# Flog Txt Version 1 # Analyzer Version: 3.1.1 # Analyzer Build Date: Oct 15 2019 14:44:06 # Log Creation Date: 20.10.2019 18:23:44.350 Process: id = "1" image_name = "1black.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1black.exe" page_root = "0x508bd000" os_pid = "0x968" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x96c [0024.928] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff6c | out: lpSystemTimeAsFileTime=0x18ff6c*(dwLowDateTime=0x8f296830, dwHighDateTime=0x1d58773)) [0024.928] GetCurrentThreadId () returned 0x96c [0024.928] GetCurrentProcessId () returned 0x968 [0024.928] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff64 | out: lpPerformanceCount=0x18ff64*=14502596366) returned 1 [0024.956] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0024.956] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0024.956] GetLastError () returned 0x57 [0024.956] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0024.956] GetLastError () returned 0x57 [0024.956] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0024.957] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0024.957] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0024.957] GetLastError () returned 0x57 [0024.957] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0024.957] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0024.957] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0024.957] GetLastError () returned 0x57 [0024.957] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0024.958] GetLastError () returned 0x57 [0024.958] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x76c20000 [0024.958] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionEx") returned 0x76c34d28 [0024.958] GetProcessHeap () returned 0x550000 [0024.958] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0024.958] GetLastError () returned 0x57 [0024.958] GetProcAddress (hModule=0x76c20000, lpProcName="FlsAlloc") returned 0x76c34f2b [0024.958] GetLastError () returned 0x57 [0024.958] GetProcAddress (hModule=0x76c20000, lpProcName="FlsGetValue") returned 0x76c31252 [0024.958] GetProcAddress (hModule=0x76c20000, lpProcName="FlsSetValue") returned 0x76c34208 [0024.958] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x364) returned 0x56abd0 [0024.959] SetLastError (dwErrCode=0x57) [0024.959] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xe00) returned 0x56af40 [0024.960] GetStartupInfoW (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40faf0, hStdOutput=0xeecc19a6, hStdError=0xfffffffe)) [0024.960] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0024.960] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0024.960] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0024.960] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe\" " [0024.960] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe\" " [0024.960] GetACP () returned 0x4e4 [0024.960] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x220) returned 0x56c548 [0024.961] IsValidCodePage (CodePage=0x4e4) returned 1 [0024.961] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fec4 | out: lpCPInfo=0x18fec4) returned 1 [0024.961] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f78c | out: lpCPInfo=0x18f78c) returned 1 [0024.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0024.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0024.961] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f7a0 | out: lpCharType=0x18f7a0) returned 1 [0024.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0024.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f4e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0024.961] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0024.961] GetLastError () returned 0x57 [0024.961] GetProcAddress (hModule=0x76c20000, lpProcName="LCMapStringEx") returned 0x76cb47f1 [0024.961] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0024.961] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0024.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18fca0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9aá\x90îÜþ\x18", lpUsedDefaultChar=0x0) returned 256 [0024.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0024.961] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0024.961] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0024.961] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0024.961] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18fba0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ\x9aá\x90îÜþ\x18", lpUsedDefaultChar=0x0) returned 256 [0024.961] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x80) returned 0x56c770 [0024.961] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fce8, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1black.exe")) returned 0x30 [0024.962] GetProcAddress (hModule=0x76c20000, lpProcName="AreFileApisANSI") returned 0x76cb40d1 [0024.962] AreFileApisANSI () returned 1 [0024.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 49 [0024.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe", cchWideChar=-1, lpMultiByteStr=0x4455c8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe", lpUsedDefaultChar=0x0) returned 49 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x39) returned 0x562270 [0024.962] RtlInitializeSListHead (in: ListHead=0x4454c8 | out: ListHead=0x4454c8) [0024.962] GetLastError () returned 0x0 [0024.962] SetLastError (dwErrCode=0x0) [0024.962] GetEnvironmentStringsW () returned 0x56c7f8* [0024.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x565) returned 0x56d2d0 [0024.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x56d2d0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0024.962] FreeEnvironmentStringsW (penv=0x56c7f8) returned 1 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x98) returned 0x56d840 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1f) returned 0x56c378 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x36) returned 0x561ce8 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x37) returned 0x56d8e0 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3c) returned 0x5622b8 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x31) returned 0x56d920 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x17) returned 0x567ba0 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x24) returned 0x561d28 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x14) returned 0x567bc0 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xd) returned 0x569870 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x25) returned 0x56d960 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x39) returned 0x562300 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x18) returned 0x567be0 [0024.962] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x17) returned 0x567c00 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xe) returned 0x569858 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x69) returned 0x56d990 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x3e) returned 0x562348 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1b) returned 0x56c3a0 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1d) returned 0x56c3c8 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x48) returned 0x56da08 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x12) returned 0x567c20 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x18) returned 0x567c40 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1b) returned 0x56c3f0 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x24) returned 0x56da58 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x29) returned 0x56da88 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56c418 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x41) returned 0x56dac0 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x17) returned 0x567c60 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0xf) returned 0x569888 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x16) returned 0x567c80 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2a) returned 0x56db10 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x29) returned 0x56db48 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x15) returned 0x567ca0 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x1e) returned 0x56c440 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x2a) returned 0x56db80 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x12) returned 0x567cc0 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x18) returned 0x567ce0 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x46) returned 0x56dbb8 [0024.963] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56d2d0 | out: hHeap=0x550000) returned 1 [0024.963] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x800) returned 0x56c7f8 [0024.963] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0024.963] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40e130) returned 0x0 [0024.964] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0024.964] DeletePwrScheme (uiID=0x0) returned 0 [0024.965] SetFocus (hWnd=0x0) returned 0x0 [0024.965] InsertMenuA (hMenu=0x0, uPosition=0x0, uFlags=0x10, uIDNewItem=0x102, lpNewItem="Файл") returned 0 [0024.965] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x8) returned 0x56dc08 [0024.965] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x56c4e0 [0024.965] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5698a0 [0024.965] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x5698b8 [0024.965] ReadProcessorPwrScheme (in: uiID=0x0, pMachineProcessorPowerPolicy=0x0 | out: pMachineProcessorPowerPolicy=0x0) returned 0 [0024.967] UnRegisterTypeLib (libID=0x18f990*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, syskind=0x1) returned 0x8002801c [0024.969] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe0 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xdc [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe4 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe8 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xec [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf0 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf4 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf8 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xfc [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x100 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x104 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x108 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x10c [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x110 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x114 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x118 [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x11c [0024.970] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.970] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x120 [0024.971] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.971] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x124 [0024.971] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.971] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x128 [0024.971] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.971] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x12c [0024.971] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.971] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x130 [0024.971] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0024.971] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5698b8 | out: hHeap=0x550000) returned 1 [0024.971] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5698a0 | out: hHeap=0x550000) returned 1 [0024.971] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56c4e0 | out: hHeap=0x550000) returned 1 [0024.971] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56dc08 | out: hHeap=0x550000) returned 1 [0024.971] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1400) returned 0x56dc08 [0024.971] GetLastError () returned 0x578 [0024.971] IsIconic (hWnd=0x0) returned 0 [0024.971] GetClientRect (in: hWnd=0x0, lpRect=0x18f980 | out: lpRect=0x18f980) returned 0 [0024.971] InvalidateRect (hWnd=0x0, lpRect=0x0, bErase=0) returned 1 [0024.996] WSAStringToAddressA (in: AddressString="", AddressFamily=-7989, lpProtocolInfo=0x0, lpAddress=0x18f900, lpAddressLength=0x18f8fc | out: lpAddress=0x18f900, lpAddressLength=0x18f8fc) returned -1 [0024.996] GetKeyState (nVirtKey=16) returned 0 [0024.996] SetFocus (hWnd=0x0) returned 0x0 [0024.996] GetSystemMetrics (nIndex=0) returned 1440 [0025.285] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x25e05f8) returned 0x0 [0025.481] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x2cb05f8) returned 0x0 [0025.490] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x30b05f8) returned 0x0 [0025.500] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x34b05f8) returned 0x0 [0025.509] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x39b05f8) returned 0x0 [0025.518] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x3eb05f8) returned 0x0 [0025.527] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x43b05f8) returned 0x0 [0025.539] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x48b05f8) returned 0x0 [0025.550] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x4db05f8) returned 0x0 [0025.559] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x52b05f8) returned 0x0 [0025.569] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x57b05f8) returned 0x0 [0025.579] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x5cb05f8) returned 0x0 [0025.588] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x61b05f8) returned 0x0 [0025.597] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x66b05f8) returned 0x0 [0025.608] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x6bb05f8) returned 0x0 [0025.618] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x70b05f8) returned 0x0 [0025.628] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x75b05f8) returned 0x0 [0025.639] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x7ab05f8) returned 0x0 [0025.651] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x7fb05f8) returned 0x0 [0025.663] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x84b05f8) returned 0x0 [0025.689] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x89b05f8) returned 0x0 [0025.699] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x8eb05f8) returned 0x0 [0025.710] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x93b05f8) returned 0x0 [0025.720] CanUserWritePwrScheme () returned 1 [0025.720] GetSystemMetrics (nIndex=46) returned 2 [0025.720] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0025.721] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0025.722] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0025.723] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.776] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.778] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.779] GetLastError () returned 0x578 [0026.779] SetLastError (dwErrCode=0x578) [0026.779] GetLastError () returned 0x578 [0026.779] SetLastError (dwErrCode=0x578) [0026.779] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1000) returned 0x5809b8 [0026.779] CanUserWritePwrScheme () returned 1 [0026.779] GetSystemMetrics (nIndex=46) returned 2 [0026.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.785] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.785] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.785] GetLastError () returned 0x578 [0026.785] SetLastError (dwErrCode=0x578) [0026.785] CanUserWritePwrScheme () returned 1 [0026.785] GetSystemMetrics (nIndex=46) returned 2 [0026.785] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.785] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.785] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.785] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.790] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.790] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.790] GetLastError () returned 0x578 [0026.790] SetLastError (dwErrCode=0x578) [0026.790] CanUserWritePwrScheme () returned 1 [0026.791] GetSystemMetrics (nIndex=46) returned 2 [0026.791] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.791] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.791] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.791] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.796] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.796] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.796] GetLastError () returned 0x578 [0026.796] SetLastError (dwErrCode=0x578) [0026.796] CanUserWritePwrScheme () returned 1 [0026.797] GetSystemMetrics (nIndex=46) returned 2 [0026.797] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.797] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.797] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.797] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.804] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.804] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.804] GetLastError () returned 0x578 [0026.804] SetLastError (dwErrCode=0x578) [0026.804] CanUserWritePwrScheme () returned 1 [0026.805] GetSystemMetrics (nIndex=46) returned 2 [0026.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.811] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.811] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.811] GetLastError () returned 0x578 [0026.812] SetLastError (dwErrCode=0x578) [0026.812] CanUserWritePwrScheme () returned 1 [0026.812] GetSystemMetrics (nIndex=46) returned 2 [0026.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.812] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.812] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.812] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.817] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.817] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.817] GetLastError () returned 0x578 [0026.817] SetLastError (dwErrCode=0x578) [0026.817] CanUserWritePwrScheme () returned 1 [0026.818] GetSystemMetrics (nIndex=46) returned 2 [0026.818] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.818] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.818] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.818] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.823] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.823] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.823] GetLastError () returned 0x578 [0026.823] SetLastError (dwErrCode=0x578) [0026.823] CanUserWritePwrScheme () returned 1 [0026.823] GetSystemMetrics (nIndex=46) returned 2 [0026.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.830] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.830] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.830] GetLastError () returned 0x578 [0026.830] SetLastError (dwErrCode=0x578) [0026.830] CanUserWritePwrScheme () returned 1 [0026.831] GetSystemMetrics (nIndex=46) returned 2 [0026.831] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.831] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.831] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.831] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.837] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.837] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.837] GetLastError () returned 0x578 [0026.837] SetLastError (dwErrCode=0x578) [0026.837] CanUserWritePwrScheme () returned 1 [0026.837] GetSystemMetrics (nIndex=46) returned 2 [0026.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.837] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.837] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.837] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.843] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.843] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.843] GetLastError () returned 0x578 [0026.843] SetLastError (dwErrCode=0x578) [0026.843] CanUserWritePwrScheme () returned 1 [0026.843] GetSystemMetrics (nIndex=46) returned 2 [0026.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.843] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.843] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.848] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.848] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.848] GetLastError () returned 0x578 [0026.849] SetLastError (dwErrCode=0x578) [0026.849] CanUserWritePwrScheme () returned 1 [0026.849] GetSystemMetrics (nIndex=46) returned 2 [0026.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.849] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.849] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.849] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.854] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.854] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.854] GetLastError () returned 0x578 [0026.854] SetLastError (dwErrCode=0x578) [0026.854] CanUserWritePwrScheme () returned 1 [0026.854] GetSystemMetrics (nIndex=46) returned 2 [0026.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.855] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.855] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.855] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.860] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.860] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.860] GetLastError () returned 0x578 [0026.860] SetLastError (dwErrCode=0x578) [0026.860] CanUserWritePwrScheme () returned 1 [0026.860] GetSystemMetrics (nIndex=46) returned 2 [0026.860] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.860] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.860] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.860] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.878] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.878] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.878] GetLastError () returned 0x578 [0026.878] SetLastError (dwErrCode=0x578) [0026.878] CanUserWritePwrScheme () returned 1 [0026.879] GetSystemMetrics (nIndex=46) returned 2 [0026.879] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.879] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.879] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.879] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.884] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.884] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.884] GetLastError () returned 0x578 [0026.884] SetLastError (dwErrCode=0x578) [0026.884] CanUserWritePwrScheme () returned 1 [0026.884] GetSystemMetrics (nIndex=46) returned 2 [0026.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.884] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.884] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.884] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.891] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.891] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.891] GetLastError () returned 0x578 [0026.891] SetLastError (dwErrCode=0x578) [0026.891] CanUserWritePwrScheme () returned 1 [0026.891] GetSystemMetrics (nIndex=46) returned 2 [0026.891] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.891] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.891] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.891] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.896] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.896] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.897] GetLastError () returned 0x578 [0026.897] SetLastError (dwErrCode=0x578) [0026.897] CanUserWritePwrScheme () returned 1 [0026.897] GetSystemMetrics (nIndex=46) returned 2 [0026.897] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.897] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.897] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.897] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.911] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.911] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.912] GetLastError () returned 0x578 [0026.912] SetLastError (dwErrCode=0x578) [0026.912] CanUserWritePwrScheme () returned 1 [0026.912] GetSystemMetrics (nIndex=46) returned 2 [0026.912] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.912] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.912] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.912] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.918] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.918] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.918] GetLastError () returned 0x578 [0026.918] SetLastError (dwErrCode=0x578) [0026.918] CanUserWritePwrScheme () returned 1 [0026.918] GetSystemMetrics (nIndex=46) returned 2 [0026.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.919] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.919] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.919] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.924] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.924] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.924] GetLastError () returned 0x578 [0026.924] SetLastError (dwErrCode=0x578) [0026.924] CanUserWritePwrScheme () returned 1 [0026.924] GetSystemMetrics (nIndex=46) returned 2 [0026.924] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.924] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.924] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.924] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.929] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.929] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.929] GetLastError () returned 0x578 [0026.929] SetLastError (dwErrCode=0x578) [0026.929] CanUserWritePwrScheme () returned 1 [0026.930] GetSystemMetrics (nIndex=46) returned 2 [0026.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.930] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.938] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.938] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.938] GetLastError () returned 0x578 [0026.938] SetLastError (dwErrCode=0x578) [0026.938] CanUserWritePwrScheme () returned 1 [0026.938] GetSystemMetrics (nIndex=46) returned 2 [0026.938] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.939] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.939] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.939] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.944] GetLastError () returned 0x578 [0026.944] SetLastError (dwErrCode=0x578) [0026.944] CanUserWritePwrScheme () returned 1 [0026.944] GetSystemMetrics (nIndex=46) returned 2 [0026.944] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.944] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.944] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.944] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.949] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.949] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.949] GetLastError () returned 0x578 [0026.949] SetLastError (dwErrCode=0x578) [0026.949] CanUserWritePwrScheme () returned 1 [0026.950] GetSystemMetrics (nIndex=46) returned 2 [0026.950] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.950] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.950] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.950] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.955] GetLastError () returned 0x578 [0026.955] SetLastError (dwErrCode=0x578) [0026.955] CanUserWritePwrScheme () returned 1 [0026.955] GetSystemMetrics (nIndex=46) returned 2 [0026.955] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.955] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.955] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.955] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.960] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.960] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.960] GetLastError () returned 0x578 [0026.960] SetLastError (dwErrCode=0x578) [0026.960] CanUserWritePwrScheme () returned 1 [0026.961] GetSystemMetrics (nIndex=46) returned 2 [0026.961] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.961] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.961] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.961] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.967] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.967] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.967] GetLastError () returned 0x578 [0026.967] SetLastError (dwErrCode=0x578) [0026.967] CanUserWritePwrScheme () returned 1 [0026.967] GetSystemMetrics (nIndex=46) returned 2 [0026.967] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.967] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.967] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.967] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.972] GetLastError () returned 0x578 [0026.972] SetLastError (dwErrCode=0x578) [0026.972] CanUserWritePwrScheme () returned 1 [0026.973] GetSystemMetrics (nIndex=46) returned 2 [0026.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.978] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.978] GetLastError () returned 0x578 [0026.978] SetLastError (dwErrCode=0x578) [0026.978] CanUserWritePwrScheme () returned 1 [0026.978] GetSystemMetrics (nIndex=46) returned 2 [0026.978] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.978] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.978] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.978] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.984] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.984] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.984] GetLastError () returned 0x578 [0026.984] SetLastError (dwErrCode=0x578) [0026.984] CanUserWritePwrScheme () returned 1 [0026.984] GetSystemMetrics (nIndex=46) returned 2 [0026.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.989] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.989] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.989] GetLastError () returned 0x578 [0026.989] SetLastError (dwErrCode=0x578) [0026.989] CanUserWritePwrScheme () returned 1 [0026.990] GetSystemMetrics (nIndex=46) returned 2 [0026.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.990] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.990] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.990] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0026.995] GetWindowTextLengthA (hWnd=0x0) returned 0 [0026.995] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0026.995] GetLastError () returned 0x578 [0026.995] SetLastError (dwErrCode=0x578) [0026.995] CanUserWritePwrScheme () returned 1 [0026.995] GetSystemMetrics (nIndex=46) returned 2 [0026.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0026.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0026.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0026.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.003] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.003] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.003] GetLastError () returned 0x578 [0027.003] SetLastError (dwErrCode=0x578) [0027.003] CanUserWritePwrScheme () returned 1 [0027.004] GetSystemMetrics (nIndex=46) returned 2 [0027.004] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.004] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.004] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.004] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.009] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.009] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.009] GetLastError () returned 0x578 [0027.009] SetLastError (dwErrCode=0x578) [0027.009] CanUserWritePwrScheme () returned 1 [0027.009] GetSystemMetrics (nIndex=46) returned 2 [0027.009] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.009] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.009] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.009] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.016] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.016] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.016] GetLastError () returned 0x578 [0027.016] SetLastError (dwErrCode=0x578) [0027.016] CanUserWritePwrScheme () returned 1 [0027.016] GetSystemMetrics (nIndex=46) returned 2 [0027.016] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.016] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.016] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.016] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.021] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.021] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.021] GetLastError () returned 0x578 [0027.021] SetLastError (dwErrCode=0x578) [0027.021] CanUserWritePwrScheme () returned 1 [0027.022] GetSystemMetrics (nIndex=46) returned 2 [0027.022] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.022] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.022] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.022] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.028] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.028] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.028] GetLastError () returned 0x578 [0027.028] SetLastError (dwErrCode=0x578) [0027.028] CanUserWritePwrScheme () returned 1 [0027.028] GetSystemMetrics (nIndex=46) returned 2 [0027.028] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.028] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.028] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.028] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.033] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.034] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.034] GetLastError () returned 0x578 [0027.034] SetLastError (dwErrCode=0x578) [0027.034] CanUserWritePwrScheme () returned 1 [0027.034] GetSystemMetrics (nIndex=46) returned 2 [0027.034] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.034] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.034] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.034] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.039] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.039] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.039] GetLastError () returned 0x578 [0027.039] SetLastError (dwErrCode=0x578) [0027.039] CanUserWritePwrScheme () returned 1 [0027.040] GetSystemMetrics (nIndex=46) returned 2 [0027.040] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.040] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.040] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.040] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.047] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.047] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.047] GetLastError () returned 0x578 [0027.047] SetLastError (dwErrCode=0x578) [0027.047] CanUserWritePwrScheme () returned 1 [0027.048] GetSystemMetrics (nIndex=46) returned 2 [0027.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.048] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.048] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.048] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.053] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.053] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.053] GetLastError () returned 0x578 [0027.053] SetLastError (dwErrCode=0x578) [0027.053] CanUserWritePwrScheme () returned 1 [0027.053] GetSystemMetrics (nIndex=46) returned 2 [0027.053] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.053] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.053] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.053] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.058] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.058] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.058] GetLastError () returned 0x578 [0027.059] SetLastError (dwErrCode=0x578) [0027.059] CanUserWritePwrScheme () returned 1 [0027.059] GetSystemMetrics (nIndex=46) returned 2 [0027.059] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.059] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.059] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.059] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.067] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.067] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.067] GetLastError () returned 0x578 [0027.067] SetLastError (dwErrCode=0x578) [0027.067] CanUserWritePwrScheme () returned 1 [0027.067] GetSystemMetrics (nIndex=46) returned 2 [0027.067] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.067] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.067] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.067] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.072] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.072] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.072] GetLastError () returned 0x578 [0027.072] SetLastError (dwErrCode=0x578) [0027.072] CanUserWritePwrScheme () returned 1 [0027.073] GetSystemMetrics (nIndex=46) returned 2 [0027.073] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.073] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.073] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.073] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.086] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.086] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.086] GetLastError () returned 0x578 [0027.086] SetLastError (dwErrCode=0x578) [0027.086] CanUserWritePwrScheme () returned 1 [0027.086] GetSystemMetrics (nIndex=46) returned 2 [0027.086] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.086] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.086] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.086] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.091] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.091] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.091] GetLastError () returned 0x578 [0027.091] SetLastError (dwErrCode=0x578) [0027.092] CanUserWritePwrScheme () returned 1 [0027.092] GetSystemMetrics (nIndex=46) returned 2 [0027.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.092] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.092] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.092] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.097] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.097] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.097] GetLastError () returned 0x578 [0027.097] SetLastError (dwErrCode=0x578) [0027.097] CanUserWritePwrScheme () returned 1 [0027.097] GetSystemMetrics (nIndex=46) returned 2 [0027.097] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.097] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.097] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.098] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.102] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.102] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.103] GetLastError () returned 0x578 [0027.103] SetLastError (dwErrCode=0x578) [0027.103] CanUserWritePwrScheme () returned 1 [0027.103] GetSystemMetrics (nIndex=46) returned 2 [0027.103] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.103] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.103] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.103] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.108] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.108] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.108] GetLastError () returned 0x578 [0027.109] SetLastError (dwErrCode=0x578) [0027.109] CanUserWritePwrScheme () returned 1 [0027.109] GetSystemMetrics (nIndex=46) returned 2 [0027.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.109] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.109] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.109] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.114] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.114] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.114] GetLastError () returned 0x578 [0027.114] SetLastError (dwErrCode=0x578) [0027.114] CanUserWritePwrScheme () returned 1 [0027.115] GetSystemMetrics (nIndex=46) returned 2 [0027.115] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.115] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.115] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.115] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.119] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.120] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.120] GetLastError () returned 0x578 [0027.120] SetLastError (dwErrCode=0x578) [0027.120] CanUserWritePwrScheme () returned 1 [0027.120] GetSystemMetrics (nIndex=46) returned 2 [0027.120] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.120] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.120] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.120] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.129] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.129] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.129] GetLastError () returned 0x578 [0027.129] SetLastError (dwErrCode=0x578) [0027.129] CanUserWritePwrScheme () returned 1 [0027.129] GetSystemMetrics (nIndex=46) returned 2 [0027.129] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.129] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.129] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.129] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.134] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.134] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.134] GetLastError () returned 0x578 [0027.134] SetLastError (dwErrCode=0x578) [0027.134] CanUserWritePwrScheme () returned 1 [0027.135] GetSystemMetrics (nIndex=46) returned 2 [0027.135] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.135] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.135] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.135] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.140] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.140] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.140] GetLastError () returned 0x578 [0027.140] SetLastError (dwErrCode=0x578) [0027.140] CanUserWritePwrScheme () returned 1 [0027.141] GetSystemMetrics (nIndex=46) returned 2 [0027.141] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.141] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.141] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.141] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.146] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.146] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.146] GetLastError () returned 0x578 [0027.146] SetLastError (dwErrCode=0x578) [0027.146] CanUserWritePwrScheme () returned 1 [0027.146] GetSystemMetrics (nIndex=46) returned 2 [0027.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.146] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.146] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.146] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.151] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.151] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.151] GetLastError () returned 0x578 [0027.152] SetLastError (dwErrCode=0x578) [0027.152] CanUserWritePwrScheme () returned 1 [0027.152] GetSystemMetrics (nIndex=46) returned 2 [0027.152] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.152] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.152] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.152] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.157] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.157] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.157] GetLastError () returned 0x578 [0027.157] SetLastError (dwErrCode=0x578) [0027.157] CanUserWritePwrScheme () returned 1 [0027.158] GetSystemMetrics (nIndex=46) returned 2 [0027.158] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.158] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.158] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.158] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.163] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.163] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.163] GetLastError () returned 0x578 [0027.163] SetLastError (dwErrCode=0x578) [0027.163] CanUserWritePwrScheme () returned 1 [0027.163] GetSystemMetrics (nIndex=46) returned 2 [0027.163] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.163] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.163] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.163] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.170] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.170] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.170] GetLastError () returned 0x578 [0027.170] SetLastError (dwErrCode=0x578) [0027.170] CanUserWritePwrScheme () returned 1 [0027.170] GetSystemMetrics (nIndex=46) returned 2 [0027.170] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.170] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.170] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.170] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.175] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.175] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.175] GetLastError () returned 0x578 [0027.176] SetLastError (dwErrCode=0x578) [0027.176] CanUserWritePwrScheme () returned 1 [0027.176] GetSystemMetrics (nIndex=46) returned 2 [0027.176] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.176] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.176] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.176] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.181] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.181] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.181] GetLastError () returned 0x578 [0027.181] SetLastError (dwErrCode=0x578) [0027.181] CanUserWritePwrScheme () returned 1 [0027.181] GetSystemMetrics (nIndex=46) returned 2 [0027.181] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.181] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.181] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.182] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.187] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.187] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.187] GetLastError () returned 0x578 [0027.187] SetLastError (dwErrCode=0x578) [0027.187] CanUserWritePwrScheme () returned 1 [0027.187] GetSystemMetrics (nIndex=46) returned 2 [0027.187] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.187] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.187] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.187] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.196] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.196] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.196] GetLastError () returned 0x578 [0027.196] SetLastError (dwErrCode=0x578) [0027.196] CanUserWritePwrScheme () returned 1 [0027.196] GetSystemMetrics (nIndex=46) returned 2 [0027.196] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.196] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.196] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.196] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.202] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.202] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.202] GetLastError () returned 0x578 [0027.202] SetLastError (dwErrCode=0x578) [0027.202] CanUserWritePwrScheme () returned 1 [0027.202] GetSystemMetrics (nIndex=46) returned 2 [0027.202] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.202] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.202] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.202] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.207] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.207] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.207] GetLastError () returned 0x578 [0027.207] SetLastError (dwErrCode=0x578) [0027.207] CanUserWritePwrScheme () returned 1 [0027.208] GetSystemMetrics (nIndex=46) returned 2 [0027.208] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.208] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.208] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.208] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.213] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.213] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.213] GetLastError () returned 0x578 [0027.213] SetLastError (dwErrCode=0x578) [0027.213] CanUserWritePwrScheme () returned 1 [0027.213] GetSystemMetrics (nIndex=46) returned 2 [0027.213] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.213] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.213] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.213] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.219] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.219] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.220] GetLastError () returned 0x578 [0027.220] SetLastError (dwErrCode=0x578) [0027.220] CanUserWritePwrScheme () returned 1 [0027.220] GetSystemMetrics (nIndex=46) returned 2 [0027.220] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.220] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.220] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.220] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.225] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.225] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.225] GetLastError () returned 0x578 [0027.225] SetLastError (dwErrCode=0x578) [0027.225] CanUserWritePwrScheme () returned 1 [0027.225] GetSystemMetrics (nIndex=46) returned 2 [0027.225] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.226] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.226] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.226] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.232] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.232] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.232] GetLastError () returned 0x578 [0027.232] SetLastError (dwErrCode=0x578) [0027.232] CanUserWritePwrScheme () returned 1 [0027.232] GetSystemMetrics (nIndex=46) returned 2 [0027.232] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.232] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.232] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.232] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.237] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.237] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.237] GetLastError () returned 0x578 [0027.237] SetLastError (dwErrCode=0x578) [0027.237] CanUserWritePwrScheme () returned 1 [0027.238] GetSystemMetrics (nIndex=46) returned 2 [0027.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.238] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.238] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.238] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.243] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.243] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.243] GetLastError () returned 0x578 [0027.243] SetLastError (dwErrCode=0x578) [0027.243] CanUserWritePwrScheme () returned 1 [0027.243] GetSystemMetrics (nIndex=46) returned 2 [0027.243] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.243] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.243] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.243] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.259] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.259] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.259] GetLastError () returned 0x578 [0027.259] SetLastError (dwErrCode=0x578) [0027.259] CanUserWritePwrScheme () returned 1 [0027.259] GetSystemMetrics (nIndex=46) returned 2 [0027.259] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.259] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.259] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.259] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.265] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.266] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.266] GetLastError () returned 0x578 [0027.266] SetLastError (dwErrCode=0x578) [0027.266] CanUserWritePwrScheme () returned 1 [0027.266] GetSystemMetrics (nIndex=46) returned 2 [0027.266] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.266] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.266] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.266] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.271] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.271] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.271] GetLastError () returned 0x578 [0027.271] SetLastError (dwErrCode=0x578) [0027.271] CanUserWritePwrScheme () returned 1 [0027.272] GetSystemMetrics (nIndex=46) returned 2 [0027.272] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.272] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.272] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.272] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.277] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.277] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.277] GetLastError () returned 0x578 [0027.277] SetLastError (dwErrCode=0x578) [0027.277] CanUserWritePwrScheme () returned 1 [0027.277] GetSystemMetrics (nIndex=46) returned 2 [0027.277] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.278] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.278] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.278] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.282] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.282] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.283] GetLastError () returned 0x578 [0027.283] SetLastError (dwErrCode=0x578) [0027.283] CanUserWritePwrScheme () returned 1 [0027.283] GetSystemMetrics (nIndex=46) returned 2 [0027.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.283] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.283] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.283] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.288] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.288] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.288] GetLastError () returned 0x578 [0027.288] SetLastError (dwErrCode=0x578) [0027.288] CanUserWritePwrScheme () returned 1 [0027.288] GetSystemMetrics (nIndex=46) returned 2 [0027.289] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.289] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.289] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.289] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.294] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.294] GetLastError () returned 0x578 [0027.294] SetLastError (dwErrCode=0x578) [0027.294] CanUserWritePwrScheme () returned 1 [0027.294] GetSystemMetrics (nIndex=46) returned 2 [0027.294] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.294] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.294] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.294] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.299] GetLastError () returned 0x578 [0027.299] SetLastError (dwErrCode=0x578) [0027.299] CanUserWritePwrScheme () returned 1 [0027.300] GetSystemMetrics (nIndex=46) returned 2 [0027.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.305] GetLastError () returned 0x578 [0027.305] SetLastError (dwErrCode=0x578) [0027.305] CanUserWritePwrScheme () returned 1 [0027.305] GetSystemMetrics (nIndex=46) returned 2 [0027.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.305] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.305] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.305] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.311] GetLastError () returned 0x578 [0027.311] SetLastError (dwErrCode=0x578) [0027.311] CanUserWritePwrScheme () returned 1 [0027.311] GetSystemMetrics (nIndex=46) returned 2 [0027.311] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.311] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.311] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.311] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.316] GetLastError () returned 0x578 [0027.316] SetLastError (dwErrCode=0x578) [0027.316] CanUserWritePwrScheme () returned 1 [0027.317] GetSystemMetrics (nIndex=46) returned 2 [0027.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.331] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.331] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.331] GetLastError () returned 0x578 [0027.332] SetLastError (dwErrCode=0x578) [0027.332] CanUserWritePwrScheme () returned 1 [0027.332] GetSystemMetrics (nIndex=46) returned 2 [0027.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.337] GetLastError () returned 0x578 [0027.337] SetLastError (dwErrCode=0x578) [0027.337] CanUserWritePwrScheme () returned 1 [0027.338] GetSystemMetrics (nIndex=46) returned 2 [0027.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.338] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.338] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.338] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.344] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.344] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.344] GetLastError () returned 0x578 [0027.344] SetLastError (dwErrCode=0x578) [0027.344] CanUserWritePwrScheme () returned 1 [0027.345] GetSystemMetrics (nIndex=46) returned 2 [0027.345] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.345] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.345] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.345] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.363] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.363] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.363] GetLastError () returned 0x578 [0027.364] SetLastError (dwErrCode=0x578) [0027.364] CanUserWritePwrScheme () returned 1 [0027.364] GetSystemMetrics (nIndex=46) returned 2 [0027.364] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.364] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.364] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.364] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.372] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.372] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.372] GetLastError () returned 0x578 [0027.372] SetLastError (dwErrCode=0x578) [0027.372] CanUserWritePwrScheme () returned 1 [0027.372] GetSystemMetrics (nIndex=46) returned 2 [0027.372] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.372] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.372] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.372] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.377] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.377] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.377] GetLastError () returned 0x578 [0027.377] SetLastError (dwErrCode=0x578) [0027.378] CanUserWritePwrScheme () returned 1 [0027.378] GetSystemMetrics (nIndex=46) returned 2 [0027.378] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.378] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.378] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.378] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.383] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.383] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.383] GetLastError () returned 0x578 [0027.383] SetLastError (dwErrCode=0x578) [0027.383] CanUserWritePwrScheme () returned 1 [0027.383] GetSystemMetrics (nIndex=46) returned 2 [0027.384] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.384] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.384] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.384] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.392] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.392] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.392] GetLastError () returned 0x578 [0027.392] SetLastError (dwErrCode=0x578) [0027.392] CanUserWritePwrScheme () returned 1 [0027.392] GetSystemMetrics (nIndex=46) returned 2 [0027.392] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.392] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.392] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.392] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.397] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.397] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.397] GetLastError () returned 0x578 [0027.397] SetLastError (dwErrCode=0x578) [0027.397] CanUserWritePwrScheme () returned 1 [0027.398] GetSystemMetrics (nIndex=46) returned 2 [0027.398] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.398] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.398] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.398] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.403] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.403] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.403] GetLastError () returned 0x578 [0027.403] SetLastError (dwErrCode=0x578) [0027.403] CanUserWritePwrScheme () returned 1 [0027.403] GetSystemMetrics (nIndex=46) returned 2 [0027.404] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.404] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.404] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.404] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.408] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.409] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.409] GetLastError () returned 0x578 [0027.409] SetLastError (dwErrCode=0x578) [0027.409] CanUserWritePwrScheme () returned 1 [0027.409] GetSystemMetrics (nIndex=46) returned 2 [0027.409] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.409] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.409] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.409] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.414] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.414] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.414] GetLastError () returned 0x578 [0027.414] SetLastError (dwErrCode=0x578) [0027.414] CanUserWritePwrScheme () returned 1 [0027.415] GetSystemMetrics (nIndex=46) returned 2 [0027.415] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.415] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.415] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.415] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.425] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.425] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.425] GetLastError () returned 0x578 [0027.425] SetLastError (dwErrCode=0x578) [0027.425] CanUserWritePwrScheme () returned 1 [0027.426] GetSystemMetrics (nIndex=46) returned 2 [0027.426] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.426] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.426] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.426] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.431] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.431] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.431] GetLastError () returned 0x578 [0027.431] SetLastError (dwErrCode=0x578) [0027.431] CanUserWritePwrScheme () returned 1 [0027.431] GetSystemMetrics (nIndex=46) returned 2 [0027.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.437] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.437] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.437] GetLastError () returned 0x578 [0027.437] SetLastError (dwErrCode=0x578) [0027.438] CanUserWritePwrScheme () returned 1 [0027.438] GetSystemMetrics (nIndex=46) returned 2 [0027.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.438] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.443] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.443] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.443] GetLastError () returned 0x578 [0027.443] SetLastError (dwErrCode=0x578) [0027.443] CanUserWritePwrScheme () returned 1 [0027.443] GetSystemMetrics (nIndex=46) returned 2 [0027.443] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.443] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.444] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.444] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.449] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.449] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.449] GetLastError () returned 0x578 [0027.449] SetLastError (dwErrCode=0x578) [0027.449] CanUserWritePwrScheme () returned 1 [0027.449] GetSystemMetrics (nIndex=46) returned 2 [0027.449] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.449] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.449] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.449] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.458] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.458] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.458] GetLastError () returned 0x578 [0027.458] SetLastError (dwErrCode=0x578) [0027.458] CanUserWritePwrScheme () returned 1 [0027.458] GetSystemMetrics (nIndex=46) returned 2 [0027.458] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.458] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.458] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.458] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.465] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.465] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.465] GetLastError () returned 0x578 [0027.465] SetLastError (dwErrCode=0x578) [0027.465] CanUserWritePwrScheme () returned 1 [0027.465] GetSystemMetrics (nIndex=46) returned 2 [0027.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.465] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.465] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.470] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.470] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.470] GetLastError () returned 0x578 [0027.470] SetLastError (dwErrCode=0x578) [0027.471] CanUserWritePwrScheme () returned 1 [0027.471] GetSystemMetrics (nIndex=46) returned 2 [0027.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.476] GetLastError () returned 0x578 [0027.476] SetLastError (dwErrCode=0x578) [0027.476] CanUserWritePwrScheme () returned 1 [0027.476] GetSystemMetrics (nIndex=46) returned 2 [0027.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.476] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.476] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.476] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.482] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.482] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.482] GetLastError () returned 0x578 [0027.482] SetLastError (dwErrCode=0x578) [0027.482] CanUserWritePwrScheme () returned 1 [0027.483] GetSystemMetrics (nIndex=46) returned 2 [0027.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.483] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.483] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.483] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.488] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.488] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.488] GetLastError () returned 0x578 [0027.488] SetLastError (dwErrCode=0x578) [0027.488] CanUserWritePwrScheme () returned 1 [0027.488] GetSystemMetrics (nIndex=46) returned 2 [0027.488] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.488] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.488] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.488] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.493] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.493] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.493] GetLastError () returned 0x578 [0027.493] SetLastError (dwErrCode=0x578) [0027.493] CanUserWritePwrScheme () returned 1 [0027.494] GetSystemMetrics (nIndex=46) returned 2 [0027.494] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.494] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.494] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.494] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.499] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.499] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.499] GetLastError () returned 0x578 [0027.499] SetLastError (dwErrCode=0x578) [0027.499] CanUserWritePwrScheme () returned 1 [0027.499] GetSystemMetrics (nIndex=46) returned 2 [0027.499] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.499] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.499] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.499] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.508] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.508] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.508] GetLastError () returned 0x578 [0027.508] SetLastError (dwErrCode=0x578) [0027.508] CanUserWritePwrScheme () returned 1 [0027.508] GetSystemMetrics (nIndex=46) returned 2 [0027.508] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.508] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.508] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.508] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.513] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.513] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.514] GetLastError () returned 0x578 [0027.514] SetLastError (dwErrCode=0x578) [0027.514] CanUserWritePwrScheme () returned 1 [0027.514] GetSystemMetrics (nIndex=46) returned 2 [0027.514] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.514] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.514] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.514] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.522] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.522] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.522] GetLastError () returned 0x578 [0027.522] SetLastError (dwErrCode=0x578) [0027.522] CanUserWritePwrScheme () returned 1 [0027.522] GetSystemMetrics (nIndex=46) returned 2 [0027.522] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.522] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.523] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.523] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.531] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.531] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.531] GetLastError () returned 0x578 [0027.531] SetLastError (dwErrCode=0x578) [0027.531] CanUserWritePwrScheme () returned 1 [0027.531] GetSystemMetrics (nIndex=46) returned 2 [0027.531] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.531] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.531] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.531] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.537] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.537] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.537] GetLastError () returned 0x578 [0027.537] SetLastError (dwErrCode=0x578) [0027.537] CanUserWritePwrScheme () returned 1 [0027.537] GetSystemMetrics (nIndex=46) returned 2 [0027.537] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.537] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.537] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.537] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.542] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.542] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.543] GetLastError () returned 0x578 [0027.543] SetLastError (dwErrCode=0x578) [0027.543] CanUserWritePwrScheme () returned 1 [0027.543] GetSystemMetrics (nIndex=46) returned 2 [0027.543] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.543] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.543] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.543] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.548] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.548] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.548] GetLastError () returned 0x578 [0027.548] SetLastError (dwErrCode=0x578) [0027.548] CanUserWritePwrScheme () returned 1 [0027.548] GetSystemMetrics (nIndex=46) returned 2 [0027.548] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.549] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.549] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.549] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.559] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.559] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.559] GetLastError () returned 0x578 [0027.559] SetLastError (dwErrCode=0x578) [0027.559] CanUserWritePwrScheme () returned 1 [0027.559] GetSystemMetrics (nIndex=46) returned 2 [0027.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.559] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.559] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.559] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.567] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.567] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.568] GetLastError () returned 0x578 [0027.568] SetLastError (dwErrCode=0x578) [0027.568] CanUserWritePwrScheme () returned 1 [0027.568] GetSystemMetrics (nIndex=46) returned 2 [0027.568] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.568] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.568] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.568] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.576] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.576] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.576] GetLastError () returned 0x578 [0027.576] SetLastError (dwErrCode=0x578) [0027.576] CanUserWritePwrScheme () returned 1 [0027.576] GetSystemMetrics (nIndex=46) returned 2 [0027.576] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.577] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.577] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.577] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.584] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.584] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.584] GetLastError () returned 0x578 [0027.584] SetLastError (dwErrCode=0x578) [0027.584] CanUserWritePwrScheme () returned 1 [0027.585] GetSystemMetrics (nIndex=46) returned 2 [0027.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.585] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.585] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.585] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.590] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.590] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.590] GetLastError () returned 0x578 [0027.591] SetLastError (dwErrCode=0x578) [0027.591] CanUserWritePwrScheme () returned 1 [0027.591] GetSystemMetrics (nIndex=46) returned 2 [0027.591] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.591] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.591] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.591] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.596] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.596] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.596] GetLastError () returned 0x578 [0027.596] SetLastError (dwErrCode=0x578) [0027.596] CanUserWritePwrScheme () returned 1 [0027.596] GetSystemMetrics (nIndex=46) returned 2 [0027.596] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.596] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.596] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.597] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.601] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.601] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.601] GetLastError () returned 0x578 [0027.601] SetLastError (dwErrCode=0x578) [0027.602] CanUserWritePwrScheme () returned 1 [0027.602] GetSystemMetrics (nIndex=46) returned 2 [0027.602] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.602] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.602] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.602] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.607] GetLastError () returned 0x578 [0027.607] SetLastError (dwErrCode=0x578) [0027.607] CanUserWritePwrScheme () returned 1 [0027.608] GetSystemMetrics (nIndex=46) returned 2 [0027.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.608] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.608] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.608] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.613] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.613] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.613] GetLastError () returned 0x578 [0027.613] SetLastError (dwErrCode=0x578) [0027.613] CanUserWritePwrScheme () returned 1 [0027.614] GetSystemMetrics (nIndex=46) returned 2 [0027.614] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.614] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.614] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.614] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.619] GetLastError () returned 0x578 [0027.619] SetLastError (dwErrCode=0x578) [0027.619] CanUserWritePwrScheme () returned 1 [0027.619] GetSystemMetrics (nIndex=46) returned 2 [0027.619] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.619] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.619] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.619] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.625] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.625] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.625] GetLastError () returned 0x578 [0027.625] SetLastError (dwErrCode=0x578) [0027.625] CanUserWritePwrScheme () returned 1 [0027.626] GetSystemMetrics (nIndex=46) returned 2 [0027.626] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.626] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.626] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.626] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.631] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.631] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.631] GetLastError () returned 0x578 [0027.631] SetLastError (dwErrCode=0x578) [0027.631] CanUserWritePwrScheme () returned 1 [0027.631] GetSystemMetrics (nIndex=46) returned 2 [0027.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.638] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.638] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.638] GetLastError () returned 0x578 [0027.638] SetLastError (dwErrCode=0x578) [0027.638] CanUserWritePwrScheme () returned 1 [0027.639] GetSystemMetrics (nIndex=46) returned 2 [0027.639] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.639] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.639] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.639] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.644] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.644] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.644] GetLastError () returned 0x578 [0027.644] SetLastError (dwErrCode=0x578) [0027.644] CanUserWritePwrScheme () returned 1 [0027.644] GetSystemMetrics (nIndex=46) returned 2 [0027.644] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.644] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.644] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.644] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.716] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.716] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.716] GetLastError () returned 0x578 [0027.716] SetLastError (dwErrCode=0x578) [0027.716] CanUserWritePwrScheme () returned 1 [0027.716] GetSystemMetrics (nIndex=46) returned 2 [0027.717] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.717] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.717] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.717] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.722] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.722] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.722] GetLastError () returned 0x578 [0027.722] SetLastError (dwErrCode=0x578) [0027.722] CanUserWritePwrScheme () returned 1 [0027.722] GetSystemMetrics (nIndex=46) returned 2 [0027.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.722] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.722] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.722] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.727] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.727] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.727] GetLastError () returned 0x578 [0027.727] SetLastError (dwErrCode=0x578) [0027.727] CanUserWritePwrScheme () returned 1 [0027.728] GetSystemMetrics (nIndex=46) returned 2 [0027.728] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.728] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.728] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.728] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.733] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.733] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.733] GetLastError () returned 0x578 [0027.733] SetLastError (dwErrCode=0x578) [0027.733] CanUserWritePwrScheme () returned 1 [0027.733] GetSystemMetrics (nIndex=46) returned 2 [0027.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.733] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.733] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.733] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.738] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.738] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.738] GetLastError () returned 0x578 [0027.738] SetLastError (dwErrCode=0x578) [0027.738] CanUserWritePwrScheme () returned 1 [0027.739] GetSystemMetrics (nIndex=46) returned 2 [0027.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.739] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.739] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.739] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.744] GetLastError () returned 0x578 [0027.744] SetLastError (dwErrCode=0x578) [0027.744] CanUserWritePwrScheme () returned 1 [0027.744] GetSystemMetrics (nIndex=46) returned 2 [0027.744] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.744] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.744] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.744] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.750] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.750] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.750] GetLastError () returned 0x578 [0027.750] SetLastError (dwErrCode=0x578) [0027.750] CanUserWritePwrScheme () returned 1 [0027.750] GetSystemMetrics (nIndex=46) returned 2 [0027.750] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.750] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.750] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.750] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.755] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.755] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.755] GetLastError () returned 0x578 [0027.755] SetLastError (dwErrCode=0x578) [0027.755] CanUserWritePwrScheme () returned 1 [0027.756] GetSystemMetrics (nIndex=46) returned 2 [0027.756] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.756] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.756] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.756] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.761] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.761] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.761] GetLastError () returned 0x578 [0027.761] SetLastError (dwErrCode=0x578) [0027.761] CanUserWritePwrScheme () returned 1 [0027.762] GetSystemMetrics (nIndex=46) returned 2 [0027.762] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.762] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.762] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.762] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.767] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.767] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.767] GetLastError () returned 0x578 [0027.767] SetLastError (dwErrCode=0x578) [0027.767] CanUserWritePwrScheme () returned 1 [0027.767] GetSystemMetrics (nIndex=46) returned 2 [0027.767] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.767] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.767] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.767] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.772] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.772] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.772] GetLastError () returned 0x578 [0027.772] SetLastError (dwErrCode=0x578) [0027.772] CanUserWritePwrScheme () returned 1 [0027.773] GetSystemMetrics (nIndex=46) returned 2 [0027.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.773] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.773] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.788] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.788] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.788] GetLastError () returned 0x578 [0027.788] SetLastError (dwErrCode=0x578) [0027.788] CanUserWritePwrScheme () returned 1 [0027.789] GetSystemMetrics (nIndex=46) returned 2 [0027.789] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.789] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.789] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.789] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.798] GetLastError () returned 0x578 [0027.798] SetLastError (dwErrCode=0x578) [0027.798] CanUserWritePwrScheme () returned 1 [0027.799] GetSystemMetrics (nIndex=46) returned 2 [0027.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.799] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.799] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.799] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.804] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.804] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.804] GetLastError () returned 0x578 [0027.804] SetLastError (dwErrCode=0x578) [0027.804] CanUserWritePwrScheme () returned 1 [0027.804] GetSystemMetrics (nIndex=46) returned 2 [0027.804] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.804] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.804] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.804] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.809] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.809] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.809] GetLastError () returned 0x578 [0027.809] SetLastError (dwErrCode=0x578) [0027.810] CanUserWritePwrScheme () returned 1 [0027.810] GetSystemMetrics (nIndex=46) returned 2 [0027.810] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.810] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.810] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.810] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.815] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.815] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.815] GetLastError () returned 0x578 [0027.815] SetLastError (dwErrCode=0x578) [0027.815] CanUserWritePwrScheme () returned 1 [0027.815] GetSystemMetrics (nIndex=46) returned 2 [0027.815] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.815] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.815] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.816] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.820] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.820] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.820] GetLastError () returned 0x578 [0027.821] SetLastError (dwErrCode=0x578) [0027.821] CanUserWritePwrScheme () returned 1 [0027.821] GetSystemMetrics (nIndex=46) returned 2 [0027.821] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.821] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.821] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.821] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.826] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.826] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.826] GetLastError () returned 0x578 [0027.826] SetLastError (dwErrCode=0x578) [0027.826] CanUserWritePwrScheme () returned 1 [0027.827] GetSystemMetrics (nIndex=46) returned 2 [0027.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.827] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.827] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.827] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.832] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.832] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.832] GetLastError () returned 0x578 [0027.832] SetLastError (dwErrCode=0x578) [0027.832] CanUserWritePwrScheme () returned 1 [0027.832] GetSystemMetrics (nIndex=46) returned 2 [0027.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.832] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.832] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.832] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.837] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.837] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.837] GetLastError () returned 0x578 [0027.837] SetLastError (dwErrCode=0x578) [0027.837] CanUserWritePwrScheme () returned 1 [0027.838] GetSystemMetrics (nIndex=46) returned 2 [0027.838] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.838] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.838] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.839] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.847] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.847] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.847] GetLastError () returned 0x578 [0027.847] SetLastError (dwErrCode=0x578) [0027.847] CanUserWritePwrScheme () returned 1 [0027.847] GetSystemMetrics (nIndex=46) returned 2 [0027.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.847] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.847] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.847] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.852] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.852] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.852] GetLastError () returned 0x578 [0027.852] SetLastError (dwErrCode=0x578) [0027.852] CanUserWritePwrScheme () returned 1 [0027.853] GetSystemMetrics (nIndex=46) returned 2 [0027.853] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.853] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.853] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.853] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.858] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.858] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.858] GetLastError () returned 0x578 [0027.858] SetLastError (dwErrCode=0x578) [0027.858] CanUserWritePwrScheme () returned 1 [0027.858] GetSystemMetrics (nIndex=46) returned 2 [0027.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.859] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.859] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.859] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.881] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.881] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.881] GetLastError () returned 0x578 [0027.881] SetLastError (dwErrCode=0x578) [0027.882] CanUserWritePwrScheme () returned 1 [0027.882] GetSystemMetrics (nIndex=46) returned 2 [0027.882] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.882] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.882] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.882] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.891] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.891] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.891] GetLastError () returned 0x578 [0027.891] SetLastError (dwErrCode=0x578) [0027.891] CanUserWritePwrScheme () returned 1 [0027.892] GetSystemMetrics (nIndex=46) returned 2 [0027.892] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.892] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.892] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.892] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.897] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.897] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.897] GetLastError () returned 0x578 [0027.897] SetLastError (dwErrCode=0x578) [0027.897] CanUserWritePwrScheme () returned 1 [0027.897] GetSystemMetrics (nIndex=46) returned 2 [0027.897] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.897] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.897] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.897] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.904] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.904] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.904] GetLastError () returned 0x578 [0027.904] SetLastError (dwErrCode=0x578) [0027.904] CanUserWritePwrScheme () returned 1 [0027.904] GetSystemMetrics (nIndex=46) returned 2 [0027.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.904] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.904] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.904] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.912] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.912] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.912] GetLastError () returned 0x578 [0027.912] SetLastError (dwErrCode=0x578) [0027.912] CanUserWritePwrScheme () returned 1 [0027.912] GetSystemMetrics (nIndex=46) returned 2 [0027.912] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.912] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.912] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.912] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.918] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.918] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.918] GetLastError () returned 0x578 [0027.918] SetLastError (dwErrCode=0x578) [0027.918] CanUserWritePwrScheme () returned 1 [0027.918] GetSystemMetrics (nIndex=46) returned 2 [0027.919] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.919] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.919] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.919] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.924] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.924] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.924] GetLastError () returned 0x578 [0027.924] SetLastError (dwErrCode=0x578) [0027.924] CanUserWritePwrScheme () returned 1 [0027.924] GetSystemMetrics (nIndex=46) returned 2 [0027.924] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.924] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.925] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.925] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.930] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.930] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.930] GetLastError () returned 0x578 [0027.930] SetLastError (dwErrCode=0x578) [0027.930] CanUserWritePwrScheme () returned 1 [0027.930] GetSystemMetrics (nIndex=46) returned 2 [0027.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.930] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.936] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.936] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.936] GetLastError () returned 0x578 [0027.936] SetLastError (dwErrCode=0x578) [0027.936] CanUserWritePwrScheme () returned 1 [0027.936] GetSystemMetrics (nIndex=46) returned 2 [0027.936] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.936] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.936] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.936] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.941] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.941] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.941] GetLastError () returned 0x578 [0027.941] SetLastError (dwErrCode=0x578) [0027.941] CanUserWritePwrScheme () returned 1 [0027.942] GetSystemMetrics (nIndex=46) returned 2 [0027.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.947] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.947] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.947] GetLastError () returned 0x578 [0027.947] SetLastError (dwErrCode=0x578) [0027.947] CanUserWritePwrScheme () returned 1 [0027.947] GetSystemMetrics (nIndex=46) returned 2 [0027.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.947] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.947] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.947] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.952] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.952] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.952] GetLastError () returned 0x578 [0027.952] SetLastError (dwErrCode=0x578) [0027.952] CanUserWritePwrScheme () returned 1 [0027.953] GetSystemMetrics (nIndex=46) returned 2 [0027.953] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.953] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.953] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.953] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.958] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.958] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.958] GetLastError () returned 0x578 [0027.958] SetLastError (dwErrCode=0x578) [0027.958] CanUserWritePwrScheme () returned 1 [0027.958] GetSystemMetrics (nIndex=46) returned 2 [0027.958] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.958] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.958] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.958] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.964] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.964] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.964] GetLastError () returned 0x578 [0027.964] SetLastError (dwErrCode=0x578) [0027.964] CanUserWritePwrScheme () returned 1 [0027.965] GetSystemMetrics (nIndex=46) returned 2 [0027.965] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.965] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.965] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.965] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.970] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.970] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.970] GetLastError () returned 0x578 [0027.970] SetLastError (dwErrCode=0x578) [0027.970] CanUserWritePwrScheme () returned 1 [0027.970] GetSystemMetrics (nIndex=46) returned 2 [0027.970] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.970] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.970] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.970] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.981] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.981] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.981] GetLastError () returned 0x578 [0027.981] SetLastError (dwErrCode=0x578) [0027.981] CanUserWritePwrScheme () returned 1 [0027.981] GetSystemMetrics (nIndex=46) returned 2 [0027.981] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.981] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.981] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.981] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.986] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.986] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.986] GetLastError () returned 0x578 [0027.986] SetLastError (dwErrCode=0x578) [0027.986] CanUserWritePwrScheme () returned 1 [0027.987] GetSystemMetrics (nIndex=46) returned 2 [0027.987] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.987] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.987] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.987] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.992] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.992] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.992] GetLastError () returned 0x578 [0027.992] SetLastError (dwErrCode=0x578) [0027.992] CanUserWritePwrScheme () returned 1 [0027.992] GetSystemMetrics (nIndex=46) returned 2 [0027.992] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.992] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.992] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.992] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0027.997] GetWindowTextLengthA (hWnd=0x0) returned 0 [0027.997] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0027.997] GetLastError () returned 0x578 [0027.997] SetLastError (dwErrCode=0x578) [0027.997] CanUserWritePwrScheme () returned 1 [0027.998] GetSystemMetrics (nIndex=46) returned 2 [0027.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0027.998] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0027.998] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0027.998] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.003] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.003] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.003] GetLastError () returned 0x578 [0028.003] SetLastError (dwErrCode=0x578) [0028.003] CanUserWritePwrScheme () returned 1 [0028.003] GetSystemMetrics (nIndex=46) returned 2 [0028.003] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.003] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.003] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.003] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.008] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.008] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.008] GetLastError () returned 0x578 [0028.008] SetLastError (dwErrCode=0x578) [0028.008] CanUserWritePwrScheme () returned 1 [0028.009] GetSystemMetrics (nIndex=46) returned 2 [0028.009] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.009] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.009] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.009] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.021] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.021] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.021] GetLastError () returned 0x578 [0028.021] SetLastError (dwErrCode=0x578) [0028.021] CanUserWritePwrScheme () returned 1 [0028.022] GetSystemMetrics (nIndex=46) returned 2 [0028.022] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.022] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.022] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.022] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.027] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.027] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.027] GetLastError () returned 0x578 [0028.027] SetLastError (dwErrCode=0x578) [0028.027] CanUserWritePwrScheme () returned 1 [0028.028] GetSystemMetrics (nIndex=46) returned 2 [0028.028] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.028] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.028] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.028] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.033] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.033] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.033] GetLastError () returned 0x578 [0028.033] SetLastError (dwErrCode=0x578) [0028.033] CanUserWritePwrScheme () returned 1 [0028.034] GetSystemMetrics (nIndex=46) returned 2 [0028.034] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.034] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.034] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.034] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.042] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.042] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.042] GetLastError () returned 0x578 [0028.042] SetLastError (dwErrCode=0x578) [0028.042] CanUserWritePwrScheme () returned 1 [0028.043] GetSystemMetrics (nIndex=46) returned 2 [0028.043] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.043] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.043] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.043] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.048] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.048] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.048] GetLastError () returned 0x578 [0028.048] SetLastError (dwErrCode=0x578) [0028.048] CanUserWritePwrScheme () returned 1 [0028.049] GetSystemMetrics (nIndex=46) returned 2 [0028.049] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.049] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.049] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.049] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.054] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.054] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.054] GetLastError () returned 0x578 [0028.054] SetLastError (dwErrCode=0x578) [0028.054] CanUserWritePwrScheme () returned 1 [0028.055] GetSystemMetrics (nIndex=46) returned 2 [0028.055] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.055] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.055] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.055] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.060] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.060] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.060] GetLastError () returned 0x578 [0028.060] SetLastError (dwErrCode=0x578) [0028.060] CanUserWritePwrScheme () returned 1 [0028.061] GetSystemMetrics (nIndex=46) returned 2 [0028.061] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.061] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.061] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.061] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.066] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.066] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.066] GetLastError () returned 0x578 [0028.066] SetLastError (dwErrCode=0x578) [0028.066] CanUserWritePwrScheme () returned 1 [0028.066] GetSystemMetrics (nIndex=46) returned 2 [0028.066] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.066] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.066] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.066] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.071] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.071] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.071] GetLastError () returned 0x578 [0028.072] SetLastError (dwErrCode=0x578) [0028.072] CanUserWritePwrScheme () returned 1 [0028.072] GetSystemMetrics (nIndex=46) returned 2 [0028.072] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.072] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.072] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.072] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.077] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.077] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.077] GetLastError () returned 0x578 [0028.077] SetLastError (dwErrCode=0x578) [0028.078] CanUserWritePwrScheme () returned 1 [0028.078] GetSystemMetrics (nIndex=46) returned 2 [0028.078] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.078] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.078] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.078] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.083] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.083] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.083] GetLastError () returned 0x578 [0028.083] SetLastError (dwErrCode=0x578) [0028.083] CanUserWritePwrScheme () returned 1 [0028.083] GetSystemMetrics (nIndex=46) returned 2 [0028.083] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.083] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.083] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.083] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.089] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.089] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.089] GetLastError () returned 0x578 [0028.089] SetLastError (dwErrCode=0x578) [0028.089] CanUserWritePwrScheme () returned 1 [0028.089] GetSystemMetrics (nIndex=46) returned 2 [0028.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.089] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.089] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.089] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.094] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.094] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.094] GetLastError () returned 0x578 [0028.094] SetLastError (dwErrCode=0x578) [0028.094] CanUserWritePwrScheme () returned 1 [0028.095] GetSystemMetrics (nIndex=46) returned 2 [0028.095] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.095] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.095] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.095] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.100] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.100] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.100] GetLastError () returned 0x578 [0028.100] SetLastError (dwErrCode=0x578) [0028.100] CanUserWritePwrScheme () returned 1 [0028.100] GetSystemMetrics (nIndex=46) returned 2 [0028.100] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.100] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.100] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.100] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.108] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.108] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.108] GetLastError () returned 0x578 [0028.108] SetLastError (dwErrCode=0x578) [0028.109] CanUserWritePwrScheme () returned 1 [0028.109] GetSystemMetrics (nIndex=46) returned 2 [0028.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.109] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.109] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.109] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.114] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.114] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.114] GetLastError () returned 0x578 [0028.114] SetLastError (dwErrCode=0x578) [0028.114] CanUserWritePwrScheme () returned 1 [0028.114] GetSystemMetrics (nIndex=46) returned 2 [0028.114] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.114] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.114] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.114] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.120] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.120] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.120] GetLastError () returned 0x578 [0028.120] SetLastError (dwErrCode=0x578) [0028.120] CanUserWritePwrScheme () returned 1 [0028.120] GetSystemMetrics (nIndex=46) returned 2 [0028.120] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.120] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.120] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.120] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.125] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.125] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.125] GetLastError () returned 0x578 [0028.125] SetLastError (dwErrCode=0x578) [0028.125] CanUserWritePwrScheme () returned 1 [0028.126] GetSystemMetrics (nIndex=46) returned 2 [0028.126] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.126] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.126] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.126] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.130] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.130] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.131] GetLastError () returned 0x578 [0028.131] SetLastError (dwErrCode=0x578) [0028.131] CanUserWritePwrScheme () returned 1 [0028.131] GetSystemMetrics (nIndex=46) returned 2 [0028.131] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.131] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.131] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.131] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.136] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.136] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.136] GetLastError () returned 0x578 [0028.136] SetLastError (dwErrCode=0x578) [0028.136] CanUserWritePwrScheme () returned 1 [0028.137] GetSystemMetrics (nIndex=46) returned 2 [0028.137] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.137] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.137] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.137] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.142] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.142] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.142] GetLastError () returned 0x578 [0028.142] SetLastError (dwErrCode=0x578) [0028.142] CanUserWritePwrScheme () returned 1 [0028.142] GetSystemMetrics (nIndex=46) returned 2 [0028.142] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.142] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.142] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.142] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.147] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.147] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.147] GetLastError () returned 0x578 [0028.147] SetLastError (dwErrCode=0x578) [0028.147] CanUserWritePwrScheme () returned 1 [0028.148] GetSystemMetrics (nIndex=46) returned 2 [0028.148] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.148] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.148] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.148] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.153] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.153] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.153] GetLastError () returned 0x578 [0028.153] SetLastError (dwErrCode=0x578) [0028.153] CanUserWritePwrScheme () returned 1 [0028.154] GetSystemMetrics (nIndex=46) returned 2 [0028.154] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.154] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.154] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.154] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.160] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.160] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.160] GetLastError () returned 0x578 [0028.160] SetLastError (dwErrCode=0x578) [0028.160] CanUserWritePwrScheme () returned 1 [0028.160] GetSystemMetrics (nIndex=46) returned 2 [0028.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.160] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.160] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.160] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.165] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.165] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.165] GetLastError () returned 0x578 [0028.165] SetLastError (dwErrCode=0x578) [0028.165] CanUserWritePwrScheme () returned 1 [0028.166] GetSystemMetrics (nIndex=46) returned 2 [0028.166] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.166] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.166] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.166] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.174] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.175] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.175] GetLastError () returned 0x578 [0028.175] SetLastError (dwErrCode=0x578) [0028.175] CanUserWritePwrScheme () returned 1 [0028.175] GetSystemMetrics (nIndex=46) returned 2 [0028.175] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.175] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.175] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.175] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.180] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.180] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.180] GetLastError () returned 0x578 [0028.180] SetLastError (dwErrCode=0x578) [0028.180] CanUserWritePwrScheme () returned 1 [0028.181] GetSystemMetrics (nIndex=46) returned 2 [0028.181] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.181] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.181] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.181] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.186] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.186] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.186] GetLastError () returned 0x578 [0028.186] SetLastError (dwErrCode=0x578) [0028.186] CanUserWritePwrScheme () returned 1 [0028.186] GetSystemMetrics (nIndex=46) returned 2 [0028.186] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.186] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.186] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.186] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.192] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.192] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.192] GetLastError () returned 0x578 [0028.192] SetLastError (dwErrCode=0x578) [0028.192] CanUserWritePwrScheme () returned 1 [0028.192] GetSystemMetrics (nIndex=46) returned 2 [0028.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.192] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.192] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.192] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.197] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.197] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.198] GetLastError () returned 0x578 [0028.198] SetLastError (dwErrCode=0x578) [0028.198] CanUserWritePwrScheme () returned 1 [0028.198] GetSystemMetrics (nIndex=46) returned 2 [0028.198] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.198] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.198] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.198] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.203] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.203] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.203] GetLastError () returned 0x578 [0028.203] SetLastError (dwErrCode=0x578) [0028.203] CanUserWritePwrScheme () returned 1 [0028.204] GetSystemMetrics (nIndex=46) returned 2 [0028.204] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.204] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.204] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.204] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.209] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.209] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.209] GetLastError () returned 0x578 [0028.209] SetLastError (dwErrCode=0x578) [0028.209] CanUserWritePwrScheme () returned 1 [0028.209] GetSystemMetrics (nIndex=46) returned 2 [0028.209] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.209] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.209] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.209] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.215] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.215] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.215] GetLastError () returned 0x578 [0028.215] SetLastError (dwErrCode=0x578) [0028.215] CanUserWritePwrScheme () returned 1 [0028.215] GetSystemMetrics (nIndex=46) returned 2 [0028.215] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.215] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.215] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.215] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.222] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.222] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.222] GetLastError () returned 0x578 [0028.222] SetLastError (dwErrCode=0x578) [0028.222] CanUserWritePwrScheme () returned 1 [0028.223] GetSystemMetrics (nIndex=46) returned 2 [0028.223] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.223] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.223] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.223] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.230] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.230] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.230] GetLastError () returned 0x578 [0028.230] SetLastError (dwErrCode=0x578) [0028.230] CanUserWritePwrScheme () returned 1 [0028.230] GetSystemMetrics (nIndex=46) returned 2 [0028.230] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.230] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.230] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.230] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.239] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.239] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.239] GetLastError () returned 0x578 [0028.239] SetLastError (dwErrCode=0x578) [0028.239] CanUserWritePwrScheme () returned 1 [0028.240] GetSystemMetrics (nIndex=46) returned 2 [0028.240] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.240] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.240] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.240] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.248] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.248] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.248] GetLastError () returned 0x578 [0028.248] SetLastError (dwErrCode=0x578) [0028.248] CanUserWritePwrScheme () returned 1 [0028.248] GetSystemMetrics (nIndex=46) returned 2 [0028.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.248] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.248] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.248] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.255] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.255] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.255] GetLastError () returned 0x578 [0028.255] SetLastError (dwErrCode=0x578) [0028.255] CanUserWritePwrScheme () returned 1 [0028.255] GetSystemMetrics (nIndex=46) returned 2 [0028.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.256] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.256] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.262] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.262] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.263] GetLastError () returned 0x578 [0028.263] SetLastError (dwErrCode=0x578) [0028.263] CanUserWritePwrScheme () returned 1 [0028.263] GetSystemMetrics (nIndex=46) returned 2 [0028.263] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.263] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.263] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.263] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.270] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.270] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.270] GetLastError () returned 0x578 [0028.270] SetLastError (dwErrCode=0x578) [0028.270] CanUserWritePwrScheme () returned 1 [0028.271] GetSystemMetrics (nIndex=46) returned 2 [0028.271] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.271] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.271] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.271] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.278] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.278] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.278] GetLastError () returned 0x578 [0028.278] SetLastError (dwErrCode=0x578) [0028.278] CanUserWritePwrScheme () returned 1 [0028.279] GetSystemMetrics (nIndex=46) returned 2 [0028.279] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.279] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.279] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.279] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.285] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.285] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.285] GetLastError () returned 0x578 [0028.285] SetLastError (dwErrCode=0x578) [0028.285] CanUserWritePwrScheme () returned 1 [0028.286] GetSystemMetrics (nIndex=46) returned 2 [0028.286] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.286] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.286] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.286] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.294] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.294] GetLastError () returned 0x578 [0028.294] SetLastError (dwErrCode=0x578) [0028.294] CanUserWritePwrScheme () returned 1 [0028.294] GetSystemMetrics (nIndex=46) returned 2 [0028.294] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.305] GetLastError () returned 0x578 [0028.305] SetLastError (dwErrCode=0x578) [0028.305] CanUserWritePwrScheme () returned 1 [0028.305] GetSystemMetrics (nIndex=46) returned 2 [0028.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.306] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.306] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.306] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.312] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.312] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.312] GetLastError () returned 0x578 [0028.313] SetLastError (dwErrCode=0x578) [0028.313] CanUserWritePwrScheme () returned 1 [0028.313] GetSystemMetrics (nIndex=46) returned 2 [0028.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.313] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.313] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.313] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.320] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.320] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.320] GetLastError () returned 0x578 [0028.320] SetLastError (dwErrCode=0x578) [0028.320] CanUserWritePwrScheme () returned 1 [0028.321] GetSystemMetrics (nIndex=46) returned 2 [0028.321] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.321] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.321] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.321] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.328] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.328] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.328] GetLastError () returned 0x578 [0028.328] SetLastError (dwErrCode=0x578) [0028.328] CanUserWritePwrScheme () returned 1 [0028.329] GetSystemMetrics (nIndex=46) returned 2 [0028.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.336] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.336] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.336] GetLastError () returned 0x578 [0028.336] SetLastError (dwErrCode=0x578) [0028.336] CanUserWritePwrScheme () returned 1 [0028.337] GetSystemMetrics (nIndex=46) returned 2 [0028.337] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.337] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.337] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.337] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.344] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.344] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.344] GetLastError () returned 0x578 [0028.344] SetLastError (dwErrCode=0x578) [0028.344] CanUserWritePwrScheme () returned 1 [0028.345] GetSystemMetrics (nIndex=46) returned 2 [0028.345] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.345] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.345] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.345] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.351] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.351] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.352] GetLastError () returned 0x578 [0028.352] SetLastError (dwErrCode=0x578) [0028.352] CanUserWritePwrScheme () returned 1 [0028.352] GetSystemMetrics (nIndex=46) returned 2 [0028.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.352] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.352] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.352] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.359] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.359] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.359] GetLastError () returned 0x578 [0028.359] SetLastError (dwErrCode=0x578) [0028.359] CanUserWritePwrScheme () returned 1 [0028.360] GetSystemMetrics (nIndex=46) returned 2 [0028.360] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.360] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.360] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.360] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.369] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.369] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.369] GetLastError () returned 0x578 [0028.369] SetLastError (dwErrCode=0x578) [0028.369] CanUserWritePwrScheme () returned 1 [0028.370] GetSystemMetrics (nIndex=46) returned 2 [0028.370] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.370] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.370] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.370] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.376] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.376] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.377] GetLastError () returned 0x578 [0028.377] SetLastError (dwErrCode=0x578) [0028.377] CanUserWritePwrScheme () returned 1 [0028.377] GetSystemMetrics (nIndex=46) returned 2 [0028.377] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.377] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.377] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.377] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.385] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.385] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.385] GetLastError () returned 0x578 [0028.385] SetLastError (dwErrCode=0x578) [0028.385] CanUserWritePwrScheme () returned 1 [0028.385] GetSystemMetrics (nIndex=46) returned 2 [0028.385] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.385] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.385] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.385] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.392] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.392] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.392] GetLastError () returned 0x578 [0028.392] SetLastError (dwErrCode=0x578) [0028.392] CanUserWritePwrScheme () returned 1 [0028.393] GetSystemMetrics (nIndex=46) returned 2 [0028.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.393] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.393] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.393] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.400] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.400] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.400] GetLastError () returned 0x578 [0028.400] SetLastError (dwErrCode=0x578) [0028.400] CanUserWritePwrScheme () returned 1 [0028.401] GetSystemMetrics (nIndex=46) returned 2 [0028.401] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.401] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.401] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.401] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.407] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.407] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.407] GetLastError () returned 0x578 [0028.407] SetLastError (dwErrCode=0x578) [0028.408] CanUserWritePwrScheme () returned 1 [0028.408] GetSystemMetrics (nIndex=46) returned 2 [0028.408] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.408] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.408] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.408] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.415] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.415] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.415] GetLastError () returned 0x578 [0028.415] SetLastError (dwErrCode=0x578) [0028.415] CanUserWritePwrScheme () returned 1 [0028.426] GetSystemMetrics (nIndex=46) returned 2 [0028.427] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.427] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.427] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.427] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.436] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.436] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.437] GetLastError () returned 0x578 [0028.437] SetLastError (dwErrCode=0x578) [0028.437] CanUserWritePwrScheme () returned 1 [0028.437] GetSystemMetrics (nIndex=46) returned 2 [0028.437] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.437] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.437] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.437] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.444] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.444] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.444] GetLastError () returned 0x578 [0028.444] SetLastError (dwErrCode=0x578) [0028.445] CanUserWritePwrScheme () returned 1 [0028.445] GetSystemMetrics (nIndex=46) returned 2 [0028.445] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.445] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.445] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.445] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.453] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.453] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.453] GetLastError () returned 0x578 [0028.453] SetLastError (dwErrCode=0x578) [0028.453] CanUserWritePwrScheme () returned 1 [0028.454] GetSystemMetrics (nIndex=46) returned 2 [0028.454] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.454] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.454] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.454] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.461] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.461] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.461] GetLastError () returned 0x578 [0028.461] SetLastError (dwErrCode=0x578) [0028.461] CanUserWritePwrScheme () returned 1 [0028.461] GetSystemMetrics (nIndex=46) returned 2 [0028.461] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.462] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.462] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.462] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.468] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.469] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.469] GetLastError () returned 0x578 [0028.469] SetLastError (dwErrCode=0x578) [0028.469] CanUserWritePwrScheme () returned 1 [0028.469] GetSystemMetrics (nIndex=46) returned 2 [0028.469] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.469] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.469] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.469] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.476] GetLastError () returned 0x578 [0028.476] SetLastError (dwErrCode=0x578) [0028.476] CanUserWritePwrScheme () returned 1 [0028.477] GetSystemMetrics (nIndex=46) returned 2 [0028.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.484] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.484] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.484] GetLastError () returned 0x578 [0028.484] SetLastError (dwErrCode=0x578) [0028.484] CanUserWritePwrScheme () returned 1 [0028.484] GetSystemMetrics (nIndex=46) returned 2 [0028.484] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.485] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.485] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.485] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.491] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.491] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.491] GetLastError () returned 0x578 [0028.491] SetLastError (dwErrCode=0x578) [0028.491] CanUserWritePwrScheme () returned 1 [0028.492] GetSystemMetrics (nIndex=46) returned 2 [0028.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.492] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.492] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.492] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.502] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.502] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.502] GetLastError () returned 0x578 [0028.502] SetLastError (dwErrCode=0x578) [0028.502] CanUserWritePwrScheme () returned 1 [0028.503] GetSystemMetrics (nIndex=46) returned 2 [0028.503] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.503] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.503] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.503] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.509] GetLastError () returned 0x578 [0028.509] SetLastError (dwErrCode=0x578) [0028.509] CanUserWritePwrScheme () returned 1 [0028.510] GetSystemMetrics (nIndex=46) returned 2 [0028.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.510] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.510] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.510] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.515] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.515] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.515] GetLastError () returned 0x578 [0028.515] SetLastError (dwErrCode=0x578) [0028.515] CanUserWritePwrScheme () returned 1 [0028.515] GetSystemMetrics (nIndex=46) returned 2 [0028.515] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.515] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.515] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.515] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.520] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.520] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.520] GetLastError () returned 0x578 [0028.520] SetLastError (dwErrCode=0x578) [0028.521] CanUserWritePwrScheme () returned 1 [0028.521] GetSystemMetrics (nIndex=46) returned 2 [0028.521] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.521] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.521] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.521] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.526] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.526] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.527] GetLastError () returned 0x578 [0028.527] SetLastError (dwErrCode=0x578) [0028.527] CanUserWritePwrScheme () returned 1 [0028.527] GetSystemMetrics (nIndex=46) returned 2 [0028.527] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.527] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.527] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.527] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.532] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.532] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.532] GetLastError () returned 0x578 [0028.532] SetLastError (dwErrCode=0x578) [0028.532] CanUserWritePwrScheme () returned 1 [0028.533] GetSystemMetrics (nIndex=46) returned 2 [0028.533] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.533] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.533] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.533] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.538] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.538] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.538] GetLastError () returned 0x578 [0028.538] SetLastError (dwErrCode=0x578) [0028.538] CanUserWritePwrScheme () returned 1 [0028.538] GetSystemMetrics (nIndex=46) returned 2 [0028.538] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.538] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.538] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.538] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.543] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.543] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.543] GetLastError () returned 0x578 [0028.544] CanUserWritePwrScheme () returned 1 [0028.544] GetSystemMetrics (nIndex=46) returned 2 [0028.544] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.544] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.544] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.544] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.549] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.549] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.549] GetLastError () returned 0x578 [0028.549] CanUserWritePwrScheme () returned 1 [0028.549] GetSystemMetrics (nIndex=46) returned 2 [0028.549] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.549] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.549] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.550] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.554] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.554] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.554] GetLastError () returned 0x578 [0028.555] CanUserWritePwrScheme () returned 1 [0028.555] GetSystemMetrics (nIndex=46) returned 2 [0028.555] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.555] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.555] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.555] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.563] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.563] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.563] GetLastError () returned 0x578 [0028.563] CanUserWritePwrScheme () returned 1 [0028.563] GetSystemMetrics (nIndex=46) returned 2 [0028.563] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.563] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.563] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.563] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.568] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.568] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.568] GetLastError () returned 0x578 [0028.568] CanUserWritePwrScheme () returned 1 [0028.569] GetSystemMetrics (nIndex=46) returned 2 [0028.569] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.569] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.569] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.569] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.575] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.575] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.575] GetLastError () returned 0x578 [0028.575] CanUserWritePwrScheme () returned 1 [0028.575] GetSystemMetrics (nIndex=46) returned 2 [0028.575] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.575] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.575] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.575] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.580] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.580] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.580] GetLastError () returned 0x578 [0028.580] CanUserWritePwrScheme () returned 1 [0028.581] GetSystemMetrics (nIndex=46) returned 2 [0028.581] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.581] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.581] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.581] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.586] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.586] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.586] GetLastError () returned 0x578 [0028.586] CanUserWritePwrScheme () returned 1 [0028.586] GetSystemMetrics (nIndex=46) returned 2 [0028.586] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.586] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.586] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.586] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.592] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.592] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.592] GetLastError () returned 0x578 [0028.592] CanUserWritePwrScheme () returned 1 [0028.592] GetSystemMetrics (nIndex=46) returned 2 [0028.592] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.592] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.592] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.592] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.597] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.597] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.597] GetLastError () returned 0x578 [0028.597] CanUserWritePwrScheme () returned 1 [0028.598] GetSystemMetrics (nIndex=46) returned 2 [0028.598] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.598] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.598] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.598] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.603] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.603] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.603] GetLastError () returned 0x578 [0028.603] CanUserWritePwrScheme () returned 1 [0028.604] GetSystemMetrics (nIndex=46) returned 2 [0028.604] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.604] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.604] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.604] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.609] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.609] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.609] GetLastError () returned 0x578 [0028.609] CanUserWritePwrScheme () returned 1 [0028.609] GetSystemMetrics (nIndex=46) returned 2 [0028.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.609] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.609] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.609] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.614] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.614] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.614] GetLastError () returned 0x578 [0028.614] CanUserWritePwrScheme () returned 1 [0028.614] GetSystemMetrics (nIndex=46) returned 2 [0028.614] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.615] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.615] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.615] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.620] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.620] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.620] GetLastError () returned 0x578 [0028.620] CanUserWritePwrScheme () returned 1 [0028.620] GetSystemMetrics (nIndex=46) returned 2 [0028.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.628] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.628] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.628] GetLastError () returned 0x578 [0028.628] CanUserWritePwrScheme () returned 1 [0028.628] GetSystemMetrics (nIndex=46) returned 2 [0028.628] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.628] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.628] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.628] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.633] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.633] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.633] GetLastError () returned 0x578 [0028.633] CanUserWritePwrScheme () returned 1 [0028.634] GetSystemMetrics (nIndex=46) returned 2 [0028.634] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.634] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.634] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.635] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.640] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.640] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.640] GetLastError () returned 0x578 [0028.640] CanUserWritePwrScheme () returned 1 [0028.641] GetSystemMetrics (nIndex=46) returned 2 [0028.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.641] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.641] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.641] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.646] GetLastError () returned 0x578 [0028.646] CanUserWritePwrScheme () returned 1 [0028.646] GetSystemMetrics (nIndex=46) returned 2 [0028.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.652] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.652] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.653] GetLastError () returned 0x578 [0028.653] CanUserWritePwrScheme () returned 1 [0028.653] GetSystemMetrics (nIndex=46) returned 2 [0028.653] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.653] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.653] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.653] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.661] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.661] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.661] GetLastError () returned 0x578 [0028.661] CanUserWritePwrScheme () returned 1 [0028.661] GetSystemMetrics (nIndex=46) returned 2 [0028.661] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.661] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.661] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.661] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.668] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.668] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.668] GetLastError () returned 0x578 [0028.668] CanUserWritePwrScheme () returned 1 [0028.668] GetSystemMetrics (nIndex=46) returned 2 [0028.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.668] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.668] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.668] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.673] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.673] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.673] GetLastError () returned 0x578 [0028.673] CanUserWritePwrScheme () returned 1 [0028.674] GetSystemMetrics (nIndex=46) returned 2 [0028.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.674] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.674] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.674] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.679] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.679] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.679] GetLastError () returned 0x578 [0028.679] CanUserWritePwrScheme () returned 1 [0028.679] GetSystemMetrics (nIndex=46) returned 2 [0028.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.679] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.684] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.684] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.685] GetLastError () returned 0x578 [0028.685] CanUserWritePwrScheme () returned 1 [0028.685] GetSystemMetrics (nIndex=46) returned 2 [0028.685] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.685] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.685] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.685] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.692] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.692] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.692] GetLastError () returned 0x578 [0028.692] CanUserWritePwrScheme () returned 1 [0028.693] GetSystemMetrics (nIndex=46) returned 2 [0028.693] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.693] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.693] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.693] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.698] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.698] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.698] GetLastError () returned 0x578 [0028.698] CanUserWritePwrScheme () returned 1 [0028.699] GetSystemMetrics (nIndex=46) returned 2 [0028.699] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.699] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.699] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.699] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.704] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.704] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.704] GetLastError () returned 0x578 [0028.704] CanUserWritePwrScheme () returned 1 [0028.704] GetSystemMetrics (nIndex=46) returned 2 [0028.704] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.704] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.704] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.704] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.709] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.709] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.709] GetLastError () returned 0x578 [0028.709] CanUserWritePwrScheme () returned 1 [0028.709] GetSystemMetrics (nIndex=46) returned 2 [0028.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.709] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.716] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.716] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.716] GetLastError () returned 0x578 [0028.716] CanUserWritePwrScheme () returned 1 [0028.716] GetSystemMetrics (nIndex=46) returned 2 [0028.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.716] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.716] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.716] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.721] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.721] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.721] GetLastError () returned 0x578 [0028.721] CanUserWritePwrScheme () returned 1 [0028.722] GetSystemMetrics (nIndex=46) returned 2 [0028.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.722] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.722] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.722] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.727] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.727] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.727] GetLastError () returned 0x578 [0028.727] CanUserWritePwrScheme () returned 1 [0028.727] GetSystemMetrics (nIndex=46) returned 2 [0028.727] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.727] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.727] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.728] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.732] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.732] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.732] GetLastError () returned 0x578 [0028.732] CanUserWritePwrScheme () returned 1 [0028.733] GetSystemMetrics (nIndex=46) returned 2 [0028.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.733] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.733] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.733] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.738] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.738] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.738] GetLastError () returned 0x578 [0028.738] CanUserWritePwrScheme () returned 1 [0028.739] GetSystemMetrics (nIndex=46) returned 2 [0028.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.739] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.739] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.739] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.744] GetLastError () returned 0x578 [0028.744] CanUserWritePwrScheme () returned 1 [0028.744] GetSystemMetrics (nIndex=46) returned 2 [0028.744] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.744] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.745] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.745] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.749] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.749] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.749] GetLastError () returned 0x578 [0028.750] CanUserWritePwrScheme () returned 1 [0028.750] GetSystemMetrics (nIndex=46) returned 2 [0028.750] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.750] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.750] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.750] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.759] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.759] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.759] GetLastError () returned 0x578 [0028.759] CanUserWritePwrScheme () returned 1 [0028.759] GetSystemMetrics (nIndex=46) returned 2 [0028.759] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.759] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.759] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.759] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.764] GetLastError () returned 0x578 [0028.764] CanUserWritePwrScheme () returned 1 [0028.765] GetSystemMetrics (nIndex=46) returned 2 [0028.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.765] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.765] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.765] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.770] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.770] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.770] GetLastError () returned 0x578 [0028.770] CanUserWritePwrScheme () returned 1 [0028.770] GetSystemMetrics (nIndex=46) returned 2 [0028.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.775] GetLastError () returned 0x578 [0028.775] CanUserWritePwrScheme () returned 1 [0028.776] GetSystemMetrics (nIndex=46) returned 2 [0028.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.776] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.776] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.776] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.781] GetLastError () returned 0x578 [0028.781] CanUserWritePwrScheme () returned 1 [0028.781] GetSystemMetrics (nIndex=46) returned 2 [0028.781] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.781] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.781] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.781] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.786] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.786] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.786] GetLastError () returned 0x578 [0028.786] CanUserWritePwrScheme () returned 1 [0028.787] GetSystemMetrics (nIndex=46) returned 2 [0028.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.792] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.792] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.792] GetLastError () returned 0x578 [0028.792] CanUserWritePwrScheme () returned 1 [0028.793] GetSystemMetrics (nIndex=46) returned 2 [0028.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.793] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.793] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.793] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.798] GetLastError () returned 0x578 [0028.798] CanUserWritePwrScheme () returned 1 [0028.798] GetSystemMetrics (nIndex=46) returned 2 [0028.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.798] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.798] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.798] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.803] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.803] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.803] GetLastError () returned 0x578 [0028.803] CanUserWritePwrScheme () returned 1 [0028.803] GetSystemMetrics (nIndex=46) returned 2 [0028.804] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.804] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.804] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.804] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.808] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.808] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.808] GetLastError () returned 0x578 [0028.809] CanUserWritePwrScheme () returned 1 [0028.809] GetSystemMetrics (nIndex=46) returned 2 [0028.809] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.809] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.809] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.809] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.814] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.814] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.814] GetLastError () returned 0x578 [0028.814] CanUserWritePwrScheme () returned 1 [0028.815] GetSystemMetrics (nIndex=46) returned 2 [0028.815] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.815] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.815] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.815] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.823] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.823] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.823] GetLastError () returned 0x578 [0028.823] CanUserWritePwrScheme () returned 1 [0028.823] GetSystemMetrics (nIndex=46) returned 2 [0028.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.829] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.829] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.829] GetLastError () returned 0x578 [0028.829] CanUserWritePwrScheme () returned 1 [0028.829] GetSystemMetrics (nIndex=46) returned 2 [0028.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.829] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.829] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.829] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.835] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.835] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.835] GetLastError () returned 0x578 [0028.835] CanUserWritePwrScheme () returned 1 [0028.835] GetSystemMetrics (nIndex=46) returned 2 [0028.835] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.835] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.836] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.836] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.841] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.841] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.841] GetLastError () returned 0x578 [0028.841] CanUserWritePwrScheme () returned 1 [0028.842] GetSystemMetrics (nIndex=46) returned 2 [0028.842] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.842] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.842] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.842] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.847] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.847] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.847] GetLastError () returned 0x578 [0028.847] CanUserWritePwrScheme () returned 1 [0028.847] GetSystemMetrics (nIndex=46) returned 2 [0028.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.847] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.848] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.848] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.854] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.854] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.854] GetLastError () returned 0x578 [0028.855] CanUserWritePwrScheme () returned 1 [0028.855] GetSystemMetrics (nIndex=46) returned 2 [0028.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.855] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.855] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.855] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.860] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.860] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.860] GetLastError () returned 0x578 [0028.860] CanUserWritePwrScheme () returned 1 [0028.860] GetSystemMetrics (nIndex=46) returned 2 [0028.860] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.865] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.866] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.866] GetLastError () returned 0x578 [0028.866] CanUserWritePwrScheme () returned 1 [0028.866] GetSystemMetrics (nIndex=46) returned 2 [0028.866] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.866] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.866] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.866] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.879] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.879] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.879] GetLastError () returned 0x578 [0028.879] CanUserWritePwrScheme () returned 1 [0028.879] GetSystemMetrics (nIndex=46) returned 2 [0028.880] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.880] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.880] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.880] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.888] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.888] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.888] GetLastError () returned 0x578 [0028.888] CanUserWritePwrScheme () returned 1 [0028.888] GetSystemMetrics (nIndex=46) returned 2 [0028.888] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.888] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.888] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.888] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.893] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.893] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.893] GetLastError () returned 0x578 [0028.893] CanUserWritePwrScheme () returned 1 [0028.894] GetSystemMetrics (nIndex=46) returned 2 [0028.894] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.894] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.894] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.894] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.899] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.899] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.899] GetLastError () returned 0x578 [0028.899] CanUserWritePwrScheme () returned 1 [0028.899] GetSystemMetrics (nIndex=46) returned 2 [0028.899] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.899] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.899] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.899] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.904] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.905] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.905] GetLastError () returned 0x578 [0028.905] CanUserWritePwrScheme () returned 1 [0028.905] GetSystemMetrics (nIndex=46) returned 2 [0028.905] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.905] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.905] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.905] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.910] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.910] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.910] GetLastError () returned 0x578 [0028.910] CanUserWritePwrScheme () returned 1 [0028.910] GetSystemMetrics (nIndex=46) returned 2 [0028.910] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.910] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.911] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.911] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.919] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.919] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.919] GetLastError () returned 0x578 [0028.919] CanUserWritePwrScheme () returned 1 [0028.920] GetSystemMetrics (nIndex=46) returned 2 [0028.920] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.920] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.920] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.920] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.925] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.925] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.925] GetLastError () returned 0x578 [0028.925] CanUserWritePwrScheme () returned 1 [0028.925] GetSystemMetrics (nIndex=46) returned 2 [0028.925] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.925] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.925] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.925] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.930] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.930] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.931] GetLastError () returned 0x578 [0028.931] CanUserWritePwrScheme () returned 1 [0028.931] GetSystemMetrics (nIndex=46) returned 2 [0028.931] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.931] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.931] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.931] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.936] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.936] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.936] GetLastError () returned 0x578 [0028.936] CanUserWritePwrScheme () returned 1 [0028.936] GetSystemMetrics (nIndex=46) returned 2 [0028.937] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.937] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.937] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.937] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.942] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.942] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.942] GetLastError () returned 0x578 [0028.942] CanUserWritePwrScheme () returned 1 [0028.942] GetSystemMetrics (nIndex=46) returned 2 [0028.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.948] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.948] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.948] GetLastError () returned 0x578 [0028.948] CanUserWritePwrScheme () returned 1 [0028.948] GetSystemMetrics (nIndex=46) returned 2 [0028.948] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.948] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.948] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.948] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.956] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.956] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.956] GetLastError () returned 0x578 [0028.956] CanUserWritePwrScheme () returned 1 [0028.957] GetSystemMetrics (nIndex=46) returned 2 [0028.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.957] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.957] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.957] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.962] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.962] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.962] GetLastError () returned 0x578 [0028.962] CanUserWritePwrScheme () returned 1 [0028.962] GetSystemMetrics (nIndex=46) returned 2 [0028.962] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.962] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.962] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.962] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.968] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.968] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.968] GetLastError () returned 0x578 [0028.968] CanUserWritePwrScheme () returned 1 [0028.968] GetSystemMetrics (nIndex=46) returned 2 [0028.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.974] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.974] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.974] GetLastError () returned 0x578 [0028.974] CanUserWritePwrScheme () returned 1 [0028.974] GetSystemMetrics (nIndex=46) returned 2 [0028.974] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.974] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.974] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.974] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.980] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.980] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.980] GetLastError () returned 0x578 [0028.980] CanUserWritePwrScheme () returned 1 [0028.980] GetSystemMetrics (nIndex=46) returned 2 [0028.980] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.980] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.980] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.980] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.985] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.985] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.985] GetLastError () returned 0x578 [0028.985] CanUserWritePwrScheme () returned 1 [0028.986] GetSystemMetrics (nIndex=46) returned 2 [0028.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.986] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.991] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.991] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.991] GetLastError () returned 0x578 [0028.991] CanUserWritePwrScheme () returned 1 [0028.991] GetSystemMetrics (nIndex=46) returned 2 [0028.991] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.991] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.991] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.991] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0028.997] GetWindowTextLengthA (hWnd=0x0) returned 0 [0028.997] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0028.997] GetLastError () returned 0x578 [0028.997] CanUserWritePwrScheme () returned 1 [0028.997] GetSystemMetrics (nIndex=46) returned 2 [0028.997] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0028.997] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0028.997] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0028.997] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.002] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.002] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.002] GetLastError () returned 0x578 [0029.002] CanUserWritePwrScheme () returned 1 [0029.003] GetSystemMetrics (nIndex=46) returned 2 [0029.003] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.003] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.003] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.003] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.008] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.008] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.008] GetLastError () returned 0x578 [0029.008] CanUserWritePwrScheme () returned 1 [0029.008] GetSystemMetrics (nIndex=46) returned 2 [0029.008] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.008] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.008] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.008] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.013] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.013] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.013] GetLastError () returned 0x578 [0029.013] CanUserWritePwrScheme () returned 1 [0029.014] GetSystemMetrics (nIndex=46) returned 2 [0029.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.021] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.021] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.021] GetLastError () returned 0x578 [0029.021] CanUserWritePwrScheme () returned 1 [0029.021] GetSystemMetrics (nIndex=46) returned 2 [0029.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.021] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.021] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.021] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.027] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.027] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.027] GetLastError () returned 0x578 [0029.027] CanUserWritePwrScheme () returned 1 [0029.027] GetSystemMetrics (nIndex=46) returned 2 [0029.027] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.027] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.027] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.027] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.032] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.032] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.032] GetLastError () returned 0x578 [0029.032] CanUserWritePwrScheme () returned 1 [0029.033] GetSystemMetrics (nIndex=46) returned 2 [0029.033] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.033] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.033] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.033] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.038] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.038] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.038] GetLastError () returned 0x578 [0029.038] CanUserWritePwrScheme () returned 1 [0029.038] GetSystemMetrics (nIndex=46) returned 2 [0029.038] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.038] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.038] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.038] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.043] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.043] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.044] GetLastError () returned 0x578 [0029.044] CanUserWritePwrScheme () returned 1 [0029.044] GetSystemMetrics (nIndex=46) returned 2 [0029.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.044] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.044] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.044] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.049] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.049] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.049] GetLastError () returned 0x578 [0029.049] CanUserWritePwrScheme () returned 1 [0029.049] GetSystemMetrics (nIndex=46) returned 2 [0029.049] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.049] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.050] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.050] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.054] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.054] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.054] GetLastError () returned 0x578 [0029.054] CanUserWritePwrScheme () returned 1 [0029.056] GetSystemMetrics (nIndex=46) returned 2 [0029.056] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.056] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.056] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.056] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.061] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.061] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.061] GetLastError () returned 0x578 [0029.061] CanUserWritePwrScheme () returned 1 [0029.061] GetSystemMetrics (nIndex=46) returned 2 [0029.061] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.061] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.061] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.061] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.066] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.066] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.066] GetLastError () returned 0x578 [0029.066] CanUserWritePwrScheme () returned 1 [0029.067] GetSystemMetrics (nIndex=46) returned 2 [0029.067] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.067] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.067] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.067] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.072] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.072] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.072] GetLastError () returned 0x578 [0029.072] CanUserWritePwrScheme () returned 1 [0029.072] GetSystemMetrics (nIndex=46) returned 2 [0029.072] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.072] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.072] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.072] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.077] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.077] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.077] GetLastError () returned 0x578 [0029.077] CanUserWritePwrScheme () returned 1 [0029.078] GetSystemMetrics (nIndex=46) returned 2 [0029.078] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.078] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.078] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.078] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.085] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.085] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.085] GetLastError () returned 0x578 [0029.085] CanUserWritePwrScheme () returned 1 [0029.086] GetSystemMetrics (nIndex=46) returned 2 [0029.086] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.086] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.086] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.086] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.092] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.092] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.092] GetLastError () returned 0x578 [0029.092] CanUserWritePwrScheme () returned 1 [0029.092] GetSystemMetrics (nIndex=46) returned 2 [0029.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.092] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.092] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.092] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.097] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.097] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.097] GetLastError () returned 0x578 [0029.097] CanUserWritePwrScheme () returned 1 [0029.098] GetSystemMetrics (nIndex=46) returned 2 [0029.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.098] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.098] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.098] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.103] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.103] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.103] GetLastError () returned 0x578 [0029.103] CanUserWritePwrScheme () returned 1 [0029.103] GetSystemMetrics (nIndex=46) returned 2 [0029.103] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.103] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.103] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.103] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.109] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.109] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.109] GetLastError () returned 0x578 [0029.109] CanUserWritePwrScheme () returned 1 [0029.109] GetSystemMetrics (nIndex=46) returned 2 [0029.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.109] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.109] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.109] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.114] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.114] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.114] GetLastError () returned 0x578 [0029.114] CanUserWritePwrScheme () returned 1 [0029.115] GetSystemMetrics (nIndex=46) returned 2 [0029.115] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.115] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.115] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.115] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.122] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.122] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.122] GetLastError () returned 0x578 [0029.122] CanUserWritePwrScheme () returned 1 [0029.123] GetSystemMetrics (nIndex=46) returned 2 [0029.123] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.123] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.123] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.123] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.129] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.129] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.129] GetLastError () returned 0x578 [0029.129] CanUserWritePwrScheme () returned 1 [0029.130] GetSystemMetrics (nIndex=46) returned 2 [0029.130] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.130] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.130] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.130] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.136] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.136] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.136] GetLastError () returned 0x578 [0029.136] CanUserWritePwrScheme () returned 1 [0029.136] GetSystemMetrics (nIndex=46) returned 2 [0029.136] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.136] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.136] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.136] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.141] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.141] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.141] GetLastError () returned 0x578 [0029.141] CanUserWritePwrScheme () returned 1 [0029.142] GetSystemMetrics (nIndex=46) returned 2 [0029.142] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.142] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.142] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.142] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.151] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.151] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.151] GetLastError () returned 0x578 [0029.151] CanUserWritePwrScheme () returned 1 [0029.151] GetSystemMetrics (nIndex=46) returned 2 [0029.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.151] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.151] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.151] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.156] GetLastError () returned 0x578 [0029.156] CanUserWritePwrScheme () returned 1 [0029.157] GetSystemMetrics (nIndex=46) returned 2 [0029.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.157] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.157] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.157] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.163] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.163] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.163] GetLastError () returned 0x578 [0029.163] CanUserWritePwrScheme () returned 1 [0029.163] GetSystemMetrics (nIndex=46) returned 2 [0029.163] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.163] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.163] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.163] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.171] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.171] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.171] GetLastError () returned 0x578 [0029.171] CanUserWritePwrScheme () returned 1 [0029.171] GetSystemMetrics (nIndex=46) returned 2 [0029.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.171] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.171] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.171] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.178] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.178] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.178] GetLastError () returned 0x578 [0029.178] CanUserWritePwrScheme () returned 1 [0029.178] GetSystemMetrics (nIndex=46) returned 2 [0029.178] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.179] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.179] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.179] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.185] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.185] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.185] GetLastError () returned 0x578 [0029.185] CanUserWritePwrScheme () returned 1 [0029.186] GetSystemMetrics (nIndex=46) returned 2 [0029.186] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.186] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.186] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.186] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.193] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.193] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.193] GetLastError () returned 0x578 [0029.193] CanUserWritePwrScheme () returned 1 [0029.193] GetSystemMetrics (nIndex=46) returned 2 [0029.194] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.194] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.194] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.194] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.201] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.201] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.201] GetLastError () returned 0x578 [0029.201] CanUserWritePwrScheme () returned 1 [0029.201] GetSystemMetrics (nIndex=46) returned 2 [0029.201] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.201] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.201] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.201] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.208] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.208] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.208] GetLastError () returned 0x578 [0029.208] CanUserWritePwrScheme () returned 1 [0029.209] GetSystemMetrics (nIndex=46) returned 2 [0029.209] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.209] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.209] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.209] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.218] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.218] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.218] GetLastError () returned 0x578 [0029.218] CanUserWritePwrScheme () returned 1 [0029.219] GetSystemMetrics (nIndex=46) returned 2 [0029.219] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.219] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.219] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.219] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.226] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.226] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.226] GetLastError () returned 0x578 [0029.226] CanUserWritePwrScheme () returned 1 [0029.226] GetSystemMetrics (nIndex=46) returned 2 [0029.226] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.226] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.226] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.227] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.233] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.233] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.233] GetLastError () returned 0x578 [0029.233] CanUserWritePwrScheme () returned 1 [0029.233] GetSystemMetrics (nIndex=46) returned 2 [0029.234] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.234] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.234] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.234] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.240] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.240] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.240] GetLastError () returned 0x578 [0029.240] CanUserWritePwrScheme () returned 1 [0029.240] GetSystemMetrics (nIndex=46) returned 2 [0029.240] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.240] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.240] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.240] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.245] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.246] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.246] GetLastError () returned 0x578 [0029.246] CanUserWritePwrScheme () returned 1 [0029.246] GetSystemMetrics (nIndex=46) returned 2 [0029.246] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.246] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.246] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.246] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.251] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.251] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.252] GetLastError () returned 0x578 [0029.252] CanUserWritePwrScheme () returned 1 [0029.252] GetSystemMetrics (nIndex=46) returned 2 [0029.252] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.252] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.252] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.252] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.257] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.257] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.257] GetLastError () returned 0x578 [0029.257] CanUserWritePwrScheme () returned 1 [0029.259] GetSystemMetrics (nIndex=46) returned 2 [0029.259] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.259] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.259] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.259] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.264] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.264] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.264] GetLastError () returned 0x578 [0029.264] CanUserWritePwrScheme () returned 1 [0029.264] GetSystemMetrics (nIndex=46) returned 2 [0029.264] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.264] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.264] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.264] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.269] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.269] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.269] GetLastError () returned 0x578 [0029.269] CanUserWritePwrScheme () returned 1 [0029.270] GetSystemMetrics (nIndex=46) returned 2 [0029.270] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.270] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.270] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.270] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.275] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.275] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.275] GetLastError () returned 0x578 [0029.275] CanUserWritePwrScheme () returned 1 [0029.275] GetSystemMetrics (nIndex=46) returned 2 [0029.275] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.275] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.276] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.276] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.283] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.283] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.283] GetLastError () returned 0x578 [0029.283] CanUserWritePwrScheme () returned 1 [0029.283] GetSystemMetrics (nIndex=46) returned 2 [0029.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.284] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.284] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.284] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.289] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.289] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.289] GetLastError () returned 0x578 [0029.289] CanUserWritePwrScheme () returned 1 [0029.289] GetSystemMetrics (nIndex=46) returned 2 [0029.289] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.289] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.289] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.289] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.295] GetLastError () returned 0x578 [0029.295] CanUserWritePwrScheme () returned 1 [0029.295] GetSystemMetrics (nIndex=46) returned 2 [0029.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.300] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.300] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.300] GetLastError () returned 0x578 [0029.300] CanUserWritePwrScheme () returned 1 [0029.301] GetSystemMetrics (nIndex=46) returned 2 [0029.301] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.301] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.301] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.301] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.306] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.306] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.306] GetLastError () returned 0x578 [0029.306] CanUserWritePwrScheme () returned 1 [0029.306] GetSystemMetrics (nIndex=46) returned 2 [0029.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.307] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.307] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.307] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.312] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.312] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.312] GetLastError () returned 0x578 [0029.312] CanUserWritePwrScheme () returned 1 [0029.312] GetSystemMetrics (nIndex=46) returned 2 [0029.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.318] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.318] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.318] GetLastError () returned 0x578 [0029.318] CanUserWritePwrScheme () returned 1 [0029.318] GetSystemMetrics (nIndex=46) returned 2 [0029.318] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.318] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.318] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.318] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.323] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.323] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.323] GetLastError () returned 0x578 [0029.323] CanUserWritePwrScheme () returned 1 [0029.324] GetSystemMetrics (nIndex=46) returned 2 [0029.324] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.324] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.324] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.324] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.329] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.329] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.329] GetLastError () returned 0x578 [0029.329] CanUserWritePwrScheme () returned 1 [0029.329] GetSystemMetrics (nIndex=46) returned 2 [0029.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.334] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.334] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.334] GetLastError () returned 0x578 [0029.335] CanUserWritePwrScheme () returned 1 [0029.335] GetSystemMetrics (nIndex=46) returned 2 [0029.335] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.335] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.335] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.335] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.340] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.340] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.340] GetLastError () returned 0x578 [0029.340] CanUserWritePwrScheme () returned 1 [0029.341] GetSystemMetrics (nIndex=46) returned 2 [0029.341] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.341] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.341] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.341] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.348] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.348] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.348] GetLastError () returned 0x578 [0029.348] CanUserWritePwrScheme () returned 1 [0029.348] GetSystemMetrics (nIndex=46) returned 2 [0029.348] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.348] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.348] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.348] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.354] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.354] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.354] GetLastError () returned 0x578 [0029.354] CanUserWritePwrScheme () returned 1 [0029.354] GetSystemMetrics (nIndex=46) returned 2 [0029.354] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.354] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.354] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.354] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.359] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.359] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.359] GetLastError () returned 0x578 [0029.359] CanUserWritePwrScheme () returned 1 [0029.360] GetSystemMetrics (nIndex=46) returned 2 [0029.360] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.360] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.360] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.360] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.365] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.365] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.365] GetLastError () returned 0x578 [0029.365] CanUserWritePwrScheme () returned 1 [0029.365] GetSystemMetrics (nIndex=46) returned 2 [0029.365] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.365] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.365] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.365] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.370] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.370] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.370] GetLastError () returned 0x578 [0029.371] CanUserWritePwrScheme () returned 1 [0029.371] GetSystemMetrics (nIndex=46) returned 2 [0029.371] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.371] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.371] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.371] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.376] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.376] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.376] GetLastError () returned 0x578 [0029.376] CanUserWritePwrScheme () returned 1 [0029.376] GetSystemMetrics (nIndex=46) returned 2 [0029.376] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.376] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.376] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.376] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.382] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.382] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.382] GetLastError () returned 0x578 [0029.382] CanUserWritePwrScheme () returned 1 [0029.382] GetSystemMetrics (nIndex=46) returned 2 [0029.382] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.382] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.382] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.383] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.388] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.388] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.388] GetLastError () returned 0x578 [0029.388] CanUserWritePwrScheme () returned 1 [0029.388] GetSystemMetrics (nIndex=46) returned 2 [0029.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.388] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.388] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.389] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.394] GetLastError () returned 0x578 [0029.394] CanUserWritePwrScheme () returned 1 [0029.394] GetSystemMetrics (nIndex=46) returned 2 [0029.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.394] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.394] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.394] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.399] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.399] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.400] GetLastError () returned 0x578 [0029.400] CanUserWritePwrScheme () returned 1 [0029.400] GetSystemMetrics (nIndex=46) returned 2 [0029.400] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.400] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.400] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.400] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.405] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.405] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.405] GetLastError () returned 0x578 [0029.405] CanUserWritePwrScheme () returned 1 [0029.405] GetSystemMetrics (nIndex=46) returned 2 [0029.405] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.406] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.406] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.406] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.413] GetLastError () returned 0x578 [0029.413] CanUserWritePwrScheme () returned 1 [0029.413] GetSystemMetrics (nIndex=46) returned 2 [0029.413] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.413] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.420] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.420] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.425] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.425] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.425] GetLastError () returned 0x578 [0029.425] CanUserWritePwrScheme () returned 1 [0029.425] GetSystemMetrics (nIndex=46) returned 2 [0029.425] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.425] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.425] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.425] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.430] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.430] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.430] GetLastError () returned 0x578 [0029.430] CanUserWritePwrScheme () returned 1 [0029.431] GetSystemMetrics (nIndex=46) returned 2 [0029.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.436] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.436] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.436] GetLastError () returned 0x578 [0029.436] CanUserWritePwrScheme () returned 1 [0029.436] GetSystemMetrics (nIndex=46) returned 2 [0029.436] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.436] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.436] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.436] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.442] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.442] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.442] GetLastError () returned 0x578 [0029.442] CanUserWritePwrScheme () returned 1 [0029.442] GetSystemMetrics (nIndex=46) returned 2 [0029.442] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.442] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.442] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.442] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.448] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.448] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.448] GetLastError () returned 0x578 [0029.448] CanUserWritePwrScheme () returned 1 [0029.448] GetSystemMetrics (nIndex=46) returned 2 [0029.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.448] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.448] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.448] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.453] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.453] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.453] GetLastError () returned 0x578 [0029.453] CanUserWritePwrScheme () returned 1 [0029.454] GetSystemMetrics (nIndex=46) returned 2 [0029.454] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.454] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.454] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.454] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.459] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.459] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.459] GetLastError () returned 0x578 [0029.459] CanUserWritePwrScheme () returned 1 [0029.459] GetSystemMetrics (nIndex=46) returned 2 [0029.459] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.459] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.459] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.459] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.466] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.466] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.466] GetLastError () returned 0x578 [0029.466] CanUserWritePwrScheme () returned 1 [0029.466] GetSystemMetrics (nIndex=46) returned 2 [0029.466] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.466] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.466] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.466] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.474] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.474] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.474] GetLastError () returned 0x578 [0029.474] CanUserWritePwrScheme () returned 1 [0029.475] GetSystemMetrics (nIndex=46) returned 2 [0029.475] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.475] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.475] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.475] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.480] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.480] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.480] GetLastError () returned 0x578 [0029.480] CanUserWritePwrScheme () returned 1 [0029.481] GetSystemMetrics (nIndex=46) returned 2 [0029.481] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.481] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.481] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.481] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.486] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.486] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.486] GetLastError () returned 0x578 [0029.486] CanUserWritePwrScheme () returned 1 [0029.487] GetSystemMetrics (nIndex=46) returned 2 [0029.487] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.487] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.487] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.487] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.492] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.492] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.492] GetLastError () returned 0x578 [0029.492] CanUserWritePwrScheme () returned 1 [0029.492] GetSystemMetrics (nIndex=46) returned 2 [0029.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.492] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.492] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.492] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.497] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.497] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.497] GetLastError () returned 0x578 [0029.498] CanUserWritePwrScheme () returned 1 [0029.498] GetSystemMetrics (nIndex=46) returned 2 [0029.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.498] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.498] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.498] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.505] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.505] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.505] GetLastError () returned 0x578 [0029.505] CanUserWritePwrScheme () returned 1 [0029.506] GetSystemMetrics (nIndex=46) returned 2 [0029.506] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.506] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.506] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.506] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.515] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.515] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.515] GetLastError () returned 0x578 [0029.515] CanUserWritePwrScheme () returned 1 [0029.516] GetSystemMetrics (nIndex=46) returned 2 [0029.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.520] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.521] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.521] GetLastError () returned 0x578 [0029.521] CanUserWritePwrScheme () returned 1 [0029.521] GetSystemMetrics (nIndex=46) returned 2 [0029.521] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.521] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.521] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.521] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.526] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.526] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.526] GetLastError () returned 0x578 [0029.526] CanUserWritePwrScheme () returned 1 [0029.527] GetSystemMetrics (nIndex=46) returned 2 [0029.527] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.527] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.527] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.527] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.531] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.531] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.532] GetLastError () returned 0x578 [0029.532] CanUserWritePwrScheme () returned 1 [0029.532] GetSystemMetrics (nIndex=46) returned 2 [0029.532] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.532] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.532] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.532] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.582] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.582] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.582] GetLastError () returned 0x578 [0029.582] CanUserWritePwrScheme () returned 1 [0029.582] GetSystemMetrics (nIndex=46) returned 2 [0029.582] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.582] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.582] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.582] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.590] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.590] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.590] GetLastError () returned 0x578 [0029.590] CanUserWritePwrScheme () returned 1 [0029.591] GetSystemMetrics (nIndex=46) returned 2 [0029.591] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.591] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.591] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.591] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.604] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.604] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.604] GetLastError () returned 0x578 [0029.604] CanUserWritePwrScheme () returned 1 [0029.605] GetSystemMetrics (nIndex=46) returned 2 [0029.605] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.605] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.605] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.605] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.610] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.610] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.610] GetLastError () returned 0x578 [0029.610] CanUserWritePwrScheme () returned 1 [0029.610] GetSystemMetrics (nIndex=46) returned 2 [0029.610] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.610] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.610] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.610] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.615] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.615] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.615] GetLastError () returned 0x578 [0029.615] CanUserWritePwrScheme () returned 1 [0029.616] GetSystemMetrics (nIndex=46) returned 2 [0029.616] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.616] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.616] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.616] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.621] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.621] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.621] GetLastError () returned 0x578 [0029.621] CanUserWritePwrScheme () returned 1 [0029.622] GetSystemMetrics (nIndex=46) returned 2 [0029.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.622] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.622] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.622] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.627] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.627] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.627] GetLastError () returned 0x578 [0029.627] CanUserWritePwrScheme () returned 1 [0029.627] GetSystemMetrics (nIndex=46) returned 2 [0029.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.627] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.627] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.627] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.632] GetLastError () returned 0x578 [0029.632] CanUserWritePwrScheme () returned 1 [0029.633] GetSystemMetrics (nIndex=46) returned 2 [0029.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.639] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.639] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.639] GetLastError () returned 0x578 [0029.640] CanUserWritePwrScheme () returned 1 [0029.640] GetSystemMetrics (nIndex=46) returned 2 [0029.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.640] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.640] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.640] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.645] GetLastError () returned 0x578 [0029.645] CanUserWritePwrScheme () returned 1 [0029.645] GetSystemMetrics (nIndex=46) returned 2 [0029.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.645] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.645] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.645] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.650] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.651] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.651] GetLastError () returned 0x578 [0029.651] CanUserWritePwrScheme () returned 1 [0029.651] GetSystemMetrics (nIndex=46) returned 2 [0029.651] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.651] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.651] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.651] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.656] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.656] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.656] GetLastError () returned 0x578 [0029.656] CanUserWritePwrScheme () returned 1 [0029.656] GetSystemMetrics (nIndex=46) returned 2 [0029.656] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.656] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.656] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.656] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.661] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.661] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.661] GetLastError () returned 0x578 [0029.661] CanUserWritePwrScheme () returned 1 [0029.662] GetSystemMetrics (nIndex=46) returned 2 [0029.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.662] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.662] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.662] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.670] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.670] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.670] GetLastError () returned 0x578 [0029.671] CanUserWritePwrScheme () returned 1 [0029.671] GetSystemMetrics (nIndex=46) returned 2 [0029.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.671] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.671] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.671] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.676] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.676] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.676] GetLastError () returned 0x578 [0029.676] CanUserWritePwrScheme () returned 1 [0029.677] GetSystemMetrics (nIndex=46) returned 2 [0029.677] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.677] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.677] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.677] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.682] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.682] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.682] GetLastError () returned 0x578 [0029.682] CanUserWritePwrScheme () returned 1 [0029.683] GetSystemMetrics (nIndex=46) returned 2 [0029.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.683] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.683] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.683] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.715] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.715] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.716] GetLastError () returned 0x578 [0029.716] CanUserWritePwrScheme () returned 1 [0029.716] GetSystemMetrics (nIndex=46) returned 2 [0029.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.716] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.716] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.716] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.724] GetLastError () returned 0x578 [0029.724] CanUserWritePwrScheme () returned 1 [0029.724] GetSystemMetrics (nIndex=46) returned 2 [0029.724] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.725] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.725] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.725] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.734] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.734] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.735] GetLastError () returned 0x578 [0029.735] CanUserWritePwrScheme () returned 1 [0029.735] GetSystemMetrics (nIndex=46) returned 2 [0029.735] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.735] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.735] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.735] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.742] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.742] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.742] GetLastError () returned 0x578 [0029.742] CanUserWritePwrScheme () returned 1 [0029.742] GetSystemMetrics (nIndex=46) returned 2 [0029.742] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.742] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.742] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.742] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.747] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.747] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.747] GetLastError () returned 0x578 [0029.747] CanUserWritePwrScheme () returned 1 [0029.748] GetSystemMetrics (nIndex=46) returned 2 [0029.748] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.748] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.748] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.748] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.753] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.753] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.753] GetLastError () returned 0x578 [0029.753] CanUserWritePwrScheme () returned 1 [0029.753] GetSystemMetrics (nIndex=46) returned 2 [0029.753] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.753] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.753] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.753] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.758] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.758] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.758] GetLastError () returned 0x578 [0029.758] CanUserWritePwrScheme () returned 1 [0029.759] GetSystemMetrics (nIndex=46) returned 2 [0029.759] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.759] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.759] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.759] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.764] GetLastError () returned 0x578 [0029.764] CanUserWritePwrScheme () returned 1 [0029.764] GetSystemMetrics (nIndex=46) returned 2 [0029.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.764] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.764] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.764] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.769] GetLastError () returned 0x578 [0029.769] CanUserWritePwrScheme () returned 1 [0029.770] GetSystemMetrics (nIndex=46) returned 2 [0029.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.775] GetLastError () returned 0x578 [0029.775] CanUserWritePwrScheme () returned 1 [0029.776] GetSystemMetrics (nIndex=46) returned 2 [0029.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.776] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.776] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.776] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.781] GetLastError () returned 0x578 [0029.781] CanUserWritePwrScheme () returned 1 [0029.781] GetSystemMetrics (nIndex=46) returned 2 [0029.781] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.781] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.781] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.781] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.786] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.786] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.786] GetLastError () returned 0x578 [0029.786] CanUserWritePwrScheme () returned 1 [0029.787] GetSystemMetrics (nIndex=46) returned 2 [0029.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.792] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.792] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.792] GetLastError () returned 0x578 [0029.792] CanUserWritePwrScheme () returned 1 [0029.793] GetSystemMetrics (nIndex=46) returned 2 [0029.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.793] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.793] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.793] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.800] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.800] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.800] GetLastError () returned 0x578 [0029.800] CanUserWritePwrScheme () returned 1 [0029.801] GetSystemMetrics (nIndex=46) returned 2 [0029.801] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.801] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.801] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.801] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.876] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.876] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.876] GetLastError () returned 0x578 [0029.876] CanUserWritePwrScheme () returned 1 [0029.877] GetSystemMetrics (nIndex=46) returned 2 [0029.877] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.877] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.877] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.877] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.884] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.884] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.884] GetLastError () returned 0x578 [0029.884] CanUserWritePwrScheme () returned 1 [0029.884] GetSystemMetrics (nIndex=46) returned 2 [0029.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.884] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.884] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.884] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.889] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.889] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.889] GetLastError () returned 0x578 [0029.889] CanUserWritePwrScheme () returned 1 [0029.890] GetSystemMetrics (nIndex=46) returned 2 [0029.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.890] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.894] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.894] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.895] GetLastError () returned 0x578 [0029.895] CanUserWritePwrScheme () returned 1 [0029.895] GetSystemMetrics (nIndex=46) returned 2 [0029.895] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.895] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.895] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.895] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.900] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.900] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.900] GetLastError () returned 0x578 [0029.900] CanUserWritePwrScheme () returned 1 [0029.901] GetSystemMetrics (nIndex=46) returned 2 [0029.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.901] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.901] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.901] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.905] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.906] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.906] GetLastError () returned 0x578 [0029.906] CanUserWritePwrScheme () returned 1 [0029.906] GetSystemMetrics (nIndex=46) returned 2 [0029.906] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.906] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.906] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.906] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.911] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.911] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.911] GetLastError () returned 0x578 [0029.911] CanUserWritePwrScheme () returned 1 [0029.911] GetSystemMetrics (nIndex=46) returned 2 [0029.911] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.911] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.911] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.911] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.917] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.917] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.917] GetLastError () returned 0x578 [0029.917] CanUserWritePwrScheme () returned 1 [0029.917] GetSystemMetrics (nIndex=46) returned 2 [0029.917] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.917] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.917] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.917] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.922] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.922] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.922] GetLastError () returned 0x578 [0029.922] CanUserWritePwrScheme () returned 1 [0029.922] GetSystemMetrics (nIndex=46) returned 2 [0029.922] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.922] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.922] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.923] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.930] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.930] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.930] GetLastError () returned 0x578 [0029.930] CanUserWritePwrScheme () returned 1 [0029.930] GetSystemMetrics (nIndex=46) returned 2 [0029.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.930] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.935] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.935] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.935] GetLastError () returned 0x578 [0029.935] CanUserWritePwrScheme () returned 1 [0029.936] GetSystemMetrics (nIndex=46) returned 2 [0029.936] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.936] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.936] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.936] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.941] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.941] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.941] GetLastError () returned 0x578 [0029.941] CanUserWritePwrScheme () returned 1 [0029.941] GetSystemMetrics (nIndex=46) returned 2 [0029.941] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.941] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.941] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.941] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.947] GetLastError () returned 0x578 [0029.947] CanUserWritePwrScheme () returned 1 [0029.947] GetSystemMetrics (nIndex=46) returned 2 [0029.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.947] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.947] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.947] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.972] GetLastError () returned 0x578 [0029.973] CanUserWritePwrScheme () returned 1 [0029.973] GetSystemMetrics (nIndex=46) returned 2 [0029.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.978] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.978] GetLastError () returned 0x578 [0029.979] CanUserWritePwrScheme () returned 1 [0029.979] GetSystemMetrics (nIndex=46) returned 2 [0029.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.979] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.979] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.979] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.984] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.984] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.984] GetLastError () returned 0x578 [0029.984] CanUserWritePwrScheme () returned 1 [0029.984] GetSystemMetrics (nIndex=46) returned 2 [0029.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.989] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.989] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.989] GetLastError () returned 0x578 [0029.989] CanUserWritePwrScheme () returned 1 [0029.990] GetSystemMetrics (nIndex=46) returned 2 [0029.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.990] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.990] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.990] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0029.997] GetWindowTextLengthA (hWnd=0x0) returned 0 [0029.997] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0029.997] GetLastError () returned 0x578 [0029.997] CanUserWritePwrScheme () returned 1 [0029.998] GetSystemMetrics (nIndex=46) returned 2 [0029.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0029.998] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0029.998] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0029.998] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.003] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.003] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.003] GetLastError () returned 0x578 [0030.003] CanUserWritePwrScheme () returned 1 [0030.003] GetSystemMetrics (nIndex=46) returned 2 [0030.003] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.003] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.003] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.003] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.008] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.008] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.008] GetLastError () returned 0x578 [0030.009] CanUserWritePwrScheme () returned 1 [0030.009] GetSystemMetrics (nIndex=46) returned 2 [0030.009] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.009] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.009] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.009] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.014] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.014] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.014] GetLastError () returned 0x578 [0030.014] CanUserWritePwrScheme () returned 1 [0030.014] GetSystemMetrics (nIndex=46) returned 2 [0030.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.019] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.019] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.019] GetLastError () returned 0x578 [0030.019] CanUserWritePwrScheme () returned 1 [0030.020] GetSystemMetrics (nIndex=46) returned 2 [0030.020] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.020] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.020] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.020] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.025] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.025] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.025] GetLastError () returned 0x578 [0030.025] CanUserWritePwrScheme () returned 1 [0030.025] GetSystemMetrics (nIndex=46) returned 2 [0030.025] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.025] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.025] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.025] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.030] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.030] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.030] GetLastError () returned 0x578 [0030.030] CanUserWritePwrScheme () returned 1 [0030.031] GetSystemMetrics (nIndex=46) returned 2 [0030.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.031] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.031] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.031] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.052] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.052] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.052] GetLastError () returned 0x578 [0030.052] CanUserWritePwrScheme () returned 1 [0030.053] GetSystemMetrics (nIndex=46) returned 2 [0030.053] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.053] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.053] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.053] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.060] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.061] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.061] GetLastError () returned 0x578 [0030.061] CanUserWritePwrScheme () returned 1 [0030.061] GetSystemMetrics (nIndex=46) returned 2 [0030.061] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.061] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.061] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.061] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.075] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.075] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.075] GetLastError () returned 0x578 [0030.075] CanUserWritePwrScheme () returned 1 [0030.076] GetSystemMetrics (nIndex=46) returned 2 [0030.076] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.076] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.076] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.076] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.084] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.084] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.084] GetLastError () returned 0x578 [0030.084] CanUserWritePwrScheme () returned 1 [0030.084] GetSystemMetrics (nIndex=46) returned 2 [0030.084] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.085] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.085] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.085] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.089] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.089] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.090] GetLastError () returned 0x578 [0030.090] CanUserWritePwrScheme () returned 1 [0030.090] GetSystemMetrics (nIndex=46) returned 2 [0030.090] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.090] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.090] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.090] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.095] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.095] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.095] GetLastError () returned 0x578 [0030.095] CanUserWritePwrScheme () returned 1 [0030.095] GetSystemMetrics (nIndex=46) returned 2 [0030.095] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.095] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.095] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.095] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.101] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.101] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.101] GetLastError () returned 0x578 [0030.101] CanUserWritePwrScheme () returned 1 [0030.101] GetSystemMetrics (nIndex=46) returned 2 [0030.101] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.101] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.101] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.101] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.106] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.106] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.106] GetLastError () returned 0x578 [0030.106] CanUserWritePwrScheme () returned 1 [0030.107] GetSystemMetrics (nIndex=46) returned 2 [0030.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.107] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.112] GetLastError () returned 0x578 [0030.112] CanUserWritePwrScheme () returned 1 [0030.113] GetSystemMetrics (nIndex=46) returned 2 [0030.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.118] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.118] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.118] GetLastError () returned 0x578 [0030.118] CanUserWritePwrScheme () returned 1 [0030.118] GetSystemMetrics (nIndex=46) returned 2 [0030.118] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.118] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.118] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.118] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.127] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.127] GetLastError () returned 0x578 [0030.127] CanUserWritePwrScheme () returned 1 [0030.127] GetSystemMetrics (nIndex=46) returned 2 [0030.127] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.127] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.127] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.127] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.132] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.132] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.132] GetLastError () returned 0x578 [0030.132] CanUserWritePwrScheme () returned 1 [0030.133] GetSystemMetrics (nIndex=46) returned 2 [0030.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.133] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.133] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.133] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.138] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.138] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.138] GetLastError () returned 0x578 [0030.138] CanUserWritePwrScheme () returned 1 [0030.138] GetSystemMetrics (nIndex=46) returned 2 [0030.138] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.138] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.138] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.138] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.143] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.143] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.143] GetLastError () returned 0x578 [0030.143] CanUserWritePwrScheme () returned 1 [0030.144] GetSystemMetrics (nIndex=46) returned 2 [0030.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.144] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.144] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.144] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.149] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.149] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.149] GetLastError () returned 0x578 [0030.149] CanUserWritePwrScheme () returned 1 [0030.149] GetSystemMetrics (nIndex=46) returned 2 [0030.149] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.149] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.149] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.149] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.154] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.154] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.154] GetLastError () returned 0x578 [0030.154] CanUserWritePwrScheme () returned 1 [0030.155] GetSystemMetrics (nIndex=46) returned 2 [0030.155] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.155] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.155] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.155] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.181] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.181] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.181] GetLastError () returned 0x578 [0030.181] CanUserWritePwrScheme () returned 1 [0030.182] GetSystemMetrics (nIndex=46) returned 2 [0030.182] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.182] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.182] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.182] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.190] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.190] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.190] GetLastError () returned 0x578 [0030.191] CanUserWritePwrScheme () returned 1 [0030.191] GetSystemMetrics (nIndex=46) returned 2 [0030.191] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.191] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.191] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.191] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.196] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.196] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.196] GetLastError () returned 0x578 [0030.196] CanUserWritePwrScheme () returned 1 [0030.197] GetSystemMetrics (nIndex=46) returned 2 [0030.197] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.197] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.197] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.197] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.202] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.202] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.202] GetLastError () returned 0x578 [0030.202] CanUserWritePwrScheme () returned 1 [0030.202] GetSystemMetrics (nIndex=46) returned 2 [0030.202] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.202] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.202] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.202] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.207] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.207] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.207] GetLastError () returned 0x578 [0030.207] CanUserWritePwrScheme () returned 1 [0030.207] GetSystemMetrics (nIndex=46) returned 2 [0030.207] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.208] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.208] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.208] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.213] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.213] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.213] GetLastError () returned 0x578 [0030.213] CanUserWritePwrScheme () returned 1 [0030.213] GetSystemMetrics (nIndex=46) returned 2 [0030.213] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.213] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.213] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.213] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.218] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.218] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.218] GetLastError () returned 0x578 [0030.218] CanUserWritePwrScheme () returned 1 [0030.219] GetSystemMetrics (nIndex=46) returned 2 [0030.219] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.219] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.219] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.219] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.265] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.265] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.265] GetLastError () returned 0x578 [0030.265] CanUserWritePwrScheme () returned 1 [0030.266] GetSystemMetrics (nIndex=46) returned 2 [0030.266] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.266] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.266] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.266] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.272] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.272] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.272] GetLastError () returned 0x578 [0030.272] CanUserWritePwrScheme () returned 1 [0030.273] GetSystemMetrics (nIndex=46) returned 2 [0030.273] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.273] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.273] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.273] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.278] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.278] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.278] GetLastError () returned 0x578 [0030.278] CanUserWritePwrScheme () returned 1 [0030.279] GetSystemMetrics (nIndex=46) returned 2 [0030.279] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.279] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.279] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.279] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.284] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.284] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.284] GetLastError () returned 0x578 [0030.284] CanUserWritePwrScheme () returned 1 [0030.284] GetSystemMetrics (nIndex=46) returned 2 [0030.284] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.284] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.284] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.284] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.290] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.290] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.290] GetLastError () returned 0x578 [0030.290] CanUserWritePwrScheme () returned 1 [0030.290] GetSystemMetrics (nIndex=46) returned 2 [0030.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.295] GetLastError () returned 0x578 [0030.295] CanUserWritePwrScheme () returned 1 [0030.296] GetSystemMetrics (nIndex=46) returned 2 [0030.296] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.296] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.296] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.296] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.301] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.301] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.301] GetLastError () returned 0x578 [0030.301] CanUserWritePwrScheme () returned 1 [0030.301] GetSystemMetrics (nIndex=46) returned 2 [0030.301] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.301] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.301] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.301] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.307] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.307] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.307] GetLastError () returned 0x578 [0030.307] CanUserWritePwrScheme () returned 1 [0030.307] GetSystemMetrics (nIndex=46) returned 2 [0030.307] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.307] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.307] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.307] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.312] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.312] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.312] GetLastError () returned 0x578 [0030.312] CanUserWritePwrScheme () returned 1 [0030.313] GetSystemMetrics (nIndex=46) returned 2 [0030.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.313] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.313] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.313] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.321] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.321] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.321] GetLastError () returned 0x578 [0030.321] CanUserWritePwrScheme () returned 1 [0030.322] GetSystemMetrics (nIndex=46) returned 2 [0030.322] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.322] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.322] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.322] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.327] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.327] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.327] GetLastError () returned 0x578 [0030.327] CanUserWritePwrScheme () returned 1 [0030.327] GetSystemMetrics (nIndex=46) returned 2 [0030.327] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.327] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.327] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.327] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.332] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.332] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.332] GetLastError () returned 0x578 [0030.332] CanUserWritePwrScheme () returned 1 [0030.333] GetSystemMetrics (nIndex=46) returned 2 [0030.333] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.333] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.333] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.333] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.374] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.374] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.375] GetLastError () returned 0x578 [0030.375] CanUserWritePwrScheme () returned 1 [0030.375] GetSystemMetrics (nIndex=46) returned 2 [0030.375] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.375] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.375] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.375] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.386] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.386] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.386] GetLastError () returned 0x578 [0030.386] CanUserWritePwrScheme () returned 1 [0030.387] GetSystemMetrics (nIndex=46) returned 2 [0030.387] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.387] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.387] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.387] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.394] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.394] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.394] GetLastError () returned 0x578 [0030.394] CanUserWritePwrScheme () returned 1 [0030.395] GetSystemMetrics (nIndex=46) returned 2 [0030.395] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.395] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.395] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.395] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.402] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.402] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.402] GetLastError () returned 0x578 [0030.402] CanUserWritePwrScheme () returned 1 [0030.403] GetSystemMetrics (nIndex=46) returned 2 [0030.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.403] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.403] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.403] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.410] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.410] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.410] GetLastError () returned 0x578 [0030.410] CanUserWritePwrScheme () returned 1 [0030.410] GetSystemMetrics (nIndex=46) returned 2 [0030.410] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.410] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.410] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.410] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.467] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.467] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.467] GetLastError () returned 0x578 [0030.467] CanUserWritePwrScheme () returned 1 [0030.468] GetSystemMetrics (nIndex=46) returned 2 [0030.468] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.468] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.468] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.468] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.476] GetLastError () returned 0x578 [0030.476] CanUserWritePwrScheme () returned 1 [0030.476] GetSystemMetrics (nIndex=46) returned 2 [0030.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.476] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.476] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.476] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.484] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.484] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.484] GetLastError () returned 0x578 [0030.484] CanUserWritePwrScheme () returned 1 [0030.485] GetSystemMetrics (nIndex=46) returned 2 [0030.485] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.485] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.485] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.485] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.490] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.490] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.490] GetLastError () returned 0x578 [0030.490] CanUserWritePwrScheme () returned 1 [0030.490] GetSystemMetrics (nIndex=46) returned 2 [0030.490] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.490] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.490] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.490] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.495] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.495] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.495] GetLastError () returned 0x578 [0030.495] CanUserWritePwrScheme () returned 1 [0030.496] GetSystemMetrics (nIndex=46) returned 2 [0030.496] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.496] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.496] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.496] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.501] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.501] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.501] GetLastError () returned 0x578 [0030.501] CanUserWritePwrScheme () returned 1 [0030.502] GetSystemMetrics (nIndex=46) returned 2 [0030.502] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.502] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.502] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.502] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.507] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.507] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.507] GetLastError () returned 0x578 [0030.507] CanUserWritePwrScheme () returned 1 [0030.508] GetSystemMetrics (nIndex=46) returned 2 [0030.508] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.508] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.508] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.508] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.563] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.563] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.563] GetLastError () returned 0x578 [0030.563] CanUserWritePwrScheme () returned 1 [0030.564] GetSystemMetrics (nIndex=46) returned 2 [0030.564] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.564] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.564] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.564] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.570] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.570] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.570] GetLastError () returned 0x578 [0030.571] CanUserWritePwrScheme () returned 1 [0030.571] GetSystemMetrics (nIndex=46) returned 2 [0030.571] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.571] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.571] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.571] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.576] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.576] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.576] GetLastError () returned 0x578 [0030.576] CanUserWritePwrScheme () returned 1 [0030.576] GetSystemMetrics (nIndex=46) returned 2 [0030.576] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.576] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.576] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.576] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.584] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.584] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.584] GetLastError () returned 0x578 [0030.584] CanUserWritePwrScheme () returned 1 [0030.584] GetSystemMetrics (nIndex=46) returned 2 [0030.584] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.585] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.585] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.585] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.589] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.589] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.590] GetLastError () returned 0x578 [0030.590] CanUserWritePwrScheme () returned 1 [0030.590] GetSystemMetrics (nIndex=46) returned 2 [0030.590] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.590] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.590] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.590] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.595] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.595] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.595] GetLastError () returned 0x578 [0030.595] CanUserWritePwrScheme () returned 1 [0030.595] GetSystemMetrics (nIndex=46) returned 2 [0030.596] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.596] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.596] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.596] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.601] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.601] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.601] GetLastError () returned 0x578 [0030.601] CanUserWritePwrScheme () returned 1 [0030.601] GetSystemMetrics (nIndex=46) returned 2 [0030.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.607] GetLastError () returned 0x578 [0030.607] CanUserWritePwrScheme () returned 1 [0030.607] GetSystemMetrics (nIndex=46) returned 2 [0030.607] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.607] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.607] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.607] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.613] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.613] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.613] GetLastError () returned 0x578 [0030.613] CanUserWritePwrScheme () returned 1 [0030.613] GetSystemMetrics (nIndex=46) returned 2 [0030.613] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.613] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.613] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.613] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.619] GetLastError () returned 0x578 [0030.619] CanUserWritePwrScheme () returned 1 [0030.620] GetSystemMetrics (nIndex=46) returned 2 [0030.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.625] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.625] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.625] GetLastError () returned 0x578 [0030.625] CanUserWritePwrScheme () returned 1 [0030.625] GetSystemMetrics (nIndex=46) returned 2 [0030.626] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.626] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.626] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.626] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.632] GetLastError () returned 0x578 [0030.632] CanUserWritePwrScheme () returned 1 [0030.632] GetSystemMetrics (nIndex=46) returned 2 [0030.632] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.632] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.632] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.632] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.638] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.638] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.638] GetLastError () returned 0x578 [0030.638] CanUserWritePwrScheme () returned 1 [0030.639] GetSystemMetrics (nIndex=46) returned 2 [0030.639] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.639] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.639] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.639] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.656] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.656] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.656] GetLastError () returned 0x578 [0030.656] CanUserWritePwrScheme () returned 1 [0030.657] GetSystemMetrics (nIndex=46) returned 2 [0030.657] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.657] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.657] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.657] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.665] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.665] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.665] GetLastError () returned 0x578 [0030.665] CanUserWritePwrScheme () returned 1 [0030.665] GetSystemMetrics (nIndex=46) returned 2 [0030.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.665] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.665] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.665] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.673] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.673] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.673] GetLastError () returned 0x578 [0030.673] CanUserWritePwrScheme () returned 1 [0030.673] GetSystemMetrics (nIndex=46) returned 2 [0030.673] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.673] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.673] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.673] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.678] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.678] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.678] GetLastError () returned 0x578 [0030.678] CanUserWritePwrScheme () returned 1 [0030.679] GetSystemMetrics (nIndex=46) returned 2 [0030.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.679] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.684] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.684] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.684] GetLastError () returned 0x578 [0030.684] CanUserWritePwrScheme () returned 1 [0030.684] GetSystemMetrics (nIndex=46) returned 2 [0030.684] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.684] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.684] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.689] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.689] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.689] GetLastError () returned 0x578 [0030.689] CanUserWritePwrScheme () returned 1 [0030.690] GetSystemMetrics (nIndex=46) returned 2 [0030.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.690] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.690] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.690] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.695] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.695] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.695] GetLastError () returned 0x578 [0030.695] CanUserWritePwrScheme () returned 1 [0030.696] GetSystemMetrics (nIndex=46) returned 2 [0030.696] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.696] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.696] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.696] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.701] GetLastError () returned 0x578 [0030.701] CanUserWritePwrScheme () returned 1 [0030.701] GetSystemMetrics (nIndex=46) returned 2 [0030.701] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.701] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.701] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.701] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.742] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.742] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.742] GetLastError () returned 0x578 [0030.742] CanUserWritePwrScheme () returned 1 [0030.743] GetSystemMetrics (nIndex=46) returned 2 [0030.743] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.743] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.743] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.743] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.748] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.748] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.748] GetLastError () returned 0x578 [0030.748] CanUserWritePwrScheme () returned 1 [0030.748] GetSystemMetrics (nIndex=46) returned 2 [0030.748] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.748] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.748] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.748] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.753] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.753] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.753] GetLastError () returned 0x578 [0030.753] CanUserWritePwrScheme () returned 1 [0030.754] GetSystemMetrics (nIndex=46) returned 2 [0030.754] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.754] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.754] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.754] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.759] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.759] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.759] GetLastError () returned 0x578 [0030.759] CanUserWritePwrScheme () returned 1 [0030.760] GetSystemMetrics (nIndex=46) returned 2 [0030.760] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.760] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.760] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.760] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.765] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.765] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.765] GetLastError () returned 0x578 [0030.765] CanUserWritePwrScheme () returned 1 [0030.765] GetSystemMetrics (nIndex=46) returned 2 [0030.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.765] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.765] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.765] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.770] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.770] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.771] GetLastError () returned 0x578 [0030.771] CanUserWritePwrScheme () returned 1 [0030.771] GetSystemMetrics (nIndex=46) returned 2 [0030.771] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.771] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.771] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.771] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.780] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.780] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.780] GetLastError () returned 0x578 [0030.780] CanUserWritePwrScheme () returned 1 [0030.780] GetSystemMetrics (nIndex=46) returned 2 [0030.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.786] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.786] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.786] GetLastError () returned 0x578 [0030.786] CanUserWritePwrScheme () returned 1 [0030.786] GetSystemMetrics (nIndex=46) returned 2 [0030.786] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.786] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.786] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.786] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.792] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.792] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.792] GetLastError () returned 0x578 [0030.792] CanUserWritePwrScheme () returned 1 [0030.792] GetSystemMetrics (nIndex=46) returned 2 [0030.792] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.792] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.792] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.792] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.797] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.798] GetLastError () returned 0x578 [0030.798] CanUserWritePwrScheme () returned 1 [0030.798] GetSystemMetrics (nIndex=46) returned 2 [0030.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.798] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.798] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.798] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.805] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.805] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.805] GetLastError () returned 0x578 [0030.805] CanUserWritePwrScheme () returned 1 [0030.805] GetSystemMetrics (nIndex=46) returned 2 [0030.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.811] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.811] GetLastError () returned 0x578 [0030.811] CanUserWritePwrScheme () returned 1 [0030.811] GetSystemMetrics (nIndex=46) returned 2 [0030.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.816] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.816] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.816] GetLastError () returned 0x578 [0030.816] CanUserWritePwrScheme () returned 1 [0030.817] GetSystemMetrics (nIndex=46) returned 2 [0030.817] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.817] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.817] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.817] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.822] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.822] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.822] GetLastError () returned 0x578 [0030.822] CanUserWritePwrScheme () returned 1 [0030.822] GetSystemMetrics (nIndex=46) returned 2 [0030.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.822] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.822] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.822] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.836] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.837] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.837] GetLastError () returned 0x578 [0030.837] CanUserWritePwrScheme () returned 1 [0030.837] GetSystemMetrics (nIndex=46) returned 2 [0030.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.837] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.837] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.837] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.844] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.844] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.844] GetLastError () returned 0x578 [0030.844] CanUserWritePwrScheme () returned 1 [0030.845] GetSystemMetrics (nIndex=46) returned 2 [0030.845] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.845] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.845] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.845] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.850] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.850] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.850] GetLastError () returned 0x578 [0030.850] CanUserWritePwrScheme () returned 1 [0030.851] GetSystemMetrics (nIndex=46) returned 2 [0030.851] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.851] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.851] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.851] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.856] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.856] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.856] GetLastError () returned 0x578 [0030.856] CanUserWritePwrScheme () returned 1 [0030.856] GetSystemMetrics (nIndex=46) returned 2 [0030.856] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.856] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.856] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.861] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.861] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.861] GetLastError () returned 0x578 [0030.861] CanUserWritePwrScheme () returned 1 [0030.861] GetSystemMetrics (nIndex=46) returned 2 [0030.862] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.862] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.862] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.862] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.866] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.866] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.867] GetLastError () returned 0x578 [0030.867] CanUserWritePwrScheme () returned 1 [0030.867] GetSystemMetrics (nIndex=46) returned 2 [0030.867] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.867] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.867] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.867] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.928] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.928] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.928] GetLastError () returned 0x578 [0030.928] CanUserWritePwrScheme () returned 1 [0030.928] GetSystemMetrics (nIndex=46) returned 2 [0030.928] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.928] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.928] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.928] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.933] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.933] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.933] GetLastError () returned 0x578 [0030.933] CanUserWritePwrScheme () returned 1 [0030.934] GetSystemMetrics (nIndex=46) returned 2 [0030.934] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.934] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.934] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.934] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.960] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.960] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.960] GetLastError () returned 0x578 [0030.960] CanUserWritePwrScheme () returned 1 [0030.960] GetSystemMetrics (nIndex=46) returned 2 [0030.960] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.960] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.960] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.960] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.970] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.970] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.970] GetLastError () returned 0x578 [0030.970] CanUserWritePwrScheme () returned 1 [0030.970] GetSystemMetrics (nIndex=46) returned 2 [0030.970] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.970] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.970] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.970] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.979] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.979] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.979] GetLastError () returned 0x578 [0030.980] CanUserWritePwrScheme () returned 1 [0030.980] GetSystemMetrics (nIndex=46) returned 2 [0030.980] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.980] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.980] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.980] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.987] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.987] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.987] GetLastError () returned 0x578 [0030.987] CanUserWritePwrScheme () returned 1 [0030.987] GetSystemMetrics (nIndex=46) returned 2 [0030.987] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.987] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.987] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.987] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0030.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0030.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0030.994] GetLastError () returned 0x578 [0030.994] CanUserWritePwrScheme () returned 1 [0030.994] GetSystemMetrics (nIndex=46) returned 2 [0030.994] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0030.994] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0030.994] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0030.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.002] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.002] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.002] GetLastError () returned 0x578 [0031.002] CanUserWritePwrScheme () returned 1 [0031.002] GetSystemMetrics (nIndex=46) returned 2 [0031.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.002] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.002] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.002] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.009] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.009] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.009] GetLastError () returned 0x578 [0031.009] CanUserWritePwrScheme () returned 1 [0031.009] GetSystemMetrics (nIndex=46) returned 2 [0031.009] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.009] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.009] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.009] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.014] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.014] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.014] GetLastError () returned 0x578 [0031.014] CanUserWritePwrScheme () returned 1 [0031.015] GetSystemMetrics (nIndex=46) returned 2 [0031.015] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.015] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.015] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.015] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.020] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.020] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.020] GetLastError () returned 0x578 [0031.020] CanUserWritePwrScheme () returned 1 [0031.020] GetSystemMetrics (nIndex=46) returned 2 [0031.020] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.020] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.020] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.020] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.025] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.025] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.026] GetLastError () returned 0x578 [0031.026] CanUserWritePwrScheme () returned 1 [0031.026] GetSystemMetrics (nIndex=46) returned 2 [0031.026] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.026] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.026] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.026] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.031] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.031] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.031] GetLastError () returned 0x578 [0031.031] CanUserWritePwrScheme () returned 1 [0031.031] GetSystemMetrics (nIndex=46) returned 2 [0031.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.031] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.031] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.031] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.043] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.043] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.043] GetLastError () returned 0x578 [0031.043] CanUserWritePwrScheme () returned 1 [0031.043] GetSystemMetrics (nIndex=46) returned 2 [0031.043] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.043] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.043] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.043] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.048] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.048] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.048] GetLastError () returned 0x578 [0031.048] CanUserWritePwrScheme () returned 1 [0031.049] GetSystemMetrics (nIndex=46) returned 2 [0031.049] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.049] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.049] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.049] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.054] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.054] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.054] GetLastError () returned 0x578 [0031.054] CanUserWritePwrScheme () returned 1 [0031.054] GetSystemMetrics (nIndex=46) returned 2 [0031.054] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.054] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.054] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.054] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.059] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.059] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.059] GetLastError () returned 0x578 [0031.059] CanUserWritePwrScheme () returned 1 [0031.060] GetSystemMetrics (nIndex=46) returned 2 [0031.060] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.060] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.060] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.060] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.065] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.065] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.065] GetLastError () returned 0x578 [0031.065] CanUserWritePwrScheme () returned 1 [0031.065] GetSystemMetrics (nIndex=46) returned 2 [0031.065] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.066] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.066] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.066] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.071] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.071] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.071] GetLastError () returned 0x578 [0031.071] CanUserWritePwrScheme () returned 1 [0031.071] GetSystemMetrics (nIndex=46) returned 2 [0031.071] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.071] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.071] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.071] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.077] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.077] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.077] GetLastError () returned 0x578 [0031.077] CanUserWritePwrScheme () returned 1 [0031.078] GetSystemMetrics (nIndex=46) returned 2 [0031.078] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.078] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.078] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.078] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.083] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.083] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.083] GetLastError () returned 0x578 [0031.083] CanUserWritePwrScheme () returned 1 [0031.083] GetSystemMetrics (nIndex=46) returned 2 [0031.083] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.084] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.084] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.084] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.088] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.088] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.089] GetLastError () returned 0x578 [0031.089] CanUserWritePwrScheme () returned 1 [0031.089] GetSystemMetrics (nIndex=46) returned 2 [0031.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.089] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.089] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.089] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.094] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.094] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.094] GetLastError () returned 0x578 [0031.094] CanUserWritePwrScheme () returned 1 [0031.094] GetSystemMetrics (nIndex=46) returned 2 [0031.094] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.094] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.094] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.094] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.103] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.103] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.103] GetLastError () returned 0x578 [0031.103] CanUserWritePwrScheme () returned 1 [0031.103] GetSystemMetrics (nIndex=46) returned 2 [0031.104] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.104] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.104] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.104] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.108] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.108] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.109] GetLastError () returned 0x578 [0031.109] CanUserWritePwrScheme () returned 1 [0031.109] GetSystemMetrics (nIndex=46) returned 2 [0031.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.109] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.109] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.109] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.123] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.123] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.123] GetLastError () returned 0x578 [0031.123] CanUserWritePwrScheme () returned 1 [0031.124] GetSystemMetrics (nIndex=46) returned 2 [0031.124] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.124] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.124] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.124] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.138] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.138] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.138] GetLastError () returned 0x578 [0031.139] CanUserWritePwrScheme () returned 1 [0031.139] GetSystemMetrics (nIndex=46) returned 2 [0031.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.139] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.139] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.139] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.144] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.144] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.144] GetLastError () returned 0x578 [0031.144] CanUserWritePwrScheme () returned 1 [0031.144] GetSystemMetrics (nIndex=46) returned 2 [0031.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.144] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.144] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.144] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.150] GetLastError () returned 0x578 [0031.150] CanUserWritePwrScheme () returned 1 [0031.150] GetSystemMetrics (nIndex=46) returned 2 [0031.150] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.150] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.150] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.150] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.155] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.155] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.155] GetLastError () returned 0x578 [0031.155] CanUserWritePwrScheme () returned 1 [0031.156] GetSystemMetrics (nIndex=46) returned 2 [0031.156] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.156] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.156] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.156] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.160] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.161] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.161] GetLastError () returned 0x578 [0031.161] CanUserWritePwrScheme () returned 1 [0031.161] GetSystemMetrics (nIndex=46) returned 2 [0031.161] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.162] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.162] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.162] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.170] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.170] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.170] GetLastError () returned 0x578 [0031.170] CanUserWritePwrScheme () returned 1 [0031.171] GetSystemMetrics (nIndex=46) returned 2 [0031.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.171] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.171] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.171] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.176] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.176] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.176] GetLastError () returned 0x578 [0031.176] CanUserWritePwrScheme () returned 1 [0031.176] GetSystemMetrics (nIndex=46) returned 2 [0031.176] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.176] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.176] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.176] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.181] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.181] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.181] GetLastError () returned 0x578 [0031.181] CanUserWritePwrScheme () returned 1 [0031.182] GetSystemMetrics (nIndex=46) returned 2 [0031.182] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.182] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.182] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.182] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.187] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.187] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.187] GetLastError () returned 0x578 [0031.187] CanUserWritePwrScheme () returned 1 [0031.187] GetSystemMetrics (nIndex=46) returned 2 [0031.187] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.187] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.187] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.187] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.193] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.193] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.193] GetLastError () returned 0x578 [0031.193] CanUserWritePwrScheme () returned 1 [0031.193] GetSystemMetrics (nIndex=46) returned 2 [0031.193] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.193] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.193] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.193] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.198] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.198] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.198] GetLastError () returned 0x578 [0031.198] CanUserWritePwrScheme () returned 1 [0031.198] GetSystemMetrics (nIndex=46) returned 2 [0031.199] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.199] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.199] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.199] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.203] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.203] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.204] GetLastError () returned 0x578 [0031.204] CanUserWritePwrScheme () returned 1 [0031.204] GetSystemMetrics (nIndex=46) returned 2 [0031.204] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.204] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.204] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.204] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.209] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.209] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.209] GetLastError () returned 0x578 [0031.209] CanUserWritePwrScheme () returned 1 [0031.210] GetSystemMetrics (nIndex=46) returned 2 [0031.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.210] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.210] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.210] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.219] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.219] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.219] GetLastError () returned 0x578 [0031.219] CanUserWritePwrScheme () returned 1 [0031.219] GetSystemMetrics (nIndex=46) returned 2 [0031.219] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.219] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.220] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.220] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.225] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.225] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.225] GetLastError () returned 0x578 [0031.225] CanUserWritePwrScheme () returned 1 [0031.225] GetSystemMetrics (nIndex=46) returned 2 [0031.225] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.225] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.225] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.225] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.230] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.230] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.230] GetLastError () returned 0x578 [0031.230] CanUserWritePwrScheme () returned 1 [0031.230] GetSystemMetrics (nIndex=46) returned 2 [0031.230] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.231] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.231] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.231] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.238] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.238] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.238] GetLastError () returned 0x578 [0031.238] CanUserWritePwrScheme () returned 1 [0031.239] GetSystemMetrics (nIndex=46) returned 2 [0031.239] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.239] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.239] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.239] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.244] GetLastError () returned 0x578 [0031.244] CanUserWritePwrScheme () returned 1 [0031.244] GetSystemMetrics (nIndex=46) returned 2 [0031.244] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.244] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.244] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.244] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.249] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.249] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.249] GetLastError () returned 0x578 [0031.249] CanUserWritePwrScheme () returned 1 [0031.250] GetSystemMetrics (nIndex=46) returned 2 [0031.250] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.250] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.250] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.250] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.255] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.255] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.255] GetLastError () returned 0x578 [0031.255] CanUserWritePwrScheme () returned 1 [0031.255] GetSystemMetrics (nIndex=46) returned 2 [0031.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.255] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.255] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.260] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.260] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.260] GetLastError () returned 0x578 [0031.260] CanUserWritePwrScheme () returned 1 [0031.261] GetSystemMetrics (nIndex=46) returned 2 [0031.261] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.261] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.261] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.261] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.266] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.266] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.266] GetLastError () returned 0x578 [0031.266] CanUserWritePwrScheme () returned 1 [0031.266] GetSystemMetrics (nIndex=46) returned 2 [0031.266] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.266] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.266] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.266] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.271] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.271] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.271] GetLastError () returned 0x578 [0031.271] CanUserWritePwrScheme () returned 1 [0031.272] GetSystemMetrics (nIndex=46) returned 2 [0031.272] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.272] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.272] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.272] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.289] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.289] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.289] GetLastError () returned 0x578 [0031.289] CanUserWritePwrScheme () returned 1 [0031.290] GetSystemMetrics (nIndex=46) returned 2 [0031.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.295] GetLastError () returned 0x578 [0031.295] CanUserWritePwrScheme () returned 1 [0031.295] GetSystemMetrics (nIndex=46) returned 2 [0031.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.309] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.309] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.309] GetLastError () returned 0x578 [0031.309] CanUserWritePwrScheme () returned 1 [0031.310] GetSystemMetrics (nIndex=46) returned 2 [0031.310] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.310] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.310] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.310] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.315] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.315] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.315] GetLastError () returned 0x578 [0031.315] CanUserWritePwrScheme () returned 1 [0031.315] GetSystemMetrics (nIndex=46) returned 2 [0031.315] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.315] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.315] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.315] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.320] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.320] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.320] GetLastError () returned 0x578 [0031.320] CanUserWritePwrScheme () returned 1 [0031.321] GetSystemMetrics (nIndex=46) returned 2 [0031.321] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.321] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.321] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.321] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.326] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.326] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.326] GetLastError () returned 0x578 [0031.326] CanUserWritePwrScheme () returned 1 [0031.326] GetSystemMetrics (nIndex=46) returned 2 [0031.326] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.326] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.326] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.326] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.331] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.331] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.331] GetLastError () returned 0x578 [0031.331] CanUserWritePwrScheme () returned 1 [0031.332] GetSystemMetrics (nIndex=46) returned 2 [0031.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.337] GetLastError () returned 0x578 [0031.337] CanUserWritePwrScheme () returned 1 [0031.337] GetSystemMetrics (nIndex=46) returned 2 [0031.337] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.337] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.337] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.337] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.342] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.342] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.342] GetLastError () returned 0x578 [0031.342] CanUserWritePwrScheme () returned 1 [0031.343] GetSystemMetrics (nIndex=46) returned 2 [0031.343] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.343] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.343] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.343] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.348] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.348] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.348] GetLastError () returned 0x578 [0031.348] CanUserWritePwrScheme () returned 1 [0031.348] GetSystemMetrics (nIndex=46) returned 2 [0031.348] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.348] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.348] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.348] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.353] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.353] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.353] GetLastError () returned 0x578 [0031.353] CanUserWritePwrScheme () returned 1 [0031.354] GetSystemMetrics (nIndex=46) returned 2 [0031.354] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.354] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.354] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.354] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.359] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.359] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.359] GetLastError () returned 0x578 [0031.359] CanUserWritePwrScheme () returned 1 [0031.359] GetSystemMetrics (nIndex=46) returned 2 [0031.359] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.359] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.359] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.359] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.367] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.367] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.367] GetLastError () returned 0x578 [0031.367] CanUserWritePwrScheme () returned 1 [0031.368] GetSystemMetrics (nIndex=46) returned 2 [0031.368] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.368] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.368] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.368] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.373] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.373] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.373] GetLastError () returned 0x578 [0031.373] CanUserWritePwrScheme () returned 1 [0031.373] GetSystemMetrics (nIndex=46) returned 2 [0031.373] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.373] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.373] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.373] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.378] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.378] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.378] GetLastError () returned 0x578 [0031.378] CanUserWritePwrScheme () returned 1 [0031.379] GetSystemMetrics (nIndex=46) returned 2 [0031.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.379] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.379] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.379] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.384] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.384] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.384] GetLastError () returned 0x578 [0031.384] CanUserWritePwrScheme () returned 1 [0031.384] GetSystemMetrics (nIndex=46) returned 2 [0031.384] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.384] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.384] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.384] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.391] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.391] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.391] GetLastError () returned 0x578 [0031.391] CanUserWritePwrScheme () returned 1 [0031.391] GetSystemMetrics (nIndex=46) returned 2 [0031.391] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.391] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.391] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.391] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.396] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.396] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.397] GetLastError () returned 0x578 [0031.397] CanUserWritePwrScheme () returned 1 [0031.397] GetSystemMetrics (nIndex=46) returned 2 [0031.397] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.397] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.397] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.397] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.402] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.402] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.402] GetLastError () returned 0x578 [0031.402] CanUserWritePwrScheme () returned 1 [0031.402] GetSystemMetrics (nIndex=46) returned 2 [0031.402] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.402] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.402] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.402] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.407] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.407] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.407] GetLastError () returned 0x578 [0031.407] CanUserWritePwrScheme () returned 1 [0031.408] GetSystemMetrics (nIndex=46) returned 2 [0031.408] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.408] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.408] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.408] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.413] GetLastError () returned 0x578 [0031.413] CanUserWritePwrScheme () returned 1 [0031.413] GetSystemMetrics (nIndex=46) returned 2 [0031.413] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.413] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.413] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.413] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.418] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.418] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.418] GetLastError () returned 0x578 [0031.418] CanUserWritePwrScheme () returned 1 [0031.419] GetSystemMetrics (nIndex=46) returned 2 [0031.419] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.419] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.419] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.419] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.424] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.424] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.424] GetLastError () returned 0x578 [0031.424] CanUserWritePwrScheme () returned 1 [0031.424] GetSystemMetrics (nIndex=46) returned 2 [0031.424] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.424] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.424] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.424] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.441] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.441] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.441] GetLastError () returned 0x578 [0031.441] CanUserWritePwrScheme () returned 1 [0031.441] GetSystemMetrics (nIndex=46) returned 2 [0031.441] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.441] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.441] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.441] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.450] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.450] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.450] GetLastError () returned 0x578 [0031.450] CanUserWritePwrScheme () returned 1 [0031.450] GetSystemMetrics (nIndex=46) returned 2 [0031.450] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.450] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.450] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.450] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.455] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.455] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.455] GetLastError () returned 0x578 [0031.455] CanUserWritePwrScheme () returned 1 [0031.456] GetSystemMetrics (nIndex=46) returned 2 [0031.456] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.456] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.456] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.456] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.461] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.461] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.461] GetLastError () returned 0x578 [0031.461] CanUserWritePwrScheme () returned 1 [0031.461] GetSystemMetrics (nIndex=46) returned 2 [0031.461] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.461] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.461] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.461] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.466] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.466] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.466] GetLastError () returned 0x578 [0031.466] CanUserWritePwrScheme () returned 1 [0031.467] GetSystemMetrics (nIndex=46) returned 2 [0031.467] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.467] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.467] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.467] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.472] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.472] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.472] GetLastError () returned 0x578 [0031.472] CanUserWritePwrScheme () returned 1 [0031.472] GetSystemMetrics (nIndex=46) returned 2 [0031.472] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.472] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.472] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.472] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.477] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.477] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.477] GetLastError () returned 0x578 [0031.478] CanUserWritePwrScheme () returned 1 [0031.478] GetSystemMetrics (nIndex=46) returned 2 [0031.478] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.478] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.478] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.478] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.483] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.483] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.483] GetLastError () returned 0x578 [0031.483] CanUserWritePwrScheme () returned 1 [0031.483] GetSystemMetrics (nIndex=46) returned 2 [0031.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.483] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.484] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.484] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.495] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.495] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.495] GetLastError () returned 0x578 [0031.495] CanUserWritePwrScheme () returned 1 [0031.496] GetSystemMetrics (nIndex=46) returned 2 [0031.496] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.496] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.496] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.496] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.501] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.501] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.501] GetLastError () returned 0x578 [0031.501] CanUserWritePwrScheme () returned 1 [0031.501] GetSystemMetrics (nIndex=46) returned 2 [0031.501] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.501] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.501] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.501] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.506] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.506] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.506] GetLastError () returned 0x578 [0031.507] CanUserWritePwrScheme () returned 1 [0031.507] GetSystemMetrics (nIndex=46) returned 2 [0031.507] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.507] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.507] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.507] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.512] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.512] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.512] GetLastError () returned 0x578 [0031.512] CanUserWritePwrScheme () returned 1 [0031.512] GetSystemMetrics (nIndex=46) returned 2 [0031.512] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.512] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.512] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.512] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.517] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.517] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.517] GetLastError () returned 0x578 [0031.517] CanUserWritePwrScheme () returned 1 [0031.518] GetSystemMetrics (nIndex=46) returned 2 [0031.518] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.518] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.518] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.518] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.523] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.523] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.523] GetLastError () returned 0x578 [0031.523] CanUserWritePwrScheme () returned 1 [0031.523] GetSystemMetrics (nIndex=46) returned 2 [0031.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.524] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.524] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.524] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.528] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.528] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.528] GetLastError () returned 0x578 [0031.528] CanUserWritePwrScheme () returned 1 [0031.529] GetSystemMetrics (nIndex=46) returned 2 [0031.529] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.529] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.529] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.529] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.534] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.534] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.534] GetLastError () returned 0x578 [0031.534] CanUserWritePwrScheme () returned 1 [0031.534] GetSystemMetrics (nIndex=46) returned 2 [0031.534] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.534] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.534] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.534] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.540] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.540] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.540] GetLastError () returned 0x578 [0031.540] CanUserWritePwrScheme () returned 1 [0031.540] GetSystemMetrics (nIndex=46) returned 2 [0031.540] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.540] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.540] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.540] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.545] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.545] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.545] GetLastError () returned 0x578 [0031.545] CanUserWritePwrScheme () returned 1 [0031.546] GetSystemMetrics (nIndex=46) returned 2 [0031.546] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.546] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.546] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.546] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.551] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.551] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.551] GetLastError () returned 0x578 [0031.551] CanUserWritePwrScheme () returned 1 [0031.551] GetSystemMetrics (nIndex=46) returned 2 [0031.551] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.551] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.551] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.551] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.559] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.559] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.559] GetLastError () returned 0x578 [0031.559] CanUserWritePwrScheme () returned 1 [0031.560] GetSystemMetrics (nIndex=46) returned 2 [0031.560] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.560] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.560] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.560] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.567] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.567] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.567] GetLastError () returned 0x578 [0031.567] CanUserWritePwrScheme () returned 1 [0031.567] GetSystemMetrics (nIndex=46) returned 2 [0031.567] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.567] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.567] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.567] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.574] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.575] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.575] GetLastError () returned 0x578 [0031.575] CanUserWritePwrScheme () returned 1 [0031.575] GetSystemMetrics (nIndex=46) returned 2 [0031.575] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.575] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.575] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.575] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.582] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.582] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.582] GetLastError () returned 0x578 [0031.582] CanUserWritePwrScheme () returned 1 [0031.582] GetSystemMetrics (nIndex=46) returned 2 [0031.583] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.583] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.583] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.583] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.590] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.590] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.590] GetLastError () returned 0x578 [0031.590] CanUserWritePwrScheme () returned 1 [0031.591] GetSystemMetrics (nIndex=46) returned 2 [0031.591] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.591] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.591] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.591] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.597] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.597] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.597] GetLastError () returned 0x578 [0031.597] CanUserWritePwrScheme () returned 1 [0031.598] GetSystemMetrics (nIndex=46) returned 2 [0031.598] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.598] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.598] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.598] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.604] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.604] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.604] GetLastError () returned 0x578 [0031.604] CanUserWritePwrScheme () returned 1 [0031.605] GetSystemMetrics (nIndex=46) returned 2 [0031.605] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.605] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.605] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.605] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.611] GetLastError () returned 0x578 [0031.611] CanUserWritePwrScheme () returned 1 [0031.611] GetSystemMetrics (nIndex=46) returned 2 [0031.611] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.611] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.618] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.618] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.619] GetLastError () returned 0x578 [0031.619] CanUserWritePwrScheme () returned 1 [0031.619] GetSystemMetrics (nIndex=46) returned 2 [0031.619] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.619] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.619] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.619] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.628] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.628] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.629] GetLastError () returned 0x578 [0031.629] CanUserWritePwrScheme () returned 1 [0031.629] GetSystemMetrics (nIndex=46) returned 2 [0031.629] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.629] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.629] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.629] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.635] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.636] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.636] GetLastError () returned 0x578 [0031.636] CanUserWritePwrScheme () returned 1 [0031.636] GetSystemMetrics (nIndex=46) returned 2 [0031.636] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.636] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.636] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.636] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.641] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.641] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.641] GetLastError () returned 0x578 [0031.641] CanUserWritePwrScheme () returned 1 [0031.642] GetSystemMetrics (nIndex=46) returned 2 [0031.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.642] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.642] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.642] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.648] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.648] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.648] GetLastError () returned 0x578 [0031.648] CanUserWritePwrScheme () returned 1 [0031.649] GetSystemMetrics (nIndex=46) returned 2 [0031.649] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.649] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.649] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.649] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.685] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.685] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.685] GetLastError () returned 0x578 [0031.685] CanUserWritePwrScheme () returned 1 [0031.686] GetSystemMetrics (nIndex=46) returned 2 [0031.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.686] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.686] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.686] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.694] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.694] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.694] GetLastError () returned 0x578 [0031.694] CanUserWritePwrScheme () returned 1 [0031.694] GetSystemMetrics (nIndex=46) returned 2 [0031.694] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.694] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.694] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.694] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.699] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.699] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.700] GetLastError () returned 0x578 [0031.700] CanUserWritePwrScheme () returned 1 [0031.700] GetSystemMetrics (nIndex=46) returned 2 [0031.700] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.700] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.700] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.700] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.705] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.705] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.705] GetLastError () returned 0x578 [0031.705] CanUserWritePwrScheme () returned 1 [0031.705] GetSystemMetrics (nIndex=46) returned 2 [0031.705] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.706] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.706] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.706] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.711] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.711] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.711] GetLastError () returned 0x578 [0031.711] CanUserWritePwrScheme () returned 1 [0031.711] GetSystemMetrics (nIndex=46) returned 2 [0031.711] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.711] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.711] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.711] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.716] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.716] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.716] GetLastError () returned 0x578 [0031.716] CanUserWritePwrScheme () returned 1 [0031.717] GetSystemMetrics (nIndex=46) returned 2 [0031.717] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.717] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.717] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.717] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.722] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.722] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.722] GetLastError () returned 0x578 [0031.722] CanUserWritePwrScheme () returned 1 [0031.722] GetSystemMetrics (nIndex=46) returned 2 [0031.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.722] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.723] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.723] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.727] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.727] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.728] GetLastError () returned 0x578 [0031.728] CanUserWritePwrScheme () returned 1 [0031.728] GetSystemMetrics (nIndex=46) returned 2 [0031.728] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.728] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.728] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.728] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.733] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.733] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.733] GetLastError () returned 0x578 [0031.733] CanUserWritePwrScheme () returned 1 [0031.733] GetSystemMetrics (nIndex=46) returned 2 [0031.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.733] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.733] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.734] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.738] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.738] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.739] GetLastError () returned 0x578 [0031.739] CanUserWritePwrScheme () returned 1 [0031.739] GetSystemMetrics (nIndex=46) returned 2 [0031.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.739] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.739] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.739] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.744] GetLastError () returned 0x578 [0031.744] CanUserWritePwrScheme () returned 1 [0031.744] GetSystemMetrics (nIndex=46) returned 2 [0031.744] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.744] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.744] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.745] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.750] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.750] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.750] GetLastError () returned 0x578 [0031.750] CanUserWritePwrScheme () returned 1 [0031.750] GetSystemMetrics (nIndex=46) returned 2 [0031.750] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.750] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.750] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.750] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.761] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.761] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.762] GetLastError () returned 0x578 [0031.762] CanUserWritePwrScheme () returned 1 [0031.762] GetSystemMetrics (nIndex=46) returned 2 [0031.762] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.762] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.762] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.762] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.768] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.768] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.768] GetLastError () returned 0x578 [0031.768] CanUserWritePwrScheme () returned 1 [0031.769] GetSystemMetrics (nIndex=46) returned 2 [0031.769] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.769] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.769] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.769] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.774] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.774] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.774] GetLastError () returned 0x578 [0031.774] CanUserWritePwrScheme () returned 1 [0031.775] GetSystemMetrics (nIndex=46) returned 2 [0031.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.775] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.775] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.775] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.780] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.780] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.780] GetLastError () returned 0x578 [0031.780] CanUserWritePwrScheme () returned 1 [0031.780] GetSystemMetrics (nIndex=46) returned 2 [0031.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.785] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.785] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.786] GetLastError () returned 0x578 [0031.786] CanUserWritePwrScheme () returned 1 [0031.786] GetSystemMetrics (nIndex=46) returned 2 [0031.786] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.786] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.786] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.786] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.791] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.791] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.791] GetLastError () returned 0x578 [0031.791] CanUserWritePwrScheme () returned 1 [0031.791] GetSystemMetrics (nIndex=46) returned 2 [0031.791] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.791] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.791] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.791] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.796] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.796] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.796] GetLastError () returned 0x578 [0031.796] CanUserWritePwrScheme () returned 1 [0031.797] GetSystemMetrics (nIndex=46) returned 2 [0031.797] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.797] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.797] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.797] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.802] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.802] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.802] GetLastError () returned 0x578 [0031.802] CanUserWritePwrScheme () returned 1 [0031.802] GetSystemMetrics (nIndex=46) returned 2 [0031.802] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.802] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.802] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.802] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.807] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.807] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.807] GetLastError () returned 0x578 [0031.807] CanUserWritePwrScheme () returned 1 [0031.808] GetSystemMetrics (nIndex=46) returned 2 [0031.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.808] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.808] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.808] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.813] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.813] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.813] GetLastError () returned 0x578 [0031.813] CanUserWritePwrScheme () returned 1 [0031.813] GetSystemMetrics (nIndex=46) returned 2 [0031.813] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.813] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.813] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.813] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.821] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.821] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.821] GetLastError () returned 0x578 [0031.821] CanUserWritePwrScheme () returned 1 [0031.821] GetSystemMetrics (nIndex=46) returned 2 [0031.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.822] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.822] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.822] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.826] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.827] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.827] GetLastError () returned 0x578 [0031.827] CanUserWritePwrScheme () returned 1 [0031.827] GetSystemMetrics (nIndex=46) returned 2 [0031.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.827] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.827] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.827] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.836] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.836] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.836] GetLastError () returned 0x578 [0031.836] CanUserWritePwrScheme () returned 1 [0031.837] GetSystemMetrics (nIndex=46) returned 2 [0031.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.837] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.837] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.837] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.842] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.842] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.842] GetLastError () returned 0x578 [0031.842] CanUserWritePwrScheme () returned 1 [0031.842] GetSystemMetrics (nIndex=46) returned 2 [0031.842] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.842] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.842] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.842] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.847] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.847] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.847] GetLastError () returned 0x578 [0031.847] CanUserWritePwrScheme () returned 1 [0031.848] GetSystemMetrics (nIndex=46) returned 2 [0031.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.848] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.848] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.848] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.853] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.853] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.853] GetLastError () returned 0x578 [0031.853] CanUserWritePwrScheme () returned 1 [0031.853] GetSystemMetrics (nIndex=46) returned 2 [0031.853] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.853] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.853] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.853] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.858] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.858] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.858] GetLastError () returned 0x578 [0031.858] CanUserWritePwrScheme () returned 1 [0031.859] GetSystemMetrics (nIndex=46) returned 2 [0031.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.859] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.859] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.859] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.864] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.864] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.864] GetLastError () returned 0x578 [0031.864] CanUserWritePwrScheme () returned 1 [0031.864] GetSystemMetrics (nIndex=46) returned 2 [0031.864] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.864] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.864] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.864] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.875] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.875] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.875] GetLastError () returned 0x578 [0031.875] CanUserWritePwrScheme () returned 1 [0031.876] GetSystemMetrics (nIndex=46) returned 2 [0031.876] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.876] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.876] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.876] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.884] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.884] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.884] GetLastError () returned 0x578 [0031.884] CanUserWritePwrScheme () returned 1 [0031.884] GetSystemMetrics (nIndex=46) returned 2 [0031.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.884] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.884] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.884] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.889] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.889] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.889] GetLastError () returned 0x578 [0031.889] CanUserWritePwrScheme () returned 1 [0031.890] GetSystemMetrics (nIndex=46) returned 2 [0031.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.890] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.895] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.895] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.895] GetLastError () returned 0x578 [0031.895] CanUserWritePwrScheme () returned 1 [0031.896] GetSystemMetrics (nIndex=46) returned 2 [0031.896] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.896] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.896] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.896] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.908] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.908] GetLastError () returned 0x578 [0031.908] CanUserWritePwrScheme () returned 1 [0031.909] GetSystemMetrics (nIndex=46) returned 2 [0031.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.909] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.909] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.909] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.915] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.915] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.915] GetLastError () returned 0x578 [0031.915] CanUserWritePwrScheme () returned 1 [0031.915] GetSystemMetrics (nIndex=46) returned 2 [0031.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.915] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.915] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.915] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.920] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.920] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.920] GetLastError () returned 0x578 [0031.920] CanUserWritePwrScheme () returned 1 [0031.921] GetSystemMetrics (nIndex=46) returned 2 [0031.921] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.921] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.921] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.921] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.926] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.926] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.926] GetLastError () returned 0x578 [0031.926] CanUserWritePwrScheme () returned 1 [0031.926] GetSystemMetrics (nIndex=46) returned 2 [0031.926] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.926] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.926] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.926] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.931] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.931] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.931] GetLastError () returned 0x578 [0031.931] CanUserWritePwrScheme () returned 1 [0031.931] GetSystemMetrics (nIndex=46) returned 2 [0031.931] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.931] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.931] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.931] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.936] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.936] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.936] GetLastError () returned 0x578 [0031.936] CanUserWritePwrScheme () returned 1 [0031.937] GetSystemMetrics (nIndex=46) returned 2 [0031.937] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.937] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.937] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.937] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.942] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.942] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.942] GetLastError () returned 0x578 [0031.942] CanUserWritePwrScheme () returned 1 [0031.942] GetSystemMetrics (nIndex=46) returned 2 [0031.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.950] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.950] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.950] GetLastError () returned 0x578 [0031.950] CanUserWritePwrScheme () returned 1 [0031.950] GetSystemMetrics (nIndex=46) returned 2 [0031.950] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.950] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.950] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.950] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.955] GetLastError () returned 0x578 [0031.955] CanUserWritePwrScheme () returned 1 [0031.956] GetSystemMetrics (nIndex=46) returned 2 [0031.956] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.956] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.956] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.956] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.961] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.961] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.961] GetLastError () returned 0x578 [0031.961] CanUserWritePwrScheme () returned 1 [0031.961] GetSystemMetrics (nIndex=46) returned 2 [0031.961] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.961] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.961] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.961] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.966] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.966] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.966] GetLastError () returned 0x578 [0031.966] CanUserWritePwrScheme () returned 1 [0031.967] GetSystemMetrics (nIndex=46) returned 2 [0031.967] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.967] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.967] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.967] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.972] GetLastError () returned 0x578 [0031.972] CanUserWritePwrScheme () returned 1 [0031.972] GetSystemMetrics (nIndex=46) returned 2 [0031.972] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.972] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.972] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.972] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.977] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.977] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.977] GetLastError () returned 0x578 [0031.977] CanUserWritePwrScheme () returned 1 [0031.978] GetSystemMetrics (nIndex=46) returned 2 [0031.978] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.978] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.978] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.978] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.983] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.983] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.983] GetLastError () returned 0x578 [0031.983] CanUserWritePwrScheme () returned 1 [0031.983] GetSystemMetrics (nIndex=46) returned 2 [0031.983] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.983] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.983] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.983] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.992] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.992] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.992] GetLastError () returned 0x578 [0031.992] CanUserWritePwrScheme () returned 1 [0031.993] GetSystemMetrics (nIndex=46) returned 2 [0031.993] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.993] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.993] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.993] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0031.998] GetWindowTextLengthA (hWnd=0x0) returned 0 [0031.998] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0031.998] GetLastError () returned 0x578 [0031.998] CanUserWritePwrScheme () returned 1 [0031.998] GetSystemMetrics (nIndex=46) returned 2 [0031.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0031.998] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0031.998] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0031.998] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.005] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.005] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.005] GetLastError () returned 0x578 [0032.005] CanUserWritePwrScheme () returned 1 [0032.005] GetSystemMetrics (nIndex=46) returned 2 [0032.005] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.005] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.005] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.005] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.010] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.010] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.010] GetLastError () returned 0x578 [0032.010] CanUserWritePwrScheme () returned 1 [0032.011] GetSystemMetrics (nIndex=46) returned 2 [0032.011] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.011] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.011] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.011] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.019] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.019] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.019] GetLastError () returned 0x578 [0032.019] CanUserWritePwrScheme () returned 1 [0032.019] GetSystemMetrics (nIndex=46) returned 2 [0032.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.019] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.025] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.025] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.025] GetLastError () returned 0x578 [0032.025] CanUserWritePwrScheme () returned 1 [0032.025] GetSystemMetrics (nIndex=46) returned 2 [0032.025] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.025] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.025] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.025] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.030] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.030] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.030] GetLastError () returned 0x578 [0032.030] CanUserWritePwrScheme () returned 1 [0032.031] GetSystemMetrics (nIndex=46) returned 2 [0032.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.031] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.031] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.031] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.036] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.036] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.037] GetLastError () returned 0x578 [0032.037] CanUserWritePwrScheme () returned 1 [0032.037] GetSystemMetrics (nIndex=46) returned 2 [0032.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.037] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.037] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.037] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.042] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.042] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.042] GetLastError () returned 0x578 [0032.042] CanUserWritePwrScheme () returned 1 [0032.042] GetSystemMetrics (nIndex=46) returned 2 [0032.043] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.043] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.043] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.043] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.047] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.047] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.047] GetLastError () returned 0x578 [0032.048] CanUserWritePwrScheme () returned 1 [0032.048] GetSystemMetrics (nIndex=46) returned 2 [0032.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.048] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.048] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.048] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.053] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.053] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.053] GetLastError () returned 0x578 [0032.053] CanUserWritePwrScheme () returned 1 [0032.053] GetSystemMetrics (nIndex=46) returned 2 [0032.053] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.053] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.053] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.053] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.058] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.058] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.058] GetLastError () returned 0x578 [0032.058] CanUserWritePwrScheme () returned 1 [0032.059] GetSystemMetrics (nIndex=46) returned 2 [0032.059] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.059] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.059] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.059] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.064] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.064] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.064] GetLastError () returned 0x578 [0032.064] CanUserWritePwrScheme () returned 1 [0032.064] GetSystemMetrics (nIndex=46) returned 2 [0032.064] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.064] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.064] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.064] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.070] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.070] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.070] GetLastError () returned 0x578 [0032.070] CanUserWritePwrScheme () returned 1 [0032.071] GetSystemMetrics (nIndex=46) returned 2 [0032.071] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.071] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.071] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.071] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.076] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.076] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.076] GetLastError () returned 0x578 [0032.076] CanUserWritePwrScheme () returned 1 [0032.076] GetSystemMetrics (nIndex=46) returned 2 [0032.076] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.076] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.076] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.076] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.083] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.083] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.083] GetLastError () returned 0x578 [0032.084] CanUserWritePwrScheme () returned 1 [0032.084] GetSystemMetrics (nIndex=46) returned 2 [0032.084] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.084] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.084] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.084] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.092] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.092] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.092] GetLastError () returned 0x578 [0032.092] CanUserWritePwrScheme () returned 1 [0032.092] GetSystemMetrics (nIndex=46) returned 2 [0032.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.093] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.093] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.093] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.098] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.098] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.098] GetLastError () returned 0x578 [0032.098] CanUserWritePwrScheme () returned 1 [0032.098] GetSystemMetrics (nIndex=46) returned 2 [0032.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.098] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.098] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.098] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.103] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.104] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.104] GetLastError () returned 0x578 [0032.104] CanUserWritePwrScheme () returned 1 [0032.104] GetSystemMetrics (nIndex=46) returned 2 [0032.104] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.104] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.104] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.104] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.109] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.109] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.109] GetLastError () returned 0x578 [0032.109] CanUserWritePwrScheme () returned 1 [0032.110] GetSystemMetrics (nIndex=46) returned 2 [0032.110] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.110] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.110] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.110] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.115] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.115] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.115] GetLastError () returned 0x578 [0032.115] CanUserWritePwrScheme () returned 1 [0032.115] GetSystemMetrics (nIndex=46) returned 2 [0032.115] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.116] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.116] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.116] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.121] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.121] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.121] GetLastError () returned 0x578 [0032.121] CanUserWritePwrScheme () returned 1 [0032.121] GetSystemMetrics (nIndex=46) returned 2 [0032.121] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.121] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.121] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.121] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.127] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.127] GetLastError () returned 0x578 [0032.127] CanUserWritePwrScheme () returned 1 [0032.127] GetSystemMetrics (nIndex=46) returned 2 [0032.127] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.127] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.127] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.127] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.133] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.133] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.133] GetLastError () returned 0x578 [0032.133] CanUserWritePwrScheme () returned 1 [0032.133] GetSystemMetrics (nIndex=46) returned 2 [0032.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.133] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.133] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.133] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.139] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.139] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.139] GetLastError () returned 0x578 [0032.139] CanUserWritePwrScheme () returned 1 [0032.139] GetSystemMetrics (nIndex=46) returned 2 [0032.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.139] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.139] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.139] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.144] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.144] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.145] GetLastError () returned 0x578 [0032.145] CanUserWritePwrScheme () returned 1 [0032.145] GetSystemMetrics (nIndex=46) returned 2 [0032.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.145] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.145] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.145] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.150] GetLastError () returned 0x578 [0032.150] CanUserWritePwrScheme () returned 1 [0032.150] GetSystemMetrics (nIndex=46) returned 2 [0032.150] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.151] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.151] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.151] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.156] GetLastError () returned 0x578 [0032.156] CanUserWritePwrScheme () returned 1 [0032.156] GetSystemMetrics (nIndex=46) returned 2 [0032.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.157] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.157] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.157] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.162] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.162] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.162] GetLastError () returned 0x578 [0032.162] CanUserWritePwrScheme () returned 1 [0032.162] GetSystemMetrics (nIndex=46) returned 2 [0032.162] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.162] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.162] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.162] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.167] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.167] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.167] GetLastError () returned 0x578 [0032.167] CanUserWritePwrScheme () returned 1 [0032.168] GetSystemMetrics (nIndex=46) returned 2 [0032.168] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.168] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.168] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.168] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.173] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.173] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.173] GetLastError () returned 0x578 [0032.173] CanUserWritePwrScheme () returned 1 [0032.173] GetSystemMetrics (nIndex=46) returned 2 [0032.173] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.173] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.173] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.173] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.179] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.179] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.179] GetLastError () returned 0x578 [0032.179] CanUserWritePwrScheme () returned 1 [0032.179] GetSystemMetrics (nIndex=46) returned 2 [0032.179] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.179] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.179] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.179] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.184] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.184] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.184] GetLastError () returned 0x578 [0032.184] CanUserWritePwrScheme () returned 1 [0032.185] GetSystemMetrics (nIndex=46) returned 2 [0032.185] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.185] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.185] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.185] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.191] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.191] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.191] GetLastError () returned 0x578 [0032.191] CanUserWritePwrScheme () returned 1 [0032.191] GetSystemMetrics (nIndex=46) returned 2 [0032.191] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.191] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.191] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.191] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.196] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.196] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.196] GetLastError () returned 0x578 [0032.196] CanUserWritePwrScheme () returned 1 [0032.196] GetSystemMetrics (nIndex=46) returned 2 [0032.196] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.197] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.197] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.197] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.202] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.202] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.202] GetLastError () returned 0x578 [0032.202] CanUserWritePwrScheme () returned 1 [0032.202] GetSystemMetrics (nIndex=46) returned 2 [0032.202] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.202] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.202] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.202] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.208] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.208] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.208] GetLastError () returned 0x578 [0032.208] CanUserWritePwrScheme () returned 1 [0032.208] GetSystemMetrics (nIndex=46) returned 2 [0032.208] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.208] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.208] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.208] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.213] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.213] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.213] GetLastError () returned 0x578 [0032.213] CanUserWritePwrScheme () returned 1 [0032.214] GetSystemMetrics (nIndex=46) returned 2 [0032.214] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.214] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.214] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.214] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.219] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.219] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.219] GetLastError () returned 0x578 [0032.219] CanUserWritePwrScheme () returned 1 [0032.219] GetSystemMetrics (nIndex=46) returned 2 [0032.219] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.219] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.219] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.219] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.225] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.225] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.225] GetLastError () returned 0x578 [0032.225] CanUserWritePwrScheme () returned 1 [0032.225] GetSystemMetrics (nIndex=46) returned 2 [0032.225] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.225] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.225] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.226] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.231] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.231] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.231] GetLastError () returned 0x578 [0032.231] CanUserWritePwrScheme () returned 1 [0032.231] GetSystemMetrics (nIndex=46) returned 2 [0032.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.231] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.231] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.231] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.236] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.236] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.236] GetLastError () returned 0x578 [0032.236] CanUserWritePwrScheme () returned 1 [0032.236] GetSystemMetrics (nIndex=46) returned 2 [0032.236] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.236] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.236] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.236] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.242] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.242] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.242] GetLastError () returned 0x578 [0032.242] CanUserWritePwrScheme () returned 1 [0032.242] GetSystemMetrics (nIndex=46) returned 2 [0032.242] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.242] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.242] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.242] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.247] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.247] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.247] GetLastError () returned 0x578 [0032.247] CanUserWritePwrScheme () returned 1 [0032.247] GetSystemMetrics (nIndex=46) returned 2 [0032.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.248] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.248] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.248] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.253] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.253] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.253] GetLastError () returned 0x578 [0032.253] CanUserWritePwrScheme () returned 1 [0032.254] GetSystemMetrics (nIndex=46) returned 2 [0032.254] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.254] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.254] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.254] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.259] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.259] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.259] GetLastError () returned 0x578 [0032.259] CanUserWritePwrScheme () returned 1 [0032.259] GetSystemMetrics (nIndex=46) returned 2 [0032.259] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.259] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.259] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.259] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.264] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.264] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.264] GetLastError () returned 0x578 [0032.264] CanUserWritePwrScheme () returned 1 [0032.265] GetSystemMetrics (nIndex=46) returned 2 [0032.265] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.265] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.265] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.265] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.270] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.270] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.270] GetLastError () returned 0x578 [0032.271] CanUserWritePwrScheme () returned 1 [0032.271] GetSystemMetrics (nIndex=46) returned 2 [0032.271] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.271] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.271] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.271] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.276] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.276] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.276] GetLastError () returned 0x578 [0032.276] CanUserWritePwrScheme () returned 1 [0032.277] GetSystemMetrics (nIndex=46) returned 2 [0032.277] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.277] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.277] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.277] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.282] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.282] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.282] GetLastError () returned 0x578 [0032.282] CanUserWritePwrScheme () returned 1 [0032.282] GetSystemMetrics (nIndex=46) returned 2 [0032.282] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.282] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.283] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.283] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.288] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.288] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.288] GetLastError () returned 0x578 [0032.288] CanUserWritePwrScheme () returned 1 [0032.289] GetSystemMetrics (nIndex=46) returned 2 [0032.289] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.289] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.289] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.289] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.294] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.294] GetLastError () returned 0x578 [0032.294] CanUserWritePwrScheme () returned 1 [0032.294] GetSystemMetrics (nIndex=46) returned 2 [0032.294] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.294] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.294] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.294] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.299] GetLastError () returned 0x578 [0032.299] CanUserWritePwrScheme () returned 1 [0032.300] GetSystemMetrics (nIndex=46) returned 2 [0032.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.305] GetLastError () returned 0x578 [0032.305] CanUserWritePwrScheme () returned 1 [0032.306] GetSystemMetrics (nIndex=46) returned 2 [0032.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.306] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.306] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.306] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.311] GetLastError () returned 0x578 [0032.311] CanUserWritePwrScheme () returned 1 [0032.312] GetSystemMetrics (nIndex=46) returned 2 [0032.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.317] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.317] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.317] GetLastError () returned 0x578 [0032.317] CanUserWritePwrScheme () returned 1 [0032.317] GetSystemMetrics (nIndex=46) returned 2 [0032.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.318] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.318] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.318] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.323] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.323] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.323] GetLastError () returned 0x578 [0032.324] CanUserWritePwrScheme () returned 1 [0032.324] GetSystemMetrics (nIndex=46) returned 2 [0032.324] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.324] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.324] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.324] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.329] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.329] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.329] GetLastError () returned 0x578 [0032.329] CanUserWritePwrScheme () returned 1 [0032.329] GetSystemMetrics (nIndex=46) returned 2 [0032.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.334] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.334] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.335] GetLastError () returned 0x578 [0032.335] CanUserWritePwrScheme () returned 1 [0032.335] GetSystemMetrics (nIndex=46) returned 2 [0032.335] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.335] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.335] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.335] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.340] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.340] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.340] GetLastError () returned 0x578 [0032.340] CanUserWritePwrScheme () returned 1 [0032.340] GetSystemMetrics (nIndex=46) returned 2 [0032.340] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.340] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.340] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.340] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.346] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.346] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.346] GetLastError () returned 0x578 [0032.346] CanUserWritePwrScheme () returned 1 [0032.347] GetSystemMetrics (nIndex=46) returned 2 [0032.347] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.347] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.347] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.347] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.352] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.352] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.352] GetLastError () returned 0x578 [0032.352] CanUserWritePwrScheme () returned 1 [0032.352] GetSystemMetrics (nIndex=46) returned 2 [0032.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.352] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.352] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.352] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.357] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.357] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.357] GetLastError () returned 0x578 [0032.357] CanUserWritePwrScheme () returned 1 [0032.358] GetSystemMetrics (nIndex=46) returned 2 [0032.358] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.358] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.358] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.358] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.364] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.364] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.364] GetLastError () returned 0x578 [0032.364] CanUserWritePwrScheme () returned 1 [0032.364] GetSystemMetrics (nIndex=46) returned 2 [0032.364] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.364] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.364] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.364] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.369] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.369] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.369] GetLastError () returned 0x578 [0032.369] CanUserWritePwrScheme () returned 1 [0032.369] GetSystemMetrics (nIndex=46) returned 2 [0032.369] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.369] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.369] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.369] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.374] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.374] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.374] GetLastError () returned 0x578 [0032.375] CanUserWritePwrScheme () returned 1 [0032.375] GetSystemMetrics (nIndex=46) returned 2 [0032.375] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.375] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.375] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.375] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.380] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.380] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.380] GetLastError () returned 0x578 [0032.380] CanUserWritePwrScheme () returned 1 [0032.381] GetSystemMetrics (nIndex=46) returned 2 [0032.381] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.381] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.381] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.381] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.387] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.387] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.387] GetLastError () returned 0x578 [0032.387] CanUserWritePwrScheme () returned 1 [0032.387] GetSystemMetrics (nIndex=46) returned 2 [0032.387] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.387] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.387] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.387] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.392] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.392] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.392] GetLastError () returned 0x578 [0032.392] CanUserWritePwrScheme () returned 1 [0032.393] GetSystemMetrics (nIndex=46) returned 2 [0032.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.393] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.393] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.393] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.398] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.398] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.398] GetLastError () returned 0x578 [0032.398] CanUserWritePwrScheme () returned 1 [0032.398] GetSystemMetrics (nIndex=46) returned 2 [0032.398] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.399] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.399] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.399] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.404] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.404] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.404] GetLastError () returned 0x578 [0032.404] CanUserWritePwrScheme () returned 1 [0032.404] GetSystemMetrics (nIndex=46) returned 2 [0032.404] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.404] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.404] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.404] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.411] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.411] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.411] GetLastError () returned 0x578 [0032.411] CanUserWritePwrScheme () returned 1 [0032.411] GetSystemMetrics (nIndex=46) returned 2 [0032.411] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.411] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.411] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.411] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.416] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.416] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.416] GetLastError () returned 0x578 [0032.416] CanUserWritePwrScheme () returned 1 [0032.417] GetSystemMetrics (nIndex=46) returned 2 [0032.417] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.417] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.417] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.417] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.422] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.422] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.422] GetLastError () returned 0x578 [0032.422] CanUserWritePwrScheme () returned 1 [0032.422] GetSystemMetrics (nIndex=46) returned 2 [0032.422] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.422] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.422] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.422] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.475] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.475] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.475] GetLastError () returned 0x578 [0032.475] CanUserWritePwrScheme () returned 1 [0032.475] GetSystemMetrics (nIndex=46) returned 2 [0032.475] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.475] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.475] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.475] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.480] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.480] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.480] GetLastError () returned 0x578 [0032.481] CanUserWritePwrScheme () returned 1 [0032.481] GetSystemMetrics (nIndex=46) returned 2 [0032.481] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.481] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.481] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.481] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.487] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.487] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.487] GetLastError () returned 0x578 [0032.487] CanUserWritePwrScheme () returned 1 [0032.488] GetSystemMetrics (nIndex=46) returned 2 [0032.488] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.488] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.488] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.488] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.492] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.493] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.493] GetLastError () returned 0x578 [0032.493] CanUserWritePwrScheme () returned 1 [0032.493] GetSystemMetrics (nIndex=46) returned 2 [0032.493] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.493] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.493] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.493] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.498] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.498] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.498] GetLastError () returned 0x578 [0032.498] CanUserWritePwrScheme () returned 1 [0032.498] GetSystemMetrics (nIndex=46) returned 2 [0032.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.498] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.499] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.499] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.504] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.504] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.504] GetLastError () returned 0x578 [0032.504] CanUserWritePwrScheme () returned 1 [0032.504] GetSystemMetrics (nIndex=46) returned 2 [0032.504] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.504] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.504] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.504] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.509] GetLastError () returned 0x578 [0032.509] CanUserWritePwrScheme () returned 1 [0032.509] GetSystemMetrics (nIndex=46) returned 2 [0032.509] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.509] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.509] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.510] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.515] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.515] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.516] GetLastError () returned 0x578 [0032.516] CanUserWritePwrScheme () returned 1 [0032.516] GetSystemMetrics (nIndex=46) returned 2 [0032.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.522] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.522] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.523] GetLastError () returned 0x578 [0032.523] CanUserWritePwrScheme () returned 1 [0032.523] GetSystemMetrics (nIndex=46) returned 2 [0032.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.523] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.523] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.523] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.529] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.529] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.529] GetLastError () returned 0x578 [0032.529] CanUserWritePwrScheme () returned 1 [0032.529] GetSystemMetrics (nIndex=46) returned 2 [0032.529] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.529] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.529] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.529] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.536] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.536] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.536] GetLastError () returned 0x578 [0032.536] CanUserWritePwrScheme () returned 1 [0032.536] GetSystemMetrics (nIndex=46) returned 2 [0032.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.543] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.543] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.544] GetLastError () returned 0x578 [0032.544] CanUserWritePwrScheme () returned 1 [0032.544] GetSystemMetrics (nIndex=46) returned 2 [0032.544] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.544] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.544] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.544] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.549] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.549] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.549] GetLastError () returned 0x578 [0032.549] CanUserWritePwrScheme () returned 1 [0032.550] GetSystemMetrics (nIndex=46) returned 2 [0032.550] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.550] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.550] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.550] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.555] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.555] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.555] GetLastError () returned 0x578 [0032.555] CanUserWritePwrScheme () returned 1 [0032.555] GetSystemMetrics (nIndex=46) returned 2 [0032.555] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.555] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.555] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.555] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.560] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.560] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.560] GetLastError () returned 0x578 [0032.560] CanUserWritePwrScheme () returned 1 [0032.560] GetSystemMetrics (nIndex=46) returned 2 [0032.560] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.561] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.561] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.561] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.566] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.566] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.566] GetLastError () returned 0x578 [0032.566] CanUserWritePwrScheme () returned 1 [0032.566] GetSystemMetrics (nIndex=46) returned 2 [0032.566] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.566] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.566] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.566] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.572] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.572] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.572] GetLastError () returned 0x578 [0032.573] CanUserWritePwrScheme () returned 1 [0032.573] GetSystemMetrics (nIndex=46) returned 2 [0032.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.573] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.573] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.573] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.578] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.578] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.578] GetLastError () returned 0x578 [0032.578] CanUserWritePwrScheme () returned 1 [0032.578] GetSystemMetrics (nIndex=46) returned 2 [0032.578] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.578] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.578] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.578] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.583] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.583] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.584] GetLastError () returned 0x578 [0032.584] CanUserWritePwrScheme () returned 1 [0032.584] GetSystemMetrics (nIndex=46) returned 2 [0032.584] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.584] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.584] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.584] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.589] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.589] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.589] GetLastError () returned 0x578 [0032.589] CanUserWritePwrScheme () returned 1 [0032.589] GetSystemMetrics (nIndex=46) returned 2 [0032.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.594] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.594] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.594] GetLastError () returned 0x578 [0032.594] CanUserWritePwrScheme () returned 1 [0032.595] GetSystemMetrics (nIndex=46) returned 2 [0032.595] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.595] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.595] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.595] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.602] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.602] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.602] GetLastError () returned 0x578 [0032.602] CanUserWritePwrScheme () returned 1 [0032.602] GetSystemMetrics (nIndex=46) returned 2 [0032.602] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.603] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.603] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.603] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.608] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.608] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.608] GetLastError () returned 0x578 [0032.608] CanUserWritePwrScheme () returned 1 [0032.608] GetSystemMetrics (nIndex=46) returned 2 [0032.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.608] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.608] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.609] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.614] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.614] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.614] GetLastError () returned 0x578 [0032.614] CanUserWritePwrScheme () returned 1 [0032.614] GetSystemMetrics (nIndex=46) returned 2 [0032.614] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.614] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.614] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.614] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.619] GetLastError () returned 0x578 [0032.619] CanUserWritePwrScheme () returned 1 [0032.620] GetSystemMetrics (nIndex=46) returned 2 [0032.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.625] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.625] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.625] GetLastError () returned 0x578 [0032.625] CanUserWritePwrScheme () returned 1 [0032.625] GetSystemMetrics (nIndex=46) returned 2 [0032.625] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.625] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.625] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.625] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.632] GetLastError () returned 0x578 [0032.632] CanUserWritePwrScheme () returned 1 [0032.633] GetSystemMetrics (nIndex=46) returned 2 [0032.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.639] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.639] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.639] GetLastError () returned 0x578 [0032.639] CanUserWritePwrScheme () returned 1 [0032.640] GetSystemMetrics (nIndex=46) returned 2 [0032.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.640] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.640] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.640] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.645] GetLastError () returned 0x578 [0032.645] CanUserWritePwrScheme () returned 1 [0032.645] GetSystemMetrics (nIndex=46) returned 2 [0032.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.645] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.645] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.645] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.650] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.650] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.650] GetLastError () returned 0x578 [0032.650] CanUserWritePwrScheme () returned 1 [0032.651] GetSystemMetrics (nIndex=46) returned 2 [0032.651] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.651] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.651] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.651] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.655] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.655] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.656] GetLastError () returned 0x578 [0032.656] CanUserWritePwrScheme () returned 1 [0032.656] GetSystemMetrics (nIndex=46) returned 2 [0032.656] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.656] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.656] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.656] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.662] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.662] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.663] GetLastError () returned 0x578 [0032.663] CanUserWritePwrScheme () returned 1 [0032.663] GetSystemMetrics (nIndex=46) returned 2 [0032.663] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.663] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.663] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.663] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.668] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.668] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.668] GetLastError () returned 0x578 [0032.668] CanUserWritePwrScheme () returned 1 [0032.668] GetSystemMetrics (nIndex=46) returned 2 [0032.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.668] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.668] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.668] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.673] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.673] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.673] GetLastError () returned 0x578 [0032.673] CanUserWritePwrScheme () returned 1 [0032.674] GetSystemMetrics (nIndex=46) returned 2 [0032.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.674] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.674] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.674] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.679] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.679] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.679] GetLastError () returned 0x578 [0032.679] CanUserWritePwrScheme () returned 1 [0032.679] GetSystemMetrics (nIndex=46) returned 2 [0032.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.679] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.685] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.685] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.685] GetLastError () returned 0x578 [0032.685] CanUserWritePwrScheme () returned 1 [0032.685] GetSystemMetrics (nIndex=46) returned 2 [0032.685] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.685] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.685] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.685] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.690] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.690] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.690] GetLastError () returned 0x578 [0032.690] CanUserWritePwrScheme () returned 1 [0032.691] GetSystemMetrics (nIndex=46) returned 2 [0032.691] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.691] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.691] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.691] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.697] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.697] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.697] GetLastError () returned 0x578 [0032.697] CanUserWritePwrScheme () returned 1 [0032.697] GetSystemMetrics (nIndex=46) returned 2 [0032.697] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.697] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.697] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.697] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.702] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.702] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.702] GetLastError () returned 0x578 [0032.702] CanUserWritePwrScheme () returned 1 [0032.703] GetSystemMetrics (nIndex=46) returned 2 [0032.703] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.703] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.703] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.703] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.708] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.708] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.708] GetLastError () returned 0x578 [0032.708] CanUserWritePwrScheme () returned 1 [0032.708] GetSystemMetrics (nIndex=46) returned 2 [0032.708] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.708] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.708] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.708] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.713] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.713] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.713] GetLastError () returned 0x578 [0032.713] CanUserWritePwrScheme () returned 1 [0032.714] GetSystemMetrics (nIndex=46) returned 2 [0032.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.714] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.714] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.714] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.719] GetLastError () returned 0x578 [0032.719] CanUserWritePwrScheme () returned 1 [0032.719] GetSystemMetrics (nIndex=46) returned 2 [0032.719] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.719] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.719] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.719] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.724] GetLastError () returned 0x578 [0032.724] CanUserWritePwrScheme () returned 1 [0032.725] GetSystemMetrics (nIndex=46) returned 2 [0032.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.725] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.725] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.725] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.731] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.731] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.731] GetLastError () returned 0x578 [0032.731] CanUserWritePwrScheme () returned 1 [0032.732] GetSystemMetrics (nIndex=46) returned 2 [0032.732] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.732] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.732] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.732] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.737] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.737] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.737] GetLastError () returned 0x578 [0032.737] CanUserWritePwrScheme () returned 1 [0032.737] GetSystemMetrics (nIndex=46) returned 2 [0032.737] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.737] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.737] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.737] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.743] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.743] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.743] GetLastError () returned 0x578 [0032.743] CanUserWritePwrScheme () returned 1 [0032.743] GetSystemMetrics (nIndex=46) returned 2 [0032.743] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.743] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.743] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.743] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.748] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.748] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.748] GetLastError () returned 0x578 [0032.748] CanUserWritePwrScheme () returned 1 [0032.748] GetSystemMetrics (nIndex=46) returned 2 [0032.748] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.748] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.748] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.748] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.753] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.753] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.753] GetLastError () returned 0x578 [0032.753] CanUserWritePwrScheme () returned 1 [0032.754] GetSystemMetrics (nIndex=46) returned 2 [0032.754] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.754] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.754] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.754] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.759] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.759] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.759] GetLastError () returned 0x578 [0032.759] CanUserWritePwrScheme () returned 1 [0032.759] GetSystemMetrics (nIndex=46) returned 2 [0032.759] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.759] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.759] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.759] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.766] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.766] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.766] GetLastError () returned 0x578 [0032.766] CanUserWritePwrScheme () returned 1 [0032.766] GetSystemMetrics (nIndex=46) returned 2 [0032.766] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.766] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.766] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.766] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.771] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.771] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.771] GetLastError () returned 0x578 [0032.771] CanUserWritePwrScheme () returned 1 [0032.772] GetSystemMetrics (nIndex=46) returned 2 [0032.772] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.772] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.772] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.772] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.777] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.777] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.777] GetLastError () returned 0x578 [0032.777] CanUserWritePwrScheme () returned 1 [0032.777] GetSystemMetrics (nIndex=46) returned 2 [0032.777] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.777] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.777] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.777] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.782] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.782] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.782] GetLastError () returned 0x578 [0032.782] CanUserWritePwrScheme () returned 1 [0032.783] GetSystemMetrics (nIndex=46) returned 2 [0032.783] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.783] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.783] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.783] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.788] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.788] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.788] GetLastError () returned 0x578 [0032.788] CanUserWritePwrScheme () returned 1 [0032.788] GetSystemMetrics (nIndex=46) returned 2 [0032.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.788] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.788] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.793] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.793] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.793] GetLastError () returned 0x578 [0032.793] CanUserWritePwrScheme () returned 1 [0032.794] GetSystemMetrics (nIndex=46) returned 2 [0032.794] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.794] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.794] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.794] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.800] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.800] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.800] GetLastError () returned 0x578 [0032.800] CanUserWritePwrScheme () returned 1 [0032.801] GetSystemMetrics (nIndex=46) returned 2 [0032.801] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.801] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.801] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.801] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.806] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.806] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.806] GetLastError () returned 0x578 [0032.806] CanUserWritePwrScheme () returned 1 [0032.806] GetSystemMetrics (nIndex=46) returned 2 [0032.806] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.806] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.806] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.806] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.811] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.811] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.811] GetLastError () returned 0x578 [0032.811] CanUserWritePwrScheme () returned 1 [0032.812] GetSystemMetrics (nIndex=46) returned 2 [0032.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.812] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.812] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.812] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.817] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.817] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.817] GetLastError () returned 0x578 [0032.817] CanUserWritePwrScheme () returned 1 [0032.817] GetSystemMetrics (nIndex=46) returned 2 [0032.817] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.817] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.817] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.817] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.822] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.822] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.822] GetLastError () returned 0x578 [0032.822] CanUserWritePwrScheme () returned 1 [0032.823] GetSystemMetrics (nIndex=46) returned 2 [0032.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.828] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.828] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.828] GetLastError () returned 0x578 [0032.828] CanUserWritePwrScheme () returned 1 [0032.828] GetSystemMetrics (nIndex=46) returned 2 [0032.828] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.828] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.828] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.828] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.833] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.833] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.833] GetLastError () returned 0x578 [0032.833] CanUserWritePwrScheme () returned 1 [0032.834] GetSystemMetrics (nIndex=46) returned 2 [0032.834] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.834] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.834] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.834] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.840] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.840] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.840] GetLastError () returned 0x578 [0032.840] CanUserWritePwrScheme () returned 1 [0032.840] GetSystemMetrics (nIndex=46) returned 2 [0032.840] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.840] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.840] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.840] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.846] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.846] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.846] GetLastError () returned 0x578 [0032.846] CanUserWritePwrScheme () returned 1 [0032.846] GetSystemMetrics (nIndex=46) returned 2 [0032.846] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.847] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.847] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.847] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.851] GetLastError () returned 0x578 [0032.851] CanUserWritePwrScheme () returned 1 [0032.852] GetSystemMetrics (nIndex=46) returned 2 [0032.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.852] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.852] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.852] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.857] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.857] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.857] GetLastError () returned 0x578 [0032.857] CanUserWritePwrScheme () returned 1 [0032.857] GetSystemMetrics (nIndex=46) returned 2 [0032.857] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.857] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.857] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.857] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.862] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.862] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.862] GetLastError () returned 0x578 [0032.862] CanUserWritePwrScheme () returned 1 [0032.863] GetSystemMetrics (nIndex=46) returned 2 [0032.863] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.863] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.863] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.863] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.876] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.876] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.876] GetLastError () returned 0x578 [0032.876] CanUserWritePwrScheme () returned 1 [0032.876] GetSystemMetrics (nIndex=46) returned 2 [0032.876] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.876] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.876] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.876] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.882] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.882] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.882] GetLastError () returned 0x578 [0032.882] CanUserWritePwrScheme () returned 1 [0032.882] GetSystemMetrics (nIndex=46) returned 2 [0032.882] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.882] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.882] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.882] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.896] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.896] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.896] GetLastError () returned 0x578 [0032.896] CanUserWritePwrScheme () returned 1 [0032.896] GetSystemMetrics (nIndex=46) returned 2 [0032.896] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.896] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.896] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.896] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.901] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.901] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.901] GetLastError () returned 0x578 [0032.902] CanUserWritePwrScheme () returned 1 [0032.902] GetSystemMetrics (nIndex=46) returned 2 [0032.902] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.902] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.902] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.902] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.907] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.907] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.907] GetLastError () returned 0x578 [0032.907] CanUserWritePwrScheme () returned 1 [0032.907] GetSystemMetrics (nIndex=46) returned 2 [0032.907] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.907] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.907] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.907] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.914] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.914] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.914] GetLastError () returned 0x578 [0032.914] CanUserWritePwrScheme () returned 1 [0032.915] GetSystemMetrics (nIndex=46) returned 2 [0032.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.915] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.915] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.915] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.920] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.920] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.920] GetLastError () returned 0x578 [0032.920] CanUserWritePwrScheme () returned 1 [0032.920] GetSystemMetrics (nIndex=46) returned 2 [0032.920] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.920] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.920] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.920] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.925] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.925] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.925] GetLastError () returned 0x578 [0032.925] CanUserWritePwrScheme () returned 1 [0032.926] GetSystemMetrics (nIndex=46) returned 2 [0032.926] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.926] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.926] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.926] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.931] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.931] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.931] GetLastError () returned 0x578 [0032.931] CanUserWritePwrScheme () returned 1 [0032.931] GetSystemMetrics (nIndex=46) returned 2 [0032.931] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.931] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.931] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.931] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.936] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.936] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.936] GetLastError () returned 0x578 [0032.936] CanUserWritePwrScheme () returned 1 [0032.936] GetSystemMetrics (nIndex=46) returned 2 [0032.936] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.937] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.937] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.937] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.943] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.943] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.943] GetLastError () returned 0x578 [0032.943] CanUserWritePwrScheme () returned 1 [0032.943] GetSystemMetrics (nIndex=46) returned 2 [0032.943] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.943] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.944] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.944] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.948] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.948] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.948] GetLastError () returned 0x578 [0032.948] CanUserWritePwrScheme () returned 1 [0032.949] GetSystemMetrics (nIndex=46) returned 2 [0032.949] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.949] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.949] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.949] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.956] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.956] GetLastError () returned 0x578 [0032.956] CanUserWritePwrScheme () returned 1 [0032.956] GetSystemMetrics (nIndex=46) returned 2 [0032.956] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.956] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.956] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.956] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.961] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.961] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.961] GetLastError () returned 0x578 [0032.961] CanUserWritePwrScheme () returned 1 [0032.962] GetSystemMetrics (nIndex=46) returned 2 [0032.962] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.962] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.962] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.962] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.966] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.966] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.966] GetLastError () returned 0x578 [0032.967] CanUserWritePwrScheme () returned 1 [0032.967] GetSystemMetrics (nIndex=46) returned 2 [0032.967] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.967] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.967] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.967] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.972] GetLastError () returned 0x578 [0032.972] CanUserWritePwrScheme () returned 1 [0032.973] GetSystemMetrics (nIndex=46) returned 2 [0032.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.977] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.978] GetLastError () returned 0x578 [0032.978] CanUserWritePwrScheme () returned 1 [0032.978] GetSystemMetrics (nIndex=46) returned 2 [0032.978] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.978] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.978] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.978] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.983] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.983] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.983] GetLastError () returned 0x578 [0032.983] CanUserWritePwrScheme () returned 1 [0032.984] GetSystemMetrics (nIndex=46) returned 2 [0032.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.989] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.989] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.989] GetLastError () returned 0x578 [0032.989] CanUserWritePwrScheme () returned 1 [0032.989] GetSystemMetrics (nIndex=46) returned 2 [0032.989] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.989] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.989] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.989] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0032.996] GetWindowTextLengthA (hWnd=0x0) returned 0 [0032.996] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0032.996] GetLastError () returned 0x578 [0032.996] CanUserWritePwrScheme () returned 1 [0032.996] GetSystemMetrics (nIndex=46) returned 2 [0032.996] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0032.996] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0032.996] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0032.996] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.001] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.001] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.001] GetLastError () returned 0x578 [0033.001] CanUserWritePwrScheme () returned 1 [0033.002] GetSystemMetrics (nIndex=46) returned 2 [0033.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.002] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.002] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.002] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.007] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.007] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.007] GetLastError () returned 0x578 [0033.007] CanUserWritePwrScheme () returned 1 [0033.007] GetSystemMetrics (nIndex=46) returned 2 [0033.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.007] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.007] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.007] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.012] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.012] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.012] GetLastError () returned 0x578 [0033.012] CanUserWritePwrScheme () returned 1 [0033.013] GetSystemMetrics (nIndex=46) returned 2 [0033.013] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.013] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.013] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.013] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.021] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.021] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.021] GetLastError () returned 0x578 [0033.021] CanUserWritePwrScheme () returned 1 [0033.021] GetSystemMetrics (nIndex=46) returned 2 [0033.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.021] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.021] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.021] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.026] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.026] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.026] GetLastError () returned 0x578 [0033.026] CanUserWritePwrScheme () returned 1 [0033.027] GetSystemMetrics (nIndex=46) returned 2 [0033.027] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.027] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.027] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.027] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.032] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.032] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.032] GetLastError () returned 0x578 [0033.032] CanUserWritePwrScheme () returned 1 [0033.032] GetSystemMetrics (nIndex=46) returned 2 [0033.032] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.032] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.032] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.032] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.040] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.040] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.040] GetLastError () returned 0x578 [0033.040] CanUserWritePwrScheme () returned 1 [0033.041] GetSystemMetrics (nIndex=46) returned 2 [0033.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.046] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.046] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.046] GetLastError () returned 0x578 [0033.046] CanUserWritePwrScheme () returned 1 [0033.046] GetSystemMetrics (nIndex=46) returned 2 [0033.046] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.046] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.046] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.046] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.051] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.051] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.051] GetLastError () returned 0x578 [0033.052] CanUserWritePwrScheme () returned 1 [0033.052] GetSystemMetrics (nIndex=46) returned 2 [0033.052] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.052] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.052] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.052] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.057] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.057] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.057] GetLastError () returned 0x578 [0033.057] CanUserWritePwrScheme () returned 1 [0033.057] GetSystemMetrics (nIndex=46) returned 2 [0033.057] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.057] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.057] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.057] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.062] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.062] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.062] GetLastError () returned 0x578 [0033.062] CanUserWritePwrScheme () returned 1 [0033.063] GetSystemMetrics (nIndex=46) returned 2 [0033.063] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.063] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.063] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.063] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.068] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.068] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.068] GetLastError () returned 0x578 [0033.068] CanUserWritePwrScheme () returned 1 [0033.068] GetSystemMetrics (nIndex=46) returned 2 [0033.068] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.068] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.068] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.069] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.073] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.073] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.073] GetLastError () returned 0x578 [0033.073] CanUserWritePwrScheme () returned 1 [0033.074] GetSystemMetrics (nIndex=46) returned 2 [0033.074] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.074] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.074] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.074] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.081] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.081] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.081] GetLastError () returned 0x578 [0033.081] CanUserWritePwrScheme () returned 1 [0033.081] GetSystemMetrics (nIndex=46) returned 2 [0033.081] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.081] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.081] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.081] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.086] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.086] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.086] GetLastError () returned 0x578 [0033.086] CanUserWritePwrScheme () returned 1 [0033.086] GetSystemMetrics (nIndex=46) returned 2 [0033.087] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.087] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.087] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.087] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.091] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.091] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.092] GetLastError () returned 0x578 [0033.092] CanUserWritePwrScheme () returned 1 [0033.092] GetSystemMetrics (nIndex=46) returned 2 [0033.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.092] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.092] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.092] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.097] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.097] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.097] GetLastError () returned 0x578 [0033.097] CanUserWritePwrScheme () returned 1 [0033.098] GetSystemMetrics (nIndex=46) returned 2 [0033.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.098] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.098] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.098] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.105] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.105] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.105] GetLastError () returned 0x578 [0033.105] CanUserWritePwrScheme () returned 1 [0033.106] GetSystemMetrics (nIndex=46) returned 2 [0033.106] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.106] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.106] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.106] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.111] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.111] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.111] GetLastError () returned 0x578 [0033.111] CanUserWritePwrScheme () returned 1 [0033.111] GetSystemMetrics (nIndex=46) returned 2 [0033.111] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.111] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.111] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.111] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.116] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.116] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.116] GetLastError () returned 0x578 [0033.116] CanUserWritePwrScheme () returned 1 [0033.117] GetSystemMetrics (nIndex=46) returned 2 [0033.117] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.117] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.117] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.117] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.121] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.121] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.122] GetLastError () returned 0x578 [0033.122] CanUserWritePwrScheme () returned 1 [0033.122] GetSystemMetrics (nIndex=46) returned 2 [0033.122] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.122] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.122] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.122] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.129] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.129] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.129] GetLastError () returned 0x578 [0033.129] CanUserWritePwrScheme () returned 1 [0033.129] GetSystemMetrics (nIndex=46) returned 2 [0033.129] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.129] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.129] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.129] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.134] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.134] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.134] GetLastError () returned 0x578 [0033.134] CanUserWritePwrScheme () returned 1 [0033.135] GetSystemMetrics (nIndex=46) returned 2 [0033.135] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.135] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.135] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.135] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.140] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.140] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.140] GetLastError () returned 0x578 [0033.140] CanUserWritePwrScheme () returned 1 [0033.140] GetSystemMetrics (nIndex=46) returned 2 [0033.140] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.140] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.140] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.140] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.145] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.145] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.145] GetLastError () returned 0x578 [0033.145] CanUserWritePwrScheme () returned 1 [0033.146] GetSystemMetrics (nIndex=46) returned 2 [0033.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.146] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.146] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.146] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.150] GetLastError () returned 0x578 [0033.151] CanUserWritePwrScheme () returned 1 [0033.151] GetSystemMetrics (nIndex=46) returned 2 [0033.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.151] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.151] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.151] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.156] GetLastError () returned 0x578 [0033.156] CanUserWritePwrScheme () returned 1 [0033.156] GetSystemMetrics (nIndex=46) returned 2 [0033.156] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.156] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.156] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.156] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.161] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.161] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.162] GetLastError () returned 0x578 [0033.162] CanUserWritePwrScheme () returned 1 [0033.162] GetSystemMetrics (nIndex=46) returned 2 [0033.162] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.162] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.162] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.162] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.167] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.167] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.167] GetLastError () returned 0x578 [0033.167] CanUserWritePwrScheme () returned 1 [0033.167] GetSystemMetrics (nIndex=46) returned 2 [0033.167] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.167] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.167] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.167] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.173] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.173] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.173] GetLastError () returned 0x578 [0033.173] CanUserWritePwrScheme () returned 1 [0033.174] GetSystemMetrics (nIndex=46) returned 2 [0033.174] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.174] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.174] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.174] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.194] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.194] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.194] GetLastError () returned 0x578 [0033.194] CanUserWritePwrScheme () returned 1 [0033.194] GetSystemMetrics (nIndex=46) returned 2 [0033.194] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.194] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.194] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.194] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.199] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.199] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.199] GetLastError () returned 0x578 [0033.199] CanUserWritePwrScheme () returned 1 [0033.200] GetSystemMetrics (nIndex=46) returned 2 [0033.200] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.200] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.200] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.200] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.205] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.205] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.205] GetLastError () returned 0x578 [0033.205] CanUserWritePwrScheme () returned 1 [0033.205] GetSystemMetrics (nIndex=46) returned 2 [0033.205] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.205] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.205] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.205] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.210] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.210] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.210] GetLastError () returned 0x578 [0033.210] CanUserWritePwrScheme () returned 1 [0033.210] GetSystemMetrics (nIndex=46) returned 2 [0033.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.211] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.211] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.211] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.218] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.218] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.218] GetLastError () returned 0x578 [0033.218] CanUserWritePwrScheme () returned 1 [0033.218] GetSystemMetrics (nIndex=46) returned 2 [0033.218] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.218] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.218] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.218] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.224] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.224] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.224] GetLastError () returned 0x578 [0033.224] CanUserWritePwrScheme () returned 1 [0033.224] GetSystemMetrics (nIndex=46) returned 2 [0033.224] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.224] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.224] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.224] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.229] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.229] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.229] GetLastError () returned 0x578 [0033.229] CanUserWritePwrScheme () returned 1 [0033.229] GetSystemMetrics (nIndex=46) returned 2 [0033.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.229] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.229] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.229] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.234] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.234] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.234] GetLastError () returned 0x578 [0033.234] CanUserWritePwrScheme () returned 1 [0033.235] GetSystemMetrics (nIndex=46) returned 2 [0033.235] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.235] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.235] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.235] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.240] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.240] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.240] GetLastError () returned 0x578 [0033.240] CanUserWritePwrScheme () returned 1 [0033.240] GetSystemMetrics (nIndex=46) returned 2 [0033.240] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.240] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.240] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.240] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.245] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.245] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.245] GetLastError () returned 0x578 [0033.245] CanUserWritePwrScheme () returned 1 [0033.246] GetSystemMetrics (nIndex=46) returned 2 [0033.246] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.246] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.246] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.246] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.251] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.251] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.251] GetLastError () returned 0x578 [0033.251] CanUserWritePwrScheme () returned 1 [0033.251] GetSystemMetrics (nIndex=46) returned 2 [0033.251] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.251] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.251] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.251] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.256] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.256] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.256] GetLastError () returned 0x578 [0033.256] CanUserWritePwrScheme () returned 1 [0033.257] GetSystemMetrics (nIndex=46) returned 2 [0033.257] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.257] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.257] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.262] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.262] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.262] GetLastError () returned 0x578 [0033.262] CanUserWritePwrScheme () returned 1 [0033.262] GetSystemMetrics (nIndex=46) returned 2 [0033.262] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.262] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.262] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.262] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.269] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.269] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.269] GetLastError () returned 0x578 [0033.269] CanUserWritePwrScheme () returned 1 [0033.270] GetSystemMetrics (nIndex=46) returned 2 [0033.270] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.270] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.270] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.270] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.275] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.275] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.275] GetLastError () returned 0x578 [0033.275] CanUserWritePwrScheme () returned 1 [0033.275] GetSystemMetrics (nIndex=46) returned 2 [0033.275] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.275] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.276] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.276] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.281] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.281] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.281] GetLastError () returned 0x578 [0033.281] CanUserWritePwrScheme () returned 1 [0033.281] GetSystemMetrics (nIndex=46) returned 2 [0033.281] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.281] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.281] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.281] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.287] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.287] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.287] GetLastError () returned 0x578 [0033.287] CanUserWritePwrScheme () returned 1 [0033.287] GetSystemMetrics (nIndex=46) returned 2 [0033.287] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.287] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.287] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.287] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.292] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.292] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.292] GetLastError () returned 0x578 [0033.292] CanUserWritePwrScheme () returned 1 [0033.293] GetSystemMetrics (nIndex=46) returned 2 [0033.293] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.293] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.293] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.293] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.298] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.298] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.298] GetLastError () returned 0x578 [0033.298] CanUserWritePwrScheme () returned 1 [0033.299] GetSystemMetrics (nIndex=46) returned 2 [0033.299] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.299] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.299] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.299] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.304] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.304] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.304] GetLastError () returned 0x578 [0033.304] CanUserWritePwrScheme () returned 1 [0033.305] GetSystemMetrics (nIndex=46) returned 2 [0033.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.305] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.305] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.305] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.310] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.310] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.310] GetLastError () returned 0x578 [0033.310] CanUserWritePwrScheme () returned 1 [0033.310] GetSystemMetrics (nIndex=46) returned 2 [0033.310] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.310] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.310] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.310] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.333] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.333] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.333] GetLastError () returned 0x578 [0033.333] CanUserWritePwrScheme () returned 1 [0033.333] GetSystemMetrics (nIndex=46) returned 2 [0033.333] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.333] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.333] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.333] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.341] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.341] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.341] GetLastError () returned 0x578 [0033.341] CanUserWritePwrScheme () returned 1 [0033.342] GetSystemMetrics (nIndex=46) returned 2 [0033.342] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.342] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.342] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.342] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.350] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.350] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.350] GetLastError () returned 0x578 [0033.350] CanUserWritePwrScheme () returned 1 [0033.350] GetSystemMetrics (nIndex=46) returned 2 [0033.350] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.350] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.350] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.350] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.355] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.355] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.355] GetLastError () returned 0x578 [0033.355] CanUserWritePwrScheme () returned 1 [0033.356] GetSystemMetrics (nIndex=46) returned 2 [0033.356] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.356] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.356] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.356] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.361] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.361] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.361] GetLastError () returned 0x578 [0033.361] CanUserWritePwrScheme () returned 1 [0033.362] GetSystemMetrics (nIndex=46) returned 2 [0033.362] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.362] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.362] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.362] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.368] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.368] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.368] GetLastError () returned 0x578 [0033.369] CanUserWritePwrScheme () returned 1 [0033.369] GetSystemMetrics (nIndex=46) returned 2 [0033.369] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.369] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.369] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.369] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.379] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.379] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.379] GetLastError () returned 0x578 [0033.379] CanUserWritePwrScheme () returned 1 [0033.379] GetSystemMetrics (nIndex=46) returned 2 [0033.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.379] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.380] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.380] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.387] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.387] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.387] GetLastError () returned 0x578 [0033.387] CanUserWritePwrScheme () returned 1 [0033.388] GetSystemMetrics (nIndex=46) returned 2 [0033.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.388] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.388] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.388] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.396] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.396] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.396] GetLastError () returned 0x578 [0033.396] CanUserWritePwrScheme () returned 1 [0033.396] GetSystemMetrics (nIndex=46) returned 2 [0033.396] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.396] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.396] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.396] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.401] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.401] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.401] GetLastError () returned 0x578 [0033.401] CanUserWritePwrScheme () returned 1 [0033.402] GetSystemMetrics (nIndex=46) returned 2 [0033.402] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.402] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.402] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.402] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.408] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.408] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.408] GetLastError () returned 0x578 [0033.408] CanUserWritePwrScheme () returned 1 [0033.408] GetSystemMetrics (nIndex=46) returned 2 [0033.408] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.408] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.408] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.408] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.415] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.415] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.415] GetLastError () returned 0x578 [0033.415] CanUserWritePwrScheme () returned 1 [0033.416] GetSystemMetrics (nIndex=46) returned 2 [0033.416] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.416] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.416] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.416] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.421] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.421] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.421] GetLastError () returned 0x578 [0033.421] CanUserWritePwrScheme () returned 1 [0033.421] GetSystemMetrics (nIndex=46) returned 2 [0033.421] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.421] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.421] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.421] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.440] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.440] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.440] GetLastError () returned 0x578 [0033.440] CanUserWritePwrScheme () returned 1 [0033.440] GetSystemMetrics (nIndex=46) returned 2 [0033.440] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.440] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.440] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.440] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.445] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.445] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.446] GetLastError () returned 0x578 [0033.446] CanUserWritePwrScheme () returned 1 [0033.446] GetSystemMetrics (nIndex=46) returned 2 [0033.446] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.446] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.446] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.446] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.451] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.451] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.451] GetLastError () returned 0x578 [0033.451] CanUserWritePwrScheme () returned 1 [0033.451] GetSystemMetrics (nIndex=46) returned 2 [0033.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.451] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.451] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.451] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.457] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.457] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.457] GetLastError () returned 0x578 [0033.457] CanUserWritePwrScheme () returned 1 [0033.457] GetSystemMetrics (nIndex=46) returned 2 [0033.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.457] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.457] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.457] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.463] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.463] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.463] GetLastError () returned 0x578 [0033.463] CanUserWritePwrScheme () returned 1 [0033.463] GetSystemMetrics (nIndex=46) returned 2 [0033.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.463] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.463] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.463] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.471] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.471] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.471] GetLastError () returned 0x578 [0033.471] CanUserWritePwrScheme () returned 1 [0033.471] GetSystemMetrics (nIndex=46) returned 2 [0033.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.472] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.472] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.472] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.476] GetLastError () returned 0x578 [0033.477] CanUserWritePwrScheme () returned 1 [0033.477] GetSystemMetrics (nIndex=46) returned 2 [0033.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.485] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.485] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.485] GetLastError () returned 0x578 [0033.485] CanUserWritePwrScheme () returned 1 [0033.486] GetSystemMetrics (nIndex=46) returned 2 [0033.486] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.486] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.486] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.486] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.494] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.494] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.494] GetLastError () returned 0x578 [0033.494] CanUserWritePwrScheme () returned 1 [0033.494] GetSystemMetrics (nIndex=46) returned 2 [0033.494] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.494] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.494] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.494] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.499] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.499] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.499] GetLastError () returned 0x578 [0033.499] CanUserWritePwrScheme () returned 1 [0033.500] GetSystemMetrics (nIndex=46) returned 2 [0033.500] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.500] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.500] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.500] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.505] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.505] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.505] GetLastError () returned 0x578 [0033.505] CanUserWritePwrScheme () returned 1 [0033.505] GetSystemMetrics (nIndex=46) returned 2 [0033.505] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.506] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.506] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.506] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.511] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.511] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.511] GetLastError () returned 0x578 [0033.511] CanUserWritePwrScheme () returned 1 [0033.511] GetSystemMetrics (nIndex=46) returned 2 [0033.511] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.511] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.511] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.511] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.516] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.516] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.516] GetLastError () returned 0x578 [0033.516] CanUserWritePwrScheme () returned 1 [0033.517] GetSystemMetrics (nIndex=46) returned 2 [0033.517] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.517] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.517] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.517] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.524] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.524] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.524] GetLastError () returned 0x578 [0033.524] CanUserWritePwrScheme () returned 1 [0033.525] GetSystemMetrics (nIndex=46) returned 2 [0033.525] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.525] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.525] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.525] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.530] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.530] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.530] GetLastError () returned 0x578 [0033.530] CanUserWritePwrScheme () returned 1 [0033.530] GetSystemMetrics (nIndex=46) returned 2 [0033.530] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.530] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.530] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.530] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.536] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.536] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.536] GetLastError () returned 0x578 [0033.536] CanUserWritePwrScheme () returned 1 [0033.536] GetSystemMetrics (nIndex=46) returned 2 [0033.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.541] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.541] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.541] GetLastError () returned 0x578 [0033.541] CanUserWritePwrScheme () returned 1 [0033.542] GetSystemMetrics (nIndex=46) returned 2 [0033.542] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.542] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.542] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.542] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.547] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.547] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.547] GetLastError () returned 0x578 [0033.547] CanUserWritePwrScheme () returned 1 [0033.548] GetSystemMetrics (nIndex=46) returned 2 [0033.548] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.548] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.548] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.548] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.553] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.553] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.553] GetLastError () returned 0x578 [0033.553] CanUserWritePwrScheme () returned 1 [0033.553] GetSystemMetrics (nIndex=46) returned 2 [0033.553] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.553] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.553] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.553] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.558] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.558] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.558] GetLastError () returned 0x578 [0033.558] CanUserWritePwrScheme () returned 1 [0033.559] GetSystemMetrics (nIndex=46) returned 2 [0033.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.559] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.559] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.559] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.564] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.564] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.564] GetLastError () returned 0x578 [0033.564] CanUserWritePwrScheme () returned 1 [0033.565] GetSystemMetrics (nIndex=46) returned 2 [0033.565] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.565] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.565] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.565] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.570] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.570] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.570] GetLastError () returned 0x578 [0033.570] CanUserWritePwrScheme () returned 1 [0033.571] GetSystemMetrics (nIndex=46) returned 2 [0033.571] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.571] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.571] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.571] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.578] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.578] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.578] GetLastError () returned 0x578 [0033.578] CanUserWritePwrScheme () returned 1 [0033.578] GetSystemMetrics (nIndex=46) returned 2 [0033.578] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.578] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.578] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.578] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.584] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.584] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.584] GetLastError () returned 0x578 [0033.584] CanUserWritePwrScheme () returned 1 [0033.584] GetSystemMetrics (nIndex=46) returned 2 [0033.584] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.584] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.584] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.584] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.589] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.589] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.589] GetLastError () returned 0x578 [0033.589] CanUserWritePwrScheme () returned 1 [0033.590] GetSystemMetrics (nIndex=46) returned 2 [0033.590] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.590] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.590] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.590] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.595] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.595] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.595] GetLastError () returned 0x578 [0033.595] CanUserWritePwrScheme () returned 1 [0033.596] GetSystemMetrics (nIndex=46) returned 2 [0033.596] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.596] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.596] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.596] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.601] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.601] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.601] GetLastError () returned 0x578 [0033.601] CanUserWritePwrScheme () returned 1 [0033.601] GetSystemMetrics (nIndex=46) returned 2 [0033.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.607] GetLastError () returned 0x578 [0033.607] CanUserWritePwrScheme () returned 1 [0033.607] GetSystemMetrics (nIndex=46) returned 2 [0033.607] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.607] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.607] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.607] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.613] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.613] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.613] GetLastError () returned 0x578 [0033.613] CanUserWritePwrScheme () returned 1 [0033.613] GetSystemMetrics (nIndex=46) returned 2 [0033.613] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.613] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.613] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.613] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.620] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.620] GetLastError () returned 0x578 [0033.620] CanUserWritePwrScheme () returned 1 [0033.620] GetSystemMetrics (nIndex=46) returned 2 [0033.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.632] GetLastError () returned 0x578 [0033.632] CanUserWritePwrScheme () returned 1 [0033.633] GetSystemMetrics (nIndex=46) returned 2 [0033.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.641] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.641] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.641] GetLastError () returned 0x578 [0033.641] CanUserWritePwrScheme () returned 1 [0033.641] GetSystemMetrics (nIndex=46) returned 2 [0033.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.642] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.642] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.642] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.647] GetLastError () returned 0x578 [0033.647] CanUserWritePwrScheme () returned 1 [0033.647] GetSystemMetrics (nIndex=46) returned 2 [0033.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.647] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.647] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.652] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.652] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.652] GetLastError () returned 0x578 [0033.652] CanUserWritePwrScheme () returned 1 [0033.653] GetSystemMetrics (nIndex=46) returned 2 [0033.653] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.653] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.653] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.653] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.658] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.658] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.658] GetLastError () returned 0x578 [0033.658] CanUserWritePwrScheme () returned 1 [0033.658] GetSystemMetrics (nIndex=46) returned 2 [0033.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.658] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.659] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.659] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.667] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.667] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.667] GetLastError () returned 0x578 [0033.667] CanUserWritePwrScheme () returned 1 [0033.667] GetSystemMetrics (nIndex=46) returned 2 [0033.667] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.667] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.667] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.667] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.674] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.674] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.674] GetLastError () returned 0x578 [0033.674] CanUserWritePwrScheme () returned 1 [0033.674] GetSystemMetrics (nIndex=46) returned 2 [0033.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.674] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.674] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.674] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.681] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.681] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.681] GetLastError () returned 0x578 [0033.681] CanUserWritePwrScheme () returned 1 [0033.682] GetSystemMetrics (nIndex=46) returned 2 [0033.682] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.682] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.682] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.682] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.691] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.691] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.691] GetLastError () returned 0x578 [0033.691] CanUserWritePwrScheme () returned 1 [0033.692] GetSystemMetrics (nIndex=46) returned 2 [0033.692] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.692] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.692] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.692] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.698] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.698] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.698] GetLastError () returned 0x578 [0033.698] CanUserWritePwrScheme () returned 1 [0033.698] GetSystemMetrics (nIndex=46) returned 2 [0033.698] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.698] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.698] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.698] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.703] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.703] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.703] GetLastError () returned 0x578 [0033.703] CanUserWritePwrScheme () returned 1 [0033.704] GetSystemMetrics (nIndex=46) returned 2 [0033.704] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.704] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.704] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.704] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.709] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.709] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.709] GetLastError () returned 0x578 [0033.709] CanUserWritePwrScheme () returned 1 [0033.709] GetSystemMetrics (nIndex=46) returned 2 [0033.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.709] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.714] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.714] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.714] GetLastError () returned 0x578 [0033.714] CanUserWritePwrScheme () returned 1 [0033.715] GetSystemMetrics (nIndex=46) returned 2 [0033.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.715] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.715] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.715] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.721] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.721] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.721] GetLastError () returned 0x578 [0033.721] CanUserWritePwrScheme () returned 1 [0033.721] GetSystemMetrics (nIndex=46) returned 2 [0033.721] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.721] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.721] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.721] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.728] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.728] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.728] GetLastError () returned 0x578 [0033.728] CanUserWritePwrScheme () returned 1 [0033.729] GetSystemMetrics (nIndex=46) returned 2 [0033.729] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.729] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.729] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.729] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.734] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.734] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.734] GetLastError () returned 0x578 [0033.734] CanUserWritePwrScheme () returned 1 [0033.734] GetSystemMetrics (nIndex=46) returned 2 [0033.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.734] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.734] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.734] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.743] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.743] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.743] GetLastError () returned 0x578 [0033.743] CanUserWritePwrScheme () returned 1 [0033.743] GetSystemMetrics (nIndex=46) returned 2 [0033.743] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.743] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.743] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.743] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.748] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.748] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.748] GetLastError () returned 0x578 [0033.748] CanUserWritePwrScheme () returned 1 [0033.749] GetSystemMetrics (nIndex=46) returned 2 [0033.749] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.749] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.749] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.749] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.754] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.754] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.754] GetLastError () returned 0x578 [0033.754] CanUserWritePwrScheme () returned 1 [0033.755] GetSystemMetrics (nIndex=46) returned 2 [0033.755] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.755] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.755] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.755] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.760] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.760] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.760] GetLastError () returned 0x578 [0033.760] CanUserWritePwrScheme () returned 1 [0033.760] GetSystemMetrics (nIndex=46) returned 2 [0033.760] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.760] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.760] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.760] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.765] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.765] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.765] GetLastError () returned 0x578 [0033.765] CanUserWritePwrScheme () returned 1 [0033.765] GetSystemMetrics (nIndex=46) returned 2 [0033.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.765] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.765] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.765] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.770] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.770] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.770] GetLastError () returned 0x578 [0033.770] CanUserWritePwrScheme () returned 1 [0033.771] GetSystemMetrics (nIndex=46) returned 2 [0033.771] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.771] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.771] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.771] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.787] GetLastError () returned 0x578 [0033.787] CanUserWritePwrScheme () returned 1 [0033.788] GetSystemMetrics (nIndex=46) returned 2 [0033.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.788] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.788] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.795] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.795] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.795] GetLastError () returned 0x578 [0033.795] CanUserWritePwrScheme () returned 1 [0033.796] GetSystemMetrics (nIndex=46) returned 2 [0033.796] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.796] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.796] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.796] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.803] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.803] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.803] GetLastError () returned 0x578 [0033.804] CanUserWritePwrScheme () returned 1 [0033.804] GetSystemMetrics (nIndex=46) returned 2 [0033.804] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.804] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.804] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.804] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.809] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.809] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.809] GetLastError () returned 0x578 [0033.809] CanUserWritePwrScheme () returned 1 [0033.810] GetSystemMetrics (nIndex=46) returned 2 [0033.810] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.810] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.810] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.810] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.815] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.815] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.815] GetLastError () returned 0x578 [0033.815] CanUserWritePwrScheme () returned 1 [0033.816] GetSystemMetrics (nIndex=46) returned 2 [0033.816] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.816] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.816] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.816] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.821] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.821] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.821] GetLastError () returned 0x578 [0033.821] CanUserWritePwrScheme () returned 1 [0033.821] GetSystemMetrics (nIndex=46) returned 2 [0033.821] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.821] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.821] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.821] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.826] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.826] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.826] GetLastError () returned 0x578 [0033.826] CanUserWritePwrScheme () returned 1 [0033.827] GetSystemMetrics (nIndex=46) returned 2 [0033.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.827] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.827] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.827] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.833] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.833] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.833] GetLastError () returned 0x578 [0033.833] CanUserWritePwrScheme () returned 1 [0033.833] GetSystemMetrics (nIndex=46) returned 2 [0033.833] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.833] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.833] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.833] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.838] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.838] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.838] GetLastError () returned 0x578 [0033.838] CanUserWritePwrScheme () returned 1 [0033.839] GetSystemMetrics (nIndex=46) returned 2 [0033.839] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.839] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.839] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.839] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.844] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.844] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.844] GetLastError () returned 0x578 [0033.844] CanUserWritePwrScheme () returned 1 [0033.845] GetSystemMetrics (nIndex=46) returned 2 [0033.845] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.845] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.845] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.845] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.850] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.850] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.850] GetLastError () returned 0x578 [0033.850] CanUserWritePwrScheme () returned 1 [0033.850] GetSystemMetrics (nIndex=46) returned 2 [0033.850] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.850] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.850] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.850] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.855] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.855] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.855] GetLastError () returned 0x578 [0033.855] CanUserWritePwrScheme () returned 1 [0033.855] GetSystemMetrics (nIndex=46) returned 2 [0033.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.856] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.856] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.864] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.864] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.864] GetLastError () returned 0x578 [0033.864] CanUserWritePwrScheme () returned 1 [0033.864] GetSystemMetrics (nIndex=46) returned 2 [0033.864] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.864] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.864] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.864] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.879] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.879] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.879] GetLastError () returned 0x578 [0033.879] CanUserWritePwrScheme () returned 1 [0033.880] GetSystemMetrics (nIndex=46) returned 2 [0033.880] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.880] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.880] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.880] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.885] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.886] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.886] GetLastError () returned 0x578 [0033.886] CanUserWritePwrScheme () returned 1 [0033.886] GetSystemMetrics (nIndex=46) returned 2 [0033.886] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.886] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.886] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.886] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.892] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.892] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.892] GetLastError () returned 0x578 [0033.892] CanUserWritePwrScheme () returned 1 [0033.892] GetSystemMetrics (nIndex=46) returned 2 [0033.892] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.892] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.892] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.892] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.897] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.897] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.897] GetLastError () returned 0x578 [0033.897] CanUserWritePwrScheme () returned 1 [0033.898] GetSystemMetrics (nIndex=46) returned 2 [0033.898] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.898] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.898] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.898] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.903] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.903] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.903] GetLastError () returned 0x578 [0033.903] CanUserWritePwrScheme () returned 1 [0033.903] GetSystemMetrics (nIndex=46) returned 2 [0033.903] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.903] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.903] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.903] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.908] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.909] GetLastError () returned 0x578 [0033.909] CanUserWritePwrScheme () returned 1 [0033.909] GetSystemMetrics (nIndex=46) returned 2 [0033.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.909] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.909] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.909] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.914] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.914] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.914] GetLastError () returned 0x578 [0033.914] CanUserWritePwrScheme () returned 1 [0033.914] GetSystemMetrics (nIndex=46) returned 2 [0033.914] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.914] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.914] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.914] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.930] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.930] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.930] GetLastError () returned 0x578 [0033.930] CanUserWritePwrScheme () returned 1 [0033.931] GetSystemMetrics (nIndex=46) returned 2 [0033.931] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.931] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.931] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.931] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.944] GetLastError () returned 0x578 [0033.944] CanUserWritePwrScheme () returned 1 [0033.944] GetSystemMetrics (nIndex=46) returned 2 [0033.944] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.944] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.944] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.944] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.949] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.949] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.949] GetLastError () returned 0x578 [0033.949] CanUserWritePwrScheme () returned 1 [0033.950] GetSystemMetrics (nIndex=46) returned 2 [0033.950] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.950] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.950] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.950] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.955] GetLastError () returned 0x578 [0033.955] CanUserWritePwrScheme () returned 1 [0033.955] GetSystemMetrics (nIndex=46) returned 2 [0033.955] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.955] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.955] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.955] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.960] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.960] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.960] GetLastError () returned 0x578 [0033.960] CanUserWritePwrScheme () returned 1 [0033.961] GetSystemMetrics (nIndex=46) returned 2 [0033.961] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.961] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.961] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.961] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.966] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.966] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.966] GetLastError () returned 0x578 [0033.966] CanUserWritePwrScheme () returned 1 [0033.966] GetSystemMetrics (nIndex=46) returned 2 [0033.966] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.966] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.966] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.966] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.971] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.971] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.972] GetLastError () returned 0x578 [0033.972] CanUserWritePwrScheme () returned 1 [0033.972] GetSystemMetrics (nIndex=46) returned 2 [0033.972] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.972] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.972] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.972] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.977] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.977] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.977] GetLastError () returned 0x578 [0033.977] CanUserWritePwrScheme () returned 1 [0033.977] GetSystemMetrics (nIndex=46) returned 2 [0033.977] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.977] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.977] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.977] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.986] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.986] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.986] GetLastError () returned 0x578 [0033.986] CanUserWritePwrScheme () returned 1 [0033.986] GetSystemMetrics (nIndex=46) returned 2 [0033.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.986] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.991] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.991] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.991] GetLastError () returned 0x578 [0033.991] CanUserWritePwrScheme () returned 1 [0033.992] GetSystemMetrics (nIndex=46) returned 2 [0033.992] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.992] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.992] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.992] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0033.996] GetWindowTextLengthA (hWnd=0x0) returned 0 [0033.996] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0033.996] GetLastError () returned 0x578 [0033.997] CanUserWritePwrScheme () returned 1 [0033.997] GetSystemMetrics (nIndex=46) returned 2 [0033.997] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0033.997] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0033.997] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0033.997] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.002] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.002] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.002] GetLastError () returned 0x578 [0034.002] CanUserWritePwrScheme () returned 1 [0034.003] GetSystemMetrics (nIndex=46) returned 2 [0034.003] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.003] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.003] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.003] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.008] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.008] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.008] GetLastError () returned 0x578 [0034.008] CanUserWritePwrScheme () returned 1 [0034.008] GetSystemMetrics (nIndex=46) returned 2 [0034.008] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.008] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.008] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.008] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.013] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.013] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.013] GetLastError () returned 0x578 [0034.013] CanUserWritePwrScheme () returned 1 [0034.013] GetSystemMetrics (nIndex=46) returned 2 [0034.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.019] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.019] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.019] GetLastError () returned 0x578 [0034.019] CanUserWritePwrScheme () returned 1 [0034.019] GetSystemMetrics (nIndex=46) returned 2 [0034.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.019] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.024] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.024] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.024] GetLastError () returned 0x578 [0034.024] CanUserWritePwrScheme () returned 1 [0034.024] GetSystemMetrics (nIndex=46) returned 2 [0034.024] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.024] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.024] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.024] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.029] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.029] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.029] GetLastError () returned 0x578 [0034.029] CanUserWritePwrScheme () returned 1 [0034.030] GetSystemMetrics (nIndex=46) returned 2 [0034.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.030] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.030] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.030] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.035] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.035] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.035] GetLastError () returned 0x578 [0034.035] CanUserWritePwrScheme () returned 1 [0034.036] GetSystemMetrics (nIndex=46) returned 2 [0034.036] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.036] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.036] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.036] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.043] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.043] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.044] GetLastError () returned 0x578 [0034.044] CanUserWritePwrScheme () returned 1 [0034.044] GetSystemMetrics (nIndex=46) returned 2 [0034.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.044] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.044] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.044] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.049] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.049] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.049] GetLastError () returned 0x578 [0034.049] CanUserWritePwrScheme () returned 1 [0034.049] GetSystemMetrics (nIndex=46) returned 2 [0034.049] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.049] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.049] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.049] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.054] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.054] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.054] GetLastError () returned 0x578 [0034.054] CanUserWritePwrScheme () returned 1 [0034.055] GetSystemMetrics (nIndex=46) returned 2 [0034.055] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.055] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.055] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.055] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.060] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.060] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.060] GetLastError () returned 0x578 [0034.060] CanUserWritePwrScheme () returned 1 [0034.060] GetSystemMetrics (nIndex=46) returned 2 [0034.060] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.060] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.060] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.060] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.065] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.065] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.066] GetLastError () returned 0x578 [0034.066] CanUserWritePwrScheme () returned 1 [0034.066] GetSystemMetrics (nIndex=46) returned 2 [0034.066] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.066] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.066] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.066] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.071] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.071] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.071] GetLastError () returned 0x578 [0034.071] CanUserWritePwrScheme () returned 1 [0034.071] GetSystemMetrics (nIndex=46) returned 2 [0034.071] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.071] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.071] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.071] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.076] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.076] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.076] GetLastError () returned 0x578 [0034.076] CanUserWritePwrScheme () returned 1 [0034.077] GetSystemMetrics (nIndex=46) returned 2 [0034.077] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.077] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.077] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.077] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.082] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.082] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.082] GetLastError () returned 0x578 [0034.082] CanUserWritePwrScheme () returned 1 [0034.082] GetSystemMetrics (nIndex=46) returned 2 [0034.082] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.082] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.082] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.082] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.087] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.087] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.087] GetLastError () returned 0x578 [0034.087] CanUserWritePwrScheme () returned 1 [0034.088] GetSystemMetrics (nIndex=46) returned 2 [0034.088] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.088] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.088] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.088] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.093] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.093] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.093] GetLastError () returned 0x578 [0034.093] CanUserWritePwrScheme () returned 1 [0034.093] GetSystemMetrics (nIndex=46) returned 2 [0034.093] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.093] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.093] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.093] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.098] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.098] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.098] GetLastError () returned 0x578 [0034.098] CanUserWritePwrScheme () returned 1 [0034.099] GetSystemMetrics (nIndex=46) returned 2 [0034.099] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.099] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.099] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.099] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.107] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.107] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.107] GetLastError () returned 0x578 [0034.107] CanUserWritePwrScheme () returned 1 [0034.107] GetSystemMetrics (nIndex=46) returned 2 [0034.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.107] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.112] GetLastError () returned 0x578 [0034.112] CanUserWritePwrScheme () returned 1 [0034.113] GetSystemMetrics (nIndex=46) returned 2 [0034.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.379] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.379] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.379] GetLastError () returned 0x578 [0034.379] CanUserWritePwrScheme () returned 1 [0034.379] GetSystemMetrics (nIndex=46) returned 2 [0034.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.379] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.379] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.379] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.383] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.383] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.383] GetLastError () returned 0x578 [0034.384] CanUserWritePwrScheme () returned 1 [0034.384] GetSystemMetrics (nIndex=46) returned 2 [0034.384] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.384] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.384] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.384] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.388] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.388] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.388] GetLastError () returned 0x578 [0034.388] CanUserWritePwrScheme () returned 1 [0034.389] GetSystemMetrics (nIndex=46) returned 2 [0034.389] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.389] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.389] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.389] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.393] GetLastError () returned 0x578 [0034.393] CanUserWritePwrScheme () returned 1 [0034.394] GetSystemMetrics (nIndex=46) returned 2 [0034.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.394] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.394] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.394] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.398] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.398] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.398] GetLastError () returned 0x578 [0034.398] CanUserWritePwrScheme () returned 1 [0034.398] GetSystemMetrics (nIndex=46) returned 2 [0034.398] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.398] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.398] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.398] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.402] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.402] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.402] GetLastError () returned 0x578 [0034.402] CanUserWritePwrScheme () returned 1 [0034.403] GetSystemMetrics (nIndex=46) returned 2 [0034.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.403] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.403] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.403] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.407] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.407] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.407] GetLastError () returned 0x578 [0034.407] CanUserWritePwrScheme () returned 1 [0034.407] GetSystemMetrics (nIndex=46) returned 2 [0034.407] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.407] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.407] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.407] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.411] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.411] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.412] GetLastError () returned 0x578 [0034.412] CanUserWritePwrScheme () returned 1 [0034.412] GetSystemMetrics (nIndex=46) returned 2 [0034.412] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.412] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.412] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.412] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.416] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.416] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.416] GetLastError () returned 0x578 [0034.416] CanUserWritePwrScheme () returned 1 [0034.416] GetSystemMetrics (nIndex=46) returned 2 [0034.416] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.416] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.416] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.416] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.420] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.421] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.421] GetLastError () returned 0x578 [0034.421] CanUserWritePwrScheme () returned 1 [0034.421] GetSystemMetrics (nIndex=46) returned 2 [0034.421] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.421] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.421] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.421] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.430] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.430] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.430] GetLastError () returned 0x578 [0034.430] CanUserWritePwrScheme () returned 1 [0034.431] GetSystemMetrics (nIndex=46) returned 2 [0034.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.435] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.435] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.435] GetLastError () returned 0x578 [0034.435] CanUserWritePwrScheme () returned 1 [0034.435] GetSystemMetrics (nIndex=46) returned 2 [0034.435] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.435] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.435] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.435] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.439] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.439] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.439] GetLastError () returned 0x578 [0034.440] CanUserWritePwrScheme () returned 1 [0034.440] GetSystemMetrics (nIndex=46) returned 2 [0034.440] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.440] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.440] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.440] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.444] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.444] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.444] GetLastError () returned 0x578 [0034.444] CanUserWritePwrScheme () returned 1 [0034.444] GetSystemMetrics (nIndex=46) returned 2 [0034.444] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.444] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.444] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.444] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.448] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.448] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.448] GetLastError () returned 0x578 [0034.449] CanUserWritePwrScheme () returned 1 [0034.449] GetSystemMetrics (nIndex=46) returned 2 [0034.449] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.449] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.449] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.449] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.453] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.453] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.453] GetLastError () returned 0x578 [0034.453] CanUserWritePwrScheme () returned 1 [0034.453] GetSystemMetrics (nIndex=46) returned 2 [0034.453] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.453] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.453] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.453] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.458] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.458] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.458] GetLastError () returned 0x578 [0034.458] CanUserWritePwrScheme () returned 1 [0034.458] GetSystemMetrics (nIndex=46) returned 2 [0034.458] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.458] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.458] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.458] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.462] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.462] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.462] GetLastError () returned 0x578 [0034.462] CanUserWritePwrScheme () returned 1 [0034.463] GetSystemMetrics (nIndex=46) returned 2 [0034.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.463] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.463] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.463] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.491] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.491] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.492] GetLastError () returned 0x578 [0034.492] CanUserWritePwrScheme () returned 1 [0034.492] GetSystemMetrics (nIndex=46) returned 2 [0034.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.492] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.492] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.492] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.496] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.497] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.497] GetLastError () returned 0x578 [0034.497] CanUserWritePwrScheme () returned 1 [0034.497] GetSystemMetrics (nIndex=46) returned 2 [0034.497] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.497] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.497] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.497] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.501] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.501] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.501] GetLastError () returned 0x578 [0034.501] CanUserWritePwrScheme () returned 1 [0034.502] GetSystemMetrics (nIndex=46) returned 2 [0034.502] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.502] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.502] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.502] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.506] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.506] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.506] GetLastError () returned 0x578 [0034.506] CanUserWritePwrScheme () returned 1 [0034.506] GetSystemMetrics (nIndex=46) returned 2 [0034.506] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.506] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.506] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.506] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.511] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.511] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.511] GetLastError () returned 0x578 [0034.511] CanUserWritePwrScheme () returned 1 [0034.511] GetSystemMetrics (nIndex=46) returned 2 [0034.511] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.511] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.511] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.511] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.516] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.516] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.516] GetLastError () returned 0x578 [0034.516] CanUserWritePwrScheme () returned 1 [0034.517] GetSystemMetrics (nIndex=46) returned 2 [0034.517] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.517] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.517] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.517] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.521] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.521] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.521] GetLastError () returned 0x578 [0034.521] CanUserWritePwrScheme () returned 1 [0034.521] GetSystemMetrics (nIndex=46) returned 2 [0034.521] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.521] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.521] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.521] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.525] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.525] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.526] GetLastError () returned 0x578 [0034.526] CanUserWritePwrScheme () returned 1 [0034.526] GetSystemMetrics (nIndex=46) returned 2 [0034.526] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.526] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.526] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.526] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.530] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.530] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.530] GetLastError () returned 0x578 [0034.530] CanUserWritePwrScheme () returned 1 [0034.531] GetSystemMetrics (nIndex=46) returned 2 [0034.531] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.531] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.531] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.531] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.535] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.535] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.535] GetLastError () returned 0x578 [0034.535] CanUserWritePwrScheme () returned 1 [0034.535] GetSystemMetrics (nIndex=46) returned 2 [0034.535] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.535] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.535] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.535] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.539] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.539] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.539] GetLastError () returned 0x578 [0034.539] CanUserWritePwrScheme () returned 1 [0034.540] GetSystemMetrics (nIndex=46) returned 2 [0034.540] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.540] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.540] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.540] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.544] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.544] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.544] GetLastError () returned 0x578 [0034.544] CanUserWritePwrScheme () returned 1 [0034.544] GetSystemMetrics (nIndex=46) returned 2 [0034.544] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.544] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.544] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.545] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.549] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.549] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.549] GetLastError () returned 0x578 [0034.549] CanUserWritePwrScheme () returned 1 [0034.549] GetSystemMetrics (nIndex=46) returned 2 [0034.549] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.549] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.549] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.549] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.553] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.553] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.553] GetLastError () returned 0x578 [0034.553] CanUserWritePwrScheme () returned 1 [0034.554] GetSystemMetrics (nIndex=46) returned 2 [0034.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.554] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.554] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.554] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.558] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.558] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.558] GetLastError () returned 0x578 [0034.558] CanUserWritePwrScheme () returned 1 [0034.558] GetSystemMetrics (nIndex=46) returned 2 [0034.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.558] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.558] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.558] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.562] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.562] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.563] GetLastError () returned 0x578 [0034.563] CanUserWritePwrScheme () returned 1 [0034.563] GetSystemMetrics (nIndex=46) returned 2 [0034.563] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.563] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.563] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.563] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.567] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.567] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.567] GetLastError () returned 0x578 [0034.567] CanUserWritePwrScheme () returned 1 [0034.568] GetSystemMetrics (nIndex=46) returned 2 [0034.568] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.568] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.568] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.568] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.572] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.572] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.572] GetLastError () returned 0x578 [0034.572] CanUserWritePwrScheme () returned 1 [0034.572] GetSystemMetrics (nIndex=46) returned 2 [0034.572] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.572] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.572] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.572] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.577] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.577] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.577] GetLastError () returned 0x578 [0034.577] CanUserWritePwrScheme () returned 1 [0034.578] GetSystemMetrics (nIndex=46) returned 2 [0034.578] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.578] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.578] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.578] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.585] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.585] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.585] GetLastError () returned 0x578 [0034.585] CanUserWritePwrScheme () returned 1 [0034.585] GetSystemMetrics (nIndex=46) returned 2 [0034.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.585] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.585] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.585] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.590] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.590] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.590] GetLastError () returned 0x578 [0034.590] CanUserWritePwrScheme () returned 1 [0034.590] GetSystemMetrics (nIndex=46) returned 2 [0034.590] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.590] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.590] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.590] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.594] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.594] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.594] GetLastError () returned 0x578 [0034.594] CanUserWritePwrScheme () returned 1 [0034.595] GetSystemMetrics (nIndex=46) returned 2 [0034.595] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.595] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.595] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.595] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.599] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.599] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.599] GetLastError () returned 0x578 [0034.599] CanUserWritePwrScheme () returned 1 [0034.599] GetSystemMetrics (nIndex=46) returned 2 [0034.599] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.599] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.599] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.600] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.604] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.604] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.604] GetLastError () returned 0x578 [0034.604] CanUserWritePwrScheme () returned 1 [0034.604] GetSystemMetrics (nIndex=46) returned 2 [0034.604] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.604] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.604] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.604] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.608] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.608] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.608] GetLastError () returned 0x578 [0034.608] CanUserWritePwrScheme () returned 1 [0034.609] GetSystemMetrics (nIndex=46) returned 2 [0034.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.609] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.609] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.609] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.616] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.616] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.616] GetLastError () returned 0x578 [0034.616] CanUserWritePwrScheme () returned 1 [0034.616] GetSystemMetrics (nIndex=46) returned 2 [0034.616] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.616] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.616] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.616] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.622] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.622] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.622] GetLastError () returned 0x578 [0034.622] CanUserWritePwrScheme () returned 1 [0034.622] GetSystemMetrics (nIndex=46) returned 2 [0034.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.622] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.622] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.622] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.629] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.629] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.630] GetLastError () returned 0x578 [0034.630] CanUserWritePwrScheme () returned 1 [0034.630] GetSystemMetrics (nIndex=46) returned 2 [0034.630] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.630] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.630] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.630] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.636] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.636] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.636] GetLastError () returned 0x578 [0034.636] CanUserWritePwrScheme () returned 1 [0034.637] GetSystemMetrics (nIndex=46) returned 2 [0034.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.637] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.637] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.637] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.642] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.642] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.642] GetLastError () returned 0x578 [0034.642] CanUserWritePwrScheme () returned 1 [0034.643] GetSystemMetrics (nIndex=46) returned 2 [0034.643] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.643] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.643] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.643] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.647] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.647] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.647] GetLastError () returned 0x578 [0034.647] CanUserWritePwrScheme () returned 1 [0034.647] GetSystemMetrics (nIndex=46) returned 2 [0034.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.647] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.647] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.651] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.651] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.651] GetLastError () returned 0x578 [0034.651] CanUserWritePwrScheme () returned 1 [0034.652] GetSystemMetrics (nIndex=46) returned 2 [0034.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.652] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.652] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.652] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.656] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.656] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.656] GetLastError () returned 0x578 [0034.656] CanUserWritePwrScheme () returned 1 [0034.657] GetSystemMetrics (nIndex=46) returned 2 [0034.657] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.657] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.657] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.657] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.661] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.661] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.661] GetLastError () returned 0x578 [0034.661] CanUserWritePwrScheme () returned 1 [0034.661] GetSystemMetrics (nIndex=46) returned 2 [0034.661] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.661] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.661] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.661] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.665] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.665] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.665] GetLastError () returned 0x578 [0034.666] CanUserWritePwrScheme () returned 1 [0034.666] GetSystemMetrics (nIndex=46) returned 2 [0034.666] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.666] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.666] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.666] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.670] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.670] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.670] GetLastError () returned 0x578 [0034.670] CanUserWritePwrScheme () returned 1 [0034.670] GetSystemMetrics (nIndex=46) returned 2 [0034.670] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.670] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.670] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.670] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.675] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.675] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.675] GetLastError () returned 0x578 [0034.675] CanUserWritePwrScheme () returned 1 [0034.675] GetSystemMetrics (nIndex=46) returned 2 [0034.675] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.675] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.675] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.675] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.679] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.679] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.679] GetLastError () returned 0x578 [0034.679] CanUserWritePwrScheme () returned 1 [0034.680] GetSystemMetrics (nIndex=46) returned 2 [0034.680] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.680] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.680] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.680] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.684] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.684] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.684] GetLastError () returned 0x578 [0034.684] CanUserWritePwrScheme () returned 1 [0034.684] GetSystemMetrics (nIndex=46) returned 2 [0034.684] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.684] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.684] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.688] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.688] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.688] GetLastError () returned 0x578 [0034.689] CanUserWritePwrScheme () returned 1 [0034.689] GetSystemMetrics (nIndex=46) returned 2 [0034.689] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.689] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.689] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.689] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.693] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.693] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.693] GetLastError () returned 0x578 [0034.693] CanUserWritePwrScheme () returned 1 [0034.693] GetSystemMetrics (nIndex=46) returned 2 [0034.693] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.693] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.693] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.693] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.697] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.697] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.697] GetLastError () returned 0x578 [0034.697] CanUserWritePwrScheme () returned 1 [0034.698] GetSystemMetrics (nIndex=46) returned 2 [0034.698] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.698] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.698] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.698] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.702] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.702] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.702] GetLastError () returned 0x578 [0034.702] CanUserWritePwrScheme () returned 1 [0034.702] GetSystemMetrics (nIndex=46) returned 2 [0034.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.703] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.706] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.706] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.707] GetLastError () returned 0x578 [0034.707] CanUserWritePwrScheme () returned 1 [0034.707] GetSystemMetrics (nIndex=46) returned 2 [0034.707] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.707] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.707] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.707] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.711] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.711] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.712] GetLastError () returned 0x578 [0034.712] CanUserWritePwrScheme () returned 1 [0034.712] GetSystemMetrics (nIndex=46) returned 2 [0034.712] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.712] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.712] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.712] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.718] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.718] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.718] GetLastError () returned 0x578 [0034.718] CanUserWritePwrScheme () returned 1 [0034.718] GetSystemMetrics (nIndex=46) returned 2 [0034.718] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.718] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.718] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.718] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.724] GetLastError () returned 0x578 [0034.725] CanUserWritePwrScheme () returned 1 [0034.725] GetSystemMetrics (nIndex=46) returned 2 [0034.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.725] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.725] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.725] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.729] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.729] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.729] GetLastError () returned 0x578 [0034.729] CanUserWritePwrScheme () returned 1 [0034.729] GetSystemMetrics (nIndex=46) returned 2 [0034.729] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.729] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.729] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.730] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.734] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.734] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.734] GetLastError () returned 0x578 [0034.734] CanUserWritePwrScheme () returned 1 [0034.734] GetSystemMetrics (nIndex=46) returned 2 [0034.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.734] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.734] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.734] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.738] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.738] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.738] GetLastError () returned 0x578 [0034.738] CanUserWritePwrScheme () returned 1 [0034.739] GetSystemMetrics (nIndex=46) returned 2 [0034.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.739] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.739] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.739] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.743] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.743] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.743] GetLastError () returned 0x578 [0034.743] CanUserWritePwrScheme () returned 1 [0034.743] GetSystemMetrics (nIndex=46) returned 2 [0034.743] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.743] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.743] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.743] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.750] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.750] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.750] GetLastError () returned 0x578 [0034.750] CanUserWritePwrScheme () returned 1 [0034.750] GetSystemMetrics (nIndex=46) returned 2 [0034.750] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.750] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.750] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.751] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.754] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.755] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.755] GetLastError () returned 0x578 [0034.755] CanUserWritePwrScheme () returned 1 [0034.755] GetSystemMetrics (nIndex=46) returned 2 [0034.755] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.755] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.755] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.755] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.759] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.759] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.759] GetLastError () returned 0x578 [0034.759] CanUserWritePwrScheme () returned 1 [0034.760] GetSystemMetrics (nIndex=46) returned 2 [0034.760] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.760] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.760] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.760] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.764] GetLastError () returned 0x578 [0034.764] CanUserWritePwrScheme () returned 1 [0034.764] GetSystemMetrics (nIndex=46) returned 2 [0034.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.764] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.764] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.764] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.768] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.768] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.769] GetLastError () returned 0x578 [0034.769] CanUserWritePwrScheme () returned 1 [0034.769] GetSystemMetrics (nIndex=46) returned 2 [0034.769] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.769] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.769] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.769] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.773] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.773] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.773] GetLastError () returned 0x578 [0034.773] CanUserWritePwrScheme () returned 1 [0034.773] GetSystemMetrics (nIndex=46) returned 2 [0034.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.774] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.774] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.777] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.778] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.778] GetLastError () returned 0x578 [0034.778] CanUserWritePwrScheme () returned 1 [0034.778] GetSystemMetrics (nIndex=46) returned 2 [0034.778] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.778] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.778] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.778] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.782] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.782] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.782] GetLastError () returned 0x578 [0034.782] CanUserWritePwrScheme () returned 1 [0034.783] GetSystemMetrics (nIndex=46) returned 2 [0034.783] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.783] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.783] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.783] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.787] GetLastError () returned 0x578 [0034.787] CanUserWritePwrScheme () returned 1 [0034.787] GetSystemMetrics (nIndex=46) returned 2 [0034.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.791] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.791] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.791] GetLastError () returned 0x578 [0034.791] CanUserWritePwrScheme () returned 1 [0034.792] GetSystemMetrics (nIndex=46) returned 2 [0034.792] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.792] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.792] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.792] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.796] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.796] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.796] GetLastError () returned 0x578 [0034.796] CanUserWritePwrScheme () returned 1 [0034.796] GetSystemMetrics (nIndex=46) returned 2 [0034.796] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.796] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.796] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.796] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.800] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.800] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.800] GetLastError () returned 0x578 [0034.801] CanUserWritePwrScheme () returned 1 [0034.801] GetSystemMetrics (nIndex=46) returned 2 [0034.801] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.801] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.801] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.801] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.805] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.805] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.805] GetLastError () returned 0x578 [0034.805] CanUserWritePwrScheme () returned 1 [0034.805] GetSystemMetrics (nIndex=46) returned 2 [0034.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.809] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.809] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.810] GetLastError () returned 0x578 [0034.810] CanUserWritePwrScheme () returned 1 [0034.810] GetSystemMetrics (nIndex=46) returned 2 [0034.810] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.810] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.810] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.810] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.814] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.814] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.814] GetLastError () returned 0x578 [0034.814] CanUserWritePwrScheme () returned 1 [0034.815] GetSystemMetrics (nIndex=46) returned 2 [0034.815] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.815] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.815] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.815] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.819] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.819] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.819] GetLastError () returned 0x578 [0034.819] CanUserWritePwrScheme () returned 1 [0034.819] GetSystemMetrics (nIndex=46) returned 2 [0034.819] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.819] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.819] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.819] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.823] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.823] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.824] GetLastError () returned 0x578 [0034.824] CanUserWritePwrScheme () returned 1 [0034.824] GetSystemMetrics (nIndex=46) returned 2 [0034.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.824] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.824] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.824] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.828] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.828] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.829] GetLastError () returned 0x578 [0034.829] CanUserWritePwrScheme () returned 1 [0034.829] GetSystemMetrics (nIndex=46) returned 2 [0034.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.829] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.829] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.829] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.833] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.833] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.833] GetLastError () returned 0x578 [0034.833] CanUserWritePwrScheme () returned 1 [0034.833] GetSystemMetrics (nIndex=46) returned 2 [0034.833] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.833] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.833] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.834] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.837] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.838] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.838] GetLastError () returned 0x578 [0034.838] CanUserWritePwrScheme () returned 1 [0034.838] GetSystemMetrics (nIndex=46) returned 2 [0034.838] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.838] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.838] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.838] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.842] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.842] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.842] GetLastError () returned 0x578 [0034.842] CanUserWritePwrScheme () returned 1 [0034.843] GetSystemMetrics (nIndex=46) returned 2 [0034.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.843] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.843] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.847] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.847] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.847] GetLastError () returned 0x578 [0034.847] CanUserWritePwrScheme () returned 1 [0034.847] GetSystemMetrics (nIndex=46) returned 2 [0034.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.847] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.847] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.847] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.851] GetLastError () returned 0x578 [0034.851] CanUserWritePwrScheme () returned 1 [0034.852] GetSystemMetrics (nIndex=46) returned 2 [0034.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.852] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.852] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.852] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.856] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.856] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.856] GetLastError () returned 0x578 [0034.856] CanUserWritePwrScheme () returned 1 [0034.856] GetSystemMetrics (nIndex=46) returned 2 [0034.856] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.856] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.856] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.861] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.861] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.861] GetLastError () returned 0x578 [0034.861] CanUserWritePwrScheme () returned 1 [0034.861] GetSystemMetrics (nIndex=46) returned 2 [0034.861] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.865] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.865] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.865] GetLastError () returned 0x578 [0034.866] CanUserWritePwrScheme () returned 1 [0034.866] GetSystemMetrics (nIndex=46) returned 2 [0034.866] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.866] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.866] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.866] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.870] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.870] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.870] GetLastError () returned 0x578 [0034.870] CanUserWritePwrScheme () returned 1 [0034.870] GetSystemMetrics (nIndex=46) returned 2 [0034.870] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.870] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.870] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.870] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.882] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.882] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.882] GetLastError () returned 0x578 [0034.882] CanUserWritePwrScheme () returned 1 [0034.882] GetSystemMetrics (nIndex=46) returned 2 [0034.882] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.882] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.882] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.882] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.886] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.886] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.886] GetLastError () returned 0x578 [0034.886] CanUserWritePwrScheme () returned 1 [0034.887] GetSystemMetrics (nIndex=46) returned 2 [0034.887] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.887] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.887] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.887] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.891] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.891] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.891] GetLastError () returned 0x578 [0034.891] CanUserWritePwrScheme () returned 1 [0034.891] GetSystemMetrics (nIndex=46) returned 2 [0034.891] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.892] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.892] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.892] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.896] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.896] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.896] GetLastError () returned 0x578 [0034.896] CanUserWritePwrScheme () returned 1 [0034.896] GetSystemMetrics (nIndex=46) returned 2 [0034.896] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.896] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.896] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.896] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.900] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.900] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.900] GetLastError () returned 0x578 [0034.900] CanUserWritePwrScheme () returned 1 [0034.901] GetSystemMetrics (nIndex=46) returned 2 [0034.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.901] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.901] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.901] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.905] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.905] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.905] GetLastError () returned 0x578 [0034.905] CanUserWritePwrScheme () returned 1 [0034.905] GetSystemMetrics (nIndex=46) returned 2 [0034.905] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.905] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.905] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.905] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.909] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.909] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.909] GetLastError () returned 0x578 [0034.909] CanUserWritePwrScheme () returned 1 [0034.910] GetSystemMetrics (nIndex=46) returned 2 [0034.910] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.910] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.910] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.910] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.914] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.914] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.914] GetLastError () returned 0x578 [0034.914] CanUserWritePwrScheme () returned 1 [0034.914] GetSystemMetrics (nIndex=46) returned 2 [0034.914] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.914] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.914] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.914] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.918] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.918] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.918] GetLastError () returned 0x578 [0034.918] CanUserWritePwrScheme () returned 1 [0034.919] GetSystemMetrics (nIndex=46) returned 2 [0034.919] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.919] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.919] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.919] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.923] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.923] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.923] GetLastError () returned 0x578 [0034.923] CanUserWritePwrScheme () returned 1 [0034.923] GetSystemMetrics (nIndex=46) returned 2 [0034.923] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.923] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.923] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.923] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.927] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.927] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.928] GetLastError () returned 0x578 [0034.928] CanUserWritePwrScheme () returned 1 [0034.928] GetSystemMetrics (nIndex=46) returned 2 [0034.928] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.928] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.928] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.928] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.932] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.932] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.932] GetLastError () returned 0x578 [0034.932] CanUserWritePwrScheme () returned 1 [0034.932] GetSystemMetrics (nIndex=46) returned 2 [0034.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.932] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.932] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.932] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.937] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.937] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.937] GetLastError () returned 0x578 [0034.937] CanUserWritePwrScheme () returned 1 [0034.937] GetSystemMetrics (nIndex=46) returned 2 [0034.937] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.937] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.937] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.937] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.941] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.941] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.941] GetLastError () returned 0x578 [0034.941] CanUserWritePwrScheme () returned 1 [0034.942] GetSystemMetrics (nIndex=46) returned 2 [0034.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.946] GetLastError () returned 0x578 [0034.946] CanUserWritePwrScheme () returned 1 [0034.946] GetSystemMetrics (nIndex=46) returned 2 [0034.946] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.946] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.946] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.946] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.950] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.950] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.950] GetLastError () returned 0x578 [0034.950] CanUserWritePwrScheme () returned 1 [0034.951] GetSystemMetrics (nIndex=46) returned 2 [0034.951] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.951] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.951] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.951] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.955] GetLastError () returned 0x578 [0034.955] CanUserWritePwrScheme () returned 1 [0034.955] GetSystemMetrics (nIndex=46) returned 2 [0034.955] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.955] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.955] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.955] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.959] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.959] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.959] GetLastError () returned 0x578 [0034.959] CanUserWritePwrScheme () returned 1 [0034.960] GetSystemMetrics (nIndex=46) returned 2 [0034.960] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.960] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.960] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.960] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.964] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.964] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.964] GetLastError () returned 0x578 [0034.964] CanUserWritePwrScheme () returned 1 [0034.964] GetSystemMetrics (nIndex=46) returned 2 [0034.964] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.964] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.964] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.964] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.972] GetLastError () returned 0x578 [0034.972] CanUserWritePwrScheme () returned 1 [0034.973] GetSystemMetrics (nIndex=46) returned 2 [0034.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.977] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.977] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.977] GetLastError () returned 0x578 [0034.977] CanUserWritePwrScheme () returned 1 [0034.977] GetSystemMetrics (nIndex=46) returned 2 [0034.977] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.977] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.977] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.977] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.981] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.981] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.981] GetLastError () returned 0x578 [0034.981] CanUserWritePwrScheme () returned 1 [0034.982] GetSystemMetrics (nIndex=46) returned 2 [0034.982] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.982] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.982] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.982] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.986] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.986] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.986] GetLastError () returned 0x578 [0034.986] CanUserWritePwrScheme () returned 1 [0034.986] GetSystemMetrics (nIndex=46) returned 2 [0034.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.987] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.991] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.991] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.991] GetLastError () returned 0x578 [0034.991] CanUserWritePwrScheme () returned 1 [0034.991] GetSystemMetrics (nIndex=46) returned 2 [0034.991] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.991] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.991] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.991] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0034.995] GetWindowTextLengthA (hWnd=0x0) returned 0 [0034.995] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0034.995] GetLastError () returned 0x578 [0034.995] CanUserWritePwrScheme () returned 1 [0034.996] GetSystemMetrics (nIndex=46) returned 2 [0034.996] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0034.996] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0034.996] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0034.996] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.000] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.000] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.000] GetLastError () returned 0x578 [0035.000] CanUserWritePwrScheme () returned 1 [0035.000] GetSystemMetrics (nIndex=46) returned 2 [0035.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.000] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.000] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.000] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.004] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.004] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.005] GetLastError () returned 0x578 [0035.005] CanUserWritePwrScheme () returned 1 [0035.005] GetSystemMetrics (nIndex=46) returned 2 [0035.005] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.005] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.005] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.005] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.009] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.009] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.009] GetLastError () returned 0x578 [0035.009] CanUserWritePwrScheme () returned 1 [0035.009] GetSystemMetrics (nIndex=46) returned 2 [0035.009] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.009] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.010] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.010] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.013] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.014] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.014] GetLastError () returned 0x578 [0035.014] CanUserWritePwrScheme () returned 1 [0035.014] GetSystemMetrics (nIndex=46) returned 2 [0035.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.018] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.018] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.018] GetLastError () returned 0x578 [0035.018] CanUserWritePwrScheme () returned 1 [0035.019] GetSystemMetrics (nIndex=46) returned 2 [0035.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.019] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.023] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.023] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.023] GetLastError () returned 0x578 [0035.023] CanUserWritePwrScheme () returned 1 [0035.023] GetSystemMetrics (nIndex=46) returned 2 [0035.023] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.023] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.023] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.023] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.027] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.027] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.027] GetLastError () returned 0x578 [0035.027] CanUserWritePwrScheme () returned 1 [0035.028] GetSystemMetrics (nIndex=46) returned 2 [0035.028] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.028] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.028] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.028] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.032] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.032] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.032] GetLastError () returned 0x578 [0035.032] CanUserWritePwrScheme () returned 1 [0035.033] GetSystemMetrics (nIndex=46) returned 2 [0035.033] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.033] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.033] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.033] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.037] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.037] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.037] GetLastError () returned 0x578 [0035.037] CanUserWritePwrScheme () returned 1 [0035.037] GetSystemMetrics (nIndex=46) returned 2 [0035.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.037] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.037] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.037] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.041] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.041] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.041] GetLastError () returned 0x578 [0035.041] CanUserWritePwrScheme () returned 1 [0035.042] GetSystemMetrics (nIndex=46) returned 2 [0035.042] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.042] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.042] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.042] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.046] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.046] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.046] GetLastError () returned 0x578 [0035.046] CanUserWritePwrScheme () returned 1 [0035.047] GetSystemMetrics (nIndex=46) returned 2 [0035.047] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.047] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.047] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.047] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.051] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.051] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.051] GetLastError () returned 0x578 [0035.051] CanUserWritePwrScheme () returned 1 [0035.051] GetSystemMetrics (nIndex=46) returned 2 [0035.051] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.051] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.051] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.051] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.055] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.055] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.055] GetLastError () returned 0x578 [0035.055] CanUserWritePwrScheme () returned 1 [0035.056] GetSystemMetrics (nIndex=46) returned 2 [0035.056] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.056] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.056] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.056] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.060] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.060] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.060] GetLastError () returned 0x578 [0035.060] CanUserWritePwrScheme () returned 1 [0035.060] GetSystemMetrics (nIndex=46) returned 2 [0035.060] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.061] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.061] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.061] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.065] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.065] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.065] GetLastError () returned 0x578 [0035.065] CanUserWritePwrScheme () returned 1 [0035.065] GetSystemMetrics (nIndex=46) returned 2 [0035.065] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.065] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.065] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.065] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.069] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.069] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.069] GetLastError () returned 0x578 [0035.069] CanUserWritePwrScheme () returned 1 [0035.070] GetSystemMetrics (nIndex=46) returned 2 [0035.070] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.070] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.070] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.070] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.074] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.074] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.074] GetLastError () returned 0x578 [0035.074] CanUserWritePwrScheme () returned 1 [0035.074] GetSystemMetrics (nIndex=46) returned 2 [0035.074] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.074] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.074] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.074] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.079] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.079] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.079] GetLastError () returned 0x578 [0035.079] CanUserWritePwrScheme () returned 1 [0035.079] GetSystemMetrics (nIndex=46) returned 2 [0035.079] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.079] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.079] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.079] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.083] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.083] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.083] GetLastError () returned 0x578 [0035.083] CanUserWritePwrScheme () returned 1 [0035.084] GetSystemMetrics (nIndex=46) returned 2 [0035.084] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.084] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.084] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.084] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.088] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.088] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.088] GetLastError () returned 0x578 [0035.088] CanUserWritePwrScheme () returned 1 [0035.088] GetSystemMetrics (nIndex=46) returned 2 [0035.088] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.088] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.088] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.088] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.093] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.093] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.093] GetLastError () returned 0x578 [0035.093] CanUserWritePwrScheme () returned 1 [0035.093] GetSystemMetrics (nIndex=46) returned 2 [0035.093] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.093] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.093] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.093] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.097] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.097] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.097] GetLastError () returned 0x578 [0035.097] CanUserWritePwrScheme () returned 1 [0035.098] GetSystemMetrics (nIndex=46) returned 2 [0035.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.098] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.098] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.098] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.102] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.102] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.102] GetLastError () returned 0x578 [0035.102] CanUserWritePwrScheme () returned 1 [0035.102] GetSystemMetrics (nIndex=46) returned 2 [0035.102] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.102] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.102] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.102] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.106] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.106] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.106] GetLastError () returned 0x578 [0035.106] CanUserWritePwrScheme () returned 1 [0035.107] GetSystemMetrics (nIndex=46) returned 2 [0035.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.107] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.111] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.111] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.111] GetLastError () returned 0x578 [0035.111] CanUserWritePwrScheme () returned 1 [0035.111] GetSystemMetrics (nIndex=46) returned 2 [0035.111] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.111] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.111] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.111] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.115] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.115] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.116] GetLastError () returned 0x578 [0035.116] CanUserWritePwrScheme () returned 1 [0035.116] GetSystemMetrics (nIndex=46) returned 2 [0035.116] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.116] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.116] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.116] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.120] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.120] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.120] GetLastError () returned 0x578 [0035.120] CanUserWritePwrScheme () returned 1 [0035.120] GetSystemMetrics (nIndex=46) returned 2 [0035.120] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.120] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.121] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.121] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.125] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.125] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.125] GetLastError () returned 0x578 [0035.125] CanUserWritePwrScheme () returned 1 [0035.125] GetSystemMetrics (nIndex=46) returned 2 [0035.125] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.125] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.125] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.125] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.129] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.129] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.129] GetLastError () returned 0x578 [0035.129] CanUserWritePwrScheme () returned 1 [0035.130] GetSystemMetrics (nIndex=46) returned 2 [0035.130] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.130] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.130] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.130] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.134] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.134] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.134] GetLastError () returned 0x578 [0035.134] CanUserWritePwrScheme () returned 1 [0035.134] GetSystemMetrics (nIndex=46) returned 2 [0035.134] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.134] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.134] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.134] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.138] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.138] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.138] GetLastError () returned 0x578 [0035.138] CanUserWritePwrScheme () returned 1 [0035.139] GetSystemMetrics (nIndex=46) returned 2 [0035.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.139] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.139] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.139] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.143] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.143] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.143] GetLastError () returned 0x578 [0035.143] CanUserWritePwrScheme () returned 1 [0035.143] GetSystemMetrics (nIndex=46) returned 2 [0035.143] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.143] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.143] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.143] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.147] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.147] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.147] GetLastError () returned 0x578 [0035.148] CanUserWritePwrScheme () returned 1 [0035.148] GetSystemMetrics (nIndex=46) returned 2 [0035.148] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.148] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.148] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.148] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.152] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.152] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.152] GetLastError () returned 0x578 [0035.152] CanUserWritePwrScheme () returned 1 [0035.152] GetSystemMetrics (nIndex=46) returned 2 [0035.152] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.152] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.152] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.152] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.157] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.157] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.157] GetLastError () returned 0x578 [0035.157] CanUserWritePwrScheme () returned 1 [0035.157] GetSystemMetrics (nIndex=46) returned 2 [0035.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.158] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.158] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.158] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.162] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.162] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.162] GetLastError () returned 0x578 [0035.162] CanUserWritePwrScheme () returned 1 [0035.162] GetSystemMetrics (nIndex=46) returned 2 [0035.162] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.162] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.162] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.162] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.166] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.166] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.166] GetLastError () returned 0x578 [0035.166] CanUserWritePwrScheme () returned 1 [0035.167] GetSystemMetrics (nIndex=46) returned 2 [0035.167] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.167] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.167] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.167] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.171] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.171] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.171] GetLastError () returned 0x578 [0035.171] CanUserWritePwrScheme () returned 1 [0035.172] GetSystemMetrics (nIndex=46) returned 2 [0035.172] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.172] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.172] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.172] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.176] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.176] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.176] GetLastError () returned 0x578 [0035.176] CanUserWritePwrScheme () returned 1 [0035.176] GetSystemMetrics (nIndex=46) returned 2 [0035.176] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.176] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.176] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.176] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.180] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.180] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.180] GetLastError () returned 0x578 [0035.180] CanUserWritePwrScheme () returned 1 [0035.181] GetSystemMetrics (nIndex=46) returned 2 [0035.181] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.181] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.181] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.181] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.185] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.185] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.185] GetLastError () returned 0x578 [0035.185] CanUserWritePwrScheme () returned 1 [0035.185] GetSystemMetrics (nIndex=46) returned 2 [0035.185] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.185] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.185] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.185] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.189] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.189] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.189] GetLastError () returned 0x578 [0035.189] CanUserWritePwrScheme () returned 1 [0035.190] GetSystemMetrics (nIndex=46) returned 2 [0035.190] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.190] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.190] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.190] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.194] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.194] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.194] GetLastError () returned 0x578 [0035.194] CanUserWritePwrScheme () returned 1 [0035.194] GetSystemMetrics (nIndex=46) returned 2 [0035.194] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.194] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.194] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.194] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.198] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.198] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.198] GetLastError () returned 0x578 [0035.199] CanUserWritePwrScheme () returned 1 [0035.199] GetSystemMetrics (nIndex=46) returned 2 [0035.199] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.199] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.199] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.199] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.203] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.203] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.203] GetLastError () returned 0x578 [0035.203] CanUserWritePwrScheme () returned 1 [0035.203] GetSystemMetrics (nIndex=46) returned 2 [0035.203] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.203] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.203] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.204] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.207] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.208] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.208] GetLastError () returned 0x578 [0035.208] CanUserWritePwrScheme () returned 1 [0035.208] GetSystemMetrics (nIndex=46) returned 2 [0035.208] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.208] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.208] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.208] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.212] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.212] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.212] GetLastError () returned 0x578 [0035.212] CanUserWritePwrScheme () returned 1 [0035.212] GetSystemMetrics (nIndex=46) returned 2 [0035.212] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.213] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.213] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.213] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.217] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.217] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.217] GetLastError () returned 0x578 [0035.217] CanUserWritePwrScheme () returned 1 [0035.217] GetSystemMetrics (nIndex=46) returned 2 [0035.217] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.217] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.217] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.217] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.221] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.221] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.221] GetLastError () returned 0x578 [0035.221] CanUserWritePwrScheme () returned 1 [0035.222] GetSystemMetrics (nIndex=46) returned 2 [0035.222] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.222] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.222] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.222] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.226] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.226] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.226] GetLastError () returned 0x578 [0035.226] CanUserWritePwrScheme () returned 1 [0035.226] GetSystemMetrics (nIndex=46) returned 2 [0035.226] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.227] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.227] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.227] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.231] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.231] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.231] GetLastError () returned 0x578 [0035.231] CanUserWritePwrScheme () returned 1 [0035.231] GetSystemMetrics (nIndex=46) returned 2 [0035.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.231] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.231] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.231] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.235] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.235] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.235] GetLastError () returned 0x578 [0035.235] CanUserWritePwrScheme () returned 1 [0035.236] GetSystemMetrics (nIndex=46) returned 2 [0035.236] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.236] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.236] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.236] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.240] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.240] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.240] GetLastError () returned 0x578 [0035.240] CanUserWritePwrScheme () returned 1 [0035.240] GetSystemMetrics (nIndex=46) returned 2 [0035.240] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.240] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.240] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.240] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.244] GetLastError () returned 0x578 [0035.245] CanUserWritePwrScheme () returned 1 [0035.245] GetSystemMetrics (nIndex=46) returned 2 [0035.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.250] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.250] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.250] GetLastError () returned 0x578 [0035.250] CanUserWritePwrScheme () returned 1 [0035.251] GetSystemMetrics (nIndex=46) returned 2 [0035.251] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.251] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.251] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.251] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.255] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.255] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.255] GetLastError () returned 0x578 [0035.255] CanUserWritePwrScheme () returned 1 [0035.255] GetSystemMetrics (nIndex=46) returned 2 [0035.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.255] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.255] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.259] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.259] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.259] GetLastError () returned 0x578 [0035.260] CanUserWritePwrScheme () returned 1 [0035.260] GetSystemMetrics (nIndex=46) returned 2 [0035.260] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.260] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.260] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.260] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.264] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.264] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.264] GetLastError () returned 0x578 [0035.264] CanUserWritePwrScheme () returned 1 [0035.265] GetSystemMetrics (nIndex=46) returned 2 [0035.265] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.265] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.265] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.265] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.269] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.269] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.269] GetLastError () returned 0x578 [0035.269] CanUserWritePwrScheme () returned 1 [0035.269] GetSystemMetrics (nIndex=46) returned 2 [0035.269] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.269] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.269] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.269] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.273] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.273] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.273] GetLastError () returned 0x578 [0035.273] CanUserWritePwrScheme () returned 1 [0035.274] GetSystemMetrics (nIndex=46) returned 2 [0035.274] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.274] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.274] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.274] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.279] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.279] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.279] GetLastError () returned 0x578 [0035.279] CanUserWritePwrScheme () returned 1 [0035.280] GetSystemMetrics (nIndex=46) returned 2 [0035.280] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.280] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.280] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.280] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.284] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.284] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.284] GetLastError () returned 0x578 [0035.284] CanUserWritePwrScheme () returned 1 [0035.285] GetSystemMetrics (nIndex=46) returned 2 [0035.285] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.285] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.285] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.285] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.289] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.289] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.289] GetLastError () returned 0x578 [0035.289] CanUserWritePwrScheme () returned 1 [0035.289] GetSystemMetrics (nIndex=46) returned 2 [0035.289] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.289] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.289] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.289] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.293] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.293] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.293] GetLastError () returned 0x578 [0035.294] CanUserWritePwrScheme () returned 1 [0035.294] GetSystemMetrics (nIndex=46) returned 2 [0035.294] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.294] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.294] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.294] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.298] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.298] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.298] GetLastError () returned 0x578 [0035.298] CanUserWritePwrScheme () returned 1 [0035.299] GetSystemMetrics (nIndex=46) returned 2 [0035.299] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.299] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.299] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.299] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.303] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.303] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.303] GetLastError () returned 0x578 [0035.303] CanUserWritePwrScheme () returned 1 [0035.303] GetSystemMetrics (nIndex=46) returned 2 [0035.303] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.303] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.303] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.303] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.307] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.307] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.307] GetLastError () returned 0x578 [0035.307] CanUserWritePwrScheme () returned 1 [0035.308] GetSystemMetrics (nIndex=46) returned 2 [0035.308] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.308] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.308] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.308] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.312] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.312] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.312] GetLastError () returned 0x578 [0035.312] CanUserWritePwrScheme () returned 1 [0035.312] GetSystemMetrics (nIndex=46) returned 2 [0035.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.317] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.317] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.317] GetLastError () returned 0x578 [0035.317] CanUserWritePwrScheme () returned 1 [0035.317] GetSystemMetrics (nIndex=46) returned 2 [0035.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.322] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.322] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.322] GetLastError () returned 0x578 [0035.322] CanUserWritePwrScheme () returned 1 [0035.322] GetSystemMetrics (nIndex=46) returned 2 [0035.322] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.322] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.322] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.322] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.327] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.327] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.327] GetLastError () returned 0x578 [0035.327] CanUserWritePwrScheme () returned 1 [0035.327] GetSystemMetrics (nIndex=46) returned 2 [0035.327] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.327] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.327] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.327] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.332] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.332] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.332] GetLastError () returned 0x578 [0035.332] CanUserWritePwrScheme () returned 1 [0035.332] GetSystemMetrics (nIndex=46) returned 2 [0035.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.336] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.336] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.336] GetLastError () returned 0x578 [0035.336] CanUserWritePwrScheme () returned 1 [0035.337] GetSystemMetrics (nIndex=46) returned 2 [0035.337] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.337] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.337] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.337] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.341] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.341] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.341] GetLastError () returned 0x578 [0035.341] CanUserWritePwrScheme () returned 1 [0035.341] GetSystemMetrics (nIndex=46) returned 2 [0035.341] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.341] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.341] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.341] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.346] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.346] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.346] GetLastError () returned 0x578 [0035.346] CanUserWritePwrScheme () returned 1 [0035.346] GetSystemMetrics (nIndex=46) returned 2 [0035.346] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.346] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.346] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.346] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.350] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.350] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.350] GetLastError () returned 0x578 [0035.351] CanUserWritePwrScheme () returned 1 [0035.351] GetSystemMetrics (nIndex=46) returned 2 [0035.351] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.351] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.351] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.351] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.355] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.355] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.355] GetLastError () returned 0x578 [0035.355] CanUserWritePwrScheme () returned 1 [0035.356] GetSystemMetrics (nIndex=46) returned 2 [0035.356] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.356] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.356] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.356] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.360] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.360] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.360] GetLastError () returned 0x578 [0035.360] CanUserWritePwrScheme () returned 1 [0035.361] GetSystemMetrics (nIndex=46) returned 2 [0035.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.361] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.361] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.361] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.365] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.365] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.365] GetLastError () returned 0x578 [0035.365] CanUserWritePwrScheme () returned 1 [0035.365] GetSystemMetrics (nIndex=46) returned 2 [0035.365] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.365] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.365] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.365] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.369] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.369] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.370] GetLastError () returned 0x578 [0035.370] CanUserWritePwrScheme () returned 1 [0035.370] GetSystemMetrics (nIndex=46) returned 2 [0035.370] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.370] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.370] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.370] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.374] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.374] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.374] GetLastError () returned 0x578 [0035.375] CanUserWritePwrScheme () returned 1 [0035.375] GetSystemMetrics (nIndex=46) returned 2 [0035.375] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.375] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.375] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.375] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.379] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.379] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.379] GetLastError () returned 0x578 [0035.379] CanUserWritePwrScheme () returned 1 [0035.380] GetSystemMetrics (nIndex=46) returned 2 [0035.380] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.380] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.380] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.380] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.384] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.384] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.384] GetLastError () returned 0x578 [0035.384] CanUserWritePwrScheme () returned 1 [0035.385] GetSystemMetrics (nIndex=46) returned 2 [0035.385] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.385] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.385] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.385] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.389] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.389] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.389] GetLastError () returned 0x578 [0035.389] CanUserWritePwrScheme () returned 1 [0035.389] GetSystemMetrics (nIndex=46) returned 2 [0035.389] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.389] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.390] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.390] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.394] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.394] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.394] GetLastError () returned 0x578 [0035.394] CanUserWritePwrScheme () returned 1 [0035.394] GetSystemMetrics (nIndex=46) returned 2 [0035.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.394] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.394] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.394] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.399] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.399] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.399] GetLastError () returned 0x578 [0035.399] CanUserWritePwrScheme () returned 1 [0035.399] GetSystemMetrics (nIndex=46) returned 2 [0035.399] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.399] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.399] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.399] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.404] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.404] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.404] GetLastError () returned 0x578 [0035.404] CanUserWritePwrScheme () returned 1 [0035.404] GetSystemMetrics (nIndex=46) returned 2 [0035.404] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.404] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.404] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.404] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.409] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.409] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.409] GetLastError () returned 0x578 [0035.409] CanUserWritePwrScheme () returned 1 [0035.409] GetSystemMetrics (nIndex=46) returned 2 [0035.409] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.409] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.409] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.409] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.413] GetLastError () returned 0x578 [0035.414] CanUserWritePwrScheme () returned 1 [0035.414] GetSystemMetrics (nIndex=46) returned 2 [0035.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.414] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.414] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.414] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.418] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.418] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.418] GetLastError () returned 0x578 [0035.418] CanUserWritePwrScheme () returned 1 [0035.418] GetSystemMetrics (nIndex=46) returned 2 [0035.418] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.418] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.418] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.418] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.428] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.428] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.428] GetLastError () returned 0x578 [0035.428] CanUserWritePwrScheme () returned 1 [0035.428] GetSystemMetrics (nIndex=46) returned 2 [0035.428] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.428] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.428] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.428] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.432] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.433] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.433] GetLastError () returned 0x578 [0035.433] CanUserWritePwrScheme () returned 1 [0035.433] GetSystemMetrics (nIndex=46) returned 2 [0035.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.433] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.433] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.433] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.437] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.437] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.437] GetLastError () returned 0x578 [0035.437] CanUserWritePwrScheme () returned 1 [0035.438] GetSystemMetrics (nIndex=46) returned 2 [0035.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.438] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.442] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.442] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.442] GetLastError () returned 0x578 [0035.442] CanUserWritePwrScheme () returned 1 [0035.442] GetSystemMetrics (nIndex=46) returned 2 [0035.442] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.442] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.442] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.442] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.447] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.447] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.447] GetLastError () returned 0x578 [0035.447] CanUserWritePwrScheme () returned 1 [0035.447] GetSystemMetrics (nIndex=46) returned 2 [0035.447] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.447] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.447] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.447] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.451] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.451] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.451] GetLastError () returned 0x578 [0035.451] CanUserWritePwrScheme () returned 1 [0035.452] GetSystemMetrics (nIndex=46) returned 2 [0035.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.452] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.452] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.452] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.456] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.456] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.456] GetLastError () returned 0x578 [0035.456] CanUserWritePwrScheme () returned 1 [0035.456] GetSystemMetrics (nIndex=46) returned 2 [0035.456] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.456] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.456] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.456] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.461] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.461] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.461] GetLastError () returned 0x578 [0035.461] CanUserWritePwrScheme () returned 1 [0035.461] GetSystemMetrics (nIndex=46) returned 2 [0035.461] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.461] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.461] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.461] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.465] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.465] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.465] GetLastError () returned 0x578 [0035.465] CanUserWritePwrScheme () returned 1 [0035.466] GetSystemMetrics (nIndex=46) returned 2 [0035.466] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.466] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.466] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.466] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.470] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.470] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.470] GetLastError () returned 0x578 [0035.470] CanUserWritePwrScheme () returned 1 [0035.470] GetSystemMetrics (nIndex=46) returned 2 [0035.470] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.470] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.470] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.474] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.474] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.475] GetLastError () returned 0x578 [0035.475] CanUserWritePwrScheme () returned 1 [0035.475] GetSystemMetrics (nIndex=46) returned 2 [0035.475] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.475] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.475] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.475] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.479] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.479] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.479] GetLastError () returned 0x578 [0035.479] CanUserWritePwrScheme () returned 1 [0035.479] GetSystemMetrics (nIndex=46) returned 2 [0035.479] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.479] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.479] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.479] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.484] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.484] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.484] GetLastError () returned 0x578 [0035.484] CanUserWritePwrScheme () returned 1 [0035.484] GetSystemMetrics (nIndex=46) returned 2 [0035.484] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.484] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.484] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.484] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.488] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.488] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.488] GetLastError () returned 0x578 [0035.488] CanUserWritePwrScheme () returned 1 [0035.489] GetSystemMetrics (nIndex=46) returned 2 [0035.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.489] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.489] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.489] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.493] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.493] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.493] GetLastError () returned 0x578 [0035.493] CanUserWritePwrScheme () returned 1 [0035.493] GetSystemMetrics (nIndex=46) returned 2 [0035.493] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.493] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.493] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.493] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.497] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.497] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.497] GetLastError () returned 0x578 [0035.497] CanUserWritePwrScheme () returned 1 [0035.498] GetSystemMetrics (nIndex=46) returned 2 [0035.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.498] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.498] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.498] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.502] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.502] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.502] GetLastError () returned 0x578 [0035.502] CanUserWritePwrScheme () returned 1 [0035.502] GetSystemMetrics (nIndex=46) returned 2 [0035.502] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.502] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.502] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.502] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.506] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.506] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.506] GetLastError () returned 0x578 [0035.507] CanUserWritePwrScheme () returned 1 [0035.507] GetSystemMetrics (nIndex=46) returned 2 [0035.507] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.507] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.507] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.507] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.511] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.511] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.511] GetLastError () returned 0x578 [0035.511] CanUserWritePwrScheme () returned 1 [0035.511] GetSystemMetrics (nIndex=46) returned 2 [0035.511] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.511] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.511] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.511] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.515] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.515] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.516] GetLastError () returned 0x578 [0035.516] CanUserWritePwrScheme () returned 1 [0035.516] GetSystemMetrics (nIndex=46) returned 2 [0035.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.520] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.520] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.520] GetLastError () returned 0x578 [0035.520] CanUserWritePwrScheme () returned 1 [0035.520] GetSystemMetrics (nIndex=46) returned 2 [0035.520] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.520] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.520] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.520] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.524] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.524] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.525] GetLastError () returned 0x578 [0035.525] CanUserWritePwrScheme () returned 1 [0035.525] GetSystemMetrics (nIndex=46) returned 2 [0035.525] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.525] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.525] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.525] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.529] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.529] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.529] GetLastError () returned 0x578 [0035.529] CanUserWritePwrScheme () returned 1 [0035.530] GetSystemMetrics (nIndex=46) returned 2 [0035.530] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.530] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.530] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.530] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.534] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.534] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.534] GetLastError () returned 0x578 [0035.534] CanUserWritePwrScheme () returned 1 [0035.534] GetSystemMetrics (nIndex=46) returned 2 [0035.534] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.534] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.534] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.534] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.538] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.538] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.538] GetLastError () returned 0x578 [0035.538] CanUserWritePwrScheme () returned 1 [0035.539] GetSystemMetrics (nIndex=46) returned 2 [0035.539] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.539] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.539] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.539] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.543] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.543] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.543] GetLastError () returned 0x578 [0035.543] CanUserWritePwrScheme () returned 1 [0035.543] GetSystemMetrics (nIndex=46) returned 2 [0035.543] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.543] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.543] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.543] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.547] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.547] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.547] GetLastError () returned 0x578 [0035.548] CanUserWritePwrScheme () returned 1 [0035.548] GetSystemMetrics (nIndex=46) returned 2 [0035.548] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.548] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.548] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.548] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.552] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.552] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.552] GetLastError () returned 0x578 [0035.552] CanUserWritePwrScheme () returned 1 [0035.552] GetSystemMetrics (nIndex=46) returned 2 [0035.552] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.552] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.552] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.552] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.556] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.556] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.556] GetLastError () returned 0x578 [0035.557] CanUserWritePwrScheme () returned 1 [0035.557] GetSystemMetrics (nIndex=46) returned 2 [0035.557] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.557] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.557] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.557] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.562] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.562] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.562] GetLastError () returned 0x578 [0035.562] CanUserWritePwrScheme () returned 1 [0035.562] GetSystemMetrics (nIndex=46) returned 2 [0035.562] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.562] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.562] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.562] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.566] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.566] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.566] GetLastError () returned 0x578 [0035.566] CanUserWritePwrScheme () returned 1 [0035.567] GetSystemMetrics (nIndex=46) returned 2 [0035.567] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.567] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.567] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.567] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.571] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.571] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.571] GetLastError () returned 0x578 [0035.571] CanUserWritePwrScheme () returned 1 [0035.571] GetSystemMetrics (nIndex=46) returned 2 [0035.571] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.571] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.571] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.571] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.575] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.575] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.575] GetLastError () returned 0x578 [0035.575] CanUserWritePwrScheme () returned 1 [0035.576] GetSystemMetrics (nIndex=46) returned 2 [0035.576] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.576] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.576] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.576] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.580] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.580] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.580] GetLastError () returned 0x578 [0035.580] CanUserWritePwrScheme () returned 1 [0035.580] GetSystemMetrics (nIndex=46) returned 2 [0035.580] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.580] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.580] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.580] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.584] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.584] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.584] GetLastError () returned 0x578 [0035.584] CanUserWritePwrScheme () returned 1 [0035.585] GetSystemMetrics (nIndex=46) returned 2 [0035.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.585] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.585] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.585] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.589] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.589] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.589] GetLastError () returned 0x578 [0035.589] CanUserWritePwrScheme () returned 1 [0035.589] GetSystemMetrics (nIndex=46) returned 2 [0035.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.594] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.594] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.594] GetLastError () returned 0x578 [0035.594] CanUserWritePwrScheme () returned 1 [0035.594] GetSystemMetrics (nIndex=46) returned 2 [0035.594] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.594] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.594] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.594] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.598] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.598] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.598] GetLastError () returned 0x578 [0035.598] CanUserWritePwrScheme () returned 1 [0035.599] GetSystemMetrics (nIndex=46) returned 2 [0035.599] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.599] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.599] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.599] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.603] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.603] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.603] GetLastError () returned 0x578 [0035.603] CanUserWritePwrScheme () returned 1 [0035.603] GetSystemMetrics (nIndex=46) returned 2 [0035.603] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.603] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.603] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.603] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.608] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.608] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.608] GetLastError () returned 0x578 [0035.608] CanUserWritePwrScheme () returned 1 [0035.608] GetSystemMetrics (nIndex=46) returned 2 [0035.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.608] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.608] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.608] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.612] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.612] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.612] GetLastError () returned 0x578 [0035.612] CanUserWritePwrScheme () returned 1 [0035.613] GetSystemMetrics (nIndex=46) returned 2 [0035.613] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.613] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.613] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.613] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.617] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.617] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.617] GetLastError () returned 0x578 [0035.617] CanUserWritePwrScheme () returned 1 [0035.617] GetSystemMetrics (nIndex=46) returned 2 [0035.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.617] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.617] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.617] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.621] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.621] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.621] GetLastError () returned 0x578 [0035.621] CanUserWritePwrScheme () returned 1 [0035.622] GetSystemMetrics (nIndex=46) returned 2 [0035.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.622] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.622] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.622] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.626] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.626] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.626] GetLastError () returned 0x578 [0035.626] CanUserWritePwrScheme () returned 1 [0035.627] GetSystemMetrics (nIndex=46) returned 2 [0035.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.627] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.627] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.627] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.631] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.631] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.631] GetLastError () returned 0x578 [0035.631] CanUserWritePwrScheme () returned 1 [0035.631] GetSystemMetrics (nIndex=46) returned 2 [0035.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.632] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.636] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.636] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.637] GetLastError () returned 0x578 [0035.637] CanUserWritePwrScheme () returned 1 [0035.637] GetSystemMetrics (nIndex=46) returned 2 [0035.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.637] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.637] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.637] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.641] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.641] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.641] GetLastError () returned 0x578 [0035.641] CanUserWritePwrScheme () returned 1 [0035.642] GetSystemMetrics (nIndex=46) returned 2 [0035.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.642] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.642] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.642] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.646] GetLastError () returned 0x578 [0035.646] CanUserWritePwrScheme () returned 1 [0035.646] GetSystemMetrics (nIndex=46) returned 2 [0035.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.650] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.650] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.650] GetLastError () returned 0x578 [0035.650] CanUserWritePwrScheme () returned 1 [0035.651] GetSystemMetrics (nIndex=46) returned 2 [0035.651] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.651] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.651] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.651] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.655] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.655] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.655] GetLastError () returned 0x578 [0035.655] CanUserWritePwrScheme () returned 1 [0035.655] GetSystemMetrics (nIndex=46) returned 2 [0035.655] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.655] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.656] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.656] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.660] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.660] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.660] GetLastError () returned 0x578 [0035.660] CanUserWritePwrScheme () returned 1 [0035.660] GetSystemMetrics (nIndex=46) returned 2 [0035.660] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.660] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.660] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.660] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.664] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.665] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.665] GetLastError () returned 0x578 [0035.665] CanUserWritePwrScheme () returned 1 [0035.665] GetSystemMetrics (nIndex=46) returned 2 [0035.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.665] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.665] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.665] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.669] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.669] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.669] GetLastError () returned 0x578 [0035.669] CanUserWritePwrScheme () returned 1 [0035.669] GetSystemMetrics (nIndex=46) returned 2 [0035.669] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.670] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.670] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.670] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.674] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.674] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.674] GetLastError () returned 0x578 [0035.674] CanUserWritePwrScheme () returned 1 [0035.674] GetSystemMetrics (nIndex=46) returned 2 [0035.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.674] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.674] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.674] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.678] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.678] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.678] GetLastError () returned 0x578 [0035.679] CanUserWritePwrScheme () returned 1 [0035.679] GetSystemMetrics (nIndex=46) returned 2 [0035.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.679] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.683] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.683] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.683] GetLastError () returned 0x578 [0035.683] CanUserWritePwrScheme () returned 1 [0035.683] GetSystemMetrics (nIndex=46) returned 2 [0035.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.683] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.683] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.688] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.688] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.688] GetLastError () returned 0x578 [0035.688] CanUserWritePwrScheme () returned 1 [0035.688] GetSystemMetrics (nIndex=46) returned 2 [0035.688] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.688] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.688] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.688] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.692] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.692] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.692] GetLastError () returned 0x578 [0035.692] CanUserWritePwrScheme () returned 1 [0035.693] GetSystemMetrics (nIndex=46) returned 2 [0035.693] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.693] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.693] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.693] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.697] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.697] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.697] GetLastError () returned 0x578 [0035.697] CanUserWritePwrScheme () returned 1 [0035.697] GetSystemMetrics (nIndex=46) returned 2 [0035.697] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.697] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.697] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.697] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.701] GetLastError () returned 0x578 [0035.702] CanUserWritePwrScheme () returned 1 [0035.702] GetSystemMetrics (nIndex=46) returned 2 [0035.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.706] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.706] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.706] GetLastError () returned 0x578 [0035.706] CanUserWritePwrScheme () returned 1 [0035.707] GetSystemMetrics (nIndex=46) returned 2 [0035.707] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.707] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.707] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.707] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.711] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.711] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.711] GetLastError () returned 0x578 [0035.711] CanUserWritePwrScheme () returned 1 [0035.711] GetSystemMetrics (nIndex=46) returned 2 [0035.711] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.711] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.711] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.711] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.715] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.715] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.715] GetLastError () returned 0x578 [0035.715] CanUserWritePwrScheme () returned 1 [0035.716] GetSystemMetrics (nIndex=46) returned 2 [0035.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.716] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.716] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.716] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.720] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.720] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.720] GetLastError () returned 0x578 [0035.720] CanUserWritePwrScheme () returned 1 [0035.721] GetSystemMetrics (nIndex=46) returned 2 [0035.721] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.721] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.721] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.721] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.725] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.725] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.725] GetLastError () returned 0x578 [0035.725] CanUserWritePwrScheme () returned 1 [0035.725] GetSystemMetrics (nIndex=46) returned 2 [0035.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.725] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.725] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.725] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.730] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.730] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.730] GetLastError () returned 0x578 [0035.730] CanUserWritePwrScheme () returned 1 [0035.730] GetSystemMetrics (nIndex=46) returned 2 [0035.730] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.730] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.730] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.730] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.734] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.734] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.735] GetLastError () returned 0x578 [0035.735] CanUserWritePwrScheme () returned 1 [0035.735] GetSystemMetrics (nIndex=46) returned 2 [0035.735] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.735] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.735] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.735] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.739] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.739] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.739] GetLastError () returned 0x578 [0035.739] CanUserWritePwrScheme () returned 1 [0035.740] GetSystemMetrics (nIndex=46) returned 2 [0035.740] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.740] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.740] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.740] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.744] GetLastError () returned 0x578 [0035.744] CanUserWritePwrScheme () returned 1 [0035.744] GetSystemMetrics (nIndex=46) returned 2 [0035.744] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.744] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.744] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.744] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.752] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.752] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.752] GetLastError () returned 0x578 [0035.752] CanUserWritePwrScheme () returned 1 [0035.752] GetSystemMetrics (nIndex=46) returned 2 [0035.752] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.752] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.752] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.752] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.756] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.756] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.757] GetLastError () returned 0x578 [0035.757] CanUserWritePwrScheme () returned 1 [0035.757] GetSystemMetrics (nIndex=46) returned 2 [0035.757] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.757] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.757] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.757] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.761] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.761] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.761] GetLastError () returned 0x578 [0035.761] CanUserWritePwrScheme () returned 1 [0035.762] GetSystemMetrics (nIndex=46) returned 2 [0035.762] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.762] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.762] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.762] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.766] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.766] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.766] GetLastError () returned 0x578 [0035.766] CanUserWritePwrScheme () returned 1 [0035.766] GetSystemMetrics (nIndex=46) returned 2 [0035.766] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.767] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.767] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.767] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.771] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.771] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.771] GetLastError () returned 0x578 [0035.771] CanUserWritePwrScheme () returned 1 [0035.771] GetSystemMetrics (nIndex=46) returned 2 [0035.771] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.771] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.771] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.771] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.775] GetLastError () returned 0x578 [0035.775] CanUserWritePwrScheme () returned 1 [0035.776] GetSystemMetrics (nIndex=46) returned 2 [0035.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.776] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.776] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.776] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.780] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.780] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.780] GetLastError () returned 0x578 [0035.780] CanUserWritePwrScheme () returned 1 [0035.780] GetSystemMetrics (nIndex=46) returned 2 [0035.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.784] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.784] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.785] GetLastError () returned 0x578 [0035.785] CanUserWritePwrScheme () returned 1 [0035.785] GetSystemMetrics (nIndex=46) returned 2 [0035.785] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.785] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.785] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.785] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.789] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.789] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.789] GetLastError () returned 0x578 [0035.789] CanUserWritePwrScheme () returned 1 [0035.790] GetSystemMetrics (nIndex=46) returned 2 [0035.790] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.790] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.790] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.790] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.794] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.794] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.794] GetLastError () returned 0x578 [0035.794] CanUserWritePwrScheme () returned 1 [0035.796] GetSystemMetrics (nIndex=46) returned 2 [0035.796] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.796] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.796] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.796] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.800] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.800] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.800] GetLastError () returned 0x578 [0035.800] CanUserWritePwrScheme () returned 1 [0035.800] GetSystemMetrics (nIndex=46) returned 2 [0035.800] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.800] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.800] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.800] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.804] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.804] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.804] GetLastError () returned 0x578 [0035.804] CanUserWritePwrScheme () returned 1 [0035.805] GetSystemMetrics (nIndex=46) returned 2 [0035.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.809] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.809] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.809] GetLastError () returned 0x578 [0035.809] CanUserWritePwrScheme () returned 1 [0035.809] GetSystemMetrics (nIndex=46) returned 2 [0035.809] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.809] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.809] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.809] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.814] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.814] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.814] GetLastError () returned 0x578 [0035.814] CanUserWritePwrScheme () returned 1 [0035.814] GetSystemMetrics (nIndex=46) returned 2 [0035.814] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.814] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.814] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.814] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.818] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.818] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.818] GetLastError () returned 0x578 [0035.818] CanUserWritePwrScheme () returned 1 [0035.819] GetSystemMetrics (nIndex=46) returned 2 [0035.819] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.819] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.819] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.819] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.823] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.823] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.823] GetLastError () returned 0x578 [0035.823] CanUserWritePwrScheme () returned 1 [0035.823] GetSystemMetrics (nIndex=46) returned 2 [0035.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.827] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.827] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.827] GetLastError () returned 0x578 [0035.827] CanUserWritePwrScheme () returned 1 [0035.828] GetSystemMetrics (nIndex=46) returned 2 [0035.828] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.828] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.828] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.828] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.832] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.832] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.832] GetLastError () returned 0x578 [0035.832] CanUserWritePwrScheme () returned 1 [0035.832] GetSystemMetrics (nIndex=46) returned 2 [0035.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.832] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.832] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.832] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.836] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.836] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.836] GetLastError () returned 0x578 [0035.837] CanUserWritePwrScheme () returned 1 [0035.837] GetSystemMetrics (nIndex=46) returned 2 [0035.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.837] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.837] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.837] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.841] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.841] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.841] GetLastError () returned 0x578 [0035.841] CanUserWritePwrScheme () returned 1 [0035.842] GetSystemMetrics (nIndex=46) returned 2 [0035.842] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.842] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.842] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.842] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.846] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.846] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.846] GetLastError () returned 0x578 [0035.846] CanUserWritePwrScheme () returned 1 [0035.846] GetSystemMetrics (nIndex=46) returned 2 [0035.846] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.846] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.846] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.846] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.851] GetLastError () returned 0x578 [0035.851] CanUserWritePwrScheme () returned 1 [0035.851] GetSystemMetrics (nIndex=46) returned 2 [0035.851] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.851] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.851] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.851] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.855] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.855] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.855] GetLastError () returned 0x578 [0035.855] CanUserWritePwrScheme () returned 1 [0035.856] GetSystemMetrics (nIndex=46) returned 2 [0035.856] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.856] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.856] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.860] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.860] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.860] GetLastError () returned 0x578 [0035.860] CanUserWritePwrScheme () returned 1 [0035.861] GetSystemMetrics (nIndex=46) returned 2 [0035.861] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.865] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.865] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.865] GetLastError () returned 0x578 [0035.865] CanUserWritePwrScheme () returned 1 [0035.865] GetSystemMetrics (nIndex=46) returned 2 [0035.865] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.865] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.865] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.865] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.869] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.869] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.869] GetLastError () returned 0x578 [0035.869] CanUserWritePwrScheme () returned 1 [0035.870] GetSystemMetrics (nIndex=46) returned 2 [0035.870] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.870] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.870] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.870] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.874] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.874] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.874] GetLastError () returned 0x578 [0035.874] CanUserWritePwrScheme () returned 1 [0035.875] GetSystemMetrics (nIndex=46) returned 2 [0035.875] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.875] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.875] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.875] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.879] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.879] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.879] GetLastError () returned 0x578 [0035.879] CanUserWritePwrScheme () returned 1 [0035.879] GetSystemMetrics (nIndex=46) returned 2 [0035.879] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.879] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.879] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.879] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.883] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.883] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.883] GetLastError () returned 0x578 [0035.883] CanUserWritePwrScheme () returned 1 [0035.884] GetSystemMetrics (nIndex=46) returned 2 [0035.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.884] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.884] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.884] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.888] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.888] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.888] GetLastError () returned 0x578 [0035.888] CanUserWritePwrScheme () returned 1 [0035.888] GetSystemMetrics (nIndex=46) returned 2 [0035.888] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.888] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.888] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.889] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.893] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.893] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.893] GetLastError () returned 0x578 [0035.893] CanUserWritePwrScheme () returned 1 [0035.893] GetSystemMetrics (nIndex=46) returned 2 [0035.893] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.893] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.893] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.893] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.897] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.897] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.897] GetLastError () returned 0x578 [0035.897] CanUserWritePwrScheme () returned 1 [0035.898] GetSystemMetrics (nIndex=46) returned 2 [0035.898] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.898] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.898] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.898] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.902] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.902] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.902] GetLastError () returned 0x578 [0035.902] CanUserWritePwrScheme () returned 1 [0035.903] GetSystemMetrics (nIndex=46) returned 2 [0035.903] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.903] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.903] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.903] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.907] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.907] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.907] GetLastError () returned 0x578 [0035.907] CanUserWritePwrScheme () returned 1 [0035.907] GetSystemMetrics (nIndex=46) returned 2 [0035.907] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.907] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.907] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.908] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.912] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.912] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.912] GetLastError () returned 0x578 [0035.912] CanUserWritePwrScheme () returned 1 [0035.912] GetSystemMetrics (nIndex=46) returned 2 [0035.912] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.912] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.912] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.912] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.916] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.916] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.916] GetLastError () returned 0x578 [0035.916] CanUserWritePwrScheme () returned 1 [0035.917] GetSystemMetrics (nIndex=46) returned 2 [0035.917] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.917] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.917] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.917] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.922] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.922] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.922] GetLastError () returned 0x578 [0035.922] CanUserWritePwrScheme () returned 1 [0035.922] GetSystemMetrics (nIndex=46) returned 2 [0035.922] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.922] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.922] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.922] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.926] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.926] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.926] GetLastError () returned 0x578 [0035.926] CanUserWritePwrScheme () returned 1 [0035.927] GetSystemMetrics (nIndex=46) returned 2 [0035.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.927] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.927] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.927] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.931] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.931] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.931] GetLastError () returned 0x578 [0035.931] CanUserWritePwrScheme () returned 1 [0035.931] GetSystemMetrics (nIndex=46) returned 2 [0035.931] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.931] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.931] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.931] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.936] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.936] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.936] GetLastError () returned 0x578 [0035.936] CanUserWritePwrScheme () returned 1 [0035.936] GetSystemMetrics (nIndex=46) returned 2 [0035.936] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.936] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.936] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.936] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.940] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.940] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.940] GetLastError () returned 0x578 [0035.940] CanUserWritePwrScheme () returned 1 [0035.941] GetSystemMetrics (nIndex=46) returned 2 [0035.941] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.941] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.941] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.941] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.945] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.945] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.945] GetLastError () returned 0x578 [0035.945] CanUserWritePwrScheme () returned 1 [0035.945] GetSystemMetrics (nIndex=46) returned 2 [0035.945] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.945] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.945] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.945] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.949] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.949] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.949] GetLastError () returned 0x578 [0035.950] CanUserWritePwrScheme () returned 1 [0035.950] GetSystemMetrics (nIndex=46) returned 2 [0035.950] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.950] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.950] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.950] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.954] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.954] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.954] GetLastError () returned 0x578 [0035.954] CanUserWritePwrScheme () returned 1 [0035.954] GetSystemMetrics (nIndex=46) returned 2 [0035.954] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.954] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.954] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.955] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.958] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.958] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.959] GetLastError () returned 0x578 [0035.959] CanUserWritePwrScheme () returned 1 [0035.959] GetSystemMetrics (nIndex=46) returned 2 [0035.959] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.959] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.959] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.959] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.963] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.963] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.963] GetLastError () returned 0x578 [0035.963] CanUserWritePwrScheme () returned 1 [0035.964] GetSystemMetrics (nIndex=46) returned 2 [0035.964] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.964] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.964] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.964] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.976] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.976] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.976] GetLastError () returned 0x578 [0035.976] CanUserWritePwrScheme () returned 1 [0035.976] GetSystemMetrics (nIndex=46) returned 2 [0035.976] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.976] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.976] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.976] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.980] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.980] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.980] GetLastError () returned 0x578 [0035.980] CanUserWritePwrScheme () returned 1 [0035.981] GetSystemMetrics (nIndex=46) returned 2 [0035.981] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.981] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.981] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.981] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.985] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.985] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.985] GetLastError () returned 0x578 [0035.985] CanUserWritePwrScheme () returned 1 [0035.985] GetSystemMetrics (nIndex=46) returned 2 [0035.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.986] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.990] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.990] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.990] GetLastError () returned 0x578 [0035.990] CanUserWritePwrScheme () returned 1 [0035.990] GetSystemMetrics (nIndex=46) returned 2 [0035.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.990] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.990] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.990] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.994] GetLastError () returned 0x578 [0035.994] CanUserWritePwrScheme () returned 1 [0035.995] GetSystemMetrics (nIndex=46) returned 2 [0035.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0035.999] GetWindowTextLengthA (hWnd=0x0) returned 0 [0035.999] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0035.999] GetLastError () returned 0x578 [0035.999] CanUserWritePwrScheme () returned 1 [0035.999] GetSystemMetrics (nIndex=46) returned 2 [0035.999] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0035.999] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0035.999] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0035.999] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.005] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.005] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.005] GetLastError () returned 0x578 [0036.005] CanUserWritePwrScheme () returned 1 [0036.005] GetSystemMetrics (nIndex=46) returned 2 [0036.005] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.005] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.005] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.005] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.009] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.009] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.009] GetLastError () returned 0x578 [0036.009] CanUserWritePwrScheme () returned 1 [0036.010] GetSystemMetrics (nIndex=46) returned 2 [0036.010] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.010] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.010] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.010] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.014] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.014] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.014] GetLastError () returned 0x578 [0036.014] CanUserWritePwrScheme () returned 1 [0036.014] GetSystemMetrics (nIndex=46) returned 2 [0036.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.019] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.019] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.019] GetLastError () returned 0x578 [0036.019] CanUserWritePwrScheme () returned 1 [0036.019] GetSystemMetrics (nIndex=46) returned 2 [0036.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.020] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.024] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.024] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.024] GetLastError () returned 0x578 [0036.024] CanUserWritePwrScheme () returned 1 [0036.024] GetSystemMetrics (nIndex=46) returned 2 [0036.024] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.024] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.024] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.024] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.029] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.029] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.029] GetLastError () returned 0x578 [0036.029] CanUserWritePwrScheme () returned 1 [0036.030] GetSystemMetrics (nIndex=46) returned 2 [0036.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.030] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.030] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.030] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.034] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.034] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.034] GetLastError () returned 0x578 [0036.034] CanUserWritePwrScheme () returned 1 [0036.034] GetSystemMetrics (nIndex=46) returned 2 [0036.034] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.034] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.034] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.034] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.038] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.038] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.038] GetLastError () returned 0x578 [0036.038] CanUserWritePwrScheme () returned 1 [0036.039] GetSystemMetrics (nIndex=46) returned 2 [0036.039] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.039] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.039] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.039] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.043] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.043] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.043] GetLastError () returned 0x578 [0036.043] CanUserWritePwrScheme () returned 1 [0036.044] GetSystemMetrics (nIndex=46) returned 2 [0036.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.044] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.044] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.044] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.048] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.048] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.048] GetLastError () returned 0x578 [0036.048] CanUserWritePwrScheme () returned 1 [0036.048] GetSystemMetrics (nIndex=46) returned 2 [0036.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.048] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.048] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.048] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.052] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.052] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.052] GetLastError () returned 0x578 [0036.052] CanUserWritePwrScheme () returned 1 [0036.053] GetSystemMetrics (nIndex=46) returned 2 [0036.053] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.053] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.053] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.053] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.057] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.057] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.057] GetLastError () returned 0x578 [0036.057] CanUserWritePwrScheme () returned 1 [0036.057] GetSystemMetrics (nIndex=46) returned 2 [0036.057] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.057] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.057] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.057] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.062] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.062] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.062] GetLastError () returned 0x578 [0036.062] CanUserWritePwrScheme () returned 1 [0036.062] GetSystemMetrics (nIndex=46) returned 2 [0036.062] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.062] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.062] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.062] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.066] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.066] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.066] GetLastError () returned 0x578 [0036.067] CanUserWritePwrScheme () returned 1 [0036.067] GetSystemMetrics (nIndex=46) returned 2 [0036.067] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.067] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.067] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.067] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.071] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.071] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.071] GetLastError () returned 0x578 [0036.071] CanUserWritePwrScheme () returned 1 [0036.071] GetSystemMetrics (nIndex=46) returned 2 [0036.071] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.071] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.071] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.072] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.076] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.076] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.076] GetLastError () returned 0x578 [0036.076] CanUserWritePwrScheme () returned 1 [0036.076] GetSystemMetrics (nIndex=46) returned 2 [0036.076] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.076] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.076] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.076] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.080] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.080] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.080] GetLastError () returned 0x578 [0036.080] CanUserWritePwrScheme () returned 1 [0036.081] GetSystemMetrics (nIndex=46) returned 2 [0036.081] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.081] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.081] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.081] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.085] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.085] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.085] GetLastError () returned 0x578 [0036.085] CanUserWritePwrScheme () returned 1 [0036.085] GetSystemMetrics (nIndex=46) returned 2 [0036.085] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.085] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.085] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.085] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.089] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.089] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.089] GetLastError () returned 0x578 [0036.089] CanUserWritePwrScheme () returned 1 [0036.090] GetSystemMetrics (nIndex=46) returned 2 [0036.090] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.090] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.090] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.090] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.094] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.094] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.094] GetLastError () returned 0x578 [0036.094] CanUserWritePwrScheme () returned 1 [0036.095] GetSystemMetrics (nIndex=46) returned 2 [0036.095] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.095] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.095] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.095] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.099] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.099] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.099] GetLastError () returned 0x578 [0036.099] CanUserWritePwrScheme () returned 1 [0036.099] GetSystemMetrics (nIndex=46) returned 2 [0036.099] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.099] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.099] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.099] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.103] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.103] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.103] GetLastError () returned 0x578 [0036.103] CanUserWritePwrScheme () returned 1 [0036.104] GetSystemMetrics (nIndex=46) returned 2 [0036.104] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.104] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.104] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.104] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.109] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.109] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.109] GetLastError () returned 0x578 [0036.109] CanUserWritePwrScheme () returned 1 [0036.109] GetSystemMetrics (nIndex=46) returned 2 [0036.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.109] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.109] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.109] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.114] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.114] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.114] GetLastError () returned 0x578 [0036.114] CanUserWritePwrScheme () returned 1 [0036.114] GetSystemMetrics (nIndex=46) returned 2 [0036.114] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.114] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.114] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.114] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.118] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.118] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.118] GetLastError () returned 0x578 [0036.118] CanUserWritePwrScheme () returned 1 [0036.119] GetSystemMetrics (nIndex=46) returned 2 [0036.119] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.119] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.119] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.119] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.123] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.123] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.123] GetLastError () returned 0x578 [0036.123] CanUserWritePwrScheme () returned 1 [0036.123] GetSystemMetrics (nIndex=46) returned 2 [0036.123] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.123] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.123] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.123] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.127] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.128] GetLastError () returned 0x578 [0036.128] CanUserWritePwrScheme () returned 1 [0036.128] GetSystemMetrics (nIndex=46) returned 2 [0036.128] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.128] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.128] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.128] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.132] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.132] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.132] GetLastError () returned 0x578 [0036.132] CanUserWritePwrScheme () returned 1 [0036.132] GetSystemMetrics (nIndex=46) returned 2 [0036.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.133] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.133] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.133] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.137] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.137] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.137] GetLastError () returned 0x578 [0036.137] CanUserWritePwrScheme () returned 1 [0036.137] GetSystemMetrics (nIndex=46) returned 2 [0036.137] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.137] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.137] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.137] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.141] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.141] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.141] GetLastError () returned 0x578 [0036.141] CanUserWritePwrScheme () returned 1 [0036.142] GetSystemMetrics (nIndex=46) returned 2 [0036.142] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.142] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.142] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.142] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.146] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.146] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.146] GetLastError () returned 0x578 [0036.146] CanUserWritePwrScheme () returned 1 [0036.146] GetSystemMetrics (nIndex=46) returned 2 [0036.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.146] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.146] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.146] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.150] GetLastError () returned 0x578 [0036.150] CanUserWritePwrScheme () returned 1 [0036.151] GetSystemMetrics (nIndex=46) returned 2 [0036.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.151] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.151] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.151] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.155] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.155] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.155] GetLastError () returned 0x578 [0036.155] CanUserWritePwrScheme () returned 1 [0036.155] GetSystemMetrics (nIndex=46) returned 2 [0036.155] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.155] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.155] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.155] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.160] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.160] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.160] GetLastError () returned 0x578 [0036.160] CanUserWritePwrScheme () returned 1 [0036.160] GetSystemMetrics (nIndex=46) returned 2 [0036.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.160] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.160] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.160] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.164] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.164] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.164] GetLastError () returned 0x578 [0036.164] CanUserWritePwrScheme () returned 1 [0036.165] GetSystemMetrics (nIndex=46) returned 2 [0036.165] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.165] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.165] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.165] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.169] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.169] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.169] GetLastError () returned 0x578 [0036.169] CanUserWritePwrScheme () returned 1 [0036.169] GetSystemMetrics (nIndex=46) returned 2 [0036.169] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.169] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.169] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.169] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.173] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.173] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.173] GetLastError () returned 0x578 [0036.173] CanUserWritePwrScheme () returned 1 [0036.174] GetSystemMetrics (nIndex=46) returned 2 [0036.174] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.174] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.174] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.174] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.178] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.178] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.178] GetLastError () returned 0x578 [0036.178] CanUserWritePwrScheme () returned 1 [0036.178] GetSystemMetrics (nIndex=46) returned 2 [0036.178] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.178] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.178] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.178] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.182] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.182] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.182] GetLastError () returned 0x578 [0036.183] CanUserWritePwrScheme () returned 1 [0036.183] GetSystemMetrics (nIndex=46) returned 2 [0036.183] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.183] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.183] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.183] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.187] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.187] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.187] GetLastError () returned 0x578 [0036.187] CanUserWritePwrScheme () returned 1 [0036.188] GetSystemMetrics (nIndex=46) returned 2 [0036.188] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.188] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.188] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.188] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.192] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.192] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.192] GetLastError () returned 0x578 [0036.192] CanUserWritePwrScheme () returned 1 [0036.192] GetSystemMetrics (nIndex=46) returned 2 [0036.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.192] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.192] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.192] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.196] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.196] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.196] GetLastError () returned 0x578 [0036.196] CanUserWritePwrScheme () returned 1 [0036.197] GetSystemMetrics (nIndex=46) returned 2 [0036.197] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.197] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.197] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.197] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.201] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.201] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.201] GetLastError () returned 0x578 [0036.201] CanUserWritePwrScheme () returned 1 [0036.201] GetSystemMetrics (nIndex=46) returned 2 [0036.201] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.201] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.201] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.201] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.205] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.205] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.205] GetLastError () returned 0x578 [0036.205] CanUserWritePwrScheme () returned 1 [0036.206] GetSystemMetrics (nIndex=46) returned 2 [0036.206] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.206] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.206] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.206] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.210] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.210] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.210] GetLastError () returned 0x578 [0036.210] CanUserWritePwrScheme () returned 1 [0036.210] GetSystemMetrics (nIndex=46) returned 2 [0036.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.210] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.210] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.210] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.214] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.214] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.214] GetLastError () returned 0x578 [0036.214] CanUserWritePwrScheme () returned 1 [0036.215] GetSystemMetrics (nIndex=46) returned 2 [0036.215] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.215] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.215] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.215] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.219] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.219] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.219] GetLastError () returned 0x578 [0036.219] CanUserWritePwrScheme () returned 1 [0036.220] GetSystemMetrics (nIndex=46) returned 2 [0036.220] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.220] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.220] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.220] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.224] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.224] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.224] GetLastError () returned 0x578 [0036.224] CanUserWritePwrScheme () returned 1 [0036.224] GetSystemMetrics (nIndex=46) returned 2 [0036.224] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.224] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.224] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.224] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.228] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.228] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.228] GetLastError () returned 0x578 [0036.228] CanUserWritePwrScheme () returned 1 [0036.229] GetSystemMetrics (nIndex=46) returned 2 [0036.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.229] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.229] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.229] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.233] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.233] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.233] GetLastError () returned 0x578 [0036.233] CanUserWritePwrScheme () returned 1 [0036.234] GetSystemMetrics (nIndex=46) returned 2 [0036.234] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.234] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.234] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.234] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.238] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.238] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.238] GetLastError () returned 0x578 [0036.238] CanUserWritePwrScheme () returned 1 [0036.238] GetSystemMetrics (nIndex=46) returned 2 [0036.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.238] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.238] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.238] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.242] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.242] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.242] GetLastError () returned 0x578 [0036.242] CanUserWritePwrScheme () returned 1 [0036.243] GetSystemMetrics (nIndex=46) returned 2 [0036.243] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.243] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.243] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.243] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.247] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.247] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.247] GetLastError () returned 0x578 [0036.247] CanUserWritePwrScheme () returned 1 [0036.248] GetSystemMetrics (nIndex=46) returned 2 [0036.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.248] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.248] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.248] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.252] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.252] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.252] GetLastError () returned 0x578 [0036.252] CanUserWritePwrScheme () returned 1 [0036.252] GetSystemMetrics (nIndex=46) returned 2 [0036.252] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.252] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.252] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.252] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.257] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.257] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.257] GetLastError () returned 0x578 [0036.257] CanUserWritePwrScheme () returned 1 [0036.257] GetSystemMetrics (nIndex=46) returned 2 [0036.257] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.257] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.257] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.262] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.262] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.262] GetLastError () returned 0x578 [0036.262] CanUserWritePwrScheme () returned 1 [0036.262] GetSystemMetrics (nIndex=46) returned 2 [0036.262] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.262] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.262] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.262] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.266] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.266] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.266] GetLastError () returned 0x578 [0036.266] CanUserWritePwrScheme () returned 1 [0036.267] GetSystemMetrics (nIndex=46) returned 2 [0036.267] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.267] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.267] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.267] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.271] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.271] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.271] GetLastError () returned 0x578 [0036.271] CanUserWritePwrScheme () returned 1 [0036.271] GetSystemMetrics (nIndex=46) returned 2 [0036.271] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.271] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.271] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.272] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.276] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.276] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.276] GetLastError () returned 0x578 [0036.276] CanUserWritePwrScheme () returned 1 [0036.276] GetSystemMetrics (nIndex=46) returned 2 [0036.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.276] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.277] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.277] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.281] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.281] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.281] GetLastError () returned 0x578 [0036.281] CanUserWritePwrScheme () returned 1 [0036.281] GetSystemMetrics (nIndex=46) returned 2 [0036.281] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.281] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.281] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.281] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.285] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.285] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.285] GetLastError () returned 0x578 [0036.285] CanUserWritePwrScheme () returned 1 [0036.286] GetSystemMetrics (nIndex=46) returned 2 [0036.286] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.286] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.286] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.286] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.290] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.290] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.290] GetLastError () returned 0x578 [0036.290] CanUserWritePwrScheme () returned 1 [0036.290] GetSystemMetrics (nIndex=46) returned 2 [0036.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.295] GetLastError () returned 0x578 [0036.295] CanUserWritePwrScheme () returned 1 [0036.295] GetSystemMetrics (nIndex=46) returned 2 [0036.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.299] GetLastError () returned 0x578 [0036.299] CanUserWritePwrScheme () returned 1 [0036.299] GetSystemMetrics (nIndex=46) returned 2 [0036.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.304] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.304] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.304] GetLastError () returned 0x578 [0036.304] CanUserWritePwrScheme () returned 1 [0036.304] GetSystemMetrics (nIndex=46) returned 2 [0036.304] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.304] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.304] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.304] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.308] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.308] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.308] GetLastError () returned 0x578 [0036.308] CanUserWritePwrScheme () returned 1 [0036.309] GetSystemMetrics (nIndex=46) returned 2 [0036.309] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.309] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.309] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.309] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.314] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.314] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.314] GetLastError () returned 0x578 [0036.314] CanUserWritePwrScheme () returned 1 [0036.314] GetSystemMetrics (nIndex=46) returned 2 [0036.314] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.314] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.314] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.314] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.318] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.318] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.318] GetLastError () returned 0x578 [0036.318] CanUserWritePwrScheme () returned 1 [0036.319] GetSystemMetrics (nIndex=46) returned 2 [0036.319] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.319] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.319] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.319] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.325] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.325] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.325] GetLastError () returned 0x578 [0036.325] CanUserWritePwrScheme () returned 1 [0036.325] GetSystemMetrics (nIndex=46) returned 2 [0036.325] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.325] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.325] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.325] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.329] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.329] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.329] GetLastError () returned 0x578 [0036.329] CanUserWritePwrScheme () returned 1 [0036.330] GetSystemMetrics (nIndex=46) returned 2 [0036.330] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.330] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.330] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.330] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.334] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.334] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.334] GetLastError () returned 0x578 [0036.334] CanUserWritePwrScheme () returned 1 [0036.334] GetSystemMetrics (nIndex=46) returned 2 [0036.334] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.334] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.334] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.334] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.338] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.338] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.338] GetLastError () returned 0x578 [0036.338] CanUserWritePwrScheme () returned 1 [0036.339] GetSystemMetrics (nIndex=46) returned 2 [0036.339] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.339] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.339] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.339] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.343] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.343] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.343] GetLastError () returned 0x578 [0036.343] CanUserWritePwrScheme () returned 1 [0036.344] GetSystemMetrics (nIndex=46) returned 2 [0036.344] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.344] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.344] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.344] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.348] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.348] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.348] GetLastError () returned 0x578 [0036.348] CanUserWritePwrScheme () returned 1 [0036.348] GetSystemMetrics (nIndex=46) returned 2 [0036.348] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.348] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.348] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.348] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.354] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.354] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.354] GetLastError () returned 0x578 [0036.354] CanUserWritePwrScheme () returned 1 [0036.355] GetSystemMetrics (nIndex=46) returned 2 [0036.355] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.355] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.355] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.355] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.361] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.361] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.361] GetLastError () returned 0x578 [0036.361] CanUserWritePwrScheme () returned 1 [0036.361] GetSystemMetrics (nIndex=46) returned 2 [0036.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.361] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.361] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.361] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.366] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.366] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.367] GetLastError () returned 0x578 [0036.367] CanUserWritePwrScheme () returned 1 [0036.367] GetSystemMetrics (nIndex=46) returned 2 [0036.367] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.367] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.367] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.367] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.373] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.373] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.373] GetLastError () returned 0x578 [0036.373] CanUserWritePwrScheme () returned 1 [0036.373] GetSystemMetrics (nIndex=46) returned 2 [0036.373] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.373] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.373] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.373] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.378] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.378] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.378] GetLastError () returned 0x578 [0036.379] CanUserWritePwrScheme () returned 1 [0036.379] GetSystemMetrics (nIndex=46) returned 2 [0036.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.379] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.379] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.379] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.384] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.384] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.384] GetLastError () returned 0x578 [0036.384] CanUserWritePwrScheme () returned 1 [0036.385] GetSystemMetrics (nIndex=46) returned 2 [0036.385] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.385] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.385] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.385] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.390] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.390] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.390] GetLastError () returned 0x578 [0036.390] CanUserWritePwrScheme () returned 1 [0036.390] GetSystemMetrics (nIndex=46) returned 2 [0036.390] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.390] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.391] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.391] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.396] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.396] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.396] GetLastError () returned 0x578 [0036.396] CanUserWritePwrScheme () returned 1 [0036.396] GetSystemMetrics (nIndex=46) returned 2 [0036.396] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.396] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.396] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.396] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.401] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.401] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.401] GetLastError () returned 0x578 [0036.401] CanUserWritePwrScheme () returned 1 [0036.402] GetSystemMetrics (nIndex=46) returned 2 [0036.402] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.402] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.402] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.402] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.407] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.407] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.407] GetLastError () returned 0x578 [0036.408] CanUserWritePwrScheme () returned 1 [0036.408] GetSystemMetrics (nIndex=46) returned 2 [0036.408] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.408] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.408] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.408] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.413] GetLastError () returned 0x578 [0036.413] CanUserWritePwrScheme () returned 1 [0036.414] GetSystemMetrics (nIndex=46) returned 2 [0036.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.414] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.414] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.414] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.425] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.425] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.425] GetLastError () returned 0x578 [0036.425] CanUserWritePwrScheme () returned 1 [0036.425] GetSystemMetrics (nIndex=46) returned 2 [0036.425] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.425] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.425] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.425] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.431] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.431] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.431] GetLastError () returned 0x578 [0036.431] CanUserWritePwrScheme () returned 1 [0036.431] GetSystemMetrics (nIndex=46) returned 2 [0036.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.432] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.437] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.437] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.437] GetLastError () returned 0x578 [0036.437] CanUserWritePwrScheme () returned 1 [0036.438] GetSystemMetrics (nIndex=46) returned 2 [0036.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.438] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.442] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.442] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.442] GetLastError () returned 0x578 [0036.442] CanUserWritePwrScheme () returned 1 [0036.442] GetSystemMetrics (nIndex=46) returned 2 [0036.443] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.443] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.443] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.443] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.447] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.447] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.447] GetLastError () returned 0x578 [0036.447] CanUserWritePwrScheme () returned 1 [0036.447] GetSystemMetrics (nIndex=46) returned 2 [0036.447] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.447] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.447] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.447] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.452] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.452] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.452] GetLastError () returned 0x578 [0036.452] CanUserWritePwrScheme () returned 1 [0036.452] GetSystemMetrics (nIndex=46) returned 2 [0036.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.452] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.452] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.452] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.457] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.457] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.458] GetLastError () returned 0x578 [0036.458] CanUserWritePwrScheme () returned 1 [0036.458] GetSystemMetrics (nIndex=46) returned 2 [0036.458] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.458] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.458] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.458] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.464] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.464] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.464] GetLastError () returned 0x578 [0036.464] CanUserWritePwrScheme () returned 1 [0036.464] GetSystemMetrics (nIndex=46) returned 2 [0036.464] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.464] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.464] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.464] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.473] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.473] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.473] GetLastError () returned 0x578 [0036.473] CanUserWritePwrScheme () returned 1 [0036.473] GetSystemMetrics (nIndex=46) returned 2 [0036.473] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.473] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.473] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.473] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.477] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.477] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.477] GetLastError () returned 0x578 [0036.477] CanUserWritePwrScheme () returned 1 [0036.478] GetSystemMetrics (nIndex=46) returned 2 [0036.478] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.478] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.478] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.478] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.482] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.482] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.482] GetLastError () returned 0x578 [0036.482] CanUserWritePwrScheme () returned 1 [0036.482] GetSystemMetrics (nIndex=46) returned 2 [0036.482] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.482] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.482] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.482] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.486] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.486] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.486] GetLastError () returned 0x578 [0036.486] CanUserWritePwrScheme () returned 1 [0036.487] GetSystemMetrics (nIndex=46) returned 2 [0036.487] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.487] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.487] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.487] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.491] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.491] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.491] GetLastError () returned 0x578 [0036.491] CanUserWritePwrScheme () returned 1 [0036.491] GetSystemMetrics (nIndex=46) returned 2 [0036.491] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.491] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.491] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.491] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.495] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.495] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.495] GetLastError () returned 0x578 [0036.495] CanUserWritePwrScheme () returned 1 [0036.496] GetSystemMetrics (nIndex=46) returned 2 [0036.496] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.496] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.496] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.496] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.500] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.500] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.500] GetLastError () returned 0x578 [0036.500] CanUserWritePwrScheme () returned 1 [0036.500] GetSystemMetrics (nIndex=46) returned 2 [0036.501] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.501] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.501] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.501] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.505] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.505] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.505] GetLastError () returned 0x578 [0036.505] CanUserWritePwrScheme () returned 1 [0036.505] GetSystemMetrics (nIndex=46) returned 2 [0036.505] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.505] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.505] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.505] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.509] GetLastError () returned 0x578 [0036.509] CanUserWritePwrScheme () returned 1 [0036.510] GetSystemMetrics (nIndex=46) returned 2 [0036.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.510] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.510] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.510] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.514] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.514] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.514] GetLastError () returned 0x578 [0036.514] CanUserWritePwrScheme () returned 1 [0036.514] GetSystemMetrics (nIndex=46) returned 2 [0036.514] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.514] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.514] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.514] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.518] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.518] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.518] GetLastError () returned 0x578 [0036.518] CanUserWritePwrScheme () returned 1 [0036.519] GetSystemMetrics (nIndex=46) returned 2 [0036.519] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.519] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.519] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.519] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.523] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.523] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.523] GetLastError () returned 0x578 [0036.523] CanUserWritePwrScheme () returned 1 [0036.523] GetSystemMetrics (nIndex=46) returned 2 [0036.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.523] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.523] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.523] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.527] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.527] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.527] GetLastError () returned 0x578 [0036.527] CanUserWritePwrScheme () returned 1 [0036.528] GetSystemMetrics (nIndex=46) returned 2 [0036.528] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.528] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.528] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.528] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.532] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.532] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.532] GetLastError () returned 0x578 [0036.532] CanUserWritePwrScheme () returned 1 [0036.532] GetSystemMetrics (nIndex=46) returned 2 [0036.532] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.532] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.532] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.533] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.536] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.537] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.537] GetLastError () returned 0x578 [0036.537] CanUserWritePwrScheme () returned 1 [0036.537] GetSystemMetrics (nIndex=46) returned 2 [0036.537] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.537] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.537] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.537] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.541] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.541] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.541] GetLastError () returned 0x578 [0036.541] CanUserWritePwrScheme () returned 1 [0036.542] GetSystemMetrics (nIndex=46) returned 2 [0036.542] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.542] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.542] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.542] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.546] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.546] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.546] GetLastError () returned 0x578 [0036.546] CanUserWritePwrScheme () returned 1 [0036.546] GetSystemMetrics (nIndex=46) returned 2 [0036.546] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.546] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.546] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.546] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.550] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.550] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.550] GetLastError () returned 0x578 [0036.550] CanUserWritePwrScheme () returned 1 [0036.551] GetSystemMetrics (nIndex=46) returned 2 [0036.551] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.551] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.551] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.551] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.555] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.555] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.555] GetLastError () returned 0x578 [0036.555] CanUserWritePwrScheme () returned 1 [0036.555] GetSystemMetrics (nIndex=46) returned 2 [0036.555] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.555] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.556] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.556] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.560] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.560] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.560] GetLastError () returned 0x578 [0036.560] CanUserWritePwrScheme () returned 1 [0036.560] GetSystemMetrics (nIndex=46) returned 2 [0036.560] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.560] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.560] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.561] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.565] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.565] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.565] GetLastError () returned 0x578 [0036.565] CanUserWritePwrScheme () returned 1 [0036.565] GetSystemMetrics (nIndex=46) returned 2 [0036.565] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.565] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.565] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.565] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.569] GetLastError () returned 0x578 [0036.569] CanUserWritePwrScheme () returned 1 [0036.570] GetSystemMetrics (nIndex=46) returned 2 [0036.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.570] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.570] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.570] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.574] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.574] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.574] GetLastError () returned 0x578 [0036.574] CanUserWritePwrScheme () returned 1 [0036.574] GetSystemMetrics (nIndex=46) returned 2 [0036.574] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.574] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.574] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.574] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.578] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.579] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.579] GetLastError () returned 0x578 [0036.579] CanUserWritePwrScheme () returned 1 [0036.579] GetSystemMetrics (nIndex=46) returned 2 [0036.579] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.579] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.579] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.579] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.583] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.583] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.583] GetLastError () returned 0x578 [0036.583] CanUserWritePwrScheme () returned 1 [0036.584] GetSystemMetrics (nIndex=46) returned 2 [0036.584] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.584] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.584] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.584] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.588] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.588] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.588] GetLastError () returned 0x578 [0036.588] CanUserWritePwrScheme () returned 1 [0036.588] GetSystemMetrics (nIndex=46) returned 2 [0036.588] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.588] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.588] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.588] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.592] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.592] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.592] GetLastError () returned 0x578 [0036.593] CanUserWritePwrScheme () returned 1 [0036.593] GetSystemMetrics (nIndex=46) returned 2 [0036.593] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.593] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.593] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.593] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.597] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.597] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.597] GetLastError () returned 0x578 [0036.597] CanUserWritePwrScheme () returned 1 [0036.598] GetSystemMetrics (nIndex=46) returned 2 [0036.598] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.598] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.598] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.598] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.602] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.602] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.602] GetLastError () returned 0x578 [0036.602] CanUserWritePwrScheme () returned 1 [0036.602] GetSystemMetrics (nIndex=46) returned 2 [0036.602] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.602] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.602] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.602] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.607] GetLastError () returned 0x578 [0036.607] CanUserWritePwrScheme () returned 1 [0036.607] GetSystemMetrics (nIndex=46) returned 2 [0036.607] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.607] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.607] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.607] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.611] GetLastError () returned 0x578 [0036.612] CanUserWritePwrScheme () returned 1 [0036.612] GetSystemMetrics (nIndex=46) returned 2 [0036.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.612] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.616] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.616] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.616] GetLastError () returned 0x578 [0036.616] CanUserWritePwrScheme () returned 1 [0036.617] GetSystemMetrics (nIndex=46) returned 2 [0036.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.617] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.617] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.617] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.621] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.621] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.621] GetLastError () returned 0x578 [0036.621] CanUserWritePwrScheme () returned 1 [0036.622] GetSystemMetrics (nIndex=46) returned 2 [0036.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.622] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.622] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.622] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.626] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.626] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.626] GetLastError () returned 0x578 [0036.626] CanUserWritePwrScheme () returned 1 [0036.626] GetSystemMetrics (nIndex=46) returned 2 [0036.626] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.626] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.626] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.626] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.630] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.631] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.631] GetLastError () returned 0x578 [0036.631] CanUserWritePwrScheme () returned 1 [0036.631] GetSystemMetrics (nIndex=46) returned 2 [0036.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.636] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.636] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.636] GetLastError () returned 0x578 [0036.636] CanUserWritePwrScheme () returned 1 [0036.637] GetSystemMetrics (nIndex=46) returned 2 [0036.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.637] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.637] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.637] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.641] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.641] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.641] GetLastError () returned 0x578 [0036.641] CanUserWritePwrScheme () returned 1 [0036.641] GetSystemMetrics (nIndex=46) returned 2 [0036.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.641] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.641] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.641] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.645] GetLastError () returned 0x578 [0036.645] CanUserWritePwrScheme () returned 1 [0036.646] GetSystemMetrics (nIndex=46) returned 2 [0036.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.650] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.650] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.650] GetLastError () returned 0x578 [0036.650] CanUserWritePwrScheme () returned 1 [0036.650] GetSystemMetrics (nIndex=46) returned 2 [0036.650] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.650] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.650] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.650] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.654] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.654] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.655] GetLastError () returned 0x578 [0036.655] CanUserWritePwrScheme () returned 1 [0036.655] GetSystemMetrics (nIndex=46) returned 2 [0036.655] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.655] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.655] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.655] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.659] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.659] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.659] GetLastError () returned 0x578 [0036.659] CanUserWritePwrScheme () returned 1 [0036.660] GetSystemMetrics (nIndex=46) returned 2 [0036.660] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.660] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.660] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.660] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.664] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.664] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.664] GetLastError () returned 0x578 [0036.664] CanUserWritePwrScheme () returned 1 [0036.664] GetSystemMetrics (nIndex=46) returned 2 [0036.664] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.664] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.664] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.664] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.668] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.668] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.668] GetLastError () returned 0x578 [0036.669] CanUserWritePwrScheme () returned 1 [0036.669] GetSystemMetrics (nIndex=46) returned 2 [0036.669] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.669] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.669] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.669] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.673] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.673] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.673] GetLastError () returned 0x578 [0036.673] CanUserWritePwrScheme () returned 1 [0036.673] GetSystemMetrics (nIndex=46) returned 2 [0036.673] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.673] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.673] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.674] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.678] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.678] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.678] GetLastError () returned 0x578 [0036.678] CanUserWritePwrScheme () returned 1 [0036.678] GetSystemMetrics (nIndex=46) returned 2 [0036.678] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.678] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.678] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.678] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.682] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.682] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.682] GetLastError () returned 0x578 [0036.682] CanUserWritePwrScheme () returned 1 [0036.682] GetSystemMetrics (nIndex=46) returned 2 [0036.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.683] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.683] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.683] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.687] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.687] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.687] GetLastError () returned 0x578 [0036.687] CanUserWritePwrScheme () returned 1 [0036.687] GetSystemMetrics (nIndex=46) returned 2 [0036.687] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.687] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.687] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.687] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.691] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.691] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.691] GetLastError () returned 0x578 [0036.691] CanUserWritePwrScheme () returned 1 [0036.692] GetSystemMetrics (nIndex=46) returned 2 [0036.692] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.692] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.692] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.692] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.696] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.696] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.696] GetLastError () returned 0x578 [0036.696] CanUserWritePwrScheme () returned 1 [0036.696] GetSystemMetrics (nIndex=46) returned 2 [0036.696] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.696] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.696] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.696] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.701] GetLastError () returned 0x578 [0036.701] CanUserWritePwrScheme () returned 1 [0036.701] GetSystemMetrics (nIndex=46) returned 2 [0036.701] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.701] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.701] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.701] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.705] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.705] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.705] GetLastError () returned 0x578 [0036.705] CanUserWritePwrScheme () returned 1 [0036.706] GetSystemMetrics (nIndex=46) returned 2 [0036.706] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.706] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.706] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.706] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.710] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.710] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.710] GetLastError () returned 0x578 [0036.710] CanUserWritePwrScheme () returned 1 [0036.710] GetSystemMetrics (nIndex=46) returned 2 [0036.710] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.710] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.710] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.710] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.715] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.715] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.715] GetLastError () returned 0x578 [0036.715] CanUserWritePwrScheme () returned 1 [0036.715] GetSystemMetrics (nIndex=46) returned 2 [0036.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.715] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.715] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.715] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.719] GetLastError () returned 0x578 [0036.719] CanUserWritePwrScheme () returned 1 [0036.720] GetSystemMetrics (nIndex=46) returned 2 [0036.720] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.720] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.720] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.720] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.724] GetLastError () returned 0x578 [0036.724] CanUserWritePwrScheme () returned 1 [0036.724] GetSystemMetrics (nIndex=46) returned 2 [0036.724] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.724] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.724] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.724] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.728] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.728] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.728] GetLastError () returned 0x578 [0036.728] CanUserWritePwrScheme () returned 1 [0036.729] GetSystemMetrics (nIndex=46) returned 2 [0036.729] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.729] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.729] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.729] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.733] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.733] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.733] GetLastError () returned 0x578 [0036.733] CanUserWritePwrScheme () returned 1 [0036.734] GetSystemMetrics (nIndex=46) returned 2 [0036.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.734] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.734] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.734] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.738] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.738] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.738] GetLastError () returned 0x578 [0036.738] CanUserWritePwrScheme () returned 1 [0036.738] GetSystemMetrics (nIndex=46) returned 2 [0036.738] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.738] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.738] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.738] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.742] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.742] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.742] GetLastError () returned 0x578 [0036.743] CanUserWritePwrScheme () returned 1 [0036.743] GetSystemMetrics (nIndex=46) returned 2 [0036.743] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.743] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.743] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.743] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.747] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.747] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.747] GetLastError () returned 0x578 [0036.747] CanUserWritePwrScheme () returned 1 [0036.748] GetSystemMetrics (nIndex=46) returned 2 [0036.748] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.748] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.748] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.748] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.752] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.752] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.752] GetLastError () returned 0x578 [0036.752] CanUserWritePwrScheme () returned 1 [0036.752] GetSystemMetrics (nIndex=46) returned 2 [0036.752] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.752] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.752] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.752] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.756] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.756] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.756] GetLastError () returned 0x578 [0036.756] CanUserWritePwrScheme () returned 1 [0036.757] GetSystemMetrics (nIndex=46) returned 2 [0036.757] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.757] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.757] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.757] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.761] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.761] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.761] GetLastError () returned 0x578 [0036.761] CanUserWritePwrScheme () returned 1 [0036.762] GetSystemMetrics (nIndex=46) returned 2 [0036.762] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.762] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.762] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.762] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.766] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.766] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.766] GetLastError () returned 0x578 [0036.766] CanUserWritePwrScheme () returned 1 [0036.766] GetSystemMetrics (nIndex=46) returned 2 [0036.766] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.766] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.766] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.766] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.770] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.770] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.770] GetLastError () returned 0x578 [0036.770] CanUserWritePwrScheme () returned 1 [0036.771] GetSystemMetrics (nIndex=46) returned 2 [0036.771] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.771] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.771] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.771] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.775] GetLastError () returned 0x578 [0036.775] CanUserWritePwrScheme () returned 1 [0036.775] GetSystemMetrics (nIndex=46) returned 2 [0036.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.775] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.775] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.775] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.779] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.779] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.779] GetLastError () returned 0x578 [0036.779] CanUserWritePwrScheme () returned 1 [0036.780] GetSystemMetrics (nIndex=46) returned 2 [0036.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.784] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.784] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.784] GetLastError () returned 0x578 [0036.784] CanUserWritePwrScheme () returned 1 [0036.784] GetSystemMetrics (nIndex=46) returned 2 [0036.784] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.784] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.784] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.784] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.788] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.788] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.788] GetLastError () returned 0x578 [0036.788] CanUserWritePwrScheme () returned 1 [0036.789] GetSystemMetrics (nIndex=46) returned 2 [0036.789] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.789] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.789] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.789] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.793] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.793] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.793] GetLastError () returned 0x578 [0036.793] CanUserWritePwrScheme () returned 1 [0036.793] GetSystemMetrics (nIndex=46) returned 2 [0036.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.793] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.793] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.794] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.797] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.797] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.798] GetLastError () returned 0x578 [0036.798] CanUserWritePwrScheme () returned 1 [0036.798] GetSystemMetrics (nIndex=46) returned 2 [0036.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.798] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.798] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.798] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.802] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.802] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.802] GetLastError () returned 0x578 [0036.802] CanUserWritePwrScheme () returned 1 [0036.802] GetSystemMetrics (nIndex=46) returned 2 [0036.802] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.802] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.803] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.803] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.807] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.807] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.807] GetLastError () returned 0x578 [0036.807] CanUserWritePwrScheme () returned 1 [0036.807] GetSystemMetrics (nIndex=46) returned 2 [0036.807] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.807] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.807] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.807] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.811] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.811] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.811] GetLastError () returned 0x578 [0036.811] CanUserWritePwrScheme () returned 1 [0036.812] GetSystemMetrics (nIndex=46) returned 2 [0036.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.812] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.812] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.812] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.816] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.816] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.816] GetLastError () returned 0x578 [0036.816] CanUserWritePwrScheme () returned 1 [0036.816] GetSystemMetrics (nIndex=46) returned 2 [0036.816] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.816] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.816] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.816] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.820] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.820] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.821] GetLastError () returned 0x578 [0036.821] CanUserWritePwrScheme () returned 1 [0036.821] GetSystemMetrics (nIndex=46) returned 2 [0036.821] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.821] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.821] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.821] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.825] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.825] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.825] GetLastError () returned 0x578 [0036.825] CanUserWritePwrScheme () returned 1 [0036.825] GetSystemMetrics (nIndex=46) returned 2 [0036.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.826] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.826] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.826] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.830] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.830] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.830] GetLastError () returned 0x578 [0036.830] CanUserWritePwrScheme () returned 1 [0036.830] GetSystemMetrics (nIndex=46) returned 2 [0036.830] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.830] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.830] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.830] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.834] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.834] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.834] GetLastError () returned 0x578 [0036.834] CanUserWritePwrScheme () returned 1 [0036.834] GetSystemMetrics (nIndex=46) returned 2 [0036.835] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.835] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.835] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.835] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.839] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.839] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.839] GetLastError () returned 0x578 [0036.839] CanUserWritePwrScheme () returned 1 [0036.839] GetSystemMetrics (nIndex=46) returned 2 [0036.839] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.839] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.839] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.839] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.843] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.843] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.843] GetLastError () returned 0x578 [0036.844] CanUserWritePwrScheme () returned 1 [0036.844] GetSystemMetrics (nIndex=46) returned 2 [0036.844] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.844] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.844] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.844] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.848] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.848] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.848] GetLastError () returned 0x578 [0036.848] CanUserWritePwrScheme () returned 1 [0036.848] GetSystemMetrics (nIndex=46) returned 2 [0036.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.848] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.849] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.849] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.852] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.853] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.853] GetLastError () returned 0x578 [0036.853] CanUserWritePwrScheme () returned 1 [0036.853] GetSystemMetrics (nIndex=46) returned 2 [0036.853] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.853] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.853] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.853] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.857] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.857] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.857] GetLastError () returned 0x578 [0036.857] CanUserWritePwrScheme () returned 1 [0036.858] GetSystemMetrics (nIndex=46) returned 2 [0036.858] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.858] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.858] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.858] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.862] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.862] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.862] GetLastError () returned 0x578 [0036.862] CanUserWritePwrScheme () returned 1 [0036.862] GetSystemMetrics (nIndex=46) returned 2 [0036.862] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.862] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.862] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.862] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.866] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.866] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.866] GetLastError () returned 0x578 [0036.866] CanUserWritePwrScheme () returned 1 [0036.867] GetSystemMetrics (nIndex=46) returned 2 [0036.867] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.867] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.867] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.867] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.871] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.871] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.871] GetLastError () returned 0x578 [0036.871] CanUserWritePwrScheme () returned 1 [0036.872] GetSystemMetrics (nIndex=46) returned 2 [0036.872] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.872] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.872] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.872] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.876] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.876] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.876] GetLastError () returned 0x578 [0036.876] CanUserWritePwrScheme () returned 1 [0036.876] GetSystemMetrics (nIndex=46) returned 2 [0036.876] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.876] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.876] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.876] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.880] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.880] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.880] GetLastError () returned 0x578 [0036.880] CanUserWritePwrScheme () returned 1 [0036.881] GetSystemMetrics (nIndex=46) returned 2 [0036.881] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.881] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.881] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.881] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.885] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.885] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.885] GetLastError () returned 0x578 [0036.885] CanUserWritePwrScheme () returned 1 [0036.885] GetSystemMetrics (nIndex=46) returned 2 [0036.885] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.885] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.885] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.885] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.889] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.889] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.889] GetLastError () returned 0x578 [0036.889] CanUserWritePwrScheme () returned 1 [0036.890] GetSystemMetrics (nIndex=46) returned 2 [0036.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.890] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.894] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.894] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.894] GetLastError () returned 0x578 [0036.894] CanUserWritePwrScheme () returned 1 [0036.894] GetSystemMetrics (nIndex=46) returned 2 [0036.894] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.894] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.894] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.894] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.898] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.898] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.898] GetLastError () returned 0x578 [0036.898] CanUserWritePwrScheme () returned 1 [0036.899] GetSystemMetrics (nIndex=46) returned 2 [0036.899] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.899] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.899] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.899] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.903] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.903] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.903] GetLastError () returned 0x578 [0036.903] CanUserWritePwrScheme () returned 1 [0036.903] GetSystemMetrics (nIndex=46) returned 2 [0036.903] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.903] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.903] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.903] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.907] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.907] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.907] GetLastError () returned 0x578 [0036.908] CanUserWritePwrScheme () returned 1 [0036.908] GetSystemMetrics (nIndex=46) returned 2 [0036.908] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.908] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.908] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.908] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.912] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.912] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.912] GetLastError () returned 0x578 [0036.912] CanUserWritePwrScheme () returned 1 [0036.912] GetSystemMetrics (nIndex=46) returned 2 [0036.912] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.912] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.912] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.912] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.916] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.916] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.916] GetLastError () returned 0x578 [0036.916] CanUserWritePwrScheme () returned 1 [0036.917] GetSystemMetrics (nIndex=46) returned 2 [0036.917] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.917] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.917] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.917] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.921] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.921] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.921] GetLastError () returned 0x578 [0036.921] CanUserWritePwrScheme () returned 1 [0036.921] GetSystemMetrics (nIndex=46) returned 2 [0036.921] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.922] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.922] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.922] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.926] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.926] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.926] GetLastError () returned 0x578 [0036.926] CanUserWritePwrScheme () returned 1 [0036.926] GetSystemMetrics (nIndex=46) returned 2 [0036.926] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.926] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.926] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.926] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.930] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.930] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.930] GetLastError () returned 0x578 [0036.930] CanUserWritePwrScheme () returned 1 [0036.930] GetSystemMetrics (nIndex=46) returned 2 [0036.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.931] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.931] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.935] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.935] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.935] GetLastError () returned 0x578 [0036.935] CanUserWritePwrScheme () returned 1 [0036.935] GetSystemMetrics (nIndex=46) returned 2 [0036.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.939] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.939] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.939] GetLastError () returned 0x578 [0036.939] CanUserWritePwrScheme () returned 1 [0036.940] GetSystemMetrics (nIndex=46) returned 2 [0036.940] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.940] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.940] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.940] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.944] GetLastError () returned 0x578 [0036.944] CanUserWritePwrScheme () returned 1 [0036.944] GetSystemMetrics (nIndex=46) returned 2 [0036.944] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.944] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.944] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.944] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.948] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.948] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.948] GetLastError () returned 0x578 [0036.948] CanUserWritePwrScheme () returned 1 [0036.949] GetSystemMetrics (nIndex=46) returned 2 [0036.949] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.949] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.949] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.949] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.953] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.953] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.953] GetLastError () returned 0x578 [0036.953] CanUserWritePwrScheme () returned 1 [0036.953] GetSystemMetrics (nIndex=46) returned 2 [0036.953] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.953] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.953] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.954] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.958] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.958] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.958] GetLastError () returned 0x578 [0036.958] CanUserWritePwrScheme () returned 1 [0036.958] GetSystemMetrics (nIndex=46) returned 2 [0036.958] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.958] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.958] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.958] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.962] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.962] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.962] GetLastError () returned 0x578 [0036.962] CanUserWritePwrScheme () returned 1 [0036.963] GetSystemMetrics (nIndex=46) returned 2 [0036.963] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.963] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.963] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.963] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.967] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.967] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.967] GetLastError () returned 0x578 [0036.967] CanUserWritePwrScheme () returned 1 [0036.968] GetSystemMetrics (nIndex=46) returned 2 [0036.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.972] GetLastError () returned 0x578 [0036.972] CanUserWritePwrScheme () returned 1 [0036.972] GetSystemMetrics (nIndex=46) returned 2 [0036.972] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.972] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.972] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.972] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.976] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.976] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.976] GetLastError () returned 0x578 [0036.976] CanUserWritePwrScheme () returned 1 [0036.977] GetSystemMetrics (nIndex=46) returned 2 [0036.977] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.977] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.977] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.977] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.981] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.981] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.981] GetLastError () returned 0x578 [0036.981] CanUserWritePwrScheme () returned 1 [0036.981] GetSystemMetrics (nIndex=46) returned 2 [0036.981] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.981] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.981] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.981] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.985] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.985] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.985] GetLastError () returned 0x578 [0036.985] CanUserWritePwrScheme () returned 1 [0036.986] GetSystemMetrics (nIndex=46) returned 2 [0036.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.986] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.990] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.990] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.990] GetLastError () returned 0x578 [0036.990] CanUserWritePwrScheme () returned 1 [0036.990] GetSystemMetrics (nIndex=46) returned 2 [0036.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.990] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.990] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.990] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.994] GetLastError () returned 0x578 [0036.994] CanUserWritePwrScheme () returned 1 [0036.995] GetSystemMetrics (nIndex=46) returned 2 [0036.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0036.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0036.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0036.999] GetWindowTextLengthA (hWnd=0x0) returned 0 [0036.999] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0036.999] GetLastError () returned 0x578 [0036.999] CanUserWritePwrScheme () returned 1 [0036.999] GetSystemMetrics (nIndex=46) returned 2 [0036.999] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0036.999] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.000] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.000] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.004] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.004] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.005] GetLastError () returned 0x578 [0037.005] CanUserWritePwrScheme () returned 1 [0037.005] GetSystemMetrics (nIndex=46) returned 2 [0037.005] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.005] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.005] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.005] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.009] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.009] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.009] GetLastError () returned 0x578 [0037.009] CanUserWritePwrScheme () returned 1 [0037.009] GetSystemMetrics (nIndex=46) returned 2 [0037.009] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.009] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.009] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.010] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.014] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.014] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.014] GetLastError () returned 0x578 [0037.014] CanUserWritePwrScheme () returned 1 [0037.014] GetSystemMetrics (nIndex=46) returned 2 [0037.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.018] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.018] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.018] GetLastError () returned 0x578 [0037.018] CanUserWritePwrScheme () returned 1 [0037.019] GetSystemMetrics (nIndex=46) returned 2 [0037.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.019] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.023] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.023] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.023] GetLastError () returned 0x578 [0037.023] CanUserWritePwrScheme () returned 1 [0037.023] GetSystemMetrics (nIndex=46) returned 2 [0037.023] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.023] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.023] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.023] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.027] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.027] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.027] GetLastError () returned 0x578 [0037.027] CanUserWritePwrScheme () returned 1 [0037.028] GetSystemMetrics (nIndex=46) returned 2 [0037.028] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.028] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.028] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.028] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.032] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.032] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.032] GetLastError () returned 0x578 [0037.032] CanUserWritePwrScheme () returned 1 [0037.032] GetSystemMetrics (nIndex=46) returned 2 [0037.032] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.032] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.032] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.032] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.036] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.036] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.036] GetLastError () returned 0x578 [0037.037] CanUserWritePwrScheme () returned 1 [0037.037] GetSystemMetrics (nIndex=46) returned 2 [0037.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.037] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.037] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.037] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.041] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.041] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.041] GetLastError () returned 0x578 [0037.041] CanUserWritePwrScheme () returned 1 [0037.041] GetSystemMetrics (nIndex=46) returned 2 [0037.042] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.042] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.042] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.042] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.046] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.046] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.046] GetLastError () returned 0x578 [0037.046] CanUserWritePwrScheme () returned 1 [0037.046] GetSystemMetrics (nIndex=46) returned 2 [0037.046] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.046] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.046] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.046] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.050] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.050] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.050] GetLastError () returned 0x578 [0037.051] CanUserWritePwrScheme () returned 1 [0037.051] GetSystemMetrics (nIndex=46) returned 2 [0037.051] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.051] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.051] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.051] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.055] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.055] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.055] GetLastError () returned 0x578 [0037.055] CanUserWritePwrScheme () returned 1 [0037.055] GetSystemMetrics (nIndex=46) returned 2 [0037.056] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.056] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.056] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.056] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.061] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.061] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.061] GetLastError () returned 0x578 [0037.061] CanUserWritePwrScheme () returned 1 [0037.061] GetSystemMetrics (nIndex=46) returned 2 [0037.061] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.061] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.061] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.061] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.065] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.065] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.065] GetLastError () returned 0x578 [0037.065] CanUserWritePwrScheme () returned 1 [0037.066] GetSystemMetrics (nIndex=46) returned 2 [0037.066] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.066] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.066] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.066] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.070] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.070] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.070] GetLastError () returned 0x578 [0037.070] CanUserWritePwrScheme () returned 1 [0037.070] GetSystemMetrics (nIndex=46) returned 2 [0037.070] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.070] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.070] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.070] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.084] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.084] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.084] GetLastError () returned 0x578 [0037.084] CanUserWritePwrScheme () returned 1 [0037.084] GetSystemMetrics (nIndex=46) returned 2 [0037.084] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.084] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.084] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.085] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.089] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.089] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.089] GetLastError () returned 0x578 [0037.089] CanUserWritePwrScheme () returned 1 [0037.089] GetSystemMetrics (nIndex=46) returned 2 [0037.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.089] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.090] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.090] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.094] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.094] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.094] GetLastError () returned 0x578 [0037.094] CanUserWritePwrScheme () returned 1 [0037.094] GetSystemMetrics (nIndex=46) returned 2 [0037.094] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.094] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.094] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.094] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.098] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.098] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.098] GetLastError () returned 0x578 [0037.098] CanUserWritePwrScheme () returned 1 [0037.099] GetSystemMetrics (nIndex=46) returned 2 [0037.099] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.099] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.099] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.099] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.103] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.103] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.103] GetLastError () returned 0x578 [0037.103] CanUserWritePwrScheme () returned 1 [0037.103] GetSystemMetrics (nIndex=46) returned 2 [0037.103] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.103] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.103] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.103] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.108] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.108] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.108] GetLastError () returned 0x578 [0037.108] CanUserWritePwrScheme () returned 1 [0037.108] GetSystemMetrics (nIndex=46) returned 2 [0037.108] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.108] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.108] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.108] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.112] GetLastError () returned 0x578 [0037.112] CanUserWritePwrScheme () returned 1 [0037.113] GetSystemMetrics (nIndex=46) returned 2 [0037.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.117] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.117] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.117] GetLastError () returned 0x578 [0037.117] CanUserWritePwrScheme () returned 1 [0037.117] GetSystemMetrics (nIndex=46) returned 2 [0037.117] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.117] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.117] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.117] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.122] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.122] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.122] GetLastError () returned 0x578 [0037.122] CanUserWritePwrScheme () returned 1 [0037.122] GetSystemMetrics (nIndex=46) returned 2 [0037.122] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.122] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.122] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.122] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.127] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.127] GetLastError () returned 0x578 [0037.127] CanUserWritePwrScheme () returned 1 [0037.127] GetSystemMetrics (nIndex=46) returned 2 [0037.127] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.127] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.127] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.127] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.131] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.131] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.131] GetLastError () returned 0x578 [0037.131] CanUserWritePwrScheme () returned 1 [0037.132] GetSystemMetrics (nIndex=46) returned 2 [0037.132] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.132] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.132] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.132] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.136] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.136] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.136] GetLastError () returned 0x578 [0037.136] CanUserWritePwrScheme () returned 1 [0037.136] GetSystemMetrics (nIndex=46) returned 2 [0037.136] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.136] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.136] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.136] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.140] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.140] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.140] GetLastError () returned 0x578 [0037.140] CanUserWritePwrScheme () returned 1 [0037.141] GetSystemMetrics (nIndex=46) returned 2 [0037.141] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.141] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.141] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.141] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.145] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.145] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.145] GetLastError () returned 0x578 [0037.145] CanUserWritePwrScheme () returned 1 [0037.146] GetSystemMetrics (nIndex=46) returned 2 [0037.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.146] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.146] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.146] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.150] GetLastError () returned 0x578 [0037.150] CanUserWritePwrScheme () returned 1 [0037.150] GetSystemMetrics (nIndex=46) returned 2 [0037.150] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.150] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.150] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.150] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.154] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.154] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.154] GetLastError () returned 0x578 [0037.154] CanUserWritePwrScheme () returned 1 [0037.155] GetSystemMetrics (nIndex=46) returned 2 [0037.155] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.155] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.155] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.155] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.159] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.159] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.159] GetLastError () returned 0x578 [0037.159] CanUserWritePwrScheme () returned 1 [0037.159] GetSystemMetrics (nIndex=46) returned 2 [0037.159] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.160] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.160] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.160] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.164] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.164] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.164] GetLastError () returned 0x578 [0037.164] CanUserWritePwrScheme () returned 1 [0037.164] GetSystemMetrics (nIndex=46) returned 2 [0037.164] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.164] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.164] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.164] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.168] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.168] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.168] GetLastError () returned 0x578 [0037.168] CanUserWritePwrScheme () returned 1 [0037.169] GetSystemMetrics (nIndex=46) returned 2 [0037.169] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.169] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.169] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.169] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.173] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.173] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.173] GetLastError () returned 0x578 [0037.173] CanUserWritePwrScheme () returned 1 [0037.173] GetSystemMetrics (nIndex=46) returned 2 [0037.173] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.173] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.173] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.173] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.177] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.177] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.177] GetLastError () returned 0x578 [0037.177] CanUserWritePwrScheme () returned 1 [0037.178] GetSystemMetrics (nIndex=46) returned 2 [0037.178] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.178] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.178] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.178] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.182] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.182] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.182] GetLastError () returned 0x578 [0037.182] CanUserWritePwrScheme () returned 1 [0037.182] GetSystemMetrics (nIndex=46) returned 2 [0037.182] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.182] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.182] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.182] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.186] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.186] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.187] GetLastError () returned 0x578 [0037.187] CanUserWritePwrScheme () returned 1 [0037.187] GetSystemMetrics (nIndex=46) returned 2 [0037.187] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.187] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.187] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.187] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.192] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.192] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.192] GetLastError () returned 0x578 [0037.192] CanUserWritePwrScheme () returned 1 [0037.192] GetSystemMetrics (nIndex=46) returned 2 [0037.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.192] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.192] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.192] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.196] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.196] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.196] GetLastError () returned 0x578 [0037.196] CanUserWritePwrScheme () returned 1 [0037.196] GetSystemMetrics (nIndex=46) returned 2 [0037.197] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.197] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.197] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.197] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.201] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.201] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.201] GetLastError () returned 0x578 [0037.201] CanUserWritePwrScheme () returned 1 [0037.201] GetSystemMetrics (nIndex=46) returned 2 [0037.201] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.201] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.201] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.201] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.205] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.205] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.205] GetLastError () returned 0x578 [0037.205] CanUserWritePwrScheme () returned 1 [0037.206] GetSystemMetrics (nIndex=46) returned 2 [0037.206] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.206] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.206] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.206] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.210] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.210] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.210] GetLastError () returned 0x578 [0037.210] CanUserWritePwrScheme () returned 1 [0037.210] GetSystemMetrics (nIndex=46) returned 2 [0037.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.210] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.210] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.210] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.214] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.214] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.215] GetLastError () returned 0x578 [0037.215] CanUserWritePwrScheme () returned 1 [0037.215] GetSystemMetrics (nIndex=46) returned 2 [0037.215] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.215] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.215] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.215] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.220] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.220] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.220] GetLastError () returned 0x578 [0037.220] CanUserWritePwrScheme () returned 1 [0037.220] GetSystemMetrics (nIndex=46) returned 2 [0037.220] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.220] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.220] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.220] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.224] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.224] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.224] GetLastError () returned 0x578 [0037.224] CanUserWritePwrScheme () returned 1 [0037.225] GetSystemMetrics (nIndex=46) returned 2 [0037.225] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.225] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.225] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.225] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.229] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.229] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.229] GetLastError () returned 0x578 [0037.229] CanUserWritePwrScheme () returned 1 [0037.229] GetSystemMetrics (nIndex=46) returned 2 [0037.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.229] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.229] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.229] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.233] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.233] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.234] GetLastError () returned 0x578 [0037.234] CanUserWritePwrScheme () returned 1 [0037.234] GetSystemMetrics (nIndex=46) returned 2 [0037.234] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.234] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.234] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.234] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.238] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.238] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.238] GetLastError () returned 0x578 [0037.238] CanUserWritePwrScheme () returned 1 [0037.238] GetSystemMetrics (nIndex=46) returned 2 [0037.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.239] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.239] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.239] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.243] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.243] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.243] GetLastError () returned 0x578 [0037.243] CanUserWritePwrScheme () returned 1 [0037.243] GetSystemMetrics (nIndex=46) returned 2 [0037.243] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.243] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.243] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.243] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.247] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.247] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.248] GetLastError () returned 0x578 [0037.248] CanUserWritePwrScheme () returned 1 [0037.248] GetSystemMetrics (nIndex=46) returned 2 [0037.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.248] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.248] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.248] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.252] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.252] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.252] GetLastError () returned 0x578 [0037.252] CanUserWritePwrScheme () returned 1 [0037.253] GetSystemMetrics (nIndex=46) returned 2 [0037.253] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.253] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.253] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.253] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.257] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.257] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.257] GetLastError () returned 0x578 [0037.257] CanUserWritePwrScheme () returned 1 [0037.258] GetSystemMetrics (nIndex=46) returned 2 [0037.258] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.258] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.258] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.258] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.262] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.262] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.262] GetLastError () returned 0x578 [0037.262] CanUserWritePwrScheme () returned 1 [0037.262] GetSystemMetrics (nIndex=46) returned 2 [0037.263] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.263] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.263] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.263] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.267] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.267] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.267] GetLastError () returned 0x578 [0037.267] CanUserWritePwrScheme () returned 1 [0037.267] GetSystemMetrics (nIndex=46) returned 2 [0037.267] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.267] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.267] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.267] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.271] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.271] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.271] GetLastError () returned 0x578 [0037.271] CanUserWritePwrScheme () returned 1 [0037.272] GetSystemMetrics (nIndex=46) returned 2 [0037.272] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.272] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.272] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.272] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.276] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.276] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.276] GetLastError () returned 0x578 [0037.276] CanUserWritePwrScheme () returned 1 [0037.276] GetSystemMetrics (nIndex=46) returned 2 [0037.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.276] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.276] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.276] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.280] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.280] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.280] GetLastError () returned 0x578 [0037.280] CanUserWritePwrScheme () returned 1 [0037.281] GetSystemMetrics (nIndex=46) returned 2 [0037.281] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.281] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.281] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.281] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.285] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.285] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.285] GetLastError () returned 0x578 [0037.285] CanUserWritePwrScheme () returned 1 [0037.285] GetSystemMetrics (nIndex=46) returned 2 [0037.285] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.285] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.285] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.285] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.290] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.290] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.290] GetLastError () returned 0x578 [0037.290] CanUserWritePwrScheme () returned 1 [0037.290] GetSystemMetrics (nIndex=46) returned 2 [0037.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.295] GetLastError () returned 0x578 [0037.295] CanUserWritePwrScheme () returned 1 [0037.295] GetSystemMetrics (nIndex=46) returned 2 [0037.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.300] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.300] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.300] GetLastError () returned 0x578 [0037.300] CanUserWritePwrScheme () returned 1 [0037.300] GetSystemMetrics (nIndex=46) returned 2 [0037.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.305] GetLastError () returned 0x578 [0037.305] CanUserWritePwrScheme () returned 1 [0037.305] GetSystemMetrics (nIndex=46) returned 2 [0037.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.305] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.305] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.305] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.310] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.310] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.310] GetLastError () returned 0x578 [0037.310] CanUserWritePwrScheme () returned 1 [0037.310] GetSystemMetrics (nIndex=46) returned 2 [0037.310] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.310] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.310] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.310] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.314] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.314] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.314] GetLastError () returned 0x578 [0037.314] CanUserWritePwrScheme () returned 1 [0037.315] GetSystemMetrics (nIndex=46) returned 2 [0037.315] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.315] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.315] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.315] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.320] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.320] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.320] GetLastError () returned 0x578 [0037.320] CanUserWritePwrScheme () returned 1 [0037.320] GetSystemMetrics (nIndex=46) returned 2 [0037.320] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.320] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.320] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.320] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.324] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.324] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.324] GetLastError () returned 0x578 [0037.324] CanUserWritePwrScheme () returned 1 [0037.325] GetSystemMetrics (nIndex=46) returned 2 [0037.325] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.325] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.325] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.325] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.329] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.329] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.329] GetLastError () returned 0x578 [0037.329] CanUserWritePwrScheme () returned 1 [0037.329] GetSystemMetrics (nIndex=46) returned 2 [0037.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.333] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.333] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.333] GetLastError () returned 0x578 [0037.333] CanUserWritePwrScheme () returned 1 [0037.334] GetSystemMetrics (nIndex=46) returned 2 [0037.334] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.334] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.334] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.334] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.338] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.338] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.338] GetLastError () returned 0x578 [0037.338] CanUserWritePwrScheme () returned 1 [0037.338] GetSystemMetrics (nIndex=46) returned 2 [0037.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.338] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.339] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.339] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.342] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.343] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.343] GetLastError () returned 0x578 [0037.343] CanUserWritePwrScheme () returned 1 [0037.343] GetSystemMetrics (nIndex=46) returned 2 [0037.343] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.343] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.343] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.343] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.347] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.347] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.347] GetLastError () returned 0x578 [0037.347] CanUserWritePwrScheme () returned 1 [0037.348] GetSystemMetrics (nIndex=46) returned 2 [0037.348] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.348] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.348] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.348] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.352] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.352] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.352] GetLastError () returned 0x578 [0037.352] CanUserWritePwrScheme () returned 1 [0037.352] GetSystemMetrics (nIndex=46) returned 2 [0037.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.352] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.352] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.352] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.356] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.356] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.356] GetLastError () returned 0x578 [0037.356] CanUserWritePwrScheme () returned 1 [0037.357] GetSystemMetrics (nIndex=46) returned 2 [0037.357] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.357] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.357] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.357] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.364] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.364] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.364] GetLastError () returned 0x578 [0037.364] CanUserWritePwrScheme () returned 1 [0037.365] GetSystemMetrics (nIndex=46) returned 2 [0037.365] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.365] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.365] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.365] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.369] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.369] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.369] GetLastError () returned 0x578 [0037.369] CanUserWritePwrScheme () returned 1 [0037.369] GetSystemMetrics (nIndex=46) returned 2 [0037.369] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.369] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.369] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.370] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.374] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.374] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.374] GetLastError () returned 0x578 [0037.374] CanUserWritePwrScheme () returned 1 [0037.374] GetSystemMetrics (nIndex=46) returned 2 [0037.374] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.374] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.374] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.374] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.378] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.378] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.378] GetLastError () returned 0x578 [0037.378] CanUserWritePwrScheme () returned 1 [0037.379] GetSystemMetrics (nIndex=46) returned 2 [0037.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.379] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.379] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.379] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.383] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.383] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.383] GetLastError () returned 0x578 [0037.383] CanUserWritePwrScheme () returned 1 [0037.384] GetSystemMetrics (nIndex=46) returned 2 [0037.384] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.384] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.384] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.384] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.388] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.388] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.388] GetLastError () returned 0x578 [0037.388] CanUserWritePwrScheme () returned 1 [0037.389] GetSystemMetrics (nIndex=46) returned 2 [0037.389] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.389] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.389] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.389] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.393] GetLastError () returned 0x578 [0037.393] CanUserWritePwrScheme () returned 1 [0037.393] GetSystemMetrics (nIndex=46) returned 2 [0037.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.393] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.393] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.393] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.397] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.397] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.397] GetLastError () returned 0x578 [0037.398] CanUserWritePwrScheme () returned 1 [0037.398] GetSystemMetrics (nIndex=46) returned 2 [0037.398] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.398] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.398] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.398] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.402] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.402] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.402] GetLastError () returned 0x578 [0037.402] CanUserWritePwrScheme () returned 1 [0037.403] GetSystemMetrics (nIndex=46) returned 2 [0037.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.403] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.403] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.403] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.407] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.407] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.407] GetLastError () returned 0x578 [0037.407] CanUserWritePwrScheme () returned 1 [0037.407] GetSystemMetrics (nIndex=46) returned 2 [0037.407] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.407] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.407] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.407] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.411] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.411] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.411] GetLastError () returned 0x578 [0037.411] CanUserWritePwrScheme () returned 1 [0037.412] GetSystemMetrics (nIndex=46) returned 2 [0037.412] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.412] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.412] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.412] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.416] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.416] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.416] GetLastError () returned 0x578 [0037.416] CanUserWritePwrScheme () returned 1 [0037.416] GetSystemMetrics (nIndex=46) returned 2 [0037.416] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.416] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.416] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.416] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.559] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.559] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.560] GetLastError () returned 0x578 [0037.560] CanUserWritePwrScheme () returned 1 [0037.560] GetSystemMetrics (nIndex=46) returned 2 [0037.560] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.560] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.560] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.560] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.564] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.564] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.564] GetLastError () returned 0x578 [0037.564] CanUserWritePwrScheme () returned 1 [0037.565] GetSystemMetrics (nIndex=46) returned 2 [0037.565] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.565] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.565] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.565] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.569] GetLastError () returned 0x578 [0037.569] CanUserWritePwrScheme () returned 1 [0037.569] GetSystemMetrics (nIndex=46) returned 2 [0037.569] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.569] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.569] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.569] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.573] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.573] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.574] GetLastError () returned 0x578 [0037.574] CanUserWritePwrScheme () returned 1 [0037.574] GetSystemMetrics (nIndex=46) returned 2 [0037.574] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.574] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.574] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.574] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.578] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.578] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.579] GetLastError () returned 0x578 [0037.579] CanUserWritePwrScheme () returned 1 [0037.579] GetSystemMetrics (nIndex=46) returned 2 [0037.579] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.579] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.579] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.579] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.583] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.583] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.583] GetLastError () returned 0x578 [0037.583] CanUserWritePwrScheme () returned 1 [0037.584] GetSystemMetrics (nIndex=46) returned 2 [0037.584] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.584] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.584] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.584] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.588] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.588] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.588] GetLastError () returned 0x578 [0037.588] CanUserWritePwrScheme () returned 1 [0037.589] GetSystemMetrics (nIndex=46) returned 2 [0037.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.593] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.593] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.593] GetLastError () returned 0x578 [0037.593] CanUserWritePwrScheme () returned 1 [0037.593] GetSystemMetrics (nIndex=46) returned 2 [0037.593] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.593] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.593] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.593] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.597] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.597] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.597] GetLastError () returned 0x578 [0037.597] CanUserWritePwrScheme () returned 1 [0037.598] GetSystemMetrics (nIndex=46) returned 2 [0037.598] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.598] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.598] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.598] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.602] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.602] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.602] GetLastError () returned 0x578 [0037.602] CanUserWritePwrScheme () returned 1 [0037.602] GetSystemMetrics (nIndex=46) returned 2 [0037.602] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.602] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.602] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.602] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.607] GetLastError () returned 0x578 [0037.607] CanUserWritePwrScheme () returned 1 [0037.607] GetSystemMetrics (nIndex=46) returned 2 [0037.607] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.607] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.607] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.607] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.611] GetLastError () returned 0x578 [0037.612] CanUserWritePwrScheme () returned 1 [0037.612] GetSystemMetrics (nIndex=46) returned 2 [0037.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.612] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.616] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.616] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.616] GetLastError () returned 0x578 [0037.616] CanUserWritePwrScheme () returned 1 [0037.617] GetSystemMetrics (nIndex=46) returned 2 [0037.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.617] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.617] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.617] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.622] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.622] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.622] GetLastError () returned 0x578 [0037.622] CanUserWritePwrScheme () returned 1 [0037.622] GetSystemMetrics (nIndex=46) returned 2 [0037.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.622] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.622] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.622] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.626] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.626] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.626] GetLastError () returned 0x578 [0037.626] CanUserWritePwrScheme () returned 1 [0037.627] GetSystemMetrics (nIndex=46) returned 2 [0037.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.627] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.627] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.627] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.631] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.631] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.631] GetLastError () returned 0x578 [0037.631] CanUserWritePwrScheme () returned 1 [0037.631] GetSystemMetrics (nIndex=46) returned 2 [0037.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.637] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.637] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.637] GetLastError () returned 0x578 [0037.637] CanUserWritePwrScheme () returned 1 [0037.637] GetSystemMetrics (nIndex=46) returned 2 [0037.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.637] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.637] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.637] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.642] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.642] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.642] GetLastError () returned 0x578 [0037.642] CanUserWritePwrScheme () returned 1 [0037.642] GetSystemMetrics (nIndex=46) returned 2 [0037.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.642] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.642] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.642] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.647] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.647] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.647] GetLastError () returned 0x578 [0037.647] CanUserWritePwrScheme () returned 1 [0037.648] GetSystemMetrics (nIndex=46) returned 2 [0037.648] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.648] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.648] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.648] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.652] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.652] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.652] GetLastError () returned 0x578 [0037.652] CanUserWritePwrScheme () returned 1 [0037.652] GetSystemMetrics (nIndex=46) returned 2 [0037.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.653] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.653] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.653] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.657] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.657] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.657] GetLastError () returned 0x578 [0037.657] CanUserWritePwrScheme () returned 1 [0037.657] GetSystemMetrics (nIndex=46) returned 2 [0037.657] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.657] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.657] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.657] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.662] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.662] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.662] GetLastError () returned 0x578 [0037.662] CanUserWritePwrScheme () returned 1 [0037.662] GetSystemMetrics (nIndex=46) returned 2 [0037.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.662] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.662] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.662] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.667] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.667] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.667] GetLastError () returned 0x578 [0037.667] CanUserWritePwrScheme () returned 1 [0037.667] GetSystemMetrics (nIndex=46) returned 2 [0037.667] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.667] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.667] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.667] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.671] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.671] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.671] GetLastError () returned 0x578 [0037.671] CanUserWritePwrScheme () returned 1 [0037.672] GetSystemMetrics (nIndex=46) returned 2 [0037.672] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.672] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.672] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.672] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.676] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.676] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.676] GetLastError () returned 0x578 [0037.676] CanUserWritePwrScheme () returned 1 [0037.676] GetSystemMetrics (nIndex=46) returned 2 [0037.676] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.676] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.676] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.676] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.680] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.680] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.680] GetLastError () returned 0x578 [0037.681] CanUserWritePwrScheme () returned 1 [0037.681] GetSystemMetrics (nIndex=46) returned 2 [0037.681] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.681] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.681] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.681] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.685] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.685] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.685] GetLastError () returned 0x578 [0037.685] CanUserWritePwrScheme () returned 1 [0037.686] GetSystemMetrics (nIndex=46) returned 2 [0037.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.686] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.686] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.686] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.690] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.690] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.690] GetLastError () returned 0x578 [0037.690] CanUserWritePwrScheme () returned 1 [0037.690] GetSystemMetrics (nIndex=46) returned 2 [0037.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.690] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.690] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.690] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.694] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.694] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.694] GetLastError () returned 0x578 [0037.694] CanUserWritePwrScheme () returned 1 [0037.695] GetSystemMetrics (nIndex=46) returned 2 [0037.695] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.695] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.695] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.695] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.699] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.699] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.699] GetLastError () returned 0x578 [0037.699] CanUserWritePwrScheme () returned 1 [0037.699] GetSystemMetrics (nIndex=46) returned 2 [0037.699] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.699] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.699] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.699] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.703] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.703] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.703] GetLastError () returned 0x578 [0037.703] CanUserWritePwrScheme () returned 1 [0037.704] GetSystemMetrics (nIndex=46) returned 2 [0037.704] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.704] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.704] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.704] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.708] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.708] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.708] GetLastError () returned 0x578 [0037.708] CanUserWritePwrScheme () returned 1 [0037.708] GetSystemMetrics (nIndex=46) returned 2 [0037.708] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.708] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.708] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.708] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.712] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.712] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.712] GetLastError () returned 0x578 [0037.712] CanUserWritePwrScheme () returned 1 [0037.713] GetSystemMetrics (nIndex=46) returned 2 [0037.713] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.713] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.713] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.713] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.717] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.717] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.717] GetLastError () returned 0x578 [0037.717] CanUserWritePwrScheme () returned 1 [0037.717] GetSystemMetrics (nIndex=46) returned 2 [0037.718] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.718] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.718] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.718] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.722] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.722] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.722] GetLastError () returned 0x578 [0037.722] CanUserWritePwrScheme () returned 1 [0037.722] GetSystemMetrics (nIndex=46) returned 2 [0037.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.722] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.722] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.722] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.727] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.727] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.727] GetLastError () returned 0x578 [0037.727] CanUserWritePwrScheme () returned 1 [0037.727] GetSystemMetrics (nIndex=46) returned 2 [0037.727] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.727] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.727] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.727] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.731] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.731] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.731] GetLastError () returned 0x578 [0037.731] CanUserWritePwrScheme () returned 1 [0037.732] GetSystemMetrics (nIndex=46) returned 2 [0037.732] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.732] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.732] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.732] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.736] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.736] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.736] GetLastError () returned 0x578 [0037.736] CanUserWritePwrScheme () returned 1 [0037.736] GetSystemMetrics (nIndex=46) returned 2 [0037.736] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.736] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.736] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.736] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.740] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.740] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.741] GetLastError () returned 0x578 [0037.741] CanUserWritePwrScheme () returned 1 [0037.741] GetSystemMetrics (nIndex=46) returned 2 [0037.741] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.741] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.741] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.741] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.745] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.745] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.745] GetLastError () returned 0x578 [0037.745] CanUserWritePwrScheme () returned 1 [0037.746] GetSystemMetrics (nIndex=46) returned 2 [0037.746] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.746] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.746] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.746] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.750] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.750] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.750] GetLastError () returned 0x578 [0037.750] CanUserWritePwrScheme () returned 1 [0037.750] GetSystemMetrics (nIndex=46) returned 2 [0037.750] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.750] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.750] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.750] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.754] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.754] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.754] GetLastError () returned 0x578 [0037.754] CanUserWritePwrScheme () returned 1 [0037.755] GetSystemMetrics (nIndex=46) returned 2 [0037.755] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.755] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.755] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.755] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.759] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.759] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.759] GetLastError () returned 0x578 [0037.759] CanUserWritePwrScheme () returned 1 [0037.759] GetSystemMetrics (nIndex=46) returned 2 [0037.759] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.759] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.759] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.759] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.764] GetLastError () returned 0x578 [0037.764] CanUserWritePwrScheme () returned 1 [0037.764] GetSystemMetrics (nIndex=46) returned 2 [0037.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.764] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.764] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.764] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.768] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.768] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.768] GetLastError () returned 0x578 [0037.768] CanUserWritePwrScheme () returned 1 [0037.769] GetSystemMetrics (nIndex=46) returned 2 [0037.769] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.769] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.769] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.769] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.773] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.773] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.773] GetLastError () returned 0x578 [0037.773] CanUserWritePwrScheme () returned 1 [0037.773] GetSystemMetrics (nIndex=46) returned 2 [0037.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.773] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.773] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.777] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.777] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.777] GetLastError () returned 0x578 [0037.778] CanUserWritePwrScheme () returned 1 [0037.778] GetSystemMetrics (nIndex=46) returned 2 [0037.778] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.778] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.778] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.778] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.782] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.782] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.782] GetLastError () returned 0x578 [0037.782] CanUserWritePwrScheme () returned 1 [0037.782] GetSystemMetrics (nIndex=46) returned 2 [0037.783] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.783] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.783] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.783] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.787] GetLastError () returned 0x578 [0037.787] CanUserWritePwrScheme () returned 1 [0037.787] GetSystemMetrics (nIndex=46) returned 2 [0037.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.792] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.792] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.792] GetLastError () returned 0x578 [0037.792] CanUserWritePwrScheme () returned 1 [0037.792] GetSystemMetrics (nIndex=46) returned 2 [0037.792] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.792] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.792] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.792] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.797] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.797] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.797] GetLastError () returned 0x578 [0037.797] CanUserWritePwrScheme () returned 1 [0037.797] GetSystemMetrics (nIndex=46) returned 2 [0037.797] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.797] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.797] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.797] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.801] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.801] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.801] GetLastError () returned 0x578 [0037.801] CanUserWritePwrScheme () returned 1 [0037.801] GetSystemMetrics (nIndex=46) returned 2 [0037.802] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.802] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.802] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.802] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.806] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.806] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.806] GetLastError () returned 0x578 [0037.806] CanUserWritePwrScheme () returned 1 [0037.806] GetSystemMetrics (nIndex=46) returned 2 [0037.806] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.806] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.806] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.806] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.810] GetLastError () returned 0x578 [0037.810] CanUserWritePwrScheme () returned 1 [0037.811] GetSystemMetrics (nIndex=46) returned 2 [0037.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.815] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.815] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.815] GetLastError () returned 0x578 [0037.815] CanUserWritePwrScheme () returned 1 [0037.815] GetSystemMetrics (nIndex=46) returned 2 [0037.815] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.815] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.815] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.815] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.819] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.819] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.819] GetLastError () returned 0x578 [0037.819] CanUserWritePwrScheme () returned 1 [0037.820] GetSystemMetrics (nIndex=46) returned 2 [0037.820] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.820] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.820] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.820] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.824] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.824] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.824] GetLastError () returned 0x578 [0037.824] CanUserWritePwrScheme () returned 1 [0037.824] GetSystemMetrics (nIndex=46) returned 2 [0037.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.824] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.824] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.824] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.828] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.828] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.828] GetLastError () returned 0x578 [0037.828] CanUserWritePwrScheme () returned 1 [0037.829] GetSystemMetrics (nIndex=46) returned 2 [0037.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.829] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.829] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.829] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.833] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.833] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.833] GetLastError () returned 0x578 [0037.833] CanUserWritePwrScheme () returned 1 [0037.833] GetSystemMetrics (nIndex=46) returned 2 [0037.833] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.833] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.833] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.833] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.837] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.837] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.837] GetLastError () returned 0x578 [0037.837] CanUserWritePwrScheme () returned 1 [0037.842] GetSystemMetrics (nIndex=46) returned 2 [0037.842] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.842] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.842] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.842] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.846] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.846] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.846] GetLastError () returned 0x578 [0037.846] CanUserWritePwrScheme () returned 1 [0037.847] GetSystemMetrics (nIndex=46) returned 2 [0037.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.847] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.847] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.847] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.851] GetLastError () returned 0x578 [0037.851] CanUserWritePwrScheme () returned 1 [0037.851] GetSystemMetrics (nIndex=46) returned 2 [0037.851] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.851] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.851] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.851] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.855] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.855] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.855] GetLastError () returned 0x578 [0037.855] CanUserWritePwrScheme () returned 1 [0037.856] GetSystemMetrics (nIndex=46) returned 2 [0037.856] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.856] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.856] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.860] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.860] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.860] GetLastError () returned 0x578 [0037.860] CanUserWritePwrScheme () returned 1 [0037.860] GetSystemMetrics (nIndex=46) returned 2 [0037.860] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.865] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.865] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.865] GetLastError () returned 0x578 [0037.865] CanUserWritePwrScheme () returned 1 [0037.865] GetSystemMetrics (nIndex=46) returned 2 [0037.865] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.865] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.865] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.865] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.870] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.870] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.870] GetLastError () returned 0x578 [0037.870] CanUserWritePwrScheme () returned 1 [0037.870] GetSystemMetrics (nIndex=46) returned 2 [0037.870] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.870] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.870] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.870] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.875] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.875] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.875] GetLastError () returned 0x578 [0037.875] CanUserWritePwrScheme () returned 1 [0037.875] GetSystemMetrics (nIndex=46) returned 2 [0037.875] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.875] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.875] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.875] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.880] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.880] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.880] GetLastError () returned 0x578 [0037.880] CanUserWritePwrScheme () returned 1 [0037.881] GetSystemMetrics (nIndex=46) returned 2 [0037.881] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.881] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.881] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.881] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.885] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.885] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.885] GetLastError () returned 0x578 [0037.885] CanUserWritePwrScheme () returned 1 [0037.886] GetSystemMetrics (nIndex=46) returned 2 [0037.886] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.886] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.886] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.886] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.890] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.890] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.890] GetLastError () returned 0x578 [0037.890] CanUserWritePwrScheme () returned 1 [0037.890] GetSystemMetrics (nIndex=46) returned 2 [0037.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.890] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.894] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.894] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.894] GetLastError () returned 0x578 [0037.895] CanUserWritePwrScheme () returned 1 [0037.895] GetSystemMetrics (nIndex=46) returned 2 [0037.895] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.895] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.895] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.895] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.899] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.899] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.899] GetLastError () returned 0x578 [0037.899] CanUserWritePwrScheme () returned 1 [0037.899] GetSystemMetrics (nIndex=46) returned 2 [0037.899] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.899] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.899] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.899] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.904] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.904] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.904] GetLastError () returned 0x578 [0037.904] CanUserWritePwrScheme () returned 1 [0037.904] GetSystemMetrics (nIndex=46) returned 2 [0037.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.904] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.904] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.904] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.908] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.908] GetLastError () returned 0x578 [0037.908] CanUserWritePwrScheme () returned 1 [0037.909] GetSystemMetrics (nIndex=46) returned 2 [0037.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.909] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.909] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.909] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.913] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.913] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.913] GetLastError () returned 0x578 [0037.913] CanUserWritePwrScheme () returned 1 [0037.913] GetSystemMetrics (nIndex=46) returned 2 [0037.913] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.913] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.913] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.913] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.917] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.917] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.917] GetLastError () returned 0x578 [0037.917] CanUserWritePwrScheme () returned 1 [0037.918] GetSystemMetrics (nIndex=46) returned 2 [0037.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.918] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.918] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.918] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.922] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.922] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.922] GetLastError () returned 0x578 [0037.922] CanUserWritePwrScheme () returned 1 [0037.922] GetSystemMetrics (nIndex=46) returned 2 [0037.922] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.922] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.922] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.922] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.926] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.926] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.926] GetLastError () returned 0x578 [0037.926] CanUserWritePwrScheme () returned 1 [0037.927] GetSystemMetrics (nIndex=46) returned 2 [0037.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.927] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.927] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.927] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.931] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.931] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.931] GetLastError () returned 0x578 [0037.931] CanUserWritePwrScheme () returned 1 [0037.931] GetSystemMetrics (nIndex=46) returned 2 [0037.931] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.931] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.931] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.931] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.935] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.935] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.935] GetLastError () returned 0x578 [0037.935] CanUserWritePwrScheme () returned 1 [0037.936] GetSystemMetrics (nIndex=46) returned 2 [0037.936] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.936] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.936] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.936] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.940] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.940] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.940] GetLastError () returned 0x578 [0037.940] CanUserWritePwrScheme () returned 1 [0037.940] GetSystemMetrics (nIndex=46) returned 2 [0037.940] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.940] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.940] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.940] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.944] GetLastError () returned 0x578 [0037.944] CanUserWritePwrScheme () returned 1 [0037.945] GetSystemMetrics (nIndex=46) returned 2 [0037.945] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.945] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.945] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.945] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.949] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.949] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.949] GetLastError () returned 0x578 [0037.949] CanUserWritePwrScheme () returned 1 [0037.949] GetSystemMetrics (nIndex=46) returned 2 [0037.949] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.949] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.949] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.949] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.953] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.953] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.953] GetLastError () returned 0x578 [0037.953] CanUserWritePwrScheme () returned 1 [0037.954] GetSystemMetrics (nIndex=46) returned 2 [0037.954] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.954] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.954] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.954] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.958] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.958] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.958] GetLastError () returned 0x578 [0037.958] CanUserWritePwrScheme () returned 1 [0037.958] GetSystemMetrics (nIndex=46) returned 2 [0037.958] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.958] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.958] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.958] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.972] GetLastError () returned 0x578 [0037.972] CanUserWritePwrScheme () returned 1 [0037.973] GetSystemMetrics (nIndex=46) returned 2 [0037.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.979] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.979] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.979] GetLastError () returned 0x578 [0037.979] CanUserWritePwrScheme () returned 1 [0037.979] GetSystemMetrics (nIndex=46) returned 2 [0037.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.979] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.979] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.979] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.983] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.983] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.983] GetLastError () returned 0x578 [0037.983] CanUserWritePwrScheme () returned 1 [0037.984] GetSystemMetrics (nIndex=46) returned 2 [0037.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.988] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.988] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.988] GetLastError () returned 0x578 [0037.988] CanUserWritePwrScheme () returned 1 [0037.989] GetSystemMetrics (nIndex=46) returned 2 [0037.989] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.989] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.989] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.989] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.993] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.993] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.993] GetLastError () returned 0x578 [0037.993] CanUserWritePwrScheme () returned 1 [0037.993] GetSystemMetrics (nIndex=46) returned 2 [0037.993] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.993] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.993] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.993] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0037.998] GetWindowTextLengthA (hWnd=0x0) returned 0 [0037.998] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0037.998] GetLastError () returned 0x578 [0037.998] CanUserWritePwrScheme () returned 1 [0037.998] GetSystemMetrics (nIndex=46) returned 2 [0037.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0037.998] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0037.998] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0037.998] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.002] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.002] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.002] GetLastError () returned 0x578 [0038.002] CanUserWritePwrScheme () returned 1 [0038.003] GetSystemMetrics (nIndex=46) returned 2 [0038.003] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.003] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.003] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.003] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.007] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.007] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.007] GetLastError () returned 0x578 [0038.007] CanUserWritePwrScheme () returned 1 [0038.007] GetSystemMetrics (nIndex=46) returned 2 [0038.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.007] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.007] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.007] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.011] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.011] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.011] GetLastError () returned 0x578 [0038.011] CanUserWritePwrScheme () returned 1 [0038.012] GetSystemMetrics (nIndex=46) returned 2 [0038.012] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.012] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.012] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.012] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.016] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.016] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.016] GetLastError () returned 0x578 [0038.016] CanUserWritePwrScheme () returned 1 [0038.016] GetSystemMetrics (nIndex=46) returned 2 [0038.016] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.016] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.016] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.016] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.020] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.020] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.020] GetLastError () returned 0x578 [0038.020] CanUserWritePwrScheme () returned 1 [0038.021] GetSystemMetrics (nIndex=46) returned 2 [0038.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.021] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.021] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.021] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.025] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.025] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.025] GetLastError () returned 0x578 [0038.025] CanUserWritePwrScheme () returned 1 [0038.026] GetSystemMetrics (nIndex=46) returned 2 [0038.026] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.026] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.026] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.026] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.030] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.030] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.030] GetLastError () returned 0x578 [0038.030] CanUserWritePwrScheme () returned 1 [0038.030] GetSystemMetrics (nIndex=46) returned 2 [0038.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.030] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.030] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.030] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.034] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.034] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.034] GetLastError () returned 0x578 [0038.034] CanUserWritePwrScheme () returned 1 [0038.035] GetSystemMetrics (nIndex=46) returned 2 [0038.035] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.035] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.035] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.035] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.039] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.039] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.039] GetLastError () returned 0x578 [0038.039] CanUserWritePwrScheme () returned 1 [0038.039] GetSystemMetrics (nIndex=46) returned 2 [0038.039] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.039] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.039] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.039] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.043] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.043] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.043] GetLastError () returned 0x578 [0038.043] CanUserWritePwrScheme () returned 1 [0038.044] GetSystemMetrics (nIndex=46) returned 2 [0038.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.044] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.044] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.044] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.048] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.048] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.048] GetLastError () returned 0x578 [0038.048] CanUserWritePwrScheme () returned 1 [0038.048] GetSystemMetrics (nIndex=46) returned 2 [0038.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.048] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.048] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.048] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.052] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.052] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.052] GetLastError () returned 0x578 [0038.052] CanUserWritePwrScheme () returned 1 [0038.053] GetSystemMetrics (nIndex=46) returned 2 [0038.053] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.053] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.053] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.053] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.057] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.057] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.057] GetLastError () returned 0x578 [0038.057] CanUserWritePwrScheme () returned 1 [0038.057] GetSystemMetrics (nIndex=46) returned 2 [0038.057] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.057] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.058] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.058] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.061] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.062] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.062] GetLastError () returned 0x578 [0038.062] CanUserWritePwrScheme () returned 1 [0038.062] GetSystemMetrics (nIndex=46) returned 2 [0038.062] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.062] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.062] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.062] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.066] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.066] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.066] GetLastError () returned 0x578 [0038.066] CanUserWritePwrScheme () returned 1 [0038.066] GetSystemMetrics (nIndex=46) returned 2 [0038.066] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.066] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.066] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.067] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.070] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.070] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.071] GetLastError () returned 0x578 [0038.071] CanUserWritePwrScheme () returned 1 [0038.071] GetSystemMetrics (nIndex=46) returned 2 [0038.071] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.071] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.071] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.071] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.075] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.075] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.075] GetLastError () returned 0x578 [0038.075] CanUserWritePwrScheme () returned 1 [0038.075] GetSystemMetrics (nIndex=46) returned 2 [0038.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.076] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.076] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.076] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.080] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.080] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.080] GetLastError () returned 0x578 [0038.080] CanUserWritePwrScheme () returned 1 [0038.080] GetSystemMetrics (nIndex=46) returned 2 [0038.080] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.080] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.080] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.080] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.084] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.084] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.084] GetLastError () returned 0x578 [0038.084] CanUserWritePwrScheme () returned 1 [0038.085] GetSystemMetrics (nIndex=46) returned 2 [0038.085] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.085] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.085] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.085] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.089] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.089] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.089] GetLastError () returned 0x578 [0038.089] CanUserWritePwrScheme () returned 1 [0038.089] GetSystemMetrics (nIndex=46) returned 2 [0038.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.089] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.089] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.089] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.093] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.093] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.093] GetLastError () returned 0x578 [0038.094] CanUserWritePwrScheme () returned 1 [0038.094] GetSystemMetrics (nIndex=46) returned 2 [0038.094] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.094] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.094] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.094] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.098] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.098] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.098] GetLastError () returned 0x578 [0038.098] CanUserWritePwrScheme () returned 1 [0038.098] GetSystemMetrics (nIndex=46) returned 2 [0038.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.098] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.098] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.098] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.102] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.102] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.102] GetLastError () returned 0x578 [0038.103] CanUserWritePwrScheme () returned 1 [0038.103] GetSystemMetrics (nIndex=46) returned 2 [0038.103] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.103] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.103] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.103] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.107] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.107] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.107] GetLastError () returned 0x578 [0038.107] CanUserWritePwrScheme () returned 1 [0038.107] GetSystemMetrics (nIndex=46) returned 2 [0038.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.107] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.111] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.111] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.111] GetLastError () returned 0x578 [0038.112] CanUserWritePwrScheme () returned 1 [0038.112] GetSystemMetrics (nIndex=46) returned 2 [0038.112] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.112] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.112] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.112] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.116] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.116] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.116] GetLastError () returned 0x578 [0038.116] CanUserWritePwrScheme () returned 1 [0038.116] GetSystemMetrics (nIndex=46) returned 2 [0038.116] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.116] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.116] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.116] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.127] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.128] GetLastError () returned 0x578 [0038.128] CanUserWritePwrScheme () returned 1 [0038.128] GetSystemMetrics (nIndex=46) returned 2 [0038.128] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.128] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.128] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.128] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.132] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.132] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.132] GetLastError () returned 0x578 [0038.132] CanUserWritePwrScheme () returned 1 [0038.133] GetSystemMetrics (nIndex=46) returned 2 [0038.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.133] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.133] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.133] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.137] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.137] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.137] GetLastError () returned 0x578 [0038.137] CanUserWritePwrScheme () returned 1 [0038.137] GetSystemMetrics (nIndex=46) returned 2 [0038.137] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.137] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.137] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.137] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.141] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.141] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.141] GetLastError () returned 0x578 [0038.142] CanUserWritePwrScheme () returned 1 [0038.142] GetSystemMetrics (nIndex=46) returned 2 [0038.142] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.142] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.142] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.142] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.146] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.146] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.146] GetLastError () returned 0x578 [0038.146] CanUserWritePwrScheme () returned 1 [0038.146] GetSystemMetrics (nIndex=46) returned 2 [0038.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.146] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.146] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.146] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.151] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.151] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.151] GetLastError () returned 0x578 [0038.151] CanUserWritePwrScheme () returned 1 [0038.151] GetSystemMetrics (nIndex=46) returned 2 [0038.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.151] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.151] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.151] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.155] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.155] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.155] GetLastError () returned 0x578 [0038.155] CanUserWritePwrScheme () returned 1 [0038.156] GetSystemMetrics (nIndex=46) returned 2 [0038.156] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.156] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.156] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.156] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.160] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.160] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.160] GetLastError () returned 0x578 [0038.160] CanUserWritePwrScheme () returned 1 [0038.160] GetSystemMetrics (nIndex=46) returned 2 [0038.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.160] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.160] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.160] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.164] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.164] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.164] GetLastError () returned 0x578 [0038.164] CanUserWritePwrScheme () returned 1 [0038.165] GetSystemMetrics (nIndex=46) returned 2 [0038.165] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.165] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.165] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.165] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.169] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.169] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.169] GetLastError () returned 0x578 [0038.169] CanUserWritePwrScheme () returned 1 [0038.169] GetSystemMetrics (nIndex=46) returned 2 [0038.169] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.169] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.169] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.169] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.173] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.173] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.173] GetLastError () returned 0x578 [0038.173] CanUserWritePwrScheme () returned 1 [0038.174] GetSystemMetrics (nIndex=46) returned 2 [0038.174] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.174] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.174] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.174] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.178] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.178] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.178] GetLastError () returned 0x578 [0038.178] CanUserWritePwrScheme () returned 1 [0038.179] GetSystemMetrics (nIndex=46) returned 2 [0038.179] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.179] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.179] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.179] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.183] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.183] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.183] GetLastError () returned 0x578 [0038.183] CanUserWritePwrScheme () returned 1 [0038.184] GetSystemMetrics (nIndex=46) returned 2 [0038.184] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.184] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.184] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.184] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.188] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.188] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.188] GetLastError () returned 0x578 [0038.188] CanUserWritePwrScheme () returned 1 [0038.188] GetSystemMetrics (nIndex=46) returned 2 [0038.188] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.188] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.188] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.188] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.192] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.192] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.193] GetLastError () returned 0x578 [0038.193] CanUserWritePwrScheme () returned 1 [0038.193] GetSystemMetrics (nIndex=46) returned 2 [0038.193] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.193] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.193] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.193] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.197] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.197] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.197] GetLastError () returned 0x578 [0038.197] CanUserWritePwrScheme () returned 1 [0038.197] GetSystemMetrics (nIndex=46) returned 2 [0038.197] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.197] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.198] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.198] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.201] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.202] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.202] GetLastError () returned 0x578 [0038.202] CanUserWritePwrScheme () returned 1 [0038.202] GetSystemMetrics (nIndex=46) returned 2 [0038.202] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.202] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.202] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.202] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.206] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.206] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.206] GetLastError () returned 0x578 [0038.206] CanUserWritePwrScheme () returned 1 [0038.206] GetSystemMetrics (nIndex=46) returned 2 [0038.207] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.207] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.207] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.207] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.211] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.211] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.211] GetLastError () returned 0x578 [0038.211] CanUserWritePwrScheme () returned 1 [0038.211] GetSystemMetrics (nIndex=46) returned 2 [0038.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.211] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.211] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.211] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.216] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.216] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.216] GetLastError () returned 0x578 [0038.216] CanUserWritePwrScheme () returned 1 [0038.216] GetSystemMetrics (nIndex=46) returned 2 [0038.216] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.216] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.216] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.216] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.220] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.220] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.220] GetLastError () returned 0x578 [0038.220] CanUserWritePwrScheme () returned 1 [0038.221] GetSystemMetrics (nIndex=46) returned 2 [0038.221] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.221] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.221] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.221] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.225] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.225] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.225] GetLastError () returned 0x578 [0038.225] CanUserWritePwrScheme () returned 1 [0038.226] GetSystemMetrics (nIndex=46) returned 2 [0038.226] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.226] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.226] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.226] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.231] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.231] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.231] GetLastError () returned 0x578 [0038.231] CanUserWritePwrScheme () returned 1 [0038.231] GetSystemMetrics (nIndex=46) returned 2 [0038.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.231] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.231] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.231] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.235] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.236] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.236] GetLastError () returned 0x578 [0038.236] CanUserWritePwrScheme () returned 1 [0038.236] GetSystemMetrics (nIndex=46) returned 2 [0038.236] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.236] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.236] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.236] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.240] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.240] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.240] GetLastError () returned 0x578 [0038.240] CanUserWritePwrScheme () returned 1 [0038.241] GetSystemMetrics (nIndex=46) returned 2 [0038.241] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.241] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.241] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.241] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.246] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.246] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.246] GetLastError () returned 0x578 [0038.246] CanUserWritePwrScheme () returned 1 [0038.246] GetSystemMetrics (nIndex=46) returned 2 [0038.246] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.246] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.246] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.246] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.251] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.251] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.251] GetLastError () returned 0x578 [0038.251] CanUserWritePwrScheme () returned 1 [0038.251] GetSystemMetrics (nIndex=46) returned 2 [0038.251] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.251] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.251] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.251] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.256] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.256] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.256] GetLastError () returned 0x578 [0038.256] CanUserWritePwrScheme () returned 1 [0038.256] GetSystemMetrics (nIndex=46) returned 2 [0038.256] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.256] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.256] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.256] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.261] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.261] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.261] GetLastError () returned 0x578 [0038.261] CanUserWritePwrScheme () returned 1 [0038.261] GetSystemMetrics (nIndex=46) returned 2 [0038.261] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.261] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.261] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.261] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.266] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.266] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.266] GetLastError () returned 0x578 [0038.266] CanUserWritePwrScheme () returned 1 [0038.266] GetSystemMetrics (nIndex=46) returned 2 [0038.266] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.266] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.266] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.266] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.271] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.271] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.271] GetLastError () returned 0x578 [0038.271] CanUserWritePwrScheme () returned 1 [0038.271] GetSystemMetrics (nIndex=46) returned 2 [0038.271] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.271] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.271] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.271] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.276] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.276] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.276] GetLastError () returned 0x578 [0038.276] CanUserWritePwrScheme () returned 1 [0038.276] GetSystemMetrics (nIndex=46) returned 2 [0038.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.276] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.276] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.276] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.281] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.281] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.281] GetLastError () returned 0x578 [0038.281] CanUserWritePwrScheme () returned 1 [0038.281] GetSystemMetrics (nIndex=46) returned 2 [0038.281] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.281] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.281] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.281] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.285] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.285] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.285] GetLastError () returned 0x578 [0038.285] CanUserWritePwrScheme () returned 1 [0038.286] GetSystemMetrics (nIndex=46) returned 2 [0038.286] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.286] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.286] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.286] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.290] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.290] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.290] GetLastError () returned 0x578 [0038.290] CanUserWritePwrScheme () returned 1 [0038.290] GetSystemMetrics (nIndex=46) returned 2 [0038.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.294] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.294] GetLastError () returned 0x578 [0038.294] CanUserWritePwrScheme () returned 1 [0038.294] GetSystemMetrics (nIndex=46) returned 2 [0038.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.299] GetLastError () returned 0x578 [0038.299] CanUserWritePwrScheme () returned 1 [0038.299] GetSystemMetrics (nIndex=46) returned 2 [0038.299] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.299] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.299] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.299] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.303] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.303] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.303] GetLastError () returned 0x578 [0038.303] CanUserWritePwrScheme () returned 1 [0038.304] GetSystemMetrics (nIndex=46) returned 2 [0038.304] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.304] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.304] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.304] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.308] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.308] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.308] GetLastError () returned 0x578 [0038.308] CanUserWritePwrScheme () returned 1 [0038.309] GetSystemMetrics (nIndex=46) returned 2 [0038.309] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.309] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.309] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.309] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.313] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.313] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.313] GetLastError () returned 0x578 [0038.313] CanUserWritePwrScheme () returned 1 [0038.313] GetSystemMetrics (nIndex=46) returned 2 [0038.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.313] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.313] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.313] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.317] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.317] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.317] GetLastError () returned 0x578 [0038.317] CanUserWritePwrScheme () returned 1 [0038.318] GetSystemMetrics (nIndex=46) returned 2 [0038.318] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.318] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.318] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.318] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.322] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.322] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.322] GetLastError () returned 0x578 [0038.322] CanUserWritePwrScheme () returned 1 [0038.322] GetSystemMetrics (nIndex=46) returned 2 [0038.322] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.322] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.322] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.322] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.326] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.326] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.326] GetLastError () returned 0x578 [0038.327] CanUserWritePwrScheme () returned 1 [0038.327] GetSystemMetrics (nIndex=46) returned 2 [0038.327] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.327] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.327] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.327] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.331] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.331] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.331] GetLastError () returned 0x578 [0038.331] CanUserWritePwrScheme () returned 1 [0038.332] GetSystemMetrics (nIndex=46) returned 2 [0038.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.336] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.336] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.336] GetLastError () returned 0x578 [0038.336] CanUserWritePwrScheme () returned 1 [0038.336] GetSystemMetrics (nIndex=46) returned 2 [0038.336] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.336] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.336] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.336] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.342] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.342] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.342] GetLastError () returned 0x578 [0038.342] CanUserWritePwrScheme () returned 1 [0038.342] GetSystemMetrics (nIndex=46) returned 2 [0038.342] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.342] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.342] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.342] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.346] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.346] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.346] GetLastError () returned 0x578 [0038.346] CanUserWritePwrScheme () returned 1 [0038.347] GetSystemMetrics (nIndex=46) returned 2 [0038.347] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.347] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.347] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.347] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.351] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.351] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.351] GetLastError () returned 0x578 [0038.351] CanUserWritePwrScheme () returned 1 [0038.351] GetSystemMetrics (nIndex=46) returned 2 [0038.351] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.351] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.352] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.352] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.356] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.356] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.356] GetLastError () returned 0x578 [0038.356] CanUserWritePwrScheme () returned 1 [0038.356] GetSystemMetrics (nIndex=46) returned 2 [0038.356] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.356] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.356] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.356] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.360] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.360] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.360] GetLastError () returned 0x578 [0038.360] CanUserWritePwrScheme () returned 1 [0038.361] GetSystemMetrics (nIndex=46) returned 2 [0038.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.361] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.361] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.361] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.365] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.365] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.365] GetLastError () returned 0x578 [0038.365] CanUserWritePwrScheme () returned 1 [0038.365] GetSystemMetrics (nIndex=46) returned 2 [0038.365] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.365] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.365] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.365] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.370] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.370] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.370] GetLastError () returned 0x578 [0038.370] CanUserWritePwrScheme () returned 1 [0038.370] GetSystemMetrics (nIndex=46) returned 2 [0038.370] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.370] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.370] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.370] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.374] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.375] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.375] GetLastError () returned 0x578 [0038.375] CanUserWritePwrScheme () returned 1 [0038.375] GetSystemMetrics (nIndex=46) returned 2 [0038.375] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.375] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.375] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.375] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.379] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.379] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.379] GetLastError () returned 0x578 [0038.379] CanUserWritePwrScheme () returned 1 [0038.380] GetSystemMetrics (nIndex=46) returned 2 [0038.380] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.380] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.380] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.380] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.384] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.384] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.384] GetLastError () returned 0x578 [0038.384] CanUserWritePwrScheme () returned 1 [0038.384] GetSystemMetrics (nIndex=46) returned 2 [0038.385] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.385] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.385] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.385] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.389] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.389] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.389] GetLastError () returned 0x578 [0038.389] CanUserWritePwrScheme () returned 1 [0038.389] GetSystemMetrics (nIndex=46) returned 2 [0038.389] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.389] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.389] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.389] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.394] GetLastError () returned 0x578 [0038.394] CanUserWritePwrScheme () returned 1 [0038.394] GetSystemMetrics (nIndex=46) returned 2 [0038.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.394] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.394] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.394] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.398] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.398] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.398] GetLastError () returned 0x578 [0038.398] CanUserWritePwrScheme () returned 1 [0038.398] GetSystemMetrics (nIndex=46) returned 2 [0038.398] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.398] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.399] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.399] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.403] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.403] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.403] GetLastError () returned 0x578 [0038.403] CanUserWritePwrScheme () returned 1 [0038.403] GetSystemMetrics (nIndex=46) returned 2 [0038.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.403] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.403] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.403] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.407] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.407] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.407] GetLastError () returned 0x578 [0038.407] CanUserWritePwrScheme () returned 1 [0038.408] GetSystemMetrics (nIndex=46) returned 2 [0038.408] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.408] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.408] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.408] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.412] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.412] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.412] GetLastError () returned 0x578 [0038.412] CanUserWritePwrScheme () returned 1 [0038.413] GetSystemMetrics (nIndex=46) returned 2 [0038.413] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.413] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.413] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.413] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.423] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.423] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.423] GetLastError () returned 0x578 [0038.423] CanUserWritePwrScheme () returned 1 [0038.423] GetSystemMetrics (nIndex=46) returned 2 [0038.423] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.423] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.423] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.423] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.428] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.428] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.428] GetLastError () returned 0x578 [0038.428] CanUserWritePwrScheme () returned 1 [0038.428] GetSystemMetrics (nIndex=46) returned 2 [0038.428] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.428] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.428] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.428] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.433] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.433] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.433] GetLastError () returned 0x578 [0038.433] CanUserWritePwrScheme () returned 1 [0038.433] GetSystemMetrics (nIndex=46) returned 2 [0038.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.433] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.433] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.433] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.438] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.438] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.438] GetLastError () returned 0x578 [0038.438] CanUserWritePwrScheme () returned 1 [0038.438] GetSystemMetrics (nIndex=46) returned 2 [0038.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.438] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.443] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.443] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.443] GetLastError () returned 0x578 [0038.443] CanUserWritePwrScheme () returned 1 [0038.443] GetSystemMetrics (nIndex=46) returned 2 [0038.443] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.443] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.443] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.443] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.448] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.448] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.448] GetLastError () returned 0x578 [0038.448] CanUserWritePwrScheme () returned 1 [0038.448] GetSystemMetrics (nIndex=46) returned 2 [0038.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.448] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.448] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.448] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.452] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.452] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.453] GetLastError () returned 0x578 [0038.453] CanUserWritePwrScheme () returned 1 [0038.453] GetSystemMetrics (nIndex=46) returned 2 [0038.453] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.453] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.453] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.453] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.457] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.457] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.457] GetLastError () returned 0x578 [0038.457] CanUserWritePwrScheme () returned 1 [0038.457] GetSystemMetrics (nIndex=46) returned 2 [0038.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.457] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.457] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.457] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.461] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.461] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.462] GetLastError () returned 0x578 [0038.462] CanUserWritePwrScheme () returned 1 [0038.462] GetSystemMetrics (nIndex=46) returned 2 [0038.462] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.462] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.462] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.462] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.466] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.466] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.466] GetLastError () returned 0x578 [0038.466] CanUserWritePwrScheme () returned 1 [0038.467] GetSystemMetrics (nIndex=46) returned 2 [0038.467] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.467] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.467] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.467] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.471] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.471] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.471] GetLastError () returned 0x578 [0038.471] CanUserWritePwrScheme () returned 1 [0038.471] GetSystemMetrics (nIndex=46) returned 2 [0038.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.475] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.475] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.475] GetLastError () returned 0x578 [0038.475] CanUserWritePwrScheme () returned 1 [0038.475] GetSystemMetrics (nIndex=46) returned 2 [0038.475] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.476] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.476] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.476] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.480] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.480] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.480] GetLastError () returned 0x578 [0038.480] CanUserWritePwrScheme () returned 1 [0038.480] GetSystemMetrics (nIndex=46) returned 2 [0038.480] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.480] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.480] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.480] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.484] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.484] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.484] GetLastError () returned 0x578 [0038.484] CanUserWritePwrScheme () returned 1 [0038.484] GetSystemMetrics (nIndex=46) returned 2 [0038.484] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.485] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.485] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.485] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.489] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.489] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.489] GetLastError () returned 0x578 [0038.489] CanUserWritePwrScheme () returned 1 [0038.489] GetSystemMetrics (nIndex=46) returned 2 [0038.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.489] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.489] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.489] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.493] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.493] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.493] GetLastError () returned 0x578 [0038.493] CanUserWritePwrScheme () returned 1 [0038.494] GetSystemMetrics (nIndex=46) returned 2 [0038.494] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.494] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.494] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.494] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.498] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.498] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.498] GetLastError () returned 0x578 [0038.498] CanUserWritePwrScheme () returned 1 [0038.498] GetSystemMetrics (nIndex=46) returned 2 [0038.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.498] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.498] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.498] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.502] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.502] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.502] GetLastError () returned 0x578 [0038.502] CanUserWritePwrScheme () returned 1 [0038.503] GetSystemMetrics (nIndex=46) returned 2 [0038.503] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.503] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.503] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.503] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.507] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.507] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.507] GetLastError () returned 0x578 [0038.507] CanUserWritePwrScheme () returned 1 [0038.507] GetSystemMetrics (nIndex=46) returned 2 [0038.507] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.507] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.507] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.507] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.511] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.511] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.511] GetLastError () returned 0x578 [0038.511] CanUserWritePwrScheme () returned 1 [0038.512] GetSystemMetrics (nIndex=46) returned 2 [0038.512] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.512] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.512] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.512] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.516] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.516] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.516] GetLastError () returned 0x578 [0038.516] CanUserWritePwrScheme () returned 1 [0038.516] GetSystemMetrics (nIndex=46) returned 2 [0038.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.520] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.520] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.520] GetLastError () returned 0x578 [0038.520] CanUserWritePwrScheme () returned 1 [0038.520] GetSystemMetrics (nIndex=46) returned 2 [0038.521] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.521] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.521] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.521] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.525] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.525] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.525] GetLastError () returned 0x578 [0038.525] CanUserWritePwrScheme () returned 1 [0038.525] GetSystemMetrics (nIndex=46) returned 2 [0038.525] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.525] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.525] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.525] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.529] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.529] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.529] GetLastError () returned 0x578 [0038.529] CanUserWritePwrScheme () returned 1 [0038.530] GetSystemMetrics (nIndex=46) returned 2 [0038.530] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.530] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.530] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.530] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.534] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.534] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.534] GetLastError () returned 0x578 [0038.534] CanUserWritePwrScheme () returned 1 [0038.534] GetSystemMetrics (nIndex=46) returned 2 [0038.534] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.534] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.534] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.534] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.539] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.539] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.539] GetLastError () returned 0x578 [0038.539] CanUserWritePwrScheme () returned 1 [0038.539] GetSystemMetrics (nIndex=46) returned 2 [0038.539] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.539] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.539] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.539] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.544] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.544] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.544] GetLastError () returned 0x578 [0038.544] CanUserWritePwrScheme () returned 1 [0038.544] GetSystemMetrics (nIndex=46) returned 2 [0038.544] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.544] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.544] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.544] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.548] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.548] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.548] GetLastError () returned 0x578 [0038.548] CanUserWritePwrScheme () returned 1 [0038.549] GetSystemMetrics (nIndex=46) returned 2 [0038.549] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.549] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.549] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.549] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.553] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.553] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.553] GetLastError () returned 0x578 [0038.553] CanUserWritePwrScheme () returned 1 [0038.554] GetSystemMetrics (nIndex=46) returned 2 [0038.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.554] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.554] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.554] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.558] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.558] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.558] GetLastError () returned 0x578 [0038.558] CanUserWritePwrScheme () returned 1 [0038.559] GetSystemMetrics (nIndex=46) returned 2 [0038.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.559] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.559] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.559] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.563] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.563] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.563] GetLastError () returned 0x578 [0038.563] CanUserWritePwrScheme () returned 1 [0038.563] GetSystemMetrics (nIndex=46) returned 2 [0038.563] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.563] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.564] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.564] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.567] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.567] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.568] GetLastError () returned 0x578 [0038.568] CanUserWritePwrScheme () returned 1 [0038.568] GetSystemMetrics (nIndex=46) returned 2 [0038.568] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.568] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.568] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.568] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.572] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.572] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.572] GetLastError () returned 0x578 [0038.572] CanUserWritePwrScheme () returned 1 [0038.572] GetSystemMetrics (nIndex=46) returned 2 [0038.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.573] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.573] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.573] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.577] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.577] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.577] GetLastError () returned 0x578 [0038.577] CanUserWritePwrScheme () returned 1 [0038.577] GetSystemMetrics (nIndex=46) returned 2 [0038.577] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.577] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.578] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.578] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.582] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.582] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.582] GetLastError () returned 0x578 [0038.582] CanUserWritePwrScheme () returned 1 [0038.582] GetSystemMetrics (nIndex=46) returned 2 [0038.582] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.582] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.582] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.582] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.586] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.586] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.587] GetLastError () returned 0x578 [0038.587] CanUserWritePwrScheme () returned 1 [0038.587] GetSystemMetrics (nIndex=46) returned 2 [0038.587] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.587] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.587] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.587] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.591] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.591] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.591] GetLastError () returned 0x578 [0038.591] CanUserWritePwrScheme () returned 1 [0038.592] GetSystemMetrics (nIndex=46) returned 2 [0038.592] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.592] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.592] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.592] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.596] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.596] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.596] GetLastError () returned 0x578 [0038.596] CanUserWritePwrScheme () returned 1 [0038.596] GetSystemMetrics (nIndex=46) returned 2 [0038.596] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.596] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.596] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.596] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.600] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.600] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.600] GetLastError () returned 0x578 [0038.601] CanUserWritePwrScheme () returned 1 [0038.601] GetSystemMetrics (nIndex=46) returned 2 [0038.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.605] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.605] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.605] GetLastError () returned 0x578 [0038.605] CanUserWritePwrScheme () returned 1 [0038.606] GetSystemMetrics (nIndex=46) returned 2 [0038.606] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.606] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.606] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.606] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.610] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.610] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.610] GetLastError () returned 0x578 [0038.610] CanUserWritePwrScheme () returned 1 [0038.610] GetSystemMetrics (nIndex=46) returned 2 [0038.610] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.610] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.610] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.610] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.614] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.614] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.614] GetLastError () returned 0x578 [0038.614] CanUserWritePwrScheme () returned 1 [0038.615] GetSystemMetrics (nIndex=46) returned 2 [0038.615] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.615] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.615] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.615] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.619] GetLastError () returned 0x578 [0038.619] CanUserWritePwrScheme () returned 1 [0038.620] GetSystemMetrics (nIndex=46) returned 2 [0038.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.624] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.624] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.624] GetLastError () returned 0x578 [0038.624] CanUserWritePwrScheme () returned 1 [0038.624] GetSystemMetrics (nIndex=46) returned 2 [0038.624] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.624] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.624] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.624] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.628] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.628] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.628] GetLastError () returned 0x578 [0038.628] CanUserWritePwrScheme () returned 1 [0038.629] GetSystemMetrics (nIndex=46) returned 2 [0038.629] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.629] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.629] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.629] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.633] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.633] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.633] GetLastError () returned 0x578 [0038.633] CanUserWritePwrScheme () returned 1 [0038.633] GetSystemMetrics (nIndex=46) returned 2 [0038.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.638] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.638] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.638] GetLastError () returned 0x578 [0038.638] CanUserWritePwrScheme () returned 1 [0038.639] GetSystemMetrics (nIndex=46) returned 2 [0038.639] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.639] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.639] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.639] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.643] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.643] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.643] GetLastError () returned 0x578 [0038.643] CanUserWritePwrScheme () returned 1 [0038.643] GetSystemMetrics (nIndex=46) returned 2 [0038.643] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.643] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.644] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.644] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.647] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.648] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.648] GetLastError () returned 0x578 [0038.648] CanUserWritePwrScheme () returned 1 [0038.648] GetSystemMetrics (nIndex=46) returned 2 [0038.648] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.648] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.648] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.648] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.721] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.721] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.721] GetLastError () returned 0x578 [0038.721] CanUserWritePwrScheme () returned 1 [0038.721] GetSystemMetrics (nIndex=46) returned 2 [0038.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.722] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.722] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.722] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.726] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.726] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.726] GetLastError () returned 0x578 [0038.726] CanUserWritePwrScheme () returned 1 [0038.726] GetSystemMetrics (nIndex=46) returned 2 [0038.726] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.726] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.727] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.727] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.731] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.731] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.731] GetLastError () returned 0x578 [0038.731] CanUserWritePwrScheme () returned 1 [0038.731] GetSystemMetrics (nIndex=46) returned 2 [0038.731] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.731] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.731] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.731] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.736] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.736] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.736] GetLastError () returned 0x578 [0038.736] CanUserWritePwrScheme () returned 1 [0038.736] GetSystemMetrics (nIndex=46) returned 2 [0038.736] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.736] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.736] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.736] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.740] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.741] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.741] GetLastError () returned 0x578 [0038.741] CanUserWritePwrScheme () returned 1 [0038.741] GetSystemMetrics (nIndex=46) returned 2 [0038.741] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.741] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.741] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.741] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.746] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.746] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.746] GetLastError () returned 0x578 [0038.746] CanUserWritePwrScheme () returned 1 [0038.746] GetSystemMetrics (nIndex=46) returned 2 [0038.746] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.746] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.746] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.746] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.750] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.750] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.750] GetLastError () returned 0x578 [0038.750] CanUserWritePwrScheme () returned 1 [0038.751] GetSystemMetrics (nIndex=46) returned 2 [0038.751] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.751] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.751] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.751] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.755] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.755] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.755] GetLastError () returned 0x578 [0038.755] CanUserWritePwrScheme () returned 1 [0038.756] GetSystemMetrics (nIndex=46) returned 2 [0038.756] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.756] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.756] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.756] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.760] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.760] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.760] GetLastError () returned 0x578 [0038.760] CanUserWritePwrScheme () returned 1 [0038.761] GetSystemMetrics (nIndex=46) returned 2 [0038.761] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.761] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.761] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.761] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.765] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.765] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.765] GetLastError () returned 0x578 [0038.765] CanUserWritePwrScheme () returned 1 [0038.765] GetSystemMetrics (nIndex=46) returned 2 [0038.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.765] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.765] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.766] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.770] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.770] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.770] GetLastError () returned 0x578 [0038.770] CanUserWritePwrScheme () returned 1 [0038.770] GetSystemMetrics (nIndex=46) returned 2 [0038.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.775] GetLastError () returned 0x578 [0038.775] CanUserWritePwrScheme () returned 1 [0038.775] GetSystemMetrics (nIndex=46) returned 2 [0038.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.775] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.775] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.775] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.780] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.780] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.780] GetLastError () returned 0x578 [0038.780] CanUserWritePwrScheme () returned 1 [0038.780] GetSystemMetrics (nIndex=46) returned 2 [0038.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.784] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.784] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.784] GetLastError () returned 0x578 [0038.784] CanUserWritePwrScheme () returned 1 [0038.785] GetSystemMetrics (nIndex=46) returned 2 [0038.785] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.785] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.785] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.785] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.789] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.789] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.789] GetLastError () returned 0x578 [0038.789] CanUserWritePwrScheme () returned 1 [0038.789] GetSystemMetrics (nIndex=46) returned 2 [0038.789] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.789] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.789] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.789] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.793] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.793] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.793] GetLastError () returned 0x578 [0038.793] CanUserWritePwrScheme () returned 1 [0038.794] GetSystemMetrics (nIndex=46) returned 2 [0038.794] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.794] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.794] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.794] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.798] GetLastError () returned 0x578 [0038.798] CanUserWritePwrScheme () returned 1 [0038.798] GetSystemMetrics (nIndex=46) returned 2 [0038.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.798] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.798] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.798] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.802] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.802] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.802] GetLastError () returned 0x578 [0038.802] CanUserWritePwrScheme () returned 1 [0038.803] GetSystemMetrics (nIndex=46) returned 2 [0038.803] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.803] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.803] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.803] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.807] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.807] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.807] GetLastError () returned 0x578 [0038.807] CanUserWritePwrScheme () returned 1 [0038.807] GetSystemMetrics (nIndex=46) returned 2 [0038.807] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.807] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.807] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.807] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.811] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.811] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.811] GetLastError () returned 0x578 [0038.811] CanUserWritePwrScheme () returned 1 [0038.812] GetSystemMetrics (nIndex=46) returned 2 [0038.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.812] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.812] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.812] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.816] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.816] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.816] GetLastError () returned 0x578 [0038.816] CanUserWritePwrScheme () returned 1 [0038.816] GetSystemMetrics (nIndex=46) returned 2 [0038.816] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.816] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.816] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.816] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.820] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.820] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.820] GetLastError () returned 0x578 [0038.820] CanUserWritePwrScheme () returned 1 [0038.821] GetSystemMetrics (nIndex=46) returned 2 [0038.821] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.821] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.821] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.821] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.825] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.825] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.825] GetLastError () returned 0x578 [0038.825] CanUserWritePwrScheme () returned 1 [0038.825] GetSystemMetrics (nIndex=46) returned 2 [0038.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.825] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.825] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.825] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.829] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.829] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.829] GetLastError () returned 0x578 [0038.829] CanUserWritePwrScheme () returned 1 [0038.830] GetSystemMetrics (nIndex=46) returned 2 [0038.830] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.830] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.830] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.830] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.834] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.834] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.834] GetLastError () returned 0x578 [0038.834] CanUserWritePwrScheme () returned 1 [0038.834] GetSystemMetrics (nIndex=46) returned 2 [0038.834] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.834] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.834] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.834] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.838] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.838] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.838] GetLastError () returned 0x578 [0038.838] CanUserWritePwrScheme () returned 1 [0038.839] GetSystemMetrics (nIndex=46) returned 2 [0038.839] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.839] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.839] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.839] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.843] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.843] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.843] GetLastError () returned 0x578 [0038.843] CanUserWritePwrScheme () returned 1 [0038.843] GetSystemMetrics (nIndex=46) returned 2 [0038.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.844] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.844] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.847] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.847] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.848] GetLastError () returned 0x578 [0038.848] CanUserWritePwrScheme () returned 1 [0038.848] GetSystemMetrics (nIndex=46) returned 2 [0038.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.848] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.848] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.848] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.852] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.852] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.852] GetLastError () returned 0x578 [0038.852] CanUserWritePwrScheme () returned 1 [0038.852] GetSystemMetrics (nIndex=46) returned 2 [0038.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.852] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.852] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.852] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.856] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.856] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.856] GetLastError () returned 0x578 [0038.857] CanUserWritePwrScheme () returned 1 [0038.857] GetSystemMetrics (nIndex=46) returned 2 [0038.857] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.857] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.857] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.857] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.861] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.861] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.861] GetLastError () returned 0x578 [0038.861] CanUserWritePwrScheme () returned 1 [0038.861] GetSystemMetrics (nIndex=46) returned 2 [0038.861] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.865] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.865] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.865] GetLastError () returned 0x578 [0038.865] CanUserWritePwrScheme () returned 1 [0038.866] GetSystemMetrics (nIndex=46) returned 2 [0038.866] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.866] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.866] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.866] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.870] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.870] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.870] GetLastError () returned 0x578 [0038.870] CanUserWritePwrScheme () returned 1 [0038.870] GetSystemMetrics (nIndex=46) returned 2 [0038.870] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.870] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.871] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.871] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.874] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.875] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.875] GetLastError () returned 0x578 [0038.875] CanUserWritePwrScheme () returned 1 [0038.875] GetSystemMetrics (nIndex=46) returned 2 [0038.875] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.875] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.875] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.875] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.879] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.879] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.879] GetLastError () returned 0x578 [0038.879] CanUserWritePwrScheme () returned 1 [0038.879] GetSystemMetrics (nIndex=46) returned 2 [0038.879] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.879] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.880] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.880] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.884] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.884] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.884] GetLastError () returned 0x578 [0038.884] CanUserWritePwrScheme () returned 1 [0038.884] GetSystemMetrics (nIndex=46) returned 2 [0038.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.884] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.884] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.884] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.888] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.888] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.888] GetLastError () returned 0x578 [0038.888] CanUserWritePwrScheme () returned 1 [0038.889] GetSystemMetrics (nIndex=46) returned 2 [0038.889] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.889] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.889] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.889] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.893] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.893] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.893] GetLastError () returned 0x578 [0038.893] CanUserWritePwrScheme () returned 1 [0038.893] GetSystemMetrics (nIndex=46) returned 2 [0038.893] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.893] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.893] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.893] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.897] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.897] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.897] GetLastError () returned 0x578 [0038.897] CanUserWritePwrScheme () returned 1 [0038.897] GetSystemMetrics (nIndex=46) returned 2 [0038.897] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.897] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.898] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.898] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.902] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.902] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.902] GetLastError () returned 0x578 [0038.902] CanUserWritePwrScheme () returned 1 [0038.902] GetSystemMetrics (nIndex=46) returned 2 [0038.902] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.902] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.902] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.902] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.907] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.907] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.907] GetLastError () returned 0x578 [0038.907] CanUserWritePwrScheme () returned 1 [0038.907] GetSystemMetrics (nIndex=46) returned 2 [0038.907] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.907] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.907] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.907] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.912] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.912] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.912] GetLastError () returned 0x578 [0038.912] CanUserWritePwrScheme () returned 1 [0038.912] GetSystemMetrics (nIndex=46) returned 2 [0038.912] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.912] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.912] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.912] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.916] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.916] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.916] GetLastError () returned 0x578 [0038.916] CanUserWritePwrScheme () returned 1 [0038.917] GetSystemMetrics (nIndex=46) returned 2 [0038.917] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.917] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.917] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.917] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.921] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.921] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.921] GetLastError () returned 0x578 [0038.921] CanUserWritePwrScheme () returned 1 [0038.922] GetSystemMetrics (nIndex=46) returned 2 [0038.922] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.922] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.922] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.922] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.926] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.926] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.926] GetLastError () returned 0x578 [0038.926] CanUserWritePwrScheme () returned 1 [0038.927] GetSystemMetrics (nIndex=46) returned 2 [0038.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.927] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.927] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.927] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.931] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.931] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.931] GetLastError () returned 0x578 [0038.931] CanUserWritePwrScheme () returned 1 [0038.932] GetSystemMetrics (nIndex=46) returned 2 [0038.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.932] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.932] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.932] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.936] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.936] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.936] GetLastError () returned 0x578 [0038.936] CanUserWritePwrScheme () returned 1 [0038.936] GetSystemMetrics (nIndex=46) returned 2 [0038.937] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.937] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.937] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.937] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.941] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.941] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.941] GetLastError () returned 0x578 [0038.941] CanUserWritePwrScheme () returned 1 [0038.941] GetSystemMetrics (nIndex=46) returned 2 [0038.941] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.941] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.941] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.941] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.945] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.945] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.945] GetLastError () returned 0x578 [0038.945] CanUserWritePwrScheme () returned 1 [0038.946] GetSystemMetrics (nIndex=46) returned 2 [0038.946] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.946] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.946] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.946] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.950] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.950] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.950] GetLastError () returned 0x578 [0038.950] CanUserWritePwrScheme () returned 1 [0038.950] GetSystemMetrics (nIndex=46) returned 2 [0038.950] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.950] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.950] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.950] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.954] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.954] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.954] GetLastError () returned 0x578 [0038.955] CanUserWritePwrScheme () returned 1 [0038.955] GetSystemMetrics (nIndex=46) returned 2 [0038.955] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.955] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.955] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.955] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.959] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.959] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.959] GetLastError () returned 0x578 [0038.959] CanUserWritePwrScheme () returned 1 [0038.959] GetSystemMetrics (nIndex=46) returned 2 [0038.959] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.959] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.959] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.959] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.964] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.964] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.964] GetLastError () returned 0x578 [0038.964] CanUserWritePwrScheme () returned 1 [0038.964] GetSystemMetrics (nIndex=46) returned 2 [0038.964] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.964] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.964] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.964] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.968] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.968] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.968] GetLastError () returned 0x578 [0038.968] CanUserWritePwrScheme () returned 1 [0038.969] GetSystemMetrics (nIndex=46) returned 2 [0038.969] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.969] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.969] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.969] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.973] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.973] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.973] GetLastError () returned 0x578 [0038.973] CanUserWritePwrScheme () returned 1 [0038.973] GetSystemMetrics (nIndex=46) returned 2 [0038.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.977] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.977] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.977] GetLastError () returned 0x578 [0038.977] CanUserWritePwrScheme () returned 1 [0038.977] GetSystemMetrics (nIndex=46) returned 2 [0038.978] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.978] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.978] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.978] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.981] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.982] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.982] GetLastError () returned 0x578 [0038.982] CanUserWritePwrScheme () returned 1 [0038.982] GetSystemMetrics (nIndex=46) returned 2 [0038.982] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.982] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.982] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.982] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.986] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.986] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.986] GetLastError () returned 0x578 [0038.986] CanUserWritePwrScheme () returned 1 [0038.986] GetSystemMetrics (nIndex=46) returned 2 [0038.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.986] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.990] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.990] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.990] GetLastError () returned 0x578 [0038.991] CanUserWritePwrScheme () returned 1 [0038.991] GetSystemMetrics (nIndex=46) returned 2 [0038.991] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.991] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.991] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.991] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0038.995] GetWindowTextLengthA (hWnd=0x0) returned 0 [0038.995] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0038.995] GetLastError () returned 0x578 [0038.995] CanUserWritePwrScheme () returned 1 [0038.996] GetSystemMetrics (nIndex=46) returned 2 [0038.996] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0038.996] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0038.996] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0038.996] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0039.000] GetWindowTextLengthA (hWnd=0x0) returned 0 [0039.000] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0039.000] GetLastError () returned 0x578 [0039.000] CanUserWritePwrScheme () returned 1 [0039.001] GetSystemMetrics (nIndex=46) returned 2 [0039.001] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0039.001] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0039.001] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0039.001] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0039.006] GetWindowTextLengthA (hWnd=0x0) returned 0 [0039.006] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0039.006] GetLastError () returned 0x578 [0039.006] CanUserWritePwrScheme () returned 1 [0039.006] GetSystemMetrics (nIndex=46) returned 2 [0039.006] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0039.006] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0039.006] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0039.006] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0039.011] GetWindowTextLengthA (hWnd=0x0) returned 0 [0039.011] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0039.011] GetLastError () returned 0x578 [0039.011] CanUserWritePwrScheme () returned 1 [0039.011] GetSystemMetrics (nIndex=46) returned 2 [0039.011] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0039.011] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0039.011] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0039.012] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0039.016] GetWindowTextLengthA (hWnd=0x0) returned 0 [0039.016] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0039.016] GetLastError () returned 0x578 [0039.016] CanUserWritePwrScheme () returned 1 [0039.016] GetSystemMetrics (nIndex=46) returned 2 [0039.016] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0039.016] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0039.016] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0039.016] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0039.021] GetWindowTextLengthA (hWnd=0x0) returned 0 [0039.021] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0039.021] GetLastError () returned 0x578 [0039.021] CanUserWritePwrScheme () returned 1 [0039.021] GetSystemMetrics (nIndex=46) returned 2 [0039.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0039.021] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0039.021] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0039.021] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0039.026] GetWindowTextLengthA (hWnd=0x0) returned 0 [0039.026] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0039.026] GetLastError () returned 0x578 [0039.026] CanUserWritePwrScheme () returned 1 [0039.027] GetSystemMetrics (nIndex=46) returned 2 [0039.027] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0039.027] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0039.027] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0039.027] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0039.031] GetWindowTextLengthA (hWnd=0x0) returned 0 [0039.031] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0039.031] GetLastError () returned 0x578 [0039.031] timeGetTime () returned 0x1144ff4 [0039.031] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.032] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.033] timeGetTime () returned 0x1144ff4 [0039.034] timeGetTime () returned 0x1144ff4 [0039.034] timeGetTime () returned 0x1144ff4 [0039.034] timeGetTime () returned 0x1144ff4 [0039.034] timeGetTime () returned 0x1144ff4 [0039.034] timeGetTime () returned 0x1144ff4 [0039.034] timeGetTime () returned 0x1144ff4 [0039.034] timeGetTime () returned 0x1144ff4 [0039.034] timeGetTime () returned 0x1144ff4 [0039.036] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0039.036] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x8) returned 0x571740 [0039.036] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x20) returned 0x5802c0 [0039.036] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x10) returned 0x57e2c8 [0039.036] GetLocalTime (in: lpSystemTime=0x18f410 | out: lpSystemTime=0x18f410*(wYear=0x7e3, wMonth=0xa, wDayOfWeek=0x1, wDay=0x15, wHour=0x5, wMinute=0x18, wSecond=0x13, wMilliseconds=0x3d1)) [0039.036] SystemTimeToVariantTime (in: lpSystemTime=0x18f410, pvtime=0x18f428 | out: pvtime=0x18f428) returned 1 [0039.036] SystemTimeToVariantTime (in: lpSystemTime=0x18f410, pvtime=0x18f3d0 | out: pvtime=0x18f3d0) returned 1 [0039.036] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57e2c8 | out: hHeap=0x550000) returned 1 [0039.036] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5802c0 | out: hHeap=0x550000) returned 1 [0039.036] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x571740 | out: hHeap=0x550000) returned 1 [0039.036] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x8, Size=0x38) returned 0x5819d8 [0039.036] AreFileApisANSI () returned 1 [0039.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x18f930, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0039.037] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x6) returned 0x571740 [0039.037] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x18f930, cbMultiByte=-1, lpWideCharStr=0x571740, cchWideChar=3 | out: lpWideCharStr="š\x07") returned 3 [0039.037] CreateFileW (lpFileName="š\x07" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\š\x07"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f20c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0039.037] GetLastError () returned 0x7b [0039.037] GetLastError () returned 0x7b [0039.037] CharToOemBuffA (in: lpszSrc="", lpszDst=0x4461f0, cchDstLength=0x0 | out: lpszDst="") returned 1 [0039.037] CallMsgFilterA (lpMsg=0x18f388, nCode=0) returned 0 [0039.037] D2D1CreateFactory () returned 0x0 [0039.038] DWriteCreateFactory () returned 0x0 [0039.212] LoadLibraryA (lpLibFileName="kernel32") returned 0x76c20000 [0039.213] GetClientRect (in: hWnd=0x0, lpRect=0x18f438 | out: lpRect=0x18f438) returned 0 [0039.214] GetProcAddress (hModule=0x76c20000, lpProcName="VirtualAlloc") returned 0x76c31856 [0039.214] VirtualAlloc (lpAddress=0x0, dwSize=0x33000, flAllocationType=0x3000, flProtect=0x40) returned 0xa600000 [0039.215] SetRect (in: lprc=0x18f438, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x18f438) returned 1 [0039.215] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc) returned 0x57e358 [0039.215] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc) returned 0x57e370 [0039.215] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc) returned 0x57e340 [0039.215] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc) returned 0x57e2e0 [0039.215] GetCursorPos (in: lpPoint=0x18f3c8 | out: lpPoint=0x18f3c8*(x=761, y=839)) returned 1 [0039.215] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="alerts") returned 0x480 [0039.215] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57e370 | out: hHeap=0x550000) returned 1 [0039.215] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57e340 | out: hHeap=0x550000) returned 1 [0039.215] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57e2e0 | out: hHeap=0x550000) returned 1 [0039.215] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.215] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.215] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.215] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.215] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.215] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.215] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.215] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.215] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.215] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0039.216] GetCursorPos (in: lpPoint=0x18f3a8 | out: lpPoint=0x18f3a8*(x=761, y=839)) returned 1 [0039.217] CreateRectRgnIndirect (lprect=0x18f3f0) returned 0x440407c7 [0039.217] WaitForSingleObject (hHandle=0x480, dwMilliseconds=0xbb6) returned 0x102 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.222] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0042.223] GetCursorPos (in: lpPoint=0x18f3a8 | out: lpPoint=0x18f3a8*(x=165, y=86)) returned 1 [0042.223] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.223] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.223] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.223] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.223] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.224] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.224] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.225] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.225] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.225] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.225] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.225] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.225] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.225] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.225] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.225] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.225] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.225] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.225] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.225] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.225] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.225] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.225] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0042.225] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0042.225] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57e358 | out: hHeap=0x550000) returned 1 [0042.225] CreateAcceleratorTableA (paccel=0x18f430, cAccel=4) returned 0x150111 [0042.225] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc) returned 0x57e358 [0042.225] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc) returned 0x57e2e0 [0042.225] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc) returned 0x57e340 [0042.225] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc) returned 0x57e370 [0042.225] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xc) returned 0x57e2c8 [0042.225] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57e2c8 | out: hHeap=0x550000) returned 1 [0042.225] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1) returned 0x571750 [0042.225] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2) returned 0x571770 [0042.225] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x571750 | out: hHeap=0x550000) returned 1 [0042.225] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3) returned 0x571750 [0042.225] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x571770 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x4) returned 0x571770 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x571750 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x6) returned 0x571750 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x571770 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x9) returned 0x57e2c8 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x571750 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xd) returned 0x57e310 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57e2c8 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x13) returned 0x568200 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57e310 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1c) returned 0x5801f8 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x568200 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2a) returned 0x57d680 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5801f8 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x3f) returned 0x5627c8 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57d680 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x5e) returned 0x584ea0 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x5627c8 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x8d) returned 0x57f790 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x584ea0 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xd3) returned 0x57fe00 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57f790 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x13c) returned 0x585340 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x57fe00 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1da) returned 0x58b5b8 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x585340 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x2c7) returned 0x58b7a0 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x58b5b8 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x42a) returned 0x58ba70 [0042.226] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x58b7a0 | out: hHeap=0x550000) returned 1 [0042.226] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x63f) returned 0x58bea8 [0042.227] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x58ba70 | out: hHeap=0x550000) returned 1 [0042.227] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x95e) returned 0x58c4f0 [0042.227] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x58bea8 | out: hHeap=0x550000) returned 1 [0042.227] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0xe0d) returned 0x58b5b8 [0042.227] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x58c4f0 | out: hHeap=0x550000) returned 1 [0042.227] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1536) returned 0x58c3d0 [0042.227] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x58b5b8 | out: hHeap=0x550000) returned 1 [0042.227] RtlAllocateHeap (HeapHandle=0x550000, Flags=0x0, Size=0x1fbf) returned 0x58d910 [0042.228] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x58c3d0 | out: hHeap=0x550000) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.228] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.229] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.230] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.230] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.230] FreeEnvironmentStringsA (penv=0x0) returned 1 [0042.230] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=1) returned 1 [0042.230] GetLastError () returned 0x715 [0042.231] GetFileVersionInfoW (in: lptstrFilename="", dwHandle=0x7fffffff, dwLen=0x0, lpData=0x445df0 | out: lpData=0x445df0) returned 0 [0042.284] GetModuleHandleA (lpModuleName="ntdll") returned 0x77130000 [0042.284] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0042.534] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f074, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1black.exe")) returned 0x30 [0042.534] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f01c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f2a0 | out: lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe", lpProcessInformation=0x18f2a0*(hProcess=0x488, hThread=0x484, dwProcessId=0xa68, dwThreadId=0xa6c)) returned 1 [0042.543] GetThreadContext (in: hThread=0x484, lpContext=0x18ed44 | out: lpContext=0x18ed44*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40d5db, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0042.547] LoadLibraryA (lpLibFileName="ntdll") returned 0x77130000 [0042.547] NtQueryInformationProcess (in: ProcessHandle=0x488, ProcessInformationClass=0x0, ProcessInformation=0x18eaf0, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x18eaf0, ReturnLength=0x0) returned 0x0 [0042.547] ReadProcessMemory (in: hProcess=0x488, lpBaseAddress=0x7efde000, lpBuffer=0x18eb3c, nSize=0x1e8, lpNumberOfBytesRead=0x18ed30 | out: lpBuffer=0x18eb3c*, lpNumberOfBytesRead=0x18ed30*=0x1e8) returned 1 [0042.547] VirtualProtectEx (in: hProcess=0x488, lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x4, lpflOldProtect=0x18ed3c | out: lpflOldProtect=0x18ed3c*=0x2) returned 1 [0042.548] WriteProcessMemory (in: hProcess=0x488, lpBaseAddress=0x400000, lpBuffer=0x58b5b8*, nSize=0x19000, lpNumberOfBytesWritten=0x18ed24 | out: lpBuffer=0x58b5b8*, lpNumberOfBytesWritten=0x18ed24*=0x19000) returned 1 [0042.551] VirtualProtectEx (in: hProcess=0x488, lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0042.551] VirtualProtectEx (in: hProcess=0x488, lpAddress=0x401000, dwSize=0x9c25, flNewProtect=0x20, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0042.551] VirtualProtectEx (in: hProcess=0x488, lpAddress=0x40b000, dwSize=0x2636, flNewProtect=0x2, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0042.551] VirtualProtectEx (in: hProcess=0x488, lpAddress=0x40e000, dwSize=0xaad5, flNewProtect=0x4, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0042.551] SetThreadContext (hThread=0x484, lpContext=0x18ed44*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x0, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40a9d0, Ebp=0x0, Eip=0x771401c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0042.552] ResumeThread (hThread=0x484) returned 0x1 [0042.552] ExitProcess (uExitCode=0x0) [0042.554] HeapFree (in: hHeap=0x550000, dwFlags=0x0, lpMem=0x56abd0 | out: hHeap=0x550000) returned 1 Thread: id = 2 os_tid = 0x970 Thread: id = 3 os_tid = 0x9c0 Thread: id = 4 os_tid = 0xa60 Thread: id = 5 os_tid = 0xa64 Process: id = "2" image_name = "1black.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1black.exe" page_root = "0x37cb4000" os_pid = "0xa68" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x968" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 6 os_tid = 0xa6c [0043.383] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76c20000 [0043.395] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcAddress") returned 0x76c31222 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleHandleW") returned 0x76c334b0 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="FindNextFileW") returned 0x76c354ee [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="FindClose") returned 0x76c34442 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="MoveFileW") returned 0x76c49af0 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileSizeEx") returned 0x76c359e2 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="GetModuleFileNameW") returned 0x76c34950 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="GetFileAttributesW") returned 0x76c31b18 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="ExitProcess") returned 0x76c37a10 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="GetCommandLineW") returned 0x76c35223 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameW") returned 0x76c3dd0e [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="GetComputerNameA") returned 0x76c4b6e0 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="CreateMutexW") returned 0x76c3424c [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenW") returned 0x76c31700 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="lstrlenA") returned 0x76c35a4b [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcess") returned 0x76c31809 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForSingleObject") returned 0x76c31136 [0043.396] GetProcAddress (hModule=0x76c20000, lpProcName="GetLogicalDrives") returned 0x76c35371 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="GetTickCount") returned 0x76c3110c [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteFileW") returned 0x76c389b3 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="WideCharToMultiByte") returned 0x76c3170d [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76c31916 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="Sleep") returned 0x76c310ff [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="LeaveCriticalSection") returned 0x77152270 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="ReadFile") returned 0x76c33ed3 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="CreateFileW") returned 0x76c33f5c [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="OpenMutexW") returned 0x76c35151 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="EnterCriticalSection") returned 0x771522b0 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="WaitForMultipleObjects") returned 0x76c34220 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiW") returned 0x76c4d5cd [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="lstrcmpiA") returned 0x76c33e8e [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="DeleteCriticalSection") returned 0x771645f5 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="ReleaseMutex") returned 0x76c3111e [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="CloseHandle") returned 0x76c31410 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="GetVersion") returned 0x76c34467 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="CreateThread") returned 0x76c334d5 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="ExpandEnvironmentStringsW") returned 0x76c34173 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceCounter") returned 0x76c31725 [0043.397] GetProcAddress (hModule=0x76c20000, lpProcName="QueryPerformanceFrequency") returned 0x76c341f0 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="GetCurrentProcessId") returned 0x76c311f8 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="SetFileAttributesW") returned 0x76c4d4f7 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="GetVolumeInformationW") returned 0x76c4c860 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="WriteFile") returned 0x76c31282 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="SetFilePointerEx") returned 0x76c4c807 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="SetEndOfFile") returned 0x76c4ce2e [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="FindFirstFileW") returned 0x76c34435 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="GetProcessHeap") returned 0x76c314e9 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="HeapReAlloc") returned 0x77171f6e [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="HeapAlloc") returned 0x7715e026 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="HeapFree") returned 0x76c314c9 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="CreatePipe") returned 0x76cb415b [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="SetHandleInformation") returned 0x76c4195c [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="CreateProcessW") returned 0x76c3103d [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringW") returned 0x76c33bca [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="CompareStringA") returned 0x76c33c5a [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="OpenProcess") returned 0x76c31986 [0043.398] GetProcAddress (hModule=0x76c20000, lpProcName="TerminateProcess") returned 0x76c4d802 [0043.399] GetProcAddress (hModule=0x76c20000, lpProcName="GetSystemTime") returned 0x76c35a96 [0043.399] GetProcAddress (hModule=0x76c20000, lpProcName="SystemTimeToFileTime") returned 0x76c35a7e [0043.399] GetProcAddress (hModule=0x76c20000, lpProcName="GetLastError") returned 0x76c311c0 [0043.399] GetProcAddress (hModule=0x76c20000, lpProcName="CreateToolhelp32Snapshot") returned 0x76c5735f [0043.399] GetProcAddress (hModule=0x76c20000, lpProcName="Process32NextW") returned 0x76c5896c [0043.399] GetProcAddress (hModule=0x76c20000, lpProcName="Process32FirstW") returned 0x76c58baf [0043.399] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x74d40000 [0043.413] GetProcAddress (hModule=0x74d40000, lpProcName="RegOpenKeyExW") returned 0x74d5468d [0043.413] GetProcAddress (hModule=0x74d40000, lpProcName="RegQueryValueExW") returned 0x74d546ad [0043.413] GetProcAddress (hModule=0x74d40000, lpProcName="RegSetValueExW") returned 0x74d514d6 [0043.413] GetProcAddress (hModule=0x74d40000, lpProcName="RegCloseKey") returned 0x74d5469d [0043.413] GetProcAddress (hModule=0x74d40000, lpProcName="OpenProcessToken") returned 0x74d54304 [0043.413] GetProcAddress (hModule=0x74d40000, lpProcName="GetTokenInformation") returned 0x74d5431c [0043.413] GetProcAddress (hModule=0x74d40000, lpProcName="OpenSCManagerW") returned 0x74d4ca64 [0043.413] GetProcAddress (hModule=0x74d40000, lpProcName="OpenServiceW") returned 0x74d4ca4c [0043.413] GetProcAddress (hModule=0x74d40000, lpProcName="CloseServiceHandle") returned 0x74d5369c [0043.414] GetProcAddress (hModule=0x74d40000, lpProcName="ControlService") returned 0x74d67144 [0043.414] GetProcAddress (hModule=0x74d40000, lpProcName="QueryServiceStatus") returned 0x74d52a86 [0043.414] GetProcAddress (hModule=0x74d40000, lpProcName="EnumDependentServicesW") returned 0x74d41e3a [0043.414] GetProcAddress (hModule=0x74d40000, lpProcName="EnumServicesStatusExW") returned 0x74d4b466 [0043.414] LoadLibraryA (lpLibFileName="user32.dll") returned 0x74f40000 [0043.429] GetProcAddress (hModule=0x74f40000, lpProcName="SystemParametersInfoW") returned 0x74f590d3 [0043.429] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75fd0000 [0045.134] GetProcAddress (hModule=0x75fd0000, lpProcName="ShellExecuteExW") returned 0x75ff1e46 [0045.134] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77130000 [0045.134] GetProcAddress (hModule=0x77130000, lpProcName="NtQuerySystemInformation") returned 0x7714fda0 [0045.134] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b50000 [0045.221] GetProcAddress (hModule=0x74b50000, lpProcName="WNetCloseEnum") returned 0x74b52dd6 [0045.221] GetProcAddress (hModule=0x74b50000, lpProcName="WNetOpenEnumW") returned 0x74b52f06 [0045.221] GetProcAddress (hModule=0x74b50000, lpProcName="WNetEnumResourceW") returned 0x74b53058 [0045.221] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75bc0000 [0045.223] GetProcAddress (hModule=0x75bc0000, lpProcName="WSAStartup") returned 0x75bc3ab2 [0045.223] GetProcAddress (hModule=0x75bc0000, lpProcName="socket") returned 0x75bc3eb8 [0045.223] GetProcAddress (hModule=0x75bc0000, lpProcName="send") returned 0x75bc6f01 [0045.224] GetProcAddress (hModule=0x75bc0000, lpProcName="recv") returned 0x75bc6b0e [0045.224] GetProcAddress (hModule=0x75bc0000, lpProcName="connect") returned 0x75bc6bdd [0045.224] GetProcAddress (hModule=0x75bc0000, lpProcName="closesocket") returned 0x75bc3918 [0045.224] GetProcAddress (hModule=0x75bc0000, lpProcName="gethostbyname") returned 0x75bd7673 [0045.224] GetProcAddress (hModule=0x75bc0000, lpProcName="inet_addr") returned 0x75bc311b [0045.224] GetProcAddress (hModule=0x75bc0000, lpProcName="ntohl") returned 0x75bc2d57 [0045.224] GetProcAddress (hModule=0x75bc0000, lpProcName="htonl") returned 0x75bc2d57 [0045.224] GetProcAddress (hModule=0x75bc0000, lpProcName="htons") returned 0x75bc2d8b [0045.224] GetProcessHeap () returned 0x8d0000 [0045.224] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x20) returned 0x8e4110 [0045.224] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=16529480351) returned 1 [0045.224] GetTickCount () returned 0x1145f5f [0045.224] GetCurrentProcessId () returned 0xa68 [0045.225] GetTickCount () returned 0x1145f5f [0045.225] GetTickCount () returned 0x1145f5f [0045.225] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x20) returned 0x8e4138 [0045.225] GetVersion () returned 0x1db10106 [0045.225] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x7) returned 0x8d36f8 [0045.225] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x8e0c18 [0045.225] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e0c18, Size=0x20) returned 0x8e4188 [0045.225] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4188, Size=0x40) returned 0x8e46f8 [0045.225] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x8e4948 [0045.226] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3A") returned 0x0 [0045.226] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_261OR3A") returned 0x84 [0045.226] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8d36f8 | out: hHeap=0x8d0000) returned 1 [0045.226] lstrlenW (lpString="Global\\syncronize_") returned 18 [0045.226] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e46f8 | out: hHeap=0x8d0000) returned 1 [0045.226] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x7) returned 0x8d36f8 [0045.226] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x8e0c18 [0045.226] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e0c18, Size=0x20) returned 0x8e4188 [0045.226] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4188, Size=0x40) returned 0x8e46f8 [0045.226] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x8f4950 [0045.226] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3U") returned 0x0 [0045.226] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_261OR3U") returned 0x88 [0045.227] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8d36f8 | out: hHeap=0x8d0000) returned 1 [0045.227] lstrlenW (lpString="Global\\syncronize_") returned 18 [0045.227] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e46f8 | out: hHeap=0x8d0000) returned 1 [0045.227] GetVersion () returned 0x1db10106 [0045.227] GetCurrentProcess () returned 0xffffffff [0045.227] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0045.227] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0045.227] CloseHandle (hObject=0x8c) returned 1 [0045.227] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0045.227] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x14) returned 0x8d36f8 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x8e0c18 [0045.227] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e0c18, Size=0x20) returned 0x8e4188 [0045.227] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4188, Size=0x40) returned 0x8e46f8 [0045.227] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e46f8, Size=0x80) returned 0x8e46f8 [0045.227] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e46f8, Size=0x100) returned 0x8e46f8 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x34) returned 0x8e4800 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e0808 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e0818 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8e0828 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x8e0c18 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e4840 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x8e0c30 [0045.227] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4840, Size=0x8) returned 0x8e4840 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x8e0c48 [0045.227] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4840, Size=0x10) returned 0x8e4840 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x8e0c60 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x8e0c78 [0045.227] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4840, Size=0x20) returned 0x8e4840 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x8e0c90 [0045.227] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x8e0ca8 [0045.227] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e0808, Size=0x8) returned 0x8e0808 [0045.227] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e0818, Size=0x8) returned 0x8e0818 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8e4868 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x8e0cc0 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e4878 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x8e0cd8 [0045.228] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4878, Size=0x8) returned 0x8e4878 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904970 [0045.228] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4878, Size=0x10) returned 0x8e4878 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904988 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8e4890 [0045.228] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4878, Size=0x20) returned 0x8e48a0 [0045.228] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e0808, Size=0x10) returned 0x8e4878 [0045.228] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e0818, Size=0x10) returned 0x8e48c8 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8e0808 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x9049a0 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e0818 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x9049b8 [0045.228] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e0818, Size=0x8) returned 0x8e0818 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8e48e0 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x9049d0 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e48f0 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x9049e8 [0045.228] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e48f0, Size=0x8) returned 0x8e48f0 [0045.228] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4878, Size=0x20) returned 0x904d58 [0045.228] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e48c8, Size=0x20) returned 0x904d80 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8e48c8 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x904a00 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e4878 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904a18 [0045.228] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4878, Size=0x8) returned 0x8e4878 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x14) returned 0x904da8 [0045.228] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x14) returned 0x904dc8 [0045.228] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0045.228] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e46f8 | out: hHeap=0x8d0000) returned 1 [0045.228] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0045.237] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a30 [0045.237] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a30, Size=0x20) returned 0x8e4390 [0045.237] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4390, Size=0x40) returned 0x8e4750 [0045.237] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4750, Size=0x80) returned 0x8e4750 [0045.237] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4750, Size=0x100) returned 0x9050a0 [0045.237] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a30 [0045.237] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a30, Size=0x20) returned 0x8e4390 [0045.237] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4390, Size=0x40) returned 0x8e4750 [0045.238] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4750, Size=0x80) returned 0x8e4750 [0045.238] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4750, Size=0x100) returned 0x9051a8 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x904a30 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e4750 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.238] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4750, Size=0x8) returned 0x8e4750 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x14) returned 0x8e4760 [0045.238] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4750, Size=0x10) returned 0x8e4780 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x18) returned 0x8e4798 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1a) returned 0x8e4390 [0045.238] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4780, Size=0x20) returned 0x8e47b8 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1c) returned 0x8e43b8 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x16) returned 0x8e47e0 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1a) returned 0x8e43e0 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x904a60 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e4750 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40) returned 0x9052b0 [0045.238] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4750, Size=0x8) returned 0x8e4750 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x3c) returned 0x9052f8 [0045.238] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4750, Size=0x10) returned 0x8e4780 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x14) returned 0x905340 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x18) returned 0x905360 [0045.238] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4780, Size=0x20) returned 0x905380 [0045.238] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x24) returned 0x9053a8 [0045.238] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0045.238] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x9050a0 | out: hHeap=0x8d0000) returned 1 [0045.238] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0045.238] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x9051a8 | out: hHeap=0x8d0000) returned 1 [0045.238] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x905928 [0045.241] EnumServicesStatusExW (in: hSCManager=0x905928, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0045.241] GetLastError () returned 0xea [0045.242] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x125a) returned 0x909228 [0045.242] EnumServicesStatusExW (in: hSCManager=0x905928, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x909228, cbBufSize=0x125a, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x909228, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0045.242] CloseServiceHandle (hSCObject=0x905928) returned 1 [0045.244] lstrlenW (lpString="Appinfo") returned 7 [0045.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.244] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.244] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.244] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.244] lstrlenW (lpString="AudioSrv") returned 8 [0045.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.244] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.244] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.244] lstrlenW (lpString="BFE") returned 3 [0045.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.245] lstrlenW (lpString="CryptSvc") returned 8 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.245] lstrlenW (lpString="CscService") returned 10 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.245] lstrlenW (lpString="DcomLaunch") returned 10 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.245] lstrlenW (lpString="Dhcp") returned 4 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.245] lstrlenW (lpString="Dnscache") returned 8 [0045.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.246] lstrlenW (lpString="DPS") returned 3 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.246] lstrlenW (lpString="eventlog") returned 8 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.246] lstrlenW (lpString="EventSystem") returned 11 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.246] lstrlenW (lpString="FontCache") returned 9 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0045.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0045.246] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0045.246] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0045.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0045.246] lstrlenW (lpString="gpsvc") returned 5 [0045.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.247] lstrlenW (lpString="iphlpsvc") returned 8 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.247] lstrlenW (lpString="LanmanServer") returned 12 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.247] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.247] lstrlenW (lpString="lmhosts") returned 7 [0045.247] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.247] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.247] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.247] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.247] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.247] lstrlenW (lpString="MMCSS") returned 5 [0045.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.248] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.248] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.248] lstrlenW (lpString="MpsSvc") returned 6 [0045.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.248] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.248] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.248] lstrlenW (lpString="Netman") returned 6 [0045.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.248] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.248] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.248] lstrlenW (lpString="netprofm") returned 8 [0045.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.248] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.248] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.248] lstrlenW (lpString="NlaSvc") returned 6 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.249] lstrlenW (lpString="nsi") returned 3 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.249] lstrlenW (lpString="PcaSvc") returned 6 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.249] lstrlenW (lpString="PlugPlay") returned 8 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.249] lstrlenW (lpString="Power") returned 5 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.249] lstrlenW (lpString="ProfSvc") returned 7 [0045.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.249] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.249] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.250] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.250] lstrlenW (lpString="RpcSs") returned 5 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.250] lstrlenW (lpString="SamSs") returned 5 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.250] lstrlenW (lpString="Schedule") returned 8 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.250] lstrlenW (lpString="SENS") returned 4 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.250] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.250] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.250] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.251] lstrlenW (lpString="Spooler") returned 7 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.251] lstrlenW (lpString="SysMain") returned 7 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.251] lstrlenW (lpString="Themes") returned 6 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.251] lstrlenW (lpString="TrkWks") returned 6 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.251] lstrlenW (lpString="UxSms") returned 5 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.251] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.251] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.251] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.252] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.252] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.252] lstrlenW (lpString="Winmgmt") returned 7 [0045.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.252] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.252] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.252] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.252] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x909228 | out: hHeap=0x8d0000) returned 1 [0045.252] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0045.257] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.257] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.258] lstrlenW (lpString="System") returned 6 [0045.258] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.258] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.258] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.258] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.258] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.258] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.258] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.258] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.258] lstrlenW (lpString="smss.exe") returned 8 [0045.258] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.258] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.258] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.258] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.259] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.259] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.259] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.259] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.259] lstrlenW (lpString="csrss.exe") returned 9 [0045.259] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.259] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.259] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.259] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.259] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.259] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.259] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.259] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.260] lstrlenW (lpString="wininit.exe") returned 11 [0045.260] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.260] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.260] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.260] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0045.260] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0045.260] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0045.260] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0045.260] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.260] lstrlenW (lpString="csrss.exe") returned 9 [0045.260] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.260] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.261] lstrlenW (lpString="winlogon.exe") returned 12 [0045.261] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.261] lstrlenW (lpString="services.exe") returned 12 [0045.261] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.262] lstrlenW (lpString="lsass.exe") returned 9 [0045.262] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.262] lstrlenW (lpString="lsm.exe") returned 7 [0045.262] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.263] lstrlenW (lpString="svchost.exe") returned 11 [0045.263] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.263] lstrlenW (lpString="svchost.exe") returned 11 [0045.263] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.264] lstrlenW (lpString="svchost.exe") returned 11 [0045.264] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.264] lstrlenW (lpString="svchost.exe") returned 11 [0045.264] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.265] lstrlenW (lpString="svchost.exe") returned 11 [0045.265] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.265] lstrlenW (lpString="audiodg.exe") returned 11 [0045.265] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.266] lstrlenW (lpString="svchost.exe") returned 11 [0045.266] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.266] lstrlenW (lpString="svchost.exe") returned 11 [0045.266] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.267] lstrlenW (lpString="dwm.exe") returned 7 [0045.267] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.267] lstrlenW (lpString="explorer.exe") returned 12 [0045.267] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.268] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.268] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.268] lstrlenW (lpString="taskhost.exe") returned 12 [0045.268] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.269] lstrlenW (lpString="svchost.exe") returned 11 [0045.269] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.269] lstrlenW (lpString="taskeng.exe") returned 11 [0045.269] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.269] lstrlenW (lpString="taskhost.exe") returned 12 [0045.269] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0045.270] lstrlenW (lpString="tested.exe") returned 10 [0045.270] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0045.270] lstrlenW (lpString="memories global commission.exe") returned 30 [0045.270] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0045.271] lstrlenW (lpString="destination.exe") returned 15 [0045.271] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0045.271] lstrlenW (lpString="rom.exe") returned 7 [0045.271] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0045.272] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0045.272] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0045.272] lstrlenW (lpString="appropriate worm.exe") returned 20 [0045.272] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0045.273] lstrlenW (lpString="arrival-testing.exe") returned 19 [0045.273] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0045.273] lstrlenW (lpString="san stories panels.exe") returned 22 [0045.273] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0045.274] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0045.274] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0045.274] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0045.274] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0045.274] lstrlenW (lpString="taught opt practice.exe") returned 23 [0045.275] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0045.275] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0045.275] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0045.275] lstrlenW (lpString="aka gap.exe") returned 11 [0045.275] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0045.276] lstrlenW (lpString="copied-mr.exe") returned 13 [0045.276] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0045.276] lstrlenW (lpString="proven.exe") returned 10 [0045.276] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0045.277] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0045.277] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0045.277] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0045.277] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0045.278] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0045.278] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0045.278] lstrlenW (lpString="acm.exe") returned 7 [0045.278] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0045.279] lstrlenW (lpString="fluid.exe") returned 9 [0045.279] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0045.280] lstrlenW (lpString="domain.exe") returned 10 [0045.280] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0045.280] lstrlenW (lpString="cult_wanna.exe") returned 14 [0045.280] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.280] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.281] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0045.281] lstrlenW (lpString="mobsync.exe") returned 11 [0045.281] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.281] lstrlenW (lpString="svchost.exe") returned 11 [0045.281] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0045.282] lstrlenW (lpString="1Black.exe") returned 10 [0045.282] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0045.282] CloseHandle (hObject=0xe0) returned 1 [0045.282] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x9052b0 | out: hHeap=0x8d0000) returned 1 [0045.282] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x9052f8 | out: hHeap=0x8d0000) returned 1 [0045.282] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905340 | out: hHeap=0x8d0000) returned 1 [0045.282] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905360 | out: hHeap=0x8d0000) returned 1 [0045.282] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x9053a8 | out: hHeap=0x8d0000) returned 1 [0045.282] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x904a48 | out: hHeap=0x8d0000) returned 1 [0045.283] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e4760 | out: hHeap=0x8d0000) returned 1 [0045.283] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e4798 | out: hHeap=0x8d0000) returned 1 [0045.283] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e4390 | out: hHeap=0x8d0000) returned 1 [0045.283] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e43b8 | out: hHeap=0x8d0000) returned 1 [0045.283] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e47e0 | out: hHeap=0x8d0000) returned 1 [0045.283] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e43e0 | out: hHeap=0x8d0000) returned 1 [0045.283] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x90b4e8 [0045.283] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x91b4f0 [0045.283] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.283] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x8e43e0 [0045.283] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e43e0, Size=0x40) returned 0x9069f0 [0045.283] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.283] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x8e43e0 [0045.284] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.284] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x8e43b8 [0045.284] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.284] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x8e4390 [0045.284] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4390, Size=0x40) returned 0x906a38 [0045.284] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x91b4f0, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1black.exe")) returned 0x30 [0045.284] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x92b4f8 [0045.284] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x93b500 [0045.284] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.284] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x8e4390 [0045.284] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4390, Size=0x40) returned 0x906a80 [0045.284] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906a80, Size=0x80) returned 0x9052b0 [0045.284] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9052b0, Size=0x100) returned 0x907bf8 [0045.284] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.284] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x907bf8 | out: hHeap=0x8d0000) returned 1 [0045.284] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\1Black.exe", lpDst=0x92b4f8, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\1Black.exe") returned 0x1f [0045.285] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x93b500 | out: hHeap=0x8d0000) returned 1 [0045.285] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92b4f8 | out: hHeap=0x8d0000) returned 1 [0045.285] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x20a0020 [0045.285] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.285] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x8e4390 [0045.285] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.285] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x905978 [0045.285] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0045.285] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0045.285] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0045.285] lstrlenW (lpString="kernel32.dll") returned 12 [0045.285] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e4390 | out: hHeap=0x8d0000) returned 1 [0045.285] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.285] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905978 | out: hHeap=0x8d0000) returned 1 [0045.285] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1black.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0045.285] CreateFileW (lpFileName="C:\\Windows\\System32\\1Black.exe" (normalized: "c:\\windows\\system32\\1black.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0045.286] ReadFile (in: hFile=0xe0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x81000, lpOverlapped=0x0) returned 1 [0045.303] WriteFile (in: hFile=0xe4, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x81000, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x18fd98*=0x81000, lpOverlapped=0x0) returned 1 [0045.313] ReadFile (in: hFile=0xe0, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0045.313] CloseHandle (hObject=0xe4) returned 1 [0045.318] CloseHandle (hObject=0xe0) returned 1 [0045.318] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.318] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x905978 [0045.318] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.318] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x905928 [0045.318] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0045.318] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0045.318] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0045.318] lstrlenW (lpString="kernel32.dll") returned 12 [0045.319] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905928 | out: hHeap=0x8d0000) returned 1 [0045.319] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.319] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905978 | out: hHeap=0x8d0000) returned 1 [0045.319] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x20a0020 | out: hHeap=0x8d0000) returned 1 [0045.323] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.323] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x905978 [0045.323] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905978, Size=0x40) returned 0x906a80 [0045.323] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906a80, Size=0x80) returned 0x92b510 [0045.323] lstrlenW (lpString="C:\\Windows\\System32\\1Black.exe") returned 30 [0045.323] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0045.323] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x5c) returned 0x9052b0 [0045.323] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0045.324] RegSetValueExW (in: hKey=0xe0, lpValueName="1Black.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\1Black.exe", cbData=0x3c | out: lpData="C:\\Windows\\System32\\1Black.exe") returned 0x0 [0045.324] RegCloseKey (hKey=0xe0) returned 0x0 [0045.324] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x9052b0 | out: hHeap=0x8d0000) returned 1 [0045.324] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0045.324] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92b510 | out: hHeap=0x8d0000) returned 1 [0045.324] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x92d4f8 [0045.324] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x93d500 [0045.325] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a48 [0045.325] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a48, Size=0x20) returned 0x905978 [0045.325] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905978, Size=0x40) returned 0x906a80 [0045.325] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906a80, Size=0x80) returned 0x92b510 [0045.325] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x907bf8 [0045.325] lstrlenW (lpString="") returned 0 [0045.325] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.325] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8c) returned 0x907d00 [0045.325] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0045.325] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x93d500, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x93d500*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0045.325] RegCloseKey (hKey=0xe0) returned 0x0 [0045.325] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x907d00 | out: hHeap=0x8d0000) returned 1 [0045.325] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.325] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8c) returned 0x907d00 [0045.325] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0045.325] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x93d500, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0045.325] RegCloseKey (hKey=0xe4) returned 0x0 [0045.325] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x907d00 | out: hHeap=0x8d0000) returned 1 [0045.325] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0045.325] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.325] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x907bf8 | out: hHeap=0x8d0000) returned 1 [0045.326] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpDst=0x92d4f8, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe") returned 0x67 [0045.326] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x93d500 | out: hHeap=0x8d0000) returned 1 [0045.326] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92d4f8 | out: hHeap=0x8d0000) returned 1 [0045.326] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x20a0020 [0045.326] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.326] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x905978 [0045.326] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.326] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x905928 [0045.326] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0045.326] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0045.326] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0045.326] lstrlenW (lpString="kernel32.dll") returned 12 [0045.326] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905978 | out: hHeap=0x8d0000) returned 1 [0045.326] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.326] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905928 | out: hHeap=0x8d0000) returned 1 [0045.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1black.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0045.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0045.332] ReadFile (in: hFile=0xe4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x81000, lpOverlapped=0x0) returned 1 [0045.345] WriteFile (in: hFile=0xe8, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x81000, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x18fd98*=0x81000, lpOverlapped=0x0) returned 1 [0045.354] ReadFile (in: hFile=0xe4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0045.354] CloseHandle (hObject=0xe8) returned 1 [0045.358] CloseHandle (hObject=0xe4) returned 1 [0045.358] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.358] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x905928 [0045.358] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.358] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x905978 [0045.358] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0045.358] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0045.358] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0045.358] lstrlenW (lpString="kernel32.dll") returned 12 [0045.358] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905978 | out: hHeap=0x8d0000) returned 1 [0045.358] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.358] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905928 | out: hHeap=0x8d0000) returned 1 [0045.358] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x20a0020 | out: hHeap=0x8d0000) returned 1 [0045.363] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x92d4f8 [0045.363] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x93d500 [0045.363] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.363] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x905928 [0045.363] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905928, Size=0x40) returned 0x906a80 [0045.363] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906a80, Size=0x80) returned 0x92b510 [0045.363] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x907bf8 [0045.363] lstrlenW (lpString="") returned 0 [0045.363] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.363] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8c) returned 0x907d00 [0045.363] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0045.363] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x93d500, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0045.363] RegCloseKey (hKey=0xe4) returned 0x0 [0045.363] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x907d00 | out: hHeap=0x8d0000) returned 1 [0045.363] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0045.364] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.364] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x907bf8 | out: hHeap=0x8d0000) returned 1 [0045.364] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpDst=0x92d4f8, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe") returned 0x48 [0045.364] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x93d500 | out: hHeap=0x8d0000) returned 1 [0045.364] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92d4f8 | out: hHeap=0x8d0000) returned 1 [0045.364] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x20a0020 [0045.364] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.364] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x905928 [0045.364] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.364] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x905978 [0045.364] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0045.364] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0045.364] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0045.364] lstrlenW (lpString="kernel32.dll") returned 12 [0045.364] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905928 | out: hHeap=0x8d0000) returned 1 [0045.364] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.364] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905978 | out: hHeap=0x8d0000) returned 1 [0045.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1black.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0045.364] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0045.366] ReadFile (in: hFile=0xe4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x81000, lpOverlapped=0x0) returned 1 [0045.379] WriteFile (in: hFile=0xe8, lpBuffer=0x20a0020*, nNumberOfBytesToWrite=0x81000, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesWritten=0x18fd98*=0x81000, lpOverlapped=0x0) returned 1 [0045.389] ReadFile (in: hFile=0xe4, lpBuffer=0x20a0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20a0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0045.453] CloseHandle (hObject=0xe8) returned 1 [0045.457] CloseHandle (hObject=0xe4) returned 1 [0045.458] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.458] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x905978 [0045.458] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.458] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x905928 [0045.458] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0045.458] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0045.458] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0045.458] lstrlenW (lpString="kernel32.dll") returned 12 [0045.458] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905928 | out: hHeap=0x8d0000) returned 1 [0045.458] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0045.458] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905978 | out: hHeap=0x8d0000) returned 1 [0045.458] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x20a0020 | out: hHeap=0x8d0000) returned 1 [0045.463] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x90b4e8 | out: hHeap=0x8d0000) returned 1 [0045.463] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91b4f0 | out: hHeap=0x8d0000) returned 1 [0045.463] lstrlenW (lpString="%windir%\\System32") returned 17 [0045.463] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x9069f0 | out: hHeap=0x8d0000) returned 1 [0045.463] lstrlenW (lpString="%appdata%") returned 9 [0045.463] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e43e0 | out: hHeap=0x8d0000) returned 1 [0045.463] lstrlenW (lpString="%sh(Startup)%") returned 13 [0045.463] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e43b8 | out: hHeap=0x8d0000) returned 1 [0045.463] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0045.463] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x906a38 | out: hHeap=0x8d0000) returned 1 [0045.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x8e43b8 [0045.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e43b8, Size=0x40) returned 0x906a38 [0045.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906a38, Size=0x80) returned 0x92b510 [0045.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x8e43b8 [0045.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1fffc) returned 0x90b4e8 [0045.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x92d4f8 [0045.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x93d500 [0045.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0045.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x8e43e0 [0045.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e43e0, Size=0x40) returned 0x906a38 [0045.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906a38, Size=0x80) returned 0x92b598 [0045.464] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b598, Size=0x100) returned 0x907bf8 [0045.464] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.464] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x907bf8 | out: hHeap=0x8d0000) returned 1 [0045.464] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x92d4f8, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0045.464] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x93d500 | out: hHeap=0x8d0000) returned 1 [0045.464] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92d4f8 | out: hHeap=0x8d0000) returned 1 [0045.464] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0045.464] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0045.465] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0045.465] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0045.465] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0xa78, dwThreadId=0xa7c)) returned 1 [0045.478] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0045.478] WriteFile (in: hFile=0xec, lpBuffer=0x92b510*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x92b510*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0045.478] CloseHandle (hObject=0xfc) returned 1 [0045.478] CloseHandle (hObject=0xf8) returned 1 [0045.478] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x90b4e8 | out: hHeap=0x8d0000) returned 1 [0045.478] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0045.479] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92b510 | out: hHeap=0x8d0000) returned 1 [0045.479] lstrlenW (lpString="%comspec%") returned 9 [0045.479] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e43b8 | out: hHeap=0x8d0000) returned 1 [0045.479] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0045.709] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x904a78 [0045.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x904a78, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0045.710] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8e47f0 [0045.710] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x8e47f0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a90 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a90, Size=0x20) returned 0x8e43b8 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e43b8, Size=0x40) returned 0x906a38 [0045.711] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xd0) returned 0x907c70 [0045.711] GetLogicalDrives () returned 0x4 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10014) returned 0x90b4e8 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a90 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a90, Size=0x20) returned 0x8e43b8 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e43b8, Size=0x40) returned 0x906ac8 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906ac8, Size=0x80) returned 0x92b510 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x9091e0 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9091e0, Size=0x200) returned 0x9091e0 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9091e0, Size=0x400) returned 0x9091e0 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9091e0, Size=0x800) returned 0x9097f8 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9097f8, Size=0x1000) returned 0x91b508 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x92d4f8 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a90 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x904b68 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e4798 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x904b80 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x8e47a8 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904b98 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e47a8, Size=0x8) returned 0x8e47a8 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904bb0 [0045.711] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e47a8, Size=0x10) returned 0x8e4760 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904bc8 [0045.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904be0 [0045.712] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4760, Size=0x20) returned 0x907af8 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904bf8 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8e47a8 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x904c10 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x904c28 [0045.712] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x907af8, Size=0x40) returned 0x905320 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x904c40 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x904c58 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x904c70 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x904c88 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904ca0 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904cb8 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x905368 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904cd0 [0045.712] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905320, Size=0x80) returned 0x9091e0 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904ce8 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904d00 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904d18 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x904d30 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909810 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909828 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909840 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8e4760 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909858 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909870 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909888 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x9098a0 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x9098b8 [0045.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x9098d0 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x9098e8 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909900 [0045.713] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9091e0, Size=0x100) returned 0x9091e0 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909918 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909930 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909948 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x909960 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909978 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909990 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8e4770 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x9099a8 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x9099c0 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x9099d8 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x6) returned 0x907af8 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x9099f0 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909a08 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x907b08 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909a20 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909a38 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909a50 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909a68 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909a80 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909a98 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x909ab0 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909ac8 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x909ae0 [0045.713] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909af8 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909b10 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909b28 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909b40 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x907b18 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909b58 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909b70 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909b88 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909ba0 [0045.714] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9091e0, Size=0x200) returned 0x9091e0 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909bb8 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x905320 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909bd0 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909c10 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909c28 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909c40 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909c58 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909c70 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909c88 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909ca0 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909cb8 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909cd0 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909ce8 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909d00 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909d18 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909d30 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909d48 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909d60 [0045.714] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909d78 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909d90 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909da8 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909dc0 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909dd8 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x905330 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909df0 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909e08 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909e20 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x90a010 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909e38 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909e50 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909e68 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909e80 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909e98 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909eb0 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909ec8 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909ee0 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909ef8 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909f10 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909f28 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909f40 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909f58 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x909f70 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909f88 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909fa0 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909fb8 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x909fd0 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c528 [0045.715] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c540 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c558 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x90a020 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x6) returned 0x90a030 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c570 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c588 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c5a0 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c5b8 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c5d0 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91c5e8 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c600 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c618 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c630 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c648 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91c660 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c678 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c690 [0045.716] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9091e0, Size=0x400) returned 0x9091e0 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c6a8 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c6c0 [0045.716] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91c6d8 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c6f0 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c708 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c720 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91c738 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c750 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c768 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c780 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x90a040 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c798 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91c7b0 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c7c8 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c7e0 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c7f8 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c810 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x91c828 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c840 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c858 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c870 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c888 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c8a0 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c8b8 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c8d0 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c8e8 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x90a050 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c928 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c940 [0045.717] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c958 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c970 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c988 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c9a0 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c9b8 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c9d0 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91c9e8 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x91ca00 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ca18 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x91ca30 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ca48 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ca60 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ca78 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ca90 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91caa8 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91cac0 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cad8 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91caf0 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cb08 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cb20 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cb38 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cb50 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cb68 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cb80 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cb98 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cbb0 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cbc8 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cbe0 [0045.718] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cbf8 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cc10 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cc28 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cc40 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cc58 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x91cc70 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x12) returned 0x905f48 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cc88 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cca0 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ccb8 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ccd0 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cce8 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cd28 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cd40 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cd58 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cd70 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cd88 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cda0 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cdb8 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cdd0 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cde8 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ce00 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ce18 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ce30 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ce48 [0045.719] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ce60 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91ce78 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91ce90 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91cea8 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91cec0 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xe) returned 0x91ced8 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91cef0 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x90a060 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cf08 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x90a070 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cf20 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cf38 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cf50 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91cf68 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91cf80 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cf98 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91cfb0 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cfc8 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91cfe0 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91cff8 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91d010 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91d028 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x91d040 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91d058 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x90a080 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91d070 [0045.720] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xa) returned 0x91d088 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9091e0, Size=0x800) returned 0x91d510 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4798, Size=0x8) returned 0x8e4798 [0045.721] lstrlenW (lpString=".wiki") returned 5 [0045.721] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91de50 | out: hHeap=0x8d0000) returned 1 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91de80, Size=0x20) returned 0x8e43b8 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e43b8, Size=0x40) returned 0x906ac8 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906ac8, Size=0x80) returned 0x92b510 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a0f0, Size=0x8) returned 0x90a100 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a100, Size=0x10) returned 0x91de80 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91de80, Size=0x20) returned 0x8e4390 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91deb0, Size=0x20) returned 0x905978 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905978, Size=0x40) returned 0x906ac8 [0045.721] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0045.721] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91deb0, Size=0x20) returned 0x905978 [0045.721] lstrlenW (lpString="Info.hta") returned 8 [0045.722] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x93d500, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1black.exe")) returned 0x30 [0045.722] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x93d500 | out: hHeap=0x8d0000) returned 1 [0045.722] lstrlenW (lpString="1Black.exe") returned 10 [0045.722] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4390, Size=0x40) returned 0x906ac8 [0045.722] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91deb0, Size=0x20) returned 0x8e4390 [0045.722] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91deb0, Size=0x20) returned 0x905978 [0045.722] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905978, Size=0x40) returned 0x906b10 [0045.722] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906b10, Size=0x80) returned 0x92b510 [0045.722] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x91b508 [0045.723] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.723] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91b508 | out: hHeap=0x8d0000) returned 1 [0045.723] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x93d500, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0045.723] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x94d508 | out: hHeap=0x8d0000) returned 1 [0045.723] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x93d500 | out: hHeap=0x8d0000) returned 1 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a100, Size=0x8) returned 0x90a0f0 [0045.723] lstrlenW (lpString="%windir%;") returned 9 [0045.723] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e4390 | out: hHeap=0x8d0000) returned 1 [0045.723] lstrlenW (lpString="C:\\Windows;") returned 11 [0045.723] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92d4f8 | out: hHeap=0x8d0000) returned 1 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91dec8, Size=0x20) returned 0x8e4390 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x8e4390, Size=0x40) returned 0x906b10 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906b10, Size=0x80) returned 0x92b510 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x91b508 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a130, Size=0x8) returned 0x90a140 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a140, Size=0x10) returned 0x91df10 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91df10, Size=0x20) returned 0x8e4390 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a100, Size=0x8) returned 0x90a140 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a110, Size=0x8) returned 0x90a100 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a130, Size=0x8) returned 0x90a150 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a150, Size=0x10) returned 0x91dfb8 [0045.723] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91dfb8, Size=0x20) returned 0x905978 [0045.724] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a140, Size=0x10) returned 0x91dfb8 [0045.724] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a100, Size=0x10) returned 0x91dfe8 [0045.724] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a140, Size=0x8) returned 0x90a130 [0045.724] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a160, Size=0x8) returned 0x90a170 [0045.724] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91dfb8, Size=0x20) returned 0x905928 [0045.724] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91dfe8, Size=0x20) returned 0x905888 [0045.724] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a180, Size=0x8) returned 0x90a190 [0045.724] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91e060, Size=0x20) returned 0x9059a0 [0045.724] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x92d4f8, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0045.724] lstrlenW (lpString="C:\\") returned 3 [0045.724] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.724] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92d4f8 | out: hHeap=0x8d0000) returned 1 [0045.725] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a1c0, Size=0x82) returned 0x91b9e0 [0045.725] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a1e0, Size=0x100) returned 0x91ba70 [0045.725] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91bb78, Size=0x104) returned 0x91bc98 [0045.725] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b620, Size=0x100) returned 0x91bda8 [0045.725] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91b9e0, Size=0x104) returned 0x91beb0 [0045.725] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91ba70, Size=0x200) returned 0x91bfc0 [0045.726] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x90a1d0 | out: hHeap=0x8d0000) returned 1 [0045.726] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91bfc0 | out: hHeap=0x8d0000) returned 1 [0045.726] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91b5f8 | out: hHeap=0x8d0000) returned 1 [0045.726] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92b6a8 | out: hHeap=0x8d0000) returned 1 [0045.726] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91e0c0 | out: hHeap=0x8d0000) returned 1 [0045.726] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92b730 | out: hHeap=0x8d0000) returned 1 [0045.727] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91e0f0 | out: hHeap=0x8d0000) returned 1 [0045.727] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91beb0 | out: hHeap=0x8d0000) returned 1 [0045.727] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91e0d8 | out: hHeap=0x8d0000) returned 1 [0045.727] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91bc98 | out: hHeap=0x8d0000) returned 1 [0045.727] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91b610 | out: hHeap=0x8d0000) returned 1 [0045.727] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91bc08 | out: hHeap=0x8d0000) returned 1 [0045.727] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x91b628 | out: hHeap=0x8d0000) returned 1 [0045.727] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91e0d8, Size=0x20) returned 0x9059c8 [0045.727] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9059c8, Size=0x40) returned 0x906b10 [0045.727] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x90b4e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91e0a8, Size=0x20) returned 0x9059c8 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9059c8, Size=0x40) returned 0x906b58 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906b58, Size=0x80) returned 0x92b510 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x91b9e0 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91b9e0, Size=0x200) returned 0x91b9e0 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91b9e0, Size=0x400) returned 0x91b9e0 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91b9e0, Size=0x800) returned 0x91b9e0 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91b9e0, Size=0x1000) returned 0x920120 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a180, Size=0x8) returned 0x90a1a0 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a1a0, Size=0x10) returned 0x91e0c0 [0045.728] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91e0c0, Size=0x20) returned 0x9059c8 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9059c8, Size=0x40) returned 0x906b58 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906b58, Size=0x80) returned 0x92b510 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x921140 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x921140, Size=0x200) returned 0x91bde0 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91bde0, Size=0x400) returned 0x923128 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x923128, Size=0x800) returned 0x924130 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x924fe0, Size=0x20) returned 0x9059c8 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9059c8, Size=0x40) returned 0x906b58 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906b58, Size=0x80) returned 0x92b510 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a320, Size=0x8) returned 0x90a330 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a330, Size=0x10) returned 0x924fe0 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x924fe0, Size=0x20) returned 0x905a18 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x925010, Size=0x20) returned 0x905a40 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905a40, Size=0x40) returned 0x906b58 [0045.729] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0045.729] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x925010, Size=0x20) returned 0x905a40 [0045.730] lstrlenW (lpString="Info.hta") returned 8 [0045.730] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x94d520, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\1black.exe")) returned 0x30 [0045.730] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x94d520 | out: hHeap=0x8d0000) returned 1 [0045.730] lstrlenW (lpString="1Black.exe") returned 10 [0045.730] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905a18, Size=0x40) returned 0x906b58 [0045.730] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x925010, Size=0x20) returned 0x905a18 [0045.730] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x925010, Size=0x20) returned 0x905a40 [0045.730] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905a40, Size=0x40) returned 0x906ba0 [0045.730] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906ba0, Size=0x80) returned 0x92b510 [0045.730] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x921140 [0045.730] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0045.730] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x921140 | out: hHeap=0x8d0000) returned 1 [0045.730] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x94d520, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0045.730] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x95d528 | out: hHeap=0x8d0000) returned 1 [0045.730] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x94d520 | out: hHeap=0x8d0000) returned 1 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a330, Size=0x8) returned 0x90a320 [0045.731] lstrlenW (lpString="%windir%;") returned 9 [0045.731] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905a18 | out: hHeap=0x8d0000) returned 1 [0045.731] lstrlenW (lpString="C:\\Windows;") returned 11 [0045.731] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x93d518 | out: hHeap=0x8d0000) returned 1 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x925028, Size=0x20) returned 0x905a18 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905a18, Size=0x40) returned 0x906ba0 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906ba0, Size=0x80) returned 0x92b510 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x921140 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a360, Size=0x8) returned 0x90a370 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a370, Size=0x10) returned 0x925070 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x925070, Size=0x20) returned 0x905a18 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a330, Size=0x8) returned 0x90a370 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a340, Size=0x8) returned 0x90a330 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a360, Size=0x8) returned 0x90a380 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a380, Size=0x10) returned 0x925118 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x925118, Size=0x20) returned 0x905a40 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a370, Size=0x10) returned 0x925118 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a330, Size=0x10) returned 0x920150 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a370, Size=0x8) returned 0x90a360 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a390, Size=0x8) returned 0x90a3a0 [0045.731] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x925118, Size=0x20) returned 0x905a68 [0045.732] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920150, Size=0x20) returned 0x905a90 [0045.732] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a3b0, Size=0x8) returned 0x90a3c0 [0045.732] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9201e0, Size=0x20) returned 0x905ae0 [0045.732] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x93d518, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0045.732] lstrlenW (lpString="C:\\") returned 3 [0045.732] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0045.732] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x93d518 | out: hHeap=0x8d0000) returned 1 [0045.732] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x923140, Size=0x82) returned 0x91be70 [0045.732] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x923160, Size=0x100) returned 0x921140 [0045.732] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91be70, Size=0x104) returned 0x9209b0 [0045.732] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x91bf00, Size=0x104) returned 0x920ac0 [0045.732] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b730, Size=0x100) returned 0x921248 [0045.732] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x921140, Size=0x200) returned 0x925150 [0045.733] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x923150 | out: hHeap=0x8d0000) returned 1 [0045.733] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x925150 | out: hHeap=0x8d0000) returned 1 [0045.733] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x920288 | out: hHeap=0x8d0000) returned 1 [0045.733] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92b6a8 | out: hHeap=0x8d0000) returned 1 [0045.733] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x920240 | out: hHeap=0x8d0000) returned 1 [0045.733] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x92b620 | out: hHeap=0x8d0000) returned 1 [0045.734] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x920270 | out: hHeap=0x8d0000) returned 1 [0045.734] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x9209b0 | out: hHeap=0x8d0000) returned 1 [0045.734] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x920258 | out: hHeap=0x8d0000) returned 1 [0045.734] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x920ac0 | out: hHeap=0x8d0000) returned 1 [0045.734] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x9202a0 | out: hHeap=0x8d0000) returned 1 [0045.734] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x920920 | out: hHeap=0x8d0000) returned 1 [0045.734] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x9202b8 | out: hHeap=0x8d0000) returned 1 [0045.734] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9202b8, Size=0x20) returned 0x905b08 [0045.734] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905b08, Size=0x40) returned 0x906ba0 [0045.734] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x92d4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0045.735] WaitForMultipleObjects (nCount=0x2, lpHandles=0x907c70*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 7 os_tid = 0xa74 Thread: id = 9 os_tid = 0xa80 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920228 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920228, Size=0x20) returned 0x905b08 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905b08, Size=0x40) returned 0x906be8 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906be8, Size=0x80) returned 0x92b510 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x921248 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920228 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920228, Size=0x20) returned 0x905b08 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905b08, Size=0x40) returned 0x906be8 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x906be8, Size=0x80) returned 0x92b510 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x92b510, Size=0x100) returned 0x921140 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x920228 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x90a3b0 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9201f8 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a3b0, Size=0x8) returned 0x90a3e0 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x14) returned 0x906188 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a3e0, Size=0x10) returned 0x920210 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x18) returned 0x9061a8 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1a) returned 0x905b08 [0046.463] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920210, Size=0x20) returned 0x905b30 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1c) returned 0x905b58 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x16) returned 0x9061c8 [0046.463] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1a) returned 0x905b80 [0046.464] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xc) returned 0x920210 [0046.464] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x4) returned 0x90a3e0 [0046.464] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40) returned 0x906be8 [0046.464] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a3e0, Size=0x8) returned 0x90a3b0 [0046.464] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x3c) returned 0x906c30 [0046.464] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x90a3b0, Size=0x10) returned 0x9201e0 [0046.464] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x14) returned 0x9061e8 [0046.464] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x18) returned 0x906208 [0046.464] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9201e0, Size=0x20) returned 0x905ba8 [0046.464] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x24) returned 0x90a438 [0046.464] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0046.464] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x921248 | out: hHeap=0x8d0000) returned 1 [0046.464] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0046.464] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x921140 | out: hHeap=0x8d0000) returned 1 [0046.464] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x905c48 [0046.467] EnumServicesStatusExW (in: hSCManager=0x905c48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0046.469] GetLastError () returned 0xea [0046.469] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x125a) returned 0x93e558 [0046.469] EnumServicesStatusExW (in: hSCManager=0x905c48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x93e558, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x93e558, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0046.470] CloseServiceHandle (hSCObject=0x905c48) returned 1 [0046.470] lstrlenW (lpString="Appinfo") returned 7 [0046.470] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0046.470] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0046.471] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0046.471] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0046.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0046.471] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0046.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.471] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0046.471] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0046.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0046.471] lstrlenW (lpString="AudioSrv") returned 8 [0046.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0046.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0046.471] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0046.471] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0046.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0046.471] lstrlenW (lpString="BFE") returned 3 [0046.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0046.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0046.471] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0046.471] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0046.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0046.471] lstrlenW (lpString="CryptSvc") returned 8 [0046.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0046.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0046.471] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0046.471] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0046.471] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0046.471] lstrlenW (lpString="CscService") returned 10 [0046.471] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0046.471] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0046.471] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0046.472] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0046.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0046.472] lstrlenW (lpString="DcomLaunch") returned 10 [0046.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.472] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0046.472] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0046.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0046.472] lstrlenW (lpString="Dhcp") returned 4 [0046.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0046.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0046.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0046.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0046.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0046.472] lstrlenW (lpString="Dnscache") returned 8 [0046.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0046.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0046.472] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0046.472] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0046.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0046.472] lstrlenW (lpString="DPS") returned 3 [0046.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0046.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0046.472] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0046.472] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0046.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0046.472] lstrlenW (lpString="eventlog") returned 8 [0046.472] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0046.472] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0046.472] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0046.472] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0046.472] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0046.473] lstrlenW (lpString="EventSystem") returned 11 [0046.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0046.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0046.473] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0046.473] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0046.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0046.473] lstrlenW (lpString="FontCache") returned 9 [0046.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0046.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0046.473] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0046.473] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0046.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0046.473] lstrlenW (lpString="gpsvc") returned 5 [0046.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0046.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0046.473] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0046.473] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0046.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0046.473] lstrlenW (lpString="iphlpsvc") returned 8 [0046.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.473] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0046.473] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0046.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0046.473] lstrlenW (lpString="LanmanServer") returned 12 [0046.473] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0046.473] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0046.473] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0046.473] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0046.473] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0046.473] lstrlenW (lpString="LanmanWorkstation") returned 17 [0046.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.474] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0046.474] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0046.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0046.474] lstrlenW (lpString="lmhosts") returned 7 [0046.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0046.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0046.474] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0046.474] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0046.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0046.474] lstrlenW (lpString="MMCSS") returned 5 [0046.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0046.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0046.474] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0046.474] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0046.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0046.474] lstrlenW (lpString="MpsSvc") returned 6 [0046.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0046.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0046.474] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0046.474] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0046.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0046.474] lstrlenW (lpString="Netman") returned 6 [0046.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0046.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0046.474] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0046.474] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0046.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0046.474] lstrlenW (lpString="netprofm") returned 8 [0046.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0046.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0046.475] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0046.475] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0046.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0046.475] lstrlenW (lpString="NlaSvc") returned 6 [0046.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0046.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0046.475] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0046.475] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0046.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0046.475] lstrlenW (lpString="nsi") returned 3 [0046.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0046.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0046.475] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0046.475] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0046.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0046.475] lstrlenW (lpString="PcaSvc") returned 6 [0046.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0046.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0046.475] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0046.475] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0046.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0046.475] lstrlenW (lpString="PlugPlay") returned 8 [0046.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0046.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0046.475] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0046.475] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0046.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0046.475] lstrlenW (lpString="Power") returned 5 [0046.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0046.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0046.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0046.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0046.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0046.476] lstrlenW (lpString="ProfSvc") returned 7 [0046.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0046.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0046.476] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0046.476] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0046.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0046.476] lstrlenW (lpString="RpcEptMapper") returned 12 [0046.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.476] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0046.476] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0046.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0046.476] lstrlenW (lpString="RpcSs") returned 5 [0046.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0046.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0046.476] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0046.476] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0046.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0046.476] lstrlenW (lpString="SamSs") returned 5 [0046.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0046.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0046.476] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0046.476] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0046.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0046.476] lstrlenW (lpString="Schedule") returned 8 [0046.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0046.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0046.476] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0046.476] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0046.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0046.477] lstrlenW (lpString="SENS") returned 4 [0046.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0046.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0046.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0046.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0046.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0046.477] lstrlenW (lpString="ShellHWDetection") returned 16 [0046.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.477] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0046.477] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0046.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0046.477] lstrlenW (lpString="Spooler") returned 7 [0046.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0046.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0046.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0046.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0046.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0046.477] lstrlenW (lpString="SysMain") returned 7 [0046.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0046.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0046.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0046.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0046.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0046.477] lstrlenW (lpString="Themes") returned 6 [0046.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0046.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0046.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0046.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0046.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0046.478] lstrlenW (lpString="TrkWks") returned 6 [0046.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0046.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0046.478] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0046.478] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0046.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0046.478] lstrlenW (lpString="UxSms") returned 5 [0046.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0046.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0046.478] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0046.478] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0046.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0046.478] lstrlenW (lpString="WdiServiceHost") returned 14 [0046.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.478] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0046.478] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0046.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0046.478] lstrlenW (lpString="WdiSystemHost") returned 13 [0046.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.478] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0046.478] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0046.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0046.478] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0046.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.478] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0046.478] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0046.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0046.479] lstrlenW (lpString="Winmgmt") returned 7 [0046.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0046.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0046.479] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0046.479] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0046.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0046.479] lstrlenW (lpString="WPDBusEnum") returned 10 [0046.479] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.479] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.479] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0046.479] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0046.479] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0046.479] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x93e558 | out: hHeap=0x8d0000) returned 1 [0046.479] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0046.483] Process32FirstW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.483] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.484] lstrlenW (lpString="System") returned 6 [0046.484] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0046.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0046.484] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0046.484] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0046.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0046.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0046.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0046.484] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.484] lstrlenW (lpString="smss.exe") returned 8 [0046.484] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0046.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0046.485] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0046.485] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0046.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0046.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0046.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0046.485] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.485] lstrlenW (lpString="csrss.exe") returned 9 [0046.485] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.485] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.485] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.485] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.485] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.485] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.485] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0046.485] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.486] lstrlenW (lpString="wininit.exe") returned 11 [0046.486] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0046.486] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0046.486] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0046.486] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0046.486] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0046.486] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0046.486] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0046.486] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.486] lstrlenW (lpString="csrss.exe") returned 9 [0046.486] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.487] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.487] lstrlenW (lpString="winlogon.exe") returned 12 [0046.487] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.487] lstrlenW (lpString="services.exe") returned 12 [0046.488] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.488] lstrlenW (lpString="lsass.exe") returned 9 [0046.488] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.488] lstrlenW (lpString="lsm.exe") returned 7 [0046.489] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.489] lstrlenW (lpString="svchost.exe") returned 11 [0046.489] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.489] lstrlenW (lpString="svchost.exe") returned 11 [0046.489] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.490] lstrlenW (lpString="svchost.exe") returned 11 [0046.490] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.490] lstrlenW (lpString="svchost.exe") returned 11 [0046.490] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.491] lstrlenW (lpString="svchost.exe") returned 11 [0046.491] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.491] lstrlenW (lpString="audiodg.exe") returned 11 [0046.491] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.492] lstrlenW (lpString="svchost.exe") returned 11 [0046.492] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.492] lstrlenW (lpString="svchost.exe") returned 11 [0046.492] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.493] lstrlenW (lpString="dwm.exe") returned 7 [0046.493] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.493] lstrlenW (lpString="explorer.exe") returned 12 [0046.493] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.494] lstrlenW (lpString="spoolsv.exe") returned 11 [0046.494] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.494] lstrlenW (lpString="taskhost.exe") returned 12 [0046.494] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.495] lstrlenW (lpString="svchost.exe") returned 11 [0046.495] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.495] lstrlenW (lpString="taskeng.exe") returned 11 [0046.495] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.496] lstrlenW (lpString="taskhost.exe") returned 12 [0046.496] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0046.496] lstrlenW (lpString="tested.exe") returned 10 [0046.496] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0046.497] lstrlenW (lpString="memories global commission.exe") returned 30 [0046.497] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0046.688] lstrlenW (lpString="destination.exe") returned 15 [0046.688] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0046.689] lstrlenW (lpString="rom.exe") returned 7 [0046.689] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0046.689] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0046.689] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0046.690] lstrlenW (lpString="appropriate worm.exe") returned 20 [0046.690] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0046.690] lstrlenW (lpString="arrival-testing.exe") returned 19 [0046.690] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0046.691] lstrlenW (lpString="san stories panels.exe") returned 22 [0046.691] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0046.691] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0046.691] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0046.692] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0046.692] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0046.692] lstrlenW (lpString="taught opt practice.exe") returned 23 [0046.692] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0046.693] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0046.693] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0046.693] lstrlenW (lpString="aka gap.exe") returned 11 [0046.693] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0046.694] lstrlenW (lpString="copied-mr.exe") returned 13 [0046.694] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0046.694] lstrlenW (lpString="proven.exe") returned 10 [0046.694] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0046.695] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0046.695] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0046.695] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0046.695] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0046.696] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0046.696] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0046.696] lstrlenW (lpString="acm.exe") returned 7 [0046.696] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0046.697] lstrlenW (lpString="fluid.exe") returned 9 [0046.697] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0046.697] lstrlenW (lpString="domain.exe") returned 10 [0046.697] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0046.698] lstrlenW (lpString="cult_wanna.exe") returned 14 [0046.698] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.698] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.698] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0046.715] lstrlenW (lpString="mobsync.exe") returned 11 [0046.715] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.715] lstrlenW (lpString="svchost.exe") returned 11 [0046.715] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0046.716] lstrlenW (lpString="1Black.exe") returned 10 [0046.716] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.716] lstrlenW (lpString="cmd.exe") returned 7 [0046.716] Process32NextW (in: hSnapshot=0x118, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0046.717] CloseHandle (hObject=0x118) returned 1 [0046.717] Sleep (dwMilliseconds=0x1f4) [0047.652] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94fa80 [0047.653] EnumServicesStatusExW (in: hSCManager=0x94fa80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0047.653] GetLastError () returned 0xea [0047.653] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x125a) returned 0x3f23478 [0047.653] EnumServicesStatusExW (in: hSCManager=0x94fa80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f23478, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f23478, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0047.654] CloseServiceHandle (hSCObject=0x94fa80) returned 1 [0047.654] lstrlenW (lpString="Appinfo") returned 7 [0047.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.654] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.654] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.654] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.654] lstrlenW (lpString="AudioSrv") returned 8 [0047.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.654] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.655] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.655] lstrlenW (lpString="BFE") returned 3 [0047.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.655] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.655] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.655] lstrlenW (lpString="CryptSvc") returned 8 [0047.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.655] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.655] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.655] lstrlenW (lpString="CscService") returned 10 [0047.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.655] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.655] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.655] lstrlenW (lpString="DcomLaunch") returned 10 [0047.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.655] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.655] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.655] lstrlenW (lpString="Dhcp") returned 4 [0047.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.655] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.655] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.655] lstrlenW (lpString="Dnscache") returned 8 [0047.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.656] lstrlenW (lpString="DPS") returned 3 [0047.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.656] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.656] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.656] lstrlenW (lpString="eventlog") returned 8 [0047.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.656] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.656] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.656] lstrlenW (lpString="EventSystem") returned 11 [0047.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.656] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.656] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.656] lstrlenW (lpString="FontCache") returned 9 [0047.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0047.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0047.656] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0047.656] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0047.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0047.656] lstrlenW (lpString="gpsvc") returned 5 [0047.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.656] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.657] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.657] lstrlenW (lpString="iphlpsvc") returned 8 [0047.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.657] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.657] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.657] lstrlenW (lpString="LanmanServer") returned 12 [0047.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.657] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.657] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.657] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.657] lstrlenW (lpString="lmhosts") returned 7 [0047.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.657] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.657] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.657] lstrlenW (lpString="MMCSS") returned 5 [0047.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.657] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.657] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.658] lstrlenW (lpString="MpsSvc") returned 6 [0047.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.658] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.658] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.658] lstrlenW (lpString="Netman") returned 6 [0047.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.658] lstrlenW (lpString="netprofm") returned 8 [0047.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.658] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.658] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.658] lstrlenW (lpString="NlaSvc") returned 6 [0047.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.658] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.658] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.658] lstrlenW (lpString="nsi") returned 3 [0047.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.658] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.658] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.658] lstrlenW (lpString="PcaSvc") returned 6 [0047.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.659] lstrlenW (lpString="PlugPlay") returned 8 [0047.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.659] lstrlenW (lpString="Power") returned 5 [0047.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.659] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.659] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.659] lstrlenW (lpString="ProfSvc") returned 7 [0047.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.659] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.659] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.659] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.659] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.659] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.659] lstrlenW (lpString="RpcSs") returned 5 [0047.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.659] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.659] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.660] lstrlenW (lpString="SamSs") returned 5 [0047.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.660] lstrlenW (lpString="Schedule") returned 8 [0047.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.660] lstrlenW (lpString="SENS") returned 4 [0047.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.660] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.660] lstrlenW (lpString="Spooler") returned 7 [0047.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.660] lstrlenW (lpString="SysMain") returned 7 [0047.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.661] lstrlenW (lpString="Themes") returned 6 [0047.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.661] lstrlenW (lpString="TrkWks") returned 6 [0047.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.661] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.661] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.661] lstrlenW (lpString="UxSms") returned 5 [0047.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.661] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.661] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.661] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.661] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.661] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.661] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.661] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.661] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.662] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.662] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.662] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.662] lstrlenW (lpString="Winmgmt") returned 7 [0047.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.662] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.662] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.662] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.662] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.662] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.662] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f23478 | out: hHeap=0x8d0000) returned 1 [0047.662] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0047.786] Process32FirstW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.789] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.789] lstrlenW (lpString="System") returned 6 [0047.789] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.789] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.789] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.789] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.789] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.789] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.789] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.789] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.790] lstrlenW (lpString="smss.exe") returned 8 [0047.790] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.790] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.790] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.790] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.790] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.790] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.790] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.790] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.791] lstrlenW (lpString="csrss.exe") returned 9 [0047.791] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.791] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.791] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.791] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.791] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.791] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.791] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.791] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.791] lstrlenW (lpString="wininit.exe") returned 11 [0047.791] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.791] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.791] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.791] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0047.792] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0047.792] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0047.792] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0047.792] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.792] lstrlenW (lpString="csrss.exe") returned 9 [0047.792] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.792] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.793] lstrlenW (lpString="winlogon.exe") returned 12 [0047.793] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.793] lstrlenW (lpString="services.exe") returned 12 [0047.793] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.794] lstrlenW (lpString="lsass.exe") returned 9 [0047.794] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.794] lstrlenW (lpString="lsm.exe") returned 7 [0047.794] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.795] lstrlenW (lpString="svchost.exe") returned 11 [0047.795] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.795] lstrlenW (lpString="svchost.exe") returned 11 [0047.795] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.796] lstrlenW (lpString="svchost.exe") returned 11 [0047.796] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.796] lstrlenW (lpString="svchost.exe") returned 11 [0047.796] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.797] lstrlenW (lpString="svchost.exe") returned 11 [0047.797] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.797] lstrlenW (lpString="audiodg.exe") returned 11 [0047.797] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.798] lstrlenW (lpString="svchost.exe") returned 11 [0047.798] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.798] lstrlenW (lpString="svchost.exe") returned 11 [0047.798] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.799] lstrlenW (lpString="dwm.exe") returned 7 [0047.799] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.799] lstrlenW (lpString="explorer.exe") returned 12 [0047.799] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.800] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.800] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.800] lstrlenW (lpString="taskhost.exe") returned 12 [0047.800] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.801] lstrlenW (lpString="svchost.exe") returned 11 [0047.801] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.801] lstrlenW (lpString="taskeng.exe") returned 11 [0047.801] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.802] lstrlenW (lpString="taskhost.exe") returned 12 [0047.802] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0047.802] lstrlenW (lpString="tested.exe") returned 10 [0047.802] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0047.803] lstrlenW (lpString="memories global commission.exe") returned 30 [0047.803] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0047.803] lstrlenW (lpString="destination.exe") returned 15 [0047.803] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0047.804] lstrlenW (lpString="rom.exe") returned 7 [0047.804] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0047.804] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0047.804] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0047.805] lstrlenW (lpString="appropriate worm.exe") returned 20 [0047.805] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0047.805] lstrlenW (lpString="arrival-testing.exe") returned 19 [0047.805] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0047.851] lstrlenW (lpString="san stories panels.exe") returned 22 [0047.851] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0047.852] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0047.852] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0047.852] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0047.852] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0047.853] lstrlenW (lpString="taught opt practice.exe") returned 23 [0047.853] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0047.854] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0047.854] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0047.854] lstrlenW (lpString="aka gap.exe") returned 11 [0047.854] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0047.855] lstrlenW (lpString="copied-mr.exe") returned 13 [0047.855] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0047.855] lstrlenW (lpString="proven.exe") returned 10 [0047.855] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0047.856] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0047.856] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0047.856] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0047.856] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0047.857] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0047.857] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0047.857] lstrlenW (lpString="acm.exe") returned 7 [0047.857] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0047.858] lstrlenW (lpString="fluid.exe") returned 9 [0047.858] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0047.858] lstrlenW (lpString="domain.exe") returned 10 [0047.858] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0047.859] lstrlenW (lpString="cult_wanna.exe") returned 14 [0047.859] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.859] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.859] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0047.860] lstrlenW (lpString="mobsync.exe") returned 11 [0047.860] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.860] lstrlenW (lpString="svchost.exe") returned 11 [0047.860] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0047.861] lstrlenW (lpString="1Black.exe") returned 10 [0047.861] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.861] lstrlenW (lpString="cmd.exe") returned 7 [0047.862] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.862] lstrlenW (lpString="conhost.exe") returned 11 [0047.862] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0047.863] lstrlenW (lpString="mode.com") returned 8 [0047.863] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0048.254] CloseHandle (hObject=0x17c) returned 1 [0048.265] Sleep (dwMilliseconds=0x1f4) [0048.985] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94fb70 [0048.985] EnumServicesStatusExW (in: hSCManager=0x94fb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0048.985] GetLastError () returned 0xea [0048.985] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x125a) returned 0x38306e8 [0048.985] EnumServicesStatusExW (in: hSCManager=0x94fb70, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38306e8, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38306e8, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0048.986] CloseServiceHandle (hSCObject=0x94fb70) returned 1 [0048.986] lstrlenW (lpString="Appinfo") returned 7 [0048.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.986] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.986] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.986] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.986] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.986] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.986] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.986] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.986] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.986] lstrlenW (lpString="AudioSrv") returned 8 [0048.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.987] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.987] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.987] lstrlenW (lpString="BFE") returned 3 [0048.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.987] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.987] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.987] lstrlenW (lpString="CryptSvc") returned 8 [0048.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.987] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.987] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.987] lstrlenW (lpString="CscService") returned 10 [0048.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.987] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.987] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.987] lstrlenW (lpString="DcomLaunch") returned 10 [0048.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.987] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.987] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.987] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.987] lstrlenW (lpString="Dhcp") returned 4 [0048.987] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.987] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.987] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.988] lstrlenW (lpString="Dnscache") returned 8 [0048.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.988] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.988] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.988] lstrlenW (lpString="DPS") returned 3 [0048.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.988] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.988] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.988] lstrlenW (lpString="eventlog") returned 8 [0048.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.988] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.988] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.988] lstrlenW (lpString="EventSystem") returned 11 [0048.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.988] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.988] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.988] lstrlenW (lpString="FontCache") returned 9 [0048.988] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0048.988] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0048.988] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0048.988] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0048.988] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0048.989] lstrlenW (lpString="gpsvc") returned 5 [0048.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.989] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.989] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.989] lstrlenW (lpString="iphlpsvc") returned 8 [0048.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.989] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.989] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.989] lstrlenW (lpString="LanmanServer") returned 12 [0048.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.989] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.989] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.989] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.989] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.989] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.989] lstrlenW (lpString="lmhosts") returned 7 [0048.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.989] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.989] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.989] lstrlenW (lpString="MMCSS") returned 5 [0048.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.990] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.990] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.990] lstrlenW (lpString="MpsSvc") returned 6 [0048.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.990] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.990] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.990] lstrlenW (lpString="Netman") returned 6 [0048.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.990] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.990] lstrlenW (lpString="netprofm") returned 8 [0048.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.990] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.990] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.990] lstrlenW (lpString="NlaSvc") returned 6 [0048.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.990] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.990] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.990] lstrlenW (lpString="nsi") returned 3 [0048.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.990] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.990] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.991] lstrlenW (lpString="PcaSvc") returned 6 [0048.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.991] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.991] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.991] lstrlenW (lpString="PlugPlay") returned 8 [0048.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.991] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.991] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.991] lstrlenW (lpString="Power") returned 5 [0048.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.991] lstrlenW (lpString="ProfSvc") returned 7 [0048.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.991] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.991] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.991] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.991] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.991] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.991] lstrlenW (lpString="RpcSs") returned 5 [0048.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.992] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.992] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.992] lstrlenW (lpString="SamSs") returned 5 [0048.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.992] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.992] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.992] lstrlenW (lpString="Schedule") returned 8 [0048.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.992] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.992] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.992] lstrlenW (lpString="SENS") returned 4 [0048.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.992] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.992] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.992] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.992] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.992] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.993] lstrlenW (lpString="Spooler") returned 7 [0048.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.993] lstrlenW (lpString="SysMain") returned 7 [0048.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.993] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.993] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.993] lstrlenW (lpString="Themes") returned 6 [0048.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.993] lstrlenW (lpString="TrkWks") returned 6 [0048.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.993] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.993] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.993] lstrlenW (lpString="UxSms") returned 5 [0048.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.993] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.993] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.993] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.994] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.994] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.994] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.994] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.994] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.994] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.994] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.994] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.994] lstrlenW (lpString="Winmgmt") returned 7 [0048.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.994] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.994] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.994] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.994] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0048.994] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x17c [0048.997] Process32FirstW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.997] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.998] lstrlenW (lpString="System") returned 6 [0048.998] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.998] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.998] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.998] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.998] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.998] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.998] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.998] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.998] lstrlenW (lpString="smss.exe") returned 8 [0048.998] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.999] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.999] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.999] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.999] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.999] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.999] lstrlenW (lpString="csrss.exe") returned 9 [0048.999] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.999] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.999] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.999] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.999] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.999] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.999] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.999] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.000] lstrlenW (lpString="wininit.exe") returned 11 [0049.000] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.000] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.000] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.000] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0049.000] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0049.000] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0049.000] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0049.000] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.001] lstrlenW (lpString="csrss.exe") returned 9 [0049.001] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.001] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.001] lstrlenW (lpString="winlogon.exe") returned 12 [0049.001] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.002] lstrlenW (lpString="services.exe") returned 12 [0049.002] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.002] lstrlenW (lpString="lsass.exe") returned 9 [0049.002] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.003] lstrlenW (lpString="lsm.exe") returned 7 [0049.003] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.003] lstrlenW (lpString="svchost.exe") returned 11 [0049.003] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.004] lstrlenW (lpString="svchost.exe") returned 11 [0049.004] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.004] lstrlenW (lpString="svchost.exe") returned 11 [0049.004] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.005] lstrlenW (lpString="svchost.exe") returned 11 [0049.005] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x27, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.005] lstrlenW (lpString="svchost.exe") returned 11 [0049.005] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.006] lstrlenW (lpString="audiodg.exe") returned 11 [0049.006] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.006] lstrlenW (lpString="svchost.exe") returned 11 [0049.006] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.007] lstrlenW (lpString="svchost.exe") returned 11 [0049.007] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.008] lstrlenW (lpString="dwm.exe") returned 7 [0049.008] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.008] lstrlenW (lpString="explorer.exe") returned 12 [0049.008] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.009] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.009] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.009] lstrlenW (lpString="taskhost.exe") returned 12 [0049.009] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.010] lstrlenW (lpString="svchost.exe") returned 11 [0049.010] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.010] lstrlenW (lpString="taskeng.exe") returned 11 [0049.010] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.011] lstrlenW (lpString="taskhost.exe") returned 12 [0049.011] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0049.011] lstrlenW (lpString="tested.exe") returned 10 [0049.011] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0049.012] lstrlenW (lpString="memories global commission.exe") returned 30 [0049.012] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0049.012] lstrlenW (lpString="destination.exe") returned 15 [0049.012] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0049.013] lstrlenW (lpString="rom.exe") returned 7 [0049.013] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0049.013] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0049.013] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0049.014] lstrlenW (lpString="appropriate worm.exe") returned 20 [0049.014] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0049.014] lstrlenW (lpString="arrival-testing.exe") returned 19 [0049.014] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0049.015] lstrlenW (lpString="san stories panels.exe") returned 22 [0049.015] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0049.015] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0049.015] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0049.016] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0049.016] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0049.016] lstrlenW (lpString="taught opt practice.exe") returned 23 [0049.016] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0049.294] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0049.294] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0049.294] lstrlenW (lpString="aka gap.exe") returned 11 [0049.294] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0049.295] lstrlenW (lpString="copied-mr.exe") returned 13 [0049.295] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0049.295] lstrlenW (lpString="proven.exe") returned 10 [0049.295] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0049.296] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0049.296] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0049.296] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0049.296] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0049.297] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0049.297] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0049.297] lstrlenW (lpString="acm.exe") returned 7 [0049.297] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0049.298] lstrlenW (lpString="fluid.exe") returned 9 [0049.298] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0049.299] lstrlenW (lpString="domain.exe") returned 10 [0049.299] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0049.299] lstrlenW (lpString="cult_wanna.exe") returned 14 [0049.299] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.300] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.300] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="mobsync.exe")) returned 1 [0049.300] lstrlenW (lpString="mobsync.exe") returned 11 [0049.300] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.301] lstrlenW (lpString="svchost.exe") returned 11 [0049.301] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0049.301] lstrlenW (lpString="1Black.exe") returned 10 [0049.301] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.302] lstrlenW (lpString="cmd.exe") returned 7 [0049.302] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.302] lstrlenW (lpString="conhost.exe") returned 11 [0049.302] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0049.303] lstrlenW (lpString="mode.com") returned 8 [0049.303] Process32NextW (in: hSnapshot=0x17c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xacc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0049.304] CloseHandle (hObject=0x17c) returned 1 [0049.304] Sleep (dwMilliseconds=0x1f4) [0050.039] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94fcb0 [0050.040] EnumServicesStatusExW (in: hSCManager=0x94fcb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0050.040] GetLastError () returned 0xea [0050.040] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x125a) returned 0x3fec510 [0050.040] EnumServicesStatusExW (in: hSCManager=0x94fcb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fec510, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fec510, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0050.041] CloseServiceHandle (hSCObject=0x94fcb0) returned 1 [0050.041] lstrlenW (lpString="Appinfo") returned 7 [0050.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.041] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.041] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.041] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.041] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.041] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.041] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.041] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.041] lstrlenW (lpString="AudioSrv") returned 8 [0050.041] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.042] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.042] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.042] lstrlenW (lpString="BFE") returned 3 [0050.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.042] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.042] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.042] lstrlenW (lpString="CryptSvc") returned 8 [0050.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.042] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.042] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.042] lstrlenW (lpString="CscService") returned 10 [0050.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.042] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.042] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.042] lstrlenW (lpString="DcomLaunch") returned 10 [0050.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.042] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.042] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.042] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.042] lstrlenW (lpString="Dhcp") returned 4 [0050.042] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.042] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.043] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.043] lstrlenW (lpString="Dnscache") returned 8 [0050.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.043] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.043] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.043] lstrlenW (lpString="DPS") returned 3 [0050.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.043] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.043] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.043] lstrlenW (lpString="eventlog") returned 8 [0050.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.043] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.043] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.043] lstrlenW (lpString="EventSystem") returned 11 [0050.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.043] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.043] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.043] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.043] lstrlenW (lpString="FontCache") returned 9 [0050.043] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0050.043] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0050.044] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0050.044] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0050.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0050.044] lstrlenW (lpString="gpsvc") returned 5 [0050.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.044] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.044] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.044] lstrlenW (lpString="iphlpsvc") returned 8 [0050.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.044] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.044] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.044] lstrlenW (lpString="LanmanServer") returned 12 [0050.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.044] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.044] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.044] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.044] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.044] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.044] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.044] lstrlenW (lpString="lmhosts") returned 7 [0050.044] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.044] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.044] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.045] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.045] lstrlenW (lpString="MMCSS") returned 5 [0050.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.045] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.045] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.045] lstrlenW (lpString="MpsSvc") returned 6 [0050.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.045] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.045] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.045] lstrlenW (lpString="Netman") returned 6 [0050.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.045] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.045] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.045] lstrlenW (lpString="netprofm") returned 8 [0050.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.045] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.045] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.045] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.045] lstrlenW (lpString="NlaSvc") returned 6 [0050.045] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.045] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.045] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.046] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.046] lstrlenW (lpString="nsi") returned 3 [0050.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.046] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.046] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.046] lstrlenW (lpString="PcaSvc") returned 6 [0050.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.046] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.046] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.046] lstrlenW (lpString="PlugPlay") returned 8 [0050.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.046] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.046] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.046] lstrlenW (lpString="Power") returned 5 [0050.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.046] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.046] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.046] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.046] lstrlenW (lpString="ProfSvc") returned 7 [0050.046] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.046] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.046] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.047] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.047] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.047] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.047] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.047] lstrlenW (lpString="RpcSs") returned 5 [0050.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.047] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.047] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.047] lstrlenW (lpString="SamSs") returned 5 [0050.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.047] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.047] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.047] lstrlenW (lpString="Schedule") returned 8 [0050.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.047] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.047] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.047] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.047] lstrlenW (lpString="SENS") returned 4 [0050.047] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.047] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.047] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.047] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.048] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.048] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.048] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.048] lstrlenW (lpString="Spooler") returned 7 [0050.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.048] lstrlenW (lpString="SysMain") returned 7 [0050.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.048] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.048] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.048] lstrlenW (lpString="Themes") returned 6 [0050.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.048] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.048] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.048] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.048] lstrlenW (lpString="TrkWks") returned 6 [0050.048] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.048] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.048] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.048] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.049] lstrlenW (lpString="UxSms") returned 5 [0050.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.049] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.049] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.049] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.049] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.049] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.049] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.049] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.049] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.049] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.049] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.049] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.049] lstrlenW (lpString="Winmgmt") returned 7 [0050.049] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.049] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.049] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.049] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.049] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.050] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.050] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.050] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.050] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.050] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.050] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.050] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fec510 | out: hHeap=0x8d0000) returned 1 [0050.050] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a8 [0050.052] Process32FirstW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.053] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.053] lstrlenW (lpString="System") returned 6 [0050.053] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.053] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.053] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.053] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.053] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.053] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.053] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.053] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.054] lstrlenW (lpString="smss.exe") returned 8 [0050.054] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.054] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.054] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.054] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.054] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.054] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.054] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.054] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.054] lstrlenW (lpString="csrss.exe") returned 9 [0050.054] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.054] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.054] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.054] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.055] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.055] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.055] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.055] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.055] lstrlenW (lpString="wininit.exe") returned 11 [0050.055] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.055] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.055] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.055] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0050.055] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0050.055] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0050.055] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0050.055] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.056] lstrlenW (lpString="csrss.exe") returned 9 [0050.056] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.056] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.056] lstrlenW (lpString="winlogon.exe") returned 12 [0050.056] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.057] lstrlenW (lpString="services.exe") returned 12 [0050.057] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.057] lstrlenW (lpString="lsass.exe") returned 9 [0050.057] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.058] lstrlenW (lpString="lsm.exe") returned 7 [0050.058] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.058] lstrlenW (lpString="svchost.exe") returned 11 [0050.058] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.059] lstrlenW (lpString="svchost.exe") returned 11 [0050.059] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.059] lstrlenW (lpString="svchost.exe") returned 11 [0050.059] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.060] lstrlenW (lpString="svchost.exe") returned 11 [0050.060] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.060] lstrlenW (lpString="svchost.exe") returned 11 [0050.060] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.061] lstrlenW (lpString="audiodg.exe") returned 11 [0050.061] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.063] lstrlenW (lpString="svchost.exe") returned 11 [0050.063] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.063] lstrlenW (lpString="svchost.exe") returned 11 [0050.063] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.063] lstrlenW (lpString="dwm.exe") returned 7 [0050.064] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.064] lstrlenW (lpString="explorer.exe") returned 12 [0050.064] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.064] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.064] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.065] lstrlenW (lpString="taskhost.exe") returned 12 [0050.065] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.065] lstrlenW (lpString="svchost.exe") returned 11 [0050.065] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.066] lstrlenW (lpString="taskeng.exe") returned 11 [0050.066] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.066] lstrlenW (lpString="taskhost.exe") returned 12 [0050.066] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0050.067] lstrlenW (lpString="tested.exe") returned 10 [0050.067] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0050.067] lstrlenW (lpString="memories global commission.exe") returned 30 [0050.067] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0050.068] lstrlenW (lpString="destination.exe") returned 15 [0050.068] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0050.068] lstrlenW (lpString="rom.exe") returned 7 [0050.068] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0050.069] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0050.069] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0050.069] lstrlenW (lpString="appropriate worm.exe") returned 20 [0050.069] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0050.070] lstrlenW (lpString="arrival-testing.exe") returned 19 [0050.070] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0050.070] lstrlenW (lpString="san stories panels.exe") returned 22 [0050.070] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0050.071] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0050.071] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0050.071] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0050.071] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0050.072] lstrlenW (lpString="taught opt practice.exe") returned 23 [0050.072] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0050.072] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0050.072] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0050.073] lstrlenW (lpString="aka gap.exe") returned 11 [0050.073] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0050.073] lstrlenW (lpString="copied-mr.exe") returned 13 [0050.073] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0050.074] lstrlenW (lpString="proven.exe") returned 10 [0050.074] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0050.074] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0050.074] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0050.075] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0050.075] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0050.075] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0050.075] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0050.352] lstrlenW (lpString="acm.exe") returned 7 [0050.352] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0050.353] lstrlenW (lpString="fluid.exe") returned 9 [0050.353] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0050.353] lstrlenW (lpString="domain.exe") returned 10 [0050.353] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0050.354] lstrlenW (lpString="cult_wanna.exe") returned 14 [0050.354] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.354] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.354] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.355] lstrlenW (lpString="svchost.exe") returned 11 [0050.355] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0050.355] lstrlenW (lpString="1Black.exe") returned 10 [0050.355] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.356] lstrlenW (lpString="cmd.exe") returned 7 [0050.356] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.356] lstrlenW (lpString="conhost.exe") returned 11 [0050.356] Process32NextW (in: hSnapshot=0x1a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0050.357] CloseHandle (hObject=0x1a8) returned 1 [0050.357] Sleep (dwMilliseconds=0x1f4) [0051.062] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94fcb0 [0051.062] EnumServicesStatusExW (in: hSCManager=0x94fcb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0051.063] GetLastError () returned 0xea [0051.063] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x125a) returned 0x400b508 [0051.063] EnumServicesStatusExW (in: hSCManager=0x94fcb0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x400b508, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x400b508, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0051.063] CloseServiceHandle (hSCObject=0x94fcb0) returned 1 [0051.063] lstrlenW (lpString="Appinfo") returned 7 [0051.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0051.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0051.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0051.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0051.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0051.064] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0051.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0051.064] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0051.064] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0051.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0051.064] lstrlenW (lpString="AudioSrv") returned 8 [0051.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0051.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0051.064] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0051.064] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0051.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0051.064] lstrlenW (lpString="BFE") returned 3 [0051.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0051.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0051.064] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0051.064] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0051.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0051.064] lstrlenW (lpString="CryptSvc") returned 8 [0051.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0051.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0051.064] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0051.064] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0051.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0051.064] lstrlenW (lpString="CscService") returned 10 [0051.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0051.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0051.065] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0051.065] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0051.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0051.065] lstrlenW (lpString="DcomLaunch") returned 10 [0051.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0051.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0051.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0051.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0051.065] lstrlenW (lpString="Dhcp") returned 4 [0051.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0051.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0051.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0051.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0051.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0051.065] lstrlenW (lpString="Dnscache") returned 8 [0051.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0051.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0051.065] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0051.065] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0051.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0051.065] lstrlenW (lpString="DPS") returned 3 [0051.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0051.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0051.065] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0051.065] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0051.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0051.065] lstrlenW (lpString="eventlog") returned 8 [0051.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0051.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0051.066] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0051.066] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0051.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0051.066] lstrlenW (lpString="EventSystem") returned 11 [0051.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0051.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0051.066] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0051.066] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0051.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0051.066] lstrlenW (lpString="FontCache") returned 9 [0051.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0051.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0051.066] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0051.066] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0051.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0051.066] lstrlenW (lpString="gpsvc") returned 5 [0051.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0051.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0051.066] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0051.066] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0051.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0051.066] lstrlenW (lpString="iphlpsvc") returned 8 [0051.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0051.067] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0051.067] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0051.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0051.067] lstrlenW (lpString="LanmanServer") returned 12 [0051.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0051.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0051.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0051.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0051.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0051.067] lstrlenW (lpString="LanmanWorkstation") returned 17 [0051.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0051.067] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0051.067] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0051.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0051.067] lstrlenW (lpString="lmhosts") returned 7 [0051.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0051.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0051.067] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0051.067] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0051.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0051.067] lstrlenW (lpString="MMCSS") returned 5 [0051.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0051.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0051.067] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0051.067] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0051.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0051.067] lstrlenW (lpString="MpsSvc") returned 6 [0051.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0051.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0051.068] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0051.068] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0051.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0051.068] lstrlenW (lpString="Netman") returned 6 [0051.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0051.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0051.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0051.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0051.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0051.068] lstrlenW (lpString="netprofm") returned 8 [0051.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0051.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0051.068] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0051.068] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0051.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0051.068] lstrlenW (lpString="NlaSvc") returned 6 [0051.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0051.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0051.068] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0051.068] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0051.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0051.068] lstrlenW (lpString="nsi") returned 3 [0051.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0051.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0051.068] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0051.068] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0051.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0051.068] lstrlenW (lpString="PcaSvc") returned 6 [0051.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0051.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0051.068] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0051.069] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0051.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0051.069] lstrlenW (lpString="PlugPlay") returned 8 [0051.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0051.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0051.069] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0051.069] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0051.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0051.069] lstrlenW (lpString="Power") returned 5 [0051.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0051.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0051.069] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0051.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0051.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0051.069] lstrlenW (lpString="ProfSvc") returned 7 [0051.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0051.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0051.069] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0051.069] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0051.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0051.069] lstrlenW (lpString="RpcEptMapper") returned 12 [0051.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0051.069] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0051.069] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0051.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0051.069] lstrlenW (lpString="RpcSs") returned 5 [0051.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0051.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0051.069] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0051.069] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0051.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0051.070] lstrlenW (lpString="SamSs") returned 5 [0051.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0051.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0051.070] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0051.070] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0051.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0051.070] lstrlenW (lpString="Schedule") returned 8 [0051.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0051.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0051.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0051.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0051.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0051.070] lstrlenW (lpString="SENS") returned 4 [0051.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0051.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0051.070] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0051.070] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0051.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0051.070] lstrlenW (lpString="ShellHWDetection") returned 16 [0051.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0051.070] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0051.070] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0051.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0051.070] lstrlenW (lpString="Spooler") returned 7 [0051.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0051.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0051.070] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0051.070] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0051.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0051.070] lstrlenW (lpString="SysMain") returned 7 [0051.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0051.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0051.071] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0051.071] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0051.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0051.071] lstrlenW (lpString="Themes") returned 6 [0051.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0051.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0051.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0051.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0051.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0051.071] lstrlenW (lpString="TrkWks") returned 6 [0051.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0051.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0051.071] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0051.071] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0051.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0051.071] lstrlenW (lpString="UxSms") returned 5 [0051.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0051.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0051.071] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0051.071] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0051.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0051.071] lstrlenW (lpString="WdiServiceHost") returned 14 [0051.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0051.071] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0051.071] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0051.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0051.071] lstrlenW (lpString="WdiSystemHost") returned 13 [0051.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0051.072] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0051.072] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0051.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0051.072] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0051.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0051.072] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0051.072] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0051.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0051.072] lstrlenW (lpString="Winmgmt") returned 7 [0051.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0051.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0051.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0051.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0051.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0051.072] lstrlenW (lpString="WPDBusEnum") returned 10 [0051.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0051.072] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0051.072] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0051.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0051.072] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0051.072] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1ac [0051.075] Process32FirstW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0051.075] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0051.076] lstrlenW (lpString="System") returned 6 [0051.076] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0051.076] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0051.076] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0051.076] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0051.076] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0051.076] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0051.076] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0051.076] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0051.077] lstrlenW (lpString="smss.exe") returned 8 [0051.077] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0051.077] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0051.077] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0051.077] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0051.077] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0051.077] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0051.077] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0051.077] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.078] lstrlenW (lpString="csrss.exe") returned 9 [0051.078] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0051.078] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0051.078] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0051.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0051.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0051.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0051.078] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0051.078] lstrlenW (lpString="wininit.exe") returned 11 [0051.078] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0051.078] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0051.078] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0051.078] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0051.078] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0051.078] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0051.078] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0051.079] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0051.079] lstrlenW (lpString="csrss.exe") returned 9 [0051.079] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0051.079] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0051.080] lstrlenW (lpString="winlogon.exe") returned 12 [0051.080] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0051.080] lstrlenW (lpString="services.exe") returned 12 [0051.080] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0051.081] lstrlenW (lpString="lsass.exe") returned 9 [0051.081] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0051.081] lstrlenW (lpString="lsm.exe") returned 7 [0051.081] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.082] lstrlenW (lpString="svchost.exe") returned 11 [0051.082] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.082] lstrlenW (lpString="svchost.exe") returned 11 [0051.082] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.083] lstrlenW (lpString="svchost.exe") returned 11 [0051.083] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.083] lstrlenW (lpString="svchost.exe") returned 11 [0051.084] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.084] lstrlenW (lpString="svchost.exe") returned 11 [0051.084] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0051.085] lstrlenW (lpString="audiodg.exe") returned 11 [0051.085] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.085] lstrlenW (lpString="svchost.exe") returned 11 [0051.085] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.086] lstrlenW (lpString="svchost.exe") returned 11 [0051.086] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0051.086] lstrlenW (lpString="dwm.exe") returned 7 [0051.086] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0051.087] lstrlenW (lpString="explorer.exe") returned 12 [0051.087] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0051.087] lstrlenW (lpString="spoolsv.exe") returned 11 [0051.087] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.088] lstrlenW (lpString="taskhost.exe") returned 12 [0051.088] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0051.088] lstrlenW (lpString="svchost.exe") returned 11 [0051.088] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0051.089] lstrlenW (lpString="taskeng.exe") returned 11 [0051.089] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0051.089] lstrlenW (lpString="taskhost.exe") returned 12 [0051.089] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0051.090] lstrlenW (lpString="tested.exe") returned 10 [0051.090] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0051.090] lstrlenW (lpString="memories global commission.exe") returned 30 [0051.090] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0051.091] lstrlenW (lpString="destination.exe") returned 15 [0051.091] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0051.091] lstrlenW (lpString="rom.exe") returned 7 [0051.091] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0051.092] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0051.092] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0051.092] lstrlenW (lpString="appropriate worm.exe") returned 20 [0051.092] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0051.093] lstrlenW (lpString="arrival-testing.exe") returned 19 [0051.093] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0051.093] lstrlenW (lpString="san stories panels.exe") returned 22 [0051.093] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0051.094] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0051.094] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0051.094] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0051.095] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0051.095] lstrlenW (lpString="taught opt practice.exe") returned 23 [0051.095] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0051.096] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0051.096] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0051.096] lstrlenW (lpString="aka gap.exe") returned 11 [0051.096] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0051.929] lstrlenW (lpString="copied-mr.exe") returned 13 [0051.930] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0051.998] lstrlenW (lpString="proven.exe") returned 10 [0051.998] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0051.998] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0051.998] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0051.999] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0051.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0051.999] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0051.999] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0052.000] lstrlenW (lpString="acm.exe") returned 7 [0052.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0052.000] lstrlenW (lpString="fluid.exe") returned 9 [0052.000] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0052.001] lstrlenW (lpString="domain.exe") returned 10 [0052.001] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0052.003] lstrlenW (lpString="cult_wanna.exe") returned 14 [0052.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.003] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.003] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.004] lstrlenW (lpString="svchost.exe") returned 11 [0052.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0052.004] lstrlenW (lpString="1Black.exe") returned 10 [0052.004] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.005] lstrlenW (lpString="cmd.exe") returned 7 [0052.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.005] lstrlenW (lpString="conhost.exe") returned 11 [0052.005] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.006] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.006] Process32NextW (in: hSnapshot=0x1ac, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0052.006] CloseHandle (hObject=0x1ac) returned 1 [0052.006] Sleep (dwMilliseconds=0x1f4) [0052.581] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94fee0 [0052.581] EnumServicesStatusExW (in: hSCManager=0x94fee0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0052.582] GetLastError () returned 0xea [0052.582] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x125a) returned 0x400b508 [0052.582] EnumServicesStatusExW (in: hSCManager=0x94fee0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x400b508, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x400b508, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0052.582] CloseServiceHandle (hSCObject=0x94fee0) returned 1 [0052.582] lstrlenW (lpString="Appinfo") returned 7 [0052.582] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.582] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.582] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.582] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.582] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.583] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.583] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.583] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.583] lstrlenW (lpString="AudioSrv") returned 8 [0052.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.583] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.583] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.583] lstrlenW (lpString="BFE") returned 3 [0052.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.583] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.583] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.583] lstrlenW (lpString="CryptSvc") returned 8 [0052.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.583] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.583] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.583] lstrlenW (lpString="CscService") returned 10 [0052.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.583] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.583] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.583] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.583] lstrlenW (lpString="DcomLaunch") returned 10 [0052.583] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.583] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.583] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.584] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.584] lstrlenW (lpString="Dhcp") returned 4 [0052.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.584] lstrlenW (lpString="Dnscache") returned 8 [0052.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.584] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.584] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.584] lstrlenW (lpString="DPS") returned 3 [0052.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.584] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.584] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.584] lstrlenW (lpString="eventlog") returned 8 [0052.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.584] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.584] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.584] lstrlenW (lpString="EventSystem") returned 11 [0052.584] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.584] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.584] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.584] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.584] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.584] lstrlenW (lpString="FontCache") returned 9 [0052.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0052.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0052.585] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0052.585] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0052.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0052.585] lstrlenW (lpString="gpsvc") returned 5 [0052.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.585] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.585] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.585] lstrlenW (lpString="iphlpsvc") returned 8 [0052.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.585] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.585] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.585] lstrlenW (lpString="LanmanServer") returned 12 [0052.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.585] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.585] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.585] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.585] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.585] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.585] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.585] lstrlenW (lpString="lmhosts") returned 7 [0052.585] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.585] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.585] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.586] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.586] lstrlenW (lpString="MMCSS") returned 5 [0052.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.586] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.586] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.586] lstrlenW (lpString="MpsSvc") returned 6 [0052.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.586] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.586] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.586] lstrlenW (lpString="Netman") returned 6 [0052.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.586] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.586] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.586] lstrlenW (lpString="netprofm") returned 8 [0052.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.586] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.586] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.586] lstrlenW (lpString="NlaSvc") returned 6 [0052.586] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.586] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.586] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.586] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.586] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.586] lstrlenW (lpString="nsi") returned 3 [0052.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.587] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.587] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.587] lstrlenW (lpString="PcaSvc") returned 6 [0052.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.587] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.587] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.587] lstrlenW (lpString="PlugPlay") returned 8 [0052.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.587] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.587] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.587] lstrlenW (lpString="Power") returned 5 [0052.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.587] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.587] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.587] lstrlenW (lpString="ProfSvc") returned 7 [0052.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.587] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.587] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.587] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.587] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.587] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.587] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.587] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.587] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.588] lstrlenW (lpString="RpcSs") returned 5 [0052.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.588] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.588] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.588] lstrlenW (lpString="SamSs") returned 5 [0052.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.588] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.588] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.588] lstrlenW (lpString="Schedule") returned 8 [0052.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.588] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.588] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.588] lstrlenW (lpString="SENS") returned 4 [0052.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.588] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.588] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.588] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.588] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.588] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.588] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.588] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.588] lstrlenW (lpString="Spooler") returned 7 [0052.588] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.589] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.589] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.589] lstrlenW (lpString="SysMain") returned 7 [0052.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.589] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.589] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.589] lstrlenW (lpString="Themes") returned 6 [0052.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.589] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.589] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.589] lstrlenW (lpString="TrkWks") returned 6 [0052.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.589] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.589] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.589] lstrlenW (lpString="UxSms") returned 5 [0052.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.589] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.589] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.589] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.589] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.589] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.589] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.589] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.589] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.590] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.590] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.590] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.590] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.590] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.590] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.590] lstrlenW (lpString="Winmgmt") returned 7 [0052.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.590] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.590] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.590] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.590] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.590] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.590] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.590] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.590] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.590] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0052.590] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0052.593] Process32FirstW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.593] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.594] lstrlenW (lpString="System") returned 6 [0052.594] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.594] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.594] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.594] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.594] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.594] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.594] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.594] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.594] lstrlenW (lpString="smss.exe") returned 8 [0052.594] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.595] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.595] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.595] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.595] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.595] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.595] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.595] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.595] lstrlenW (lpString="csrss.exe") returned 9 [0052.595] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.595] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.595] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.595] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.596] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.596] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.596] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.596] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.596] lstrlenW (lpString="wininit.exe") returned 11 [0052.596] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.596] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.596] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.596] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0052.596] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0052.596] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0052.596] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0052.596] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.597] lstrlenW (lpString="csrss.exe") returned 9 [0052.597] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.597] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.597] lstrlenW (lpString="winlogon.exe") returned 12 [0052.597] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.598] lstrlenW (lpString="services.exe") returned 12 [0052.598] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.598] lstrlenW (lpString="lsass.exe") returned 9 [0052.598] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.599] lstrlenW (lpString="lsm.exe") returned 7 [0052.599] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.599] lstrlenW (lpString="svchost.exe") returned 11 [0052.600] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.600] lstrlenW (lpString="svchost.exe") returned 11 [0052.600] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.600] lstrlenW (lpString="svchost.exe") returned 11 [0052.601] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.601] lstrlenW (lpString="svchost.exe") returned 11 [0052.601] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.602] lstrlenW (lpString="svchost.exe") returned 11 [0052.602] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.602] lstrlenW (lpString="audiodg.exe") returned 11 [0052.602] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.603] lstrlenW (lpString="svchost.exe") returned 11 [0052.603] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.603] lstrlenW (lpString="svchost.exe") returned 11 [0052.603] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.604] lstrlenW (lpString="dwm.exe") returned 7 [0052.604] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.604] lstrlenW (lpString="explorer.exe") returned 12 [0052.604] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.605] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.605] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.605] lstrlenW (lpString="taskhost.exe") returned 12 [0052.605] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.606] lstrlenW (lpString="svchost.exe") returned 11 [0052.606] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.606] lstrlenW (lpString="taskeng.exe") returned 11 [0052.606] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.607] lstrlenW (lpString="taskhost.exe") returned 12 [0052.607] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0052.607] lstrlenW (lpString="tested.exe") returned 10 [0052.607] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0052.608] lstrlenW (lpString="memories global commission.exe") returned 30 [0052.608] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0052.608] lstrlenW (lpString="destination.exe") returned 15 [0052.608] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0052.609] lstrlenW (lpString="rom.exe") returned 7 [0052.609] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0052.609] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0052.609] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0052.610] lstrlenW (lpString="appropriate worm.exe") returned 20 [0052.610] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0052.610] lstrlenW (lpString="arrival-testing.exe") returned 19 [0052.610] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0052.611] lstrlenW (lpString="san stories panels.exe") returned 22 [0052.611] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0052.611] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0052.612] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0052.612] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0052.612] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0052.612] lstrlenW (lpString="taught opt practice.exe") returned 23 [0052.613] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0052.754] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0052.754] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0052.755] lstrlenW (lpString="aka gap.exe") returned 11 [0052.755] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0052.755] lstrlenW (lpString="copied-mr.exe") returned 13 [0052.755] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0052.756] lstrlenW (lpString="proven.exe") returned 10 [0052.756] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0052.756] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0052.756] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0052.757] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0052.757] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0052.757] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0052.758] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0052.758] lstrlenW (lpString="acm.exe") returned 7 [0052.758] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0052.759] lstrlenW (lpString="fluid.exe") returned 9 [0052.759] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0052.759] lstrlenW (lpString="domain.exe") returned 10 [0052.759] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0052.760] lstrlenW (lpString="cult_wanna.exe") returned 14 [0052.760] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.760] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.761] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.761] lstrlenW (lpString="svchost.exe") returned 11 [0052.761] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0052.761] lstrlenW (lpString="1Black.exe") returned 10 [0052.762] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.762] lstrlenW (lpString="cmd.exe") returned 7 [0052.762] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.763] lstrlenW (lpString="conhost.exe") returned 11 [0052.763] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.763] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.763] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0052.764] CloseHandle (hObject=0x180) returned 1 [0052.764] Sleep (dwMilliseconds=0x1f4) [0053.625] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94ff30 [0053.626] EnumServicesStatusExW (in: hSCManager=0x94ff30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0053.626] GetLastError () returned 0xea [0053.626] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x125a) returned 0x400b508 [0053.626] EnumServicesStatusExW (in: hSCManager=0x94ff30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x400b508, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x400b508, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0053.627] CloseServiceHandle (hSCObject=0x94ff30) returned 1 [0053.627] lstrlenW (lpString="Appinfo") returned 7 [0053.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.627] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.627] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.627] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.627] lstrlenW (lpString="AudioSrv") returned 8 [0053.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.627] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.628] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.628] lstrlenW (lpString="BFE") returned 3 [0053.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.628] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.628] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.628] lstrlenW (lpString="CryptSvc") returned 8 [0053.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.628] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.628] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.628] lstrlenW (lpString="CscService") returned 10 [0053.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.628] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.628] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.628] lstrlenW (lpString="DcomLaunch") returned 10 [0053.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.628] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.628] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.628] lstrlenW (lpString="Dhcp") returned 4 [0053.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.628] lstrlenW (lpString="Dnscache") returned 8 [0053.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.629] lstrlenW (lpString="DPS") returned 3 [0053.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.629] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.629] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.629] lstrlenW (lpString="eventlog") returned 8 [0053.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.629] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.629] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.629] lstrlenW (lpString="EventSystem") returned 11 [0053.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.629] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.629] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.629] lstrlenW (lpString="FontCache") returned 9 [0053.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0053.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0053.629] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0053.629] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0053.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0053.629] lstrlenW (lpString="gpsvc") returned 5 [0053.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.629] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.630] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.630] lstrlenW (lpString="iphlpsvc") returned 8 [0053.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.630] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.630] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.630] lstrlenW (lpString="LanmanServer") returned 12 [0053.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.630] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.630] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.630] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.630] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.630] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.630] lstrlenW (lpString="lmhosts") returned 7 [0053.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.630] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.630] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.630] lstrlenW (lpString="MMCSS") returned 5 [0053.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.630] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.630] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.631] lstrlenW (lpString="MpsSvc") returned 6 [0053.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.631] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.631] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.631] lstrlenW (lpString="Netman") returned 6 [0053.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.631] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.631] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.631] lstrlenW (lpString="netprofm") returned 8 [0053.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.631] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.631] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.631] lstrlenW (lpString="NlaSvc") returned 6 [0053.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.631] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.631] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.631] lstrlenW (lpString="nsi") returned 3 [0053.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.631] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.631] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.631] lstrlenW (lpString="PcaSvc") returned 6 [0053.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.632] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.632] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.632] lstrlenW (lpString="PlugPlay") returned 8 [0053.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.632] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.632] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.632] lstrlenW (lpString="Power") returned 5 [0053.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.632] lstrlenW (lpString="ProfSvc") returned 7 [0053.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.632] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.632] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.632] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.632] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.632] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.632] lstrlenW (lpString="RpcSs") returned 5 [0053.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.632] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.632] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.633] lstrlenW (lpString="SamSs") returned 5 [0053.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.633] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.633] lstrlenW (lpString="Schedule") returned 8 [0053.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.633] lstrlenW (lpString="SENS") returned 4 [0053.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.633] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.633] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.633] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.633] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.633] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.633] lstrlenW (lpString="Spooler") returned 7 [0053.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.633] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.633] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.633] lstrlenW (lpString="SysMain") returned 7 [0053.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.634] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.634] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.634] lstrlenW (lpString="Themes") returned 6 [0053.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.634] lstrlenW (lpString="TrkWks") returned 6 [0053.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.634] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.634] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.634] lstrlenW (lpString="UxSms") returned 5 [0053.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.634] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.635] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.635] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.635] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.635] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.635] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.635] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.636] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.636] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.636] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.636] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.636] lstrlenW (lpString="Winmgmt") returned 7 [0053.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.636] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.636] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.636] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.636] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0053.636] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0053.639] Process32FirstW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.640] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.641] lstrlenW (lpString="System") returned 6 [0053.641] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.641] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.641] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.641] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.641] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.641] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.641] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.641] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.641] lstrlenW (lpString="smss.exe") returned 8 [0053.641] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.642] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.642] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.642] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.642] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.642] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.642] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.642] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.642] lstrlenW (lpString="csrss.exe") returned 9 [0053.642] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.642] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.642] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.642] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.642] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.642] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.642] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.642] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.643] lstrlenW (lpString="wininit.exe") returned 11 [0053.643] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.643] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.643] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.643] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0053.643] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0053.643] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0053.643] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0053.643] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.644] lstrlenW (lpString="csrss.exe") returned 9 [0053.644] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.644] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.644] lstrlenW (lpString="winlogon.exe") returned 12 [0053.644] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.645] lstrlenW (lpString="services.exe") returned 12 [0053.645] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.645] lstrlenW (lpString="lsass.exe") returned 9 [0053.645] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.646] lstrlenW (lpString="lsm.exe") returned 7 [0053.646] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.646] lstrlenW (lpString="svchost.exe") returned 11 [0053.646] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.647] lstrlenW (lpString="svchost.exe") returned 11 [0053.647] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.647] lstrlenW (lpString="svchost.exe") returned 11 [0053.647] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.648] lstrlenW (lpString="svchost.exe") returned 11 [0053.648] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.648] lstrlenW (lpString="svchost.exe") returned 11 [0053.649] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.649] lstrlenW (lpString="audiodg.exe") returned 11 [0053.649] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.649] lstrlenW (lpString="svchost.exe") returned 11 [0053.650] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.650] lstrlenW (lpString="svchost.exe") returned 11 [0053.650] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.650] lstrlenW (lpString="dwm.exe") returned 7 [0053.651] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.651] lstrlenW (lpString="explorer.exe") returned 12 [0053.651] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.652] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.652] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.652] lstrlenW (lpString="taskhost.exe") returned 12 [0053.652] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.653] lstrlenW (lpString="svchost.exe") returned 11 [0053.653] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.653] lstrlenW (lpString="taskeng.exe") returned 11 [0053.653] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.654] lstrlenW (lpString="taskhost.exe") returned 12 [0053.654] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0053.654] lstrlenW (lpString="tested.exe") returned 10 [0053.654] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0053.655] lstrlenW (lpString="memories global commission.exe") returned 30 [0053.655] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0053.655] lstrlenW (lpString="destination.exe") returned 15 [0053.655] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0053.656] lstrlenW (lpString="rom.exe") returned 7 [0053.656] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0053.656] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0053.656] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0053.657] lstrlenW (lpString="appropriate worm.exe") returned 20 [0053.657] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0053.657] lstrlenW (lpString="arrival-testing.exe") returned 19 [0053.657] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0053.658] lstrlenW (lpString="san stories panels.exe") returned 22 [0053.658] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0053.658] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0053.659] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0053.659] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0053.659] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0053.659] lstrlenW (lpString="taught opt practice.exe") returned 23 [0053.660] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0053.660] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0053.660] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0054.007] lstrlenW (lpString="aka gap.exe") returned 11 [0054.007] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0054.008] lstrlenW (lpString="copied-mr.exe") returned 13 [0054.008] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0054.008] lstrlenW (lpString="proven.exe") returned 10 [0054.008] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0054.009] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0054.009] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0054.009] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0054.009] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0054.010] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0054.010] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0054.011] lstrlenW (lpString="acm.exe") returned 7 [0054.011] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0054.011] lstrlenW (lpString="fluid.exe") returned 9 [0054.011] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0054.012] lstrlenW (lpString="domain.exe") returned 10 [0054.012] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0054.012] lstrlenW (lpString="cult_wanna.exe") returned 14 [0054.012] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0054.013] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0054.013] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.013] lstrlenW (lpString="svchost.exe") returned 11 [0054.013] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0054.014] lstrlenW (lpString="1Black.exe") returned 10 [0054.014] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0054.015] lstrlenW (lpString="cmd.exe") returned 7 [0054.015] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0054.015] lstrlenW (lpString="conhost.exe") returned 11 [0054.015] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0054.016] lstrlenW (lpString="vssadmin.exe") returned 12 [0054.016] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0054.017] CloseHandle (hObject=0x180) returned 1 [0054.017] Sleep (dwMilliseconds=0x1f4) [0054.671] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94ffa8 [0054.673] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0054.674] GetLastError () returned 0xea [0054.674] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x12b4) returned 0x400b508 [0054.674] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x400b508, cbBufSize=0x12b4, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x400b508, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0054.676] CloseServiceHandle (hSCObject=0x94ffa8) returned 1 [0054.676] lstrlenW (lpString="Appinfo") returned 7 [0054.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.676] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.676] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.676] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.676] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.676] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.676] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.676] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.676] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.677] lstrlenW (lpString="AudioSrv") returned 8 [0054.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.677] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.677] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0054.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0054.677] lstrlenW (lpString="BFE") returned 3 [0054.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.677] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.677] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.677] lstrlenW (lpString="CryptSvc") returned 8 [0054.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.677] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.677] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.677] lstrlenW (lpString="CscService") returned 10 [0054.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0054.677] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0054.677] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0054.677] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0054.677] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0054.677] lstrlenW (lpString="DcomLaunch") returned 10 [0054.677] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.678] lstrlenW (lpString="Dhcp") returned 4 [0054.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.678] lstrlenW (lpString="Dnscache") returned 8 [0054.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.678] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.678] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.678] lstrlenW (lpString="DPS") returned 3 [0054.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.678] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.678] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.678] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.678] lstrlenW (lpString="eventlog") returned 8 [0054.678] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0054.678] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0054.678] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0054.679] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0054.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0054.679] lstrlenW (lpString="EventSystem") returned 11 [0054.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.679] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.679] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.679] lstrlenW (lpString="FontCache") returned 9 [0054.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0054.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0054.679] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0054.679] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0054.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0054.679] lstrlenW (lpString="gpsvc") returned 5 [0054.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.679] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.679] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.679] lstrlenW (lpString="iphlpsvc") returned 8 [0054.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.679] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.679] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.679] lstrlenW (lpString="LanmanServer") returned 12 [0054.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.680] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.680] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.680] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.680] lstrlenW (lpString="lmhosts") returned 7 [0054.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.680] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.680] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.680] lstrlenW (lpString="MMCSS") returned 5 [0054.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0054.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0054.680] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0054.680] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0054.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0054.680] lstrlenW (lpString="MpsSvc") returned 6 [0054.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.681] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.681] lstrlenW (lpString="Netman") returned 6 [0054.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0054.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0054.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0054.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0054.681] lstrlenW (lpString="netprofm") returned 8 [0054.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.681] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.681] lstrlenW (lpString="NlaSvc") returned 6 [0054.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.681] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.681] lstrlenW (lpString="nsi") returned 3 [0054.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.681] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.681] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.682] lstrlenW (lpString="PcaSvc") returned 6 [0054.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.682] lstrlenW (lpString="PlugPlay") returned 8 [0054.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.682] lstrlenW (lpString="Power") returned 5 [0054.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.682] lstrlenW (lpString="ProfSvc") returned 7 [0054.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.682] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.682] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.682] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.683] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.683] lstrlenW (lpString="RpcSs") returned 5 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.683] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.683] lstrlenW (lpString="SamSs") returned 5 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.683] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.683] lstrlenW (lpString="Schedule") returned 8 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.683] lstrlenW (lpString="SENS") returned 4 [0054.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.684] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.684] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.684] lstrlenW (lpString="Spooler") returned 7 [0054.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.684] lstrlenW (lpString="SysMain") returned 7 [0054.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.684] lstrlenW (lpString="Themes") returned 6 [0054.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0054.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0054.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0054.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0054.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0054.685] lstrlenW (lpString="TrkWks") returned 6 [0054.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0054.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0054.685] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0054.685] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0054.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0054.685] lstrlenW (lpString="UxSms") returned 5 [0054.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0054.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0054.685] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0054.685] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0054.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0054.685] lstrlenW (lpString="VSS") returned 3 [0054.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0054.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0054.685] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0054.685] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0054.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0054.685] lstrlenW (lpString="WdiServiceHost") returned 14 [0054.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.685] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0054.685] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0054.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0054.685] lstrlenW (lpString="WdiSystemHost") returned 13 [0054.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.686] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0054.686] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0054.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0054.686] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0054.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.686] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0054.686] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0054.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0054.686] lstrlenW (lpString="Winmgmt") returned 7 [0054.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0054.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0054.686] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0054.686] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0054.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0054.686] lstrlenW (lpString="WPDBusEnum") returned 10 [0054.686] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.686] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.686] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0054.686] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0054.686] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0054.686] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0054.687] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0054.690] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.691] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.692] lstrlenW (lpString="System") returned 6 [0054.692] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0054.692] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0054.692] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0054.692] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0054.692] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0054.692] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0054.692] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0054.692] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.696] lstrlenW (lpString="smss.exe") returned 8 [0054.696] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0054.696] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0054.696] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0054.696] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0054.696] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0054.696] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0054.696] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0054.696] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.697] lstrlenW (lpString="csrss.exe") returned 9 [0054.697] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0054.697] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0054.697] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0054.697] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0054.697] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0054.697] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0054.697] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0054.697] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.697] lstrlenW (lpString="wininit.exe") returned 11 [0054.697] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0054.698] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0054.698] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0054.698] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.698] lstrlenW (lpString="csrss.exe") returned 9 [0054.698] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.699] lstrlenW (lpString="winlogon.exe") returned 12 [0054.699] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.699] lstrlenW (lpString="services.exe") returned 12 [0054.699] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.700] lstrlenW (lpString="lsass.exe") returned 9 [0054.700] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.701] lstrlenW (lpString="lsm.exe") returned 7 [0054.701] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.701] lstrlenW (lpString="svchost.exe") returned 11 [0054.702] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.702] lstrlenW (lpString="svchost.exe") returned 11 [0054.702] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.703] lstrlenW (lpString="svchost.exe") returned 11 [0054.703] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.704] lstrlenW (lpString="svchost.exe") returned 11 [0054.704] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.704] lstrlenW (lpString="svchost.exe") returned 11 [0054.704] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.705] lstrlenW (lpString="audiodg.exe") returned 11 [0054.705] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.705] lstrlenW (lpString="svchost.exe") returned 11 [0054.706] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.706] lstrlenW (lpString="svchost.exe") returned 11 [0054.706] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.707] lstrlenW (lpString="dwm.exe") returned 7 [0054.707] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.707] lstrlenW (lpString="explorer.exe") returned 12 [0054.707] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.185] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.185] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.185] lstrlenW (lpString="taskhost.exe") returned 12 [0055.186] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.186] lstrlenW (lpString="svchost.exe") returned 11 [0055.186] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.187] lstrlenW (lpString="taskeng.exe") returned 11 [0055.187] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.187] lstrlenW (lpString="taskhost.exe") returned 12 [0055.187] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0055.188] lstrlenW (lpString="tested.exe") returned 10 [0055.188] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0055.188] lstrlenW (lpString="memories global commission.exe") returned 30 [0055.188] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0055.189] lstrlenW (lpString="destination.exe") returned 15 [0055.189] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0055.189] lstrlenW (lpString="rom.exe") returned 7 [0055.189] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0055.190] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0055.190] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0055.190] lstrlenW (lpString="appropriate worm.exe") returned 20 [0055.190] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0055.191] lstrlenW (lpString="arrival-testing.exe") returned 19 [0055.191] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0055.191] lstrlenW (lpString="san stories panels.exe") returned 22 [0055.192] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0055.192] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0055.192] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0055.192] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0055.193] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0055.193] lstrlenW (lpString="taught opt practice.exe") returned 23 [0055.193] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0055.194] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0055.194] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0055.194] lstrlenW (lpString="aka gap.exe") returned 11 [0055.194] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0055.195] lstrlenW (lpString="copied-mr.exe") returned 13 [0055.195] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0055.195] lstrlenW (lpString="proven.exe") returned 10 [0055.195] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0055.196] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0055.196] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0055.196] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0055.196] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0055.197] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0055.197] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0055.197] lstrlenW (lpString="acm.exe") returned 7 [0055.197] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0055.198] lstrlenW (lpString="fluid.exe") returned 9 [0055.198] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0055.198] lstrlenW (lpString="domain.exe") returned 10 [0055.198] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0055.199] lstrlenW (lpString="cult_wanna.exe") returned 14 [0055.199] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.200] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.200] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.200] lstrlenW (lpString="svchost.exe") returned 11 [0055.200] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0055.201] lstrlenW (lpString="1Black.exe") returned 10 [0055.201] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.202] lstrlenW (lpString="cmd.exe") returned 7 [0055.202] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.202] lstrlenW (lpString="conhost.exe") returned 11 [0055.202] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.203] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.203] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.203] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.203] Process32NextW (in: hSnapshot=0x1fc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0055.204] CloseHandle (hObject=0x1fc) returned 1 [0055.204] Sleep (dwMilliseconds=0x1f4) [0055.849] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94ffa8 [0055.849] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0055.849] GetLastError () returned 0xea [0055.850] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x12b4) returned 0x400b508 [0055.850] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x400b508, cbBufSize=0x12b4, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x400b508, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0055.850] CloseServiceHandle (hSCObject=0x94ffa8) returned 1 [0055.850] lstrlenW (lpString="Appinfo") returned 7 [0055.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.851] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.851] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.851] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.851] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.851] lstrlenW (lpString="AudioSrv") returned 8 [0055.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.851] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.851] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.851] lstrlenW (lpString="BFE") returned 3 [0055.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.851] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.851] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.851] lstrlenW (lpString="CryptSvc") returned 8 [0055.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.851] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.851] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.851] lstrlenW (lpString="CscService") returned 10 [0055.851] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.851] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.851] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.851] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.851] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.851] lstrlenW (lpString="DcomLaunch") returned 10 [0055.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.852] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.852] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.852] lstrlenW (lpString="Dhcp") returned 4 [0055.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.852] lstrlenW (lpString="Dnscache") returned 8 [0055.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.852] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.852] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.852] lstrlenW (lpString="DPS") returned 3 [0055.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.852] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.852] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.852] lstrlenW (lpString="eventlog") returned 8 [0055.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.852] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.852] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.852] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.852] lstrlenW (lpString="EventSystem") returned 11 [0055.852] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.852] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.852] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.853] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.853] lstrlenW (lpString="FontCache") returned 9 [0055.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0055.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0055.853] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0055.853] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0055.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0055.853] lstrlenW (lpString="gpsvc") returned 5 [0055.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.853] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.853] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.853] lstrlenW (lpString="iphlpsvc") returned 8 [0055.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.853] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.853] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.853] lstrlenW (lpString="LanmanServer") returned 12 [0055.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.853] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.853] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.853] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.853] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.853] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.853] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.853] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.853] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.854] lstrlenW (lpString="lmhosts") returned 7 [0055.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.854] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.854] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.854] lstrlenW (lpString="MMCSS") returned 5 [0055.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.854] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.854] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.854] lstrlenW (lpString="MpsSvc") returned 6 [0055.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.854] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.854] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.854] lstrlenW (lpString="Netman") returned 6 [0055.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.854] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.854] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.854] lstrlenW (lpString="netprofm") returned 8 [0055.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.854] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.854] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.854] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.854] lstrlenW (lpString="NlaSvc") returned 6 [0055.854] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.854] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.855] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.855] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.855] lstrlenW (lpString="nsi") returned 3 [0055.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.855] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.855] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.855] lstrlenW (lpString="PcaSvc") returned 6 [0055.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.855] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.855] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.855] lstrlenW (lpString="PlugPlay") returned 8 [0055.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.855] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.855] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.855] lstrlenW (lpString="Power") returned 5 [0055.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.855] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.855] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.855] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.855] lstrlenW (lpString="ProfSvc") returned 7 [0055.855] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.855] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.855] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.856] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.856] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.856] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.856] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.856] lstrlenW (lpString="RpcSs") returned 5 [0055.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.856] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.856] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.856] lstrlenW (lpString="SamSs") returned 5 [0055.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.856] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.856] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.856] lstrlenW (lpString="Schedule") returned 8 [0055.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.856] lstrlenW (lpString="SENS") returned 4 [0055.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.857] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.857] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.857] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.857] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.857] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.857] lstrlenW (lpString="Spooler") returned 7 [0055.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.857] lstrlenW (lpString="SysMain") returned 7 [0055.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.857] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.857] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.857] lstrlenW (lpString="Themes") returned 6 [0055.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.857] lstrlenW (lpString="TrkWks") returned 6 [0055.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.857] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.858] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.858] lstrlenW (lpString="UxSms") returned 5 [0055.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.858] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.858] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.858] lstrlenW (lpString="VSS") returned 3 [0055.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.858] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.858] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.858] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.858] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.858] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.858] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.858] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.858] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.858] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.858] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.858] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.858] lstrlenW (lpString="Winmgmt") returned 7 [0055.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.859] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.859] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.859] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.859] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0055.859] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0055.864] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.865] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.865] lstrlenW (lpString="System") returned 6 [0055.865] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.865] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.865] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.865] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.865] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.865] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.866] lstrlenW (lpString="smss.exe") returned 8 [0055.866] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.866] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.866] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.866] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.866] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.866] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.866] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.866] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.866] lstrlenW (lpString="csrss.exe") returned 9 [0055.867] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.867] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.867] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.867] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.867] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.867] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.867] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.867] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.867] lstrlenW (lpString="wininit.exe") returned 11 [0055.867] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.867] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.867] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.867] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.868] lstrlenW (lpString="csrss.exe") returned 9 [0055.868] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.868] lstrlenW (lpString="winlogon.exe") returned 12 [0055.868] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.869] lstrlenW (lpString="services.exe") returned 12 [0055.869] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.870] lstrlenW (lpString="lsass.exe") returned 9 [0055.870] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.870] lstrlenW (lpString="lsm.exe") returned 7 [0055.870] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.871] lstrlenW (lpString="svchost.exe") returned 11 [0055.871] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.871] lstrlenW (lpString="svchost.exe") returned 11 [0055.871] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.872] lstrlenW (lpString="svchost.exe") returned 11 [0055.872] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.872] lstrlenW (lpString="svchost.exe") returned 11 [0055.872] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x26, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.873] lstrlenW (lpString="svchost.exe") returned 11 [0055.873] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.873] lstrlenW (lpString="audiodg.exe") returned 11 [0055.873] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.874] lstrlenW (lpString="svchost.exe") returned 11 [0055.874] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.874] lstrlenW (lpString="svchost.exe") returned 11 [0055.874] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.875] lstrlenW (lpString="dwm.exe") returned 7 [0055.875] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.875] lstrlenW (lpString="explorer.exe") returned 12 [0055.875] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.876] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.876] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.876] lstrlenW (lpString="taskhost.exe") returned 12 [0055.876] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.877] lstrlenW (lpString="svchost.exe") returned 11 [0055.877] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.877] lstrlenW (lpString="taskeng.exe") returned 11 [0055.877] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.878] lstrlenW (lpString="taskhost.exe") returned 12 [0055.878] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0055.878] lstrlenW (lpString="tested.exe") returned 10 [0055.878] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0055.879] lstrlenW (lpString="memories global commission.exe") returned 30 [0055.879] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0055.879] lstrlenW (lpString="destination.exe") returned 15 [0055.880] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0055.880] lstrlenW (lpString="rom.exe") returned 7 [0055.880] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0055.881] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0055.881] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0055.881] lstrlenW (lpString="appropriate worm.exe") returned 20 [0055.881] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0055.882] lstrlenW (lpString="arrival-testing.exe") returned 19 [0055.882] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0055.882] lstrlenW (lpString="san stories panels.exe") returned 22 [0055.882] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0055.883] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0055.883] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0055.883] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0055.883] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0056.127] lstrlenW (lpString="taught opt practice.exe") returned 23 [0056.127] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0056.128] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0056.128] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0056.128] lstrlenW (lpString="aka gap.exe") returned 11 [0056.128] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0056.129] lstrlenW (lpString="copied-mr.exe") returned 13 [0056.129] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0056.129] lstrlenW (lpString="proven.exe") returned 10 [0056.129] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0056.130] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0056.130] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0056.131] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0056.131] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0056.131] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0056.131] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0056.132] lstrlenW (lpString="acm.exe") returned 7 [0056.132] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0056.132] lstrlenW (lpString="fluid.exe") returned 9 [0056.132] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0056.133] lstrlenW (lpString="domain.exe") returned 10 [0056.133] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0056.133] lstrlenW (lpString="cult_wanna.exe") returned 14 [0056.133] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.134] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.134] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.134] lstrlenW (lpString="svchost.exe") returned 11 [0056.134] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0056.135] lstrlenW (lpString="1Black.exe") returned 10 [0056.135] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.135] lstrlenW (lpString="cmd.exe") returned 7 [0056.135] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.136] lstrlenW (lpString="conhost.exe") returned 11 [0056.136] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.136] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.137] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.137] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.137] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0056.138] CloseHandle (hObject=0x1e4) returned 1 [0056.138] Sleep (dwMilliseconds=0x1f4) [0057.026] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94fe68 [0057.026] EnumServicesStatusExW (in: hSCManager=0x94fe68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0057.027] GetLastError () returned 0xea [0057.027] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x12b4) returned 0x38406f0 [0057.027] EnumServicesStatusExW (in: hSCManager=0x94fe68, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38406f0, cbBufSize=0x12b4, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38406f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0057.028] CloseServiceHandle (hSCObject=0x94fe68) returned 1 [0057.028] lstrlenW (lpString="Appinfo") returned 7 [0057.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.028] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.028] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.028] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.028] lstrlenW (lpString="AudioSrv") returned 8 [0057.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.029] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.029] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.029] lstrlenW (lpString="BFE") returned 3 [0057.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.029] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.029] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.029] lstrlenW (lpString="CryptSvc") returned 8 [0057.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.029] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.029] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.029] lstrlenW (lpString="CscService") returned 10 [0057.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.029] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.029] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.029] lstrlenW (lpString="DcomLaunch") returned 10 [0057.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.029] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.029] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.029] lstrlenW (lpString="Dhcp") returned 4 [0057.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.029] lstrlenW (lpString="Dnscache") returned 8 [0057.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.030] lstrlenW (lpString="DPS") returned 3 [0057.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.030] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.030] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.030] lstrlenW (lpString="eventlog") returned 8 [0057.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.030] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.030] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.030] lstrlenW (lpString="EventSystem") returned 11 [0057.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.030] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.030] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.030] lstrlenW (lpString="FontCache") returned 9 [0057.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0057.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0057.030] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0057.030] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0057.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0057.030] lstrlenW (lpString="gpsvc") returned 5 [0057.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.031] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.031] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.031] lstrlenW (lpString="iphlpsvc") returned 8 [0057.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.031] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.031] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.031] lstrlenW (lpString="LanmanServer") returned 12 [0057.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.031] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.031] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.031] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.031] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.031] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.031] lstrlenW (lpString="lmhosts") returned 7 [0057.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.031] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.031] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.031] lstrlenW (lpString="MMCSS") returned 5 [0057.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.031] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.031] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.032] lstrlenW (lpString="MpsSvc") returned 6 [0057.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.032] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.032] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.032] lstrlenW (lpString="Netman") returned 6 [0057.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.032] lstrlenW (lpString="netprofm") returned 8 [0057.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.032] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.032] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.032] lstrlenW (lpString="NlaSvc") returned 6 [0057.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.032] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.032] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.032] lstrlenW (lpString="nsi") returned 3 [0057.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.032] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.032] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.032] lstrlenW (lpString="PcaSvc") returned 6 [0057.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.033] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.033] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.033] lstrlenW (lpString="PlugPlay") returned 8 [0057.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.033] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.033] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.033] lstrlenW (lpString="Power") returned 5 [0057.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.033] lstrlenW (lpString="ProfSvc") returned 7 [0057.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.033] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.033] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.033] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.033] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.033] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.033] lstrlenW (lpString="RpcSs") returned 5 [0057.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.033] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.033] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.034] lstrlenW (lpString="SamSs") returned 5 [0057.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.034] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.034] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.034] lstrlenW (lpString="Schedule") returned 8 [0057.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.034] lstrlenW (lpString="SENS") returned 4 [0057.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.034] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.034] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.034] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.034] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.034] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.034] lstrlenW (lpString="Spooler") returned 7 [0057.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.034] lstrlenW (lpString="SysMain") returned 7 [0057.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.035] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.035] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.035] lstrlenW (lpString="Themes") returned 6 [0057.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.035] lstrlenW (lpString="TrkWks") returned 6 [0057.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.035] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.035] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.035] lstrlenW (lpString="UxSms") returned 5 [0057.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.035] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.035] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.035] lstrlenW (lpString="VSS") returned 3 [0057.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.035] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.035] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.035] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.035] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.035] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.036] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.036] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.036] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.036] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.036] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.036] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.036] lstrlenW (lpString="Winmgmt") returned 7 [0057.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.036] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.036] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.036] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.036] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38406f0 | out: hHeap=0x8d0000) returned 1 [0057.036] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x180 [0057.039] Process32FirstW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.039] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.040] lstrlenW (lpString="System") returned 6 [0057.040] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.040] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.040] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.040] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.040] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.040] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.040] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.040] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.040] lstrlenW (lpString="smss.exe") returned 8 [0057.040] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.040] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.040] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.040] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.040] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.041] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.041] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.041] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.041] lstrlenW (lpString="csrss.exe") returned 9 [0057.041] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.041] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.041] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.041] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.041] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.041] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.041] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.041] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.042] lstrlenW (lpString="wininit.exe") returned 11 [0057.042] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.042] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.042] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.042] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.042] lstrlenW (lpString="csrss.exe") returned 9 [0057.042] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.043] lstrlenW (lpString="winlogon.exe") returned 12 [0057.043] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.044] lstrlenW (lpString="services.exe") returned 12 [0057.044] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.044] lstrlenW (lpString="lsass.exe") returned 9 [0057.044] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.045] lstrlenW (lpString="lsm.exe") returned 7 [0057.045] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.045] lstrlenW (lpString="svchost.exe") returned 11 [0057.045] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.046] lstrlenW (lpString="svchost.exe") returned 11 [0057.046] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.046] lstrlenW (lpString="svchost.exe") returned 11 [0057.046] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.047] lstrlenW (lpString="svchost.exe") returned 11 [0057.047] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.047] lstrlenW (lpString="svchost.exe") returned 11 [0057.047] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.048] lstrlenW (lpString="audiodg.exe") returned 11 [0057.048] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.048] lstrlenW (lpString="svchost.exe") returned 11 [0057.048] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.049] lstrlenW (lpString="svchost.exe") returned 11 [0057.049] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.049] lstrlenW (lpString="dwm.exe") returned 7 [0057.049] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.050] lstrlenW (lpString="explorer.exe") returned 12 [0057.050] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.050] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.050] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.051] lstrlenW (lpString="taskhost.exe") returned 12 [0057.051] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.051] lstrlenW (lpString="svchost.exe") returned 11 [0057.051] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.052] lstrlenW (lpString="taskeng.exe") returned 11 [0057.052] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.052] lstrlenW (lpString="taskhost.exe") returned 12 [0057.052] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0057.053] lstrlenW (lpString="tested.exe") returned 10 [0057.053] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0057.053] lstrlenW (lpString="memories global commission.exe") returned 30 [0057.054] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0057.054] lstrlenW (lpString="destination.exe") returned 15 [0057.054] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0057.054] lstrlenW (lpString="rom.exe") returned 7 [0057.055] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0057.055] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0057.055] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0057.056] lstrlenW (lpString="appropriate worm.exe") returned 20 [0057.056] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0057.056] lstrlenW (lpString="arrival-testing.exe") returned 19 [0057.056] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0057.057] lstrlenW (lpString="san stories panels.exe") returned 22 [0057.057] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0057.057] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0057.057] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0057.246] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0057.247] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0057.247] lstrlenW (lpString="taught opt practice.exe") returned 23 [0057.247] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0057.248] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0057.248] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0057.248] lstrlenW (lpString="aka gap.exe") returned 11 [0057.248] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0057.249] lstrlenW (lpString="copied-mr.exe") returned 13 [0057.249] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0057.249] lstrlenW (lpString="proven.exe") returned 10 [0057.249] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0057.250] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0057.250] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0057.250] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0057.250] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0057.251] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0057.251] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0057.251] lstrlenW (lpString="acm.exe") returned 7 [0057.251] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0057.252] lstrlenW (lpString="fluid.exe") returned 9 [0057.252] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0057.252] lstrlenW (lpString="domain.exe") returned 10 [0057.252] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0057.253] lstrlenW (lpString="cult_wanna.exe") returned 14 [0057.253] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0057.253] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0057.254] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.254] lstrlenW (lpString="svchost.exe") returned 11 [0057.254] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0057.254] lstrlenW (lpString="1Black.exe") returned 10 [0057.255] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0057.255] lstrlenW (lpString="cmd.exe") returned 7 [0057.255] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0057.256] lstrlenW (lpString="conhost.exe") returned 11 [0057.256] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0057.256] lstrlenW (lpString="vssadmin.exe") returned 12 [0057.256] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0057.257] lstrlenW (lpString="VSSVC.exe") returned 9 [0057.257] Process32NextW (in: hSnapshot=0x180, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0057.257] CloseHandle (hObject=0x180) returned 1 [0057.257] Sleep (dwMilliseconds=0x1f4) [0057.879] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94ffa8 [0057.879] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0057.879] GetLastError () returned 0xea [0057.879] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x12b4) returned 0x38406f0 [0057.880] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38406f0, cbBufSize=0x12b4, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38406f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0057.880] CloseServiceHandle (hSCObject=0x94ffa8) returned 1 [0057.881] lstrlenW (lpString="Appinfo") returned 7 [0057.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0057.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0057.881] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0057.881] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0057.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0057.881] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0057.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0057.881] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0057.881] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0057.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0057.881] lstrlenW (lpString="AudioSrv") returned 8 [0057.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0057.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0057.881] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0057.881] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0057.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0057.881] lstrlenW (lpString="BFE") returned 3 [0057.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0057.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0057.881] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0057.881] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0057.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0057.881] lstrlenW (lpString="CryptSvc") returned 8 [0057.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0057.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0057.882] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0057.882] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0057.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0057.882] lstrlenW (lpString="CscService") returned 10 [0057.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0057.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0057.882] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0057.882] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0057.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0057.882] lstrlenW (lpString="DcomLaunch") returned 10 [0057.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0057.882] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0057.882] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0057.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0057.882] lstrlenW (lpString="Dhcp") returned 4 [0057.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0057.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0057.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0057.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0057.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0057.882] lstrlenW (lpString="Dnscache") returned 8 [0057.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0057.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0057.882] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0057.882] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0057.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0057.882] lstrlenW (lpString="DPS") returned 3 [0057.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0057.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0057.882] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0057.882] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0057.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0057.883] lstrlenW (lpString="eventlog") returned 8 [0057.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0057.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0057.883] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0057.883] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0057.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0057.883] lstrlenW (lpString="EventSystem") returned 11 [0057.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0057.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0057.883] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0057.883] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0057.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0057.883] lstrlenW (lpString="FontCache") returned 9 [0057.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0057.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0057.883] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0057.883] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0057.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0057.883] lstrlenW (lpString="gpsvc") returned 5 [0057.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0057.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0057.883] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0057.883] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0057.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0057.883] lstrlenW (lpString="iphlpsvc") returned 8 [0057.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0057.883] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0057.883] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0057.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0057.884] lstrlenW (lpString="LanmanServer") returned 12 [0057.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0057.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0057.884] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0057.884] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0057.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0057.884] lstrlenW (lpString="LanmanWorkstation") returned 17 [0057.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0057.884] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0057.884] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0057.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0057.884] lstrlenW (lpString="lmhosts") returned 7 [0057.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0057.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0057.884] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0057.884] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0057.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0057.884] lstrlenW (lpString="MMCSS") returned 5 [0057.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0057.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0057.884] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0057.884] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0057.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0057.884] lstrlenW (lpString="MpsSvc") returned 6 [0057.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0057.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0057.884] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0057.884] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0057.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0057.885] lstrlenW (lpString="Netman") returned 6 [0057.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0057.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0057.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0057.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0057.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0057.885] lstrlenW (lpString="netprofm") returned 8 [0057.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0057.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0057.885] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0057.885] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0057.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0057.885] lstrlenW (lpString="NlaSvc") returned 6 [0057.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0057.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0057.885] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0057.885] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0057.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0057.885] lstrlenW (lpString="nsi") returned 3 [0057.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0057.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0057.885] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0057.885] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0057.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0057.885] lstrlenW (lpString="PcaSvc") returned 6 [0057.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0057.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0057.885] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0057.885] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0057.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0057.885] lstrlenW (lpString="PlugPlay") returned 8 [0057.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0057.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0057.886] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0057.886] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0057.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0057.886] lstrlenW (lpString="Power") returned 5 [0057.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0057.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0057.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0057.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0057.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0057.886] lstrlenW (lpString="ProfSvc") returned 7 [0057.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0057.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0057.886] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0057.886] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0057.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0057.886] lstrlenW (lpString="RpcEptMapper") returned 12 [0057.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0057.886] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0057.886] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0057.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0057.886] lstrlenW (lpString="RpcSs") returned 5 [0057.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0057.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0057.886] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0057.886] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0057.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0057.886] lstrlenW (lpString="SamSs") returned 5 [0057.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0057.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0057.886] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0057.886] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0057.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0057.887] lstrlenW (lpString="Schedule") returned 8 [0057.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0057.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0057.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0057.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0057.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0057.887] lstrlenW (lpString="SENS") returned 4 [0057.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0057.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0057.887] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0057.887] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0057.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0057.887] lstrlenW (lpString="ShellHWDetection") returned 16 [0057.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0057.887] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0057.887] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0057.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0057.887] lstrlenW (lpString="Spooler") returned 7 [0057.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0057.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0057.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0057.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0057.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0057.887] lstrlenW (lpString="SysMain") returned 7 [0057.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0057.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0057.887] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0057.887] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0057.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0057.887] lstrlenW (lpString="Themes") returned 6 [0057.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0057.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0057.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0057.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0057.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0057.888] lstrlenW (lpString="TrkWks") returned 6 [0057.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0057.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0057.888] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0057.888] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0057.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0057.888] lstrlenW (lpString="UxSms") returned 5 [0057.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0057.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0057.888] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0057.888] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0057.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0057.888] lstrlenW (lpString="VSS") returned 3 [0057.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0057.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0057.888] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0057.888] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0057.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0057.888] lstrlenW (lpString="WdiServiceHost") returned 14 [0057.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0057.888] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0057.888] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0057.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0057.888] lstrlenW (lpString="WdiSystemHost") returned 13 [0057.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0057.888] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0057.889] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0057.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0057.889] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0057.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0057.889] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0057.889] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0057.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0057.889] lstrlenW (lpString="Winmgmt") returned 7 [0057.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0057.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0057.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0057.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0057.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0057.889] lstrlenW (lpString="WPDBusEnum") returned 10 [0057.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0057.889] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0057.889] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0057.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0057.889] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38406f0 | out: hHeap=0x8d0000) returned 1 [0057.889] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0057.892] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0057.892] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0057.895] lstrlenW (lpString="System") returned 6 [0057.895] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0057.895] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0057.895] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0057.895] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0057.895] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0057.895] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0057.895] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0057.895] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0057.896] lstrlenW (lpString="smss.exe") returned 8 [0057.896] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0057.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0057.896] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0057.896] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0057.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0057.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0057.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0057.896] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.896] lstrlenW (lpString="csrss.exe") returned 9 [0057.896] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0057.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0057.897] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0057.897] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0057.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0057.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0057.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0057.897] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0057.897] lstrlenW (lpString="wininit.exe") returned 11 [0057.897] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0057.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0057.897] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0057.897] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0057.898] lstrlenW (lpString="csrss.exe") returned 9 [0057.898] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0057.898] lstrlenW (lpString="winlogon.exe") returned 12 [0057.898] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0057.899] lstrlenW (lpString="services.exe") returned 12 [0057.899] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0057.900] lstrlenW (lpString="lsass.exe") returned 9 [0057.900] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0057.900] lstrlenW (lpString="lsm.exe") returned 7 [0057.900] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.901] lstrlenW (lpString="svchost.exe") returned 11 [0057.901] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.901] lstrlenW (lpString="svchost.exe") returned 11 [0057.901] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.902] lstrlenW (lpString="svchost.exe") returned 11 [0057.902] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.902] lstrlenW (lpString="svchost.exe") returned 11 [0057.902] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2f, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.903] lstrlenW (lpString="svchost.exe") returned 11 [0057.903] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0057.903] lstrlenW (lpString="audiodg.exe") returned 11 [0057.903] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.904] lstrlenW (lpString="svchost.exe") returned 11 [0057.904] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.904] lstrlenW (lpString="svchost.exe") returned 11 [0057.904] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0057.905] lstrlenW (lpString="dwm.exe") returned 7 [0057.905] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0057.905] lstrlenW (lpString="explorer.exe") returned 12 [0057.905] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0057.906] lstrlenW (lpString="spoolsv.exe") returned 11 [0057.906] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.906] lstrlenW (lpString="taskhost.exe") returned 12 [0057.906] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0057.907] lstrlenW (lpString="svchost.exe") returned 11 [0057.907] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0057.907] lstrlenW (lpString="taskeng.exe") returned 11 [0057.907] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0057.908] lstrlenW (lpString="taskhost.exe") returned 12 [0057.908] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0057.908] lstrlenW (lpString="tested.exe") returned 10 [0057.908] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0057.909] lstrlenW (lpString="memories global commission.exe") returned 30 [0057.909] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0057.909] lstrlenW (lpString="destination.exe") returned 15 [0057.909] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0057.910] lstrlenW (lpString="rom.exe") returned 7 [0057.910] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0057.911] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0057.911] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0057.911] lstrlenW (lpString="appropriate worm.exe") returned 20 [0057.911] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0057.912] lstrlenW (lpString="arrival-testing.exe") returned 19 [0057.912] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0057.912] lstrlenW (lpString="san stories panels.exe") returned 22 [0057.912] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0057.913] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0057.913] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0057.913] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0057.913] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0057.914] lstrlenW (lpString="taught opt practice.exe") returned 23 [0057.914] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0057.914] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0057.914] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0058.196] lstrlenW (lpString="aka gap.exe") returned 11 [0058.196] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0058.196] lstrlenW (lpString="copied-mr.exe") returned 13 [0058.196] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0058.197] lstrlenW (lpString="proven.exe") returned 10 [0058.197] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0058.197] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0058.197] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0058.198] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0058.198] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0058.198] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0058.198] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0058.199] lstrlenW (lpString="acm.exe") returned 7 [0058.199] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0058.199] lstrlenW (lpString="fluid.exe") returned 9 [0058.200] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0058.200] lstrlenW (lpString="domain.exe") returned 10 [0058.200] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0058.201] lstrlenW (lpString="cult_wanna.exe") returned 14 [0058.201] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0058.201] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0058.201] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0058.202] lstrlenW (lpString="svchost.exe") returned 11 [0058.202] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0058.202] lstrlenW (lpString="1Black.exe") returned 10 [0058.202] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0058.203] lstrlenW (lpString="cmd.exe") returned 7 [0058.203] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0058.203] lstrlenW (lpString="conhost.exe") returned 11 [0058.203] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0058.204] lstrlenW (lpString="vssadmin.exe") returned 12 [0058.204] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0058.204] lstrlenW (lpString="VSSVC.exe") returned 9 [0058.204] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0058.205] CloseHandle (hObject=0x1e0) returned 1 [0058.205] Sleep (dwMilliseconds=0x1f4) [0059.026] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94ffa8 [0059.027] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0059.027] GetLastError () returned 0xea [0059.027] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x133c) returned 0x3f754b0 [0059.027] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3f754b0, cbBufSize=0x133c, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3f754b0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0059.028] CloseServiceHandle (hSCObject=0x94ffa8) returned 1 [0059.028] lstrlenW (lpString="Appinfo") returned 7 [0059.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0059.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0059.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0059.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0059.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0059.028] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0059.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0059.029] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0059.029] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0059.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0059.029] lstrlenW (lpString="AudioSrv") returned 8 [0059.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0059.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0059.029] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0059.029] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0059.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0059.029] lstrlenW (lpString="BFE") returned 3 [0059.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0059.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0059.029] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0059.029] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0059.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0059.029] lstrlenW (lpString="CryptSvc") returned 8 [0059.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0059.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0059.029] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0059.029] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0059.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0059.029] lstrlenW (lpString="CscService") returned 10 [0059.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0059.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0059.029] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0059.029] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0059.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0059.029] lstrlenW (lpString="DcomLaunch") returned 10 [0059.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0059.029] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0059.029] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0059.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0059.029] lstrlenW (lpString="Dhcp") returned 4 [0059.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0059.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0059.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0059.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0059.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0059.030] lstrlenW (lpString="Dnscache") returned 8 [0059.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0059.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0059.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0059.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0059.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0059.030] lstrlenW (lpString="DPS") returned 3 [0059.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0059.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0059.030] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0059.030] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0059.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0059.030] lstrlenW (lpString="eventlog") returned 8 [0059.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0059.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0059.030] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0059.030] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0059.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0059.030] lstrlenW (lpString="EventSystem") returned 11 [0059.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0059.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0059.030] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0059.030] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0059.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0059.030] lstrlenW (lpString="FontCache") returned 9 [0059.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0059.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0059.030] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0059.030] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0059.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0059.031] lstrlenW (lpString="gpsvc") returned 5 [0059.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0059.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0059.031] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0059.031] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0059.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0059.031] lstrlenW (lpString="iphlpsvc") returned 8 [0059.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0059.031] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0059.031] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0059.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0059.031] lstrlenW (lpString="LanmanServer") returned 12 [0059.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0059.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0059.031] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0059.031] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0059.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0059.031] lstrlenW (lpString="LanmanWorkstation") returned 17 [0059.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0059.031] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0059.031] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0059.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0059.031] lstrlenW (lpString="lmhosts") returned 7 [0059.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0059.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0059.031] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0059.031] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0059.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0059.031] lstrlenW (lpString="MMCSS") returned 5 [0059.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0059.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0059.032] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0059.032] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0059.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0059.032] lstrlenW (lpString="MpsSvc") returned 6 [0059.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0059.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0059.032] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0059.032] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0059.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0059.032] lstrlenW (lpString="Netman") returned 6 [0059.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0059.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0059.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0059.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0059.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0059.032] lstrlenW (lpString="netprofm") returned 8 [0059.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0059.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0059.032] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0059.032] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0059.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0059.032] lstrlenW (lpString="NlaSvc") returned 6 [0059.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0059.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0059.032] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0059.032] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0059.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0059.032] lstrlenW (lpString="nsi") returned 3 [0059.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0059.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0059.032] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0059.032] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0059.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0059.033] lstrlenW (lpString="PcaSvc") returned 6 [0059.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0059.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0059.033] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0059.033] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0059.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0059.033] lstrlenW (lpString="PlugPlay") returned 8 [0059.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0059.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0059.033] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0059.033] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0059.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0059.033] lstrlenW (lpString="Power") returned 5 [0059.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0059.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0059.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0059.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0059.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0059.033] lstrlenW (lpString="ProfSvc") returned 7 [0059.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0059.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0059.033] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0059.033] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0059.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0059.033] lstrlenW (lpString="RpcEptMapper") returned 12 [0059.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0059.033] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0059.033] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0059.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0059.033] lstrlenW (lpString="RpcSs") returned 5 [0059.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0059.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0059.033] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0059.034] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0059.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0059.034] lstrlenW (lpString="SamSs") returned 5 [0059.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0059.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0059.034] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0059.034] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0059.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0059.034] lstrlenW (lpString="Schedule") returned 8 [0059.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0059.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0059.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0059.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0059.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0059.034] lstrlenW (lpString="SENS") returned 4 [0059.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0059.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0059.034] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0059.034] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0059.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0059.034] lstrlenW (lpString="ShellHWDetection") returned 16 [0059.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0059.034] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0059.034] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0059.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0059.034] lstrlenW (lpString="Spooler") returned 7 [0059.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0059.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0059.034] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0059.034] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0059.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0059.034] lstrlenW (lpString="swprv") returned 5 [0059.034] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0059.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0059.035] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0059.035] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0059.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0059.035] lstrlenW (lpString="SysMain") returned 7 [0059.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0059.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0059.035] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0059.035] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0059.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0059.035] lstrlenW (lpString="Themes") returned 6 [0059.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0059.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0059.035] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0059.035] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0059.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0059.035] lstrlenW (lpString="TrkWks") returned 6 [0059.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0059.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0059.035] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0059.035] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0059.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0059.035] lstrlenW (lpString="UxSms") returned 5 [0059.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0059.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0059.035] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0059.035] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0059.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0059.035] lstrlenW (lpString="VSS") returned 3 [0059.035] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0059.035] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0059.035] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0059.035] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0059.035] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0059.036] lstrlenW (lpString="WdiServiceHost") returned 14 [0059.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0059.036] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0059.036] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0059.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0059.036] lstrlenW (lpString="WdiSystemHost") returned 13 [0059.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0059.036] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0059.036] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0059.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0059.036] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0059.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0059.036] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0059.036] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0059.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0059.036] lstrlenW (lpString="Winmgmt") returned 7 [0059.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0059.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0059.036] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0059.036] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0059.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0059.036] lstrlenW (lpString="WPDBusEnum") returned 10 [0059.036] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.036] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0059.036] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0059.036] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0059.036] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0059.036] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f754b0 | out: hHeap=0x8d0000) returned 1 [0059.036] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0059.041] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0059.041] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0059.042] lstrlenW (lpString="System") returned 6 [0059.042] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0059.042] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0059.042] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0059.042] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0059.042] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0059.042] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0059.042] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0059.042] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0059.043] lstrlenW (lpString="smss.exe") returned 8 [0059.043] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0059.043] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0059.043] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0059.043] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0059.043] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0059.043] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0059.043] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0059.043] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.043] lstrlenW (lpString="csrss.exe") returned 9 [0059.043] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0059.043] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0059.044] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0059.044] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0059.044] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0059.044] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0059.044] lstrlenW (lpString="wininit.exe") returned 11 [0059.044] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0059.045] lstrlenW (lpString="csrss.exe") returned 9 [0059.045] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0059.045] lstrlenW (lpString="winlogon.exe") returned 12 [0059.045] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0059.046] lstrlenW (lpString="services.exe") returned 12 [0059.046] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0059.046] lstrlenW (lpString="lsass.exe") returned 9 [0059.046] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0059.047] lstrlenW (lpString="lsm.exe") returned 7 [0059.047] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.047] lstrlenW (lpString="svchost.exe") returned 11 [0059.047] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.048] lstrlenW (lpString="svchost.exe") returned 11 [0059.048] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.048] lstrlenW (lpString="svchost.exe") returned 11 [0059.048] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.049] lstrlenW (lpString="svchost.exe") returned 11 [0059.049] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.049] lstrlenW (lpString="svchost.exe") returned 11 [0059.049] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0059.050] lstrlenW (lpString="audiodg.exe") returned 11 [0059.050] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.050] lstrlenW (lpString="svchost.exe") returned 11 [0059.050] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.051] lstrlenW (lpString="svchost.exe") returned 11 [0059.051] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0059.051] lstrlenW (lpString="dwm.exe") returned 7 [0059.051] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0059.052] lstrlenW (lpString="explorer.exe") returned 12 [0059.052] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0059.052] lstrlenW (lpString="spoolsv.exe") returned 11 [0059.052] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.053] lstrlenW (lpString="taskhost.exe") returned 12 [0059.053] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.053] lstrlenW (lpString="svchost.exe") returned 11 [0059.053] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0059.054] lstrlenW (lpString="taskeng.exe") returned 11 [0059.054] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0059.055] lstrlenW (lpString="taskhost.exe") returned 12 [0059.055] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0059.055] lstrlenW (lpString="tested.exe") returned 10 [0059.055] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0059.056] lstrlenW (lpString="memories global commission.exe") returned 30 [0059.056] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0059.056] lstrlenW (lpString="destination.exe") returned 15 [0059.056] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0059.057] lstrlenW (lpString="rom.exe") returned 7 [0059.057] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0059.057] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0059.057] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0059.058] lstrlenW (lpString="appropriate worm.exe") returned 20 [0059.058] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0059.058] lstrlenW (lpString="arrival-testing.exe") returned 19 [0059.058] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0059.059] lstrlenW (lpString="san stories panels.exe") returned 22 [0059.059] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0059.059] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0059.059] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0059.060] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0059.060] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0059.060] lstrlenW (lpString="taught opt practice.exe") returned 23 [0059.060] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0059.061] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0059.061] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0059.061] lstrlenW (lpString="aka gap.exe") returned 11 [0059.061] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0059.062] lstrlenW (lpString="copied-mr.exe") returned 13 [0059.062] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0059.479] lstrlenW (lpString="proven.exe") returned 10 [0059.479] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0059.480] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0059.480] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0059.480] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0059.481] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0059.481] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0059.481] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0059.482] lstrlenW (lpString="acm.exe") returned 7 [0059.482] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0059.482] lstrlenW (lpString="fluid.exe") returned 9 [0059.482] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0059.483] lstrlenW (lpString="domain.exe") returned 10 [0059.483] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0059.483] lstrlenW (lpString="cult_wanna.exe") returned 14 [0059.483] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0059.484] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0059.484] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0059.484] lstrlenW (lpString="svchost.exe") returned 11 [0059.484] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0059.485] lstrlenW (lpString="1Black.exe") returned 10 [0059.485] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0059.485] lstrlenW (lpString="cmd.exe") returned 7 [0059.485] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0059.486] lstrlenW (lpString="conhost.exe") returned 11 [0059.486] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0059.486] lstrlenW (lpString="vssadmin.exe") returned 12 [0059.486] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0059.487] lstrlenW (lpString="VSSVC.exe") returned 9 [0059.487] Process32NextW (in: hSnapshot=0x1e8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0059.487] CloseHandle (hObject=0x1e8) returned 1 [0059.487] Sleep (dwMilliseconds=0x1f4) [0060.140] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94f9e0 [0060.143] EnumServicesStatusExW (in: hSCManager=0x94f9e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0060.144] GetLastError () returned 0xea [0060.144] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x133c) returned 0x38406f0 [0060.144] EnumServicesStatusExW (in: hSCManager=0x94f9e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38406f0, cbBufSize=0x133c, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38406f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0060.144] CloseServiceHandle (hSCObject=0x94f9e0) returned 1 [0060.145] lstrlenW (lpString="Appinfo") returned 7 [0060.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0060.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0060.145] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0060.145] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0060.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0060.145] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0060.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0060.145] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0060.145] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0060.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0060.145] lstrlenW (lpString="AudioSrv") returned 8 [0060.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0060.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0060.145] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0060.145] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0060.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0060.145] lstrlenW (lpString="BFE") returned 3 [0060.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0060.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0060.145] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0060.145] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0060.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0060.145] lstrlenW (lpString="CryptSvc") returned 8 [0060.145] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0060.145] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0060.145] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0060.145] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0060.145] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0060.145] lstrlenW (lpString="CscService") returned 10 [0060.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0060.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0060.146] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0060.146] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0060.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0060.146] lstrlenW (lpString="DcomLaunch") returned 10 [0060.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0060.146] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0060.146] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0060.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0060.146] lstrlenW (lpString="Dhcp") returned 4 [0060.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0060.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0060.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0060.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0060.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0060.146] lstrlenW (lpString="Dnscache") returned 8 [0060.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0060.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0060.146] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0060.146] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0060.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0060.146] lstrlenW (lpString="DPS") returned 3 [0060.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0060.146] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0060.146] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0060.146] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0060.146] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0060.146] lstrlenW (lpString="eventlog") returned 8 [0060.146] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0060.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0060.147] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0060.147] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0060.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0060.147] lstrlenW (lpString="EventSystem") returned 11 [0060.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0060.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0060.147] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0060.147] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0060.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0060.147] lstrlenW (lpString="FontCache") returned 9 [0060.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0060.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0060.147] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0060.147] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0060.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0060.147] lstrlenW (lpString="gpsvc") returned 5 [0060.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0060.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0060.147] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0060.147] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0060.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0060.147] lstrlenW (lpString="iphlpsvc") returned 8 [0060.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0060.147] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0060.147] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0060.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0060.147] lstrlenW (lpString="LanmanServer") returned 12 [0060.147] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0060.147] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0060.147] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0060.147] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0060.147] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0060.148] lstrlenW (lpString="LanmanWorkstation") returned 17 [0060.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0060.148] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0060.148] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0060.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0060.148] lstrlenW (lpString="lmhosts") returned 7 [0060.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0060.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0060.148] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0060.148] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0060.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0060.148] lstrlenW (lpString="MMCSS") returned 5 [0060.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0060.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0060.148] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0060.148] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0060.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0060.148] lstrlenW (lpString="MpsSvc") returned 6 [0060.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0060.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0060.148] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0060.148] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0060.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0060.148] lstrlenW (lpString="Netman") returned 6 [0060.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0060.148] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0060.148] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0060.148] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0060.148] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0060.148] lstrlenW (lpString="netprofm") returned 8 [0060.148] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0060.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0060.149] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0060.149] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0060.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0060.149] lstrlenW (lpString="NlaSvc") returned 6 [0060.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0060.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0060.149] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0060.149] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0060.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0060.149] lstrlenW (lpString="nsi") returned 3 [0060.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0060.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0060.149] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0060.149] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0060.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0060.149] lstrlenW (lpString="PcaSvc") returned 6 [0060.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0060.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0060.149] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0060.149] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0060.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0060.149] lstrlenW (lpString="PlugPlay") returned 8 [0060.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0060.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0060.149] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0060.149] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0060.149] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0060.149] lstrlenW (lpString="Power") returned 5 [0060.149] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0060.149] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0060.149] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0060.149] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0060.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0060.150] lstrlenW (lpString="ProfSvc") returned 7 [0060.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0060.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0060.150] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0060.150] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0060.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0060.150] lstrlenW (lpString="RpcEptMapper") returned 12 [0060.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0060.150] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0060.150] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0060.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0060.150] lstrlenW (lpString="RpcSs") returned 5 [0060.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0060.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0060.150] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0060.150] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0060.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0060.150] lstrlenW (lpString="SamSs") returned 5 [0060.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0060.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0060.150] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0060.150] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0060.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0060.150] lstrlenW (lpString="Schedule") returned 8 [0060.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0060.150] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0060.150] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0060.150] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0060.150] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0060.150] lstrlenW (lpString="SENS") returned 4 [0060.150] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0060.151] lstrlenW (lpString="ShellHWDetection") returned 16 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0060.151] lstrlenW (lpString="Spooler") returned 7 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0060.151] lstrlenW (lpString="swprv") returned 5 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0060.151] lstrlenW (lpString="SysMain") returned 7 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0060.151] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0060.151] lstrlenW (lpString="Themes") returned 6 [0060.151] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0060.151] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0060.151] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0060.151] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0060.152] lstrlenW (lpString="TrkWks") returned 6 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0060.152] lstrlenW (lpString="UxSms") returned 5 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0060.152] lstrlenW (lpString="VSS") returned 3 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0060.152] lstrlenW (lpString="WdiServiceHost") returned 14 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0060.152] lstrlenW (lpString="WdiSystemHost") returned 13 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.152] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0060.152] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0060.152] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0060.152] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0060.152] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0060.152] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0060.153] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0060.153] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0060.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0060.153] lstrlenW (lpString="Winmgmt") returned 7 [0060.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0060.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0060.153] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0060.153] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0060.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0060.153] lstrlenW (lpString="WPDBusEnum") returned 10 [0060.153] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.153] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0060.153] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0060.153] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0060.153] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0060.153] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38406f0 | out: hHeap=0x8d0000) returned 1 [0060.153] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x170 [0060.155] Process32FirstW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0060.156] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0060.156] lstrlenW (lpString="System") returned 6 [0060.156] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0060.156] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0060.156] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0060.156] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0060.156] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0060.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0060.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0060.157] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0060.157] lstrlenW (lpString="smss.exe") returned 8 [0060.157] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0060.157] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0060.157] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0060.157] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0060.157] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0060.157] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0060.157] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0060.157] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.158] lstrlenW (lpString="csrss.exe") returned 9 [0060.158] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0060.158] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0060.158] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0060.158] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0060.158] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0060.158] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0060.159] lstrlenW (lpString="wininit.exe") returned 11 [0060.159] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0060.159] lstrlenW (lpString="csrss.exe") returned 9 [0060.159] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0060.160] lstrlenW (lpString="winlogon.exe") returned 12 [0060.160] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0060.160] lstrlenW (lpString="services.exe") returned 12 [0060.160] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0060.161] lstrlenW (lpString="lsass.exe") returned 9 [0060.161] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0060.161] lstrlenW (lpString="lsm.exe") returned 7 [0060.161] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.162] lstrlenW (lpString="svchost.exe") returned 11 [0060.162] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.162] lstrlenW (lpString="svchost.exe") returned 11 [0060.162] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.163] lstrlenW (lpString="svchost.exe") returned 11 [0060.163] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.163] lstrlenW (lpString="svchost.exe") returned 11 [0060.164] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.164] lstrlenW (lpString="svchost.exe") returned 11 [0060.164] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0060.165] lstrlenW (lpString="audiodg.exe") returned 11 [0060.165] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.165] lstrlenW (lpString="svchost.exe") returned 11 [0060.165] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.166] lstrlenW (lpString="svchost.exe") returned 11 [0060.166] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0060.166] lstrlenW (lpString="dwm.exe") returned 7 [0060.166] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0060.167] lstrlenW (lpString="explorer.exe") returned 12 [0060.167] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0060.167] lstrlenW (lpString="spoolsv.exe") returned 11 [0060.167] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.168] lstrlenW (lpString="taskhost.exe") returned 12 [0060.168] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.168] lstrlenW (lpString="svchost.exe") returned 11 [0060.168] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0060.169] lstrlenW (lpString="taskeng.exe") returned 11 [0060.169] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0060.169] lstrlenW (lpString="taskhost.exe") returned 12 [0060.169] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0060.170] lstrlenW (lpString="tested.exe") returned 10 [0060.170] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0060.170] lstrlenW (lpString="memories global commission.exe") returned 30 [0060.171] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0060.171] lstrlenW (lpString="destination.exe") returned 15 [0060.171] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0060.172] lstrlenW (lpString="rom.exe") returned 7 [0060.172] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0060.172] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0060.172] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0060.173] lstrlenW (lpString="appropriate worm.exe") returned 20 [0060.173] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0060.173] lstrlenW (lpString="arrival-testing.exe") returned 19 [0060.173] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0060.174] lstrlenW (lpString="san stories panels.exe") returned 22 [0060.174] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0060.174] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0060.174] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0060.175] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0060.175] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0060.175] lstrlenW (lpString="taught opt practice.exe") returned 23 [0060.176] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0060.176] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0060.176] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0060.177] lstrlenW (lpString="aka gap.exe") returned 11 [0060.177] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0060.341] lstrlenW (lpString="copied-mr.exe") returned 13 [0060.341] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0060.342] lstrlenW (lpString="proven.exe") returned 10 [0060.342] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0060.342] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0060.342] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0060.343] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0060.343] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0060.343] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0060.343] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0060.344] lstrlenW (lpString="acm.exe") returned 7 [0060.344] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0060.344] lstrlenW (lpString="fluid.exe") returned 9 [0060.344] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0060.345] lstrlenW (lpString="domain.exe") returned 10 [0060.345] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0060.345] lstrlenW (lpString="cult_wanna.exe") returned 14 [0060.345] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0060.346] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0060.346] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.346] lstrlenW (lpString="svchost.exe") returned 11 [0060.346] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0060.347] lstrlenW (lpString="1Black.exe") returned 10 [0060.347] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0060.347] lstrlenW (lpString="cmd.exe") returned 7 [0060.347] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0060.348] lstrlenW (lpString="conhost.exe") returned 11 [0060.348] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0060.349] lstrlenW (lpString="vssadmin.exe") returned 12 [0060.349] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0060.349] lstrlenW (lpString="VSSVC.exe") returned 9 [0060.349] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0060.350] lstrlenW (lpString="svchost.exe") returned 11 [0060.350] Process32NextW (in: hSnapshot=0x170, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0060.350] CloseHandle (hObject=0x170) returned 1 [0060.350] Sleep (dwMilliseconds=0x1f4) [0061.016] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94f9e0 [0061.023] EnumServicesStatusExW (in: hSCManager=0x94f9e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0061.024] GetLastError () returned 0xea [0061.024] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x133c) returned 0x405b530 [0061.024] EnumServicesStatusExW (in: hSCManager=0x94f9e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x405b530, cbBufSize=0x133c, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x405b530, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0061.025] CloseServiceHandle (hSCObject=0x94f9e0) returned 1 [0061.025] lstrlenW (lpString="Appinfo") returned 7 [0061.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0061.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0061.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0061.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0061.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0061.025] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0061.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0061.026] lstrlenW (lpString="AudioSrv") returned 8 [0061.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0061.026] lstrlenW (lpString="BFE") returned 3 [0061.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0061.026] lstrlenW (lpString="CryptSvc") returned 8 [0061.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0061.026] lstrlenW (lpString="CscService") returned 10 [0061.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0061.026] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0061.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0061.026] lstrlenW (lpString="DcomLaunch") returned 10 [0061.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0061.026] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0061.027] lstrlenW (lpString="Dhcp") returned 4 [0061.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0061.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0061.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0061.027] lstrlenW (lpString="Dnscache") returned 8 [0061.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0061.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0061.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0061.027] lstrlenW (lpString="DPS") returned 3 [0061.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0061.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0061.027] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0061.027] lstrlenW (lpString="eventlog") returned 8 [0061.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0061.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0061.027] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0061.027] lstrlenW (lpString="EventSystem") returned 11 [0061.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0061.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0061.027] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0061.027] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0061.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0061.027] lstrlenW (lpString="FontCache") returned 9 [0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0061.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0061.028] lstrlenW (lpString="gpsvc") returned 5 [0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0061.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0061.028] lstrlenW (lpString="iphlpsvc") returned 8 [0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0061.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0061.028] lstrlenW (lpString="LanmanServer") returned 12 [0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0061.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0061.028] lstrlenW (lpString="LanmanWorkstation") returned 17 [0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0061.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0061.028] lstrlenW (lpString="lmhosts") returned 7 [0061.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0061.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0061.028] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0061.028] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0061.029] lstrlenW (lpString="MMCSS") returned 5 [0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0061.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0061.029] lstrlenW (lpString="MpsSvc") returned 6 [0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0061.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0061.029] lstrlenW (lpString="Netman") returned 6 [0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0061.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0061.029] lstrlenW (lpString="netprofm") returned 8 [0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0061.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0061.029] lstrlenW (lpString="NlaSvc") returned 6 [0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0061.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0061.029] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0061.029] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0061.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0061.029] lstrlenW (lpString="nsi") returned 3 [0061.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0061.030] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0061.030] lstrlenW (lpString="PcaSvc") returned 6 [0061.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0061.030] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0061.030] lstrlenW (lpString="PlugPlay") returned 8 [0061.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0061.030] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0061.030] lstrlenW (lpString="Power") returned 5 [0061.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0061.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0061.030] lstrlenW (lpString="ProfSvc") returned 7 [0061.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0061.030] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0061.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0061.030] lstrlenW (lpString="RpcEptMapper") returned 12 [0061.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0061.030] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0061.031] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0061.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0061.031] lstrlenW (lpString="RpcSs") returned 5 [0061.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0061.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0061.031] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0061.031] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0061.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0061.031] lstrlenW (lpString="SamSs") returned 5 [0061.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0061.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0061.031] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0061.031] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0061.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0061.031] lstrlenW (lpString="Schedule") returned 8 [0061.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0061.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0061.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0061.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0061.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0061.031] lstrlenW (lpString="SENS") returned 4 [0061.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0061.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0061.031] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0061.031] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0061.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0061.031] lstrlenW (lpString="ShellHWDetection") returned 16 [0061.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0061.031] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0061.031] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0061.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0061.031] lstrlenW (lpString="Spooler") returned 7 [0061.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0061.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0061.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0061.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0061.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0061.032] lstrlenW (lpString="swprv") returned 5 [0061.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0061.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0061.032] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0061.032] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0061.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0061.032] lstrlenW (lpString="SysMain") returned 7 [0061.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0061.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0061.032] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0061.032] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0061.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0061.032] lstrlenW (lpString="Themes") returned 6 [0061.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0061.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0061.032] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0061.032] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0061.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0061.032] lstrlenW (lpString="TrkWks") returned 6 [0061.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0061.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0061.032] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0061.032] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0061.032] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0061.032] lstrlenW (lpString="UxSms") returned 5 [0061.032] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0061.032] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0061.032] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0061.032] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0061.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0061.033] lstrlenW (lpString="VSS") returned 3 [0061.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0061.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0061.033] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0061.033] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0061.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0061.033] lstrlenW (lpString="WdiServiceHost") returned 14 [0061.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0061.033] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0061.033] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0061.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0061.033] lstrlenW (lpString="WdiSystemHost") returned 13 [0061.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0061.033] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0061.033] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0061.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0061.033] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0061.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0061.033] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0061.033] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0061.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0061.033] lstrlenW (lpString="Winmgmt") returned 7 [0061.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0061.033] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0061.033] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0061.033] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0061.033] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0061.033] lstrlenW (lpString="WPDBusEnum") returned 10 [0061.033] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.034] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0061.034] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0061.034] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0061.034] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0061.034] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x405b530 | out: hHeap=0x8d0000) returned 1 [0061.034] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0061.037] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0061.037] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0061.038] lstrlenW (lpString="System") returned 6 [0061.038] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0061.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0061.038] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0061.038] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0061.038] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0061.038] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0061.038] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0061.038] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0061.038] lstrlenW (lpString="smss.exe") returned 8 [0061.038] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0061.038] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0061.038] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0061.038] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0061.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0061.039] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0061.039] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0061.039] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.039] lstrlenW (lpString="csrss.exe") returned 9 [0061.039] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0061.039] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0061.039] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0061.039] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0061.039] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0061.039] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0061.040] lstrlenW (lpString="wininit.exe") returned 11 [0061.040] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0061.040] lstrlenW (lpString="csrss.exe") returned 9 [0061.040] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0061.041] lstrlenW (lpString="winlogon.exe") returned 12 [0061.041] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0061.041] lstrlenW (lpString="services.exe") returned 12 [0061.041] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0061.042] lstrlenW (lpString="lsass.exe") returned 9 [0061.042] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0061.043] lstrlenW (lpString="lsm.exe") returned 7 [0061.043] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.043] lstrlenW (lpString="svchost.exe") returned 11 [0061.043] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.044] lstrlenW (lpString="svchost.exe") returned 11 [0061.044] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.044] lstrlenW (lpString="svchost.exe") returned 11 [0061.044] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.045] lstrlenW (lpString="svchost.exe") returned 11 [0061.045] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.045] lstrlenW (lpString="svchost.exe") returned 11 [0061.045] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0061.046] lstrlenW (lpString="audiodg.exe") returned 11 [0061.046] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.046] lstrlenW (lpString="svchost.exe") returned 11 [0061.046] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.047] lstrlenW (lpString="svchost.exe") returned 11 [0061.047] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0061.047] lstrlenW (lpString="dwm.exe") returned 7 [0061.047] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0061.048] lstrlenW (lpString="explorer.exe") returned 12 [0061.048] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0061.048] lstrlenW (lpString="spoolsv.exe") returned 11 [0061.048] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.049] lstrlenW (lpString="taskhost.exe") returned 12 [0061.049] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.049] lstrlenW (lpString="svchost.exe") returned 11 [0061.049] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0061.050] lstrlenW (lpString="taskeng.exe") returned 11 [0061.050] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0061.051] lstrlenW (lpString="taskhost.exe") returned 12 [0061.051] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0061.051] lstrlenW (lpString="tested.exe") returned 10 [0061.051] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0061.052] lstrlenW (lpString="memories global commission.exe") returned 30 [0061.052] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0061.052] lstrlenW (lpString="destination.exe") returned 15 [0061.052] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0061.053] lstrlenW (lpString="rom.exe") returned 7 [0061.053] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0061.053] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0061.053] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0061.054] lstrlenW (lpString="appropriate worm.exe") returned 20 [0061.054] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0061.054] lstrlenW (lpString="arrival-testing.exe") returned 19 [0061.055] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0061.055] lstrlenW (lpString="san stories panels.exe") returned 22 [0061.055] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0061.056] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0061.056] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0061.056] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0061.056] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0061.057] lstrlenW (lpString="taught opt practice.exe") returned 23 [0061.057] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0061.057] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0061.057] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0061.058] lstrlenW (lpString="aka gap.exe") returned 11 [0061.058] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0061.058] lstrlenW (lpString="copied-mr.exe") returned 13 [0061.058] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0061.059] lstrlenW (lpString="proven.exe") returned 10 [0061.059] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0061.059] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0061.059] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0061.060] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0061.060] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0061.060] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0061.060] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0061.061] lstrlenW (lpString="acm.exe") returned 7 [0061.061] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0061.061] lstrlenW (lpString="fluid.exe") returned 9 [0061.062] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0061.062] lstrlenW (lpString="domain.exe") returned 10 [0061.062] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0061.063] lstrlenW (lpString="cult_wanna.exe") returned 14 [0061.063] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0061.063] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0061.063] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.064] lstrlenW (lpString="svchost.exe") returned 11 [0061.064] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0061.064] lstrlenW (lpString="1Black.exe") returned 10 [0061.064] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0061.065] lstrlenW (lpString="cmd.exe") returned 7 [0061.065] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0061.065] lstrlenW (lpString="conhost.exe") returned 11 [0061.065] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0061.066] lstrlenW (lpString="vssadmin.exe") returned 12 [0061.066] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0061.193] lstrlenW (lpString="VSSVC.exe") returned 9 [0061.194] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0061.194] lstrlenW (lpString="svchost.exe") returned 11 [0061.194] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0061.195] CloseHandle (hObject=0x1d8) returned 1 [0061.195] Sleep (dwMilliseconds=0x1f4) [0062.073] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94ffa8 [0062.074] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0062.074] GetLastError () returned 0xea [0062.074] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x133c) returned 0x405b530 [0062.074] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x405b530, cbBufSize=0x133c, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x405b530, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0062.088] CloseServiceHandle (hSCObject=0x94ffa8) returned 1 [0062.089] lstrlenW (lpString="Appinfo") returned 7 [0062.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0062.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0062.089] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0062.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0062.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0062.089] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0062.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0062.089] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0062.089] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0062.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0062.089] lstrlenW (lpString="AudioSrv") returned 8 [0062.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0062.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0062.089] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0062.089] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0062.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0062.089] lstrlenW (lpString="BFE") returned 3 [0062.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0062.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0062.089] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0062.089] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0062.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0062.089] lstrlenW (lpString="CryptSvc") returned 8 [0062.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0062.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0062.089] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0062.089] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0062.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0062.089] lstrlenW (lpString="CscService") returned 10 [0062.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0062.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0062.090] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0062.090] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0062.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0062.090] lstrlenW (lpString="DcomLaunch") returned 10 [0062.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0062.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0062.090] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0062.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0062.090] lstrlenW (lpString="Dhcp") returned 4 [0062.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0062.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0062.090] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0062.090] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0062.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0062.090] lstrlenW (lpString="Dnscache") returned 8 [0062.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0062.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0062.090] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0062.090] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0062.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0062.090] lstrlenW (lpString="DPS") returned 3 [0062.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0062.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0062.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0062.090] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0062.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0062.090] lstrlenW (lpString="eventlog") returned 8 [0062.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0062.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0062.090] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0062.091] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0062.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0062.091] lstrlenW (lpString="EventSystem") returned 11 [0062.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0062.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0062.091] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0062.091] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0062.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0062.091] lstrlenW (lpString="FontCache") returned 9 [0062.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0062.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0062.091] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0062.091] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0062.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0062.091] lstrlenW (lpString="gpsvc") returned 5 [0062.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0062.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0062.091] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0062.091] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0062.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0062.091] lstrlenW (lpString="iphlpsvc") returned 8 [0062.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0062.091] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0062.091] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0062.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0062.091] lstrlenW (lpString="LanmanServer") returned 12 [0062.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0062.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0062.091] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0062.091] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0062.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0062.092] lstrlenW (lpString="LanmanWorkstation") returned 17 [0062.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0062.092] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0062.092] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0062.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0062.092] lstrlenW (lpString="lmhosts") returned 7 [0062.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0062.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0062.092] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0062.092] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0062.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0062.092] lstrlenW (lpString="MMCSS") returned 5 [0062.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0062.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0062.092] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0062.092] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0062.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0062.092] lstrlenW (lpString="MpsSvc") returned 6 [0062.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0062.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0062.092] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0062.092] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0062.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0062.092] lstrlenW (lpString="Netman") returned 6 [0062.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0062.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0062.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0062.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0062.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0062.092] lstrlenW (lpString="netprofm") returned 8 [0062.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0062.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0062.093] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0062.093] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0062.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0062.093] lstrlenW (lpString="NlaSvc") returned 6 [0062.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0062.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0062.093] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0062.093] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0062.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0062.093] lstrlenW (lpString="nsi") returned 3 [0062.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0062.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0062.093] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0062.093] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0062.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0062.093] lstrlenW (lpString="PcaSvc") returned 6 [0062.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0062.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0062.093] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0062.093] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0062.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0062.093] lstrlenW (lpString="PlugPlay") returned 8 [0062.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0062.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0062.093] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0062.093] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0062.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0062.093] lstrlenW (lpString="Power") returned 5 [0062.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0062.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0062.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0062.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0062.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0062.094] lstrlenW (lpString="ProfSvc") returned 7 [0062.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0062.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0062.094] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0062.094] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0062.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0062.094] lstrlenW (lpString="RpcEptMapper") returned 12 [0062.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0062.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0062.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0062.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0062.094] lstrlenW (lpString="RpcSs") returned 5 [0062.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0062.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0062.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0062.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0062.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0062.094] lstrlenW (lpString="SamSs") returned 5 [0062.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0062.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0062.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0062.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0062.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0062.094] lstrlenW (lpString="Schedule") returned 8 [0062.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0062.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0062.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0062.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0062.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0062.095] lstrlenW (lpString="SENS") returned 4 [0062.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0062.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0062.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0062.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0062.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0062.095] lstrlenW (lpString="ShellHWDetection") returned 16 [0062.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0062.095] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0062.095] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0062.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0062.095] lstrlenW (lpString="Spooler") returned 7 [0062.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0062.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0062.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0062.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0062.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0062.095] lstrlenW (lpString="swprv") returned 5 [0062.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0062.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0062.095] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0062.095] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0062.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0062.095] lstrlenW (lpString="SysMain") returned 7 [0062.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0062.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0062.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0062.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0062.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0062.095] lstrlenW (lpString="Themes") returned 6 [0062.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0062.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0062.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0062.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0062.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0062.096] lstrlenW (lpString="TrkWks") returned 6 [0062.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0062.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0062.096] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0062.096] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0062.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0062.096] lstrlenW (lpString="UxSms") returned 5 [0062.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0062.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0062.096] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0062.096] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0062.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0062.096] lstrlenW (lpString="VSS") returned 3 [0062.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0062.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0062.096] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0062.096] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0062.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0062.096] lstrlenW (lpString="WdiServiceHost") returned 14 [0062.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0062.096] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0062.096] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0062.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0062.097] lstrlenW (lpString="WdiSystemHost") returned 13 [0062.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0062.097] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0062.097] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0062.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0062.097] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0062.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0062.097] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0062.097] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0062.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0062.097] lstrlenW (lpString="Winmgmt") returned 7 [0062.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0062.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0062.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0062.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0062.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0062.097] lstrlenW (lpString="WPDBusEnum") returned 10 [0062.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0062.097] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0062.097] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0062.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0062.097] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x405b530 | out: hHeap=0x8d0000) returned 1 [0062.097] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0062.100] Process32FirstW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0062.100] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0062.101] lstrlenW (lpString="System") returned 6 [0062.101] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0062.101] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0062.101] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0062.101] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0062.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0062.101] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0062.101] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0062.101] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0062.101] lstrlenW (lpString="smss.exe") returned 8 [0062.101] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0062.101] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0062.101] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0062.101] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0062.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0062.102] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0062.102] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0062.102] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.102] lstrlenW (lpString="csrss.exe") returned 9 [0062.102] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0062.102] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0062.102] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0062.102] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0062.102] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0062.102] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0062.103] lstrlenW (lpString="wininit.exe") returned 11 [0062.103] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0062.103] lstrlenW (lpString="csrss.exe") returned 9 [0062.103] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0062.104] lstrlenW (lpString="winlogon.exe") returned 12 [0062.104] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0062.104] lstrlenW (lpString="services.exe") returned 12 [0062.105] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0062.105] lstrlenW (lpString="lsass.exe") returned 9 [0062.105] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0062.106] lstrlenW (lpString="lsm.exe") returned 7 [0062.106] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.106] lstrlenW (lpString="svchost.exe") returned 11 [0062.106] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.107] lstrlenW (lpString="svchost.exe") returned 11 [0062.107] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.107] lstrlenW (lpString="svchost.exe") returned 11 [0062.107] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.108] lstrlenW (lpString="svchost.exe") returned 11 [0062.108] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.108] lstrlenW (lpString="svchost.exe") returned 11 [0062.108] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0062.109] lstrlenW (lpString="audiodg.exe") returned 11 [0062.109] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.109] lstrlenW (lpString="svchost.exe") returned 11 [0062.109] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.110] lstrlenW (lpString="svchost.exe") returned 11 [0062.110] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0062.110] lstrlenW (lpString="dwm.exe") returned 7 [0062.110] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0062.111] lstrlenW (lpString="explorer.exe") returned 12 [0062.111] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0062.111] lstrlenW (lpString="spoolsv.exe") returned 11 [0062.111] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.112] lstrlenW (lpString="taskhost.exe") returned 12 [0062.112] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.112] lstrlenW (lpString="svchost.exe") returned 11 [0062.112] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0062.113] lstrlenW (lpString="taskeng.exe") returned 11 [0062.113] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0062.113] lstrlenW (lpString="taskhost.exe") returned 12 [0062.114] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0062.114] lstrlenW (lpString="tested.exe") returned 10 [0062.114] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0062.115] lstrlenW (lpString="memories global commission.exe") returned 30 [0062.115] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0062.115] lstrlenW (lpString="destination.exe") returned 15 [0062.115] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0062.116] lstrlenW (lpString="rom.exe") returned 7 [0062.116] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0062.116] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0062.116] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0062.117] lstrlenW (lpString="appropriate worm.exe") returned 20 [0062.117] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0062.117] lstrlenW (lpString="arrival-testing.exe") returned 19 [0062.117] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0062.118] lstrlenW (lpString="san stories panels.exe") returned 22 [0062.118] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0062.118] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0062.118] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0062.119] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0062.119] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0062.119] lstrlenW (lpString="taught opt practice.exe") returned 23 [0062.119] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0062.120] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0062.120] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0062.120] lstrlenW (lpString="aka gap.exe") returned 11 [0062.120] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0062.121] lstrlenW (lpString="copied-mr.exe") returned 13 [0062.121] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0062.121] lstrlenW (lpString="proven.exe") returned 10 [0062.121] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0062.122] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0062.122] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0062.122] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0062.122] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0062.123] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0062.123] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0062.123] lstrlenW (lpString="acm.exe") returned 7 [0062.124] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0062.124] lstrlenW (lpString="fluid.exe") returned 9 [0062.124] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0062.125] lstrlenW (lpString="domain.exe") returned 10 [0062.125] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0062.125] lstrlenW (lpString="cult_wanna.exe") returned 14 [0062.125] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0062.126] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0062.126] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.126] lstrlenW (lpString="svchost.exe") returned 11 [0062.126] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0062.127] lstrlenW (lpString="1Black.exe") returned 10 [0062.303] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0062.303] lstrlenW (lpString="cmd.exe") returned 7 [0062.303] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0062.304] lstrlenW (lpString="conhost.exe") returned 11 [0062.304] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0062.304] lstrlenW (lpString="vssadmin.exe") returned 12 [0062.304] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0062.305] lstrlenW (lpString="VSSVC.exe") returned 9 [0062.305] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0062.305] lstrlenW (lpString="svchost.exe") returned 11 [0062.305] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0062.306] CloseHandle (hObject=0x204) returned 1 [0062.306] Sleep (dwMilliseconds=0x1f4) [0063.251] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94ffa8 [0063.252] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0063.252] GetLastError () returned 0xea [0063.252] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x133c) returned 0x38406f0 [0063.253] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38406f0, cbBufSize=0x133c, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38406f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0063.254] CloseServiceHandle (hSCObject=0x94ffa8) returned 1 [0063.254] lstrlenW (lpString="Appinfo") returned 7 [0063.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.254] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.254] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.254] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.254] lstrlenW (lpString="AudioSrv") returned 8 [0063.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0063.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0063.254] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0063.254] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0063.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0063.254] lstrlenW (lpString="BFE") returned 3 [0063.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.255] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.255] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.255] lstrlenW (lpString="CryptSvc") returned 8 [0063.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.255] lstrlenW (lpString="CscService") returned 10 [0063.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0063.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0063.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0063.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0063.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0063.255] lstrlenW (lpString="DcomLaunch") returned 10 [0063.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.255] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.255] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.255] lstrlenW (lpString="Dhcp") returned 4 [0063.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.255] lstrlenW (lpString="Dnscache") returned 8 [0063.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.256] lstrlenW (lpString="DPS") returned 3 [0063.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.256] lstrlenW (lpString="eventlog") returned 8 [0063.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0063.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0063.256] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0063.256] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0063.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0063.256] lstrlenW (lpString="EventSystem") returned 11 [0063.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.256] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.256] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.256] lstrlenW (lpString="FontCache") returned 9 [0063.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0063.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0063.256] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0063.256] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0063.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0063.256] lstrlenW (lpString="gpsvc") returned 5 [0063.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.256] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.256] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.257] lstrlenW (lpString="iphlpsvc") returned 8 [0063.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.257] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.257] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.257] lstrlenW (lpString="LanmanServer") returned 12 [0063.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.257] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.257] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.257] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.257] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.257] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.257] lstrlenW (lpString="lmhosts") returned 7 [0063.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.257] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.257] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.257] lstrlenW (lpString="MMCSS") returned 5 [0063.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0063.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0063.257] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0063.257] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0063.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0063.257] lstrlenW (lpString="MpsSvc") returned 6 [0063.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.258] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.258] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.258] lstrlenW (lpString="Netman") returned 6 [0063.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0063.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0063.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0063.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0063.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0063.258] lstrlenW (lpString="netprofm") returned 8 [0063.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.258] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.258] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.258] lstrlenW (lpString="NlaSvc") returned 6 [0063.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.258] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.258] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.258] lstrlenW (lpString="nsi") returned 3 [0063.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.258] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.258] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.258] lstrlenW (lpString="PcaSvc") returned 6 [0063.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.258] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.259] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.259] lstrlenW (lpString="PlugPlay") returned 8 [0063.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.259] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.259] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.259] lstrlenW (lpString="Power") returned 5 [0063.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.259] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.259] lstrlenW (lpString="ProfSvc") returned 7 [0063.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.259] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.259] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.259] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.259] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.259] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.259] lstrlenW (lpString="RpcSs") returned 5 [0063.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.259] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.259] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.259] lstrlenW (lpString="SamSs") returned 5 [0063.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.260] lstrlenW (lpString="Schedule") returned 8 [0063.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.260] lstrlenW (lpString="SENS") returned 4 [0063.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.260] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.260] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.260] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.260] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.260] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.260] lstrlenW (lpString="Spooler") returned 7 [0063.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.260] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.260] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.260] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.260] lstrlenW (lpString="swprv") returned 5 [0063.260] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0063.260] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0063.261] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0063.261] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0063.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0063.261] lstrlenW (lpString="SysMain") returned 7 [0063.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.261] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.261] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0063.261] lstrlenW (lpString="Themes") returned 6 [0063.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0063.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0063.261] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0063.261] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0063.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0063.261] lstrlenW (lpString="TrkWks") returned 6 [0063.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0063.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0063.261] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0063.261] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0063.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0063.261] lstrlenW (lpString="UxSms") returned 5 [0063.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0063.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0063.261] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0063.261] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0063.261] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0063.261] lstrlenW (lpString="VSS") returned 3 [0063.261] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0063.261] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0063.261] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0063.261] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0063.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0063.262] lstrlenW (lpString="WdiServiceHost") returned 14 [0063.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.262] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0063.262] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0063.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0063.262] lstrlenW (lpString="WdiSystemHost") returned 13 [0063.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.262] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0063.262] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0063.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0063.262] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0063.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.262] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0063.262] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0063.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0063.262] lstrlenW (lpString="Winmgmt") returned 7 [0063.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0063.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0063.262] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0063.262] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0063.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0063.262] lstrlenW (lpString="WPDBusEnum") returned 10 [0063.262] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.262] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.262] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0063.262] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0063.262] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0063.262] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38406f0 | out: hHeap=0x8d0000) returned 1 [0063.263] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0063.265] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0063.265] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0063.266] lstrlenW (lpString="System") returned 6 [0063.266] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0063.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0063.266] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0063.266] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0063.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0063.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0063.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0063.266] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0063.267] lstrlenW (lpString="smss.exe") returned 8 [0063.267] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0063.267] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0063.267] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0063.267] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0063.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0063.267] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0063.267] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0063.267] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.268] lstrlenW (lpString="csrss.exe") returned 9 [0063.268] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0063.268] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0063.268] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0063.268] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0063.268] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0063.268] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0063.268] lstrlenW (lpString="wininit.exe") returned 11 [0063.268] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0063.269] lstrlenW (lpString="csrss.exe") returned 9 [0063.269] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0063.269] lstrlenW (lpString="winlogon.exe") returned 12 [0063.270] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0063.270] lstrlenW (lpString="services.exe") returned 12 [0063.270] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0063.271] lstrlenW (lpString="lsass.exe") returned 9 [0063.271] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0063.271] lstrlenW (lpString="lsm.exe") returned 7 [0063.271] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.272] lstrlenW (lpString="svchost.exe") returned 11 [0063.272] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.272] lstrlenW (lpString="svchost.exe") returned 11 [0063.272] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.273] lstrlenW (lpString="svchost.exe") returned 11 [0063.273] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.273] lstrlenW (lpString="svchost.exe") returned 11 [0063.273] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.274] lstrlenW (lpString="svchost.exe") returned 11 [0063.274] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0063.274] lstrlenW (lpString="audiodg.exe") returned 11 [0063.274] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.275] lstrlenW (lpString="svchost.exe") returned 11 [0063.275] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.275] lstrlenW (lpString="svchost.exe") returned 11 [0063.275] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0063.276] lstrlenW (lpString="dwm.exe") returned 7 [0063.276] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0063.276] lstrlenW (lpString="explorer.exe") returned 12 [0063.276] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0063.277] lstrlenW (lpString="spoolsv.exe") returned 11 [0063.277] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.277] lstrlenW (lpString="taskhost.exe") returned 12 [0063.277] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.278] lstrlenW (lpString="svchost.exe") returned 11 [0063.278] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0063.278] lstrlenW (lpString="taskeng.exe") returned 11 [0063.278] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0063.279] lstrlenW (lpString="taskhost.exe") returned 12 [0063.279] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0063.279] lstrlenW (lpString="tested.exe") returned 10 [0063.279] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0063.280] lstrlenW (lpString="memories global commission.exe") returned 30 [0063.280] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0063.280] lstrlenW (lpString="destination.exe") returned 15 [0063.281] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0063.281] lstrlenW (lpString="rom.exe") returned 7 [0063.281] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0063.282] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0063.282] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0063.282] lstrlenW (lpString="appropriate worm.exe") returned 20 [0063.282] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0063.283] lstrlenW (lpString="arrival-testing.exe") returned 19 [0063.283] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0063.283] lstrlenW (lpString="san stories panels.exe") returned 22 [0063.283] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0063.284] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0063.284] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0063.284] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0063.284] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0063.285] lstrlenW (lpString="taught opt practice.exe") returned 23 [0063.285] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0063.285] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0063.285] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0063.286] lstrlenW (lpString="aka gap.exe") returned 11 [0063.286] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0063.286] lstrlenW (lpString="copied-mr.exe") returned 13 [0063.286] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0063.287] lstrlenW (lpString="proven.exe") returned 10 [0063.287] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0063.287] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0063.287] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0063.288] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0063.288] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0063.288] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0063.288] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0063.289] lstrlenW (lpString="acm.exe") returned 7 [0063.289] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0063.289] lstrlenW (lpString="fluid.exe") returned 9 [0063.290] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0063.290] lstrlenW (lpString="domain.exe") returned 10 [0063.290] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0063.290] lstrlenW (lpString="cult_wanna.exe") returned 14 [0063.291] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0063.291] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0063.291] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.292] lstrlenW (lpString="svchost.exe") returned 11 [0063.292] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0063.292] lstrlenW (lpString="1Black.exe") returned 10 [0063.292] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0063.293] lstrlenW (lpString="cmd.exe") returned 7 [0063.293] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0063.293] lstrlenW (lpString="conhost.exe") returned 11 [0063.293] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0063.294] lstrlenW (lpString="vssadmin.exe") returned 12 [0063.294] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0063.294] lstrlenW (lpString="VSSVC.exe") returned 9 [0063.294] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0063.295] lstrlenW (lpString="svchost.exe") returned 11 [0063.295] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0063.295] CloseHandle (hObject=0x1e4) returned 1 [0063.295] Sleep (dwMilliseconds=0x1f4) [0063.988] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94ffa8 [0063.988] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0063.988] GetLastError () returned 0xea [0063.988] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x133c) returned 0x38406f0 [0063.988] EnumServicesStatusExW (in: hSCManager=0x94ffa8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38406f0, cbBufSize=0x133c, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38406f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0063.989] CloseServiceHandle (hSCObject=0x94ffa8) returned 1 [0063.989] lstrlenW (lpString="Appinfo") returned 7 [0063.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0063.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0063.989] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0063.989] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0063.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0063.989] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0063.989] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.989] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0063.989] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0063.989] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0063.989] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0063.989] lstrlenW (lpString="AudioSrv") returned 8 [0063.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0063.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0063.990] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0063.990] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0063.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0063.990] lstrlenW (lpString="BFE") returned 3 [0063.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0063.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0063.990] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0063.990] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0063.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0063.990] lstrlenW (lpString="CryptSvc") returned 8 [0063.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0063.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0063.990] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0063.990] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0063.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0063.990] lstrlenW (lpString="CscService") returned 10 [0063.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0063.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0063.990] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0063.990] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0063.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0063.990] lstrlenW (lpString="DcomLaunch") returned 10 [0063.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0063.990] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0063.990] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0063.990] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0063.990] lstrlenW (lpString="Dhcp") returned 4 [0063.990] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0063.990] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0063.990] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0063.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0063.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0063.991] lstrlenW (lpString="Dnscache") returned 8 [0063.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0063.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0063.991] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0063.991] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0063.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0063.991] lstrlenW (lpString="DPS") returned 3 [0063.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0063.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0063.991] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0063.991] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0063.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0063.991] lstrlenW (lpString="eventlog") returned 8 [0063.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0063.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0063.991] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0063.991] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0063.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0063.991] lstrlenW (lpString="EventSystem") returned 11 [0063.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0063.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0063.991] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0063.991] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0063.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0063.991] lstrlenW (lpString="FontCache") returned 9 [0063.991] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0063.991] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0063.991] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0063.991] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0063.991] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0063.991] lstrlenW (lpString="gpsvc") returned 5 [0063.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0063.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0063.992] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0063.992] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0063.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0063.992] lstrlenW (lpString="iphlpsvc") returned 8 [0063.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0063.992] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0063.992] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0063.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0063.992] lstrlenW (lpString="LanmanServer") returned 12 [0063.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0063.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0063.992] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0063.992] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0063.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0063.992] lstrlenW (lpString="LanmanWorkstation") returned 17 [0063.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0063.992] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0063.992] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0063.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0063.992] lstrlenW (lpString="lmhosts") returned 7 [0063.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0063.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0063.992] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0063.992] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0063.992] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0063.992] lstrlenW (lpString="MMCSS") returned 5 [0063.992] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0063.992] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0063.992] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0063.992] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0063.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0063.993] lstrlenW (lpString="MpsSvc") returned 6 [0063.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0063.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0063.993] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0063.993] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0063.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0063.993] lstrlenW (lpString="Netman") returned 6 [0063.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0063.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0063.993] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0063.993] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0063.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0063.993] lstrlenW (lpString="netprofm") returned 8 [0063.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0063.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0063.993] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0063.993] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0063.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0063.993] lstrlenW (lpString="NlaSvc") returned 6 [0063.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0063.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0063.993] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0063.993] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0063.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0063.993] lstrlenW (lpString="nsi") returned 3 [0063.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0063.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0063.993] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0063.993] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0063.993] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0063.993] lstrlenW (lpString="PcaSvc") returned 6 [0063.993] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0063.993] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0063.994] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0063.994] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0063.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0063.994] lstrlenW (lpString="PlugPlay") returned 8 [0063.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0063.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0063.994] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0063.994] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0063.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0063.994] lstrlenW (lpString="Power") returned 5 [0063.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0063.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0063.994] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0063.994] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0063.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0063.994] lstrlenW (lpString="ProfSvc") returned 7 [0063.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0063.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0063.994] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0063.994] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0063.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0063.994] lstrlenW (lpString="RpcEptMapper") returned 12 [0063.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0063.994] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0063.994] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0063.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0063.994] lstrlenW (lpString="RpcSs") returned 5 [0063.994] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0063.994] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0063.994] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0063.994] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0063.994] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0063.994] lstrlenW (lpString="SamSs") returned 5 [0063.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0063.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0063.995] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0063.995] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0063.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0063.995] lstrlenW (lpString="Schedule") returned 8 [0063.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0063.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0063.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0063.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0063.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0063.995] lstrlenW (lpString="SENS") returned 4 [0063.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0063.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0063.995] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0063.995] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0063.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0063.995] lstrlenW (lpString="ShellHWDetection") returned 16 [0063.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0063.995] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0063.995] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0063.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0063.995] lstrlenW (lpString="Spooler") returned 7 [0063.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0063.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0063.995] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0063.995] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0063.995] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0063.995] lstrlenW (lpString="swprv") returned 5 [0063.995] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0063.995] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0063.995] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0063.996] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0063.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0063.996] lstrlenW (lpString="SysMain") returned 7 [0063.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0063.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0063.996] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0063.996] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0063.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0063.996] lstrlenW (lpString="Themes") returned 6 [0063.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0063.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0063.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0063.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0063.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0063.996] lstrlenW (lpString="TrkWks") returned 6 [0063.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0063.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0063.996] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0063.996] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0063.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0063.996] lstrlenW (lpString="UxSms") returned 5 [0063.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0063.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0063.996] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0063.996] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0063.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0063.996] lstrlenW (lpString="VSS") returned 3 [0063.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0063.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0063.996] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0063.996] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0063.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0063.996] lstrlenW (lpString="WdiServiceHost") returned 14 [0063.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0063.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0063.997] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0063.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0063.997] lstrlenW (lpString="WdiSystemHost") returned 13 [0063.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0063.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0063.997] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0063.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0063.997] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0063.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0063.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0063.997] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0063.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0063.997] lstrlenW (lpString="Winmgmt") returned 7 [0063.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0063.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0063.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0063.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0063.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0063.997] lstrlenW (lpString="WPDBusEnum") returned 10 [0063.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0063.997] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0063.997] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0063.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0063.997] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38406f0 | out: hHeap=0x8d0000) returned 1 [0063.997] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0064.000] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.001] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0064.001] lstrlenW (lpString="System") returned 6 [0064.001] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0064.001] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0064.001] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0064.001] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0064.001] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0064.001] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0064.001] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0064.001] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0064.002] lstrlenW (lpString="smss.exe") returned 8 [0064.002] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0064.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0064.002] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0064.002] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0064.002] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0064.002] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0064.002] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0064.002] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.002] lstrlenW (lpString="csrss.exe") returned 9 [0064.002] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0064.002] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0064.002] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0064.003] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0064.003] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0064.003] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0064.003] lstrlenW (lpString="wininit.exe") returned 11 [0064.003] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.004] lstrlenW (lpString="csrss.exe") returned 9 [0064.004] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0064.004] lstrlenW (lpString="winlogon.exe") returned 12 [0064.004] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0064.005] lstrlenW (lpString="services.exe") returned 12 [0064.005] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0064.005] lstrlenW (lpString="lsass.exe") returned 9 [0064.005] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0064.006] lstrlenW (lpString="lsm.exe") returned 7 [0064.006] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.006] lstrlenW (lpString="svchost.exe") returned 11 [0064.006] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.007] lstrlenW (lpString="svchost.exe") returned 11 [0064.007] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.007] lstrlenW (lpString="svchost.exe") returned 11 [0064.007] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.008] lstrlenW (lpString="svchost.exe") returned 11 [0064.008] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.008] lstrlenW (lpString="svchost.exe") returned 11 [0064.008] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.009] lstrlenW (lpString="audiodg.exe") returned 11 [0064.009] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.009] lstrlenW (lpString="svchost.exe") returned 11 [0064.009] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.010] lstrlenW (lpString="svchost.exe") returned 11 [0064.010] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.010] lstrlenW (lpString="dwm.exe") returned 7 [0064.010] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.011] lstrlenW (lpString="explorer.exe") returned 12 [0064.011] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.011] lstrlenW (lpString="spoolsv.exe") returned 11 [0064.011] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.012] lstrlenW (lpString="taskhost.exe") returned 12 [0064.012] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.012] lstrlenW (lpString="svchost.exe") returned 11 [0064.012] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0064.013] lstrlenW (lpString="taskeng.exe") returned 11 [0064.013] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.013] lstrlenW (lpString="taskhost.exe") returned 12 [0064.013] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0064.014] lstrlenW (lpString="tested.exe") returned 10 [0064.014] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0064.014] lstrlenW (lpString="memories global commission.exe") returned 30 [0064.015] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0064.015] lstrlenW (lpString="destination.exe") returned 15 [0064.015] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0064.015] lstrlenW (lpString="rom.exe") returned 7 [0064.016] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0064.016] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0064.016] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0064.017] lstrlenW (lpString="appropriate worm.exe") returned 20 [0064.017] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0064.017] lstrlenW (lpString="arrival-testing.exe") returned 19 [0064.017] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0064.018] lstrlenW (lpString="san stories panels.exe") returned 22 [0064.018] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0064.018] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0064.018] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0064.019] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0064.019] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0064.019] lstrlenW (lpString="taught opt practice.exe") returned 23 [0064.019] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0064.020] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0064.020] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0064.020] lstrlenW (lpString="aka gap.exe") returned 11 [0064.020] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0064.021] lstrlenW (lpString="copied-mr.exe") returned 13 [0064.021] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0064.021] lstrlenW (lpString="proven.exe") returned 10 [0064.021] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0064.022] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0064.022] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0064.022] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0064.022] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0064.023] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0064.023] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0064.023] lstrlenW (lpString="acm.exe") returned 7 [0064.023] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0064.024] lstrlenW (lpString="fluid.exe") returned 9 [0064.024] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0064.025] lstrlenW (lpString="domain.exe") returned 10 [0064.025] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0064.025] lstrlenW (lpString="cult_wanna.exe") returned 14 [0064.025] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.026] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.026] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.026] lstrlenW (lpString="svchost.exe") returned 11 [0064.026] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0064.027] lstrlenW (lpString="1Black.exe") returned 10 [0064.027] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.027] lstrlenW (lpString="cmd.exe") returned 7 [0064.027] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.028] lstrlenW (lpString="conhost.exe") returned 11 [0064.028] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0064.028] lstrlenW (lpString="vssadmin.exe") returned 12 [0064.028] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0064.029] lstrlenW (lpString="VSSVC.exe") returned 9 [0064.029] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.029] lstrlenW (lpString="svchost.exe") returned 11 [0064.029] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0064.030] CloseHandle (hObject=0x1d8) returned 1 [0064.109] Sleep (dwMilliseconds=0x1f4) [0064.789] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x950070 [0064.790] EnumServicesStatusExW (in: hSCManager=0x950070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0064.790] GetLastError () returned 0xea [0064.790] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x133c) returned 0x3fb54b8 [0064.790] EnumServicesStatusExW (in: hSCManager=0x950070, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fb54b8, cbBufSize=0x133c, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fb54b8, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0064.791] CloseServiceHandle (hSCObject=0x950070) returned 1 [0064.791] lstrlenW (lpString="Appinfo") returned 7 [0064.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0064.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0064.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0064.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0064.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0064.791] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0064.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0064.791] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0064.791] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0064.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0064.791] lstrlenW (lpString="AudioSrv") returned 8 [0064.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0064.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0064.791] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0064.791] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0064.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0064.791] lstrlenW (lpString="BFE") returned 3 [0064.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0064.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0064.792] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0064.792] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0064.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0064.792] lstrlenW (lpString="CryptSvc") returned 8 [0064.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0064.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0064.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0064.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0064.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0064.792] lstrlenW (lpString="CscService") returned 10 [0064.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0064.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0064.792] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0064.792] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0064.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0064.792] lstrlenW (lpString="DcomLaunch") returned 10 [0064.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0064.792] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0064.792] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0064.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0064.792] lstrlenW (lpString="Dhcp") returned 4 [0064.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0064.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0064.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0064.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0064.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0064.792] lstrlenW (lpString="Dnscache") returned 8 [0064.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0064.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0064.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0064.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0064.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0064.793] lstrlenW (lpString="DPS") returned 3 [0064.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0064.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0064.793] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0064.793] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0064.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0064.793] lstrlenW (lpString="eventlog") returned 8 [0064.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0064.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0064.793] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0064.793] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0064.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0064.793] lstrlenW (lpString="EventSystem") returned 11 [0064.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0064.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0064.793] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0064.793] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0064.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0064.793] lstrlenW (lpString="FontCache") returned 9 [0064.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0064.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0064.793] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0064.793] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0064.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0064.794] lstrlenW (lpString="gpsvc") returned 5 [0064.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0064.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0064.794] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0064.794] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0064.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0064.794] lstrlenW (lpString="iphlpsvc") returned 8 [0064.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0064.794] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0064.794] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0064.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0064.794] lstrlenW (lpString="LanmanServer") returned 12 [0064.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0064.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0064.794] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0064.794] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0064.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0064.794] lstrlenW (lpString="LanmanWorkstation") returned 17 [0064.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0064.794] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0064.794] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0064.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0064.794] lstrlenW (lpString="lmhosts") returned 7 [0064.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0064.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0064.795] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0064.795] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0064.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0064.795] lstrlenW (lpString="MMCSS") returned 5 [0064.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0064.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0064.795] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0064.795] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0064.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0064.795] lstrlenW (lpString="MpsSvc") returned 6 [0064.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0064.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0064.795] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0064.795] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0064.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0064.795] lstrlenW (lpString="Netman") returned 6 [0064.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0064.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0064.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0064.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0064.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0064.795] lstrlenW (lpString="netprofm") returned 8 [0064.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0064.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0064.795] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0064.795] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0064.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0064.795] lstrlenW (lpString="NlaSvc") returned 6 [0064.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0064.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0064.796] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0064.796] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0064.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0064.796] lstrlenW (lpString="nsi") returned 3 [0064.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0064.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0064.796] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0064.796] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0064.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0064.796] lstrlenW (lpString="PcaSvc") returned 6 [0064.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0064.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0064.796] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0064.796] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0064.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0064.796] lstrlenW (lpString="PlugPlay") returned 8 [0064.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0064.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0064.796] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0064.796] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0064.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0064.796] lstrlenW (lpString="Power") returned 5 [0064.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0064.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0064.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0064.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0064.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0064.796] lstrlenW (lpString="ProfSvc") returned 7 [0064.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0064.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0064.797] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0064.797] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0064.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0064.797] lstrlenW (lpString="RpcEptMapper") returned 12 [0064.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0064.797] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0064.797] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0064.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0064.797] lstrlenW (lpString="RpcSs") returned 5 [0064.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0064.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0064.797] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0064.797] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0064.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0064.797] lstrlenW (lpString="SamSs") returned 5 [0064.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0064.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0064.797] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0064.797] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0064.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0064.797] lstrlenW (lpString="Schedule") returned 8 [0064.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0064.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0064.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0064.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0064.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0064.798] lstrlenW (lpString="SENS") returned 4 [0064.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0064.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0064.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0064.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0064.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0064.798] lstrlenW (lpString="ShellHWDetection") returned 16 [0064.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0064.798] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0064.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0064.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0064.798] lstrlenW (lpString="Spooler") returned 7 [0064.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0064.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0064.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0064.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0064.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0064.798] lstrlenW (lpString="swprv") returned 5 [0064.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0064.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0064.798] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0064.798] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0064.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0064.798] lstrlenW (lpString="SysMain") returned 7 [0064.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0064.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0064.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0064.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0064.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0064.799] lstrlenW (lpString="Themes") returned 6 [0064.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0064.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0064.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0064.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0064.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0064.799] lstrlenW (lpString="TrkWks") returned 6 [0064.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0064.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0064.799] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0064.799] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0064.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0064.799] lstrlenW (lpString="UxSms") returned 5 [0064.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0064.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0064.799] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0064.799] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0064.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0064.799] lstrlenW (lpString="VSS") returned 3 [0064.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0064.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0064.799] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0064.799] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0064.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0064.799] lstrlenW (lpString="WdiServiceHost") returned 14 [0064.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0064.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0064.799] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0064.799] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0064.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0064.800] lstrlenW (lpString="WdiSystemHost") returned 13 [0064.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0064.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0064.800] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0064.800] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0064.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0064.800] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0064.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0064.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0064.800] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0064.800] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0064.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0064.800] lstrlenW (lpString="Winmgmt") returned 7 [0064.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0064.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0064.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0064.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0064.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0064.800] lstrlenW (lpString="WPDBusEnum") returned 10 [0064.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0064.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0064.800] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0064.800] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0064.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0064.800] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54b8 | out: hHeap=0x8d0000) returned 1 [0064.800] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x174 [0064.803] Process32FirstW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0064.803] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0064.804] lstrlenW (lpString="System") returned 6 [0064.804] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0064.804] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0064.804] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0064.804] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0064.804] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0064.804] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0064.804] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0064.804] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0064.804] lstrlenW (lpString="smss.exe") returned 8 [0064.804] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0064.804] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0064.804] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0064.804] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0064.804] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0064.805] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0064.805] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0064.805] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.805] lstrlenW (lpString="csrss.exe") returned 9 [0064.805] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0064.805] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0064.805] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0064.805] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0064.805] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0064.805] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0064.806] lstrlenW (lpString="wininit.exe") returned 11 [0064.806] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0064.807] lstrlenW (lpString="csrss.exe") returned 9 [0064.807] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0064.807] lstrlenW (lpString="winlogon.exe") returned 12 [0064.807] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0064.808] lstrlenW (lpString="services.exe") returned 12 [0064.808] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0064.808] lstrlenW (lpString="lsass.exe") returned 9 [0064.808] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0064.809] lstrlenW (lpString="lsm.exe") returned 7 [0064.809] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.809] lstrlenW (lpString="svchost.exe") returned 11 [0064.809] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.810] lstrlenW (lpString="svchost.exe") returned 11 [0064.810] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.815] lstrlenW (lpString="svchost.exe") returned 11 [0064.815] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.816] lstrlenW (lpString="svchost.exe") returned 11 [0064.816] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.816] lstrlenW (lpString="svchost.exe") returned 11 [0064.816] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0064.817] lstrlenW (lpString="audiodg.exe") returned 11 [0064.817] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.817] lstrlenW (lpString="svchost.exe") returned 11 [0064.817] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.818] lstrlenW (lpString="svchost.exe") returned 11 [0064.818] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0064.818] lstrlenW (lpString="dwm.exe") returned 7 [0064.818] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0064.819] lstrlenW (lpString="explorer.exe") returned 12 [0064.819] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0064.819] lstrlenW (lpString="spoolsv.exe") returned 11 [0064.819] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.820] lstrlenW (lpString="taskhost.exe") returned 12 [0064.820] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.820] lstrlenW (lpString="svchost.exe") returned 11 [0064.821] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0064.821] lstrlenW (lpString="taskeng.exe") returned 11 [0064.821] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0064.821] lstrlenW (lpString="taskhost.exe") returned 12 [0064.822] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0064.822] lstrlenW (lpString="tested.exe") returned 10 [0064.822] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0064.823] lstrlenW (lpString="memories global commission.exe") returned 30 [0064.823] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0064.823] lstrlenW (lpString="destination.exe") returned 15 [0064.823] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0064.824] lstrlenW (lpString="rom.exe") returned 7 [0064.824] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0064.824] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0064.824] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0064.825] lstrlenW (lpString="appropriate worm.exe") returned 20 [0064.825] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0064.825] lstrlenW (lpString="arrival-testing.exe") returned 19 [0064.825] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0064.826] lstrlenW (lpString="san stories panels.exe") returned 22 [0064.826] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0064.826] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0064.826] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0064.977] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0064.977] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0064.977] lstrlenW (lpString="taught opt practice.exe") returned 23 [0064.977] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0064.978] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0064.978] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0064.979] lstrlenW (lpString="aka gap.exe") returned 11 [0064.979] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0064.979] lstrlenW (lpString="copied-mr.exe") returned 13 [0064.979] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0064.980] lstrlenW (lpString="proven.exe") returned 10 [0064.980] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0064.980] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0064.980] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0064.981] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0064.981] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0064.981] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0064.981] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0064.982] lstrlenW (lpString="acm.exe") returned 7 [0064.982] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0064.982] lstrlenW (lpString="fluid.exe") returned 9 [0064.982] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0064.983] lstrlenW (lpString="domain.exe") returned 10 [0064.983] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0064.983] lstrlenW (lpString="cult_wanna.exe") returned 14 [0064.983] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0064.984] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0064.984] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.984] lstrlenW (lpString="svchost.exe") returned 11 [0064.985] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0064.985] lstrlenW (lpString="1Black.exe") returned 10 [0064.985] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0064.986] lstrlenW (lpString="cmd.exe") returned 7 [0064.986] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0064.986] lstrlenW (lpString="conhost.exe") returned 11 [0064.986] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0064.987] lstrlenW (lpString="vssadmin.exe") returned 12 [0064.987] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0064.987] lstrlenW (lpString="VSSVC.exe") returned 9 [0064.987] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0064.988] lstrlenW (lpString="svchost.exe") returned 11 [0064.988] Process32NextW (in: hSnapshot=0x174, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0064.988] CloseHandle (hObject=0x174) returned 1 [0064.988] Sleep (dwMilliseconds=0x1f4) [0066.184] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94fe18 [0066.185] EnumServicesStatusExW (in: hSCManager=0x94fe18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0066.185] GetLastError () returned 0xea [0066.185] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x133c) returned 0x38406f0 [0066.185] EnumServicesStatusExW (in: hSCManager=0x94fe18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38406f0, cbBufSize=0x133c, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38406f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0066.186] CloseServiceHandle (hSCObject=0x94fe18) returned 1 [0066.186] lstrlenW (lpString="Appinfo") returned 7 [0066.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0066.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0066.186] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0066.186] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0066.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0066.186] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0066.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0066.186] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0066.186] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0066.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0066.186] lstrlenW (lpString="AudioSrv") returned 8 [0066.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0066.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0066.186] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0066.186] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0066.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0066.186] lstrlenW (lpString="BFE") returned 3 [0066.186] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0066.186] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0066.186] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0066.186] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0066.186] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0066.186] lstrlenW (lpString="CryptSvc") returned 8 [0066.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0066.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0066.187] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0066.187] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0066.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0066.187] lstrlenW (lpString="CscService") returned 10 [0066.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0066.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0066.187] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0066.187] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0066.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0066.187] lstrlenW (lpString="DcomLaunch") returned 10 [0066.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0066.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0066.187] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0066.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0066.187] lstrlenW (lpString="Dhcp") returned 4 [0066.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0066.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0066.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0066.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0066.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0066.187] lstrlenW (lpString="Dnscache") returned 8 [0066.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0066.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0066.187] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0066.187] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0066.187] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0066.187] lstrlenW (lpString="DPS") returned 3 [0066.187] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0066.187] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0066.187] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0066.188] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0066.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0066.188] lstrlenW (lpString="eventlog") returned 8 [0066.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0066.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0066.188] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0066.188] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0066.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0066.188] lstrlenW (lpString="EventSystem") returned 11 [0066.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0066.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0066.188] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0066.188] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0066.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0066.188] lstrlenW (lpString="FontCache") returned 9 [0066.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0066.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0066.188] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0066.188] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0066.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0066.188] lstrlenW (lpString="gpsvc") returned 5 [0066.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0066.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0066.188] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0066.188] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0066.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0066.188] lstrlenW (lpString="iphlpsvc") returned 8 [0066.188] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.188] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0066.188] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0066.188] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0066.188] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0066.188] lstrlenW (lpString="LanmanServer") returned 12 [0066.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0066.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0066.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0066.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0066.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0066.189] lstrlenW (lpString="LanmanWorkstation") returned 17 [0066.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0066.189] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0066.189] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0066.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0066.189] lstrlenW (lpString="lmhosts") returned 7 [0066.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0066.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0066.189] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0066.189] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0066.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0066.189] lstrlenW (lpString="MMCSS") returned 5 [0066.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0066.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0066.189] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0066.189] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0066.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0066.189] lstrlenW (lpString="MpsSvc") returned 6 [0066.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0066.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0066.189] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0066.189] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0066.189] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0066.189] lstrlenW (lpString="Netman") returned 6 [0066.189] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0066.189] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0066.189] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0066.190] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0066.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0066.190] lstrlenW (lpString="netprofm") returned 8 [0066.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0066.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0066.190] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0066.190] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0066.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0066.190] lstrlenW (lpString="NlaSvc") returned 6 [0066.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0066.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0066.190] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0066.190] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0066.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0066.190] lstrlenW (lpString="nsi") returned 3 [0066.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0066.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0066.190] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0066.190] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0066.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0066.190] lstrlenW (lpString="PcaSvc") returned 6 [0066.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0066.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0066.190] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0066.190] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0066.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0066.190] lstrlenW (lpString="PlugPlay") returned 8 [0066.190] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0066.190] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0066.190] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0066.190] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0066.190] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0066.190] lstrlenW (lpString="Power") returned 5 [0066.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0066.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0066.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0066.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0066.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0066.191] lstrlenW (lpString="ProfSvc") returned 7 [0066.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0066.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0066.191] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0066.191] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0066.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0066.191] lstrlenW (lpString="RpcEptMapper") returned 12 [0066.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0066.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0066.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0066.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0066.191] lstrlenW (lpString="RpcSs") returned 5 [0066.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0066.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0066.191] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0066.191] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0066.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0066.191] lstrlenW (lpString="SamSs") returned 5 [0066.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0066.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0066.191] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0066.191] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0066.191] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0066.191] lstrlenW (lpString="Schedule") returned 8 [0066.191] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0066.191] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0066.191] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0066.191] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0066.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0066.192] lstrlenW (lpString="SENS") returned 4 [0066.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0066.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0066.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0066.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0066.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0066.192] lstrlenW (lpString="ShellHWDetection") returned 16 [0066.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0066.192] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0066.192] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0066.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0066.192] lstrlenW (lpString="Spooler") returned 7 [0066.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0066.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0066.192] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0066.192] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0066.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0066.192] lstrlenW (lpString="swprv") returned 5 [0066.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0066.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0066.192] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0066.192] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0066.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0066.192] lstrlenW (lpString="SysMain") returned 7 [0066.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0066.192] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0066.192] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0066.192] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0066.192] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0066.192] lstrlenW (lpString="Themes") returned 6 [0066.192] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0066.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0066.193] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0066.193] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0066.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0066.193] lstrlenW (lpString="TrkWks") returned 6 [0066.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0066.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0066.193] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0066.193] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0066.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0066.193] lstrlenW (lpString="UxSms") returned 5 [0066.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0066.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0066.193] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0066.193] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0066.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0066.193] lstrlenW (lpString="VSS") returned 3 [0066.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0066.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0066.193] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0066.193] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0066.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0066.193] lstrlenW (lpString="WdiServiceHost") returned 14 [0066.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0066.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0066.193] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0066.193] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0066.193] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0066.193] lstrlenW (lpString="WdiSystemHost") returned 13 [0066.193] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0066.193] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0066.193] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0066.193] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0066.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0066.194] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0066.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0066.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0066.194] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0066.194] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0066.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0066.194] lstrlenW (lpString="Winmgmt") returned 7 [0066.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0066.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0066.194] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0066.194] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0066.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0066.194] lstrlenW (lpString="WPDBusEnum") returned 10 [0066.194] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0066.194] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0066.194] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0066.194] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0066.194] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0066.194] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38406f0 | out: hHeap=0x8d0000) returned 1 [0066.194] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0066.197] Process32FirstW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0066.197] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0066.198] lstrlenW (lpString="System") returned 6 [0066.198] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0066.198] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0066.198] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0066.198] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0066.198] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0066.198] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0066.198] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0066.198] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0066.199] lstrlenW (lpString="smss.exe") returned 8 [0066.199] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0066.199] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0066.199] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0066.199] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0066.199] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0066.199] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0066.199] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0066.199] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.200] lstrlenW (lpString="csrss.exe") returned 9 [0066.200] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0066.200] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0066.200] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0066.200] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0066.200] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0066.200] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0066.200] lstrlenW (lpString="wininit.exe") returned 11 [0066.200] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0066.201] lstrlenW (lpString="csrss.exe") returned 9 [0066.201] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0066.202] lstrlenW (lpString="winlogon.exe") returned 12 [0066.202] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0066.202] lstrlenW (lpString="services.exe") returned 12 [0066.202] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0066.203] lstrlenW (lpString="lsass.exe") returned 9 [0066.203] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0066.203] lstrlenW (lpString="lsm.exe") returned 7 [0066.203] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.204] lstrlenW (lpString="svchost.exe") returned 11 [0066.204] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.204] lstrlenW (lpString="svchost.exe") returned 11 [0066.204] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.205] lstrlenW (lpString="svchost.exe") returned 11 [0066.205] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.205] lstrlenW (lpString="svchost.exe") returned 11 [0066.205] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.206] lstrlenW (lpString="svchost.exe") returned 11 [0066.206] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0066.206] lstrlenW (lpString="audiodg.exe") returned 11 [0066.206] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.207] lstrlenW (lpString="svchost.exe") returned 11 [0066.207] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.207] lstrlenW (lpString="svchost.exe") returned 11 [0066.207] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0066.208] lstrlenW (lpString="dwm.exe") returned 7 [0066.208] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0066.208] lstrlenW (lpString="explorer.exe") returned 12 [0066.208] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0066.209] lstrlenW (lpString="spoolsv.exe") returned 11 [0066.209] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.209] lstrlenW (lpString="taskhost.exe") returned 12 [0066.209] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.210] lstrlenW (lpString="svchost.exe") returned 11 [0066.210] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0066.210] lstrlenW (lpString="taskeng.exe") returned 11 [0066.210] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0066.211] lstrlenW (lpString="taskhost.exe") returned 12 [0066.211] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0066.211] lstrlenW (lpString="tested.exe") returned 10 [0066.211] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0066.212] lstrlenW (lpString="memories global commission.exe") returned 30 [0066.212] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0066.212] lstrlenW (lpString="destination.exe") returned 15 [0066.213] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0066.213] lstrlenW (lpString="rom.exe") returned 7 [0066.213] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0066.213] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0066.214] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0066.214] lstrlenW (lpString="appropriate worm.exe") returned 20 [0066.214] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0066.215] lstrlenW (lpString="arrival-testing.exe") returned 19 [0066.215] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0066.215] lstrlenW (lpString="san stories panels.exe") returned 22 [0066.215] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0066.216] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0066.216] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0066.216] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0066.216] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0066.217] lstrlenW (lpString="taught opt practice.exe") returned 23 [0066.217] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0066.217] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0066.217] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0066.218] lstrlenW (lpString="aka gap.exe") returned 11 [0066.218] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0066.218] lstrlenW (lpString="copied-mr.exe") returned 13 [0066.218] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0066.219] lstrlenW (lpString="proven.exe") returned 10 [0066.219] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0066.219] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0066.219] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0066.389] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0066.389] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0066.389] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0066.389] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0066.390] lstrlenW (lpString="acm.exe") returned 7 [0066.390] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0066.390] lstrlenW (lpString="fluid.exe") returned 9 [0066.390] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0066.391] lstrlenW (lpString="domain.exe") returned 10 [0066.391] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0066.391] lstrlenW (lpString="cult_wanna.exe") returned 14 [0066.391] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0066.392] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0066.392] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.392] lstrlenW (lpString="svchost.exe") returned 11 [0066.392] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0066.393] lstrlenW (lpString="1Black.exe") returned 10 [0066.393] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0066.394] lstrlenW (lpString="cmd.exe") returned 7 [0066.394] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0066.394] lstrlenW (lpString="conhost.exe") returned 11 [0066.394] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0066.395] lstrlenW (lpString="vssadmin.exe") returned 12 [0066.395] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0066.395] lstrlenW (lpString="VSSVC.exe") returned 9 [0066.395] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0066.396] lstrlenW (lpString="svchost.exe") returned 11 [0066.396] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0066.396] CloseHandle (hObject=0x200) returned 1 [0066.396] Sleep (dwMilliseconds=0x1f4) [0067.359] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94f990 [0067.360] EnumServicesStatusExW (in: hSCManager=0x94f990, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0067.360] GetLastError () returned 0xea [0067.360] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x133c) returned 0x37f06c8 [0067.360] EnumServicesStatusExW (in: hSCManager=0x94f990, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x37f06c8, cbBufSize=0x133c, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x37f06c8, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0067.361] CloseServiceHandle (hSCObject=0x94f990) returned 1 [0067.361] lstrlenW (lpString="Appinfo") returned 7 [0067.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0067.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0067.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0067.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0067.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0067.361] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0067.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0067.361] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0067.361] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0067.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0067.361] lstrlenW (lpString="AudioSrv") returned 8 [0067.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0067.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0067.361] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0067.361] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0067.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0067.361] lstrlenW (lpString="BFE") returned 3 [0067.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0067.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0067.362] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0067.362] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0067.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0067.362] lstrlenW (lpString="CryptSvc") returned 8 [0067.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0067.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0067.362] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0067.362] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0067.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0067.362] lstrlenW (lpString="CscService") returned 10 [0067.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0067.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0067.362] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0067.362] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0067.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0067.362] lstrlenW (lpString="DcomLaunch") returned 10 [0067.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0067.362] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0067.362] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0067.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0067.362] lstrlenW (lpString="Dhcp") returned 4 [0067.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0067.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0067.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0067.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0067.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0067.362] lstrlenW (lpString="Dnscache") returned 8 [0067.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0067.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0067.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0067.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0067.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0067.363] lstrlenW (lpString="DPS") returned 3 [0067.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0067.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0067.363] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0067.363] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0067.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0067.363] lstrlenW (lpString="eventlog") returned 8 [0067.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0067.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0067.363] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0067.363] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0067.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0067.363] lstrlenW (lpString="EventSystem") returned 11 [0067.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0067.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0067.363] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0067.363] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0067.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0067.363] lstrlenW (lpString="FontCache") returned 9 [0067.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0067.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0067.363] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0067.363] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0067.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0067.363] lstrlenW (lpString="gpsvc") returned 5 [0067.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0067.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0067.363] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0067.363] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0067.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0067.364] lstrlenW (lpString="iphlpsvc") returned 8 [0067.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0067.364] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0067.364] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0067.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0067.364] lstrlenW (lpString="LanmanServer") returned 12 [0067.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0067.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0067.364] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0067.364] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0067.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0067.364] lstrlenW (lpString="LanmanWorkstation") returned 17 [0067.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0067.364] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0067.364] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0067.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0067.364] lstrlenW (lpString="lmhosts") returned 7 [0067.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0067.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0067.364] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0067.364] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0067.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0067.364] lstrlenW (lpString="MMCSS") returned 5 [0067.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0067.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0067.364] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0067.364] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0067.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0067.364] lstrlenW (lpString="MpsSvc") returned 6 [0067.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0067.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0067.365] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0067.365] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0067.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0067.365] lstrlenW (lpString="Netman") returned 6 [0067.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0067.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0067.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0067.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0067.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0067.365] lstrlenW (lpString="netprofm") returned 8 [0067.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0067.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0067.365] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0067.365] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0067.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0067.365] lstrlenW (lpString="NlaSvc") returned 6 [0067.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0067.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0067.365] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0067.365] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0067.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0067.365] lstrlenW (lpString="nsi") returned 3 [0067.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0067.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0067.365] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0067.365] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0067.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0067.365] lstrlenW (lpString="PcaSvc") returned 6 [0067.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0067.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0067.365] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0067.365] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0067.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0067.366] lstrlenW (lpString="PlugPlay") returned 8 [0067.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0067.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0067.366] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0067.366] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0067.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0067.366] lstrlenW (lpString="Power") returned 5 [0067.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0067.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0067.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0067.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0067.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0067.366] lstrlenW (lpString="ProfSvc") returned 7 [0067.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0067.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0067.366] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0067.366] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0067.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0067.366] lstrlenW (lpString="RpcEptMapper") returned 12 [0067.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0067.366] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0067.366] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0067.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0067.366] lstrlenW (lpString="RpcSs") returned 5 [0067.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0067.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0067.366] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0067.366] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0067.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0067.366] lstrlenW (lpString="SamSs") returned 5 [0067.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0067.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0067.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0067.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0067.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0067.367] lstrlenW (lpString="Schedule") returned 8 [0067.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0067.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0067.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0067.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0067.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0067.367] lstrlenW (lpString="SENS") returned 4 [0067.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0067.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0067.367] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0067.367] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0067.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0067.367] lstrlenW (lpString="ShellHWDetection") returned 16 [0067.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0067.367] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0067.367] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0067.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0067.367] lstrlenW (lpString="Spooler") returned 7 [0067.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0067.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0067.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0067.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0067.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0067.367] lstrlenW (lpString="swprv") returned 5 [0067.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0067.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0067.367] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0067.368] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0067.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0067.368] lstrlenW (lpString="SysMain") returned 7 [0067.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0067.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0067.368] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0067.368] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0067.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0067.368] lstrlenW (lpString="Themes") returned 6 [0067.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0067.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0067.368] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0067.368] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0067.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0067.368] lstrlenW (lpString="TrkWks") returned 6 [0067.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0067.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0067.368] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0067.368] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0067.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0067.368] lstrlenW (lpString="UxSms") returned 5 [0067.368] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0067.368] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0067.368] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0067.368] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0067.368] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0067.368] lstrlenW (lpString="VSS") returned 3 [0067.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0067.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0067.369] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0067.369] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0067.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0067.369] lstrlenW (lpString="WdiServiceHost") returned 14 [0067.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0067.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0067.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0067.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0067.369] lstrlenW (lpString="WdiSystemHost") returned 13 [0067.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0067.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0067.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0067.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0067.369] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0067.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0067.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0067.369] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0067.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0067.369] lstrlenW (lpString="Winmgmt") returned 7 [0067.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0067.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0067.369] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0067.369] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0067.369] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0067.369] lstrlenW (lpString="WPDBusEnum") returned 10 [0067.369] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.369] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0067.369] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0067.370] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0067.370] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0067.370] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x37f06c8 | out: hHeap=0x8d0000) returned 1 [0067.370] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x224 [0067.374] Process32FirstW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0067.374] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0067.375] lstrlenW (lpString="System") returned 6 [0067.375] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0067.375] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0067.375] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0067.375] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0067.375] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0067.375] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0067.375] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0067.375] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0067.376] lstrlenW (lpString="smss.exe") returned 8 [0067.376] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0067.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0067.376] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0067.376] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0067.376] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0067.376] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0067.376] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0067.376] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.376] lstrlenW (lpString="csrss.exe") returned 9 [0067.376] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0067.376] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0067.377] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0067.377] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0067.377] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0067.377] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0067.377] lstrlenW (lpString="wininit.exe") returned 11 [0067.377] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0067.378] lstrlenW (lpString="csrss.exe") returned 9 [0067.378] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0067.378] lstrlenW (lpString="winlogon.exe") returned 12 [0067.378] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0067.379] lstrlenW (lpString="services.exe") returned 12 [0067.379] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0067.379] lstrlenW (lpString="lsass.exe") returned 9 [0067.379] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0067.380] lstrlenW (lpString="lsm.exe") returned 7 [0067.380] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.380] lstrlenW (lpString="svchost.exe") returned 11 [0067.380] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.381] lstrlenW (lpString="svchost.exe") returned 11 [0067.381] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.382] lstrlenW (lpString="svchost.exe") returned 11 [0067.382] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.382] lstrlenW (lpString="svchost.exe") returned 11 [0067.382] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.383] lstrlenW (lpString="svchost.exe") returned 11 [0067.383] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0067.383] lstrlenW (lpString="audiodg.exe") returned 11 [0067.383] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.384] lstrlenW (lpString="svchost.exe") returned 11 [0067.384] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.384] lstrlenW (lpString="svchost.exe") returned 11 [0067.384] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0067.385] lstrlenW (lpString="dwm.exe") returned 7 [0067.385] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0067.385] lstrlenW (lpString="explorer.exe") returned 12 [0067.385] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0067.386] lstrlenW (lpString="spoolsv.exe") returned 11 [0067.386] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.386] lstrlenW (lpString="taskhost.exe") returned 12 [0067.386] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.387] lstrlenW (lpString="svchost.exe") returned 11 [0067.387] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0067.387] lstrlenW (lpString="taskeng.exe") returned 11 [0067.387] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0067.388] lstrlenW (lpString="taskhost.exe") returned 12 [0067.388] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0067.388] lstrlenW (lpString="tested.exe") returned 10 [0067.388] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0067.389] lstrlenW (lpString="memories global commission.exe") returned 30 [0067.389] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0067.389] lstrlenW (lpString="destination.exe") returned 15 [0067.389] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0067.390] lstrlenW (lpString="rom.exe") returned 7 [0067.390] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0067.390] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0067.390] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0067.487] lstrlenW (lpString="appropriate worm.exe") returned 20 [0067.488] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0067.488] lstrlenW (lpString="arrival-testing.exe") returned 19 [0067.488] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0067.489] lstrlenW (lpString="san stories panels.exe") returned 22 [0067.489] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0067.489] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0067.489] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0067.490] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0067.490] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0067.490] lstrlenW (lpString="taught opt practice.exe") returned 23 [0067.490] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0067.491] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0067.491] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0067.491] lstrlenW (lpString="aka gap.exe") returned 11 [0067.491] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0067.492] lstrlenW (lpString="copied-mr.exe") returned 13 [0067.492] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0067.492] lstrlenW (lpString="proven.exe") returned 10 [0067.492] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0067.493] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0067.493] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0067.494] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0067.494] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0067.494] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0067.494] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0067.495] lstrlenW (lpString="acm.exe") returned 7 [0067.495] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0067.495] lstrlenW (lpString="fluid.exe") returned 9 [0067.495] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0067.496] lstrlenW (lpString="domain.exe") returned 10 [0067.496] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0067.496] lstrlenW (lpString="cult_wanna.exe") returned 14 [0067.496] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0067.497] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0067.497] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.498] lstrlenW (lpString="svchost.exe") returned 11 [0067.498] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0067.498] lstrlenW (lpString="1Black.exe") returned 10 [0067.498] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0067.499] lstrlenW (lpString="cmd.exe") returned 7 [0067.499] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0067.499] lstrlenW (lpString="conhost.exe") returned 11 [0067.499] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0067.500] lstrlenW (lpString="vssadmin.exe") returned 12 [0067.500] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0067.500] lstrlenW (lpString="VSSVC.exe") returned 9 [0067.500] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0067.501] lstrlenW (lpString="svchost.exe") returned 11 [0067.501] Process32NextW (in: hSnapshot=0x224, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0067.501] CloseHandle (hObject=0x224) returned 1 [0067.501] Sleep (dwMilliseconds=0x1f4) [0068.095] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94feb8 [0068.095] EnumServicesStatusExW (in: hSCManager=0x94feb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0068.095] GetLastError () returned 0xea [0068.095] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x133c) returned 0x38426f0 [0068.096] EnumServicesStatusExW (in: hSCManager=0x94feb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38426f0, cbBufSize=0x133c, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38426f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0068.097] CloseServiceHandle (hSCObject=0x94feb8) returned 1 [0068.097] lstrlenW (lpString="Appinfo") returned 7 [0068.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0068.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0068.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0068.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0068.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0068.097] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0068.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0068.097] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0068.097] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0068.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0068.097] lstrlenW (lpString="AudioSrv") returned 8 [0068.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0068.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0068.097] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0068.097] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0068.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0068.097] lstrlenW (lpString="BFE") returned 3 [0068.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0068.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0068.097] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0068.097] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0068.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0068.097] lstrlenW (lpString="CryptSvc") returned 8 [0068.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0068.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0068.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0068.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0068.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0068.098] lstrlenW (lpString="CscService") returned 10 [0068.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0068.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0068.098] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0068.098] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0068.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0068.098] lstrlenW (lpString="DcomLaunch") returned 10 [0068.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0068.098] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0068.098] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0068.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0068.098] lstrlenW (lpString="Dhcp") returned 4 [0068.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0068.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0068.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0068.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0068.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0068.098] lstrlenW (lpString="Dnscache") returned 8 [0068.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0068.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0068.098] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0068.098] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0068.098] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0068.098] lstrlenW (lpString="DPS") returned 3 [0068.098] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0068.098] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0068.099] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0068.099] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0068.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0068.099] lstrlenW (lpString="eventlog") returned 8 [0068.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0068.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0068.099] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0068.099] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0068.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0068.099] lstrlenW (lpString="EventSystem") returned 11 [0068.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0068.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0068.099] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0068.099] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0068.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0068.099] lstrlenW (lpString="FontCache") returned 9 [0068.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0068.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0068.099] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0068.099] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0068.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0068.099] lstrlenW (lpString="gpsvc") returned 5 [0068.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0068.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0068.099] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0068.099] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0068.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0068.099] lstrlenW (lpString="iphlpsvc") returned 8 [0068.099] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.099] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0068.099] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0068.099] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0068.099] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0068.100] lstrlenW (lpString="LanmanServer") returned 12 [0068.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0068.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0068.100] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0068.100] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0068.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0068.100] lstrlenW (lpString="LanmanWorkstation") returned 17 [0068.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0068.100] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0068.100] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0068.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0068.100] lstrlenW (lpString="lmhosts") returned 7 [0068.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0068.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0068.100] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0068.100] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0068.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0068.100] lstrlenW (lpString="MMCSS") returned 5 [0068.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0068.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0068.100] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0068.100] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0068.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0068.100] lstrlenW (lpString="MpsSvc") returned 6 [0068.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0068.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0068.100] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0068.100] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0068.100] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0068.100] lstrlenW (lpString="Netman") returned 6 [0068.100] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0068.100] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0068.101] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0068.101] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0068.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0068.101] lstrlenW (lpString="netprofm") returned 8 [0068.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0068.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0068.101] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0068.101] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0068.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0068.101] lstrlenW (lpString="NlaSvc") returned 6 [0068.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0068.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0068.101] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0068.101] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0068.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0068.101] lstrlenW (lpString="nsi") returned 3 [0068.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0068.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0068.101] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0068.101] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0068.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0068.101] lstrlenW (lpString="PcaSvc") returned 6 [0068.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0068.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0068.101] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0068.101] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0068.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0068.101] lstrlenW (lpString="PlugPlay") returned 8 [0068.101] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0068.101] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0068.101] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0068.101] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0068.101] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0068.102] lstrlenW (lpString="Power") returned 5 [0068.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0068.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0068.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0068.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0068.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0068.102] lstrlenW (lpString="ProfSvc") returned 7 [0068.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0068.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0068.102] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0068.102] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0068.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0068.102] lstrlenW (lpString="RpcEptMapper") returned 12 [0068.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0068.103] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0068.103] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0068.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0068.103] lstrlenW (lpString="RpcSs") returned 5 [0068.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0068.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0068.103] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0068.103] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0068.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0068.103] lstrlenW (lpString="SamSs") returned 5 [0068.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0068.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0068.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0068.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0068.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0068.103] lstrlenW (lpString="Schedule") returned 8 [0068.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0068.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0068.103] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0068.103] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0068.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0068.103] lstrlenW (lpString="SENS") returned 4 [0068.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0068.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0068.103] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0068.103] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0068.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0068.103] lstrlenW (lpString="ShellHWDetection") returned 16 [0068.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0068.103] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0068.103] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0068.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0068.104] lstrlenW (lpString="Spooler") returned 7 [0068.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0068.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0068.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0068.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0068.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0068.104] lstrlenW (lpString="swprv") returned 5 [0068.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0068.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0068.104] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0068.104] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0068.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0068.104] lstrlenW (lpString="SysMain") returned 7 [0068.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0068.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0068.104] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0068.104] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0068.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0068.104] lstrlenW (lpString="Themes") returned 6 [0068.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0068.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0068.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0068.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0068.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0068.104] lstrlenW (lpString="TrkWks") returned 6 [0068.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0068.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0068.104] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0068.104] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0068.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0068.104] lstrlenW (lpString="UxSms") returned 5 [0068.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0068.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0068.105] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0068.105] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0068.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0068.105] lstrlenW (lpString="VSS") returned 3 [0068.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0068.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0068.105] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0068.105] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0068.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0068.105] lstrlenW (lpString="WdiServiceHost") returned 14 [0068.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0068.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0068.105] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0068.105] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0068.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0068.105] lstrlenW (lpString="WdiSystemHost") returned 13 [0068.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0068.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0068.105] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0068.105] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0068.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0068.105] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0068.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0068.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0068.105] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0068.105] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0068.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0068.105] lstrlenW (lpString="Winmgmt") returned 7 [0068.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0068.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0068.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0068.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0068.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0068.106] lstrlenW (lpString="WPDBusEnum") returned 10 [0068.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0068.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0068.106] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0068.106] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0068.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0068.106] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38426f0 | out: hHeap=0x8d0000) returned 1 [0068.106] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0068.109] Process32FirstW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0068.109] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0068.110] lstrlenW (lpString="System") returned 6 [0068.110] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0068.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0068.110] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0068.110] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0068.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0068.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0068.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0068.110] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0068.110] lstrlenW (lpString="smss.exe") returned 8 [0068.111] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0068.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0068.111] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0068.111] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0068.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0068.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0068.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0068.111] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.111] lstrlenW (lpString="csrss.exe") returned 9 [0068.111] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0068.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0068.111] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0068.111] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0068.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0068.112] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0068.112] lstrlenW (lpString="wininit.exe") returned 11 [0068.112] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0068.113] lstrlenW (lpString="csrss.exe") returned 9 [0068.113] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0068.113] lstrlenW (lpString="winlogon.exe") returned 12 [0068.113] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0068.114] lstrlenW (lpString="services.exe") returned 12 [0068.114] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0068.114] lstrlenW (lpString="lsass.exe") returned 9 [0068.114] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0068.115] lstrlenW (lpString="lsm.exe") returned 7 [0068.115] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.115] lstrlenW (lpString="svchost.exe") returned 11 [0068.115] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.116] lstrlenW (lpString="svchost.exe") returned 11 [0068.116] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.116] lstrlenW (lpString="svchost.exe") returned 11 [0068.116] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.117] lstrlenW (lpString="svchost.exe") returned 11 [0068.117] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.118] lstrlenW (lpString="svchost.exe") returned 11 [0068.118] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0068.118] lstrlenW (lpString="audiodg.exe") returned 11 [0068.118] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.119] lstrlenW (lpString="svchost.exe") returned 11 [0068.119] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.119] lstrlenW (lpString="svchost.exe") returned 11 [0068.119] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0068.120] lstrlenW (lpString="dwm.exe") returned 7 [0068.120] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0068.120] lstrlenW (lpString="explorer.exe") returned 12 [0068.120] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0068.121] lstrlenW (lpString="spoolsv.exe") returned 11 [0068.121] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.121] lstrlenW (lpString="taskhost.exe") returned 12 [0068.121] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.122] lstrlenW (lpString="svchost.exe") returned 11 [0068.122] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0068.122] lstrlenW (lpString="taskeng.exe") returned 11 [0068.122] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0068.123] lstrlenW (lpString="taskhost.exe") returned 12 [0068.123] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0068.123] lstrlenW (lpString="tested.exe") returned 10 [0068.123] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0068.124] lstrlenW (lpString="memories global commission.exe") returned 30 [0068.124] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0068.124] lstrlenW (lpString="destination.exe") returned 15 [0068.124] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0068.125] lstrlenW (lpString="rom.exe") returned 7 [0068.125] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0068.126] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0068.126] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0068.126] lstrlenW (lpString="appropriate worm.exe") returned 20 [0068.126] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0068.127] lstrlenW (lpString="arrival-testing.exe") returned 19 [0068.127] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0068.127] lstrlenW (lpString="san stories panels.exe") returned 22 [0068.127] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0068.128] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0068.128] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0068.128] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0068.128] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0068.129] lstrlenW (lpString="taught opt practice.exe") returned 23 [0068.129] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0068.129] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0068.129] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0068.130] lstrlenW (lpString="aka gap.exe") returned 11 [0068.130] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0068.351] lstrlenW (lpString="copied-mr.exe") returned 13 [0068.351] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0068.352] lstrlenW (lpString="proven.exe") returned 10 [0068.352] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0068.352] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0068.352] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0068.353] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0068.353] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0068.353] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0068.354] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0068.354] lstrlenW (lpString="acm.exe") returned 7 [0068.354] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0068.355] lstrlenW (lpString="fluid.exe") returned 9 [0068.355] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0068.355] lstrlenW (lpString="domain.exe") returned 10 [0068.355] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0068.356] lstrlenW (lpString="cult_wanna.exe") returned 14 [0068.356] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0068.356] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0068.356] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.357] lstrlenW (lpString="svchost.exe") returned 11 [0068.357] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0068.357] lstrlenW (lpString="1Black.exe") returned 10 [0068.357] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0068.358] lstrlenW (lpString="cmd.exe") returned 7 [0068.358] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0068.358] lstrlenW (lpString="conhost.exe") returned 11 [0068.358] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0068.359] lstrlenW (lpString="vssadmin.exe") returned 12 [0068.359] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0068.359] lstrlenW (lpString="VSSVC.exe") returned 9 [0068.359] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0068.360] lstrlenW (lpString="svchost.exe") returned 11 [0068.360] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0068.360] CloseHandle (hObject=0x200) returned 1 [0068.360] Sleep (dwMilliseconds=0x1f4) [0069.303] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94feb8 [0069.303] EnumServicesStatusExW (in: hSCManager=0x94feb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0069.304] GetLastError () returned 0xea [0069.304] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x139e) returned 0x38426f0 [0069.304] EnumServicesStatusExW (in: hSCManager=0x94feb8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38426f0, cbBufSize=0x139e, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38426f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0069.308] CloseServiceHandle (hSCObject=0x94feb8) returned 1 [0069.308] lstrlenW (lpString="Appinfo") returned 7 [0069.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0069.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0069.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0069.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0069.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0069.308] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0069.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0069.308] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0069.308] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0069.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0069.308] lstrlenW (lpString="AudioSrv") returned 8 [0069.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0069.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0069.308] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0069.308] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0069.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0069.308] lstrlenW (lpString="BFE") returned 3 [0069.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0069.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0069.308] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0069.308] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0069.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0069.308] lstrlenW (lpString="CryptSvc") returned 8 [0069.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0069.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0069.309] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0069.309] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0069.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0069.309] lstrlenW (lpString="CscService") returned 10 [0069.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0069.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0069.309] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0069.309] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0069.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0069.309] lstrlenW (lpString="DcomLaunch") returned 10 [0069.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0069.309] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0069.309] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0069.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0069.309] lstrlenW (lpString="Dhcp") returned 4 [0069.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0069.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0069.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0069.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0069.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0069.309] lstrlenW (lpString="Dnscache") returned 8 [0069.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0069.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0069.309] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0069.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0069.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0069.309] lstrlenW (lpString="DPS") returned 3 [0069.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0069.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0069.309] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0069.309] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0069.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0069.310] lstrlenW (lpString="eventlog") returned 8 [0069.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0069.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0069.310] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0069.310] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0069.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0069.310] lstrlenW (lpString="EventSystem") returned 11 [0069.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0069.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0069.310] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0069.310] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0069.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0069.310] lstrlenW (lpString="FontCache") returned 9 [0069.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0069.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0069.310] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0069.310] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0069.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0069.310] lstrlenW (lpString="gpsvc") returned 5 [0069.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0069.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0069.310] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0069.310] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0069.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0069.310] lstrlenW (lpString="iphlpsvc") returned 8 [0069.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0069.310] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0069.310] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0069.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0069.310] lstrlenW (lpString="LanmanServer") returned 12 [0069.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0069.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0069.311] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0069.311] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0069.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0069.311] lstrlenW (lpString="LanmanWorkstation") returned 17 [0069.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0069.311] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0069.311] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0069.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0069.311] lstrlenW (lpString="lmhosts") returned 7 [0069.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0069.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0069.311] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0069.311] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0069.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0069.311] lstrlenW (lpString="MMCSS") returned 5 [0069.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0069.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0069.311] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0069.311] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0069.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0069.311] lstrlenW (lpString="MpsSvc") returned 6 [0069.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0069.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0069.311] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0069.311] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0069.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0069.311] lstrlenW (lpString="Netman") returned 6 [0069.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0069.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0069.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0069.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0069.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0069.312] lstrlenW (lpString="netprofm") returned 8 [0069.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0069.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0069.312] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0069.312] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0069.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0069.312] lstrlenW (lpString="NlaSvc") returned 6 [0069.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0069.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0069.312] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0069.312] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0069.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0069.312] lstrlenW (lpString="nsi") returned 3 [0069.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0069.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0069.312] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0069.312] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0069.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0069.312] lstrlenW (lpString="PcaSvc") returned 6 [0069.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0069.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0069.312] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0069.312] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0069.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0069.312] lstrlenW (lpString="PlugPlay") returned 8 [0069.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0069.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0069.312] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0069.312] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0069.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0069.312] lstrlenW (lpString="Power") returned 5 [0069.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0069.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0069.313] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0069.313] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0069.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0069.313] lstrlenW (lpString="ProfSvc") returned 7 [0069.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0069.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0069.313] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0069.313] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0069.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0069.313] lstrlenW (lpString="RpcEptMapper") returned 12 [0069.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0069.313] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0069.313] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0069.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0069.313] lstrlenW (lpString="RpcSs") returned 5 [0069.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0069.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0069.313] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0069.313] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0069.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0069.313] lstrlenW (lpString="SamSs") returned 5 [0069.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0069.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0069.313] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0069.313] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0069.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0069.313] lstrlenW (lpString="Schedule") returned 8 [0069.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0069.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0069.313] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0069.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0069.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0069.314] lstrlenW (lpString="SENS") returned 4 [0069.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0069.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0069.314] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0069.314] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0069.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0069.314] lstrlenW (lpString="ShellHWDetection") returned 16 [0069.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0069.314] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0069.314] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0069.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0069.314] lstrlenW (lpString="Spooler") returned 7 [0069.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0069.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0069.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0069.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0069.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0069.314] lstrlenW (lpString="sppsvc") returned 6 [0069.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0069.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0069.314] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0069.314] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0069.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0069.314] lstrlenW (lpString="swprv") returned 5 [0069.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0069.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0069.314] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0069.314] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0069.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0069.314] lstrlenW (lpString="SysMain") returned 7 [0069.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0069.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0069.315] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0069.315] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0069.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0069.315] lstrlenW (lpString="Themes") returned 6 [0069.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0069.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0069.315] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0069.315] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0069.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0069.315] lstrlenW (lpString="TrkWks") returned 6 [0069.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0069.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0069.315] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0069.315] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0069.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0069.315] lstrlenW (lpString="UxSms") returned 5 [0069.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0069.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0069.315] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0069.315] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0069.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0069.315] lstrlenW (lpString="VSS") returned 3 [0069.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0069.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0069.315] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0069.315] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0069.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0069.315] lstrlenW (lpString="WdiServiceHost") returned 14 [0069.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0069.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0069.315] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0069.316] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0069.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0069.316] lstrlenW (lpString="WdiSystemHost") returned 13 [0069.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0069.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0069.316] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0069.316] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0069.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0069.316] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0069.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0069.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0069.316] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0069.316] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0069.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0069.316] lstrlenW (lpString="Winmgmt") returned 7 [0069.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0069.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0069.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0069.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0069.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0069.316] lstrlenW (lpString="WPDBusEnum") returned 10 [0069.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0069.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0069.316] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0069.316] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0069.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0069.316] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38426f0 | out: hHeap=0x8d0000) returned 1 [0069.319] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f4 [0069.321] Process32FirstW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0069.322] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0069.322] lstrlenW (lpString="System") returned 6 [0069.322] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0069.322] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0069.322] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0069.322] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0069.322] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0069.322] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0069.322] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0069.322] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0069.323] lstrlenW (lpString="smss.exe") returned 8 [0069.323] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0069.323] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0069.323] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0069.323] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0069.323] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0069.323] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0069.323] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0069.323] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.323] lstrlenW (lpString="csrss.exe") returned 9 [0069.324] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0069.324] lstrlenW (lpString="wininit.exe") returned 11 [0069.324] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0069.325] lstrlenW (lpString="csrss.exe") returned 9 [0069.325] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0069.325] lstrlenW (lpString="winlogon.exe") returned 12 [0069.325] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0069.326] lstrlenW (lpString="services.exe") returned 12 [0069.326] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0069.326] lstrlenW (lpString="lsass.exe") returned 9 [0069.326] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0069.327] lstrlenW (lpString="lsm.exe") returned 7 [0069.327] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.327] lstrlenW (lpString="svchost.exe") returned 11 [0069.327] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.328] lstrlenW (lpString="svchost.exe") returned 11 [0069.328] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.328] lstrlenW (lpString="svchost.exe") returned 11 [0069.328] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.329] lstrlenW (lpString="svchost.exe") returned 11 [0069.329] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.329] lstrlenW (lpString="svchost.exe") returned 11 [0069.329] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0069.330] lstrlenW (lpString="audiodg.exe") returned 11 [0069.330] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.330] lstrlenW (lpString="svchost.exe") returned 11 [0069.331] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.331] lstrlenW (lpString="svchost.exe") returned 11 [0069.331] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0069.332] lstrlenW (lpString="dwm.exe") returned 7 [0069.332] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0069.332] lstrlenW (lpString="explorer.exe") returned 12 [0069.332] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0069.333] lstrlenW (lpString="spoolsv.exe") returned 11 [0069.333] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.333] lstrlenW (lpString="taskhost.exe") returned 12 [0069.333] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.334] lstrlenW (lpString="svchost.exe") returned 11 [0069.334] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0069.334] lstrlenW (lpString="taskeng.exe") returned 11 [0069.334] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0069.335] lstrlenW (lpString="taskhost.exe") returned 12 [0069.335] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0069.335] lstrlenW (lpString="tested.exe") returned 10 [0069.335] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0069.336] lstrlenW (lpString="memories global commission.exe") returned 30 [0069.336] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0069.336] lstrlenW (lpString="destination.exe") returned 15 [0069.336] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0069.337] lstrlenW (lpString="rom.exe") returned 7 [0069.337] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0069.337] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0069.337] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0069.338] lstrlenW (lpString="appropriate worm.exe") returned 20 [0069.338] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0069.338] lstrlenW (lpString="arrival-testing.exe") returned 19 [0069.338] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0069.339] lstrlenW (lpString="san stories panels.exe") returned 22 [0069.339] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0069.339] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0069.339] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0069.363] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0069.363] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0069.363] lstrlenW (lpString="taught opt practice.exe") returned 23 [0069.363] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0069.364] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0069.364] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0069.364] lstrlenW (lpString="aka gap.exe") returned 11 [0069.364] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0069.365] lstrlenW (lpString="copied-mr.exe") returned 13 [0069.365] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0069.365] lstrlenW (lpString="proven.exe") returned 10 [0069.365] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0069.366] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0069.366] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0069.367] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0069.367] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0069.367] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0069.367] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0069.368] lstrlenW (lpString="acm.exe") returned 7 [0069.368] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0069.368] lstrlenW (lpString="fluid.exe") returned 9 [0069.368] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0069.369] lstrlenW (lpString="domain.exe") returned 10 [0069.369] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0069.369] lstrlenW (lpString="cult_wanna.exe") returned 14 [0069.369] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0069.370] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0069.370] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.370] lstrlenW (lpString="svchost.exe") returned 11 [0069.370] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0069.371] lstrlenW (lpString="1Black.exe") returned 10 [0069.371] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0069.371] lstrlenW (lpString="cmd.exe") returned 7 [0069.371] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0069.372] lstrlenW (lpString="conhost.exe") returned 11 [0069.372] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0069.372] lstrlenW (lpString="vssadmin.exe") returned 12 [0069.373] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0069.373] lstrlenW (lpString="VSSVC.exe") returned 9 [0069.373] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0069.374] lstrlenW (lpString="svchost.exe") returned 11 [0069.374] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0069.374] lstrlenW (lpString="sppsvc.exe") returned 10 [0069.374] Process32NextW (in: hSnapshot=0x1f4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0069.375] CloseHandle (hObject=0x1f4) returned 1 [0069.375] Sleep (dwMilliseconds=0x1f4) [0070.083] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x401b618 [0070.084] EnumServicesStatusExW (in: hSCManager=0x401b618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0070.084] GetLastError () returned 0xea [0070.084] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x139e) returned 0x3fd54e0 [0070.084] EnumServicesStatusExW (in: hSCManager=0x401b618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3fd54e0, cbBufSize=0x139e, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3fd54e0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0070.085] CloseServiceHandle (hSCObject=0x401b618) returned 1 [0070.085] lstrlenW (lpString="Appinfo") returned 7 [0070.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0070.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0070.085] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0070.085] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0070.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0070.085] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0070.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0070.085] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0070.085] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0070.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0070.085] lstrlenW (lpString="AudioSrv") returned 8 [0070.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0070.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0070.085] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0070.085] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0070.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0070.085] lstrlenW (lpString="BFE") returned 3 [0070.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0070.085] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0070.085] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0070.085] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0070.085] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0070.085] lstrlenW (lpString="CryptSvc") returned 8 [0070.085] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0070.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0070.086] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0070.086] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0070.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0070.086] lstrlenW (lpString="CscService") returned 10 [0070.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0070.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0070.086] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0070.086] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0070.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0070.086] lstrlenW (lpString="DcomLaunch") returned 10 [0070.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0070.086] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0070.086] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0070.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0070.086] lstrlenW (lpString="Dhcp") returned 4 [0070.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0070.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0070.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0070.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0070.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0070.086] lstrlenW (lpString="Dnscache") returned 8 [0070.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0070.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0070.086] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0070.086] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0070.086] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0070.086] lstrlenW (lpString="DPS") returned 3 [0070.086] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0070.086] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0070.086] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0070.087] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0070.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0070.087] lstrlenW (lpString="eventlog") returned 8 [0070.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0070.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0070.087] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0070.087] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0070.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0070.087] lstrlenW (lpString="EventSystem") returned 11 [0070.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0070.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0070.087] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0070.087] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0070.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0070.087] lstrlenW (lpString="FontCache") returned 9 [0070.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0070.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0070.087] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0070.087] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0070.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0070.087] lstrlenW (lpString="gpsvc") returned 5 [0070.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0070.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0070.087] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0070.087] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0070.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0070.087] lstrlenW (lpString="iphlpsvc") returned 8 [0070.087] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.087] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0070.087] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0070.087] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0070.087] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0070.087] lstrlenW (lpString="LanmanServer") returned 12 [0070.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0070.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0070.088] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0070.088] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0070.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0070.088] lstrlenW (lpString="LanmanWorkstation") returned 17 [0070.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0070.088] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0070.088] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0070.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0070.088] lstrlenW (lpString="lmhosts") returned 7 [0070.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0070.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0070.088] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0070.088] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0070.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0070.088] lstrlenW (lpString="MMCSS") returned 5 [0070.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0070.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0070.088] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0070.088] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0070.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0070.088] lstrlenW (lpString="MpsSvc") returned 6 [0070.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0070.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0070.088] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0070.088] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0070.088] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0070.088] lstrlenW (lpString="Netman") returned 6 [0070.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0070.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0070.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0070.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0070.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0070.089] lstrlenW (lpString="netprofm") returned 8 [0070.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0070.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0070.089] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0070.089] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0070.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0070.089] lstrlenW (lpString="NlaSvc") returned 6 [0070.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0070.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0070.089] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0070.089] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0070.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0070.089] lstrlenW (lpString="nsi") returned 3 [0070.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0070.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0070.089] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0070.089] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0070.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0070.089] lstrlenW (lpString="PcaSvc") returned 6 [0070.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0070.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0070.089] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0070.089] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0070.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0070.089] lstrlenW (lpString="PlugPlay") returned 8 [0070.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0070.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0070.089] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0070.089] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0070.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0070.090] lstrlenW (lpString="Power") returned 5 [0070.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0070.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0070.090] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0070.090] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0070.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0070.090] lstrlenW (lpString="ProfSvc") returned 7 [0070.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0070.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0070.090] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0070.090] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0070.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0070.090] lstrlenW (lpString="RpcEptMapper") returned 12 [0070.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0070.090] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0070.090] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0070.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0070.090] lstrlenW (lpString="RpcSs") returned 5 [0070.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0070.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0070.090] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0070.090] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0070.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0070.090] lstrlenW (lpString="SamSs") returned 5 [0070.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0070.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0070.090] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0070.090] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0070.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0070.090] lstrlenW (lpString="Schedule") returned 8 [0070.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0070.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0070.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0070.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0070.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0070.091] lstrlenW (lpString="SENS") returned 4 [0070.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0070.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0070.091] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0070.091] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0070.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0070.091] lstrlenW (lpString="ShellHWDetection") returned 16 [0070.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0070.091] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0070.091] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0070.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0070.091] lstrlenW (lpString="Spooler") returned 7 [0070.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0070.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0070.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0070.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0070.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0070.091] lstrlenW (lpString="sppsvc") returned 6 [0070.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0070.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0070.091] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0070.091] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0070.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0070.091] lstrlenW (lpString="swprv") returned 5 [0070.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0070.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0070.091] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0070.091] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0070.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0070.092] lstrlenW (lpString="SysMain") returned 7 [0070.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0070.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0070.092] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0070.092] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0070.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0070.092] lstrlenW (lpString="Themes") returned 6 [0070.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0070.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0070.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0070.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0070.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0070.092] lstrlenW (lpString="TrkWks") returned 6 [0070.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0070.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0070.092] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0070.092] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0070.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0070.092] lstrlenW (lpString="UxSms") returned 5 [0070.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0070.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0070.092] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0070.092] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0070.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0070.092] lstrlenW (lpString="VSS") returned 3 [0070.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0070.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0070.092] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0070.092] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0070.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0070.092] lstrlenW (lpString="WdiServiceHost") returned 14 [0070.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0070.093] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0070.093] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0070.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0070.093] lstrlenW (lpString="WdiSystemHost") returned 13 [0070.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0070.093] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0070.093] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0070.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0070.093] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0070.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0070.093] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0070.093] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0070.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0070.093] lstrlenW (lpString="Winmgmt") returned 7 [0070.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0070.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0070.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0070.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0070.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0070.093] lstrlenW (lpString="WPDBusEnum") returned 10 [0070.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0070.093] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0070.093] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0070.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0070.093] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fd54e0 | out: hHeap=0x8d0000) returned 1 [0070.093] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0070.097] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0070.097] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0070.098] lstrlenW (lpString="System") returned 6 [0070.098] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0070.098] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0070.098] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0070.098] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0070.098] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0070.098] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0070.098] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0070.098] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0070.099] lstrlenW (lpString="smss.exe") returned 8 [0070.099] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0070.099] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0070.099] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0070.099] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0070.099] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0070.099] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0070.099] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0070.099] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.099] lstrlenW (lpString="csrss.exe") returned 9 [0070.100] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0070.100] lstrlenW (lpString="wininit.exe") returned 11 [0070.100] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0070.101] lstrlenW (lpString="csrss.exe") returned 9 [0070.101] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0070.101] lstrlenW (lpString="winlogon.exe") returned 12 [0070.101] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0070.102] lstrlenW (lpString="services.exe") returned 12 [0070.102] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0070.102] lstrlenW (lpString="lsass.exe") returned 9 [0070.102] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0070.103] lstrlenW (lpString="lsm.exe") returned 7 [0070.103] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.103] lstrlenW (lpString="svchost.exe") returned 11 [0070.103] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.104] lstrlenW (lpString="svchost.exe") returned 11 [0070.104] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.104] lstrlenW (lpString="svchost.exe") returned 11 [0070.104] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.105] lstrlenW (lpString="svchost.exe") returned 11 [0070.105] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.106] lstrlenW (lpString="svchost.exe") returned 11 [0070.106] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0070.106] lstrlenW (lpString="audiodg.exe") returned 11 [0070.106] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.107] lstrlenW (lpString="svchost.exe") returned 11 [0070.107] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.107] lstrlenW (lpString="svchost.exe") returned 11 [0070.107] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0070.108] lstrlenW (lpString="dwm.exe") returned 7 [0070.108] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0070.108] lstrlenW (lpString="explorer.exe") returned 12 [0070.108] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0070.109] lstrlenW (lpString="spoolsv.exe") returned 11 [0070.109] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.109] lstrlenW (lpString="taskhost.exe") returned 12 [0070.110] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.110] lstrlenW (lpString="svchost.exe") returned 11 [0070.110] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0070.111] lstrlenW (lpString="taskeng.exe") returned 11 [0070.111] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0070.111] lstrlenW (lpString="taskhost.exe") returned 12 [0070.111] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0070.112] lstrlenW (lpString="tested.exe") returned 10 [0070.112] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0070.112] lstrlenW (lpString="memories global commission.exe") returned 30 [0070.112] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0070.113] lstrlenW (lpString="destination.exe") returned 15 [0070.113] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0070.113] lstrlenW (lpString="rom.exe") returned 7 [0070.113] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0070.114] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0070.114] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0070.114] lstrlenW (lpString="appropriate worm.exe") returned 20 [0070.114] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0070.115] lstrlenW (lpString="arrival-testing.exe") returned 19 [0070.115] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0070.116] lstrlenW (lpString="san stories panels.exe") returned 22 [0070.116] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0070.116] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0070.116] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0070.117] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0070.117] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0070.117] lstrlenW (lpString="taught opt practice.exe") returned 23 [0070.117] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0070.118] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0070.118] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0070.118] lstrlenW (lpString="aka gap.exe") returned 11 [0070.118] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0070.119] lstrlenW (lpString="copied-mr.exe") returned 13 [0070.119] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0070.119] lstrlenW (lpString="proven.exe") returned 10 [0070.119] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0070.199] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0070.199] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0070.200] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0070.200] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0070.200] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0070.200] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0070.201] lstrlenW (lpString="acm.exe") returned 7 [0070.201] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0070.201] lstrlenW (lpString="fluid.exe") returned 9 [0070.201] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0070.202] lstrlenW (lpString="domain.exe") returned 10 [0070.202] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0070.202] lstrlenW (lpString="cult_wanna.exe") returned 14 [0070.203] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0070.203] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0070.203] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.204] lstrlenW (lpString="svchost.exe") returned 11 [0070.204] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0070.204] lstrlenW (lpString="1Black.exe") returned 10 [0070.204] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0070.205] lstrlenW (lpString="cmd.exe") returned 7 [0070.205] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0070.205] lstrlenW (lpString="conhost.exe") returned 11 [0070.205] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0070.206] lstrlenW (lpString="vssadmin.exe") returned 12 [0070.206] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0070.206] lstrlenW (lpString="VSSVC.exe") returned 9 [0070.206] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0070.207] lstrlenW (lpString="svchost.exe") returned 11 [0070.207] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0070.207] lstrlenW (lpString="sppsvc.exe") returned 10 [0070.207] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0070.208] CloseHandle (hObject=0x1e4) returned 1 [0070.208] Sleep (dwMilliseconds=0x1f4) [0071.209] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x401b618 [0071.270] EnumServicesStatusExW (in: hSCManager=0x401b618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0071.270] GetLastError () returned 0xea [0071.270] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x139e) returned 0x407bd40 [0071.270] EnumServicesStatusExW (in: hSCManager=0x401b618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x407bd40, cbBufSize=0x139e, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x407bd40, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0071.271] CloseServiceHandle (hSCObject=0x401b618) returned 1 [0071.271] lstrlenW (lpString="Appinfo") returned 7 [0071.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0071.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0071.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0071.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0071.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0071.271] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0071.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.271] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0071.271] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0071.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0071.271] lstrlenW (lpString="AudioSrv") returned 8 [0071.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0071.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0071.271] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0071.271] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0071.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0071.271] lstrlenW (lpString="BFE") returned 3 [0071.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0071.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0071.272] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0071.272] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0071.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0071.272] lstrlenW (lpString="CryptSvc") returned 8 [0071.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0071.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0071.272] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0071.272] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0071.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0071.272] lstrlenW (lpString="CscService") returned 10 [0071.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0071.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0071.272] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0071.272] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0071.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0071.272] lstrlenW (lpString="DcomLaunch") returned 10 [0071.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.272] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0071.272] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0071.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0071.272] lstrlenW (lpString="Dhcp") returned 4 [0071.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0071.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0071.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0071.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0071.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0071.272] lstrlenW (lpString="Dnscache") returned 8 [0071.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0071.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0071.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0071.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0071.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0071.273] lstrlenW (lpString="DPS") returned 3 [0071.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0071.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0071.273] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0071.273] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0071.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0071.273] lstrlenW (lpString="eventlog") returned 8 [0071.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0071.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0071.273] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0071.273] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0071.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0071.273] lstrlenW (lpString="EventSystem") returned 11 [0071.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0071.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0071.273] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0071.273] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0071.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0071.273] lstrlenW (lpString="FontCache") returned 9 [0071.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0071.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0071.273] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0071.273] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0071.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0071.273] lstrlenW (lpString="gpsvc") returned 5 [0071.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0071.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0071.273] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0071.273] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0071.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0071.273] lstrlenW (lpString="iphlpsvc") returned 8 [0071.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.274] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0071.274] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0071.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0071.274] lstrlenW (lpString="LanmanServer") returned 12 [0071.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0071.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0071.274] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0071.274] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0071.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0071.274] lstrlenW (lpString="LanmanWorkstation") returned 17 [0071.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.274] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0071.274] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0071.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0071.274] lstrlenW (lpString="lmhosts") returned 7 [0071.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0071.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0071.274] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0071.274] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0071.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0071.274] lstrlenW (lpString="MMCSS") returned 5 [0071.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0071.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0071.274] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0071.274] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0071.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0071.274] lstrlenW (lpString="MpsSvc") returned 6 [0071.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0071.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0071.274] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0071.274] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0071.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0071.275] lstrlenW (lpString="Netman") returned 6 [0071.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0071.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0071.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0071.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0071.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0071.275] lstrlenW (lpString="netprofm") returned 8 [0071.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0071.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0071.275] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0071.275] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0071.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0071.275] lstrlenW (lpString="NlaSvc") returned 6 [0071.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0071.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0071.275] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0071.275] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0071.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0071.275] lstrlenW (lpString="nsi") returned 3 [0071.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0071.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0071.275] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0071.275] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0071.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0071.275] lstrlenW (lpString="PcaSvc") returned 6 [0071.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0071.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0071.275] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0071.275] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0071.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0071.275] lstrlenW (lpString="PlugPlay") returned 8 [0071.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0071.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0071.276] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0071.276] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0071.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0071.276] lstrlenW (lpString="Power") returned 5 [0071.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0071.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0071.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0071.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0071.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0071.276] lstrlenW (lpString="ProfSvc") returned 7 [0071.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0071.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0071.276] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0071.276] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0071.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0071.276] lstrlenW (lpString="RpcEptMapper") returned 12 [0071.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.276] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0071.276] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0071.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0071.276] lstrlenW (lpString="RpcSs") returned 5 [0071.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0071.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0071.276] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0071.276] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0071.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0071.276] lstrlenW (lpString="SamSs") returned 5 [0071.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0071.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0071.276] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0071.276] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0071.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0071.277] lstrlenW (lpString="Schedule") returned 8 [0071.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0071.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0071.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0071.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0071.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0071.277] lstrlenW (lpString="SENS") returned 4 [0071.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0071.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0071.277] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0071.277] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0071.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0071.277] lstrlenW (lpString="ShellHWDetection") returned 16 [0071.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.277] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0071.277] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0071.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0071.277] lstrlenW (lpString="Spooler") returned 7 [0071.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0071.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0071.277] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0071.277] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0071.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0071.277] lstrlenW (lpString="sppsvc") returned 6 [0071.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0071.277] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0071.277] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0071.277] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0071.277] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0071.277] lstrlenW (lpString="swprv") returned 5 [0071.277] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0071.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0071.278] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0071.278] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0071.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0071.278] lstrlenW (lpString="SysMain") returned 7 [0071.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0071.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0071.278] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0071.278] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0071.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0071.278] lstrlenW (lpString="Themes") returned 6 [0071.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0071.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0071.278] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0071.278] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0071.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0071.278] lstrlenW (lpString="TrkWks") returned 6 [0071.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0071.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0071.278] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0071.278] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0071.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0071.278] lstrlenW (lpString="UxSms") returned 5 [0071.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0071.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0071.278] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0071.278] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0071.278] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0071.278] lstrlenW (lpString="VSS") returned 3 [0071.278] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0071.278] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0071.278] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0071.278] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0071.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0071.279] lstrlenW (lpString="WdiServiceHost") returned 14 [0071.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.279] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0071.279] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0071.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0071.279] lstrlenW (lpString="WdiSystemHost") returned 13 [0071.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.279] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0071.279] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0071.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0071.279] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0071.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.279] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0071.279] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0071.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0071.279] lstrlenW (lpString="Winmgmt") returned 7 [0071.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0071.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0071.279] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0071.279] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0071.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0071.279] lstrlenW (lpString="WPDBusEnum") returned 10 [0071.279] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0071.279] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0071.279] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0071.279] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0071.279] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0071.279] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x407bd40 | out: hHeap=0x8d0000) returned 1 [0071.279] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x21c [0071.282] Process32FirstW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.282] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0071.283] lstrlenW (lpString="System") returned 6 [0071.283] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0071.283] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0071.283] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0071.283] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0071.283] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0071.283] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0071.283] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0071.283] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0071.284] lstrlenW (lpString="smss.exe") returned 8 [0071.284] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0071.284] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0071.284] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0071.284] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0071.284] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0071.284] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0071.284] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0071.284] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.285] lstrlenW (lpString="csrss.exe") returned 9 [0071.285] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0071.286] lstrlenW (lpString="wininit.exe") returned 11 [0071.286] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.286] lstrlenW (lpString="csrss.exe") returned 9 [0071.286] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0071.287] lstrlenW (lpString="winlogon.exe") returned 12 [0071.287] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0071.287] lstrlenW (lpString="services.exe") returned 12 [0071.287] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0071.288] lstrlenW (lpString="lsass.exe") returned 9 [0071.288] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0071.288] lstrlenW (lpString="lsm.exe") returned 7 [0071.288] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.289] lstrlenW (lpString="svchost.exe") returned 11 [0071.289] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.289] lstrlenW (lpString="svchost.exe") returned 11 [0071.289] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.290] lstrlenW (lpString="svchost.exe") returned 11 [0071.290] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.290] lstrlenW (lpString="svchost.exe") returned 11 [0071.291] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.291] lstrlenW (lpString="svchost.exe") returned 11 [0071.291] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0071.291] lstrlenW (lpString="audiodg.exe") returned 11 [0071.292] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.292] lstrlenW (lpString="svchost.exe") returned 11 [0071.292] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.293] lstrlenW (lpString="svchost.exe") returned 11 [0071.293] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0071.293] lstrlenW (lpString="dwm.exe") returned 7 [0071.293] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0071.294] lstrlenW (lpString="explorer.exe") returned 12 [0071.294] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0071.294] lstrlenW (lpString="spoolsv.exe") returned 11 [0071.294] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.295] lstrlenW (lpString="taskhost.exe") returned 12 [0071.295] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.295] lstrlenW (lpString="svchost.exe") returned 11 [0071.295] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0071.296] lstrlenW (lpString="taskeng.exe") returned 11 [0071.296] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.296] lstrlenW (lpString="taskhost.exe") returned 12 [0071.296] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0071.297] lstrlenW (lpString="tested.exe") returned 10 [0071.297] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0071.300] lstrlenW (lpString="memories global commission.exe") returned 30 [0071.300] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0071.301] lstrlenW (lpString="destination.exe") returned 15 [0071.301] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0071.301] lstrlenW (lpString="rom.exe") returned 7 [0071.301] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0071.302] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0071.302] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0071.302] lstrlenW (lpString="appropriate worm.exe") returned 20 [0071.302] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0071.303] lstrlenW (lpString="arrival-testing.exe") returned 19 [0071.303] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0071.303] lstrlenW (lpString="san stories panels.exe") returned 22 [0071.304] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0071.304] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0071.304] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0071.305] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0071.305] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0071.305] lstrlenW (lpString="taught opt practice.exe") returned 23 [0071.305] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0071.306] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0071.306] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0071.306] lstrlenW (lpString="aka gap.exe") returned 11 [0071.306] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0071.307] lstrlenW (lpString="copied-mr.exe") returned 13 [0071.307] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0071.307] lstrlenW (lpString="proven.exe") returned 10 [0071.307] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0071.308] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0071.308] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0071.308] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0071.308] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0071.309] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0071.309] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0071.309] lstrlenW (lpString="acm.exe") returned 7 [0071.309] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0071.310] lstrlenW (lpString="fluid.exe") returned 9 [0071.310] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0071.310] lstrlenW (lpString="domain.exe") returned 10 [0071.310] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0071.311] lstrlenW (lpString="cult_wanna.exe") returned 14 [0071.311] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0071.311] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0071.312] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.312] lstrlenW (lpString="svchost.exe") returned 11 [0071.312] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0071.312] lstrlenW (lpString="1Black.exe") returned 10 [0071.312] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0071.313] lstrlenW (lpString="cmd.exe") returned 7 [0071.313] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0071.313] lstrlenW (lpString="conhost.exe") returned 11 [0071.313] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0071.314] lstrlenW (lpString="vssadmin.exe") returned 12 [0071.314] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0071.315] lstrlenW (lpString="VSSVC.exe") returned 9 [0071.315] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.315] lstrlenW (lpString="svchost.exe") returned 11 [0071.316] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0071.316] lstrlenW (lpString="sppsvc.exe") returned 10 [0071.316] Process32NextW (in: hSnapshot=0x21c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0071.317] CloseHandle (hObject=0x21c) returned 1 [0071.317] Sleep (dwMilliseconds=0x1f4) [0071.885] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x401b618 [0071.886] EnumServicesStatusExW (in: hSCManager=0x401b618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0071.886] GetLastError () returned 0xea [0071.886] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1316) returned 0x407bd40 [0071.886] EnumServicesStatusExW (in: hSCManager=0x401b618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x407bd40, cbBufSize=0x1316, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x407bd40, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0071.887] CloseServiceHandle (hSCObject=0x401b618) returned 1 [0071.887] lstrlenW (lpString="Appinfo") returned 7 [0071.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0071.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0071.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0071.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0071.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0071.887] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0071.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0071.887] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0071.887] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0071.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0071.887] lstrlenW (lpString="AudioSrv") returned 8 [0071.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0071.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0071.888] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0071.888] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0071.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0071.888] lstrlenW (lpString="BFE") returned 3 [0071.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0071.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0071.888] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0071.888] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0071.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0071.888] lstrlenW (lpString="CryptSvc") returned 8 [0071.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0071.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0071.888] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0071.888] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0071.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0071.888] lstrlenW (lpString="CscService") returned 10 [0071.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0071.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0071.888] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0071.888] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0071.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0071.888] lstrlenW (lpString="DcomLaunch") returned 10 [0071.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0071.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0071.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0071.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0071.888] lstrlenW (lpString="Dhcp") returned 4 [0071.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0071.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0071.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0071.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0071.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0071.889] lstrlenW (lpString="Dnscache") returned 8 [0071.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0071.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0071.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0071.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0071.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0071.889] lstrlenW (lpString="DPS") returned 3 [0071.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0071.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0071.889] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0071.889] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0071.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0071.889] lstrlenW (lpString="eventlog") returned 8 [0071.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0071.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0071.889] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0071.889] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0071.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0071.889] lstrlenW (lpString="EventSystem") returned 11 [0071.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0071.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0071.889] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0071.889] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0071.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0071.889] lstrlenW (lpString="FontCache") returned 9 [0071.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0071.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0071.889] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0071.889] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0071.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0071.889] lstrlenW (lpString="gpsvc") returned 5 [0071.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0071.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0071.890] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0071.890] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0071.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0071.890] lstrlenW (lpString="iphlpsvc") returned 8 [0071.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0071.890] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0071.890] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0071.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0071.890] lstrlenW (lpString="LanmanServer") returned 12 [0071.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0071.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0071.890] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0071.890] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0071.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0071.890] lstrlenW (lpString="LanmanWorkstation") returned 17 [0071.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0071.890] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0071.890] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0071.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0071.890] lstrlenW (lpString="lmhosts") returned 7 [0071.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0071.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0071.890] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0071.890] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0071.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0071.890] lstrlenW (lpString="MMCSS") returned 5 [0071.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0071.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0071.890] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0071.891] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0071.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0071.891] lstrlenW (lpString="MpsSvc") returned 6 [0071.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0071.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0071.891] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0071.891] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0071.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0071.891] lstrlenW (lpString="Netman") returned 6 [0071.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0071.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0071.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0071.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0071.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0071.891] lstrlenW (lpString="netprofm") returned 8 [0071.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0071.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0071.891] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0071.891] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0071.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0071.891] lstrlenW (lpString="NlaSvc") returned 6 [0071.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0071.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0071.891] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0071.891] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0071.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0071.891] lstrlenW (lpString="nsi") returned 3 [0071.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0071.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0071.891] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0071.891] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0071.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0071.891] lstrlenW (lpString="PcaSvc") returned 6 [0071.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0071.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0071.892] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0071.892] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0071.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0071.892] lstrlenW (lpString="PlugPlay") returned 8 [0071.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0071.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0071.892] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0071.892] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0071.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0071.892] lstrlenW (lpString="Power") returned 5 [0071.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0071.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0071.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0071.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0071.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0071.892] lstrlenW (lpString="ProfSvc") returned 7 [0071.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0071.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0071.892] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0071.892] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0071.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0071.892] lstrlenW (lpString="RpcEptMapper") returned 12 [0071.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0071.893] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0071.893] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0071.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0071.893] lstrlenW (lpString="RpcSs") returned 5 [0071.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0071.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0071.893] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0071.893] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0071.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0071.893] lstrlenW (lpString="SamSs") returned 5 [0071.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0071.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0071.893] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0071.893] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0071.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0071.893] lstrlenW (lpString="Schedule") returned 8 [0071.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0071.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0071.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0071.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0071.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0071.894] lstrlenW (lpString="SENS") returned 4 [0071.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0071.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0071.894] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0071.894] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0071.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0071.894] lstrlenW (lpString="ShellHWDetection") returned 16 [0071.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0071.894] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0071.894] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0071.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0071.894] lstrlenW (lpString="Spooler") returned 7 [0071.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0071.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0071.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0071.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0071.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0071.894] lstrlenW (lpString="sppsvc") returned 6 [0071.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0071.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0071.894] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0071.894] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0071.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0071.894] lstrlenW (lpString="swprv") returned 5 [0071.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0071.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0071.894] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0071.894] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0071.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0071.894] lstrlenW (lpString="SysMain") returned 7 [0071.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0071.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0071.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0071.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0071.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0071.895] lstrlenW (lpString="Themes") returned 6 [0071.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0071.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0071.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0071.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0071.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0071.895] lstrlenW (lpString="TrkWks") returned 6 [0071.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0071.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0071.895] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0071.895] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0071.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0071.895] lstrlenW (lpString="UxSms") returned 5 [0071.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0071.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0071.895] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0071.895] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0071.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0071.895] lstrlenW (lpString="VSS") returned 3 [0071.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0071.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0071.895] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0071.895] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0071.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0071.895] lstrlenW (lpString="WdiServiceHost") returned 14 [0071.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0071.895] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0071.895] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0071.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0071.896] lstrlenW (lpString="WdiSystemHost") returned 13 [0071.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0071.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0071.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0071.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0071.896] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0071.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0071.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0071.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0071.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0071.896] lstrlenW (lpString="Winmgmt") returned 7 [0071.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0071.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0071.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0071.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0071.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0071.896] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x407bd40 | out: hHeap=0x8d0000) returned 1 [0071.896] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0071.899] Process32FirstW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0071.899] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0071.900] lstrlenW (lpString="System") returned 6 [0071.900] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0071.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0071.900] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0071.900] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0071.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0071.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0071.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0071.900] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0071.900] lstrlenW (lpString="smss.exe") returned 8 [0071.900] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0071.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0071.900] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0071.900] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0071.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0071.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0071.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0071.901] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.901] lstrlenW (lpString="csrss.exe") returned 9 [0071.901] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0071.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0071.901] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0071.901] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0071.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0071.902] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0071.902] lstrlenW (lpString="wininit.exe") returned 11 [0071.902] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0071.903] lstrlenW (lpString="csrss.exe") returned 9 [0071.903] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0071.903] lstrlenW (lpString="winlogon.exe") returned 12 [0071.903] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0071.904] lstrlenW (lpString="services.exe") returned 12 [0071.904] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0071.904] lstrlenW (lpString="lsass.exe") returned 9 [0071.904] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0071.905] lstrlenW (lpString="lsm.exe") returned 7 [0071.905] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.905] lstrlenW (lpString="svchost.exe") returned 11 [0071.905] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.906] lstrlenW (lpString="svchost.exe") returned 11 [0071.906] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.906] lstrlenW (lpString="svchost.exe") returned 11 [0071.906] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.907] lstrlenW (lpString="svchost.exe") returned 11 [0071.907] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.907] lstrlenW (lpString="svchost.exe") returned 11 [0071.907] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0071.908] lstrlenW (lpString="audiodg.exe") returned 11 [0071.909] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.909] lstrlenW (lpString="svchost.exe") returned 11 [0071.909] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.910] lstrlenW (lpString="svchost.exe") returned 11 [0071.910] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0071.910] lstrlenW (lpString="dwm.exe") returned 7 [0071.910] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0071.911] lstrlenW (lpString="explorer.exe") returned 12 [0071.911] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0071.911] lstrlenW (lpString="spoolsv.exe") returned 11 [0071.911] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.912] lstrlenW (lpString="taskhost.exe") returned 12 [0071.912] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0071.912] lstrlenW (lpString="svchost.exe") returned 11 [0071.912] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0071.913] lstrlenW (lpString="taskeng.exe") returned 11 [0071.913] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0071.913] lstrlenW (lpString="taskhost.exe") returned 12 [0071.913] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0071.914] lstrlenW (lpString="tested.exe") returned 10 [0071.914] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0071.914] lstrlenW (lpString="memories global commission.exe") returned 30 [0071.914] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0071.915] lstrlenW (lpString="destination.exe") returned 15 [0071.915] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0071.915] lstrlenW (lpString="rom.exe") returned 7 [0071.915] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0071.916] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0071.916] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0071.916] lstrlenW (lpString="appropriate worm.exe") returned 20 [0071.917] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0071.917] lstrlenW (lpString="arrival-testing.exe") returned 19 [0071.917] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0071.918] lstrlenW (lpString="san stories panels.exe") returned 22 [0071.918] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0071.918] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0071.918] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0071.919] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0071.919] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0071.919] lstrlenW (lpString="taught opt practice.exe") returned 23 [0071.919] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0071.920] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0071.920] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0071.920] lstrlenW (lpString="aka gap.exe") returned 11 [0071.920] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0071.921] lstrlenW (lpString="copied-mr.exe") returned 13 [0071.921] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0072.054] lstrlenW (lpString="proven.exe") returned 10 [0072.054] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0072.055] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0072.055] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0072.055] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0072.055] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0072.056] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0072.056] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0072.056] lstrlenW (lpString="acm.exe") returned 7 [0072.056] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0072.057] lstrlenW (lpString="fluid.exe") returned 9 [0072.057] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0072.057] lstrlenW (lpString="domain.exe") returned 10 [0072.057] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0072.058] lstrlenW (lpString="cult_wanna.exe") returned 14 [0072.058] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.058] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.058] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.059] lstrlenW (lpString="svchost.exe") returned 11 [0072.059] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0072.059] lstrlenW (lpString="1Black.exe") returned 10 [0072.059] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0072.060] lstrlenW (lpString="cmd.exe") returned 7 [0072.060] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.060] lstrlenW (lpString="conhost.exe") returned 11 [0072.060] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0072.061] lstrlenW (lpString="vssadmin.exe") returned 12 [0072.061] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0072.062] lstrlenW (lpString="VSSVC.exe") returned 9 [0072.062] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.062] lstrlenW (lpString="svchost.exe") returned 11 [0072.062] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0072.063] lstrlenW (lpString="sppsvc.exe") returned 10 [0072.063] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0072.063] CloseHandle (hObject=0x204) returned 1 [0072.063] Sleep (dwMilliseconds=0x1f4) [0072.624] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x401b550 [0072.628] EnumServicesStatusExW (in: hSCManager=0x401b550, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0072.628] GetLastError () returned 0xea [0072.628] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1316) returned 0x38446f0 [0072.628] EnumServicesStatusExW (in: hSCManager=0x401b550, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38446f0, cbBufSize=0x1316, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38446f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0072.628] CloseServiceHandle (hSCObject=0x401b550) returned 1 [0072.629] lstrlenW (lpString="Appinfo") returned 7 [0072.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0072.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0072.629] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0072.629] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0072.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0072.629] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0072.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0072.629] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0072.629] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0072.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0072.629] lstrlenW (lpString="AudioSrv") returned 8 [0072.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0072.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0072.629] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0072.629] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0072.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0072.629] lstrlenW (lpString="BFE") returned 3 [0072.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0072.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0072.629] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0072.629] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0072.629] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0072.629] lstrlenW (lpString="CryptSvc") returned 8 [0072.629] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0072.629] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0072.629] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0072.629] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0072.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0072.630] lstrlenW (lpString="CscService") returned 10 [0072.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0072.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0072.630] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0072.630] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0072.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0072.630] lstrlenW (lpString="DcomLaunch") returned 10 [0072.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0072.630] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0072.630] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0072.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0072.630] lstrlenW (lpString="Dhcp") returned 4 [0072.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0072.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0072.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0072.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0072.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0072.630] lstrlenW (lpString="Dnscache") returned 8 [0072.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0072.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0072.630] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0072.630] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0072.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0072.630] lstrlenW (lpString="DPS") returned 3 [0072.630] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0072.630] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0072.630] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0072.630] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0072.630] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0072.630] lstrlenW (lpString="eventlog") returned 8 [0072.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0072.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0072.631] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0072.631] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0072.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0072.631] lstrlenW (lpString="EventSystem") returned 11 [0072.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0072.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0072.631] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0072.631] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0072.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0072.631] lstrlenW (lpString="FontCache") returned 9 [0072.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0072.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0072.631] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0072.631] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0072.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0072.631] lstrlenW (lpString="gpsvc") returned 5 [0072.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0072.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0072.631] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0072.631] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0072.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0072.631] lstrlenW (lpString="iphlpsvc") returned 8 [0072.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0072.631] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0072.631] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0072.631] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0072.631] lstrlenW (lpString="LanmanServer") returned 12 [0072.631] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0072.631] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0072.632] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0072.632] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0072.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0072.632] lstrlenW (lpString="LanmanWorkstation") returned 17 [0072.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0072.632] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0072.632] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0072.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0072.632] lstrlenW (lpString="lmhosts") returned 7 [0072.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0072.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0072.632] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0072.632] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0072.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0072.632] lstrlenW (lpString="MMCSS") returned 5 [0072.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0072.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0072.632] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0072.632] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0072.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0072.632] lstrlenW (lpString="MpsSvc") returned 6 [0072.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0072.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0072.632] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0072.632] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0072.632] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0072.632] lstrlenW (lpString="Netman") returned 6 [0072.632] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0072.632] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0072.632] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0072.632] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0072.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0072.633] lstrlenW (lpString="netprofm") returned 8 [0072.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0072.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0072.633] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0072.633] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0072.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0072.633] lstrlenW (lpString="NlaSvc") returned 6 [0072.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0072.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0072.633] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0072.633] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0072.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0072.633] lstrlenW (lpString="nsi") returned 3 [0072.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0072.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0072.633] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0072.633] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0072.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0072.633] lstrlenW (lpString="PcaSvc") returned 6 [0072.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0072.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0072.633] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0072.633] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0072.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0072.633] lstrlenW (lpString="PlugPlay") returned 8 [0072.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0072.633] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0072.633] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0072.633] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0072.633] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0072.633] lstrlenW (lpString="Power") returned 5 [0072.633] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0072.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0072.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0072.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0072.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0072.634] lstrlenW (lpString="ProfSvc") returned 7 [0072.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0072.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0072.634] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0072.634] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0072.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0072.634] lstrlenW (lpString="RpcEptMapper") returned 12 [0072.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0072.634] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0072.634] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0072.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0072.634] lstrlenW (lpString="RpcSs") returned 5 [0072.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0072.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0072.634] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0072.635] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0072.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0072.635] lstrlenW (lpString="SamSs") returned 5 [0072.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0072.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0072.635] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0072.635] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0072.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0072.635] lstrlenW (lpString="Schedule") returned 8 [0072.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0072.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0072.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0072.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0072.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0072.636] lstrlenW (lpString="SENS") returned 4 [0072.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0072.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0072.636] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0072.636] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0072.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0072.636] lstrlenW (lpString="ShellHWDetection") returned 16 [0072.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0072.636] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0072.636] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0072.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0072.636] lstrlenW (lpString="Spooler") returned 7 [0072.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0072.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0072.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0072.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0072.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0072.636] lstrlenW (lpString="sppsvc") returned 6 [0072.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0072.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0072.636] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0072.636] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0072.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0072.636] lstrlenW (lpString="swprv") returned 5 [0072.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0072.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0072.636] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0072.636] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0072.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0072.637] lstrlenW (lpString="SysMain") returned 7 [0072.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0072.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0072.637] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0072.637] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0072.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0072.637] lstrlenW (lpString="Themes") returned 6 [0072.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0072.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0072.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0072.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0072.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0072.637] lstrlenW (lpString="TrkWks") returned 6 [0072.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0072.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0072.637] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0072.637] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0072.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0072.637] lstrlenW (lpString="UxSms") returned 5 [0072.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0072.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0072.637] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0072.637] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0072.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0072.637] lstrlenW (lpString="VSS") returned 3 [0072.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0072.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0072.637] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0072.637] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0072.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0072.637] lstrlenW (lpString="WdiServiceHost") returned 14 [0072.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0072.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0072.638] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0072.638] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0072.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0072.638] lstrlenW (lpString="WdiSystemHost") returned 13 [0072.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0072.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0072.638] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0072.638] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0072.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0072.638] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0072.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0072.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0072.638] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0072.638] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0072.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0072.638] lstrlenW (lpString="Winmgmt") returned 7 [0072.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0072.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0072.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0072.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0072.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0072.638] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38446f0 | out: hHeap=0x8d0000) returned 1 [0072.638] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f0 [0072.640] Process32FirstW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0072.641] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0072.642] lstrlenW (lpString="System") returned 6 [0072.642] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0072.642] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0072.642] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0072.642] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0072.642] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0072.642] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0072.642] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0072.642] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0072.642] lstrlenW (lpString="smss.exe") returned 8 [0072.642] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0072.642] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0072.642] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0072.642] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0072.642] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0072.642] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0072.643] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0072.643] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.643] lstrlenW (lpString="csrss.exe") returned 9 [0072.643] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0072.643] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0072.643] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0072.643] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0072.643] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0072.643] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0072.644] lstrlenW (lpString="wininit.exe") returned 11 [0072.644] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0072.644] lstrlenW (lpString="csrss.exe") returned 9 [0072.644] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0072.645] lstrlenW (lpString="winlogon.exe") returned 12 [0072.645] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0072.645] lstrlenW (lpString="services.exe") returned 12 [0072.646] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0072.646] lstrlenW (lpString="lsass.exe") returned 9 [0072.646] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0072.646] lstrlenW (lpString="lsm.exe") returned 7 [0072.647] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.647] lstrlenW (lpString="svchost.exe") returned 11 [0072.647] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.648] lstrlenW (lpString="svchost.exe") returned 11 [0072.648] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.648] lstrlenW (lpString="svchost.exe") returned 11 [0072.648] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.649] lstrlenW (lpString="svchost.exe") returned 11 [0072.649] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.649] lstrlenW (lpString="svchost.exe") returned 11 [0072.649] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0072.650] lstrlenW (lpString="audiodg.exe") returned 11 [0072.650] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.650] lstrlenW (lpString="svchost.exe") returned 11 [0072.650] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.651] lstrlenW (lpString="svchost.exe") returned 11 [0072.651] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0072.651] lstrlenW (lpString="dwm.exe") returned 7 [0072.651] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0072.652] lstrlenW (lpString="explorer.exe") returned 12 [0072.652] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0072.652] lstrlenW (lpString="spoolsv.exe") returned 11 [0072.652] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.653] lstrlenW (lpString="taskhost.exe") returned 12 [0072.653] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.653] lstrlenW (lpString="svchost.exe") returned 11 [0072.653] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0072.654] lstrlenW (lpString="taskeng.exe") returned 11 [0072.654] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0072.654] lstrlenW (lpString="taskhost.exe") returned 12 [0072.654] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0072.655] lstrlenW (lpString="tested.exe") returned 10 [0072.655] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0072.655] lstrlenW (lpString="memories global commission.exe") returned 30 [0072.655] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0072.656] lstrlenW (lpString="destination.exe") returned 15 [0072.656] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0072.657] lstrlenW (lpString="rom.exe") returned 7 [0072.657] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0072.657] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0072.657] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0072.658] lstrlenW (lpString="appropriate worm.exe") returned 20 [0072.658] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0072.658] lstrlenW (lpString="arrival-testing.exe") returned 19 [0072.658] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0072.659] lstrlenW (lpString="san stories panels.exe") returned 22 [0072.659] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0072.659] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0072.659] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0072.660] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0072.660] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0072.660] lstrlenW (lpString="taught opt practice.exe") returned 23 [0072.660] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0072.661] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0072.661] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0072.661] lstrlenW (lpString="aka gap.exe") returned 11 [0072.661] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0072.662] lstrlenW (lpString="copied-mr.exe") returned 13 [0072.662] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0072.662] lstrlenW (lpString="proven.exe") returned 10 [0072.662] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0072.663] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0072.663] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0072.663] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0072.663] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0072.664] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0072.664] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0072.664] lstrlenW (lpString="acm.exe") returned 7 [0072.665] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0072.665] lstrlenW (lpString="fluid.exe") returned 9 [0072.665] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0072.665] lstrlenW (lpString="domain.exe") returned 10 [0072.666] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0072.666] lstrlenW (lpString="cult_wanna.exe") returned 14 [0072.666] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0072.667] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0072.667] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.667] lstrlenW (lpString="svchost.exe") returned 11 [0072.667] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0072.668] lstrlenW (lpString="1Black.exe") returned 10 [0072.668] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0072.668] lstrlenW (lpString="cmd.exe") returned 7 [0072.668] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0072.669] lstrlenW (lpString="conhost.exe") returned 11 [0072.669] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0072.669] lstrlenW (lpString="vssadmin.exe") returned 12 [0072.669] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0072.670] lstrlenW (lpString="VSSVC.exe") returned 9 [0072.670] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0072.670] lstrlenW (lpString="svchost.exe") returned 11 [0072.670] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0072.671] lstrlenW (lpString="sppsvc.exe") returned 10 [0072.671] Process32NextW (in: hSnapshot=0x1f0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0072.671] CloseHandle (hObject=0x1f0) returned 1 [0072.671] Sleep (dwMilliseconds=0x1f4) [0073.689] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94f990 [0073.689] EnumServicesStatusExW (in: hSCManager=0x94f990, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0073.690] GetLastError () returned 0xea [0073.690] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1316) returned 0x38446f0 [0073.690] EnumServicesStatusExW (in: hSCManager=0x94f990, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38446f0, cbBufSize=0x1316, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38446f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0073.691] CloseServiceHandle (hSCObject=0x94f990) returned 1 [0073.691] lstrlenW (lpString="Appinfo") returned 7 [0073.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0073.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0073.691] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0073.691] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0073.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0073.691] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0073.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0073.691] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0073.691] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0073.691] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0073.691] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0073.691] lstrlenW (lpString="AudioSrv") returned 8 [0073.691] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0073.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0073.692] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0073.692] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0073.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0073.692] lstrlenW (lpString="BFE") returned 3 [0073.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0073.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0073.692] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0073.692] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0073.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0073.692] lstrlenW (lpString="CryptSvc") returned 8 [0073.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0073.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0073.692] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0073.692] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0073.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0073.692] lstrlenW (lpString="CscService") returned 10 [0073.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0073.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0073.692] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0073.692] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0073.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0073.692] lstrlenW (lpString="DcomLaunch") returned 10 [0073.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0073.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0073.692] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0073.692] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0073.692] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0073.692] lstrlenW (lpString="Dhcp") returned 4 [0073.692] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0073.692] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0073.692] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0073.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0073.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0073.693] lstrlenW (lpString="Dnscache") returned 8 [0073.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0073.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0073.693] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0073.693] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0073.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0073.693] lstrlenW (lpString="DPS") returned 3 [0073.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0073.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0073.693] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0073.693] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0073.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0073.693] lstrlenW (lpString="eventlog") returned 8 [0073.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0073.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0073.693] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0073.693] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0073.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0073.693] lstrlenW (lpString="EventSystem") returned 11 [0073.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0073.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0073.693] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0073.693] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0073.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0073.693] lstrlenW (lpString="FontCache") returned 9 [0073.693] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0073.693] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0073.693] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0073.693] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0073.693] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0073.693] lstrlenW (lpString="gpsvc") returned 5 [0073.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0073.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0073.694] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0073.694] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0073.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0073.694] lstrlenW (lpString="iphlpsvc") returned 8 [0073.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0073.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0073.694] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0073.694] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0073.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0073.694] lstrlenW (lpString="LanmanServer") returned 12 [0073.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0073.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0073.694] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0073.694] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0073.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0073.694] lstrlenW (lpString="LanmanWorkstation") returned 17 [0073.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0073.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0073.694] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0073.694] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0073.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0073.694] lstrlenW (lpString="lmhosts") returned 7 [0073.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0073.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0073.694] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0073.694] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0073.694] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0073.694] lstrlenW (lpString="MMCSS") returned 5 [0073.694] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0073.694] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0073.694] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0073.695] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0073.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0073.695] lstrlenW (lpString="MpsSvc") returned 6 [0073.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0073.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0073.695] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0073.695] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0073.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0073.695] lstrlenW (lpString="Netman") returned 6 [0073.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0073.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0073.695] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0073.695] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0073.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0073.695] lstrlenW (lpString="netprofm") returned 8 [0073.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0073.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0073.695] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0073.695] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0073.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0073.695] lstrlenW (lpString="NlaSvc") returned 6 [0073.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0073.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0073.695] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0073.695] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0073.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0073.695] lstrlenW (lpString="nsi") returned 3 [0073.695] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0073.695] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0073.695] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0073.695] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0073.695] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0073.696] lstrlenW (lpString="PcaSvc") returned 6 [0073.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0073.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0073.696] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0073.696] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0073.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0073.696] lstrlenW (lpString="PlugPlay") returned 8 [0073.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0073.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0073.696] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0073.696] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0073.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0073.696] lstrlenW (lpString="Power") returned 5 [0073.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0073.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0073.696] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0073.696] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0073.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0073.696] lstrlenW (lpString="ProfSvc") returned 7 [0073.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0073.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0073.696] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0073.696] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0073.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0073.696] lstrlenW (lpString="RpcEptMapper") returned 12 [0073.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0073.696] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0073.696] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0073.696] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0073.696] lstrlenW (lpString="RpcSs") returned 5 [0073.696] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0073.696] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0073.697] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0073.697] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0073.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0073.697] lstrlenW (lpString="SamSs") returned 5 [0073.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0073.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0073.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0073.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0073.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0073.697] lstrlenW (lpString="Schedule") returned 8 [0073.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0073.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0073.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0073.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0073.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0073.697] lstrlenW (lpString="SENS") returned 4 [0073.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0073.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0073.697] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0073.697] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0073.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0073.697] lstrlenW (lpString="ShellHWDetection") returned 16 [0073.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0073.697] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0073.697] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0073.697] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0073.697] lstrlenW (lpString="Spooler") returned 7 [0073.697] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0073.697] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0073.697] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0073.697] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0073.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0073.698] lstrlenW (lpString="sppsvc") returned 6 [0073.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0073.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0073.698] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0073.698] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0073.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0073.698] lstrlenW (lpString="swprv") returned 5 [0073.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0073.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0073.698] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0073.698] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0073.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0073.698] lstrlenW (lpString="SysMain") returned 7 [0073.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0073.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0073.698] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0073.698] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0073.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0073.698] lstrlenW (lpString="Themes") returned 6 [0073.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0073.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0073.698] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0073.698] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0073.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0073.698] lstrlenW (lpString="TrkWks") returned 6 [0073.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0073.698] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0073.698] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0073.698] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0073.698] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0073.698] lstrlenW (lpString="UxSms") returned 5 [0073.698] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0073.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0073.699] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0073.699] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0073.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0073.699] lstrlenW (lpString="VSS") returned 3 [0073.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0073.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0073.699] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0073.699] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0073.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0073.699] lstrlenW (lpString="WdiServiceHost") returned 14 [0073.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0073.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0073.699] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0073.699] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0073.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0073.699] lstrlenW (lpString="WdiSystemHost") returned 13 [0073.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0073.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0073.699] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0073.699] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0073.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0073.699] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0073.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0073.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0073.699] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0073.699] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0073.699] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0073.699] lstrlenW (lpString="Winmgmt") returned 7 [0073.699] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0073.699] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0073.699] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0073.700] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0073.700] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0073.700] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38446f0 | out: hHeap=0x8d0000) returned 1 [0073.700] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0073.702] Process32FirstW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0073.703] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0073.703] lstrlenW (lpString="System") returned 6 [0073.703] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0073.703] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0073.703] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0073.703] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0073.703] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0073.703] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0073.703] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0073.703] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0073.704] lstrlenW (lpString="smss.exe") returned 8 [0073.704] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0073.704] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0073.704] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0073.704] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0073.704] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0073.704] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0073.704] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0073.704] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.705] lstrlenW (lpString="csrss.exe") returned 9 [0073.705] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0073.705] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0073.705] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0073.705] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0073.705] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0073.705] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0073.706] lstrlenW (lpString="wininit.exe") returned 11 [0073.706] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0073.706] lstrlenW (lpString="csrss.exe") returned 9 [0073.706] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0073.707] lstrlenW (lpString="winlogon.exe") returned 12 [0073.707] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0073.707] lstrlenW (lpString="services.exe") returned 12 [0073.707] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0073.708] lstrlenW (lpString="lsass.exe") returned 9 [0073.708] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0073.708] lstrlenW (lpString="lsm.exe") returned 7 [0073.708] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.709] lstrlenW (lpString="svchost.exe") returned 11 [0073.709] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.709] lstrlenW (lpString="svchost.exe") returned 11 [0073.709] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.710] lstrlenW (lpString="svchost.exe") returned 11 [0073.710] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.710] lstrlenW (lpString="svchost.exe") returned 11 [0073.711] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.711] lstrlenW (lpString="svchost.exe") returned 11 [0073.711] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0073.712] lstrlenW (lpString="audiodg.exe") returned 11 [0073.712] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.712] lstrlenW (lpString="svchost.exe") returned 11 [0073.712] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.713] lstrlenW (lpString="svchost.exe") returned 11 [0073.713] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0073.713] lstrlenW (lpString="dwm.exe") returned 7 [0073.713] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0073.714] lstrlenW (lpString="explorer.exe") returned 12 [0073.714] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0073.714] lstrlenW (lpString="spoolsv.exe") returned 11 [0073.714] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.715] lstrlenW (lpString="taskhost.exe") returned 12 [0073.715] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0073.715] lstrlenW (lpString="svchost.exe") returned 11 [0073.715] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0073.716] lstrlenW (lpString="taskeng.exe") returned 11 [0073.716] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0073.716] lstrlenW (lpString="taskhost.exe") returned 12 [0073.716] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0073.717] lstrlenW (lpString="tested.exe") returned 10 [0073.717] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0073.717] lstrlenW (lpString="memories global commission.exe") returned 30 [0073.717] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0073.718] lstrlenW (lpString="destination.exe") returned 15 [0073.718] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0073.718] lstrlenW (lpString="rom.exe") returned 7 [0073.718] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0073.719] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0073.719] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0073.720] lstrlenW (lpString="appropriate worm.exe") returned 20 [0073.720] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0073.720] lstrlenW (lpString="arrival-testing.exe") returned 19 [0073.720] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0073.721] lstrlenW (lpString="san stories panels.exe") returned 22 [0073.721] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0073.721] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0073.721] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0073.722] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0073.722] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0073.722] lstrlenW (lpString="taught opt practice.exe") returned 23 [0073.722] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0073.723] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0073.723] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0073.723] lstrlenW (lpString="aka gap.exe") returned 11 [0073.723] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0074.010] lstrlenW (lpString="copied-mr.exe") returned 13 [0074.010] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0074.010] lstrlenW (lpString="proven.exe") returned 10 [0074.011] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0074.011] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0074.011] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0074.012] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0074.012] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0074.012] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0074.012] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0074.013] lstrlenW (lpString="acm.exe") returned 7 [0074.013] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0074.013] lstrlenW (lpString="fluid.exe") returned 9 [0074.013] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0074.014] lstrlenW (lpString="domain.exe") returned 10 [0074.014] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0074.014] lstrlenW (lpString="cult_wanna.exe") returned 14 [0074.014] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.015] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0074.015] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.015] lstrlenW (lpString="svchost.exe") returned 11 [0074.016] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0074.016] lstrlenW (lpString="1Black.exe") returned 10 [0074.016] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0074.016] lstrlenW (lpString="cmd.exe") returned 7 [0074.017] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.017] lstrlenW (lpString="conhost.exe") returned 11 [0074.017] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0074.018] lstrlenW (lpString="vssadmin.exe") returned 12 [0074.018] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0074.018] lstrlenW (lpString="VSSVC.exe") returned 9 [0074.018] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.019] lstrlenW (lpString="svchost.exe") returned 11 [0074.019] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0074.019] lstrlenW (lpString="sppsvc.exe") returned 10 [0074.019] Process32NextW (in: hSnapshot=0x200, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 0 [0074.020] CloseHandle (hObject=0x200) returned 1 [0074.020] Sleep (dwMilliseconds=0x1f4) [0074.710] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x94fa80 [0074.711] EnumServicesStatusExW (in: hSCManager=0x94fa80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0074.711] GetLastError () returned 0xea [0074.711] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1316) returned 0x38446f0 [0074.711] EnumServicesStatusExW (in: hSCManager=0x94fa80, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38446f0, cbBufSize=0x1316, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38446f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0074.712] CloseServiceHandle (hSCObject=0x94fa80) returned 1 [0074.712] lstrlenW (lpString="Appinfo") returned 7 [0074.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0074.712] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0074.712] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0074.712] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0074.712] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0074.712] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0074.712] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0074.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0074.713] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0074.713] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0074.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0074.713] lstrlenW (lpString="AudioSrv") returned 8 [0074.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0074.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0074.713] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0074.713] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0074.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0074.713] lstrlenW (lpString="BFE") returned 3 [0074.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0074.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0074.713] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0074.713] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0074.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0074.713] lstrlenW (lpString="CryptSvc") returned 8 [0074.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0074.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0074.713] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0074.713] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0074.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0074.713] lstrlenW (lpString="CscService") returned 10 [0074.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0074.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0074.713] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0074.713] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0074.713] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0074.713] lstrlenW (lpString="DcomLaunch") returned 10 [0074.713] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0074.713] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0074.713] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0074.713] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0074.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0074.714] lstrlenW (lpString="Dhcp") returned 4 [0074.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0074.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0074.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0074.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0074.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0074.714] lstrlenW (lpString="Dnscache") returned 8 [0074.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0074.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0074.714] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0074.714] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0074.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0074.714] lstrlenW (lpString="DPS") returned 3 [0074.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0074.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0074.714] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0074.714] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0074.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0074.714] lstrlenW (lpString="eventlog") returned 8 [0074.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0074.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0074.714] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0074.714] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0074.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0074.714] lstrlenW (lpString="EventSystem") returned 11 [0074.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0074.714] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0074.714] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0074.714] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0074.714] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0074.714] lstrlenW (lpString="FontCache") returned 9 [0074.714] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0074.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0074.715] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0074.715] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0074.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0074.715] lstrlenW (lpString="gpsvc") returned 5 [0074.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0074.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0074.715] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0074.715] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0074.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0074.715] lstrlenW (lpString="iphlpsvc") returned 8 [0074.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0074.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0074.715] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0074.715] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0074.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0074.715] lstrlenW (lpString="LanmanServer") returned 12 [0074.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0074.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0074.715] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0074.715] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0074.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0074.715] lstrlenW (lpString="LanmanWorkstation") returned 17 [0074.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0074.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0074.715] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0074.715] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0074.715] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0074.715] lstrlenW (lpString="lmhosts") returned 7 [0074.715] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0074.715] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0074.715] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0074.715] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0074.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0074.716] lstrlenW (lpString="MMCSS") returned 5 [0074.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0074.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0074.716] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0074.716] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0074.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0074.716] lstrlenW (lpString="MpsSvc") returned 6 [0074.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0074.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0074.716] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0074.716] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0074.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0074.716] lstrlenW (lpString="Netman") returned 6 [0074.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0074.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0074.716] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0074.716] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0074.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0074.716] lstrlenW (lpString="netprofm") returned 8 [0074.716] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0074.716] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0074.716] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0074.716] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0074.716] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0074.717] lstrlenW (lpString="NlaSvc") returned 6 [0074.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0074.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0074.717] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0074.717] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0074.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0074.717] lstrlenW (lpString="nsi") returned 3 [0074.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0074.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0074.717] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0074.717] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0074.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0074.717] lstrlenW (lpString="PcaSvc") returned 6 [0074.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0074.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0074.717] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0074.717] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0074.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0074.717] lstrlenW (lpString="PlugPlay") returned 8 [0074.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0074.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0074.717] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0074.717] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0074.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0074.717] lstrlenW (lpString="Power") returned 5 [0074.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0074.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0074.717] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0074.717] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0074.717] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0074.717] lstrlenW (lpString="ProfSvc") returned 7 [0074.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0074.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0074.718] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0074.718] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0074.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0074.718] lstrlenW (lpString="RpcEptMapper") returned 12 [0074.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0074.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0074.718] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0074.718] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0074.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0074.718] lstrlenW (lpString="RpcSs") returned 5 [0074.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0074.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0074.718] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0074.718] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0074.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0074.718] lstrlenW (lpString="SamSs") returned 5 [0074.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0074.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0074.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0074.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0074.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0074.718] lstrlenW (lpString="Schedule") returned 8 [0074.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0074.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0074.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0074.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0074.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0074.718] lstrlenW (lpString="SENS") returned 4 [0074.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0074.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0074.718] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0074.718] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0074.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0074.719] lstrlenW (lpString="ShellHWDetection") returned 16 [0074.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0074.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0074.719] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0074.719] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0074.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0074.719] lstrlenW (lpString="Spooler") returned 7 [0074.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0074.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0074.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0074.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0074.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0074.719] lstrlenW (lpString="sppsvc") returned 6 [0074.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0074.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0074.719] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0074.719] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0074.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0074.719] lstrlenW (lpString="swprv") returned 5 [0074.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0074.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0074.719] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0074.719] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0074.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0074.719] lstrlenW (lpString="SysMain") returned 7 [0074.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0074.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0074.719] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0074.719] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0074.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0074.719] lstrlenW (lpString="Themes") returned 6 [0074.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0074.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0074.720] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0074.720] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0074.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0074.720] lstrlenW (lpString="TrkWks") returned 6 [0074.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0074.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0074.720] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0074.720] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0074.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0074.720] lstrlenW (lpString="UxSms") returned 5 [0074.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0074.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0074.720] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0074.720] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0074.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0074.720] lstrlenW (lpString="VSS") returned 3 [0074.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0074.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0074.720] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0074.720] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0074.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0074.720] lstrlenW (lpString="WdiServiceHost") returned 14 [0074.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0074.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0074.720] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0074.720] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0074.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0074.720] lstrlenW (lpString="WdiSystemHost") returned 13 [0074.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0074.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0074.721] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0074.721] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0074.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0074.721] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0074.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0074.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0074.721] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0074.721] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0074.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0074.721] lstrlenW (lpString="Winmgmt") returned 7 [0074.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0074.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0074.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0074.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0074.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0074.721] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38446f0 | out: hHeap=0x8d0000) returned 1 [0074.721] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0074.724] Process32FirstW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0074.724] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0074.725] lstrlenW (lpString="System") returned 6 [0074.725] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0074.725] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0074.725] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0074.725] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0074.725] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0074.725] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0074.725] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0074.725] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0074.725] lstrlenW (lpString="smss.exe") returned 8 [0074.725] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0074.725] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0074.725] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0074.725] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0074.725] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0074.725] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0074.725] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0074.726] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.726] lstrlenW (lpString="csrss.exe") returned 9 [0074.726] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0074.726] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0074.726] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0074.726] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0074.726] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0074.726] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0074.727] lstrlenW (lpString="wininit.exe") returned 11 [0074.727] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0074.728] lstrlenW (lpString="csrss.exe") returned 9 [0074.728] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0074.728] lstrlenW (lpString="winlogon.exe") returned 12 [0074.728] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0074.729] lstrlenW (lpString="services.exe") returned 12 [0074.729] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0074.730] lstrlenW (lpString="lsass.exe") returned 9 [0074.730] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0074.730] lstrlenW (lpString="lsm.exe") returned 7 [0074.730] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.731] lstrlenW (lpString="svchost.exe") returned 11 [0074.731] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.731] lstrlenW (lpString="svchost.exe") returned 11 [0074.731] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.732] lstrlenW (lpString="svchost.exe") returned 11 [0074.732] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.733] lstrlenW (lpString="svchost.exe") returned 11 [0074.733] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.733] lstrlenW (lpString="svchost.exe") returned 11 [0074.733] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0074.734] lstrlenW (lpString="audiodg.exe") returned 11 [0074.734] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.734] lstrlenW (lpString="svchost.exe") returned 11 [0074.734] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.735] lstrlenW (lpString="svchost.exe") returned 11 [0074.735] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0074.735] lstrlenW (lpString="dwm.exe") returned 7 [0074.735] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0074.736] lstrlenW (lpString="explorer.exe") returned 12 [0074.736] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0074.736] lstrlenW (lpString="spoolsv.exe") returned 11 [0074.736] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0074.737] lstrlenW (lpString="taskhost.exe") returned 12 [0074.737] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.737] lstrlenW (lpString="svchost.exe") returned 11 [0074.738] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0074.738] lstrlenW (lpString="taskeng.exe") returned 11 [0074.738] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0074.739] lstrlenW (lpString="taskhost.exe") returned 12 [0074.739] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0074.739] lstrlenW (lpString="tested.exe") returned 10 [0074.739] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0074.740] lstrlenW (lpString="memories global commission.exe") returned 30 [0074.740] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0074.740] lstrlenW (lpString="destination.exe") returned 15 [0074.740] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0074.741] lstrlenW (lpString="rom.exe") returned 7 [0074.741] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0074.741] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0074.741] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0074.742] lstrlenW (lpString="appropriate worm.exe") returned 20 [0074.742] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0074.742] lstrlenW (lpString="arrival-testing.exe") returned 19 [0074.742] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0074.743] lstrlenW (lpString="san stories panels.exe") returned 22 [0074.743] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0074.749] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0074.749] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0074.749] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0074.749] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0074.750] lstrlenW (lpString="taught opt practice.exe") returned 23 [0074.750] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0074.750] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0074.750] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0074.751] lstrlenW (lpString="aka gap.exe") returned 11 [0074.751] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0074.751] lstrlenW (lpString="copied-mr.exe") returned 13 [0074.752] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0074.752] lstrlenW (lpString="proven.exe") returned 10 [0074.752] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0074.752] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0074.753] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0074.753] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0074.753] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0074.754] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0074.754] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0074.754] lstrlenW (lpString="acm.exe") returned 7 [0074.754] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0074.755] lstrlenW (lpString="fluid.exe") returned 9 [0074.755] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0074.755] lstrlenW (lpString="domain.exe") returned 10 [0074.755] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0074.756] lstrlenW (lpString="cult_wanna.exe") returned 14 [0074.756] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0074.756] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0074.756] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.757] lstrlenW (lpString="svchost.exe") returned 11 [0074.757] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0074.757] lstrlenW (lpString="1Black.exe") returned 10 [0074.757] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0074.758] lstrlenW (lpString="cmd.exe") returned 7 [0074.758] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0074.758] lstrlenW (lpString="conhost.exe") returned 11 [0074.758] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0074.759] lstrlenW (lpString="vssadmin.exe") returned 12 [0074.759] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0074.759] lstrlenW (lpString="VSSVC.exe") returned 9 [0074.759] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0074.760] lstrlenW (lpString="svchost.exe") returned 11 [0074.760] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0074.760] lstrlenW (lpString="sppsvc.exe") returned 10 [0074.760] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0074.761] lstrlenW (lpString="LogonUI.exe") returned 11 [0074.761] Process32NextW (in: hSnapshot=0x204, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0074.761] CloseHandle (hObject=0x204) returned 1 [0074.761] Sleep (dwMilliseconds=0x1f4) [0075.357] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x401b5c8 [0075.358] EnumServicesStatusExW (in: hSCManager=0x401b5c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0075.358] GetLastError () returned 0xea [0075.358] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1316) returned 0x38466f0 [0075.358] EnumServicesStatusExW (in: hSCManager=0x401b5c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38466f0, cbBufSize=0x1316, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38466f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0075.359] CloseServiceHandle (hSCObject=0x401b5c8) returned 1 [0075.359] lstrlenW (lpString="Appinfo") returned 7 [0075.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0075.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0075.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0075.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0075.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0075.359] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0075.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0075.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0075.359] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0075.359] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0075.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0075.359] lstrlenW (lpString="AudioSrv") returned 8 [0075.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0075.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0075.359] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0075.359] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0075.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0075.359] lstrlenW (lpString="BFE") returned 3 [0075.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0075.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0075.360] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0075.360] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0075.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0075.360] lstrlenW (lpString="CryptSvc") returned 8 [0075.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0075.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0075.360] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0075.360] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0075.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0075.360] lstrlenW (lpString="CscService") returned 10 [0075.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0075.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0075.360] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0075.360] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0075.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0075.360] lstrlenW (lpString="DcomLaunch") returned 10 [0075.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0075.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0075.360] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0075.360] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0075.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0075.360] lstrlenW (lpString="Dhcp") returned 4 [0075.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0075.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0075.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0075.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0075.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0075.360] lstrlenW (lpString="Dnscache") returned 8 [0075.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0075.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0075.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0075.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0075.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0075.360] lstrlenW (lpString="DPS") returned 3 [0075.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0075.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0075.361] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0075.361] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0075.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0075.361] lstrlenW (lpString="eventlog") returned 8 [0075.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0075.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0075.361] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0075.361] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0075.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0075.361] lstrlenW (lpString="EventSystem") returned 11 [0075.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0075.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0075.361] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0075.361] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0075.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0075.361] lstrlenW (lpString="FontCache") returned 9 [0075.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0075.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0075.361] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0075.361] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0075.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0075.361] lstrlenW (lpString="gpsvc") returned 5 [0075.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0075.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0075.361] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0075.361] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0075.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0075.361] lstrlenW (lpString="iphlpsvc") returned 8 [0075.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0075.361] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0075.361] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0075.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0075.362] lstrlenW (lpString="LanmanServer") returned 12 [0075.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0075.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0075.362] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0075.362] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0075.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0075.362] lstrlenW (lpString="LanmanWorkstation") returned 17 [0075.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0075.362] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0075.362] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0075.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0075.362] lstrlenW (lpString="lmhosts") returned 7 [0075.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0075.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0075.362] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0075.362] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0075.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0075.362] lstrlenW (lpString="MMCSS") returned 5 [0075.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0075.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0075.362] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0075.362] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0075.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0075.362] lstrlenW (lpString="MpsSvc") returned 6 [0075.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0075.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0075.362] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0075.362] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0075.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0075.362] lstrlenW (lpString="Netman") returned 6 [0075.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0075.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0075.363] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0075.363] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0075.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0075.363] lstrlenW (lpString="netprofm") returned 8 [0075.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0075.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0075.363] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0075.363] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0075.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0075.363] lstrlenW (lpString="NlaSvc") returned 6 [0075.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0075.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0075.363] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0075.363] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0075.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0075.363] lstrlenW (lpString="nsi") returned 3 [0075.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0075.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0075.363] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0075.363] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0075.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0075.363] lstrlenW (lpString="PcaSvc") returned 6 [0075.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0075.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0075.363] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0075.363] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0075.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0075.363] lstrlenW (lpString="PlugPlay") returned 8 [0075.363] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0075.363] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0075.363] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0075.363] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0075.363] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0075.364] lstrlenW (lpString="Power") returned 5 [0075.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0075.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0075.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0075.364] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0075.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0075.364] lstrlenW (lpString="ProfSvc") returned 7 [0075.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0075.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0075.364] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0075.364] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0075.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0075.364] lstrlenW (lpString="RpcEptMapper") returned 12 [0075.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0075.364] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0075.364] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0075.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0075.364] lstrlenW (lpString="RpcSs") returned 5 [0075.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0075.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0075.364] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0075.364] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0075.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0075.364] lstrlenW (lpString="SamSs") returned 5 [0075.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0075.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0075.364] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0075.364] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0075.364] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0075.364] lstrlenW (lpString="Schedule") returned 8 [0075.364] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0075.364] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0075.364] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0075.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0075.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0075.365] lstrlenW (lpString="SENS") returned 4 [0075.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0075.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0075.365] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0075.365] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0075.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0075.365] lstrlenW (lpString="ShellHWDetection") returned 16 [0075.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0075.365] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0075.365] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0075.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0075.365] lstrlenW (lpString="Spooler") returned 7 [0075.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0075.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0075.365] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0075.365] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0075.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0075.365] lstrlenW (lpString="sppsvc") returned 6 [0075.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="sppsvc") returned -1 [0075.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="sppsvc") returned -1 [0075.365] lstrcmpiW (lpString1="sqlwriter", lpString2="sppsvc") returned 1 [0075.365] lstrcmpiW (lpString1="mssqlserver", lpString2="sppsvc") returned -1 [0075.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="sppsvc") returned 1 [0075.365] lstrlenW (lpString="swprv") returned 5 [0075.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0075.365] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0075.365] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0075.365] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0075.365] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0075.365] lstrlenW (lpString="SysMain") returned 7 [0075.365] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0075.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0075.366] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0075.366] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0075.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0075.366] lstrlenW (lpString="Themes") returned 6 [0075.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0075.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0075.366] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0075.366] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0075.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0075.366] lstrlenW (lpString="TrkWks") returned 6 [0075.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0075.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0075.366] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0075.366] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0075.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0075.366] lstrlenW (lpString="UxSms") returned 5 [0075.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0075.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0075.366] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0075.366] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0075.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0075.366] lstrlenW (lpString="VSS") returned 3 [0075.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0075.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0075.366] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0075.366] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0075.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0075.366] lstrlenW (lpString="WdiServiceHost") returned 14 [0075.366] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0075.366] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0075.366] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0075.366] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0075.366] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0075.367] lstrlenW (lpString="WdiSystemHost") returned 13 [0075.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0075.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0075.367] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0075.367] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0075.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0075.367] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0075.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0075.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0075.367] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0075.367] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0075.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0075.367] lstrlenW (lpString="Winmgmt") returned 7 [0075.367] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0075.367] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0075.367] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0075.367] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0075.367] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0075.367] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38466f0 | out: hHeap=0x8d0000) returned 1 [0075.367] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e0 [0075.369] Process32FirstW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0075.370] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0075.370] lstrlenW (lpString="System") returned 6 [0075.370] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0075.370] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0075.370] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0075.370] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0075.370] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0075.370] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0075.370] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0075.370] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0075.371] lstrlenW (lpString="smss.exe") returned 8 [0075.371] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0075.371] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0075.371] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0075.371] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0075.371] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0075.371] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0075.371] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0075.371] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.372] lstrlenW (lpString="csrss.exe") returned 9 [0075.372] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0075.372] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0075.372] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0075.372] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0075.372] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0075.372] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0075.373] lstrlenW (lpString="wininit.exe") returned 11 [0075.373] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0075.373] lstrlenW (lpString="csrss.exe") returned 9 [0075.373] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0075.374] lstrlenW (lpString="winlogon.exe") returned 12 [0075.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0075.374] lstrlenW (lpString="services.exe") returned 12 [0075.374] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0075.375] lstrlenW (lpString="lsass.exe") returned 9 [0075.375] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0075.375] lstrlenW (lpString="lsm.exe") returned 7 [0075.375] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.376] lstrlenW (lpString="svchost.exe") returned 11 [0075.376] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x298, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.376] lstrlenW (lpString="svchost.exe") returned 11 [0075.376] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.377] lstrlenW (lpString="svchost.exe") returned 11 [0075.377] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x334, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.378] lstrlenW (lpString="svchost.exe") returned 11 [0075.378] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x36c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.378] lstrlenW (lpString="svchost.exe") returned 11 [0075.378] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0075.379] lstrlenW (lpString="audiodg.exe") returned 11 [0075.379] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.379] lstrlenW (lpString="svchost.exe") returned 11 [0075.379] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x124, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.380] lstrlenW (lpString="svchost.exe") returned 11 [0075.380] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x334, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0075.380] lstrlenW (lpString="dwm.exe") returned 7 [0075.380] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x45c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x440, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0075.381] lstrlenW (lpString="explorer.exe") returned 12 [0075.381] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x480, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0075.381] lstrlenW (lpString="spoolsv.exe") returned 11 [0075.381] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0075.382] lstrlenW (lpString="taskhost.exe") returned 12 [0075.382] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.382] lstrlenW (lpString="svchost.exe") returned 11 [0075.382] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x50c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x36c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0075.383] lstrlenW (lpString="taskeng.exe") returned 11 [0075.383] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x508, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0075.383] lstrlenW (lpString="taskhost.exe") returned 12 [0075.383] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x440, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="tested.exe")) returned 1 [0075.384] lstrlenW (lpString="tested.exe") returned 10 [0075.384] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="memories global commission.exe")) returned 1 [0075.384] lstrlenW (lpString="memories global commission.exe") returned 30 [0075.384] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="destination.exe")) returned 1 [0075.385] lstrlenW (lpString="destination.exe") returned 15 [0075.385] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x780, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="rom.exe")) returned 1 [0075.385] lstrlenW (lpString="rom.exe") returned 7 [0075.385] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="announcement detail nextel.exe")) returned 1 [0075.386] lstrlenW (lpString="announcement detail nextel.exe") returned 30 [0075.386] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x274, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="appropriate worm.exe")) returned 1 [0075.386] lstrlenW (lpString="appropriate worm.exe") returned 20 [0075.386] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x438, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="arrival-testing.exe")) returned 1 [0075.387] lstrlenW (lpString="arrival-testing.exe") returned 19 [0075.387] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x734, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="san stories panels.exe")) returned 1 [0075.388] lstrlenW (lpString="san stories panels.exe") returned 22 [0075.388] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="blackdnspersonals.exe")) returned 1 [0075.388] lstrlenW (lpString="blackdnspersonals.exe") returned 21 [0075.388] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="version angels enzyme.exe")) returned 1 [0075.389] lstrlenW (lpString="version angels enzyme.exe") returned 25 [0075.389] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="taught opt practice.exe")) returned 1 [0075.389] lstrlenW (lpString="taught opt practice.exe") returned 23 [0075.389] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="ok_bufing_i.exe")) returned 1 [0075.390] lstrlenW (lpString="ok_bufing_i.exe") returned 15 [0075.390] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x39c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="aka gap.exe")) returned 1 [0075.390] lstrlenW (lpString="aka gap.exe") returned 11 [0075.390] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="copied-mr.exe")) returned 1 [0075.391] lstrlenW (lpString="copied-mr.exe") returned 13 [0075.391] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="proven.exe")) returned 1 [0075.559] lstrlenW (lpString="proven.exe") returned 10 [0075.559] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2a8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="forgot_monitor.exe")) returned 1 [0075.873] lstrlenW (lpString="forgot_monitor.exe") returned 18 [0075.873] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x694, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fetish-commodity.exe")) returned 1 [0075.874] lstrlenW (lpString="fetish-commodity.exe") returned 20 [0075.874] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="click-debate-mw.exe")) returned 1 [0075.874] lstrlenW (lpString="click-debate-mw.exe") returned 19 [0075.874] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="acm.exe")) returned 1 [0075.875] lstrlenW (lpString="acm.exe") returned 7 [0075.875] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="fluid.exe")) returned 1 [0075.875] lstrlenW (lpString="fluid.exe") returned 9 [0075.875] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="domain.exe")) returned 1 [0075.876] lstrlenW (lpString="domain.exe") returned 10 [0075.876] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x794, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x45c, pcPriClassBase=8, dwFlags=0x0, szExeFile="cult_wanna.exe")) returned 1 [0075.877] lstrlenW (lpString="cult_wanna.exe") returned 14 [0075.877] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0075.877] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0075.877] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa44, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.878] lstrlenW (lpString="svchost.exe") returned 11 [0075.878] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa68, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x968, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0075.878] lstrlenW (lpString="1Black.exe") returned 10 [0075.878] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa78, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0xa68, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0075.879] lstrlenW (lpString="cmd.exe") returned 7 [0075.879] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa9c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0075.879] lstrlenW (lpString="conhost.exe") returned 11 [0075.879] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xad8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0xa78, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0075.880] lstrlenW (lpString="vssadmin.exe") returned 12 [0075.880] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0075.880] lstrlenW (lpString="VSSVC.exe") returned 9 [0075.880] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb48, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0075.881] lstrlenW (lpString="svchost.exe") returned 11 [0075.881] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="sppsvc.exe")) returned 1 [0075.881] lstrlenW (lpString="sppsvc.exe") returned 10 [0075.881] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0075.882] lstrlenW (lpString="LogonUI.exe") returned 11 [0075.882] Process32NextW (in: hSnapshot=0x1e0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xbb4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0075.882] CloseHandle (hObject=0x1e0) returned 1 [0075.882] Sleep (dwMilliseconds=0x1f4) Thread: id = 10 os_tid = 0xa84 [0046.500] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0046.500] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x904a78 | out: hHeap=0x8d0000) returned 1 Thread: id = 11 os_tid = 0xa88 [0046.501] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x904a78 [0046.501] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x904a78, Size=0x20) returned 0x905c98 [0046.501] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x905c98, Size=0x40) returned 0x906c78 [0046.501] GetLogicalDrives () returned 0x4 [0046.501] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x93e558 [0046.501] GetComputerNameW (in: lpBuffer=0x93e55c, nSize=0x239ff6c | out: lpBuffer="XDUWTFONO", nSize=0x239ff6c) returned 1 [0046.502] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1000) returned 0x94e560 [0046.502] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x239ff3c | out: lphEnum=0x239ff3c*=0x906228) returned 0x0 [0046.503] WNetEnumResourceW (in: hEnum=0x906228, lpcCount=0x239ff38, lpBuffer=0x94e560, lpBufferSize=0x239ff40 | out: lpcCount=0x239ff38, lpBuffer=0x94e560, lpBufferSize=0x239ff40) returned 0x103 [0046.503] WNetCloseEnum (hEnum=0x906228) returned 0x0 [0046.503] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x239ff3c | out: lphEnum=0x239ff3c*=0x3f12208) returned 0x0 [0049.413] WNetEnumResourceW (in: hEnum=0x3f12208, lpcCount=0x239ff38, lpBuffer=0x94e560, lpBufferSize=0x239ff40 | out: lpcCount=0x239ff38, lpBuffer=0x94e560, lpBufferSize=0x239ff40) returned 0x0 [0049.413] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1000) returned 0x3fe94c0 [0049.413] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x94e560, lphEnum=0x239ff10 | out: lphEnum=0x239ff10*=0x9063a8) returned 0x0 [0049.712] WNetEnumResourceW (in: hEnum=0x9063a8, lpcCount=0x239ff0c, lpBuffer=0x3fe94c0, lpBufferSize=0x239ff14 | out: lpcCount=0x239ff0c, lpBuffer=0x3fe94c0, lpBufferSize=0x239ff14) returned 0x103 [0049.712] WNetCloseEnum (hEnum=0x9063a8) returned 0x0 [0049.712] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1000) returned 0x3f54498 [0049.712] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x94e580, lphEnum=0x239ff10 | out: lphEnum=0x239ff10*=0x0) returned 0x4b8 [0067.651] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1000) returned 0x3ff6578 [0067.651] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x94e5a0, lphEnum=0x239ff10 | out: lphEnum=0x239ff10*=0x0) returned 0x4c6 [0067.826] WNetEnumResourceW (in: hEnum=0x3f12208, lpcCount=0x239ff38, lpBuffer=0x94e560, lpBufferSize=0x239ff40 | out: lpcCount=0x239ff38, lpBuffer=0x94e560, lpBufferSize=0x239ff40) returned 0x103 [0067.826] WNetCloseEnum (hEnum=0x3f12208) returned 0x0 [0067.826] GetLogicalDrives () returned 0x4 [0067.826] Sleep (dwMilliseconds=0x64) [0068.069] GetLogicalDrives () returned 0x4 [0068.069] Sleep (dwMilliseconds=0x64) [0069.166] GetLogicalDrives () returned 0x4 [0069.166] Sleep (dwMilliseconds=0x64) [0069.352] GetLogicalDrives () returned 0x4 [0069.352] Sleep (dwMilliseconds=0x64) [0069.781] GetLogicalDrives () returned 0x4 [0069.789] Sleep (dwMilliseconds=0x64) [0070.120] GetLogicalDrives () returned 0x4 [0070.120] Sleep (dwMilliseconds=0x64) [0070.381] GetLogicalDrives () returned 0x4 [0070.381] Sleep (dwMilliseconds=0x64) [0071.208] GetLogicalDrives () returned 0x4 [0071.208] Sleep (dwMilliseconds=0x64) [0071.447] GetLogicalDrives () returned 0x4 [0071.447] Sleep (dwMilliseconds=0x64) [0071.713] GetLogicalDrives () returned 0x4 [0071.713] Sleep (dwMilliseconds=0x64) [0071.875] GetLogicalDrives () returned 0x4 [0071.875] Sleep (dwMilliseconds=0x64) [0072.123] GetLogicalDrives () returned 0x4 [0072.123] Sleep (dwMilliseconds=0x64) [0072.286] GetLogicalDrives () returned 0x4 [0072.286] Sleep (dwMilliseconds=0x64) [0072.477] GetLogicalDrives () returned 0x4 [0072.477] Sleep (dwMilliseconds=0x64) [0072.626] GetLogicalDrives () returned 0x4 [0072.626] Sleep (dwMilliseconds=0x64) [0073.179] GetLogicalDrives () returned 0x4 [0073.180] Sleep (dwMilliseconds=0x64) [0073.839] GetLogicalDrives () returned 0x4 [0073.839] Sleep (dwMilliseconds=0x64) [0074.287] GetLogicalDrives () returned 0x4 [0074.287] Sleep (dwMilliseconds=0x64) [0074.443] GetLogicalDrives () returned 0x4 [0074.443] Sleep (dwMilliseconds=0x64) [0074.744] GetLogicalDrives () returned 0x4 [0074.744] Sleep (dwMilliseconds=0x64) [0075.024] GetLogicalDrives () returned 0x4 [0075.024] Sleep (dwMilliseconds=0x64) [0075.314] GetLogicalDrives () returned 0x4 [0075.314] Sleep (dwMilliseconds=0x64) [0075.560] GetLogicalDrives () returned 0x4 [0075.560] Sleep (dwMilliseconds=0x64) [0075.933] GetLogicalDrives () returned 0x4 [0075.933] Sleep (dwMilliseconds=0x64) [0076.245] GetLogicalDrives () returned 0x4 [0076.245] Sleep (dwMilliseconds=0x64) Thread: id = 12 os_tid = 0xa8c [0046.505] GetTickCount () returned 0x11460c6 [0046.505] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x24) returned 0x91bfa8 [0046.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x91bfa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x120 [0046.533] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x91bfa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0046.535] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x91bfa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0046.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x91bfa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0046.540] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920288 [0046.540] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920288, Size=0x20) returned 0x905c48 [0046.540] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920288 [0046.540] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920288, Size=0x20) returned 0x905bd0 [0046.588] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.033] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.033] Wow64DisableWow64FsRedirection (in: OldValue=0x24dff84 | out: OldValue=0x24dff84*=0x0) returned 1 [0047.033] lstrlenW (lpString="kernel32.dll") returned 12 [0047.033] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905c48 | out: hHeap=0x8d0000) returned 1 [0047.033] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.033] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905bd0 | out: hHeap=0x8d0000) returned 1 [0047.033] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x90b4e8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0047.034] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.239] GetTickCount () returned 0x114620e [0047.239] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.491] GetTickCount () returned 0x11462b9 [0047.491] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.652] GetTickCount () returned 0x1146365 [0047.652] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.018] GetTickCount () returned 0x1146430 [0048.018] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.357] GetTickCount () returned 0x1146587 [0048.357] GetTickCount () returned 0x1146587 [0048.357] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.723] GetTickCount () returned 0x11466ee [0048.723] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.017] GetTickCount () returned 0x1146816 [0049.017] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.305] GetTickCount () returned 0x114691f [0049.305] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.711] GetTickCount () returned 0x1146a29 [0049.711] GetTickCount () returned 0x1146a29 [0049.711] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.865] GetTickCount () returned 0x1146ac5 [0049.865] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.076] GetTickCount () returned 0x1146b70 [0050.076] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.367] GetTickCount () returned 0x1146c6a [0050.367] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.874] GetTickCount () returned 0x1146dd1 [0050.874] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.062] GetTickCount () returned 0x1146e8c [0051.062] GetTickCount () returned 0x1146e8c [0051.062] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.007] GetTickCount () returned 0x1147041 [0052.007] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.120] GetTickCount () returned 0x11470ae [0052.121] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.412] GetTickCount () returned 0x11471d6 [0052.412] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.581] GetTickCount () returned 0x1147282 [0052.581] GetTickCount () returned 0x1147282 [0052.581] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.764] GetTickCount () returned 0x114732d [0052.764] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.032] GetTickCount () returned 0x1147408 [0053.032] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.500] GetTickCount () returned 0x114759d [0053.500] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.941] GetTickCount () returned 0x1147752 [0053.941] GetTickCount () returned 0x1147752 [0053.941] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.203] GetTickCount () returned 0x114783c [0054.203] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.379] GetTickCount () returned 0x11478e8 [0054.379] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.665] GetTickCount () returned 0x11479e1 [0054.665] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.204] GetTickCount () returned 0x1147c03 [0055.204] GetTickCount () returned 0x1147c03 [0055.204] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.374] GetTickCount () returned 0x1147caf [0055.374] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.654] GetTickCount () returned 0x1147dc8 [0055.654] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.884] GetTickCount () returned 0x1147ea2 [0055.884] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.236] GetTickCount () returned 0x1147fda [0056.236] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.463] GetTickCount () returned 0x11480b5 [0056.463] GetTickCount () returned 0x11480b5 [0056.463] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.826] GetTickCount () returned 0x114822b [0056.826] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0057.229] GetTickCount () returned 0x11483a1 [0057.229] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0057.605] GetTickCount () returned 0x1148518 [0057.605] GetTickCount () returned 0x1148518 [0057.605] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0057.878] GetTickCount () returned 0x1148621 [0057.878] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.206] GetTickCount () returned 0x114871b [0058.206] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0058.652] GetTickCount () returned 0x11488c0 [0058.652] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.063] GetTickCount () returned 0x1148a55 [0059.063] GetTickCount () returned 0x1148a55 [0059.063] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.523] GetTickCount () returned 0x1148c29 [0059.523] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0059.853] GetTickCount () returned 0x1148d71 [0059.853] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.079] GetTickCount () returned 0x1148e4b [0060.079] GetTickCount () returned 0x1148e4b [0060.079] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.328] GetTickCount () returned 0x1148f45 [0060.328] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0060.583] GetTickCount () returned 0x114904e [0060.583] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.004] GetTickCount () returned 0x11491f4 [0061.004] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.196] GetTickCount () returned 0x11492af [0061.196] GetTickCount () returned 0x11492af [0061.196] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0061.374] GetTickCount () returned 0x11493b8 [0061.456] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.072] GetTickCount () returned 0x1149618 [0062.072] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.361] GetTickCount () returned 0x1149741 [0062.361] GetTickCount () returned 0x1149741 [0062.361] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0062.484] GetTickCount () returned 0x11497ae [0062.484] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0063.250] GetTickCount () returned 0x1149aba [0063.250] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0063.718] GetTickCount () returned 0x1149c8e [0063.718] GetTickCount () returned 0x1149c8e [0063.718] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.093] GetTickCount () returned 0x1149e04 [0064.093] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.413] GetTickCount () returned 0x1149f3c [0064.413] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.579] GetTickCount () returned 0x1149fe8 [0064.579] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0064.889] GetTickCount () returned 0x114a120 [0064.889] GetTickCount () returned 0x114a120 [0064.889] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.111] GetTickCount () returned 0x114a1fa [0065.111] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.351] GetTickCount () returned 0x114a2e4 [0065.351] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0065.890] GetTickCount () returned 0x114a506 [0065.890] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.257] GetTickCount () returned 0x114a66d [0066.258] GetTickCount () returned 0x114a66d [0066.258] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0066.776] GetTickCount () returned 0x114a880 [0066.776] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.359] GetTickCount () returned 0x114aac1 [0067.359] GetTickCount () returned 0x114aac1 [0067.359] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.604] GetTickCount () returned 0x114abba [0067.604] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0067.870] GetTickCount () returned 0x114acc4 [0067.876] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0068.069] GetTickCount () returned 0x114ad7f [0068.069] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0069.158] GetTickCount () returned 0x114b1c3 [0069.158] GetTickCount () returned 0x114b1c3 [0069.158] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0069.348] GetTickCount () returned 0x114b27e [0069.348] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0069.764] GetTickCount () returned 0x114b423 [0069.764] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.083] GetTickCount () returned 0x114b56b [0070.083] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.210] GetTickCount () returned 0x114b5e8 [0070.211] GetTickCount () returned 0x114b5e8 [0070.211] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0070.433] GetTickCount () returned 0x114b6c2 [0070.433] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.209] GetTickCount () returned 0x114b9ce [0071.209] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.446] GetTickCount () returned 0x114bab8 [0071.446] GetTickCount () returned 0x114bab8 [0071.447] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.713] GetTickCount () returned 0x114bbc1 [0071.713] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0071.875] GetTickCount () returned 0x114bc5d [0071.875] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.123] GetTickCount () returned 0x114bd57 [0072.123] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.286] GetTickCount () returned 0x114be02 [0072.286] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.477] GetTickCount () returned 0x114bebe [0072.477] GetTickCount () returned 0x114bebe [0072.477] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0072.626] GetTickCount () returned 0x114bf5a [0072.626] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.180] GetTickCount () returned 0x114c17c [0073.180] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0073.839] GetTickCount () returned 0x114c40b [0073.839] GetTickCount () returned 0x114c40b [0073.840] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0074.287] GetTickCount () returned 0x114c5cf [0074.287] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0074.444] GetTickCount () returned 0x114c66b [0074.444] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0074.743] GetTickCount () returned 0x114c794 [0074.743] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0075.023] GetTickCount () returned 0x114c8ac [0075.023] GetTickCount () returned 0x114c8ac [0075.023] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0075.314] GetTickCount () returned 0x114c9d5 [0075.314] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0075.559] GetTickCount () returned 0x114cace [0075.559] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0075.933] GetTickCount () returned 0x114cc45 [0075.933] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0076.221] GetTickCount () returned 0x114cd5e [0076.221] GetTickCount () returned 0x114cd5e [0076.221] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 13 os_tid = 0xa90 [0046.505] GetTickCount () returned 0x11460c6 [0046.505] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x24) returned 0x92b450 [0046.505] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x92b450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0046.534] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x92b450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0046.536] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x92b450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0046.538] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x92b450, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0046.592] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920288 [0046.592] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920288, Size=0x20) returned 0x905cc0 [0046.592] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920288 [0046.592] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920288, Size=0x20) returned 0x905ce8 [0046.592] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.012] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.012] Wow64DisableWow64FsRedirection (in: OldValue=0x261ff84 | out: OldValue=0x261ff84*=0x0) returned 1 [0047.012] lstrlenW (lpString="kernel32.dll") returned 12 [0047.012] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905cc0 | out: hHeap=0x8d0000) returned 1 [0047.012] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.013] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905ce8 | out: hHeap=0x8d0000) returned 1 [0047.013] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x92d4f8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0047.015] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0047.229] GetTickCount () returned 0x114620e [0047.229] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0047.475] GetTickCount () returned 0x11462aa [0047.475] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0047.625] GetTickCount () returned 0x1146346 [0047.625] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0048.018] GetTickCount () returned 0x1146430 [0048.018] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0048.356] GetTickCount () returned 0x1146587 [0048.356] GetTickCount () returned 0x1146587 [0048.356] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0048.723] GetTickCount () returned 0x11466ee [0048.723] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0049.017] GetTickCount () returned 0x1146816 [0049.017] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0049.305] GetTickCount () returned 0x114691f [0049.305] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0049.711] GetTickCount () returned 0x1146a29 [0049.711] GetTickCount () returned 0x1146a29 [0049.711] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0049.865] GetTickCount () returned 0x1146ac5 [0049.865] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0050.076] GetTickCount () returned 0x1146b70 [0050.076] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0050.367] GetTickCount () returned 0x1146c6a [0050.367] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0050.874] GetTickCount () returned 0x1146dd1 [0050.874] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0051.062] GetTickCount () returned 0x1146e8c [0051.062] GetTickCount () returned 0x1146e8c [0051.062] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0052.007] GetTickCount () returned 0x1147041 [0052.007] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0052.121] GetTickCount () returned 0x11470ae [0052.121] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0052.413] GetTickCount () returned 0x11471d6 [0052.413] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0052.581] GetTickCount () returned 0x1147282 [0052.581] GetTickCount () returned 0x1147282 [0052.581] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0052.765] GetTickCount () returned 0x114732d [0052.765] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0053.032] GetTickCount () returned 0x1147408 [0053.032] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0053.500] GetTickCount () returned 0x114759d [0053.500] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0053.941] GetTickCount () returned 0x1147752 [0053.941] GetTickCount () returned 0x1147752 [0053.941] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0054.203] GetTickCount () returned 0x114783c [0054.203] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0054.379] GetTickCount () returned 0x11478e8 [0054.379] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0054.665] GetTickCount () returned 0x11479e1 [0054.665] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0055.204] GetTickCount () returned 0x1147c03 [0055.204] GetTickCount () returned 0x1147c03 [0055.204] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0055.374] GetTickCount () returned 0x1147caf [0055.374] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0055.654] GetTickCount () returned 0x1147dc8 [0055.654] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0055.884] GetTickCount () returned 0x1147ea2 [0055.884] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0056.237] GetTickCount () returned 0x1147fda [0056.237] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0056.463] GetTickCount () returned 0x11480b5 [0056.463] GetTickCount () returned 0x11480b5 [0056.463] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0056.826] GetTickCount () returned 0x114822b [0056.826] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0057.229] GetTickCount () returned 0x11483a1 [0057.229] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0057.605] GetTickCount () returned 0x1148518 [0057.605] GetTickCount () returned 0x1148518 [0057.605] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0057.879] GetTickCount () returned 0x1148621 [0057.879] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0058.206] GetTickCount () returned 0x114871b [0058.206] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0058.652] GetTickCount () returned 0x11488c0 [0058.653] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0059.063] GetTickCount () returned 0x1148a55 [0059.063] GetTickCount () returned 0x1148a55 [0059.063] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0059.523] GetTickCount () returned 0x1148c29 [0059.523] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0059.853] GetTickCount () returned 0x1148d71 [0059.853] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0060.072] GetTickCount () returned 0x1148e4b [0060.079] GetTickCount () returned 0x1148e4b [0060.079] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0060.328] GetTickCount () returned 0x1148f45 [0060.328] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0060.582] GetTickCount () returned 0x114904e [0060.582] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0061.004] GetTickCount () returned 0x11491f4 [0061.004] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0061.196] GetTickCount () returned 0x11492af [0061.196] GetTickCount () returned 0x11492af [0061.196] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0061.341] GetTickCount () returned 0x114933b [0061.341] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0061.540] GetTickCount () returned 0x1149406 [0061.540] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0062.073] GetTickCount () returned 0x1149618 [0062.073] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0062.362] GetTickCount () returned 0x1149741 [0062.362] GetTickCount () returned 0x1149741 [0062.362] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0062.484] GetTickCount () returned 0x11497ae [0062.484] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0063.250] GetTickCount () returned 0x1149aba [0063.250] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0063.719] GetTickCount () returned 0x1149c8e [0063.719] GetTickCount () returned 0x1149c8e [0063.719] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0064.093] GetTickCount () returned 0x1149e04 [0064.093] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0064.413] GetTickCount () returned 0x1149f3c [0064.413] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0064.579] GetTickCount () returned 0x1149fe8 [0064.579] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0064.888] GetTickCount () returned 0x114a120 [0064.888] GetTickCount () returned 0x114a120 [0064.888] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0065.111] GetTickCount () returned 0x114a1fa [0065.111] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0065.351] GetTickCount () returned 0x114a2e4 [0065.351] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0065.881] GetTickCount () returned 0x114a4f7 [0065.884] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0066.257] GetTickCount () returned 0x114a66d [0066.257] GetTickCount () returned 0x114a66d [0066.257] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0066.775] GetTickCount () returned 0x114a870 [0066.775] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0067.359] GetTickCount () returned 0x114aac1 [0067.359] GetTickCount () returned 0x114aac1 [0067.359] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0067.604] GetTickCount () returned 0x114abba [0067.604] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0067.914] GetTickCount () returned 0x114acf2 [0067.915] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0068.131] GetTickCount () returned 0x114adbd [0068.132] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0069.201] GetTickCount () returned 0x114b1f2 [0069.201] GetTickCount () returned 0x114b1f2 [0069.201] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0069.359] GetTickCount () returned 0x114b28e [0069.359] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0069.781] GetTickCount () returned 0x114b433 [0069.781] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0070.083] GetTickCount () returned 0x114b56b [0070.083] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0070.211] GetTickCount () returned 0x114b5e8 [0070.211] GetTickCount () returned 0x114b5e8 [0070.211] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0070.433] GetTickCount () returned 0x114b6c2 [0070.433] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0071.209] GetTickCount () returned 0x114b9ce [0071.209] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0071.447] GetTickCount () returned 0x114bab8 [0071.447] GetTickCount () returned 0x114bab8 [0071.447] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0071.713] GetTickCount () returned 0x114bbc1 [0071.713] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0071.875] GetTickCount () returned 0x114bc5d [0071.875] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0072.123] GetTickCount () returned 0x114bd57 [0072.123] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0072.286] GetTickCount () returned 0x114be02 [0072.286] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0072.477] GetTickCount () returned 0x114bebe [0072.477] GetTickCount () returned 0x114bebe [0072.477] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0072.626] GetTickCount () returned 0x114bf5a [0072.626] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0073.180] GetTickCount () returned 0x114c17c [0073.180] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0073.839] GetTickCount () returned 0x114c40b [0073.839] GetTickCount () returned 0x114c40b [0073.839] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0074.287] GetTickCount () returned 0x114c5cf [0074.287] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0074.443] GetTickCount () returned 0x114c66b [0074.444] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0074.744] GetTickCount () returned 0x114c794 [0074.744] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0075.023] GetTickCount () returned 0x114c8ac [0075.023] GetTickCount () returned 0x114c8ac [0075.024] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0075.314] GetTickCount () returned 0x114c9d5 [0075.314] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0075.559] GetTickCount () returned 0x114cace [0075.559] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0075.933] GetTickCount () returned 0x114cc45 [0075.933] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) returned 0x102 [0076.229] GetTickCount () returned 0x114cd5e [0076.229] GetTickCount () returned 0x114cd5e [0076.229] WaitForSingleObject (hHandle=0x138, dwMilliseconds=0x64) Thread: id = 14 os_tid = 0xa94 [0047.014] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x9502c0 [0047.014] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x9602c8 [0047.014] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920330 [0047.014] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x6) returned 0x90a3b0 [0047.014] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920348 [0047.014] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x3420020 [0047.014] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920360 [0047.014] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920360, Size=0x20) returned 0x905ce8 [0047.014] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920360 [0047.014] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920360, Size=0x20) returned 0x905cc0 [0047.015] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.015] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.015] Wow64DisableWow64FsRedirection (in: OldValue=0x229ff58 | out: OldValue=0x229ff58*=0x0) returned 1 [0047.015] lstrlenW (lpString="kernel32.dll") returned 12 [0047.015] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905ce8 | out: hHeap=0x8d0000) returned 1 [0047.015] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.015] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905cc0 | out: hHeap=0x8d0000) returned 1 [0047.015] Sleep (dwMilliseconds=0x64) [0047.229] Sleep (dwMilliseconds=0x64) [0047.437] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0047.437] lstrlenW (lpString="desktop.ini") returned 11 [0047.437] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.437] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=129) returned 1 [0047.438] CloseHandle (hObject=0x164) returned 1 [0047.438] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0047.438] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.438] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.438] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.438] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.438] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0047.439] GetLastError () returned 0x0 [0047.439] ReadFile (in: hFile=0x164, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x81, lpOverlapped=0x0) returned 1 [0047.452] WriteFile (in: hFile=0x168, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x90, lpOverlapped=0x0) returned 1 [0047.453] ReadFile (in: hFile=0x164, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.453] WriteFile (in: hFile=0x168, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.453] SetEndOfFile (hFile=0x168) returned 1 [0047.454] CloseHandle (hObject=0x168) returned 1 [0047.455] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.455] SetEndOfFile (hFile=0x164) returned 1 [0047.456] CloseHandle (hObject=0x164) returned 1 [0047.456] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x26) returned 1 [0047.456] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0047.457] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.457] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.457] lstrlenW (lpString=".doc") returned 4 [0047.457] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0047.457] lstrlenW (lpString=".docx") returned 5 [0047.457] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0047.457] lstrlenW (lpString=".pdf") returned 4 [0047.457] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0047.457] lstrlenW (lpString=".xls") returned 4 [0047.457] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0047.457] lstrlenW (lpString=".xlsx") returned 5 [0047.457] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0047.457] lstrlenW (lpString=".ppt") returned 4 [0047.457] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0047.457] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.457] lstrlenW (lpString=".zip") returned 4 [0047.457] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0047.457] lstrlenW (lpString=".rar") returned 4 [0047.457] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0047.457] lstrlenW (lpString=".bz2") returned 4 [0047.457] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0047.457] lstrlenW (lpString=".7z") returned 3 [0047.457] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0047.457] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.457] lstrlenW (lpString=".dbf") returned 4 [0047.457] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0047.457] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.457] lstrlenW (lpString=".1cd") returned 4 [0047.457] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0047.457] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.457] lstrlenW (lpString=".jpg") returned 4 [0047.457] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0047.458] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.458] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.458] lstrlenW (lpString=".doc") returned 4 [0047.458] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0047.458] lstrlenW (lpString=".docx") returned 5 [0047.458] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0047.458] lstrlenW (lpString=".pdf") returned 4 [0047.458] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0047.458] lstrlenW (lpString=".xls") returned 4 [0047.458] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0047.458] lstrlenW (lpString=".xlsx") returned 5 [0047.458] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0047.458] lstrlenW (lpString=".ppt") returned 4 [0047.458] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0047.458] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.458] lstrlenW (lpString=".zip") returned 4 [0047.458] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0047.458] lstrlenW (lpString=".rar") returned 4 [0047.458] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0047.458] lstrlenW (lpString=".bz2") returned 4 [0047.458] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0047.458] lstrlenW (lpString=".7z") returned 3 [0047.458] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0047.458] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.458] lstrlenW (lpString=".dbf") returned 4 [0047.458] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0047.458] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.458] lstrlenW (lpString=".1cd") returned 4 [0047.458] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0047.458] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.458] lstrlenW (lpString=".jpg") returned 4 [0047.458] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0047.459] lstrcmpiW (lpString1=".LOG", lpString2=".wiki") returned -1 [0047.459] lstrlenW (lpString="BCD.LOG") returned 7 [0047.459] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.459] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.459] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.459] lstrlenW (lpString=".doc") returned 4 [0047.459] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0047.459] lstrlenW (lpString=".docx") returned 5 [0047.459] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0047.459] lstrlenW (lpString=".pdf") returned 4 [0047.459] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0047.459] lstrlenW (lpString=".xls") returned 4 [0047.459] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0047.459] lstrlenW (lpString=".xlsx") returned 5 [0047.459] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0047.459] lstrlenW (lpString=".ppt") returned 4 [0047.459] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0047.459] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.459] lstrlenW (lpString=".zip") returned 4 [0047.459] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0047.459] lstrlenW (lpString=".rar") returned 4 [0047.459] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0047.459] lstrlenW (lpString=".bz2") returned 4 [0047.459] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0047.459] lstrlenW (lpString=".7z") returned 3 [0047.459] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0047.459] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.459] lstrlenW (lpString=".dbf") returned 4 [0047.460] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0047.460] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.460] lstrlenW (lpString=".1cd") returned 4 [0047.460] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0047.460] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.460] lstrlenW (lpString=".jpg") returned 4 [0047.460] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0047.460] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.460] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.460] lstrlenW (lpString=".doc") returned 4 [0047.460] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0047.460] lstrlenW (lpString=".docx") returned 5 [0047.460] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0047.460] lstrlenW (lpString=".pdf") returned 4 [0047.460] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0047.460] lstrlenW (lpString=".xls") returned 4 [0047.460] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0047.460] lstrlenW (lpString=".xlsx") returned 5 [0047.460] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0047.460] lstrlenW (lpString=".ppt") returned 4 [0047.460] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0047.460] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.460] lstrlenW (lpString=".zip") returned 4 [0047.460] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0047.460] lstrlenW (lpString=".rar") returned 4 [0047.460] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0047.460] lstrlenW (lpString=".bz2") returned 4 [0047.460] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0047.460] lstrlenW (lpString=".7z") returned 3 [0047.460] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0047.460] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.460] lstrlenW (lpString=".dbf") returned 4 [0047.460] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0047.461] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.461] lstrlenW (lpString=".1cd") returned 4 [0047.461] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0047.461] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0047.461] lstrlenW (lpString=".jpg") returned 4 [0047.461] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0047.461] lstrcmpiW (lpString1=".DAT", lpString2=".wiki") returned -1 [0047.461] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0047.461] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.461] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=65536) returned 1 [0047.461] CloseHandle (hObject=0x164) returned 1 [0047.462] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0047.462] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.462] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.462] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.462] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.462] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0047.462] GetLastError () returned 0x0 [0047.462] ReadFile (in: hFile=0x164, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x10000, lpOverlapped=0x0) returned 1 [0047.465] WriteFile (in: hFile=0x168, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0047.467] ReadFile (in: hFile=0x164, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.467] WriteFile (in: hFile=0x168, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.467] SetEndOfFile (hFile=0x168) returned 1 [0047.467] CloseHandle (hObject=0x168) returned 1 [0047.469] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.469] SetEndOfFile (hFile=0x164) returned 1 [0047.470] CloseHandle (hObject=0x164) returned 1 [0047.471] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x26) returned 1 [0047.471] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0047.471] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.471] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.471] lstrlenW (lpString=".doc") returned 4 [0047.471] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0047.471] lstrlenW (lpString=".docx") returned 5 [0047.471] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0047.471] lstrlenW (lpString=".pdf") returned 4 [0047.471] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0047.471] lstrlenW (lpString=".xls") returned 4 [0047.471] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0047.471] lstrlenW (lpString=".xlsx") returned 5 [0047.471] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0047.471] lstrlenW (lpString=".ppt") returned 4 [0047.471] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0047.471] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.471] lstrlenW (lpString=".zip") returned 4 [0047.471] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0047.471] lstrlenW (lpString=".rar") returned 4 [0047.472] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0047.472] lstrlenW (lpString=".bz2") returned 4 [0047.472] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0047.472] lstrlenW (lpString=".7z") returned 3 [0047.472] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0047.472] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.472] lstrlenW (lpString=".dbf") returned 4 [0047.472] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0047.472] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.472] lstrlenW (lpString=".1cd") returned 4 [0047.472] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0047.472] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.472] lstrlenW (lpString=".jpg") returned 4 [0047.472] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0047.472] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.472] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.472] lstrlenW (lpString=".doc") returned 4 [0047.472] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0047.472] lstrlenW (lpString=".docx") returned 5 [0047.472] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0047.472] lstrlenW (lpString=".pdf") returned 4 [0047.472] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0047.472] lstrlenW (lpString=".xls") returned 4 [0047.472] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0047.472] lstrlenW (lpString=".xlsx") returned 5 [0047.472] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0047.472] lstrlenW (lpString=".ppt") returned 4 [0047.472] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0047.472] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.472] lstrlenW (lpString=".zip") returned 4 [0047.472] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0047.473] lstrlenW (lpString=".rar") returned 4 [0047.473] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0047.473] lstrlenW (lpString=".bz2") returned 4 [0047.473] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0047.473] lstrlenW (lpString=".7z") returned 3 [0047.473] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0047.473] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.473] lstrlenW (lpString=".dbf") returned 4 [0047.473] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0047.473] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.473] lstrlenW (lpString=".1cd") returned 4 [0047.473] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0047.473] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0047.473] lstrlenW (lpString=".jpg") returned 4 [0047.473] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0047.473] Sleep (dwMilliseconds=0x64) [0047.572] Sleep (dwMilliseconds=0x64) [0047.751] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0047.751] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0047.751] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.752] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1450) returned 1 [0047.752] CloseHandle (hObject=0x164) returned 1 [0047.752] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0047.752] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.752] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.752] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.752] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.752] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.753] GetLastError () returned 0x0 [0047.753] ReadFile (in: hFile=0x164, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0047.755] WriteFile (in: hFile=0x178, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0047.756] ReadFile (in: hFile=0x164, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.756] WriteFile (in: hFile=0x178, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0047.756] SetEndOfFile (hFile=0x178) returned 1 [0047.756] CloseHandle (hObject=0x178) returned 1 [0047.757] SetFilePointerEx (in: hFile=0x164, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.757] SetEndOfFile (hFile=0x164) returned 1 [0047.758] CloseHandle (hObject=0x164) returned 1 [0047.758] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0047.758] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0047.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.759] lstrlenW (lpString=".doc") returned 4 [0047.759] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.759] lstrlenW (lpString=".docx") returned 5 [0047.759] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0047.759] lstrlenW (lpString=".pdf") returned 4 [0047.759] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.759] lstrlenW (lpString=".xls") returned 4 [0047.759] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.759] lstrlenW (lpString=".xlsx") returned 5 [0047.759] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0047.759] lstrlenW (lpString=".ppt") returned 4 [0047.759] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.759] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.759] lstrlenW (lpString=".zip") returned 4 [0047.759] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.759] lstrlenW (lpString=".rar") returned 4 [0047.759] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.863] lstrlenW (lpString=".bz2") returned 4 [0047.863] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.863] lstrlenW (lpString=".7z") returned 3 [0047.863] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.863] lstrlenW (lpString=".dbf") returned 4 [0047.863] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.863] lstrlenW (lpString=".1cd") returned 4 [0047.863] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.863] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.863] lstrlenW (lpString=".jpg") returned 4 [0047.863] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.864] lstrlenW (lpString=".doc") returned 4 [0047.864] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.864] lstrlenW (lpString=".docx") returned 5 [0047.864] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0047.864] lstrlenW (lpString=".pdf") returned 4 [0047.864] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.864] lstrlenW (lpString=".xls") returned 4 [0047.864] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.864] lstrlenW (lpString=".xlsx") returned 5 [0047.864] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0047.864] lstrlenW (lpString=".ppt") returned 4 [0047.864] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.864] lstrlenW (lpString=".zip") returned 4 [0047.864] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.864] lstrlenW (lpString=".rar") returned 4 [0047.864] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.864] lstrlenW (lpString=".bz2") returned 4 [0047.864] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.864] lstrlenW (lpString=".7z") returned 3 [0047.864] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.864] lstrlenW (lpString=".dbf") returned 4 [0047.864] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.864] lstrlenW (lpString=".1cd") returned 4 [0047.864] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0047.864] lstrlenW (lpString=".jpg") returned 4 [0047.864] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.865] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0047.865] lstrlenW (lpString="Setup.xml") returned 9 [0047.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.865] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1886) returned 1 [0047.865] CloseHandle (hObject=0x180) returned 1 [0047.865] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.865] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.865] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.865] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.865] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.866] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.866] GetLastError () returned 0x0 [0047.866] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x75e, lpOverlapped=0x0) returned 1 [0047.867] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x760, lpOverlapped=0x0) returned 1 [0047.868] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.869] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.869] SetEndOfFile (hFile=0x184) returned 1 [0047.869] CloseHandle (hObject=0x184) returned 1 [0047.871] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.871] SetEndOfFile (hFile=0x180) returned 1 [0047.871] CloseHandle (hObject=0x180) returned 1 [0047.872] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0047.872] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.872] lstrlenW (lpString=".doc") returned 4 [0047.872] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.872] lstrlenW (lpString=".docx") returned 5 [0047.872] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0047.872] lstrlenW (lpString=".pdf") returned 4 [0047.872] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.872] lstrlenW (lpString=".xls") returned 4 [0047.872] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.872] lstrlenW (lpString=".xlsx") returned 5 [0047.872] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0047.872] lstrlenW (lpString=".ppt") returned 4 [0047.872] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.872] lstrlenW (lpString=".zip") returned 4 [0047.872] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.872] lstrlenW (lpString=".rar") returned 4 [0047.873] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.873] lstrlenW (lpString=".bz2") returned 4 [0047.873] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.873] lstrlenW (lpString=".7z") returned 3 [0047.873] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.873] lstrlenW (lpString=".dbf") returned 4 [0047.873] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.873] lstrlenW (lpString=".1cd") returned 4 [0047.873] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.873] lstrlenW (lpString=".jpg") returned 4 [0047.873] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.873] lstrlenW (lpString=".doc") returned 4 [0047.873] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.873] lstrlenW (lpString=".docx") returned 5 [0047.873] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0047.873] lstrlenW (lpString=".pdf") returned 4 [0047.873] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.873] lstrlenW (lpString=".xls") returned 4 [0047.873] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.873] lstrlenW (lpString=".xlsx") returned 5 [0047.873] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0047.873] lstrlenW (lpString=".ppt") returned 4 [0047.873] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.873] lstrlenW (lpString=".zip") returned 4 [0047.873] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.873] lstrlenW (lpString=".rar") returned 4 [0047.874] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.874] lstrlenW (lpString=".bz2") returned 4 [0047.874] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.874] lstrlenW (lpString=".7z") returned 3 [0047.874] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.874] lstrlenW (lpString=".dbf") returned 4 [0047.874] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.874] lstrlenW (lpString=".1cd") returned 4 [0047.874] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.874] lstrlenW (lpString=".jpg") returned 4 [0047.874] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.874] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0047.874] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0047.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.876] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1450) returned 1 [0047.876] CloseHandle (hObject=0x180) returned 1 [0047.876] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0047.876] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.876] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.876] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.876] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.876] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.876] GetLastError () returned 0x0 [0047.876] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0047.878] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0047.879] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.879] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0047.879] SetEndOfFile (hFile=0x184) returned 1 [0047.879] CloseHandle (hObject=0x184) returned 1 [0047.880] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.880] SetEndOfFile (hFile=0x180) returned 1 [0047.881] CloseHandle (hObject=0x180) returned 1 [0047.881] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0047.881] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0047.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.881] lstrlenW (lpString=".doc") returned 4 [0047.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.881] lstrlenW (lpString=".docx") returned 5 [0047.881] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0047.881] lstrlenW (lpString=".pdf") returned 4 [0047.881] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.881] lstrlenW (lpString=".xls") returned 4 [0047.881] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.881] lstrlenW (lpString=".xlsx") returned 5 [0047.881] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0047.881] lstrlenW (lpString=".ppt") returned 4 [0047.881] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.882] lstrlenW (lpString=".zip") returned 4 [0047.882] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.882] lstrlenW (lpString=".rar") returned 4 [0047.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.882] lstrlenW (lpString=".bz2") returned 4 [0047.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.882] lstrlenW (lpString=".7z") returned 3 [0047.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.882] lstrlenW (lpString=".dbf") returned 4 [0047.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.882] lstrlenW (lpString=".1cd") returned 4 [0047.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.882] lstrlenW (lpString=".jpg") returned 4 [0047.882] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.882] lstrlenW (lpString=".doc") returned 4 [0047.882] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.882] lstrlenW (lpString=".docx") returned 5 [0047.882] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0047.882] lstrlenW (lpString=".pdf") returned 4 [0047.882] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.882] lstrlenW (lpString=".xls") returned 4 [0047.882] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.882] lstrlenW (lpString=".xlsx") returned 5 [0047.882] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0047.882] lstrlenW (lpString=".ppt") returned 4 [0047.882] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.882] lstrlenW (lpString=".zip") returned 4 [0047.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.883] lstrlenW (lpString=".rar") returned 4 [0047.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.883] lstrlenW (lpString=".bz2") returned 4 [0047.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.883] lstrlenW (lpString=".7z") returned 3 [0047.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.883] lstrlenW (lpString=".dbf") returned 4 [0047.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.883] lstrlenW (lpString=".1cd") returned 4 [0047.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0047.883] lstrlenW (lpString=".jpg") returned 4 [0047.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.883] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0047.883] lstrlenW (lpString="Setup.xml") returned 9 [0047.883] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.883] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1608) returned 1 [0047.883] CloseHandle (hObject=0x180) returned 1 [0047.884] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.884] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.884] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.884] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.884] GetLastError () returned 0x0 [0047.884] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x648, lpOverlapped=0x0) returned 1 [0047.886] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x650, lpOverlapped=0x0) returned 1 [0047.887] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.887] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.887] SetEndOfFile (hFile=0x184) returned 1 [0047.887] CloseHandle (hObject=0x184) returned 1 [0047.887] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.887] SetEndOfFile (hFile=0x180) returned 1 [0047.888] CloseHandle (hObject=0x180) returned 1 [0047.888] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0047.888] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0047.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.889] lstrlenW (lpString=".doc") returned 4 [0047.889] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.889] lstrlenW (lpString=".docx") returned 5 [0047.889] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0047.889] lstrlenW (lpString=".pdf") returned 4 [0047.889] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.889] lstrlenW (lpString=".xls") returned 4 [0047.889] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.889] lstrlenW (lpString=".xlsx") returned 5 [0047.889] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0047.889] lstrlenW (lpString=".ppt") returned 4 [0047.889] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.889] lstrlenW (lpString=".zip") returned 4 [0047.889] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.889] lstrlenW (lpString=".rar") returned 4 [0047.889] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.889] lstrlenW (lpString=".bz2") returned 4 [0047.889] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.889] lstrlenW (lpString=".7z") returned 3 [0047.889] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.889] lstrlenW (lpString=".dbf") returned 4 [0047.889] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.889] lstrlenW (lpString=".1cd") returned 4 [0047.889] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.890] lstrlenW (lpString=".jpg") returned 4 [0047.890] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.890] lstrlenW (lpString=".doc") returned 4 [0047.890] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.890] lstrlenW (lpString=".docx") returned 5 [0047.890] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0047.890] lstrlenW (lpString=".pdf") returned 4 [0047.890] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.890] lstrlenW (lpString=".xls") returned 4 [0047.890] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.890] lstrlenW (lpString=".xlsx") returned 5 [0047.890] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0047.890] lstrlenW (lpString=".ppt") returned 4 [0047.890] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.890] lstrlenW (lpString=".zip") returned 4 [0047.890] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.890] lstrlenW (lpString=".rar") returned 4 [0047.890] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.890] lstrlenW (lpString=".bz2") returned 4 [0047.890] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.890] lstrlenW (lpString=".7z") returned 3 [0047.890] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.890] lstrlenW (lpString=".dbf") returned 4 [0047.890] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.890] lstrlenW (lpString=".1cd") returned 4 [0047.890] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0047.891] lstrlenW (lpString=".jpg") returned 4 [0047.891] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.891] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0047.891] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0047.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.892] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3186) returned 1 [0047.892] CloseHandle (hObject=0x180) returned 1 [0047.892] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0047.892] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.892] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.892] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0047.892] GetLastError () returned 0x0 [0047.892] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xc72, lpOverlapped=0x0) returned 1 [0047.894] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0047.895] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.895] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0047.895] SetEndOfFile (hFile=0x184) returned 1 [0047.895] CloseHandle (hObject=0x184) returned 1 [0047.896] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.896] SetEndOfFile (hFile=0x180) returned 1 [0047.896] CloseHandle (hObject=0x180) returned 1 [0047.897] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0047.897] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0047.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.897] lstrlenW (lpString=".doc") returned 4 [0047.897] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.897] lstrlenW (lpString=".docx") returned 5 [0047.897] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0047.897] lstrlenW (lpString=".pdf") returned 4 [0047.897] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.897] lstrlenW (lpString=".xls") returned 4 [0047.897] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.897] lstrlenW (lpString=".xlsx") returned 5 [0047.897] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0047.897] lstrlenW (lpString=".ppt") returned 4 [0047.897] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.897] lstrlenW (lpString=".zip") returned 4 [0047.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.897] lstrlenW (lpString=".rar") returned 4 [0047.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.897] lstrlenW (lpString=".bz2") returned 4 [0047.898] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.898] lstrlenW (lpString=".7z") returned 3 [0047.898] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.898] lstrlenW (lpString=".dbf") returned 4 [0047.898] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.898] lstrlenW (lpString=".1cd") returned 4 [0047.898] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.898] lstrlenW (lpString=".jpg") returned 4 [0047.898] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.898] lstrlenW (lpString=".doc") returned 4 [0047.898] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0047.898] lstrlenW (lpString=".docx") returned 5 [0047.898] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0047.898] lstrlenW (lpString=".pdf") returned 4 [0047.898] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0047.898] lstrlenW (lpString=".xls") returned 4 [0047.898] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0047.898] lstrlenW (lpString=".xlsx") returned 5 [0047.898] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0047.898] lstrlenW (lpString=".ppt") returned 4 [0047.898] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0047.898] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.898] lstrlenW (lpString=".zip") returned 4 [0047.898] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0047.898] lstrlenW (lpString=".rar") returned 4 [0047.898] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0047.898] lstrlenW (lpString=".bz2") returned 4 [0047.899] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0047.899] lstrlenW (lpString=".7z") returned 3 [0047.899] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0047.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.899] lstrlenW (lpString=".dbf") returned 4 [0047.899] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0047.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.899] lstrlenW (lpString=".1cd") returned 4 [0047.899] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0047.899] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0047.899] lstrlenW (lpString=".jpg") returned 4 [0047.899] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0047.899] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0047.899] lstrlenW (lpString="Setup.xml") returned 9 [0047.899] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0047.899] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=4207) returned 1 [0047.899] CloseHandle (hObject=0x180) returned 1 [0047.899] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0047.899] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.265] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.265] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.266] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.266] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.266] GetLastError () returned 0x0 [0048.266] ReadFile (in: hFile=0x17c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x106f, lpOverlapped=0x0) returned 1 [0048.267] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0048.268] ReadFile (in: hFile=0x17c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.268] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.269] SetEndOfFile (hFile=0x1ac) returned 1 [0048.269] CloseHandle (hObject=0x1ac) returned 1 [0048.269] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.270] SetEndOfFile (hFile=0x17c) returned 1 [0048.270] CloseHandle (hObject=0x17c) returned 1 [0048.270] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.271] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.271] lstrlenW (lpString=".doc") returned 4 [0048.271] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.271] lstrlenW (lpString=".docx") returned 5 [0048.271] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.271] lstrlenW (lpString=".pdf") returned 4 [0048.271] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.271] lstrlenW (lpString=".xls") returned 4 [0048.271] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.271] lstrlenW (lpString=".xlsx") returned 5 [0048.271] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.271] lstrlenW (lpString=".ppt") returned 4 [0048.271] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.271] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.271] lstrlenW (lpString=".zip") returned 4 [0048.271] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.271] lstrlenW (lpString=".rar") returned 4 [0048.272] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.272] lstrlenW (lpString=".bz2") returned 4 [0048.272] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.272] lstrlenW (lpString=".7z") returned 3 [0048.272] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.272] lstrlenW (lpString=".dbf") returned 4 [0048.272] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.272] lstrlenW (lpString=".1cd") returned 4 [0048.272] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.272] lstrlenW (lpString=".jpg") returned 4 [0048.272] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.272] lstrlenW (lpString=".doc") returned 4 [0048.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.272] lstrlenW (lpString=".docx") returned 5 [0048.272] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.272] lstrlenW (lpString=".pdf") returned 4 [0048.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.272] lstrlenW (lpString=".xls") returned 4 [0048.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.272] lstrlenW (lpString=".xlsx") returned 5 [0048.272] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.272] lstrlenW (lpString=".ppt") returned 4 [0048.272] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.272] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.272] lstrlenW (lpString=".zip") returned 4 [0048.272] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.272] lstrlenW (lpString=".rar") returned 4 [0048.272] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.273] lstrlenW (lpString=".bz2") returned 4 [0048.273] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.273] lstrlenW (lpString=".7z") returned 3 [0048.273] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.273] lstrlenW (lpString=".dbf") returned 4 [0048.273] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.273] lstrlenW (lpString=".1cd") returned 4 [0048.273] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.273] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.273] lstrlenW (lpString=".jpg") returned 4 [0048.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.273] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.273] lstrlenW (lpString="Proofing.xml") returned 12 [0048.273] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.273] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=811) returned 1 [0048.273] CloseHandle (hObject=0x17c) returned 1 [0048.273] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0048.274] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.274] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.274] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.274] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.274] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.274] GetLastError () returned 0x0 [0048.274] ReadFile (in: hFile=0x17c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x32b, lpOverlapped=0x0) returned 1 [0048.275] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x330, lpOverlapped=0x0) returned 1 [0048.276] ReadFile (in: hFile=0x17c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.276] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.276] SetEndOfFile (hFile=0x1ac) returned 1 [0048.277] CloseHandle (hObject=0x1ac) returned 1 [0048.277] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.277] SetEndOfFile (hFile=0x17c) returned 1 [0048.278] CloseHandle (hObject=0x17c) returned 1 [0048.278] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.278] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0048.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.279] lstrlenW (lpString=".doc") returned 4 [0048.279] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.279] lstrlenW (lpString=".docx") returned 5 [0048.279] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0048.279] lstrlenW (lpString=".pdf") returned 4 [0048.279] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.279] lstrlenW (lpString=".xls") returned 4 [0048.279] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.279] lstrlenW (lpString=".xlsx") returned 5 [0048.279] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0048.279] lstrlenW (lpString=".ppt") returned 4 [0048.279] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.279] lstrlenW (lpString=".zip") returned 4 [0048.279] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.279] lstrlenW (lpString=".rar") returned 4 [0048.279] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.279] lstrlenW (lpString=".bz2") returned 4 [0048.279] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.279] lstrlenW (lpString=".7z") returned 3 [0048.279] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.279] lstrlenW (lpString=".dbf") returned 4 [0048.279] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.279] lstrlenW (lpString=".1cd") returned 4 [0048.279] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.279] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.280] lstrlenW (lpString=".jpg") returned 4 [0048.280] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.280] lstrlenW (lpString=".doc") returned 4 [0048.280] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.280] lstrlenW (lpString=".docx") returned 5 [0048.280] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0048.280] lstrlenW (lpString=".pdf") returned 4 [0048.280] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.280] lstrlenW (lpString=".xls") returned 4 [0048.280] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.280] lstrlenW (lpString=".xlsx") returned 5 [0048.280] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0048.280] lstrlenW (lpString=".ppt") returned 4 [0048.280] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.280] lstrlenW (lpString=".zip") returned 4 [0048.280] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.280] lstrlenW (lpString=".rar") returned 4 [0048.280] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.280] lstrlenW (lpString=".bz2") returned 4 [0048.280] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.280] lstrlenW (lpString=".7z") returned 3 [0048.280] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.280] lstrlenW (lpString=".dbf") returned 4 [0048.280] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.280] lstrlenW (lpString=".1cd") returned 4 [0048.280] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.280] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0048.281] lstrlenW (lpString=".jpg") returned 4 [0048.281] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.281] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.281] lstrlenW (lpString="Setup.xml") returned 9 [0048.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.281] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5884) returned 1 [0048.281] CloseHandle (hObject=0x17c) returned 1 [0048.281] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.281] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.281] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.281] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.281] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.282] GetLastError () returned 0x0 [0048.282] ReadFile (in: hFile=0x17c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0048.284] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0048.285] ReadFile (in: hFile=0x17c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.285] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.285] SetEndOfFile (hFile=0x1ac) returned 1 [0048.285] CloseHandle (hObject=0x1ac) returned 1 [0048.286] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.286] SetEndOfFile (hFile=0x17c) returned 1 [0048.287] CloseHandle (hObject=0x17c) returned 1 [0048.287] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.287] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.288] lstrlenW (lpString=".doc") returned 4 [0048.288] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.288] lstrlenW (lpString=".docx") returned 5 [0048.288] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.288] lstrlenW (lpString=".pdf") returned 4 [0048.288] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.288] lstrlenW (lpString=".xls") returned 4 [0048.288] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.288] lstrlenW (lpString=".xlsx") returned 5 [0048.288] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.288] lstrlenW (lpString=".ppt") returned 4 [0048.288] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.288] lstrlenW (lpString=".zip") returned 4 [0048.288] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.288] lstrlenW (lpString=".rar") returned 4 [0048.288] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.288] lstrlenW (lpString=".bz2") returned 4 [0048.288] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.288] lstrlenW (lpString=".7z") returned 3 [0048.288] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.288] lstrlenW (lpString=".dbf") returned 4 [0048.288] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.288] lstrlenW (lpString=".1cd") returned 4 [0048.288] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.289] lstrlenW (lpString=".jpg") returned 4 [0048.289] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.289] lstrlenW (lpString=".doc") returned 4 [0048.289] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.289] lstrlenW (lpString=".docx") returned 5 [0048.289] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.289] lstrlenW (lpString=".pdf") returned 4 [0048.289] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.289] lstrlenW (lpString=".xls") returned 4 [0048.289] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.289] lstrlenW (lpString=".xlsx") returned 5 [0048.289] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.289] lstrlenW (lpString=".ppt") returned 4 [0048.289] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.289] lstrlenW (lpString=".zip") returned 4 [0048.289] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.289] lstrlenW (lpString=".rar") returned 4 [0048.289] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.289] lstrlenW (lpString=".bz2") returned 4 [0048.289] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.289] lstrlenW (lpString=".7z") returned 3 [0048.289] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.289] lstrlenW (lpString=".dbf") returned 4 [0048.289] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.290] lstrlenW (lpString=".1cd") returned 4 [0048.290] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.290] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.290] lstrlenW (lpString=".jpg") returned 4 [0048.290] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.290] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.290] lstrlenW (lpString="Office32MUI.xml") returned 15 [0048.290] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.291] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1383) returned 1 [0048.291] CloseHandle (hObject=0x17c) returned 1 [0048.291] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0048.291] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.291] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.291] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.291] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.291] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.292] GetLastError () returned 0x0 [0048.292] ReadFile (in: hFile=0x17c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x567, lpOverlapped=0x0) returned 1 [0048.293] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x570, lpOverlapped=0x0) returned 1 [0048.294] ReadFile (in: hFile=0x17c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.294] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0048.294] SetEndOfFile (hFile=0x1ac) returned 1 [0048.294] CloseHandle (hObject=0x1ac) returned 1 [0048.295] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.295] SetEndOfFile (hFile=0x17c) returned 1 [0048.296] CloseHandle (hObject=0x17c) returned 1 [0048.296] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.296] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0048.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.296] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.296] lstrlenW (lpString=".doc") returned 4 [0048.296] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.296] lstrlenW (lpString=".docx") returned 5 [0048.297] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.297] lstrlenW (lpString=".pdf") returned 4 [0048.297] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.297] lstrlenW (lpString=".xls") returned 4 [0048.297] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.297] lstrlenW (lpString=".xlsx") returned 5 [0048.297] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.297] lstrlenW (lpString=".ppt") returned 4 [0048.297] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.297] lstrlenW (lpString=".zip") returned 4 [0048.297] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.297] lstrlenW (lpString=".rar") returned 4 [0048.297] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.297] lstrlenW (lpString=".bz2") returned 4 [0048.297] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.297] lstrlenW (lpString=".7z") returned 3 [0048.297] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.297] lstrlenW (lpString=".dbf") returned 4 [0048.297] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.297] lstrlenW (lpString=".1cd") returned 4 [0048.297] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.297] lstrlenW (lpString=".jpg") returned 4 [0048.297] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.297] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.297] lstrlenW (lpString=".doc") returned 4 [0048.297] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.297] lstrlenW (lpString=".docx") returned 5 [0048.297] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.298] lstrlenW (lpString=".pdf") returned 4 [0048.298] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.298] lstrlenW (lpString=".xls") returned 4 [0048.298] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.298] lstrlenW (lpString=".xlsx") returned 5 [0048.298] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.298] lstrlenW (lpString=".ppt") returned 4 [0048.298] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.298] lstrlenW (lpString=".zip") returned 4 [0048.298] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.298] lstrlenW (lpString=".rar") returned 4 [0048.298] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.298] lstrlenW (lpString=".bz2") returned 4 [0048.298] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.298] lstrlenW (lpString=".7z") returned 3 [0048.298] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.298] lstrlenW (lpString=".dbf") returned 4 [0048.298] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.298] lstrlenW (lpString=".1cd") returned 4 [0048.298] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0048.298] lstrlenW (lpString=".jpg") returned 4 [0048.298] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.298] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.298] lstrlenW (lpString="Setup.xml") returned 9 [0048.298] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.299] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2362) returned 1 [0048.299] CloseHandle (hObject=0x17c) returned 1 [0048.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.299] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.299] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.299] GetLastError () returned 0x0 [0048.299] ReadFile (in: hFile=0x17c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x93a, lpOverlapped=0x0) returned 1 [0048.391] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x940, lpOverlapped=0x0) returned 1 [0048.759] ReadFile (in: hFile=0x17c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.759] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.759] SetEndOfFile (hFile=0x1ac) returned 1 [0048.759] CloseHandle (hObject=0x1ac) returned 1 [0048.760] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.760] SetEndOfFile (hFile=0x17c) returned 1 [0048.761] CloseHandle (hObject=0x17c) returned 1 [0048.761] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.761] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.761] lstrlenW (lpString=".doc") returned 4 [0048.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.761] lstrlenW (lpString=".docx") returned 5 [0048.761] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.761] lstrlenW (lpString=".pdf") returned 4 [0048.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString=".xls") returned 4 [0048.762] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString=".xlsx") returned 5 [0048.762] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.762] lstrlenW (lpString=".ppt") returned 4 [0048.762] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.762] lstrlenW (lpString=".zip") returned 4 [0048.762] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.762] lstrlenW (lpString=".rar") returned 4 [0048.762] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString=".bz2") returned 4 [0048.762] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString=".7z") returned 3 [0048.762] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.762] lstrlenW (lpString=".dbf") returned 4 [0048.762] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.762] lstrlenW (lpString=".1cd") returned 4 [0048.762] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.762] lstrlenW (lpString=".jpg") returned 4 [0048.762] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.762] lstrlenW (lpString=".doc") returned 4 [0048.762] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.762] lstrlenW (lpString=".docx") returned 5 [0048.762] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.763] lstrlenW (lpString=".pdf") returned 4 [0048.763] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.763] lstrlenW (lpString=".xls") returned 4 [0048.763] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.763] lstrlenW (lpString=".xlsx") returned 5 [0048.763] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.763] lstrlenW (lpString=".ppt") returned 4 [0048.763] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.763] lstrlenW (lpString=".zip") returned 4 [0048.763] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.763] lstrlenW (lpString=".rar") returned 4 [0048.763] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.763] lstrlenW (lpString=".bz2") returned 4 [0048.763] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.763] lstrlenW (lpString=".7z") returned 3 [0048.763] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.763] lstrlenW (lpString=".dbf") returned 4 [0048.763] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.763] lstrlenW (lpString=".1cd") returned 4 [0048.763] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.763] lstrlenW (lpString=".jpg") returned 4 [0048.763] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.763] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.764] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0048.764] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.405] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=913) returned 1 [0049.405] CloseHandle (hObject=0x18c) returned 1 [0049.405] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0049.405] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.422] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.444] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.444] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.445] GetLastError () returned 0x0 [0049.445] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x391, lpOverlapped=0x0) returned 1 [0049.733] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0049.734] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.734] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xee, lpOverlapped=0x0) returned 1 [0049.734] SetEndOfFile (hFile=0x1a8) returned 1 [0049.734] CloseHandle (hObject=0x1a8) returned 1 [0049.735] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.735] SetEndOfFile (hFile=0x1b0) returned 1 [0049.736] CloseHandle (hObject=0x1b0) returned 1 [0049.736] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0049.736] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0049.736] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.737] lstrlenW (lpString=".doc") returned 4 [0049.737] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.737] lstrlenW (lpString=".docx") returned 5 [0049.737] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0049.737] lstrlenW (lpString=".pdf") returned 4 [0049.737] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.737] lstrlenW (lpString=".xls") returned 4 [0049.737] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.737] lstrlenW (lpString=".xlsx") returned 5 [0049.737] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0049.737] lstrlenW (lpString=".ppt") returned 4 [0049.737] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.737] lstrlenW (lpString=".zip") returned 4 [0049.737] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.737] lstrlenW (lpString=".rar") returned 4 [0049.737] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.737] lstrlenW (lpString=".bz2") returned 4 [0049.737] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.737] lstrlenW (lpString=".7z") returned 3 [0049.737] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.737] lstrlenW (lpString=".dbf") returned 4 [0049.737] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.737] lstrlenW (lpString=".1cd") returned 4 [0049.737] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.737] lstrlenW (lpString=".jpg") returned 4 [0049.737] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.738] lstrlenW (lpString=".doc") returned 4 [0049.738] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.738] lstrlenW (lpString=".docx") returned 5 [0049.738] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0049.738] lstrlenW (lpString=".pdf") returned 4 [0049.738] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.738] lstrlenW (lpString=".xls") returned 4 [0049.738] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.738] lstrlenW (lpString=".xlsx") returned 5 [0049.738] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0049.738] lstrlenW (lpString=".ppt") returned 4 [0049.738] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.738] lstrlenW (lpString=".zip") returned 4 [0049.738] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.738] lstrlenW (lpString=".rar") returned 4 [0049.738] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.738] lstrlenW (lpString=".bz2") returned 4 [0049.738] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.738] lstrlenW (lpString=".7z") returned 3 [0049.738] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.738] lstrlenW (lpString=".dbf") returned 4 [0049.738] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.738] lstrlenW (lpString=".1cd") returned 4 [0049.738] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0049.738] lstrlenW (lpString=".jpg") returned 4 [0049.738] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.739] lstrcmpiW (lpString1=".chm", lpString2=".wiki") returned -1 [0049.739] lstrlenW (lpString="setup.chm") returned 9 [0049.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.739] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=67190) returned 1 [0049.739] CloseHandle (hObject=0x1b0) returned 1 [0049.739] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0049.739] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.739] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.739] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0049.740] GetLastError () returned 0x0 [0049.740] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x10676, lpOverlapped=0x0) returned 1 [0049.912] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0049.914] ReadFile (in: hFile=0x1b0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.914] WriteFile (in: hFile=0x1a8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.914] SetEndOfFile (hFile=0x1a8) returned 1 [0049.914] CloseHandle (hObject=0x1a8) returned 1 [0049.916] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.916] SetEndOfFile (hFile=0x1b0) returned 1 [0049.917] CloseHandle (hObject=0x1b0) returned 1 [0049.917] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0049.917] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0049.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.918] lstrlenW (lpString=".doc") returned 4 [0049.918] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0049.918] lstrlenW (lpString=".docx") returned 5 [0049.918] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0049.918] lstrlenW (lpString=".pdf") returned 4 [0049.918] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0049.918] lstrlenW (lpString=".xls") returned 4 [0049.918] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0049.918] lstrlenW (lpString=".xlsx") returned 5 [0049.918] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0049.918] lstrlenW (lpString=".ppt") returned 4 [0049.918] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0049.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.918] lstrlenW (lpString=".zip") returned 4 [0049.918] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0049.918] lstrlenW (lpString=".rar") returned 4 [0049.918] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0049.918] lstrlenW (lpString=".bz2") returned 4 [0049.918] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0049.918] lstrlenW (lpString=".7z") returned 3 [0049.918] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0049.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.918] lstrlenW (lpString=".dbf") returned 4 [0049.918] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0049.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.919] lstrlenW (lpString=".1cd") returned 4 [0049.919] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0049.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.919] lstrlenW (lpString=".jpg") returned 4 [0049.919] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0049.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.919] lstrlenW (lpString=".doc") returned 4 [0049.919] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0049.919] lstrlenW (lpString=".docx") returned 5 [0049.919] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0049.919] lstrlenW (lpString=".pdf") returned 4 [0049.919] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0049.919] lstrlenW (lpString=".xls") returned 4 [0049.919] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0049.919] lstrlenW (lpString=".xlsx") returned 5 [0049.919] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0049.919] lstrlenW (lpString=".ppt") returned 4 [0049.919] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0049.919] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.919] lstrlenW (lpString=".zip") returned 4 [0049.919] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0049.919] lstrlenW (lpString=".rar") returned 4 [0049.919] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0049.919] lstrlenW (lpString=".bz2") returned 4 [0049.919] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0049.919] lstrlenW (lpString=".7z") returned 3 [0049.919] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0049.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.920] lstrlenW (lpString=".dbf") returned 4 [0049.920] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0049.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.920] lstrlenW (lpString=".1cd") returned 4 [0049.920] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0049.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0049.920] lstrlenW (lpString=".jpg") returned 4 [0049.920] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0049.920] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0049.920] lstrlenW (lpString="branding.xml") returned 12 [0049.920] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.077] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=596341) returned 1 [0050.077] CloseHandle (hObject=0x1ac) returned 1 [0050.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0050.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.077] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.077] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.077] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0050.078] GetLastError () returned 0x0 [0050.078] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x91975, lpOverlapped=0x0) returned 1 [0050.092] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0050.102] ReadFile (in: hFile=0x1ac, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.102] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.103] SetEndOfFile (hFile=0x180) returned 1 [0050.103] CloseHandle (hObject=0x180) returned 1 [0050.108] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.108] SetEndOfFile (hFile=0x1ac) returned 1 [0050.113] CloseHandle (hObject=0x1ac) returned 1 [0050.113] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.113] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0050.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.114] lstrlenW (lpString=".doc") returned 4 [0050.114] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.114] lstrlenW (lpString=".docx") returned 5 [0050.114] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0050.114] lstrlenW (lpString=".pdf") returned 4 [0050.114] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.114] lstrlenW (lpString=".xls") returned 4 [0050.114] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.114] lstrlenW (lpString=".xlsx") returned 5 [0050.114] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0050.114] lstrlenW (lpString=".ppt") returned 4 [0050.114] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.114] lstrlenW (lpString=".zip") returned 4 [0050.114] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.114] lstrlenW (lpString=".rar") returned 4 [0050.114] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.114] lstrlenW (lpString=".bz2") returned 4 [0050.114] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.114] lstrlenW (lpString=".7z") returned 3 [0050.114] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.114] lstrlenW (lpString=".dbf") returned 4 [0050.114] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.114] lstrlenW (lpString=".1cd") returned 4 [0050.115] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.115] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.115] lstrlenW (lpString=".jpg") returned 4 [0050.115] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.365] lstrlenW (lpString=".doc") returned 4 [0050.365] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".docx") returned 5 [0050.365] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0050.365] lstrlenW (lpString=".pdf") returned 4 [0050.365] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".xls") returned 4 [0050.365] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".xlsx") returned 5 [0050.365] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0050.365] lstrlenW (lpString=".ppt") returned 4 [0050.365] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.365] lstrlenW (lpString=".zip") returned 4 [0050.365] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.365] lstrlenW (lpString=".rar") returned 4 [0050.365] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".bz2") returned 4 [0050.365] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString=".7z") returned 3 [0050.365] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.365] lstrlenW (lpString=".dbf") returned 4 [0050.365] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.365] lstrlenW (lpString=".1cd") returned 4 [0050.365] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.365] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0050.365] lstrlenW (lpString=".jpg") returned 4 [0050.366] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.366] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0050.366] lstrlenW (lpString="Office32WW.xml") returned 14 [0050.366] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0050.569] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=4274) returned 1 [0050.569] CloseHandle (hObject=0x1b4) returned 1 [0050.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0050.569] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.569] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0050.569] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.569] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.570] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0050.570] GetLastError () returned 0x0 [0050.570] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0050.674] WriteFile (in: hFile=0x1b8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0050.675] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.675] WriteFile (in: hFile=0x1b8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0050.675] SetEndOfFile (hFile=0x1b8) returned 1 [0050.675] CloseHandle (hObject=0x1b8) returned 1 [0050.676] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.676] SetEndOfFile (hFile=0x1b4) returned 1 [0050.677] CloseHandle (hObject=0x1b4) returned 1 [0050.677] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.677] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0050.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.677] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.677] lstrlenW (lpString=".doc") returned 4 [0050.677] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.677] lstrlenW (lpString=".docx") returned 5 [0050.677] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.677] lstrlenW (lpString=".pdf") returned 4 [0050.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.678] lstrlenW (lpString=".xls") returned 4 [0050.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.678] lstrlenW (lpString=".xlsx") returned 5 [0050.678] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.678] lstrlenW (lpString=".ppt") returned 4 [0050.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.678] lstrlenW (lpString=".zip") returned 4 [0050.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.678] lstrlenW (lpString=".rar") returned 4 [0050.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.678] lstrlenW (lpString=".bz2") returned 4 [0050.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.678] lstrlenW (lpString=".7z") returned 3 [0050.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.678] lstrlenW (lpString=".dbf") returned 4 [0050.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.678] lstrlenW (lpString=".1cd") returned 4 [0050.678] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.678] lstrlenW (lpString=".jpg") returned 4 [0050.678] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.678] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.678] lstrlenW (lpString=".doc") returned 4 [0050.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.679] lstrlenW (lpString=".docx") returned 5 [0050.679] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.679] lstrlenW (lpString=".pdf") returned 4 [0050.679] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.679] lstrlenW (lpString=".xls") returned 4 [0050.679] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.679] lstrlenW (lpString=".xlsx") returned 5 [0050.679] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.679] lstrlenW (lpString=".ppt") returned 4 [0050.679] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.679] lstrlenW (lpString=".zip") returned 4 [0050.679] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.679] lstrlenW (lpString=".rar") returned 4 [0050.679] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.679] lstrlenW (lpString=".bz2") returned 4 [0050.679] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.679] lstrlenW (lpString=".7z") returned 3 [0050.679] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.679] lstrlenW (lpString=".dbf") returned 4 [0050.679] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.679] lstrlenW (lpString=".1cd") returned 4 [0050.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.679] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.679] lstrlenW (lpString=".jpg") returned 4 [0050.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.680] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0050.680] lstrlenW (lpString="Setup.xml") returned 9 [0050.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0050.680] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=20577) returned 1 [0050.680] CloseHandle (hObject=0x1b4) returned 1 [0050.680] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0050.680] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0050.680] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.680] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.680] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0050.681] GetLastError () returned 0x0 [0050.681] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x5061, lpOverlapped=0x0) returned 1 [0050.694] WriteFile (in: hFile=0x1b8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0050.695] ReadFile (in: hFile=0x1b4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.695] WriteFile (in: hFile=0x1b8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.695] SetEndOfFile (hFile=0x1b8) returned 1 [0050.695] CloseHandle (hObject=0x1b8) returned 1 [0050.696] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.696] SetEndOfFile (hFile=0x1b4) returned 1 [0050.697] CloseHandle (hObject=0x1b4) returned 1 [0050.697] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.697] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0050.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.699] lstrlenW (lpString=".doc") returned 4 [0050.699] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.699] lstrlenW (lpString=".docx") returned 5 [0050.699] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.699] lstrlenW (lpString=".pdf") returned 4 [0050.699] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.699] lstrlenW (lpString=".xls") returned 4 [0050.699] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.699] lstrlenW (lpString=".xlsx") returned 5 [0050.699] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.699] lstrlenW (lpString=".ppt") returned 4 [0050.699] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.699] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.699] lstrlenW (lpString=".zip") returned 4 [0050.699] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.699] lstrlenW (lpString=".rar") returned 4 [0050.700] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.700] lstrlenW (lpString=".bz2") returned 4 [0050.700] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.700] lstrlenW (lpString=".7z") returned 3 [0050.700] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.700] lstrlenW (lpString=".dbf") returned 4 [0050.700] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.700] lstrlenW (lpString=".1cd") returned 4 [0050.700] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.700] lstrlenW (lpString=".jpg") returned 4 [0050.700] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.700] lstrlenW (lpString=".doc") returned 4 [0050.700] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.700] lstrlenW (lpString=".docx") returned 5 [0050.700] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.700] lstrlenW (lpString=".pdf") returned 4 [0050.700] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.700] lstrlenW (lpString=".xls") returned 4 [0050.700] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.700] lstrlenW (lpString=".xlsx") returned 5 [0050.700] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.700] lstrlenW (lpString=".ppt") returned 4 [0050.700] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.700] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.700] lstrlenW (lpString=".zip") returned 4 [0050.701] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.701] lstrlenW (lpString=".rar") returned 4 [0050.701] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.701] lstrlenW (lpString=".bz2") returned 4 [0050.701] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.701] lstrlenW (lpString=".7z") returned 3 [0050.701] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.701] lstrlenW (lpString=".dbf") returned 4 [0050.701] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.701] lstrlenW (lpString=".1cd") returned 4 [0050.701] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.701] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.701] lstrlenW (lpString=".jpg") returned 4 [0050.701] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.701] lstrcmpiW (lpString1=".EPS", lpString2=".wiki") returned -1 [0050.701] lstrlenW (lpString="MS.EPS") returned 6 [0050.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0050.703] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=15067) returned 1 [0050.703] CloseHandle (hObject=0x1b8) returned 1 [0050.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0050.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0050.703] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.703] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.703] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.703] GetLastError () returned 0x0 [0050.703] ReadFile (in: hFile=0x1b8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0050.705] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0050.706] ReadFile (in: hFile=0x1b8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.706] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0050.706] SetEndOfFile (hFile=0x1ac) returned 1 [0050.706] CloseHandle (hObject=0x1ac) returned 1 [0050.707] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.707] SetEndOfFile (hFile=0x1b8) returned 1 [0050.708] CloseHandle (hObject=0x1b8) returned 1 [0050.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.708] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0050.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.709] lstrlenW (lpString=".doc") returned 4 [0050.709] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0050.709] lstrlenW (lpString=".docx") returned 5 [0050.709] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0050.709] lstrlenW (lpString=".pdf") returned 4 [0050.709] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0050.709] lstrlenW (lpString=".xls") returned 4 [0050.709] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0050.709] lstrlenW (lpString=".xlsx") returned 5 [0050.709] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0050.709] lstrlenW (lpString=".ppt") returned 4 [0050.709] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0050.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.709] lstrlenW (lpString=".zip") returned 4 [0050.709] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0050.709] lstrlenW (lpString=".rar") returned 4 [0050.709] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0050.709] lstrlenW (lpString=".bz2") returned 4 [0050.709] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0050.709] lstrlenW (lpString=".7z") returned 3 [0050.709] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0050.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.709] lstrlenW (lpString=".dbf") returned 4 [0050.709] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0050.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.709] lstrlenW (lpString=".1cd") returned 4 [0050.709] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0050.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.709] lstrlenW (lpString=".jpg") returned 4 [0050.710] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0050.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.710] lstrlenW (lpString=".doc") returned 4 [0050.710] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0050.710] lstrlenW (lpString=".docx") returned 5 [0050.710] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0050.710] lstrlenW (lpString=".pdf") returned 4 [0050.710] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0050.710] lstrlenW (lpString=".xls") returned 4 [0050.710] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0050.710] lstrlenW (lpString=".xlsx") returned 5 [0050.710] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0050.710] lstrlenW (lpString=".ppt") returned 4 [0050.710] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0050.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.710] lstrlenW (lpString=".zip") returned 4 [0050.710] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0050.710] lstrlenW (lpString=".rar") returned 4 [0050.710] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0050.710] lstrlenW (lpString=".bz2") returned 4 [0050.710] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0050.710] lstrlenW (lpString=".7z") returned 3 [0050.710] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0050.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.710] lstrlenW (lpString=".dbf") returned 4 [0050.710] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0050.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.710] lstrlenW (lpString=".1cd") returned 4 [0050.710] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0050.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0050.711] lstrlenW (lpString=".jpg") returned 4 [0050.711] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0050.711] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0050.711] lstrlenW (lpString="MS.GIF") returned 6 [0050.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0050.711] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1069) returned 1 [0050.711] CloseHandle (hObject=0x1b8) returned 1 [0050.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0050.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0050.711] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.711] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.712] GetLastError () returned 0x0 [0050.712] ReadFile (in: hFile=0x1b8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x42d, lpOverlapped=0x0) returned 1 [0050.713] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x430, lpOverlapped=0x0) returned 1 [0050.714] ReadFile (in: hFile=0x1b8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.714] WriteFile (in: hFile=0x1ac, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0050.714] SetEndOfFile (hFile=0x1ac) returned 1 [0050.714] CloseHandle (hObject=0x1ac) returned 1 [0050.715] SetFilePointerEx (in: hFile=0x1b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.715] SetEndOfFile (hFile=0x1b8) returned 1 [0050.716] CloseHandle (hObject=0x1b8) returned 1 [0050.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0050.717] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0050.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.717] lstrlenW (lpString=".doc") returned 4 [0050.717] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.717] lstrlenW (lpString=".docx") returned 5 [0050.717] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0050.717] lstrlenW (lpString=".pdf") returned 4 [0050.717] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.717] lstrlenW (lpString=".xls") returned 4 [0050.717] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.717] lstrlenW (lpString=".xlsx") returned 5 [0050.717] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0050.717] lstrlenW (lpString=".ppt") returned 4 [0050.717] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.717] lstrlenW (lpString=".zip") returned 4 [0050.717] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.717] lstrlenW (lpString=".rar") returned 4 [0050.717] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.717] lstrlenW (lpString=".bz2") returned 4 [0050.718] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.718] lstrlenW (lpString=".7z") returned 3 [0050.718] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.718] lstrlenW (lpString=".dbf") returned 4 [0050.718] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.718] lstrlenW (lpString=".1cd") returned 4 [0050.718] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.718] lstrlenW (lpString=".jpg") returned 4 [0050.718] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.718] lstrlenW (lpString=".doc") returned 4 [0050.718] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0050.718] lstrlenW (lpString=".docx") returned 5 [0050.718] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0050.718] lstrlenW (lpString=".pdf") returned 4 [0050.718] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0050.718] lstrlenW (lpString=".xls") returned 4 [0050.718] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0050.718] lstrlenW (lpString=".xlsx") returned 5 [0050.718] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0050.718] lstrlenW (lpString=".ppt") returned 4 [0050.718] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0050.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.718] lstrlenW (lpString=".zip") returned 4 [0050.718] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0050.718] lstrlenW (lpString=".rar") returned 4 [0050.719] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0050.719] lstrlenW (lpString=".bz2") returned 4 [0050.719] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0050.719] lstrlenW (lpString=".7z") returned 3 [0050.719] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0050.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.719] lstrlenW (lpString=".dbf") returned 4 [0050.719] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0050.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.719] lstrlenW (lpString=".1cd") returned 4 [0050.719] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0050.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0050.719] lstrlenW (lpString=".jpg") returned 4 [0050.719] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0050.719] lstrcmpiW (lpString1=".JPG", lpString2=".wiki") returned -1 [0050.719] lstrlenW (lpString="MS.JPG") returned 6 [0050.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.143] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1061) returned 1 [0051.145] CloseHandle (hObject=0x1a0) returned 1 [0051.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0051.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.146] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.146] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.146] GetLastError () returned 0x0 [0051.146] ReadFile (in: hFile=0x1a0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x425, lpOverlapped=0x0) returned 1 [0051.790] WriteFile (in: hFile=0x1b8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x430, lpOverlapped=0x0) returned 1 [0051.791] ReadFile (in: hFile=0x1a0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.791] WriteFile (in: hFile=0x1b8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0051.791] SetEndOfFile (hFile=0x1b8) returned 1 [0051.792] CloseHandle (hObject=0x1b8) returned 1 [0051.792] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.793] SetEndOfFile (hFile=0x1a0) returned 1 [0051.793] CloseHandle (hObject=0x1a0) returned 1 [0051.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0051.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.794] lstrlenW (lpString=".doc") returned 4 [0051.794] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0051.794] lstrlenW (lpString=".docx") returned 5 [0051.794] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0051.794] lstrlenW (lpString=".pdf") returned 4 [0051.794] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0051.794] lstrlenW (lpString=".xls") returned 4 [0051.795] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0051.795] lstrlenW (lpString=".xlsx") returned 5 [0051.795] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0051.795] lstrlenW (lpString=".ppt") returned 4 [0051.795] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0051.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.795] lstrlenW (lpString=".zip") returned 4 [0051.795] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0051.795] lstrlenW (lpString=".rar") returned 4 [0051.795] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0051.795] lstrlenW (lpString=".bz2") returned 4 [0051.795] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0051.795] lstrlenW (lpString=".7z") returned 3 [0051.795] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0051.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.795] lstrlenW (lpString=".dbf") returned 4 [0051.795] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0051.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.795] lstrlenW (lpString=".1cd") returned 4 [0051.795] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0051.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.795] lstrlenW (lpString=".jpg") returned 4 [0051.795] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0051.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.796] lstrlenW (lpString=".doc") returned 4 [0051.796] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0051.796] lstrlenW (lpString=".docx") returned 5 [0051.796] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0051.796] lstrlenW (lpString=".pdf") returned 4 [0051.796] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0051.796] lstrlenW (lpString=".xls") returned 4 [0051.796] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0051.796] lstrlenW (lpString=".xlsx") returned 5 [0051.796] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0051.796] lstrlenW (lpString=".ppt") returned 4 [0051.796] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0051.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.796] lstrlenW (lpString=".zip") returned 4 [0051.796] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0051.796] lstrlenW (lpString=".rar") returned 4 [0051.796] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0051.796] lstrlenW (lpString=".bz2") returned 4 [0051.796] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0051.796] lstrlenW (lpString=".7z") returned 3 [0051.796] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0051.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.796] lstrlenW (lpString=".dbf") returned 4 [0051.796] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0051.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.797] lstrlenW (lpString=".1cd") returned 4 [0051.797] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0051.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0051.797] lstrlenW (lpString=".jpg") returned 4 [0051.797] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0051.797] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.797] lstrlenW (lpString="oskmenu.xml") returned 11 [0051.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0052.410] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=215) returned 1 [0052.410] CloseHandle (hObject=0x1dc) returned 1 [0052.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml")) returned 0x20 [0052.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.410] lstrlenW (lpString=".doc") returned 4 [0052.410] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.410] lstrlenW (lpString=".docx") returned 5 [0052.410] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0052.410] lstrlenW (lpString=".pdf") returned 4 [0052.410] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.410] lstrlenW (lpString=".xls") returned 4 [0052.410] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.410] lstrlenW (lpString=".xlsx") returned 5 [0052.411] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0052.411] lstrlenW (lpString=".ppt") returned 4 [0052.411] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.411] lstrlenW (lpString=".zip") returned 4 [0052.411] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.411] lstrlenW (lpString=".rar") returned 4 [0052.411] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.411] lstrlenW (lpString=".bz2") returned 4 [0052.411] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.411] lstrlenW (lpString=".7z") returned 3 [0052.411] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.411] lstrlenW (lpString=".dbf") returned 4 [0052.411] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.411] lstrlenW (lpString=".1cd") returned 4 [0052.411] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.411] lstrlenW (lpString=".jpg") returned 4 [0052.411] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.411] lstrlenW (lpString=".doc") returned 4 [0052.411] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.411] lstrlenW (lpString=".docx") returned 5 [0052.411] lstrcmpiW (lpString1=".docx", lpString2="u.xml") returned -1 [0052.411] lstrlenW (lpString=".pdf") returned 4 [0052.411] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.411] lstrlenW (lpString=".xls") returned 4 [0052.411] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.411] lstrlenW (lpString=".xlsx") returned 5 [0052.412] lstrcmpiW (lpString1=".xlsx", lpString2="u.xml") returned -1 [0052.412] lstrlenW (lpString=".ppt") returned 4 [0052.412] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.412] lstrlenW (lpString=".zip") returned 4 [0052.412] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.412] lstrlenW (lpString=".rar") returned 4 [0052.412] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.412] lstrlenW (lpString=".bz2") returned 4 [0052.412] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.412] lstrlenW (lpString=".7z") returned 3 [0052.412] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.412] lstrlenW (lpString=".dbf") returned 4 [0052.412] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.412] lstrlenW (lpString=".1cd") returned 4 [0052.412] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu.xml") returned 76 [0052.412] lstrlenW (lpString=".jpg") returned 4 [0052.412] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.412] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0052.412] lstrlenW (lpString="hwrusash.dat") returned 12 [0052.412] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0053.416] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=4120784) returned 1 [0053.416] CloseHandle (hObject=0x1d8) returned 1 [0053.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0053.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.416] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0053.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.417] lstrlenW (lpString=".doc") returned 4 [0053.417] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0053.417] lstrlenW (lpString=".docx") returned 5 [0053.417] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0053.417] lstrlenW (lpString=".pdf") returned 4 [0053.417] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0053.417] lstrlenW (lpString=".xls") returned 4 [0053.417] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0053.417] lstrlenW (lpString=".xlsx") returned 5 [0053.417] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0053.417] lstrlenW (lpString=".ppt") returned 4 [0053.417] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0053.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.417] lstrlenW (lpString=".zip") returned 4 [0053.417] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0053.417] lstrlenW (lpString=".rar") returned 4 [0053.417] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0053.417] lstrlenW (lpString=".bz2") returned 4 [0053.417] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0053.417] lstrlenW (lpString=".7z") returned 3 [0053.417] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0053.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.417] lstrlenW (lpString=".dbf") returned 4 [0053.417] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0053.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.417] lstrlenW (lpString=".1cd") returned 4 [0053.417] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0053.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.417] lstrlenW (lpString=".jpg") returned 4 [0053.417] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0053.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.418] lstrlenW (lpString=".doc") returned 4 [0053.418] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0053.418] lstrlenW (lpString=".docx") returned 5 [0053.418] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0053.418] lstrlenW (lpString=".pdf") returned 4 [0053.418] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0053.418] lstrlenW (lpString=".xls") returned 4 [0053.418] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0053.418] lstrlenW (lpString=".xlsx") returned 5 [0053.418] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0053.418] lstrlenW (lpString=".ppt") returned 4 [0053.418] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0053.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.418] lstrlenW (lpString=".zip") returned 4 [0053.418] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0053.418] lstrlenW (lpString=".rar") returned 4 [0053.418] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0053.418] lstrlenW (lpString=".bz2") returned 4 [0053.418] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0053.418] lstrlenW (lpString=".7z") returned 3 [0053.418] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0053.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.418] lstrlenW (lpString=".dbf") returned 4 [0053.418] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0053.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.418] lstrlenW (lpString=".1cd") returned 4 [0053.418] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0053.418] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0053.418] lstrlenW (lpString=".jpg") returned 4 [0053.418] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0053.419] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0053.419] lstrlenW (lpString="ipshrv.xml") returned 10 [0053.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0053.419] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2652) returned 1 [0053.419] CloseHandle (hObject=0x1d8) returned 1 [0053.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0053.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.419] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.419] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.419] lstrlenW (lpString=".doc") returned 4 [0053.419] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.419] lstrlenW (lpString=".docx") returned 5 [0053.419] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0053.420] lstrlenW (lpString=".pdf") returned 4 [0053.420] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.420] lstrlenW (lpString=".xls") returned 4 [0053.420] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.420] lstrlenW (lpString=".xlsx") returned 5 [0053.420] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0053.420] lstrlenW (lpString=".ppt") returned 4 [0053.420] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.420] lstrlenW (lpString=".zip") returned 4 [0053.420] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.420] lstrlenW (lpString=".rar") returned 4 [0053.420] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.420] lstrlenW (lpString=".bz2") returned 4 [0053.420] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.420] lstrlenW (lpString=".7z") returned 3 [0053.420] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.420] lstrlenW (lpString=".dbf") returned 4 [0053.420] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.420] lstrlenW (lpString=".1cd") returned 4 [0053.420] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.420] lstrlenW (lpString=".jpg") returned 4 [0053.420] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.420] lstrlenW (lpString=".doc") returned 4 [0053.420] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.420] lstrlenW (lpString=".docx") returned 5 [0053.420] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0053.421] lstrlenW (lpString=".pdf") returned 4 [0053.421] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.421] lstrlenW (lpString=".xls") returned 4 [0053.421] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.421] lstrlenW (lpString=".xlsx") returned 5 [0053.421] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0053.421] lstrlenW (lpString=".ppt") returned 4 [0053.421] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.421] lstrlenW (lpString=".zip") returned 4 [0053.421] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.421] lstrlenW (lpString=".rar") returned 4 [0053.421] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.421] lstrlenW (lpString=".bz2") returned 4 [0053.421] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.421] lstrlenW (lpString=".7z") returned 3 [0053.421] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.421] lstrlenW (lpString=".dbf") returned 4 [0053.421] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.421] lstrlenW (lpString=".1cd") returned 4 [0053.421] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0053.421] lstrlenW (lpString=".jpg") returned 4 [0053.421] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.421] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0053.422] lstrlenW (lpString="ipsita.xml") returned 10 [0053.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0053.422] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2526) returned 1 [0053.422] CloseHandle (hObject=0x1d8) returned 1 [0053.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0053.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.423] lstrlenW (lpString=".doc") returned 4 [0053.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.423] lstrlenW (lpString=".docx") returned 5 [0053.423] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.423] lstrlenW (lpString=".pdf") returned 4 [0053.423] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.423] lstrlenW (lpString=".xls") returned 4 [0053.423] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.423] lstrlenW (lpString=".xlsx") returned 5 [0053.423] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.423] lstrlenW (lpString=".ppt") returned 4 [0053.423] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.423] lstrlenW (lpString=".zip") returned 4 [0053.423] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.423] lstrlenW (lpString=".rar") returned 4 [0053.423] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.423] lstrlenW (lpString=".bz2") returned 4 [0053.423] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.423] lstrlenW (lpString=".7z") returned 3 [0053.423] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.423] lstrlenW (lpString=".dbf") returned 4 [0053.423] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.423] lstrlenW (lpString=".1cd") returned 4 [0053.423] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.423] lstrlenW (lpString=".jpg") returned 4 [0053.423] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.424] lstrlenW (lpString=".doc") returned 4 [0053.424] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.424] lstrlenW (lpString=".docx") returned 5 [0053.424] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0053.424] lstrlenW (lpString=".pdf") returned 4 [0053.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.424] lstrlenW (lpString=".xls") returned 4 [0053.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.424] lstrlenW (lpString=".xlsx") returned 5 [0053.424] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0053.424] lstrlenW (lpString=".ppt") returned 4 [0053.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.424] lstrlenW (lpString=".zip") returned 4 [0053.424] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.424] lstrlenW (lpString=".rar") returned 4 [0053.424] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.424] lstrlenW (lpString=".bz2") returned 4 [0053.424] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.424] lstrlenW (lpString=".7z") returned 3 [0053.424] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.424] lstrlenW (lpString=".dbf") returned 4 [0053.424] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.424] lstrlenW (lpString=".1cd") returned 4 [0053.424] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0053.424] lstrlenW (lpString=".jpg") returned 4 [0053.424] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.425] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0053.425] lstrlenW (lpString="ipsjpn.xml") returned 10 [0053.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0053.425] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2522) returned 1 [0053.425] CloseHandle (hObject=0x1d8) returned 1 [0053.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0053.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.425] lstrlenW (lpString=".doc") returned 4 [0053.425] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.425] lstrlenW (lpString=".docx") returned 5 [0053.425] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0053.426] lstrlenW (lpString=".pdf") returned 4 [0053.426] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.426] lstrlenW (lpString=".xls") returned 4 [0053.426] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.426] lstrlenW (lpString=".xlsx") returned 5 [0053.426] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0053.426] lstrlenW (lpString=".ppt") returned 4 [0053.426] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.426] lstrlenW (lpString=".zip") returned 4 [0053.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.426] lstrlenW (lpString=".rar") returned 4 [0053.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.426] lstrlenW (lpString=".bz2") returned 4 [0053.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.426] lstrlenW (lpString=".7z") returned 3 [0053.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.426] lstrlenW (lpString=".dbf") returned 4 [0053.426] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.426] lstrlenW (lpString=".1cd") returned 4 [0053.426] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.426] lstrlenW (lpString=".jpg") returned 4 [0053.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.426] lstrlenW (lpString=".doc") returned 4 [0053.426] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.426] lstrlenW (lpString=".docx") returned 5 [0053.426] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0053.426] lstrlenW (lpString=".pdf") returned 4 [0053.427] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.427] lstrlenW (lpString=".xls") returned 4 [0053.427] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.427] lstrlenW (lpString=".xlsx") returned 5 [0053.427] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0053.427] lstrlenW (lpString=".ppt") returned 4 [0053.427] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.427] lstrlenW (lpString=".zip") returned 4 [0053.427] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.427] lstrlenW (lpString=".rar") returned 4 [0053.427] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.427] lstrlenW (lpString=".bz2") returned 4 [0053.427] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.427] lstrlenW (lpString=".7z") returned 3 [0053.427] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.427] lstrlenW (lpString=".dbf") returned 4 [0053.427] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.427] lstrlenW (lpString=".1cd") returned 4 [0053.427] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.427] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0053.427] lstrlenW (lpString=".jpg") returned 4 [0053.427] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.427] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0053.427] lstrlenW (lpString="ipskor.xml") returned 10 [0053.427] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0053.428] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2568) returned 1 [0053.428] CloseHandle (hObject=0x1d8) returned 1 [0053.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0053.429] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.429] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.429] lstrlenW (lpString=".doc") returned 4 [0053.429] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.429] lstrlenW (lpString=".docx") returned 5 [0053.429] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0053.429] lstrlenW (lpString=".pdf") returned 4 [0053.429] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.429] lstrlenW (lpString=".xls") returned 4 [0053.429] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.429] lstrlenW (lpString=".xlsx") returned 5 [0053.429] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0053.429] lstrlenW (lpString=".ppt") returned 4 [0053.429] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.429] lstrlenW (lpString=".zip") returned 4 [0053.429] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.429] lstrlenW (lpString=".rar") returned 4 [0053.429] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.429] lstrlenW (lpString=".bz2") returned 4 [0053.429] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.429] lstrlenW (lpString=".7z") returned 3 [0053.429] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.429] lstrlenW (lpString=".dbf") returned 4 [0053.429] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.429] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.429] lstrlenW (lpString=".1cd") returned 4 [0053.430] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.430] lstrlenW (lpString=".jpg") returned 4 [0053.430] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.430] lstrlenW (lpString=".doc") returned 4 [0053.430] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.430] lstrlenW (lpString=".docx") returned 5 [0053.430] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0053.430] lstrlenW (lpString=".pdf") returned 4 [0053.430] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.430] lstrlenW (lpString=".xls") returned 4 [0053.430] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.430] lstrlenW (lpString=".xlsx") returned 5 [0053.430] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0053.430] lstrlenW (lpString=".ppt") returned 4 [0053.430] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.430] lstrlenW (lpString=".zip") returned 4 [0053.430] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.430] lstrlenW (lpString=".rar") returned 4 [0053.430] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.430] lstrlenW (lpString=".bz2") returned 4 [0053.430] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.430] lstrlenW (lpString=".7z") returned 3 [0053.430] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.430] lstrlenW (lpString=".dbf") returned 4 [0053.430] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.430] lstrlenW (lpString=".1cd") returned 4 [0053.431] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0053.431] lstrlenW (lpString=".jpg") returned 4 [0053.431] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.431] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0053.431] lstrlenW (lpString="ipsnld.xml") returned 10 [0053.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0053.431] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2626) returned 1 [0053.431] CloseHandle (hObject=0x1d8) returned 1 [0053.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0053.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.431] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.432] lstrlenW (lpString=".doc") returned 4 [0053.432] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.432] lstrlenW (lpString=".docx") returned 5 [0053.432] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0053.432] lstrlenW (lpString=".pdf") returned 4 [0053.432] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.432] lstrlenW (lpString=".xls") returned 4 [0053.432] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.432] lstrlenW (lpString=".xlsx") returned 5 [0053.432] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0053.432] lstrlenW (lpString=".ppt") returned 4 [0053.432] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.432] lstrlenW (lpString=".zip") returned 4 [0053.432] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.432] lstrlenW (lpString=".rar") returned 4 [0053.432] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.432] lstrlenW (lpString=".bz2") returned 4 [0053.432] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.432] lstrlenW (lpString=".7z") returned 3 [0053.432] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.432] lstrlenW (lpString=".dbf") returned 4 [0053.432] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.432] lstrlenW (lpString=".1cd") returned 4 [0053.432] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.432] lstrlenW (lpString=".jpg") returned 4 [0053.432] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.433] lstrlenW (lpString=".doc") returned 4 [0053.433] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.433] lstrlenW (lpString=".docx") returned 5 [0053.433] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0053.433] lstrlenW (lpString=".pdf") returned 4 [0053.433] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.433] lstrlenW (lpString=".xls") returned 4 [0053.433] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.433] lstrlenW (lpString=".xlsx") returned 5 [0053.433] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0053.433] lstrlenW (lpString=".ppt") returned 4 [0053.433] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.433] lstrlenW (lpString=".zip") returned 4 [0053.433] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.433] lstrlenW (lpString=".rar") returned 4 [0053.433] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.433] lstrlenW (lpString=".bz2") returned 4 [0053.433] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.433] lstrlenW (lpString=".7z") returned 3 [0053.433] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.433] lstrlenW (lpString=".dbf") returned 4 [0053.433] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.433] lstrlenW (lpString=".1cd") returned 4 [0053.433] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0053.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0053.433] lstrlenW (lpString=".jpg") returned 4 [0053.433] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0053.434] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0053.434] lstrlenW (lpString="ipsnor.xml") returned 10 [0053.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0053.434] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2580) returned 1 [0053.434] CloseHandle (hObject=0x1d8) returned 1 [0053.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0053.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0053.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0053.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0053.434] lstrlenW (lpString=".doc") returned 4 [0053.434] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0053.434] lstrlenW (lpString=".docx") returned 5 [0053.434] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0053.434] lstrlenW (lpString=".pdf") returned 4 [0053.434] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0053.435] lstrlenW (lpString=".xls") returned 4 [0053.435] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0053.435] lstrlenW (lpString=".xlsx") returned 5 [0053.435] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0053.435] lstrlenW (lpString=".ppt") returned 4 [0053.435] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0053.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0053.435] lstrlenW (lpString=".zip") returned 4 [0053.435] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0053.435] lstrlenW (lpString=".rar") returned 4 [0053.435] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0053.435] lstrlenW (lpString=".bz2") returned 4 [0053.435] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0053.435] lstrlenW (lpString=".7z") returned 3 [0053.435] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0053.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0053.435] lstrlenW (lpString=".dbf") returned 4 [0053.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.440] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0053.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0053.441] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fc6c | out: lpNewFilePointer=0x0) returned 1 [0053.441] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.441] ReadFile (in: hFile=0x1d8, lpBuffer=0x3420058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x229fc38, lpOverlapped=0x0 | out: lpBuffer=0x3420058*, lpNumberOfBytesRead=0x229fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.445] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x229fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.445] ReadFile (in: hFile=0x1d8, lpBuffer=0x3460058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x229fc38, lpOverlapped=0x0 | out: lpBuffer=0x3460058*, lpNumberOfBytesRead=0x229fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.448] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x229fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.448] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x229fc2c | out: lpNewFilePointer=0x0) returned 1 [0053.448] ReadFile (in: hFile=0x1d8, lpBuffer=0x34a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x229fc38, lpOverlapped=0x0 | out: lpBuffer=0x34a0058*, lpNumberOfBytesRead=0x229fc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.804] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.804] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x229fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0053.827] SetEndOfFile (hFile=0x1d8) returned 1 [0053.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f854b0 [0053.827] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.827] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x229fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x229fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.027] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x229fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.027] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x229fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x229fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.029] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x229fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.029] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x229fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x229fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.031] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b0 | out: hHeap=0x8d0000) returned 1 [0054.031] CloseHandle (hObject=0x1d8) returned 1 [0054.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.456] lstrlenW (lpString=".doc") returned 4 [0054.457] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0054.457] lstrlenW (lpString=".docx") returned 5 [0054.457] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0054.457] lstrlenW (lpString=".pdf") returned 4 [0054.457] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0054.457] lstrlenW (lpString=".xls") returned 4 [0054.457] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0054.457] lstrlenW (lpString=".xlsx") returned 5 [0054.457] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0054.457] lstrlenW (lpString=".ppt") returned 4 [0054.457] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0054.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.457] lstrlenW (lpString=".zip") returned 4 [0054.457] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0054.457] lstrlenW (lpString=".rar") returned 4 [0054.457] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0054.457] lstrlenW (lpString=".bz2") returned 4 [0054.457] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0054.457] lstrlenW (lpString=".7z") returned 3 [0054.457] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0054.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.457] lstrlenW (lpString=".dbf") returned 4 [0054.457] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0054.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.457] lstrlenW (lpString=".1cd") returned 4 [0054.457] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0054.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.457] lstrlenW (lpString=".jpg") returned 4 [0054.457] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0054.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.457] lstrlenW (lpString=".doc") returned 4 [0054.458] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0054.458] lstrlenW (lpString=".docx") returned 5 [0054.458] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0054.458] lstrlenW (lpString=".pdf") returned 4 [0054.458] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0054.458] lstrlenW (lpString=".xls") returned 4 [0054.458] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0054.458] lstrlenW (lpString=".xlsx") returned 5 [0054.458] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0054.458] lstrlenW (lpString=".ppt") returned 4 [0054.458] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0054.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.458] lstrlenW (lpString=".zip") returned 4 [0054.458] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0054.458] lstrlenW (lpString=".rar") returned 4 [0054.458] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0054.458] lstrlenW (lpString=".bz2") returned 4 [0054.458] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0054.458] lstrlenW (lpString=".7z") returned 3 [0054.458] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0054.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.458] lstrlenW (lpString=".dbf") returned 4 [0054.458] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0054.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.458] lstrlenW (lpString=".1cd") returned 4 [0054.458] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0054.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0054.458] lstrlenW (lpString=".jpg") returned 4 [0054.458] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0054.458] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0054.459] lstrlenW (lpString="SETUP.CHM") returned 9 [0054.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.817] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=67190) returned 1 [0054.817] CloseHandle (hObject=0x1e8) returned 1 [0054.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0054.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.818] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.818] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.818] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.818] GetLastError () returned 0x0 [0054.818] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x10676, lpOverlapped=0x0) returned 1 [0054.832] WriteFile (in: hFile=0x1ec, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0054.833] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.833] WriteFile (in: hFile=0x1ec, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.834] SetEndOfFile (hFile=0x1ec) returned 1 [0054.834] CloseHandle (hObject=0x1ec) returned 1 [0054.835] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.835] SetEndOfFile (hFile=0x1e8) returned 1 [0054.836] CloseHandle (hObject=0x1e8) returned 1 [0054.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.837] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0054.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.837] lstrlenW (lpString=".doc") returned 4 [0054.837] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0054.837] lstrlenW (lpString=".docx") returned 5 [0054.837] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0054.837] lstrlenW (lpString=".pdf") returned 4 [0054.837] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0054.837] lstrlenW (lpString=".xls") returned 4 [0054.837] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0054.837] lstrlenW (lpString=".xlsx") returned 5 [0054.837] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0054.837] lstrlenW (lpString=".ppt") returned 4 [0054.837] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0054.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.837] lstrlenW (lpString=".zip") returned 4 [0054.837] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0054.837] lstrlenW (lpString=".rar") returned 4 [0054.837] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0054.837] lstrlenW (lpString=".bz2") returned 4 [0054.837] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0054.838] lstrlenW (lpString=".7z") returned 3 [0054.838] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0054.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.838] lstrlenW (lpString=".dbf") returned 4 [0054.838] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0054.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.838] lstrlenW (lpString=".1cd") returned 4 [0054.838] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0054.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.838] lstrlenW (lpString=".jpg") returned 4 [0054.838] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0054.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.838] lstrlenW (lpString=".doc") returned 4 [0054.838] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0054.838] lstrlenW (lpString=".docx") returned 5 [0054.838] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0054.838] lstrlenW (lpString=".pdf") returned 4 [0054.838] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0054.838] lstrlenW (lpString=".xls") returned 4 [0054.838] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0054.838] lstrlenW (lpString=".xlsx") returned 5 [0054.838] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0054.838] lstrlenW (lpString=".ppt") returned 4 [0054.838] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0054.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.838] lstrlenW (lpString=".zip") returned 4 [0054.838] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0054.838] lstrlenW (lpString=".rar") returned 4 [0054.838] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0054.838] lstrlenW (lpString=".bz2") returned 4 [0054.839] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0054.839] lstrlenW (lpString=".7z") returned 3 [0054.839] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0054.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.839] lstrlenW (lpString=".dbf") returned 4 [0054.839] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0054.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.839] lstrlenW (lpString=".1cd") returned 4 [0054.839] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0054.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0054.839] lstrlenW (lpString=".jpg") returned 4 [0054.839] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0054.839] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.839] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0054.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.839] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1606) returned 1 [0054.839] CloseHandle (hObject=0x1e8) returned 1 [0054.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0054.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.840] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.840] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.840] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.889] GetLastError () returned 0x0 [0054.889] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x646, lpOverlapped=0x0) returned 1 [0054.893] WriteFile (in: hFile=0x208, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x650, lpOverlapped=0x0) returned 1 [0054.894] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.894] WriteFile (in: hFile=0x208, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0054.895] SetEndOfFile (hFile=0x208) returned 1 [0054.895] CloseHandle (hObject=0x208) returned 1 [0054.895] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.895] SetEndOfFile (hFile=0x1e8) returned 1 [0054.896] CloseHandle (hObject=0x1e8) returned 1 [0054.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.897] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0054.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.897] lstrlenW (lpString=".doc") returned 4 [0054.897] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.897] lstrlenW (lpString=".docx") returned 5 [0054.897] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.897] lstrlenW (lpString=".pdf") returned 4 [0054.897] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.897] lstrlenW (lpString=".xls") returned 4 [0054.897] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.897] lstrlenW (lpString=".xlsx") returned 5 [0054.897] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.897] lstrlenW (lpString=".ppt") returned 4 [0054.897] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.897] lstrlenW (lpString=".zip") returned 4 [0054.897] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.897] lstrlenW (lpString=".rar") returned 4 [0054.897] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.897] lstrlenW (lpString=".bz2") returned 4 [0054.897] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.897] lstrlenW (lpString=".7z") returned 3 [0054.897] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.897] lstrlenW (lpString=".dbf") returned 4 [0054.897] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.898] lstrlenW (lpString=".1cd") returned 4 [0054.898] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.898] lstrlenW (lpString=".jpg") returned 4 [0054.898] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.898] lstrlenW (lpString=".doc") returned 4 [0054.898] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.898] lstrlenW (lpString=".docx") returned 5 [0054.898] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.898] lstrlenW (lpString=".pdf") returned 4 [0054.898] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.898] lstrlenW (lpString=".xls") returned 4 [0054.898] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.898] lstrlenW (lpString=".xlsx") returned 5 [0054.898] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.898] lstrlenW (lpString=".ppt") returned 4 [0054.898] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.898] lstrlenW (lpString=".zip") returned 4 [0054.898] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.898] lstrlenW (lpString=".rar") returned 4 [0054.898] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.898] lstrlenW (lpString=".bz2") returned 4 [0054.898] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.898] lstrlenW (lpString=".7z") returned 3 [0054.898] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.898] lstrlenW (lpString=".dbf") returned 4 [0054.899] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.899] lstrlenW (lpString=".1cd") returned 4 [0054.899] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0054.899] lstrlenW (lpString=".jpg") returned 4 [0054.899] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.899] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.899] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0054.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.899] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3186) returned 1 [0054.899] CloseHandle (hObject=0x1e8) returned 1 [0054.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0054.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.900] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.900] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.902] GetLastError () returned 0x0 [0054.902] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xc72, lpOverlapped=0x0) returned 1 [0054.903] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0054.904] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.904] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0054.904] SetEndOfFile (hFile=0x180) returned 1 [0054.904] CloseHandle (hObject=0x180) returned 1 [0054.905] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.905] SetEndOfFile (hFile=0x1e8) returned 1 [0054.906] CloseHandle (hObject=0x1e8) returned 1 [0054.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.906] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.907] lstrlenW (lpString=".doc") returned 4 [0054.907] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.907] lstrlenW (lpString=".docx") returned 5 [0054.907] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.907] lstrlenW (lpString=".pdf") returned 4 [0054.907] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.907] lstrlenW (lpString=".xls") returned 4 [0054.907] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.907] lstrlenW (lpString=".xlsx") returned 5 [0054.907] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.907] lstrlenW (lpString=".ppt") returned 4 [0054.907] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.907] lstrlenW (lpString=".zip") returned 4 [0054.907] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.907] lstrlenW (lpString=".rar") returned 4 [0054.907] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.907] lstrlenW (lpString=".bz2") returned 4 [0054.907] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.907] lstrlenW (lpString=".7z") returned 3 [0054.907] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.907] lstrlenW (lpString=".dbf") returned 4 [0054.907] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.907] lstrlenW (lpString=".1cd") returned 4 [0054.908] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.908] lstrlenW (lpString=".jpg") returned 4 [0054.908] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.908] lstrlenW (lpString=".doc") returned 4 [0054.908] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.908] lstrlenW (lpString=".docx") returned 5 [0054.908] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.908] lstrlenW (lpString=".pdf") returned 4 [0054.908] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.908] lstrlenW (lpString=".xls") returned 4 [0054.908] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.908] lstrlenW (lpString=".xlsx") returned 5 [0054.908] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.908] lstrlenW (lpString=".ppt") returned 4 [0054.908] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.908] lstrlenW (lpString=".zip") returned 4 [0054.908] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.908] lstrlenW (lpString=".rar") returned 4 [0054.908] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.908] lstrlenW (lpString=".bz2") returned 4 [0054.908] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.908] lstrlenW (lpString=".7z") returned 3 [0054.908] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.908] lstrlenW (lpString=".dbf") returned 4 [0054.908] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.909] lstrlenW (lpString=".1cd") returned 4 [0054.909] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0054.909] lstrlenW (lpString=".jpg") returned 4 [0054.909] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.909] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.909] lstrlenW (lpString="SETUP.XML") returned 9 [0054.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.910] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=4207) returned 1 [0054.910] CloseHandle (hObject=0x1e8) returned 1 [0054.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0054.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.910] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.910] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.910] GetLastError () returned 0x0 [0054.910] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x106f, lpOverlapped=0x0) returned 1 [0054.913] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0054.914] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.914] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.914] SetEndOfFile (hFile=0x180) returned 1 [0054.914] CloseHandle (hObject=0x180) returned 1 [0054.914] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.915] SetEndOfFile (hFile=0x1e8) returned 1 [0054.915] CloseHandle (hObject=0x1e8) returned 1 [0054.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.916] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0054.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.916] lstrlenW (lpString=".doc") returned 4 [0054.916] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.916] lstrlenW (lpString=".docx") returned 5 [0054.916] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.916] lstrlenW (lpString=".pdf") returned 4 [0054.916] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.916] lstrlenW (lpString=".xls") returned 4 [0054.916] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.916] lstrlenW (lpString=".xlsx") returned 5 [0054.916] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.916] lstrlenW (lpString=".ppt") returned 4 [0054.916] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.916] lstrlenW (lpString=".zip") returned 4 [0054.916] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.916] lstrlenW (lpString=".rar") returned 4 [0054.916] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.916] lstrlenW (lpString=".bz2") returned 4 [0054.916] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.916] lstrlenW (lpString=".7z") returned 3 [0054.917] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.917] lstrlenW (lpString=".dbf") returned 4 [0054.917] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.917] lstrlenW (lpString=".1cd") returned 4 [0054.917] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.917] lstrlenW (lpString=".jpg") returned 4 [0054.917] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.917] lstrlenW (lpString=".doc") returned 4 [0054.917] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.917] lstrlenW (lpString=".docx") returned 5 [0054.917] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.917] lstrlenW (lpString=".pdf") returned 4 [0054.917] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.917] lstrlenW (lpString=".xls") returned 4 [0054.917] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.917] lstrlenW (lpString=".xlsx") returned 5 [0054.917] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.917] lstrlenW (lpString=".ppt") returned 4 [0054.917] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.917] lstrlenW (lpString=".zip") returned 4 [0054.917] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.917] lstrlenW (lpString=".rar") returned 4 [0054.917] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.917] lstrlenW (lpString=".bz2") returned 4 [0054.917] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.917] lstrlenW (lpString=".7z") returned 3 [0054.918] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.918] lstrlenW (lpString=".dbf") returned 4 [0054.918] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.918] lstrlenW (lpString=".1cd") returned 4 [0054.918] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0054.918] lstrlenW (lpString=".jpg") returned 4 [0054.918] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.918] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.918] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0054.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.918] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1450) returned 1 [0054.918] CloseHandle (hObject=0x1e8) returned 1 [0054.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0054.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.919] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.919] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.919] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.921] GetLastError () returned 0x0 [0054.921] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0054.925] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0054.926] ReadFile (in: hFile=0x1e8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.926] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0054.926] SetEndOfFile (hFile=0x180) returned 1 [0054.926] CloseHandle (hObject=0x180) returned 1 [0054.927] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.927] SetEndOfFile (hFile=0x1e8) returned 1 [0054.928] CloseHandle (hObject=0x1e8) returned 1 [0054.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.928] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0054.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.928] lstrlenW (lpString=".doc") returned 4 [0054.928] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.928] lstrlenW (lpString=".docx") returned 5 [0054.928] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.928] lstrlenW (lpString=".pdf") returned 4 [0054.928] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.929] lstrlenW (lpString=".xls") returned 4 [0054.929] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.929] lstrlenW (lpString=".xlsx") returned 5 [0054.929] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.929] lstrlenW (lpString=".ppt") returned 4 [0054.929] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.929] lstrlenW (lpString=".zip") returned 4 [0054.929] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.929] lstrlenW (lpString=".rar") returned 4 [0054.929] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.929] lstrlenW (lpString=".bz2") returned 4 [0054.929] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.929] lstrlenW (lpString=".7z") returned 3 [0054.929] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.929] lstrlenW (lpString=".dbf") returned 4 [0054.929] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.929] lstrlenW (lpString=".1cd") returned 4 [0054.929] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.929] lstrlenW (lpString=".jpg") returned 4 [0054.929] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.929] lstrlenW (lpString=".doc") returned 4 [0054.929] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.929] lstrlenW (lpString=".docx") returned 5 [0054.929] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.929] lstrlenW (lpString=".pdf") returned 4 [0054.930] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.930] lstrlenW (lpString=".xls") returned 4 [0054.930] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.930] lstrlenW (lpString=".xlsx") returned 5 [0054.930] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.930] lstrlenW (lpString=".ppt") returned 4 [0054.930] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.930] lstrlenW (lpString=".zip") returned 4 [0054.930] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.930] lstrlenW (lpString=".rar") returned 4 [0054.930] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.930] lstrlenW (lpString=".bz2") returned 4 [0054.930] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.930] lstrlenW (lpString=".7z") returned 3 [0054.930] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.930] lstrlenW (lpString=".dbf") returned 4 [0054.930] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.930] lstrlenW (lpString=".1cd") returned 4 [0054.930] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0054.930] lstrlenW (lpString=".jpg") returned 4 [0054.930] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.930] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.930] lstrlenW (lpString="SETUP.XML") returned 9 [0054.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.274] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1886) returned 1 [0055.274] CloseHandle (hObject=0x180) returned 1 [0055.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0055.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.274] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.274] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.275] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.275] GetLastError () returned 0x0 [0055.275] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x75e, lpOverlapped=0x0) returned 1 [0055.513] WriteFile (in: hFile=0x204, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x760, lpOverlapped=0x0) returned 1 [0055.515] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.515] WriteFile (in: hFile=0x204, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.515] SetEndOfFile (hFile=0x204) returned 1 [0055.515] CloseHandle (hObject=0x204) returned 1 [0055.518] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.518] SetEndOfFile (hFile=0x180) returned 1 [0055.519] CloseHandle (hObject=0x180) returned 1 [0055.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.519] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0055.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.520] lstrlenW (lpString=".doc") returned 4 [0055.520] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.520] lstrlenW (lpString=".docx") returned 5 [0055.520] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0055.520] lstrlenW (lpString=".pdf") returned 4 [0055.520] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.520] lstrlenW (lpString=".xls") returned 4 [0055.520] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.520] lstrlenW (lpString=".xlsx") returned 5 [0055.520] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0055.520] lstrlenW (lpString=".ppt") returned 4 [0055.520] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.520] lstrlenW (lpString=".zip") returned 4 [0055.520] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.520] lstrlenW (lpString=".rar") returned 4 [0055.520] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.520] lstrlenW (lpString=".bz2") returned 4 [0055.520] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.520] lstrlenW (lpString=".7z") returned 3 [0055.520] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.520] lstrlenW (lpString=".dbf") returned 4 [0055.520] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.520] lstrlenW (lpString=".1cd") returned 4 [0055.521] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.521] lstrlenW (lpString=".jpg") returned 4 [0055.521] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.521] lstrlenW (lpString=".doc") returned 4 [0055.521] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.521] lstrlenW (lpString=".docx") returned 5 [0055.521] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0055.521] lstrlenW (lpString=".pdf") returned 4 [0055.521] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.521] lstrlenW (lpString=".xls") returned 4 [0055.521] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.521] lstrlenW (lpString=".xlsx") returned 5 [0055.521] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0055.521] lstrlenW (lpString=".ppt") returned 4 [0055.521] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.521] lstrlenW (lpString=".zip") returned 4 [0055.521] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.521] lstrlenW (lpString=".rar") returned 4 [0055.521] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.521] lstrlenW (lpString=".bz2") returned 4 [0055.521] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.521] lstrlenW (lpString=".7z") returned 3 [0055.521] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.521] lstrlenW (lpString=".dbf") returned 4 [0055.521] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.521] lstrlenW (lpString=".1cd") returned 4 [0055.522] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0055.522] lstrlenW (lpString=".jpg") returned 4 [0055.522] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.522] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.522] lstrlenW (lpString="SETUP.XML") returned 9 [0055.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.522] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1872) returned 1 [0055.522] CloseHandle (hObject=0x180) returned 1 [0055.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0055.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.523] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.523] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.523] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.523] GetLastError () returned 0x0 [0055.523] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x750, lpOverlapped=0x0) returned 1 [0055.690] WriteFile (in: hFile=0x204, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x760, lpOverlapped=0x0) returned 1 [0055.692] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.692] WriteFile (in: hFile=0x204, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.692] SetEndOfFile (hFile=0x204) returned 1 [0055.692] CloseHandle (hObject=0x204) returned 1 [0055.694] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.694] SetEndOfFile (hFile=0x180) returned 1 [0055.720] CloseHandle (hObject=0x180) returned 1 [0055.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.721] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0055.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.721] lstrlenW (lpString=".doc") returned 4 [0055.721] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.721] lstrlenW (lpString=".docx") returned 5 [0055.721] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0055.721] lstrlenW (lpString=".pdf") returned 4 [0055.721] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.721] lstrlenW (lpString=".xls") returned 4 [0055.721] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.721] lstrlenW (lpString=".xlsx") returned 5 [0055.721] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0055.721] lstrlenW (lpString=".ppt") returned 4 [0055.721] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.722] lstrlenW (lpString=".zip") returned 4 [0055.722] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.722] lstrlenW (lpString=".rar") returned 4 [0055.722] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.722] lstrlenW (lpString=".bz2") returned 4 [0055.722] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.722] lstrlenW (lpString=".7z") returned 3 [0055.722] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.722] lstrlenW (lpString=".dbf") returned 4 [0055.722] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.722] lstrlenW (lpString=".1cd") returned 4 [0055.722] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.722] lstrlenW (lpString=".jpg") returned 4 [0055.722] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.722] lstrlenW (lpString=".doc") returned 4 [0055.722] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.722] lstrlenW (lpString=".docx") returned 5 [0055.722] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0055.722] lstrlenW (lpString=".pdf") returned 4 [0055.722] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.722] lstrlenW (lpString=".xls") returned 4 [0055.722] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.722] lstrlenW (lpString=".xlsx") returned 5 [0055.722] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0055.722] lstrlenW (lpString=".ppt") returned 4 [0055.722] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.723] lstrlenW (lpString=".zip") returned 4 [0055.723] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.723] lstrlenW (lpString=".rar") returned 4 [0055.723] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.723] lstrlenW (lpString=".bz2") returned 4 [0055.723] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.723] lstrlenW (lpString=".7z") returned 3 [0055.723] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.723] lstrlenW (lpString=".dbf") returned 4 [0055.723] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.723] lstrlenW (lpString=".1cd") returned 4 [0055.723] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0055.723] lstrlenW (lpString=".jpg") returned 4 [0055.723] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.723] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.723] lstrlenW (lpString="SETUP.XML") returned 9 [0055.723] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.724] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5884) returned 1 [0055.724] CloseHandle (hObject=0x180) returned 1 [0055.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0055.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0055.724] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.724] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.232] GetLastError () returned 0x0 [0056.232] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x16fc, lpOverlapped=0x0) returned 1 [0056.369] WriteFile (in: hFile=0x1e4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0056.382] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.382] WriteFile (in: hFile=0x1e4, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.382] SetEndOfFile (hFile=0x1e4) returned 1 [0056.382] CloseHandle (hObject=0x1e4) returned 1 [0056.382] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.382] SetEndOfFile (hFile=0x180) returned 1 [0056.383] CloseHandle (hObject=0x180) returned 1 [0056.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.383] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0056.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.384] lstrlenW (lpString=".doc") returned 4 [0056.384] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.384] lstrlenW (lpString=".docx") returned 5 [0056.384] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.384] lstrlenW (lpString=".pdf") returned 4 [0056.384] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.384] lstrlenW (lpString=".xls") returned 4 [0056.384] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.384] lstrlenW (lpString=".xlsx") returned 5 [0056.384] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.384] lstrlenW (lpString=".ppt") returned 4 [0056.384] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.384] lstrlenW (lpString=".zip") returned 4 [0056.384] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.384] lstrlenW (lpString=".rar") returned 4 [0056.384] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.384] lstrlenW (lpString=".bz2") returned 4 [0056.384] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.384] lstrlenW (lpString=".7z") returned 3 [0056.384] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.384] lstrlenW (lpString=".dbf") returned 4 [0056.384] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.384] lstrlenW (lpString=".1cd") returned 4 [0056.384] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.385] lstrlenW (lpString=".jpg") returned 4 [0056.385] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.385] lstrlenW (lpString=".doc") returned 4 [0056.385] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.385] lstrlenW (lpString=".docx") returned 5 [0056.385] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.385] lstrlenW (lpString=".pdf") returned 4 [0056.385] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.385] lstrlenW (lpString=".xls") returned 4 [0056.385] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.385] lstrlenW (lpString=".xlsx") returned 5 [0056.385] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.385] lstrlenW (lpString=".ppt") returned 4 [0056.385] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.385] lstrlenW (lpString=".zip") returned 4 [0056.385] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.385] lstrlenW (lpString=".rar") returned 4 [0056.385] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.385] lstrlenW (lpString=".bz2") returned 4 [0056.385] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.385] lstrlenW (lpString=".7z") returned 3 [0056.385] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.385] lstrlenW (lpString=".dbf") returned 4 [0056.385] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.385] lstrlenW (lpString=".1cd") returned 4 [0056.385] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0056.386] lstrlenW (lpString=".jpg") returned 4 [0056.386] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.386] lstrcmpiW (lpString1=".HTM", lpString2=".wiki") returned -1 [0056.386] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0056.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.387] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=11463) returned 1 [0056.387] CloseHandle (hObject=0x180) returned 1 [0056.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0056.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.387] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.387] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.399] GetLastError () returned 0x0 [0056.399] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0056.412] WriteFile (in: hFile=0x1fc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0056.413] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.413] WriteFile (in: hFile=0x1fc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.414] SetEndOfFile (hFile=0x1fc) returned 1 [0056.414] CloseHandle (hObject=0x1fc) returned 1 [0056.414] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.414] SetEndOfFile (hFile=0x180) returned 1 [0056.415] CloseHandle (hObject=0x180) returned 1 [0056.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0056.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.415] lstrlenW (lpString=".doc") returned 4 [0056.415] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0056.415] lstrlenW (lpString=".docx") returned 5 [0056.415] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0056.415] lstrlenW (lpString=".pdf") returned 4 [0056.415] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0056.415] lstrlenW (lpString=".xls") returned 4 [0056.415] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0056.416] lstrlenW (lpString=".xlsx") returned 5 [0056.416] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0056.416] lstrlenW (lpString=".ppt") returned 4 [0056.416] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0056.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.416] lstrlenW (lpString=".zip") returned 4 [0056.416] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0056.416] lstrlenW (lpString=".rar") returned 4 [0056.416] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0056.416] lstrlenW (lpString=".bz2") returned 4 [0056.416] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0056.416] lstrlenW (lpString=".7z") returned 3 [0056.416] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0056.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.416] lstrlenW (lpString=".dbf") returned 4 [0056.416] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0056.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.416] lstrlenW (lpString=".1cd") returned 4 [0056.416] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0056.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.416] lstrlenW (lpString=".jpg") returned 4 [0056.416] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0056.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.416] lstrlenW (lpString=".doc") returned 4 [0056.416] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0056.416] lstrlenW (lpString=".docx") returned 5 [0056.416] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0056.416] lstrlenW (lpString=".pdf") returned 4 [0056.416] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0056.416] lstrlenW (lpString=".xls") returned 4 [0056.416] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0056.416] lstrlenW (lpString=".xlsx") returned 5 [0056.417] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0056.417] lstrlenW (lpString=".ppt") returned 4 [0056.417] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0056.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.417] lstrlenW (lpString=".zip") returned 4 [0056.417] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0056.417] lstrlenW (lpString=".rar") returned 4 [0056.417] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0056.417] lstrlenW (lpString=".bz2") returned 4 [0056.417] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0056.417] lstrlenW (lpString=".7z") returned 3 [0056.417] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0056.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.417] lstrlenW (lpString=".dbf") returned 4 [0056.417] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0056.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.417] lstrlenW (lpString=".1cd") returned 4 [0056.417] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0056.417] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0056.417] lstrlenW (lpString=".jpg") returned 4 [0056.417] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0056.417] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.417] lstrlenW (lpString="PHONE.XML") returned 9 [0056.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.465] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1844) returned 1 [0056.465] CloseHandle (hObject=0x1e4) returned 1 [0056.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0056.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.466] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.466] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0056.466] GetLastError () returned 0x0 [0056.466] ReadFile (in: hFile=0x1e4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x734, lpOverlapped=0x0) returned 1 [0056.636] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x740, lpOverlapped=0x0) returned 1 [0056.637] ReadFile (in: hFile=0x1e4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.637] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.637] SetEndOfFile (hFile=0x1d8) returned 1 [0056.637] CloseHandle (hObject=0x1d8) returned 1 [0056.637] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.637] SetEndOfFile (hFile=0x1e4) returned 1 [0056.638] CloseHandle (hObject=0x1e4) returned 1 [0056.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.638] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0056.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.639] lstrlenW (lpString=".doc") returned 4 [0056.639] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.639] lstrlenW (lpString=".docx") returned 5 [0056.639] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0056.639] lstrlenW (lpString=".pdf") returned 4 [0056.639] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.639] lstrlenW (lpString=".xls") returned 4 [0056.639] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.639] lstrlenW (lpString=".xlsx") returned 5 [0056.639] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0056.639] lstrlenW (lpString=".ppt") returned 4 [0056.639] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.639] lstrlenW (lpString=".zip") returned 4 [0056.639] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.639] lstrlenW (lpString=".rar") returned 4 [0056.639] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.639] lstrlenW (lpString=".bz2") returned 4 [0056.639] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.639] lstrlenW (lpString=".7z") returned 3 [0056.639] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.639] lstrlenW (lpString=".dbf") returned 4 [0056.639] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.639] lstrlenW (lpString=".1cd") returned 4 [0056.640] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.640] lstrlenW (lpString=".jpg") returned 4 [0056.640] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.640] lstrlenW (lpString=".doc") returned 4 [0056.640] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.640] lstrlenW (lpString=".docx") returned 5 [0056.640] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0056.640] lstrlenW (lpString=".pdf") returned 4 [0056.640] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.640] lstrlenW (lpString=".xls") returned 4 [0056.640] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.640] lstrlenW (lpString=".xlsx") returned 5 [0056.640] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0056.640] lstrlenW (lpString=".ppt") returned 4 [0056.640] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.640] lstrlenW (lpString=".zip") returned 4 [0056.640] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.640] lstrlenW (lpString=".rar") returned 4 [0056.640] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.640] lstrlenW (lpString=".bz2") returned 4 [0056.640] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.640] lstrlenW (lpString=".7z") returned 3 [0056.640] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.640] lstrlenW (lpString=".dbf") returned 4 [0056.640] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.640] lstrlenW (lpString=".1cd") returned 4 [0056.640] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0056.641] lstrlenW (lpString=".jpg") returned 4 [0056.641] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.641] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.641] lstrlenW (lpString="TIME.XML") returned 8 [0056.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.641] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=8564) returned 1 [0056.641] CloseHandle (hObject=0x1e4) returned 1 [0056.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0056.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.642] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.642] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0056.642] GetLastError () returned 0x0 [0056.642] ReadFile (in: hFile=0x1e4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x2174, lpOverlapped=0x0) returned 1 [0056.673] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0056.675] ReadFile (in: hFile=0x1e4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.675] WriteFile (in: hFile=0x1d8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0056.675] SetEndOfFile (hFile=0x1d8) returned 1 [0056.675] CloseHandle (hObject=0x1d8) returned 1 [0056.676] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.676] SetEndOfFile (hFile=0x1e4) returned 1 [0056.676] CloseHandle (hObject=0x1e4) returned 1 [0056.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0056.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.677] lstrlenW (lpString=".doc") returned 4 [0056.677] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.677] lstrlenW (lpString=".docx") returned 5 [0056.677] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0056.677] lstrlenW (lpString=".pdf") returned 4 [0056.677] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.677] lstrlenW (lpString=".xls") returned 4 [0056.677] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.677] lstrlenW (lpString=".xlsx") returned 5 [0056.677] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0056.677] lstrlenW (lpString=".ppt") returned 4 [0056.677] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.677] lstrlenW (lpString=".zip") returned 4 [0056.677] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.677] lstrlenW (lpString=".rar") returned 4 [0056.678] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.678] lstrlenW (lpString=".bz2") returned 4 [0056.678] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.678] lstrlenW (lpString=".7z") returned 3 [0056.678] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.678] lstrlenW (lpString=".dbf") returned 4 [0056.678] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.678] lstrlenW (lpString=".1cd") returned 4 [0056.678] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.678] lstrlenW (lpString=".jpg") returned 4 [0056.678] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.678] lstrlenW (lpString=".doc") returned 4 [0056.678] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.678] lstrlenW (lpString=".docx") returned 5 [0056.678] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0056.678] lstrlenW (lpString=".pdf") returned 4 [0056.678] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.678] lstrlenW (lpString=".xls") returned 4 [0056.678] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.678] lstrlenW (lpString=".xlsx") returned 5 [0056.678] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0056.678] lstrlenW (lpString=".ppt") returned 4 [0056.678] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.678] lstrlenW (lpString=".zip") returned 4 [0056.678] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.678] lstrlenW (lpString=".rar") returned 4 [0056.679] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.679] lstrlenW (lpString=".bz2") returned 4 [0056.679] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.679] lstrlenW (lpString=".7z") returned 3 [0056.679] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.679] lstrlenW (lpString=".dbf") returned 4 [0056.679] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.679] lstrlenW (lpString=".1cd") returned 4 [0056.679] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0056.679] lstrlenW (lpString=".jpg") returned 4 [0056.679] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.679] lstrcmpiW (lpString1=".TXT", lpString2=".wiki") returned -1 [0056.679] lstrlenW (lpString="METCONV.TXT") returned 11 [0056.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.979] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1183416) returned 1 [0056.979] CloseHandle (hObject=0x184) returned 1 [0056.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0056.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.980] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.980] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.980] GetLastError () returned 0x0 [0056.980] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0057.004] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0057.023] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0057.236] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0057.241] ReadFile (in: hFile=0x184, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.241] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.241] SetEndOfFile (hFile=0x200) returned 1 [0057.242] CloseHandle (hObject=0x200) returned 1 [0057.242] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.242] SetEndOfFile (hFile=0x184) returned 1 [0057.243] CloseHandle (hObject=0x184) returned 1 [0057.243] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0057.244] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.244] lstrlenW (lpString=".doc") returned 4 [0057.244] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0057.244] lstrlenW (lpString=".docx") returned 5 [0057.244] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0057.244] lstrlenW (lpString=".pdf") returned 4 [0057.244] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0057.244] lstrlenW (lpString=".xls") returned 4 [0057.244] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0057.244] lstrlenW (lpString=".xlsx") returned 5 [0057.244] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0057.244] lstrlenW (lpString=".ppt") returned 4 [0057.244] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0057.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.245] lstrlenW (lpString=".zip") returned 4 [0057.245] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0057.245] lstrlenW (lpString=".rar") returned 4 [0057.245] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0057.245] lstrlenW (lpString=".bz2") returned 4 [0057.245] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0057.245] lstrlenW (lpString=".7z") returned 3 [0057.245] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0057.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.245] lstrlenW (lpString=".dbf") returned 4 [0057.245] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0057.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.245] lstrlenW (lpString=".1cd") returned 4 [0057.245] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0057.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.245] lstrlenW (lpString=".jpg") returned 4 [0057.245] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0057.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.245] lstrlenW (lpString=".doc") returned 4 [0057.245] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0057.245] lstrlenW (lpString=".docx") returned 5 [0057.245] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0057.245] lstrlenW (lpString=".pdf") returned 4 [0057.245] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0057.245] lstrlenW (lpString=".xls") returned 4 [0057.245] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0057.245] lstrlenW (lpString=".xlsx") returned 5 [0057.245] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0057.245] lstrlenW (lpString=".ppt") returned 4 [0057.245] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0057.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.245] lstrlenW (lpString=".zip") returned 4 [0057.246] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0057.246] lstrlenW (lpString=".rar") returned 4 [0057.246] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0057.246] lstrlenW (lpString=".bz2") returned 4 [0057.246] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0057.246] lstrlenW (lpString=".7z") returned 3 [0057.246] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0057.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.246] lstrlenW (lpString=".dbf") returned 4 [0057.246] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0057.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.246] lstrlenW (lpString=".1cd") returned 4 [0057.246] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0057.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0057.246] lstrlenW (lpString=".jpg") returned 4 [0057.246] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0057.246] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0057.246] lstrlenW (lpString="Tanspecks.jpg") returned 13 [0057.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0057.915] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3650) returned 1 [0057.915] CloseHandle (hObject=0x204) returned 1 [0057.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg")) returned 0x20 [0057.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tanspecks.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.916] lstrlenW (lpString=".doc") returned 4 [0057.916] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0057.916] lstrlenW (lpString=".docx") returned 5 [0057.916] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0057.916] lstrlenW (lpString=".pdf") returned 4 [0057.916] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0057.916] lstrlenW (lpString=".xls") returned 4 [0057.916] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0057.916] lstrlenW (lpString=".xlsx") returned 5 [0057.916] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0057.916] lstrlenW (lpString=".ppt") returned 4 [0057.916] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0057.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.916] lstrlenW (lpString=".zip") returned 4 [0057.916] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0057.916] lstrlenW (lpString=".rar") returned 4 [0057.916] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0057.916] lstrlenW (lpString=".bz2") returned 4 [0057.916] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0057.916] lstrlenW (lpString=".7z") returned 3 [0057.916] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0057.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.916] lstrlenW (lpString=".dbf") returned 4 [0057.916] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0057.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.916] lstrlenW (lpString=".1cd") returned 4 [0057.916] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0057.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.916] lstrlenW (lpString=".jpg") returned 4 [0057.917] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0057.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.917] lstrlenW (lpString=".doc") returned 4 [0057.917] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0057.917] lstrlenW (lpString=".docx") returned 5 [0057.917] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0057.917] lstrlenW (lpString=".pdf") returned 4 [0057.917] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0057.917] lstrlenW (lpString=".xls") returned 4 [0057.917] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0057.917] lstrlenW (lpString=".xlsx") returned 5 [0057.917] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0057.917] lstrlenW (lpString=".ppt") returned 4 [0057.917] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0057.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.917] lstrlenW (lpString=".zip") returned 4 [0057.917] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0057.917] lstrlenW (lpString=".rar") returned 4 [0057.917] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0057.917] lstrlenW (lpString=".bz2") returned 4 [0057.917] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0057.917] lstrlenW (lpString=".7z") returned 3 [0057.917] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0057.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.917] lstrlenW (lpString=".dbf") returned 4 [0057.917] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0057.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.917] lstrlenW (lpString=".1cd") returned 4 [0057.917] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0057.917] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tanspecks.jpg") returned 71 [0057.917] lstrlenW (lpString=".jpg") returned 4 [0057.918] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0057.918] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0057.918] lstrlenW (lpString="Tiki.gif") returned 8 [0057.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0057.918] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=4638) returned 1 [0057.918] CloseHandle (hObject=0x204) returned 1 [0057.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif")) returned 0x20 [0057.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\tiki.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.918] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.918] lstrlenW (lpString=".doc") returned 4 [0057.918] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0057.918] lstrlenW (lpString=".docx") returned 5 [0057.919] lstrcmpiW (lpString1=".docx", lpString2="i.gif") returned -1 [0057.919] lstrlenW (lpString=".pdf") returned 4 [0057.919] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0057.919] lstrlenW (lpString=".xls") returned 4 [0057.919] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0057.919] lstrlenW (lpString=".xlsx") returned 5 [0057.919] lstrcmpiW (lpString1=".xlsx", lpString2="i.gif") returned -1 [0057.919] lstrlenW (lpString=".ppt") returned 4 [0057.919] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0057.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.919] lstrlenW (lpString=".zip") returned 4 [0057.919] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0057.919] lstrlenW (lpString=".rar") returned 4 [0057.919] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0057.919] lstrlenW (lpString=".bz2") returned 4 [0057.919] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0057.919] lstrlenW (lpString=".7z") returned 3 [0057.919] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0057.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.919] lstrlenW (lpString=".dbf") returned 4 [0057.919] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0057.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.919] lstrlenW (lpString=".1cd") returned 4 [0057.919] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0057.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.919] lstrlenW (lpString=".jpg") returned 4 [0057.919] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0057.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.919] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.919] lstrlenW (lpString=".doc") returned 4 [0057.919] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0057.919] lstrlenW (lpString=".docx") returned 5 [0057.919] lstrcmpiW (lpString1=".docx", lpString2="i.gif") returned -1 [0057.920] lstrlenW (lpString=".pdf") returned 4 [0057.920] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0057.920] lstrlenW (lpString=".xls") returned 4 [0057.920] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0057.920] lstrlenW (lpString=".xlsx") returned 5 [0057.920] lstrcmpiW (lpString1=".xlsx", lpString2="i.gif") returned -1 [0057.920] lstrlenW (lpString=".ppt") returned 4 [0057.920] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0057.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.920] lstrlenW (lpString=".zip") returned 4 [0057.920] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0057.920] lstrlenW (lpString=".rar") returned 4 [0057.920] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0057.920] lstrlenW (lpString=".bz2") returned 4 [0057.920] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0057.920] lstrlenW (lpString=".7z") returned 3 [0057.920] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0057.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.920] lstrlenW (lpString=".dbf") returned 4 [0057.920] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0057.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.920] lstrlenW (lpString=".1cd") returned 4 [0057.920] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0057.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Tiki.gif") returned 66 [0057.920] lstrlenW (lpString=".jpg") returned 4 [0057.920] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0057.920] lstrcmpiW (lpString1=".emf", lpString2=".wiki") returned -1 [0057.920] lstrlenW (lpString="To_Do_List.emf") returned 14 [0057.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0057.921] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=26720) returned 1 [0057.921] CloseHandle (hObject=0x204) returned 1 [0057.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf")) returned 0x20 [0057.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.921] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\to_do_list.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0057.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.921] lstrlenW (lpString=".doc") returned 4 [0057.921] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0057.921] lstrlenW (lpString=".docx") returned 5 [0057.921] lstrcmpiW (lpString1=".docx", lpString2="t.emf") returned -1 [0057.921] lstrlenW (lpString=".pdf") returned 4 [0057.921] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0057.921] lstrlenW (lpString=".xls") returned 4 [0057.921] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0057.921] lstrlenW (lpString=".xlsx") returned 5 [0057.921] lstrcmpiW (lpString1=".xlsx", lpString2="t.emf") returned -1 [0057.921] lstrlenW (lpString=".ppt") returned 4 [0057.921] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0057.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.922] lstrlenW (lpString=".zip") returned 4 [0057.922] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0057.922] lstrlenW (lpString=".rar") returned 4 [0057.922] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0057.922] lstrlenW (lpString=".bz2") returned 4 [0057.922] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0057.922] lstrlenW (lpString=".7z") returned 3 [0057.922] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0057.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.922] lstrlenW (lpString=".dbf") returned 4 [0057.922] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0057.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.922] lstrlenW (lpString=".1cd") returned 4 [0057.922] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0057.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.922] lstrlenW (lpString=".jpg") returned 4 [0057.922] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0057.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.922] lstrlenW (lpString=".doc") returned 4 [0057.922] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0057.922] lstrlenW (lpString=".docx") returned 5 [0057.922] lstrcmpiW (lpString1=".docx", lpString2="t.emf") returned -1 [0057.922] lstrlenW (lpString=".pdf") returned 4 [0057.922] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0057.922] lstrlenW (lpString=".xls") returned 4 [0057.922] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0057.922] lstrlenW (lpString=".xlsx") returned 5 [0057.922] lstrcmpiW (lpString1=".xlsx", lpString2="t.emf") returned -1 [0057.922] lstrlenW (lpString=".ppt") returned 4 [0057.922] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0057.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.922] lstrlenW (lpString=".zip") returned 4 [0057.923] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0057.923] lstrlenW (lpString=".rar") returned 4 [0057.923] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0057.923] lstrlenW (lpString=".bz2") returned 4 [0057.923] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0057.923] lstrlenW (lpString=".7z") returned 3 [0057.923] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0057.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.923] lstrlenW (lpString=".dbf") returned 4 [0057.923] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0057.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.923] lstrlenW (lpString=".1cd") returned 4 [0057.923] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0057.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\To_Do_List.emf") returned 72 [0057.923] lstrlenW (lpString=".jpg") returned 4 [0057.923] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0057.923] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0057.923] lstrlenW (lpString="White_Chocolate.jpg") returned 19 [0057.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.215] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3168) returned 1 [0058.215] CloseHandle (hObject=0x1f8) returned 1 [0058.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg")) returned 0x20 [0058.216] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\white_chocolate.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.216] lstrlenW (lpString=".doc") returned 4 [0058.216] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0058.216] lstrlenW (lpString=".docx") returned 5 [0058.216] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0058.216] lstrlenW (lpString=".pdf") returned 4 [0058.216] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0058.216] lstrlenW (lpString=".xls") returned 4 [0058.216] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0058.216] lstrlenW (lpString=".xlsx") returned 5 [0058.216] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0058.216] lstrlenW (lpString=".ppt") returned 4 [0058.216] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0058.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.216] lstrlenW (lpString=".zip") returned 4 [0058.216] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0058.216] lstrlenW (lpString=".rar") returned 4 [0058.216] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0058.216] lstrlenW (lpString=".bz2") returned 4 [0058.217] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0058.217] lstrlenW (lpString=".7z") returned 3 [0058.217] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0058.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.217] lstrlenW (lpString=".dbf") returned 4 [0058.217] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0058.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.217] lstrlenW (lpString=".1cd") returned 4 [0058.217] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0058.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.217] lstrlenW (lpString=".jpg") returned 4 [0058.217] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0058.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.217] lstrlenW (lpString=".doc") returned 4 [0058.217] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0058.217] lstrlenW (lpString=".docx") returned 5 [0058.217] lstrcmpiW (lpString1=".docx", lpString2="e.jpg") returned -1 [0058.217] lstrlenW (lpString=".pdf") returned 4 [0058.217] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0058.217] lstrlenW (lpString=".xls") returned 4 [0058.217] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0058.217] lstrlenW (lpString=".xlsx") returned 5 [0058.217] lstrcmpiW (lpString1=".xlsx", lpString2="e.jpg") returned -1 [0058.217] lstrlenW (lpString=".ppt") returned 4 [0058.217] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0058.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.217] lstrlenW (lpString=".zip") returned 4 [0058.217] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0058.217] lstrlenW (lpString=".rar") returned 4 [0058.217] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0058.217] lstrlenW (lpString=".bz2") returned 4 [0058.218] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0058.218] lstrlenW (lpString=".7z") returned 3 [0058.218] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0058.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.218] lstrlenW (lpString=".dbf") returned 4 [0058.218] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0058.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.218] lstrlenW (lpString=".1cd") returned 4 [0058.218] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0058.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\White_Chocolate.jpg") returned 77 [0058.218] lstrlenW (lpString=".jpg") returned 4 [0058.218] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0058.218] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0058.218] lstrlenW (lpString="Wrinkled_Paper.gif") returned 18 [0058.218] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.218] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=15063) returned 1 [0058.218] CloseHandle (hObject=0x1f8) returned 1 [0058.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif")) returned 0x20 [0058.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\wrinkled_paper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.219] lstrlenW (lpString=".doc") returned 4 [0058.219] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0058.219] lstrlenW (lpString=".docx") returned 5 [0058.219] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0058.219] lstrlenW (lpString=".pdf") returned 4 [0058.219] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0058.219] lstrlenW (lpString=".xls") returned 4 [0058.219] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0058.219] lstrlenW (lpString=".xlsx") returned 5 [0058.219] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0058.219] lstrlenW (lpString=".ppt") returned 4 [0058.219] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0058.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.219] lstrlenW (lpString=".zip") returned 4 [0058.219] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0058.219] lstrlenW (lpString=".rar") returned 4 [0058.219] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0058.219] lstrlenW (lpString=".bz2") returned 4 [0058.219] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0058.219] lstrlenW (lpString=".7z") returned 3 [0058.219] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0058.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.219] lstrlenW (lpString=".dbf") returned 4 [0058.219] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0058.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.220] lstrlenW (lpString=".1cd") returned 4 [0058.220] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0058.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.220] lstrlenW (lpString=".jpg") returned 4 [0058.220] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0058.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.220] lstrlenW (lpString=".doc") returned 4 [0058.220] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0058.220] lstrlenW (lpString=".docx") returned 5 [0058.220] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0058.220] lstrlenW (lpString=".pdf") returned 4 [0058.220] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0058.220] lstrlenW (lpString=".xls") returned 4 [0058.220] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0058.220] lstrlenW (lpString=".xlsx") returned 5 [0058.220] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0058.220] lstrlenW (lpString=".ppt") returned 4 [0058.220] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0058.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.220] lstrlenW (lpString=".zip") returned 4 [0058.220] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0058.220] lstrlenW (lpString=".rar") returned 4 [0058.220] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0058.220] lstrlenW (lpString=".bz2") returned 4 [0058.220] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0058.220] lstrlenW (lpString=".7z") returned 3 [0058.220] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0058.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.220] lstrlenW (lpString=".dbf") returned 4 [0058.220] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0058.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.220] lstrlenW (lpString=".1cd") returned 4 [0058.221] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0058.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Wrinkled_Paper.gif") returned 76 [0058.221] lstrlenW (lpString=".jpg") returned 4 [0058.221] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0058.221] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0058.221] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.223] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1569) returned 1 [0058.223] CloseHandle (hObject=0x1f8) returned 1 [0058.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 0x20 [0058.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.223] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.223] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0058.225] GetLastError () returned 0x0 [0058.225] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x621, lpOverlapped=0x0) returned 1 [0058.227] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x630, lpOverlapped=0x0) returned 1 [0058.228] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.228] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.228] SetEndOfFile (hFile=0x1e0) returned 1 [0058.228] CloseHandle (hObject=0x1e0) returned 1 [0058.228] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.228] SetEndOfFile (hFile=0x1f8) returned 1 [0058.229] CloseHandle (hObject=0x1f8) returned 1 [0058.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.229] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0058.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.230] lstrlenW (lpString=".doc") returned 4 [0058.230] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.230] lstrlenW (lpString=".docx") returned 5 [0058.230] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.230] lstrlenW (lpString=".pdf") returned 4 [0058.230] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.230] lstrlenW (lpString=".xls") returned 4 [0058.230] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.230] lstrlenW (lpString=".xlsx") returned 5 [0058.230] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.230] lstrlenW (lpString=".ppt") returned 4 [0058.230] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.230] lstrlenW (lpString=".zip") returned 4 [0058.230] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.230] lstrlenW (lpString=".rar") returned 4 [0058.230] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.230] lstrlenW (lpString=".bz2") returned 4 [0058.230] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.230] lstrlenW (lpString=".7z") returned 3 [0058.230] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.230] lstrlenW (lpString=".dbf") returned 4 [0058.230] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.230] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.230] lstrlenW (lpString=".1cd") returned 4 [0058.231] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.231] lstrlenW (lpString=".jpg") returned 4 [0058.231] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.231] lstrlenW (lpString=".doc") returned 4 [0058.231] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.231] lstrlenW (lpString=".docx") returned 5 [0058.231] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.231] lstrlenW (lpString=".pdf") returned 4 [0058.231] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.231] lstrlenW (lpString=".xls") returned 4 [0058.231] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.231] lstrlenW (lpString=".xlsx") returned 5 [0058.231] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.231] lstrlenW (lpString=".ppt") returned 4 [0058.231] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.231] lstrlenW (lpString=".zip") returned 4 [0058.231] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.231] lstrlenW (lpString=".rar") returned 4 [0058.231] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.231] lstrlenW (lpString=".bz2") returned 4 [0058.231] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.231] lstrlenW (lpString=".7z") returned 3 [0058.231] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.231] lstrlenW (lpString=".dbf") returned 4 [0058.231] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.231] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.231] lstrlenW (lpString=".1cd") returned 4 [0058.232] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.232] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0058.232] lstrlenW (lpString=".jpg") returned 4 [0058.232] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.232] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0058.232] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.233] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=25234) returned 1 [0058.233] CloseHandle (hObject=0x1f8) returned 1 [0058.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0058.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.233] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.233] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.233] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0058.234] GetLastError () returned 0x0 [0058.234] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x6292, lpOverlapped=0x0) returned 1 [0058.236] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0058.237] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.237] WriteFile (in: hFile=0x1e0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.237] SetEndOfFile (hFile=0x1e0) returned 1 [0058.237] CloseHandle (hObject=0x1e0) returned 1 [0058.237] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.237] SetEndOfFile (hFile=0x1f8) returned 1 [0058.238] CloseHandle (hObject=0x1f8) returned 1 [0058.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0058.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.239] lstrlenW (lpString=".doc") returned 4 [0058.239] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.239] lstrlenW (lpString=".docx") returned 5 [0058.239] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.239] lstrlenW (lpString=".pdf") returned 4 [0058.239] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.239] lstrlenW (lpString=".xls") returned 4 [0058.239] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.239] lstrlenW (lpString=".xlsx") returned 5 [0058.239] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.239] lstrlenW (lpString=".ppt") returned 4 [0058.239] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.239] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.239] lstrlenW (lpString=".zip") returned 4 [0058.239] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.239] lstrlenW (lpString=".rar") returned 4 [0058.239] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.239] lstrlenW (lpString=".bz2") returned 4 [0058.239] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.239] lstrlenW (lpString=".7z") returned 3 [0058.239] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.240] lstrlenW (lpString=".dbf") returned 4 [0058.240] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.240] lstrlenW (lpString=".1cd") returned 4 [0058.240] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.240] lstrlenW (lpString=".jpg") returned 4 [0058.240] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.240] lstrlenW (lpString=".doc") returned 4 [0058.240] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.240] lstrlenW (lpString=".docx") returned 5 [0058.240] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.240] lstrlenW (lpString=".pdf") returned 4 [0058.240] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.240] lstrlenW (lpString=".xls") returned 4 [0058.240] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.240] lstrlenW (lpString=".xlsx") returned 5 [0058.240] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.240] lstrlenW (lpString=".ppt") returned 4 [0058.240] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.240] lstrlenW (lpString=".zip") returned 4 [0058.240] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.240] lstrlenW (lpString=".rar") returned 4 [0058.240] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.240] lstrlenW (lpString=".bz2") returned 4 [0058.240] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.240] lstrlenW (lpString=".7z") returned 3 [0058.240] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.241] lstrlenW (lpString=".dbf") returned 4 [0058.241] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.241] lstrlenW (lpString=".1cd") returned 4 [0058.241] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0058.241] lstrlenW (lpString=".jpg") returned 4 [0058.241] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.241] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0058.241] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.241] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0058.696] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2985) returned 1 [0058.696] CloseHandle (hObject=0x1f0) returned 1 [0058.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0058.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0058.698] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.698] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.023] GetLastError () returned 0x0 [0059.023] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xba9, lpOverlapped=0x0) returned 1 [0059.103] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0059.107] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.107] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.107] SetEndOfFile (hFile=0x200) returned 1 [0059.107] CloseHandle (hObject=0x200) returned 1 [0059.107] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.107] SetEndOfFile (hFile=0x1f0) returned 1 [0059.108] CloseHandle (hObject=0x1f0) returned 1 [0059.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.108] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0059.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.108] lstrlenW (lpString=".doc") returned 4 [0059.108] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.108] lstrlenW (lpString=".docx") returned 5 [0059.108] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.109] lstrlenW (lpString=".pdf") returned 4 [0059.109] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.109] lstrlenW (lpString=".xls") returned 4 [0059.109] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.109] lstrlenW (lpString=".xlsx") returned 5 [0059.109] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.109] lstrlenW (lpString=".ppt") returned 4 [0059.109] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.109] lstrlenW (lpString=".zip") returned 4 [0059.109] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.109] lstrlenW (lpString=".rar") returned 4 [0059.109] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.109] lstrlenW (lpString=".bz2") returned 4 [0059.109] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.109] lstrlenW (lpString=".7z") returned 3 [0059.109] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.109] lstrlenW (lpString=".dbf") returned 4 [0059.109] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.109] lstrlenW (lpString=".1cd") returned 4 [0059.109] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.109] lstrlenW (lpString=".jpg") returned 4 [0059.109] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.109] lstrlenW (lpString=".doc") returned 4 [0059.109] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.109] lstrlenW (lpString=".docx") returned 5 [0059.109] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.109] lstrlenW (lpString=".pdf") returned 4 [0059.110] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.110] lstrlenW (lpString=".xls") returned 4 [0059.110] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.110] lstrlenW (lpString=".xlsx") returned 5 [0059.110] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.110] lstrlenW (lpString=".ppt") returned 4 [0059.110] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.110] lstrlenW (lpString=".zip") returned 4 [0059.110] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.110] lstrlenW (lpString=".rar") returned 4 [0059.110] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.110] lstrlenW (lpString=".bz2") returned 4 [0059.110] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.110] lstrlenW (lpString=".7z") returned 3 [0059.110] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.110] lstrlenW (lpString=".dbf") returned 4 [0059.110] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.110] lstrlenW (lpString=".1cd") returned 4 [0059.110] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.110] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0059.110] lstrlenW (lpString=".jpg") returned 4 [0059.110] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.110] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.110] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.111] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2722) returned 1 [0059.111] CloseHandle (hObject=0x1f0) returned 1 [0059.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0059.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.111] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.111] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.111] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.113] GetLastError () returned 0x0 [0059.113] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xaa2, lpOverlapped=0x0) returned 1 [0059.122] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0059.123] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.123] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.123] SetEndOfFile (hFile=0x200) returned 1 [0059.123] CloseHandle (hObject=0x200) returned 1 [0059.124] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.124] SetEndOfFile (hFile=0x1f0) returned 1 [0059.124] CloseHandle (hObject=0x1f0) returned 1 [0059.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.125] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0059.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.125] lstrlenW (lpString=".doc") returned 4 [0059.125] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.125] lstrlenW (lpString=".docx") returned 5 [0059.125] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.125] lstrlenW (lpString=".pdf") returned 4 [0059.125] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.125] lstrlenW (lpString=".xls") returned 4 [0059.125] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.125] lstrlenW (lpString=".xlsx") returned 5 [0059.125] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.125] lstrlenW (lpString=".ppt") returned 4 [0059.125] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.125] lstrlenW (lpString=".zip") returned 4 [0059.125] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.125] lstrlenW (lpString=".rar") returned 4 [0059.125] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.125] lstrlenW (lpString=".bz2") returned 4 [0059.125] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.125] lstrlenW (lpString=".7z") returned 3 [0059.125] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.126] lstrlenW (lpString=".dbf") returned 4 [0059.126] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.126] lstrlenW (lpString=".1cd") returned 4 [0059.126] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.126] lstrlenW (lpString=".jpg") returned 4 [0059.126] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.126] lstrlenW (lpString=".doc") returned 4 [0059.126] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.126] lstrlenW (lpString=".docx") returned 5 [0059.126] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.126] lstrlenW (lpString=".pdf") returned 4 [0059.126] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.126] lstrlenW (lpString=".xls") returned 4 [0059.126] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.126] lstrlenW (lpString=".xlsx") returned 5 [0059.126] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.126] lstrlenW (lpString=".ppt") returned 4 [0059.126] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.126] lstrlenW (lpString=".zip") returned 4 [0059.126] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.126] lstrlenW (lpString=".rar") returned 4 [0059.126] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.126] lstrlenW (lpString=".bz2") returned 4 [0059.126] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.126] lstrlenW (lpString=".7z") returned 3 [0059.126] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.127] lstrlenW (lpString=".dbf") returned 4 [0059.127] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.127] lstrlenW (lpString=".1cd") returned 4 [0059.127] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0059.127] lstrlenW (lpString=".jpg") returned 4 [0059.127] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.127] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.127] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.128] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=43276) returned 1 [0059.128] CloseHandle (hObject=0x1f0) returned 1 [0059.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0059.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.128] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.128] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.129] GetLastError () returned 0x0 [0059.129] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0059.131] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0059.133] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.133] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.133] SetEndOfFile (hFile=0x200) returned 1 [0059.133] CloseHandle (hObject=0x200) returned 1 [0059.133] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.133] SetEndOfFile (hFile=0x1f0) returned 1 [0059.134] CloseHandle (hObject=0x1f0) returned 1 [0059.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.135] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0059.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.135] lstrlenW (lpString=".doc") returned 4 [0059.135] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.135] lstrlenW (lpString=".docx") returned 5 [0059.135] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.135] lstrlenW (lpString=".pdf") returned 4 [0059.135] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.135] lstrlenW (lpString=".xls") returned 4 [0059.135] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.135] lstrlenW (lpString=".xlsx") returned 5 [0059.135] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.135] lstrlenW (lpString=".ppt") returned 4 [0059.135] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.135] lstrlenW (lpString=".zip") returned 4 [0059.135] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.135] lstrlenW (lpString=".rar") returned 4 [0059.135] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.135] lstrlenW (lpString=".bz2") returned 4 [0059.135] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.135] lstrlenW (lpString=".7z") returned 3 [0059.135] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.136] lstrlenW (lpString=".dbf") returned 4 [0059.136] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.136] lstrlenW (lpString=".1cd") returned 4 [0059.136] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.136] lstrlenW (lpString=".jpg") returned 4 [0059.136] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.136] lstrlenW (lpString=".doc") returned 4 [0059.136] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.136] lstrlenW (lpString=".docx") returned 5 [0059.136] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.136] lstrlenW (lpString=".pdf") returned 4 [0059.136] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.136] lstrlenW (lpString=".xls") returned 4 [0059.136] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.136] lstrlenW (lpString=".xlsx") returned 5 [0059.136] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.136] lstrlenW (lpString=".ppt") returned 4 [0059.136] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.136] lstrlenW (lpString=".zip") returned 4 [0059.136] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.136] lstrlenW (lpString=".rar") returned 4 [0059.136] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.136] lstrlenW (lpString=".bz2") returned 4 [0059.136] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.136] lstrlenW (lpString=".7z") returned 3 [0059.136] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.137] lstrlenW (lpString=".dbf") returned 4 [0059.137] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.137] lstrlenW (lpString=".1cd") returned 4 [0059.137] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0059.137] lstrlenW (lpString=".jpg") returned 4 [0059.137] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.137] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.137] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.137] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=945) returned 1 [0059.137] CloseHandle (hObject=0x1f0) returned 1 [0059.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0059.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.138] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.138] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.138] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.139] GetLastError () returned 0x0 [0059.139] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x3b1, lpOverlapped=0x0) returned 1 [0059.141] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0059.142] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.142] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.142] SetEndOfFile (hFile=0x200) returned 1 [0059.142] CloseHandle (hObject=0x200) returned 1 [0059.142] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.142] SetEndOfFile (hFile=0x1f0) returned 1 [0059.143] CloseHandle (hObject=0x1f0) returned 1 [0059.143] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.143] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0059.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.143] lstrlenW (lpString=".doc") returned 4 [0059.143] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.143] lstrlenW (lpString=".docx") returned 5 [0059.143] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.143] lstrlenW (lpString=".pdf") returned 4 [0059.144] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.144] lstrlenW (lpString=".xls") returned 4 [0059.144] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.144] lstrlenW (lpString=".xlsx") returned 5 [0059.144] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.144] lstrlenW (lpString=".ppt") returned 4 [0059.144] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.144] lstrlenW (lpString=".zip") returned 4 [0059.144] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.144] lstrlenW (lpString=".rar") returned 4 [0059.144] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.144] lstrlenW (lpString=".bz2") returned 4 [0059.144] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.144] lstrlenW (lpString=".7z") returned 3 [0059.144] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.144] lstrlenW (lpString=".dbf") returned 4 [0059.144] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.144] lstrlenW (lpString=".1cd") returned 4 [0059.144] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.144] lstrlenW (lpString=".jpg") returned 4 [0059.144] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.144] lstrlenW (lpString=".doc") returned 4 [0059.144] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.144] lstrlenW (lpString=".docx") returned 5 [0059.144] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.144] lstrlenW (lpString=".pdf") returned 4 [0059.144] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.145] lstrlenW (lpString=".xls") returned 4 [0059.145] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.145] lstrlenW (lpString=".xlsx") returned 5 [0059.145] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.145] lstrlenW (lpString=".ppt") returned 4 [0059.145] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.145] lstrlenW (lpString=".zip") returned 4 [0059.145] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.145] lstrlenW (lpString=".rar") returned 4 [0059.145] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.145] lstrlenW (lpString=".bz2") returned 4 [0059.145] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.145] lstrlenW (lpString=".7z") returned 3 [0059.145] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.145] lstrlenW (lpString=".dbf") returned 4 [0059.145] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.145] lstrlenW (lpString=".1cd") returned 4 [0059.145] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0059.145] lstrlenW (lpString=".jpg") returned 4 [0059.145] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.145] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.145] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.146] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=32607) returned 1 [0059.146] CloseHandle (hObject=0x1f0) returned 1 [0059.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0059.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.146] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.146] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.146] GetLastError () returned 0x0 [0059.147] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0059.524] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0059.526] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.526] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.526] SetEndOfFile (hFile=0x200) returned 1 [0059.526] CloseHandle (hObject=0x200) returned 1 [0059.526] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.526] SetEndOfFile (hFile=0x1f0) returned 1 [0059.527] CloseHandle (hObject=0x1f0) returned 1 [0059.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.528] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0059.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.528] lstrlenW (lpString=".doc") returned 4 [0059.528] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.528] lstrlenW (lpString=".docx") returned 5 [0059.528] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.528] lstrlenW (lpString=".pdf") returned 4 [0059.528] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.528] lstrlenW (lpString=".xls") returned 4 [0059.528] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.528] lstrlenW (lpString=".xlsx") returned 5 [0059.528] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.528] lstrlenW (lpString=".ppt") returned 4 [0059.528] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.528] lstrlenW (lpString=".zip") returned 4 [0059.528] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.528] lstrlenW (lpString=".rar") returned 4 [0059.528] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.528] lstrlenW (lpString=".bz2") returned 4 [0059.528] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.528] lstrlenW (lpString=".7z") returned 3 [0059.528] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.528] lstrlenW (lpString=".dbf") returned 4 [0059.528] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.528] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.529] lstrlenW (lpString=".1cd") returned 4 [0059.529] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.529] lstrlenW (lpString=".jpg") returned 4 [0059.529] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.529] lstrlenW (lpString=".doc") returned 4 [0059.529] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.529] lstrlenW (lpString=".docx") returned 5 [0059.529] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.529] lstrlenW (lpString=".pdf") returned 4 [0059.529] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.529] lstrlenW (lpString=".xls") returned 4 [0059.529] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.529] lstrlenW (lpString=".xlsx") returned 5 [0059.529] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.529] lstrlenW (lpString=".ppt") returned 4 [0059.529] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.529] lstrlenW (lpString=".zip") returned 4 [0059.529] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.529] lstrlenW (lpString=".rar") returned 4 [0059.529] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.529] lstrlenW (lpString=".bz2") returned 4 [0059.529] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.529] lstrlenW (lpString=".7z") returned 3 [0059.529] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.529] lstrlenW (lpString=".dbf") returned 4 [0059.529] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.529] lstrlenW (lpString=".1cd") returned 4 [0059.530] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0059.530] lstrlenW (lpString=".jpg") returned 4 [0059.530] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.530] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.530] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.530] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3957) returned 1 [0059.530] CloseHandle (hObject=0x1f0) returned 1 [0059.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0059.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.531] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.531] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.533] GetLastError () returned 0x0 [0059.533] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xf75, lpOverlapped=0x0) returned 1 [0059.534] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0059.535] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.535] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.535] SetEndOfFile (hFile=0x200) returned 1 [0059.536] CloseHandle (hObject=0x200) returned 1 [0059.536] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.536] SetEndOfFile (hFile=0x1f0) returned 1 [0059.536] CloseHandle (hObject=0x1f0) returned 1 [0059.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.539] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0059.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.540] lstrlenW (lpString=".doc") returned 4 [0059.540] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.540] lstrlenW (lpString=".docx") returned 5 [0059.540] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.540] lstrlenW (lpString=".pdf") returned 4 [0059.540] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.540] lstrlenW (lpString=".xls") returned 4 [0059.540] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.540] lstrlenW (lpString=".xlsx") returned 5 [0059.540] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.540] lstrlenW (lpString=".ppt") returned 4 [0059.540] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.540] lstrlenW (lpString=".zip") returned 4 [0059.540] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.540] lstrlenW (lpString=".rar") returned 4 [0059.540] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.540] lstrlenW (lpString=".bz2") returned 4 [0059.540] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.540] lstrlenW (lpString=".7z") returned 3 [0059.540] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.540] lstrlenW (lpString=".dbf") returned 4 [0059.540] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.540] lstrlenW (lpString=".1cd") returned 4 [0059.540] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.540] lstrlenW (lpString=".jpg") returned 4 [0059.540] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.541] lstrlenW (lpString=".doc") returned 4 [0059.541] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.541] lstrlenW (lpString=".docx") returned 5 [0059.541] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.541] lstrlenW (lpString=".pdf") returned 4 [0059.541] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.541] lstrlenW (lpString=".xls") returned 4 [0059.541] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.541] lstrlenW (lpString=".xlsx") returned 5 [0059.541] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.541] lstrlenW (lpString=".ppt") returned 4 [0059.541] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.541] lstrlenW (lpString=".zip") returned 4 [0059.541] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.541] lstrlenW (lpString=".rar") returned 4 [0059.541] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.541] lstrlenW (lpString=".bz2") returned 4 [0059.541] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.541] lstrlenW (lpString=".7z") returned 3 [0059.541] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.541] lstrlenW (lpString=".dbf") returned 4 [0059.541] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.541] lstrlenW (lpString=".1cd") returned 4 [0059.541] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0059.541] lstrlenW (lpString=".jpg") returned 4 [0059.541] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.542] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.542] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.542] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=33277) returned 1 [0059.543] CloseHandle (hObject=0x1f0) returned 1 [0059.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0059.543] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.543] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.543] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.543] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.543] GetLastError () returned 0x0 [0059.543] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0059.545] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0059.547] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.547] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.547] SetEndOfFile (hFile=0x200) returned 1 [0059.547] CloseHandle (hObject=0x200) returned 1 [0059.547] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.547] SetEndOfFile (hFile=0x1f0) returned 1 [0059.548] CloseHandle (hObject=0x1f0) returned 1 [0059.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0059.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.549] lstrlenW (lpString=".doc") returned 4 [0059.549] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.549] lstrlenW (lpString=".docx") returned 5 [0059.549] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.549] lstrlenW (lpString=".pdf") returned 4 [0059.549] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.549] lstrlenW (lpString=".xls") returned 4 [0059.549] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.549] lstrlenW (lpString=".xlsx") returned 5 [0059.549] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.549] lstrlenW (lpString=".ppt") returned 4 [0059.549] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.549] lstrlenW (lpString=".zip") returned 4 [0059.549] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.549] lstrlenW (lpString=".rar") returned 4 [0059.549] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.549] lstrlenW (lpString=".bz2") returned 4 [0059.549] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.549] lstrlenW (lpString=".7z") returned 3 [0059.549] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.549] lstrlenW (lpString=".dbf") returned 4 [0059.549] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.549] lstrlenW (lpString=".1cd") returned 4 [0059.549] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.549] lstrlenW (lpString=".jpg") returned 4 [0059.549] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.550] lstrlenW (lpString=".doc") returned 4 [0059.550] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.550] lstrlenW (lpString=".docx") returned 5 [0059.550] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.550] lstrlenW (lpString=".pdf") returned 4 [0059.550] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.550] lstrlenW (lpString=".xls") returned 4 [0059.550] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.550] lstrlenW (lpString=".xlsx") returned 5 [0059.550] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.550] lstrlenW (lpString=".ppt") returned 4 [0059.550] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.550] lstrlenW (lpString=".zip") returned 4 [0059.550] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.550] lstrlenW (lpString=".rar") returned 4 [0059.550] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.550] lstrlenW (lpString=".bz2") returned 4 [0059.550] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.550] lstrlenW (lpString=".7z") returned 3 [0059.550] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.550] lstrlenW (lpString=".dbf") returned 4 [0059.550] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.550] lstrlenW (lpString=".1cd") returned 4 [0059.550] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0059.550] lstrlenW (lpString=".jpg") returned 4 [0059.550] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.551] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.551] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.551] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1453) returned 1 [0059.551] CloseHandle (hObject=0x1f0) returned 1 [0059.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0059.551] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.551] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.551] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.553] GetLastError () returned 0x0 [0059.553] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0059.555] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0059.556] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.556] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.556] SetEndOfFile (hFile=0x200) returned 1 [0059.556] CloseHandle (hObject=0x200) returned 1 [0059.556] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.556] SetEndOfFile (hFile=0x1f0) returned 1 [0059.557] CloseHandle (hObject=0x1f0) returned 1 [0059.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.557] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0059.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.557] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.557] lstrlenW (lpString=".doc") returned 4 [0059.557] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.557] lstrlenW (lpString=".docx") returned 5 [0059.557] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.557] lstrlenW (lpString=".pdf") returned 4 [0059.558] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.558] lstrlenW (lpString=".xls") returned 4 [0059.558] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.558] lstrlenW (lpString=".xlsx") returned 5 [0059.558] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.558] lstrlenW (lpString=".ppt") returned 4 [0059.558] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.558] lstrlenW (lpString=".zip") returned 4 [0059.558] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.558] lstrlenW (lpString=".rar") returned 4 [0059.558] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.558] lstrlenW (lpString=".bz2") returned 4 [0059.558] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.558] lstrlenW (lpString=".7z") returned 3 [0059.558] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.558] lstrlenW (lpString=".dbf") returned 4 [0059.558] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.558] lstrlenW (lpString=".1cd") returned 4 [0059.558] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.558] lstrlenW (lpString=".jpg") returned 4 [0059.558] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.558] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.558] lstrlenW (lpString=".doc") returned 4 [0059.558] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.558] lstrlenW (lpString=".docx") returned 5 [0059.558] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.558] lstrlenW (lpString=".pdf") returned 4 [0059.559] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.559] lstrlenW (lpString=".xls") returned 4 [0059.559] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.559] lstrlenW (lpString=".xlsx") returned 5 [0059.559] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.559] lstrlenW (lpString=".ppt") returned 4 [0059.559] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.559] lstrlenW (lpString=".zip") returned 4 [0059.559] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.559] lstrlenW (lpString=".rar") returned 4 [0059.559] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.559] lstrlenW (lpString=".bz2") returned 4 [0059.559] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.559] lstrlenW (lpString=".7z") returned 3 [0059.559] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.559] lstrlenW (lpString=".dbf") returned 4 [0059.559] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.559] lstrlenW (lpString=".1cd") returned 4 [0059.559] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.559] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0059.559] lstrlenW (lpString=".jpg") returned 4 [0059.559] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.559] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.559] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.559] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.560] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=25106) returned 1 [0059.560] CloseHandle (hObject=0x1f0) returned 1 [0059.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0059.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.561] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.561] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.561] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.561] GetLastError () returned 0x0 [0059.561] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x6212, lpOverlapped=0x0) returned 1 [0059.563] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x6220, lpOverlapped=0x0) returned 1 [0059.565] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.565] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.565] SetEndOfFile (hFile=0x200) returned 1 [0059.565] CloseHandle (hObject=0x200) returned 1 [0059.565] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.565] SetEndOfFile (hFile=0x1f0) returned 1 [0059.566] CloseHandle (hObject=0x1f0) returned 1 [0059.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.566] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0059.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.566] lstrlenW (lpString=".doc") returned 4 [0059.567] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.567] lstrlenW (lpString=".docx") returned 5 [0059.567] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.567] lstrlenW (lpString=".pdf") returned 4 [0059.567] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.567] lstrlenW (lpString=".xls") returned 4 [0059.567] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.567] lstrlenW (lpString=".xlsx") returned 5 [0059.567] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.567] lstrlenW (lpString=".ppt") returned 4 [0059.567] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.567] lstrlenW (lpString=".zip") returned 4 [0059.567] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.567] lstrlenW (lpString=".rar") returned 4 [0059.567] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.567] lstrlenW (lpString=".bz2") returned 4 [0059.567] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.567] lstrlenW (lpString=".7z") returned 3 [0059.567] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.567] lstrlenW (lpString=".dbf") returned 4 [0059.567] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.567] lstrlenW (lpString=".1cd") returned 4 [0059.567] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.567] lstrlenW (lpString=".jpg") returned 4 [0059.567] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.567] lstrlenW (lpString=".doc") returned 4 [0059.567] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.568] lstrlenW (lpString=".docx") returned 5 [0059.568] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.568] lstrlenW (lpString=".pdf") returned 4 [0059.568] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.568] lstrlenW (lpString=".xls") returned 4 [0059.568] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.568] lstrlenW (lpString=".xlsx") returned 5 [0059.568] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.568] lstrlenW (lpString=".ppt") returned 4 [0059.568] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.568] lstrlenW (lpString=".zip") returned 4 [0059.568] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.568] lstrlenW (lpString=".rar") returned 4 [0059.568] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.568] lstrlenW (lpString=".bz2") returned 4 [0059.568] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.568] lstrlenW (lpString=".7z") returned 3 [0059.568] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.568] lstrlenW (lpString=".dbf") returned 4 [0059.568] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.568] lstrlenW (lpString=".1cd") returned 4 [0059.568] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.568] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0059.568] lstrlenW (lpString=".jpg") returned 4 [0059.568] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.569] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.569] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.570] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1347) returned 1 [0059.570] CloseHandle (hObject=0x1f0) returned 1 [0059.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0059.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.570] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.570] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.572] GetLastError () returned 0x0 [0059.572] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x543, lpOverlapped=0x0) returned 1 [0059.573] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x550, lpOverlapped=0x0) returned 1 [0059.574] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.575] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.575] SetEndOfFile (hFile=0x200) returned 1 [0059.575] CloseHandle (hObject=0x200) returned 1 [0059.575] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.575] SetEndOfFile (hFile=0x1f0) returned 1 [0059.576] CloseHandle (hObject=0x1f0) returned 1 [0059.576] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.576] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0059.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.576] lstrlenW (lpString=".doc") returned 4 [0059.576] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.576] lstrlenW (lpString=".docx") returned 5 [0059.576] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.576] lstrlenW (lpString=".pdf") returned 4 [0059.576] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.576] lstrlenW (lpString=".xls") returned 4 [0059.576] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.576] lstrlenW (lpString=".xlsx") returned 5 [0059.576] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.577] lstrlenW (lpString=".ppt") returned 4 [0059.577] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.577] lstrlenW (lpString=".zip") returned 4 [0059.577] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.577] lstrlenW (lpString=".rar") returned 4 [0059.577] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.577] lstrlenW (lpString=".bz2") returned 4 [0059.577] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.577] lstrlenW (lpString=".7z") returned 3 [0059.577] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.577] lstrlenW (lpString=".dbf") returned 4 [0059.577] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.577] lstrlenW (lpString=".1cd") returned 4 [0059.577] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.577] lstrlenW (lpString=".jpg") returned 4 [0059.577] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.577] lstrlenW (lpString=".doc") returned 4 [0059.577] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.577] lstrlenW (lpString=".docx") returned 5 [0059.577] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.577] lstrlenW (lpString=".pdf") returned 4 [0059.577] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.577] lstrlenW (lpString=".xls") returned 4 [0059.577] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.577] lstrlenW (lpString=".xlsx") returned 5 [0059.577] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.578] lstrlenW (lpString=".ppt") returned 4 [0059.578] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.578] lstrlenW (lpString=".zip") returned 4 [0059.578] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.578] lstrlenW (lpString=".rar") returned 4 [0059.578] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.578] lstrlenW (lpString=".bz2") returned 4 [0059.578] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.578] lstrlenW (lpString=".7z") returned 3 [0059.578] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.578] lstrlenW (lpString=".dbf") returned 4 [0059.578] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.578] lstrlenW (lpString=".1cd") returned 4 [0059.578] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0059.578] lstrlenW (lpString=".jpg") returned 4 [0059.578] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.578] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.578] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.579] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=32403) returned 1 [0059.579] CloseHandle (hObject=0x1f0) returned 1 [0059.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0059.579] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.579] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.579] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.579] GetLastError () returned 0x0 [0059.579] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0059.582] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0059.583] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.583] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.583] SetEndOfFile (hFile=0x200) returned 1 [0059.583] CloseHandle (hObject=0x200) returned 1 [0059.584] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.584] SetEndOfFile (hFile=0x1f0) returned 1 [0059.584] CloseHandle (hObject=0x1f0) returned 1 [0059.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.585] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0059.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.585] lstrlenW (lpString=".doc") returned 4 [0059.585] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.585] lstrlenW (lpString=".docx") returned 5 [0059.585] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.585] lstrlenW (lpString=".pdf") returned 4 [0059.585] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.585] lstrlenW (lpString=".xls") returned 4 [0059.585] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.585] lstrlenW (lpString=".xlsx") returned 5 [0059.585] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.585] lstrlenW (lpString=".ppt") returned 4 [0059.585] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.585] lstrlenW (lpString=".zip") returned 4 [0059.585] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.585] lstrlenW (lpString=".rar") returned 4 [0059.585] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.585] lstrlenW (lpString=".bz2") returned 4 [0059.586] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.586] lstrlenW (lpString=".7z") returned 3 [0059.586] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.586] lstrlenW (lpString=".dbf") returned 4 [0059.586] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.586] lstrlenW (lpString=".1cd") returned 4 [0059.586] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.586] lstrlenW (lpString=".jpg") returned 4 [0059.586] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.586] lstrlenW (lpString=".doc") returned 4 [0059.586] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.586] lstrlenW (lpString=".docx") returned 5 [0059.586] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.586] lstrlenW (lpString=".pdf") returned 4 [0059.586] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.586] lstrlenW (lpString=".xls") returned 4 [0059.586] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.586] lstrlenW (lpString=".xlsx") returned 5 [0059.586] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.586] lstrlenW (lpString=".ppt") returned 4 [0059.586] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.586] lstrlenW (lpString=".zip") returned 4 [0059.586] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.586] lstrlenW (lpString=".rar") returned 4 [0059.586] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.586] lstrlenW (lpString=".bz2") returned 4 [0059.586] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.587] lstrlenW (lpString=".7z") returned 3 [0059.587] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.587] lstrlenW (lpString=".dbf") returned 4 [0059.587] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.587] lstrlenW (lpString=".1cd") returned 4 [0059.587] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.587] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0059.587] lstrlenW (lpString=".jpg") returned 4 [0059.587] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.587] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.587] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.587] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1347) returned 1 [0059.587] CloseHandle (hObject=0x1f0) returned 1 [0059.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0059.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.588] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.588] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.589] GetLastError () returned 0x0 [0059.589] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x543, lpOverlapped=0x0) returned 1 [0059.591] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x550, lpOverlapped=0x0) returned 1 [0059.592] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.592] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.592] SetEndOfFile (hFile=0x200) returned 1 [0059.592] CloseHandle (hObject=0x200) returned 1 [0059.592] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.592] SetEndOfFile (hFile=0x1f0) returned 1 [0059.593] CloseHandle (hObject=0x1f0) returned 1 [0059.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.593] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0059.593] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.594] lstrlenW (lpString=".doc") returned 4 [0059.594] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.594] lstrlenW (lpString=".docx") returned 5 [0059.594] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.594] lstrlenW (lpString=".pdf") returned 4 [0059.594] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.594] lstrlenW (lpString=".xls") returned 4 [0059.594] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.594] lstrlenW (lpString=".xlsx") returned 5 [0059.594] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.594] lstrlenW (lpString=".ppt") returned 4 [0059.594] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.594] lstrlenW (lpString=".zip") returned 4 [0059.594] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.594] lstrlenW (lpString=".rar") returned 4 [0059.594] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.594] lstrlenW (lpString=".bz2") returned 4 [0059.594] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.594] lstrlenW (lpString=".7z") returned 3 [0059.594] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.594] lstrlenW (lpString=".dbf") returned 4 [0059.594] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.594] lstrlenW (lpString=".1cd") returned 4 [0059.594] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.594] lstrlenW (lpString=".jpg") returned 4 [0059.594] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.595] lstrlenW (lpString=".doc") returned 4 [0059.595] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.595] lstrlenW (lpString=".docx") returned 5 [0059.595] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.595] lstrlenW (lpString=".pdf") returned 4 [0059.595] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.595] lstrlenW (lpString=".xls") returned 4 [0059.595] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.595] lstrlenW (lpString=".xlsx") returned 5 [0059.595] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.595] lstrlenW (lpString=".ppt") returned 4 [0059.595] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.595] lstrlenW (lpString=".zip") returned 4 [0059.595] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.595] lstrlenW (lpString=".rar") returned 4 [0059.595] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.595] lstrlenW (lpString=".bz2") returned 4 [0059.595] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.595] lstrlenW (lpString=".7z") returned 3 [0059.595] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.595] lstrlenW (lpString=".dbf") returned 4 [0059.595] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.595] lstrlenW (lpString=".1cd") returned 4 [0059.595] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0059.595] lstrlenW (lpString=".jpg") returned 4 [0059.595] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.596] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.596] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.596] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=26402) returned 1 [0059.596] CloseHandle (hObject=0x1f0) returned 1 [0059.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0059.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.596] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.596] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.597] GetLastError () returned 0x0 [0059.597] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x6722, lpOverlapped=0x0) returned 1 [0059.837] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0059.839] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.839] WriteFile (in: hFile=0x200, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.839] SetEndOfFile (hFile=0x200) returned 1 [0059.839] CloseHandle (hObject=0x200) returned 1 [0059.839] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.839] SetEndOfFile (hFile=0x1f0) returned 1 [0059.840] CloseHandle (hObject=0x1f0) returned 1 [0059.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.840] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0059.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.849] lstrlenW (lpString=".doc") returned 4 [0059.849] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.849] lstrlenW (lpString=".docx") returned 5 [0059.849] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.849] lstrlenW (lpString=".pdf") returned 4 [0059.849] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.849] lstrlenW (lpString=".xls") returned 4 [0059.849] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.849] lstrlenW (lpString=".xlsx") returned 5 [0059.849] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.849] lstrlenW (lpString=".ppt") returned 4 [0059.850] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.850] lstrlenW (lpString=".zip") returned 4 [0059.850] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.850] lstrlenW (lpString=".rar") returned 4 [0059.850] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.850] lstrlenW (lpString=".bz2") returned 4 [0059.850] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.850] lstrlenW (lpString=".7z") returned 3 [0059.850] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.850] lstrlenW (lpString=".dbf") returned 4 [0059.850] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.850] lstrlenW (lpString=".1cd") returned 4 [0059.850] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.850] lstrlenW (lpString=".jpg") returned 4 [0059.850] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.850] lstrlenW (lpString=".doc") returned 4 [0059.850] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.850] lstrlenW (lpString=".docx") returned 5 [0059.850] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.851] lstrlenW (lpString=".pdf") returned 4 [0059.851] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.851] lstrlenW (lpString=".xls") returned 4 [0059.851] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.851] lstrlenW (lpString=".xlsx") returned 5 [0059.851] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.851] lstrlenW (lpString=".ppt") returned 4 [0059.851] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.851] lstrlenW (lpString=".zip") returned 4 [0059.851] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.851] lstrlenW (lpString=".rar") returned 4 [0059.851] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.851] lstrlenW (lpString=".bz2") returned 4 [0059.851] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.851] lstrlenW (lpString=".7z") returned 3 [0059.851] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.851] lstrlenW (lpString=".dbf") returned 4 [0059.851] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.851] lstrlenW (lpString=".1cd") returned 4 [0059.851] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0059.851] lstrlenW (lpString=".jpg") returned 4 [0059.851] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.851] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.851] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.852] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5179) returned 1 [0059.852] CloseHandle (hObject=0x1f0) returned 1 [0059.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0059.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0059.852] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.852] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0060.178] GetLastError () returned 0x0 [0060.178] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x143b, lpOverlapped=0x0) returned 1 [0060.210] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0060.211] ReadFile (in: hFile=0x1f0, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.211] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.211] SetEndOfFile (hFile=0x218) returned 1 [0060.212] CloseHandle (hObject=0x218) returned 1 [0060.212] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.212] SetEndOfFile (hFile=0x1f0) returned 1 [0060.213] CloseHandle (hObject=0x1f0) returned 1 [0060.213] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.213] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0060.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.213] lstrlenW (lpString=".doc") returned 4 [0060.213] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.213] lstrlenW (lpString=".docx") returned 5 [0060.213] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.213] lstrlenW (lpString=".pdf") returned 4 [0060.213] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.213] lstrlenW (lpString=".xls") returned 4 [0060.213] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.213] lstrlenW (lpString=".xlsx") returned 5 [0060.213] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.213] lstrlenW (lpString=".ppt") returned 4 [0060.213] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.214] lstrlenW (lpString=".zip") returned 4 [0060.214] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.214] lstrlenW (lpString=".rar") returned 4 [0060.214] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.214] lstrlenW (lpString=".bz2") returned 4 [0060.214] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.214] lstrlenW (lpString=".7z") returned 3 [0060.214] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.214] lstrlenW (lpString=".dbf") returned 4 [0060.214] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.214] lstrlenW (lpString=".1cd") returned 4 [0060.214] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.214] lstrlenW (lpString=".jpg") returned 4 [0060.214] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.214] lstrlenW (lpString=".doc") returned 4 [0060.214] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.214] lstrlenW (lpString=".docx") returned 5 [0060.214] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.214] lstrlenW (lpString=".pdf") returned 4 [0060.214] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.214] lstrlenW (lpString=".xls") returned 4 [0060.214] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.214] lstrlenW (lpString=".xlsx") returned 5 [0060.214] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.214] lstrlenW (lpString=".ppt") returned 4 [0060.214] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.215] lstrlenW (lpString=".zip") returned 4 [0060.215] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.215] lstrlenW (lpString=".rar") returned 4 [0060.215] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.215] lstrlenW (lpString=".bz2") returned 4 [0060.215] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.215] lstrlenW (lpString=".7z") returned 3 [0060.215] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.215] lstrlenW (lpString=".dbf") returned 4 [0060.215] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.215] lstrlenW (lpString=".1cd") returned 4 [0060.215] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0060.215] lstrlenW (lpString=".jpg") returned 4 [0060.215] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.215] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.215] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.215] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.229] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=48115) returned 1 [0060.229] CloseHandle (hObject=0x1ec) returned 1 [0060.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0060.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.229] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.229] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.229] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.229] GetLastError () returned 0x0 [0060.229] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0060.236] WriteFile (in: hFile=0x1f0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0060.238] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.238] WriteFile (in: hFile=0x1f0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.238] SetEndOfFile (hFile=0x1f0) returned 1 [0060.238] CloseHandle (hObject=0x1f0) returned 1 [0060.238] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.238] SetEndOfFile (hFile=0x1ec) returned 1 [0060.239] CloseHandle (hObject=0x1ec) returned 1 [0060.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.239] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0060.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.240] lstrlenW (lpString=".doc") returned 4 [0060.240] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.240] lstrlenW (lpString=".docx") returned 5 [0060.240] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.240] lstrlenW (lpString=".pdf") returned 4 [0060.240] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.240] lstrlenW (lpString=".xls") returned 4 [0060.240] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.240] lstrlenW (lpString=".xlsx") returned 5 [0060.240] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.240] lstrlenW (lpString=".ppt") returned 4 [0060.240] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.240] lstrlenW (lpString=".zip") returned 4 [0060.240] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.240] lstrlenW (lpString=".rar") returned 4 [0060.240] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.240] lstrlenW (lpString=".bz2") returned 4 [0060.240] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.240] lstrlenW (lpString=".7z") returned 3 [0060.240] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.240] lstrlenW (lpString=".dbf") returned 4 [0060.240] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.240] lstrlenW (lpString=".1cd") returned 4 [0060.240] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.240] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.240] lstrlenW (lpString=".jpg") returned 4 [0060.240] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.241] lstrlenW (lpString=".doc") returned 4 [0060.241] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.241] lstrlenW (lpString=".docx") returned 5 [0060.241] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.241] lstrlenW (lpString=".pdf") returned 4 [0060.241] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.241] lstrlenW (lpString=".xls") returned 4 [0060.241] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.241] lstrlenW (lpString=".xlsx") returned 5 [0060.241] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.241] lstrlenW (lpString=".ppt") returned 4 [0060.241] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.241] lstrlenW (lpString=".zip") returned 4 [0060.241] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.241] lstrlenW (lpString=".rar") returned 4 [0060.241] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.241] lstrlenW (lpString=".bz2") returned 4 [0060.241] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.241] lstrlenW (lpString=".7z") returned 3 [0060.241] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.241] lstrlenW (lpString=".dbf") returned 4 [0060.241] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.241] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.241] lstrlenW (lpString=".1cd") returned 4 [0060.241] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0060.242] lstrlenW (lpString=".jpg") returned 4 [0060.242] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.242] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.242] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.242] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=11573) returned 1 [0060.242] CloseHandle (hObject=0x1ec) returned 1 [0060.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0060.245] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.245] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.245] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.245] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.246] GetLastError () returned 0x0 [0060.246] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0060.268] WriteFile (in: hFile=0x1f0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0060.269] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.269] WriteFile (in: hFile=0x1f0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.269] SetEndOfFile (hFile=0x1f0) returned 1 [0060.270] CloseHandle (hObject=0x1f0) returned 1 [0060.270] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.270] SetEndOfFile (hFile=0x1ec) returned 1 [0060.271] CloseHandle (hObject=0x1ec) returned 1 [0060.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.271] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0060.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.271] lstrlenW (lpString=".doc") returned 4 [0060.271] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.271] lstrlenW (lpString=".docx") returned 5 [0060.271] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.271] lstrlenW (lpString=".pdf") returned 4 [0060.271] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.271] lstrlenW (lpString=".xls") returned 4 [0060.271] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.271] lstrlenW (lpString=".xlsx") returned 5 [0060.272] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.272] lstrlenW (lpString=".ppt") returned 4 [0060.272] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.272] lstrlenW (lpString=".zip") returned 4 [0060.272] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.272] lstrlenW (lpString=".rar") returned 4 [0060.272] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.272] lstrlenW (lpString=".bz2") returned 4 [0060.272] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.272] lstrlenW (lpString=".7z") returned 3 [0060.272] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.272] lstrlenW (lpString=".dbf") returned 4 [0060.272] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.272] lstrlenW (lpString=".1cd") returned 4 [0060.272] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.272] lstrlenW (lpString=".jpg") returned 4 [0060.272] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.272] lstrlenW (lpString=".doc") returned 4 [0060.272] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.272] lstrlenW (lpString=".docx") returned 5 [0060.272] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.272] lstrlenW (lpString=".pdf") returned 4 [0060.272] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.272] lstrlenW (lpString=".xls") returned 4 [0060.272] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.272] lstrlenW (lpString=".xlsx") returned 5 [0060.273] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.273] lstrlenW (lpString=".ppt") returned 4 [0060.273] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.273] lstrlenW (lpString=".zip") returned 4 [0060.273] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.273] lstrlenW (lpString=".rar") returned 4 [0060.273] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.273] lstrlenW (lpString=".bz2") returned 4 [0060.273] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.273] lstrlenW (lpString=".7z") returned 3 [0060.273] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.273] lstrlenW (lpString=".dbf") returned 4 [0060.273] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.273] lstrlenW (lpString=".1cd") returned 4 [0060.273] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0060.273] lstrlenW (lpString=".jpg") returned 4 [0060.273] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.273] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.273] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.446] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=21745) returned 1 [0060.446] CloseHandle (hObject=0x1d8) returned 1 [0060.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0060.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.446] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.446] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.447] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.447] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0060.447] GetLastError () returned 0x0 [0060.447] ReadFile (in: hFile=0x1d8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0060.449] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0060.450] ReadFile (in: hFile=0x1d8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.450] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.450] SetEndOfFile (hFile=0x218) returned 1 [0060.450] CloseHandle (hObject=0x218) returned 1 [0060.450] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.450] SetEndOfFile (hFile=0x1d8) returned 1 [0060.451] CloseHandle (hObject=0x1d8) returned 1 [0060.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.452] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0060.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.452] lstrlenW (lpString=".doc") returned 4 [0060.452] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.452] lstrlenW (lpString=".docx") returned 5 [0060.452] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.452] lstrlenW (lpString=".pdf") returned 4 [0060.452] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.452] lstrlenW (lpString=".xls") returned 4 [0060.452] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.452] lstrlenW (lpString=".xlsx") returned 5 [0060.452] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.452] lstrlenW (lpString=".ppt") returned 4 [0060.452] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.452] lstrlenW (lpString=".zip") returned 4 [0060.452] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.452] lstrlenW (lpString=".rar") returned 4 [0060.452] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.452] lstrlenW (lpString=".bz2") returned 4 [0060.452] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.452] lstrlenW (lpString=".7z") returned 3 [0060.452] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.452] lstrlenW (lpString=".dbf") returned 4 [0060.453] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.453] lstrlenW (lpString=".1cd") returned 4 [0060.453] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.453] lstrlenW (lpString=".jpg") returned 4 [0060.453] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.453] lstrlenW (lpString=".doc") returned 4 [0060.453] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.453] lstrlenW (lpString=".docx") returned 5 [0060.453] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.453] lstrlenW (lpString=".pdf") returned 4 [0060.453] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.453] lstrlenW (lpString=".xls") returned 4 [0060.453] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.453] lstrlenW (lpString=".xlsx") returned 5 [0060.453] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.453] lstrlenW (lpString=".ppt") returned 4 [0060.453] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.453] lstrlenW (lpString=".zip") returned 4 [0060.453] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.453] lstrlenW (lpString=".rar") returned 4 [0060.453] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.453] lstrlenW (lpString=".bz2") returned 4 [0060.453] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.453] lstrlenW (lpString=".7z") returned 3 [0060.453] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.453] lstrlenW (lpString=".dbf") returned 4 [0060.454] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.454] lstrlenW (lpString=".1cd") returned 4 [0060.454] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0060.454] lstrlenW (lpString=".jpg") returned 4 [0060.454] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.454] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.454] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.455] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1666) returned 1 [0060.455] CloseHandle (hObject=0x1d8) returned 1 [0060.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0060.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.455] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.455] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0060.755] GetLastError () returned 0x0 [0060.755] ReadFile (in: hFile=0x1d8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x682, lpOverlapped=0x0) returned 1 [0060.804] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x690, lpOverlapped=0x0) returned 1 [0060.807] ReadFile (in: hFile=0x1d8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.807] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.808] SetEndOfFile (hFile=0x1e8) returned 1 [0060.808] CloseHandle (hObject=0x1e8) returned 1 [0060.809] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.809] SetEndOfFile (hFile=0x1d8) returned 1 [0060.810] CloseHandle (hObject=0x1d8) returned 1 [0060.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.811] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0060.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.811] lstrlenW (lpString=".doc") returned 4 [0060.811] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.811] lstrlenW (lpString=".docx") returned 5 [0060.812] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.812] lstrlenW (lpString=".pdf") returned 4 [0060.812] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.812] lstrlenW (lpString=".xls") returned 4 [0060.812] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.812] lstrlenW (lpString=".xlsx") returned 5 [0060.812] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.812] lstrlenW (lpString=".ppt") returned 4 [0060.812] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.812] lstrlenW (lpString=".zip") returned 4 [0060.812] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.812] lstrlenW (lpString=".rar") returned 4 [0060.812] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.812] lstrlenW (lpString=".bz2") returned 4 [0060.812] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.812] lstrlenW (lpString=".7z") returned 3 [0060.812] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.812] lstrlenW (lpString=".dbf") returned 4 [0060.812] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.812] lstrlenW (lpString=".1cd") returned 4 [0060.812] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.812] lstrlenW (lpString=".jpg") returned 4 [0060.812] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.812] lstrlenW (lpString=".doc") returned 4 [0060.812] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.812] lstrlenW (lpString=".docx") returned 5 [0060.813] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.813] lstrlenW (lpString=".pdf") returned 4 [0060.813] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.813] lstrlenW (lpString=".xls") returned 4 [0060.813] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.813] lstrlenW (lpString=".xlsx") returned 5 [0060.813] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.813] lstrlenW (lpString=".ppt") returned 4 [0060.813] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.813] lstrlenW (lpString=".zip") returned 4 [0060.813] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.813] lstrlenW (lpString=".rar") returned 4 [0060.813] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.813] lstrlenW (lpString=".bz2") returned 4 [0060.813] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.813] lstrlenW (lpString=".7z") returned 3 [0060.813] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.813] lstrlenW (lpString=".dbf") returned 4 [0060.813] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.813] lstrlenW (lpString=".1cd") returned 4 [0060.813] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0060.813] lstrlenW (lpString=".jpg") returned 4 [0060.813] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.813] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.814] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.814] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.815] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=937) returned 1 [0060.815] CloseHandle (hObject=0x1d8) returned 1 [0060.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0060.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.815] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.815] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.015] GetLastError () returned 0x0 [0061.015] ReadFile (in: hFile=0x1d8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0061.018] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0061.019] ReadFile (in: hFile=0x1d8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.019] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.019] SetEndOfFile (hFile=0x180) returned 1 [0061.019] CloseHandle (hObject=0x180) returned 1 [0061.019] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.019] SetEndOfFile (hFile=0x1d8) returned 1 [0061.020] CloseHandle (hObject=0x1d8) returned 1 [0061.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.020] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0061.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.020] lstrlenW (lpString=".doc") returned 4 [0061.020] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.020] lstrlenW (lpString=".docx") returned 5 [0061.021] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.021] lstrlenW (lpString=".pdf") returned 4 [0061.021] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.021] lstrlenW (lpString=".xls") returned 4 [0061.021] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.021] lstrlenW (lpString=".xlsx") returned 5 [0061.021] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.021] lstrlenW (lpString=".ppt") returned 4 [0061.021] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.021] lstrlenW (lpString=".zip") returned 4 [0061.021] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.021] lstrlenW (lpString=".rar") returned 4 [0061.021] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.021] lstrlenW (lpString=".bz2") returned 4 [0061.021] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.021] lstrlenW (lpString=".7z") returned 3 [0061.021] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.021] lstrlenW (lpString=".dbf") returned 4 [0061.021] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.021] lstrlenW (lpString=".1cd") returned 4 [0061.021] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.021] lstrlenW (lpString=".jpg") returned 4 [0061.021] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.021] lstrlenW (lpString=".doc") returned 4 [0061.021] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.021] lstrlenW (lpString=".docx") returned 5 [0061.022] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.022] lstrlenW (lpString=".pdf") returned 4 [0061.022] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.022] lstrlenW (lpString=".xls") returned 4 [0061.022] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.022] lstrlenW (lpString=".xlsx") returned 5 [0061.022] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.022] lstrlenW (lpString=".ppt") returned 4 [0061.022] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.022] lstrlenW (lpString=".zip") returned 4 [0061.022] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.022] lstrlenW (lpString=".rar") returned 4 [0061.022] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.022] lstrlenW (lpString=".bz2") returned 4 [0061.022] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.022] lstrlenW (lpString=".7z") returned 3 [0061.022] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.022] lstrlenW (lpString=".dbf") returned 4 [0061.022] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.022] lstrlenW (lpString=".1cd") returned 4 [0061.022] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0061.022] lstrlenW (lpString=".jpg") returned 4 [0061.022] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.022] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0061.023] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0061.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0061.295] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=18380) returned 1 [0061.295] CloseHandle (hObject=0x218) returned 1 [0061.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0061.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0061.295] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.295] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.295] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0061.296] GetLastError () returned 0x0 [0061.296] ReadFile (in: hFile=0x218, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0061.358] WriteFile (in: hFile=0x170, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0061.359] ReadFile (in: hFile=0x218, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.359] WriteFile (in: hFile=0x170, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.359] SetEndOfFile (hFile=0x170) returned 1 [0061.359] CloseHandle (hObject=0x170) returned 1 [0061.359] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.359] SetEndOfFile (hFile=0x218) returned 1 [0061.360] CloseHandle (hObject=0x218) returned 1 [0061.360] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.361] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0061.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.361] lstrlenW (lpString=".doc") returned 4 [0061.361] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.361] lstrlenW (lpString=".docx") returned 5 [0061.361] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.361] lstrlenW (lpString=".pdf") returned 4 [0061.361] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.361] lstrlenW (lpString=".xls") returned 4 [0061.361] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.361] lstrlenW (lpString=".xlsx") returned 5 [0061.361] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.361] lstrlenW (lpString=".ppt") returned 4 [0061.361] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.361] lstrlenW (lpString=".zip") returned 4 [0061.361] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.361] lstrlenW (lpString=".rar") returned 4 [0061.361] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.361] lstrlenW (lpString=".bz2") returned 4 [0061.361] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.361] lstrlenW (lpString=".7z") returned 3 [0061.361] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.361] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.361] lstrlenW (lpString=".dbf") returned 4 [0061.362] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.362] lstrlenW (lpString=".1cd") returned 4 [0061.362] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.362] lstrlenW (lpString=".jpg") returned 4 [0061.362] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.362] lstrlenW (lpString=".doc") returned 4 [0061.362] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.362] lstrlenW (lpString=".docx") returned 5 [0061.362] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.362] lstrlenW (lpString=".pdf") returned 4 [0061.362] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.362] lstrlenW (lpString=".xls") returned 4 [0061.362] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.362] lstrlenW (lpString=".xlsx") returned 5 [0061.362] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.362] lstrlenW (lpString=".ppt") returned 4 [0061.362] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.362] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.362] lstrlenW (lpString=".zip") returned 4 [0061.362] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.362] lstrlenW (lpString=".rar") returned 4 [0061.362] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.363] lstrlenW (lpString=".bz2") returned 4 [0061.363] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.363] lstrlenW (lpString=".7z") returned 3 [0061.363] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.363] lstrlenW (lpString=".dbf") returned 4 [0061.363] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.363] lstrlenW (lpString=".1cd") returned 4 [0061.363] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.363] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0061.363] lstrlenW (lpString=".jpg") returned 4 [0061.363] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.363] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0061.363] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0061.363] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.373] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1571) returned 1 [0061.373] CloseHandle (hObject=0x198) returned 1 [0061.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0061.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.373] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.373] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.373] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0061.381] GetLastError () returned 0x0 [0061.381] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x623, lpOverlapped=0x0) returned 1 [0061.399] WriteFile (in: hFile=0x1fc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x630, lpOverlapped=0x0) returned 1 [0061.401] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.401] WriteFile (in: hFile=0x1fc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.401] SetEndOfFile (hFile=0x1fc) returned 1 [0061.401] CloseHandle (hObject=0x1fc) returned 1 [0061.401] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.401] SetEndOfFile (hFile=0x198) returned 1 [0061.402] CloseHandle (hObject=0x198) returned 1 [0061.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.402] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0061.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.403] lstrlenW (lpString=".doc") returned 4 [0061.403] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.403] lstrlenW (lpString=".docx") returned 5 [0061.403] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.403] lstrlenW (lpString=".pdf") returned 4 [0061.403] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.403] lstrlenW (lpString=".xls") returned 4 [0061.403] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.403] lstrlenW (lpString=".xlsx") returned 5 [0061.403] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.403] lstrlenW (lpString=".ppt") returned 4 [0061.403] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.403] lstrlenW (lpString=".zip") returned 4 [0061.403] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.403] lstrlenW (lpString=".rar") returned 4 [0061.403] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.403] lstrlenW (lpString=".bz2") returned 4 [0061.403] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.403] lstrlenW (lpString=".7z") returned 3 [0061.403] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.403] lstrlenW (lpString=".dbf") returned 4 [0061.403] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.403] lstrlenW (lpString=".1cd") returned 4 [0061.403] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.403] lstrlenW (lpString=".jpg") returned 4 [0061.403] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.404] lstrlenW (lpString=".doc") returned 4 [0061.404] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.404] lstrlenW (lpString=".docx") returned 5 [0061.404] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.404] lstrlenW (lpString=".pdf") returned 4 [0061.404] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.404] lstrlenW (lpString=".xls") returned 4 [0061.404] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.404] lstrlenW (lpString=".xlsx") returned 5 [0061.404] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.404] lstrlenW (lpString=".ppt") returned 4 [0061.404] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.404] lstrlenW (lpString=".zip") returned 4 [0061.404] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.404] lstrlenW (lpString=".rar") returned 4 [0061.404] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.404] lstrlenW (lpString=".bz2") returned 4 [0061.404] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.404] lstrlenW (lpString=".7z") returned 3 [0061.404] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.404] lstrlenW (lpString=".dbf") returned 4 [0061.404] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.404] lstrlenW (lpString=".1cd") returned 4 [0061.404] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0061.404] lstrlenW (lpString=".jpg") returned 4 [0061.404] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.405] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0061.405] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0061.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.450] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=72031) returned 1 [0061.451] CloseHandle (hObject=0x198) returned 1 [0061.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0061.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.451] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.451] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0061.451] GetLastError () returned 0x0 [0061.451] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0061.496] WriteFile (in: hFile=0x1fc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0061.498] ReadFile (in: hFile=0x198, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.498] WriteFile (in: hFile=0x1fc, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.499] SetEndOfFile (hFile=0x1fc) returned 1 [0061.499] CloseHandle (hObject=0x1fc) returned 1 [0061.499] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.499] SetEndOfFile (hFile=0x198) returned 1 [0061.500] CloseHandle (hObject=0x198) returned 1 [0061.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.500] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0061.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.501] lstrlenW (lpString=".doc") returned 4 [0061.501] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0061.501] lstrlenW (lpString=".docx") returned 5 [0061.501] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0061.501] lstrlenW (lpString=".pdf") returned 4 [0061.501] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0061.501] lstrlenW (lpString=".xls") returned 4 [0061.501] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0061.501] lstrlenW (lpString=".xlsx") returned 5 [0061.501] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0061.501] lstrlenW (lpString=".ppt") returned 4 [0061.501] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0061.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.501] lstrlenW (lpString=".zip") returned 4 [0061.501] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0061.501] lstrlenW (lpString=".rar") returned 4 [0061.501] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0061.501] lstrlenW (lpString=".bz2") returned 4 [0061.501] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0061.501] lstrlenW (lpString=".7z") returned 3 [0061.501] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0061.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.501] lstrlenW (lpString=".dbf") returned 4 [0061.501] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0061.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.501] lstrlenW (lpString=".1cd") returned 4 [0061.501] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0061.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.501] lstrlenW (lpString=".jpg") returned 4 [0061.501] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0061.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.502] lstrlenW (lpString=".doc") returned 4 [0061.502] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0061.502] lstrlenW (lpString=".docx") returned 5 [0061.502] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0061.502] lstrlenW (lpString=".pdf") returned 4 [0061.502] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0061.502] lstrlenW (lpString=".xls") returned 4 [0061.502] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0061.502] lstrlenW (lpString=".xlsx") returned 5 [0061.502] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0061.502] lstrlenW (lpString=".ppt") returned 4 [0061.502] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0061.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.502] lstrlenW (lpString=".zip") returned 4 [0061.502] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0061.502] lstrlenW (lpString=".rar") returned 4 [0061.502] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0061.502] lstrlenW (lpString=".bz2") returned 4 [0061.502] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0061.502] lstrlenW (lpString=".7z") returned 3 [0061.502] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0061.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.502] lstrlenW (lpString=".dbf") returned 4 [0061.502] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0061.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.502] lstrlenW (lpString=".1cd") returned 4 [0061.502] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0061.502] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0061.503] lstrlenW (lpString=".jpg") returned 4 [0061.503] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0061.516] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0061.516] lstrlenW (lpString="VBUI6.CHM") returned 9 [0061.516] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0061.519] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=416918) returned 1 [0061.519] CloseHandle (hObject=0x1fc) returned 1 [0061.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0061.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0061.519] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.519] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.520] GetLastError () returned 0x0 [0061.520] ReadFile (in: hFile=0x1fc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x65c96, lpOverlapped=0x0) returned 1 [0062.208] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0062.216] ReadFile (in: hFile=0x1fc, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.216] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.217] SetEndOfFile (hFile=0x1e8) returned 1 [0062.217] CloseHandle (hObject=0x1e8) returned 1 [0062.217] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.217] SetEndOfFile (hFile=0x1fc) returned 1 [0062.221] CloseHandle (hObject=0x1fc) returned 1 [0062.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0062.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0062.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.221] lstrlenW (lpString=".doc") returned 4 [0062.221] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.222] lstrlenW (lpString=".docx") returned 5 [0062.222] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0062.222] lstrlenW (lpString=".pdf") returned 4 [0062.222] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.222] lstrlenW (lpString=".xls") returned 4 [0062.222] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.222] lstrlenW (lpString=".xlsx") returned 5 [0062.222] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0062.222] lstrlenW (lpString=".ppt") returned 4 [0062.222] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.222] lstrlenW (lpString=".zip") returned 4 [0062.222] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.222] lstrlenW (lpString=".rar") returned 4 [0062.222] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.222] lstrlenW (lpString=".bz2") returned 4 [0062.222] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.222] lstrlenW (lpString=".7z") returned 3 [0062.222] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.222] lstrlenW (lpString=".dbf") returned 4 [0062.222] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.222] lstrlenW (lpString=".1cd") returned 4 [0062.222] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.222] lstrlenW (lpString=".jpg") returned 4 [0062.222] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.222] lstrlenW (lpString=".doc") returned 4 [0062.223] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.223] lstrlenW (lpString=".docx") returned 5 [0062.223] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0062.223] lstrlenW (lpString=".pdf") returned 4 [0062.223] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.223] lstrlenW (lpString=".xls") returned 4 [0062.223] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.223] lstrlenW (lpString=".xlsx") returned 5 [0062.223] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0062.223] lstrlenW (lpString=".ppt") returned 4 [0062.223] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.223] lstrlenW (lpString=".zip") returned 4 [0062.223] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.223] lstrlenW (lpString=".rar") returned 4 [0062.223] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.223] lstrlenW (lpString=".bz2") returned 4 [0062.223] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.223] lstrlenW (lpString=".7z") returned 3 [0062.223] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.223] lstrlenW (lpString=".dbf") returned 4 [0062.223] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.223] lstrlenW (lpString=".1cd") returned 4 [0062.223] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0062.223] lstrlenW (lpString=".jpg") returned 4 [0062.223] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.224] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0062.224] lstrlenW (lpString="oledbvbs.inc") returned 12 [0062.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0062.298] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=9975) returned 1 [0062.298] CloseHandle (hObject=0x218) returned 1 [0062.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0062.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.298] lstrlenW (lpString=".doc") returned 4 [0062.298] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.298] lstrlenW (lpString=".docx") returned 5 [0062.298] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.298] lstrlenW (lpString=".pdf") returned 4 [0062.298] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.298] lstrlenW (lpString=".xls") returned 4 [0062.298] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.298] lstrlenW (lpString=".xlsx") returned 5 [0062.298] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.298] lstrlenW (lpString=".ppt") returned 4 [0062.298] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.298] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.298] lstrlenW (lpString=".zip") returned 4 [0062.299] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.299] lstrlenW (lpString=".rar") returned 4 [0062.299] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.299] lstrlenW (lpString=".bz2") returned 4 [0062.299] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.299] lstrlenW (lpString=".7z") returned 3 [0062.299] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.299] lstrlenW (lpString=".dbf") returned 4 [0062.299] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0062.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.299] lstrlenW (lpString=".1cd") returned 4 [0062.299] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0062.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.299] lstrlenW (lpString=".jpg") returned 4 [0062.299] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0062.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.299] lstrlenW (lpString=".doc") returned 4 [0062.299] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.299] lstrlenW (lpString=".docx") returned 5 [0062.299] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.299] lstrlenW (lpString=".pdf") returned 4 [0062.299] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.299] lstrlenW (lpString=".xls") returned 4 [0062.299] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.299] lstrlenW (lpString=".xlsx") returned 5 [0062.299] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.299] lstrlenW (lpString=".ppt") returned 4 [0062.299] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.299] lstrlenW (lpString=".zip") returned 4 [0062.300] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.300] lstrlenW (lpString=".rar") returned 4 [0062.300] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.300] lstrlenW (lpString=".bz2") returned 4 [0062.300] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.300] lstrlenW (lpString=".7z") returned 3 [0062.300] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.300] lstrlenW (lpString=".dbf") returned 4 [0062.300] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0062.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.300] lstrlenW (lpString=".1cd") returned 4 [0062.300] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0062.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0062.300] lstrlenW (lpString=".jpg") returned 4 [0062.300] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0062.300] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0062.300] lstrlenW (lpString="4to3Squareframe_SelectionSubpicture.png") returned 39 [0062.300] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.474] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3304) returned 1 [0062.474] CloseHandle (hObject=0x214) returned 1 [0062.474] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png")) returned 0x20 [0063.214] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.471] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.471] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.471] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.471] lstrlenW (lpString=".doc") returned 4 [0063.471] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.471] lstrlenW (lpString=".docx") returned 5 [0063.472] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0063.472] lstrlenW (lpString=".pdf") returned 4 [0063.472] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.472] lstrlenW (lpString=".xls") returned 4 [0063.472] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.472] lstrlenW (lpString=".xlsx") returned 5 [0063.472] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0063.472] lstrlenW (lpString=".ppt") returned 4 [0063.472] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.472] lstrlenW (lpString=".zip") returned 4 [0063.472] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.472] lstrlenW (lpString=".rar") returned 4 [0063.472] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.472] lstrlenW (lpString=".bz2") returned 4 [0063.472] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.472] lstrlenW (lpString=".7z") returned 3 [0063.472] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.472] lstrlenW (lpString=".dbf") returned 4 [0063.472] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.472] lstrlenW (lpString=".1cd") returned 4 [0063.472] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.472] lstrlenW (lpString=".jpg") returned 4 [0063.472] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.472] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.472] lstrlenW (lpString=".doc") returned 4 [0063.472] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.472] lstrlenW (lpString=".docx") returned 5 [0063.473] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0063.473] lstrlenW (lpString=".pdf") returned 4 [0063.473] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.473] lstrlenW (lpString=".xls") returned 4 [0063.473] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.473] lstrlenW (lpString=".xlsx") returned 5 [0063.473] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0063.473] lstrlenW (lpString=".ppt") returned 4 [0063.473] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.473] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.473] lstrlenW (lpString=".zip") returned 4 [0063.473] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.473] lstrlenW (lpString=".rar") returned 4 [0063.473] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.473] lstrlenW (lpString=".bz2") returned 4 [0063.473] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.473] lstrlenW (lpString=".7z") returned 3 [0063.473] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.473] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.473] lstrlenW (lpString=".dbf") returned 4 [0063.473] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.473] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.473] lstrlenW (lpString=".1cd") returned 4 [0063.473] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.473] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_SelectionSubpicture.png") returned 83 [0063.473] lstrlenW (lpString=".jpg") returned 4 [0063.473] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.473] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0063.473] lstrlenW (lpString="circleround_selectionsubpicture.png") returned 35 [0063.474] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0063.745] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3878) returned 1 [0063.745] CloseHandle (hObject=0x180) returned 1 [0063.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png")) returned 0x20 [0063.745] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.745] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.745] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.745] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.746] lstrlenW (lpString=".doc") returned 4 [0063.746] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.746] lstrlenW (lpString=".docx") returned 5 [0063.746] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0063.746] lstrlenW (lpString=".pdf") returned 4 [0063.746] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.746] lstrlenW (lpString=".xls") returned 4 [0063.746] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.746] lstrlenW (lpString=".xlsx") returned 5 [0063.746] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0063.746] lstrlenW (lpString=".ppt") returned 4 [0063.746] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.746] lstrlenW (lpString=".zip") returned 4 [0063.746] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.746] lstrlenW (lpString=".rar") returned 4 [0063.746] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.746] lstrlenW (lpString=".bz2") returned 4 [0063.746] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.746] lstrlenW (lpString=".7z") returned 3 [0063.746] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.746] lstrlenW (lpString=".dbf") returned 4 [0063.746] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.746] lstrlenW (lpString=".1cd") returned 4 [0063.746] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.746] lstrlenW (lpString=".jpg") returned 4 [0063.746] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.746] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.747] lstrlenW (lpString=".doc") returned 4 [0063.747] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.747] lstrlenW (lpString=".docx") returned 5 [0063.747] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0063.747] lstrlenW (lpString=".pdf") returned 4 [0063.747] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.747] lstrlenW (lpString=".xls") returned 4 [0063.747] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.747] lstrlenW (lpString=".xlsx") returned 5 [0063.747] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0063.747] lstrlenW (lpString=".ppt") returned 4 [0063.747] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.747] lstrlenW (lpString=".zip") returned 4 [0063.747] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.747] lstrlenW (lpString=".rar") returned 4 [0063.747] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.747] lstrlenW (lpString=".bz2") returned 4 [0063.747] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.747] lstrlenW (lpString=".7z") returned 3 [0063.747] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.747] lstrlenW (lpString=".dbf") returned 4 [0063.747] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.747] lstrlenW (lpString=".1cd") returned 4 [0063.747] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.747] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_selectionsubpicture.png") returned 79 [0063.747] lstrlenW (lpString=".jpg") returned 4 [0063.747] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.748] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0063.748] lstrlenW (lpString="Circle_ButtonGraphic.png") returned 24 [0063.748] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0063.748] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=27281) returned 1 [0063.748] CloseHandle (hObject=0x180) returned 1 [0063.748] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png")) returned 0x20 [0063.748] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.748] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.748] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.748] lstrlenW (lpString=".doc") returned 4 [0063.748] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.748] lstrlenW (lpString=".docx") returned 5 [0063.748] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0063.749] lstrlenW (lpString=".pdf") returned 4 [0063.749] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.749] lstrlenW (lpString=".xls") returned 4 [0063.749] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.749] lstrlenW (lpString=".xlsx") returned 5 [0063.749] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0063.749] lstrlenW (lpString=".ppt") returned 4 [0063.749] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.749] lstrlenW (lpString=".zip") returned 4 [0063.749] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.749] lstrlenW (lpString=".rar") returned 4 [0063.749] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.749] lstrlenW (lpString=".bz2") returned 4 [0063.749] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.749] lstrlenW (lpString=".7z") returned 3 [0063.749] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.749] lstrlenW (lpString=".dbf") returned 4 [0063.749] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.749] lstrlenW (lpString=".1cd") returned 4 [0063.749] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.749] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.749] lstrlenW (lpString=".jpg") returned 4 [0063.749] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.750] lstrlenW (lpString=".doc") returned 4 [0063.750] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.750] lstrlenW (lpString=".docx") returned 5 [0063.750] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0063.750] lstrlenW (lpString=".pdf") returned 4 [0063.750] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.750] lstrlenW (lpString=".xls") returned 4 [0063.750] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.750] lstrlenW (lpString=".xlsx") returned 5 [0063.750] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0063.750] lstrlenW (lpString=".ppt") returned 4 [0063.750] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.750] lstrlenW (lpString=".zip") returned 4 [0063.750] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.750] lstrlenW (lpString=".rar") returned 4 [0063.750] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.750] lstrlenW (lpString=".bz2") returned 4 [0063.750] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.750] lstrlenW (lpString=".7z") returned 3 [0063.750] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.750] lstrlenW (lpString=".dbf") returned 4 [0063.750] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.750] lstrlenW (lpString=".1cd") returned 4 [0063.750] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.750] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_ButtonGraphic.png") returned 68 [0063.750] lstrlenW (lpString=".jpg") returned 4 [0063.750] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.751] lstrcmpiW (lpString1=".bmp", lpString2=".wiki") returned -1 [0063.751] lstrlenW (lpString="circle_glass_Thumbnail.bmp") returned 26 [0063.751] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0063.751] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5072) returned 1 [0063.751] CloseHandle (hObject=0x180) returned 1 [0063.751] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp")) returned 0x20 [0063.751] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.751] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_glass_thumbnail.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.751] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.751] lstrlenW (lpString=".doc") returned 4 [0063.751] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0063.751] lstrlenW (lpString=".docx") returned 5 [0063.751] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0063.751] lstrlenW (lpString=".pdf") returned 4 [0063.751] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0063.752] lstrlenW (lpString=".xls") returned 4 [0063.752] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0063.752] lstrlenW (lpString=".xlsx") returned 5 [0063.752] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0063.752] lstrlenW (lpString=".ppt") returned 4 [0063.752] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0063.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.752] lstrlenW (lpString=".zip") returned 4 [0063.752] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0063.752] lstrlenW (lpString=".rar") returned 4 [0063.752] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0063.752] lstrlenW (lpString=".bz2") returned 4 [0063.752] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0063.752] lstrlenW (lpString=".7z") returned 3 [0063.752] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0063.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.752] lstrlenW (lpString=".dbf") returned 4 [0063.752] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0063.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.752] lstrlenW (lpString=".1cd") returned 4 [0063.752] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0063.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.752] lstrlenW (lpString=".jpg") returned 4 [0063.752] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0063.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.752] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.752] lstrlenW (lpString=".doc") returned 4 [0063.752] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0063.752] lstrlenW (lpString=".docx") returned 5 [0063.752] lstrcmpiW (lpString1=".docx", lpString2="l.bmp") returned -1 [0063.752] lstrlenW (lpString=".pdf") returned 4 [0063.752] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0063.752] lstrlenW (lpString=".xls") returned 4 [0063.753] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0063.753] lstrlenW (lpString=".xlsx") returned 5 [0063.753] lstrcmpiW (lpString1=".xlsx", lpString2="l.bmp") returned -1 [0063.753] lstrlenW (lpString=".ppt") returned 4 [0063.753] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0063.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.753] lstrlenW (lpString=".zip") returned 4 [0063.753] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0063.753] lstrlenW (lpString=".rar") returned 4 [0063.753] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0063.753] lstrlenW (lpString=".bz2") returned 4 [0063.753] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0063.753] lstrlenW (lpString=".7z") returned 3 [0063.753] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0063.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.753] lstrlenW (lpString=".dbf") returned 4 [0063.753] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0063.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.753] lstrlenW (lpString=".1cd") returned 4 [0063.753] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0063.753] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circle_glass_Thumbnail.bmp") returned 70 [0063.753] lstrlenW (lpString=".jpg") returned 4 [0063.753] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0063.753] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0063.753] lstrlenW (lpString="Circle_SelectionSubpictureA.png") returned 31 [0063.753] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0063.754] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3878) returned 1 [0063.754] CloseHandle (hObject=0x180) returned 1 [0063.754] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png")) returned 0x20 [0063.754] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.754] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpicturea.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.754] lstrlenW (lpString=".doc") returned 4 [0063.754] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.754] lstrlenW (lpString=".docx") returned 5 [0063.754] lstrcmpiW (lpString1=".docx", lpString2="A.png") returned -1 [0063.754] lstrlenW (lpString=".pdf") returned 4 [0063.754] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.754] lstrlenW (lpString=".xls") returned 4 [0063.754] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.754] lstrlenW (lpString=".xlsx") returned 5 [0063.754] lstrcmpiW (lpString1=".xlsx", lpString2="A.png") returned -1 [0063.754] lstrlenW (lpString=".ppt") returned 4 [0063.754] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.754] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.754] lstrlenW (lpString=".zip") returned 4 [0063.754] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.754] lstrlenW (lpString=".rar") returned 4 [0063.755] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.755] lstrlenW (lpString=".bz2") returned 4 [0063.755] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.755] lstrlenW (lpString=".7z") returned 3 [0063.755] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.755] lstrlenW (lpString=".dbf") returned 4 [0063.755] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.755] lstrlenW (lpString=".1cd") returned 4 [0063.755] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.755] lstrlenW (lpString=".jpg") returned 4 [0063.755] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.755] lstrlenW (lpString=".doc") returned 4 [0063.755] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.755] lstrlenW (lpString=".docx") returned 5 [0063.755] lstrcmpiW (lpString1=".docx", lpString2="A.png") returned -1 [0063.755] lstrlenW (lpString=".pdf") returned 4 [0063.755] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.755] lstrlenW (lpString=".xls") returned 4 [0063.755] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.755] lstrlenW (lpString=".xlsx") returned 5 [0063.755] lstrcmpiW (lpString1=".xlsx", lpString2="A.png") returned -1 [0063.755] lstrlenW (lpString=".ppt") returned 4 [0063.755] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.755] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.755] lstrlenW (lpString=".zip") returned 4 [0063.755] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.755] lstrlenW (lpString=".rar") returned 4 [0063.756] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.756] lstrlenW (lpString=".bz2") returned 4 [0063.756] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.756] lstrlenW (lpString=".7z") returned 3 [0063.756] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.756] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.756] lstrlenW (lpString=".dbf") returned 4 [0063.756] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.756] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.756] lstrlenW (lpString=".1cd") returned 4 [0063.756] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.756] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureA.png") returned 75 [0063.756] lstrlenW (lpString=".jpg") returned 4 [0063.756] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.756] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0063.756] lstrlenW (lpString="Circle_SelectionSubpictureB.png") returned 31 [0063.756] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0063.757] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3215) returned 1 [0063.757] CloseHandle (hObject=0x180) returned 1 [0063.759] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png")) returned 0x20 [0063.759] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.759] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_selectionsubpictureb.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.759] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.759] lstrlenW (lpString=".doc") returned 4 [0063.759] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.759] lstrlenW (lpString=".docx") returned 5 [0063.759] lstrcmpiW (lpString1=".docx", lpString2="B.png") returned -1 [0063.759] lstrlenW (lpString=".pdf") returned 4 [0063.760] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.760] lstrlenW (lpString=".xls") returned 4 [0063.760] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.760] lstrlenW (lpString=".xlsx") returned 5 [0063.760] lstrcmpiW (lpString1=".xlsx", lpString2="B.png") returned -1 [0063.760] lstrlenW (lpString=".ppt") returned 4 [0063.760] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.760] lstrlenW (lpString=".zip") returned 4 [0063.760] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.760] lstrlenW (lpString=".rar") returned 4 [0063.760] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.760] lstrlenW (lpString=".bz2") returned 4 [0063.760] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.760] lstrlenW (lpString=".7z") returned 3 [0063.760] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.760] lstrlenW (lpString=".dbf") returned 4 [0063.760] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.760] lstrlenW (lpString=".1cd") returned 4 [0063.760] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.760] lstrlenW (lpString=".jpg") returned 4 [0063.760] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.760] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.760] lstrlenW (lpString=".doc") returned 4 [0063.760] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.760] lstrlenW (lpString=".docx") returned 5 [0063.760] lstrcmpiW (lpString1=".docx", lpString2="B.png") returned -1 [0063.760] lstrlenW (lpString=".pdf") returned 4 [0063.760] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.761] lstrlenW (lpString=".xls") returned 4 [0063.761] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.761] lstrlenW (lpString=".xlsx") returned 5 [0063.761] lstrcmpiW (lpString1=".xlsx", lpString2="B.png") returned -1 [0063.761] lstrlenW (lpString=".ppt") returned 4 [0063.761] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.761] lstrlenW (lpString=".zip") returned 4 [0063.761] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.761] lstrlenW (lpString=".rar") returned 4 [0063.761] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.761] lstrlenW (lpString=".bz2") returned 4 [0063.761] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.761] lstrlenW (lpString=".7z") returned 3 [0063.761] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.761] lstrlenW (lpString=".dbf") returned 4 [0063.761] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.761] lstrlenW (lpString=".1cd") returned 4 [0063.761] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.761] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_SelectionSubpictureB.png") returned 75 [0063.761] lstrlenW (lpString=".jpg") returned 4 [0063.761] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.761] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0063.761] lstrlenW (lpString="Circle_VideoInset.png") returned 21 [0063.761] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0063.762] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5059) returned 1 [0063.762] CloseHandle (hObject=0x180) returned 1 [0063.762] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png")) returned 0x20 [0063.762] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.762] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circle_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned 65 [0063.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned 65 [0063.762] lstrlenW (lpString=".doc") returned 4 [0063.762] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.762] lstrlenW (lpString=".docx") returned 5 [0063.762] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0063.762] lstrlenW (lpString=".pdf") returned 4 [0063.762] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.762] lstrlenW (lpString=".xls") returned 4 [0063.762] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.762] lstrlenW (lpString=".xlsx") returned 5 [0063.762] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0063.762] lstrlenW (lpString=".ppt") returned 4 [0063.762] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.762] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned 65 [0063.763] lstrlenW (lpString=".zip") returned 4 [0063.763] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.763] lstrlenW (lpString=".rar") returned 4 [0063.763] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.763] lstrlenW (lpString=".bz2") returned 4 [0063.763] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.763] lstrlenW (lpString=".7z") returned 3 [0063.763] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.763] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Circle_VideoInset.png") returned 65 [0063.763] lstrlenW (lpString=".dbf") returned 4 [0063.763] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.236] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.237] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.237] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.238] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.238] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.239] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.239] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.479] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0066.553] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.553] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.575] GetLastError () returned 0x0 [0066.575] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x2340, lpOverlapped=0x0) returned 1 [0066.589] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x2350, lpOverlapped=0x0) returned 1 [0066.590] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.591] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.591] SetEndOfFile (hFile=0x1e8) returned 1 [0066.591] CloseHandle (hObject=0x1e8) returned 1 [0066.591] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.591] SetEndOfFile (hFile=0x1ec) returned 1 [0066.592] CloseHandle (hObject=0x1ec) returned 1 [0066.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0066.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.593] lstrlenW (lpString=".doc") returned 4 [0066.593] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.593] lstrlenW (lpString=".docx") returned 5 [0066.593] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.593] lstrlenW (lpString=".pdf") returned 4 [0066.593] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.593] lstrlenW (lpString=".xls") returned 4 [0066.593] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.593] lstrlenW (lpString=".xlsx") returned 5 [0066.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.593] lstrlenW (lpString=".ppt") returned 4 [0066.593] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.593] lstrlenW (lpString=".zip") returned 4 [0066.593] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.593] lstrlenW (lpString=".rar") returned 4 [0066.593] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.593] lstrlenW (lpString=".bz2") returned 4 [0066.593] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.593] lstrlenW (lpString=".7z") returned 3 [0066.593] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.593] lstrlenW (lpString=".dbf") returned 4 [0066.593] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.593] lstrlenW (lpString=".1cd") returned 4 [0066.593] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.593] lstrlenW (lpString=".jpg") returned 4 [0066.593] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.594] lstrlenW (lpString=".doc") returned 4 [0066.594] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.594] lstrlenW (lpString=".docx") returned 5 [0066.594] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.594] lstrlenW (lpString=".pdf") returned 4 [0066.594] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.594] lstrlenW (lpString=".xls") returned 4 [0066.594] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.594] lstrlenW (lpString=".xlsx") returned 5 [0066.594] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.594] lstrlenW (lpString=".ppt") returned 4 [0066.594] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.594] lstrlenW (lpString=".zip") returned 4 [0066.594] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.594] lstrlenW (lpString=".rar") returned 4 [0066.594] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.594] lstrlenW (lpString=".bz2") returned 4 [0066.594] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.594] lstrlenW (lpString=".7z") returned 3 [0066.594] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.594] lstrlenW (lpString=".dbf") returned 4 [0066.594] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.594] lstrlenW (lpString=".1cd") returned 4 [0066.594] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0066.594] lstrlenW (lpString=".jpg") returned 4 [0066.594] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.595] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.595] lstrlenW (lpString="AG00126_.GIF") returned 12 [0066.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.595] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3140) returned 1 [0066.595] CloseHandle (hObject=0x1ec) returned 1 [0066.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0066.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.595] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.595] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.596] GetLastError () returned 0x0 [0066.596] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xc44, lpOverlapped=0x0) returned 1 [0066.597] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0066.598] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.598] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.599] SetEndOfFile (hFile=0x1e8) returned 1 [0066.599] CloseHandle (hObject=0x1e8) returned 1 [0066.599] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.599] SetEndOfFile (hFile=0x1ec) returned 1 [0066.600] CloseHandle (hObject=0x1ec) returned 1 [0066.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0066.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.600] lstrlenW (lpString=".doc") returned 4 [0066.600] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.600] lstrlenW (lpString=".docx") returned 5 [0066.600] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.600] lstrlenW (lpString=".pdf") returned 4 [0066.600] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.600] lstrlenW (lpString=".xls") returned 4 [0066.600] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.600] lstrlenW (lpString=".xlsx") returned 5 [0066.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.600] lstrlenW (lpString=".ppt") returned 4 [0066.600] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.600] lstrlenW (lpString=".zip") returned 4 [0066.601] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.601] lstrlenW (lpString=".rar") returned 4 [0066.601] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.601] lstrlenW (lpString=".bz2") returned 4 [0066.601] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.601] lstrlenW (lpString=".7z") returned 3 [0066.601] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.601] lstrlenW (lpString=".dbf") returned 4 [0066.601] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.601] lstrlenW (lpString=".1cd") returned 4 [0066.601] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.601] lstrlenW (lpString=".jpg") returned 4 [0066.601] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.601] lstrlenW (lpString=".doc") returned 4 [0066.601] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.601] lstrlenW (lpString=".docx") returned 5 [0066.601] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.601] lstrlenW (lpString=".pdf") returned 4 [0066.601] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.601] lstrlenW (lpString=".xls") returned 4 [0066.601] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.601] lstrlenW (lpString=".xlsx") returned 5 [0066.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.601] lstrlenW (lpString=".ppt") returned 4 [0066.601] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.601] lstrlenW (lpString=".zip") returned 4 [0066.601] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.602] lstrlenW (lpString=".rar") returned 4 [0066.602] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.602] lstrlenW (lpString=".bz2") returned 4 [0066.602] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.602] lstrlenW (lpString=".7z") returned 3 [0066.602] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.602] lstrlenW (lpString=".dbf") returned 4 [0066.602] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.602] lstrlenW (lpString=".1cd") returned 4 [0066.602] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0066.602] lstrlenW (lpString=".jpg") returned 4 [0066.602] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.602] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.602] lstrlenW (lpString="AG00129_.GIF") returned 12 [0066.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.602] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=12482) returned 1 [0066.602] CloseHandle (hObject=0x1ec) returned 1 [0066.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0066.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.603] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.603] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.603] GetLastError () returned 0x0 [0066.603] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0066.605] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0066.606] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.606] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.606] SetEndOfFile (hFile=0x1e8) returned 1 [0066.606] CloseHandle (hObject=0x1e8) returned 1 [0066.606] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.606] SetEndOfFile (hFile=0x1ec) returned 1 [0066.607] CloseHandle (hObject=0x1ec) returned 1 [0066.607] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0066.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.608] lstrlenW (lpString=".doc") returned 4 [0066.608] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.608] lstrlenW (lpString=".docx") returned 5 [0066.608] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.608] lstrlenW (lpString=".pdf") returned 4 [0066.608] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.608] lstrlenW (lpString=".xls") returned 4 [0066.608] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.608] lstrlenW (lpString=".xlsx") returned 5 [0066.608] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.608] lstrlenW (lpString=".ppt") returned 4 [0066.608] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.608] lstrlenW (lpString=".zip") returned 4 [0066.608] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.608] lstrlenW (lpString=".rar") returned 4 [0066.608] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.608] lstrlenW (lpString=".bz2") returned 4 [0066.608] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.608] lstrlenW (lpString=".7z") returned 3 [0066.608] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.608] lstrlenW (lpString=".dbf") returned 4 [0066.609] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.609] lstrlenW (lpString=".1cd") returned 4 [0066.609] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.609] lstrlenW (lpString=".jpg") returned 4 [0066.609] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.609] lstrlenW (lpString=".doc") returned 4 [0066.609] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.609] lstrlenW (lpString=".docx") returned 5 [0066.609] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.609] lstrlenW (lpString=".pdf") returned 4 [0066.609] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.609] lstrlenW (lpString=".xls") returned 4 [0066.609] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.609] lstrlenW (lpString=".xlsx") returned 5 [0066.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.609] lstrlenW (lpString=".ppt") returned 4 [0066.609] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.609] lstrlenW (lpString=".zip") returned 4 [0066.609] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.609] lstrlenW (lpString=".rar") returned 4 [0066.609] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.609] lstrlenW (lpString=".bz2") returned 4 [0066.609] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.609] lstrlenW (lpString=".7z") returned 3 [0066.609] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.609] lstrlenW (lpString=".dbf") returned 4 [0066.610] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.610] lstrlenW (lpString=".1cd") returned 4 [0066.610] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0066.610] lstrlenW (lpString=".jpg") returned 4 [0066.610] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.610] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.610] lstrlenW (lpString="AG00130_.GIF") returned 12 [0066.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.610] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5253) returned 1 [0066.610] CloseHandle (hObject=0x1ec) returned 1 [0066.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0066.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.611] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.611] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.611] GetLastError () returned 0x0 [0066.611] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x1485, lpOverlapped=0x0) returned 1 [0066.613] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0066.613] ReadFile (in: hFile=0x1ec, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.614] WriteFile (in: hFile=0x1e8, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.614] SetEndOfFile (hFile=0x1e8) returned 1 [0066.614] CloseHandle (hObject=0x1e8) returned 1 [0066.614] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.614] SetEndOfFile (hFile=0x1ec) returned 1 [0066.615] CloseHandle (hObject=0x1ec) returned 1 [0066.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.615] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0066.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.615] lstrlenW (lpString=".doc") returned 4 [0066.615] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.615] lstrlenW (lpString=".docx") returned 5 [0066.615] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.615] lstrlenW (lpString=".pdf") returned 4 [0066.615] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.615] lstrlenW (lpString=".xls") returned 4 [0066.615] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.615] lstrlenW (lpString=".xlsx") returned 5 [0066.615] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.616] lstrlenW (lpString=".ppt") returned 4 [0066.616] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.616] lstrlenW (lpString=".zip") returned 4 [0066.616] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.616] lstrlenW (lpString=".rar") returned 4 [0066.616] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.616] lstrlenW (lpString=".bz2") returned 4 [0066.616] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.616] lstrlenW (lpString=".7z") returned 3 [0066.616] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.616] lstrlenW (lpString=".dbf") returned 4 [0066.616] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.616] lstrlenW (lpString=".1cd") returned 4 [0066.616] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.616] lstrlenW (lpString=".jpg") returned 4 [0066.616] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.616] lstrlenW (lpString=".doc") returned 4 [0066.616] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.616] lstrlenW (lpString=".docx") returned 5 [0066.616] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.616] lstrlenW (lpString=".pdf") returned 4 [0066.616] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.616] lstrlenW (lpString=".xls") returned 4 [0066.616] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.616] lstrlenW (lpString=".xlsx") returned 5 [0066.616] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.616] lstrlenW (lpString=".ppt") returned 4 [0066.617] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.617] lstrlenW (lpString=".zip") returned 4 [0066.617] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.617] lstrlenW (lpString=".rar") returned 4 [0066.617] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.617] lstrlenW (lpString=".bz2") returned 4 [0066.617] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.617] lstrlenW (lpString=".7z") returned 3 [0066.617] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.617] lstrlenW (lpString=".dbf") returned 4 [0066.617] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.617] lstrlenW (lpString=".1cd") returned 4 [0066.617] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0066.617] lstrlenW (lpString=".jpg") returned 4 [0066.617] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.617] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.617] lstrlenW (lpString="AG00135_.GIF") returned 12 [0066.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.653] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2596) returned 1 [0066.653] CloseHandle (hObject=0x1f8) returned 1 [0066.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0066.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.661] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.669] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.669] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0066.677] GetLastError () returned 0x0 [0066.677] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xa24, lpOverlapped=0x0) returned 1 [0066.694] WriteFile (in: hFile=0x220, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0066.695] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.695] WriteFile (in: hFile=0x220, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.695] SetEndOfFile (hFile=0x220) returned 1 [0066.695] CloseHandle (hObject=0x220) returned 1 [0066.695] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.695] SetEndOfFile (hFile=0x1f8) returned 1 [0066.696] CloseHandle (hObject=0x1f8) returned 1 [0066.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.696] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0066.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.697] lstrlenW (lpString=".doc") returned 4 [0066.697] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.697] lstrlenW (lpString=".docx") returned 5 [0066.697] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.697] lstrlenW (lpString=".pdf") returned 4 [0066.697] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.697] lstrlenW (lpString=".xls") returned 4 [0066.697] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.697] lstrlenW (lpString=".xlsx") returned 5 [0066.697] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.697] lstrlenW (lpString=".ppt") returned 4 [0066.697] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.697] lstrlenW (lpString=".zip") returned 4 [0066.697] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.697] lstrlenW (lpString=".rar") returned 4 [0066.697] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.697] lstrlenW (lpString=".bz2") returned 4 [0066.697] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.697] lstrlenW (lpString=".7z") returned 3 [0066.697] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.697] lstrlenW (lpString=".dbf") returned 4 [0066.697] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.698] lstrlenW (lpString=".1cd") returned 4 [0066.698] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.698] lstrlenW (lpString=".jpg") returned 4 [0066.698] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.698] lstrlenW (lpString=".doc") returned 4 [0066.698] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.698] lstrlenW (lpString=".docx") returned 5 [0066.698] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.698] lstrlenW (lpString=".pdf") returned 4 [0066.698] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.699] lstrlenW (lpString=".xls") returned 4 [0066.699] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.699] lstrlenW (lpString=".xlsx") returned 5 [0066.699] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.699] lstrlenW (lpString=".ppt") returned 4 [0066.699] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.699] lstrlenW (lpString=".zip") returned 4 [0066.699] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.699] lstrlenW (lpString=".rar") returned 4 [0066.699] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.699] lstrlenW (lpString=".bz2") returned 4 [0066.699] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.699] lstrlenW (lpString=".7z") returned 3 [0066.699] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.699] lstrlenW (lpString=".dbf") returned 4 [0066.699] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.699] lstrlenW (lpString=".1cd") returned 4 [0066.699] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0066.699] lstrlenW (lpString=".jpg") returned 4 [0066.699] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.699] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.699] lstrlenW (lpString="AG00160_.GIF") returned 12 [0066.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.700] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1146) returned 1 [0066.700] CloseHandle (hObject=0x1f8) returned 1 [0066.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0066.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.700] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.700] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0066.700] GetLastError () returned 0x0 [0066.700] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x47a, lpOverlapped=0x0) returned 1 [0066.702] WriteFile (in: hFile=0x220, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x480, lpOverlapped=0x0) returned 1 [0066.703] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.703] WriteFile (in: hFile=0x220, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.703] SetEndOfFile (hFile=0x220) returned 1 [0066.703] CloseHandle (hObject=0x220) returned 1 [0066.703] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.703] SetEndOfFile (hFile=0x1f8) returned 1 [0066.704] CloseHandle (hObject=0x1f8) returned 1 [0066.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0066.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.705] lstrlenW (lpString=".doc") returned 4 [0066.705] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.705] lstrlenW (lpString=".docx") returned 5 [0066.705] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.705] lstrlenW (lpString=".pdf") returned 4 [0066.705] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.705] lstrlenW (lpString=".xls") returned 4 [0066.705] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.705] lstrlenW (lpString=".xlsx") returned 5 [0066.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.705] lstrlenW (lpString=".ppt") returned 4 [0066.705] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.705] lstrlenW (lpString=".zip") returned 4 [0066.705] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.705] lstrlenW (lpString=".rar") returned 4 [0066.705] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.705] lstrlenW (lpString=".bz2") returned 4 [0066.705] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.705] lstrlenW (lpString=".7z") returned 3 [0066.705] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.705] lstrlenW (lpString=".dbf") returned 4 [0066.705] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.705] lstrlenW (lpString=".1cd") returned 4 [0066.705] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.705] lstrlenW (lpString=".jpg") returned 4 [0066.706] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.706] lstrlenW (lpString=".doc") returned 4 [0066.706] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.706] lstrlenW (lpString=".docx") returned 5 [0066.706] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.706] lstrlenW (lpString=".pdf") returned 4 [0066.706] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.706] lstrlenW (lpString=".xls") returned 4 [0066.706] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.706] lstrlenW (lpString=".xlsx") returned 5 [0066.706] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.706] lstrlenW (lpString=".ppt") returned 4 [0066.706] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.706] lstrlenW (lpString=".zip") returned 4 [0066.706] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.706] lstrlenW (lpString=".rar") returned 4 [0066.706] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.706] lstrlenW (lpString=".bz2") returned 4 [0066.706] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.706] lstrlenW (lpString=".7z") returned 3 [0066.706] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.706] lstrlenW (lpString=".dbf") returned 4 [0066.706] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.706] lstrlenW (lpString=".1cd") returned 4 [0066.706] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0066.706] lstrlenW (lpString=".jpg") returned 4 [0066.707] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.707] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.707] lstrlenW (lpString="AG00161_.GIF") returned 12 [0066.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.707] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=7583) returned 1 [0066.707] CloseHandle (hObject=0x1f8) returned 1 [0066.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0066.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.707] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.708] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0066.708] GetLastError () returned 0x0 [0066.708] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0066.709] WriteFile (in: hFile=0x220, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0066.713] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.713] WriteFile (in: hFile=0x220, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.713] SetEndOfFile (hFile=0x220) returned 1 [0066.713] CloseHandle (hObject=0x220) returned 1 [0066.714] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.714] SetEndOfFile (hFile=0x1f8) returned 1 [0066.714] CloseHandle (hObject=0x1f8) returned 1 [0066.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0066.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.715] lstrlenW (lpString=".doc") returned 4 [0066.715] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.715] lstrlenW (lpString=".docx") returned 5 [0066.715] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.715] lstrlenW (lpString=".pdf") returned 4 [0066.715] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.715] lstrlenW (lpString=".xls") returned 4 [0066.715] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.715] lstrlenW (lpString=".xlsx") returned 5 [0066.715] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.715] lstrlenW (lpString=".ppt") returned 4 [0066.715] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.715] lstrlenW (lpString=".zip") returned 4 [0066.715] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.715] lstrlenW (lpString=".rar") returned 4 [0066.716] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.716] lstrlenW (lpString=".bz2") returned 4 [0066.716] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.716] lstrlenW (lpString=".7z") returned 3 [0066.716] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.716] lstrlenW (lpString=".dbf") returned 4 [0066.716] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.716] lstrlenW (lpString=".1cd") returned 4 [0066.716] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.716] lstrlenW (lpString=".jpg") returned 4 [0066.716] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.716] lstrlenW (lpString=".doc") returned 4 [0066.716] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.716] lstrlenW (lpString=".docx") returned 5 [0066.716] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.716] lstrlenW (lpString=".pdf") returned 4 [0066.716] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.716] lstrlenW (lpString=".xls") returned 4 [0066.716] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.716] lstrlenW (lpString=".xlsx") returned 5 [0066.716] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.716] lstrlenW (lpString=".ppt") returned 4 [0066.716] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.716] lstrlenW (lpString=".zip") returned 4 [0066.716] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.716] lstrlenW (lpString=".rar") returned 4 [0066.717] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.717] lstrlenW (lpString=".bz2") returned 4 [0066.717] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.717] lstrlenW (lpString=".7z") returned 3 [0066.717] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.717] lstrlenW (lpString=".dbf") returned 4 [0066.717] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.717] lstrlenW (lpString=".1cd") returned 4 [0066.717] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0066.717] lstrlenW (lpString=".jpg") returned 4 [0066.717] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.717] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.717] lstrlenW (lpString="AG00163_.GIF") returned 12 [0066.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.718] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=6984) returned 1 [0066.718] CloseHandle (hObject=0x1f8) returned 1 [0066.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0066.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.718] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.718] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0066.719] GetLastError () returned 0x0 [0066.719] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0066.722] WriteFile (in: hFile=0x220, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0066.723] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.723] WriteFile (in: hFile=0x220, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.723] SetEndOfFile (hFile=0x220) returned 1 [0066.723] CloseHandle (hObject=0x220) returned 1 [0066.723] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.723] SetEndOfFile (hFile=0x1f8) returned 1 [0066.724] CloseHandle (hObject=0x1f8) returned 1 [0066.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.724] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0066.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.725] lstrlenW (lpString=".doc") returned 4 [0066.725] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.725] lstrlenW (lpString=".docx") returned 5 [0066.725] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.725] lstrlenW (lpString=".pdf") returned 4 [0066.725] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.725] lstrlenW (lpString=".xls") returned 4 [0066.725] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.725] lstrlenW (lpString=".xlsx") returned 5 [0066.725] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.725] lstrlenW (lpString=".ppt") returned 4 [0066.725] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.725] lstrlenW (lpString=".zip") returned 4 [0066.725] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.725] lstrlenW (lpString=".rar") returned 4 [0066.725] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.725] lstrlenW (lpString=".bz2") returned 4 [0066.725] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.725] lstrlenW (lpString=".7z") returned 3 [0066.725] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.725] lstrlenW (lpString=".dbf") returned 4 [0066.725] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.726] lstrlenW (lpString=".1cd") returned 4 [0066.726] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.726] lstrlenW (lpString=".jpg") returned 4 [0066.726] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.726] lstrlenW (lpString=".doc") returned 4 [0066.726] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.726] lstrlenW (lpString=".docx") returned 5 [0066.726] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.726] lstrlenW (lpString=".pdf") returned 4 [0066.726] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.726] lstrlenW (lpString=".xls") returned 4 [0066.726] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.726] lstrlenW (lpString=".xlsx") returned 5 [0066.726] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.726] lstrlenW (lpString=".ppt") returned 4 [0066.726] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.726] lstrlenW (lpString=".zip") returned 4 [0066.726] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.726] lstrlenW (lpString=".rar") returned 4 [0066.726] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.726] lstrlenW (lpString=".bz2") returned 4 [0066.726] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.726] lstrlenW (lpString=".7z") returned 3 [0066.726] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.726] lstrlenW (lpString=".dbf") returned 4 [0066.726] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.727] lstrlenW (lpString=".1cd") returned 4 [0066.727] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0066.727] lstrlenW (lpString=".jpg") returned 4 [0066.727] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.727] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.727] lstrlenW (lpString="AG00164_.GIF") returned 12 [0066.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.727] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=13254) returned 1 [0066.727] CloseHandle (hObject=0x1f8) returned 1 [0066.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0066.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.727] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0066.728] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.728] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0066.728] GetLastError () returned 0x0 [0066.728] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0067.325] WriteFile (in: hFile=0x220, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0067.326] ReadFile (in: hFile=0x1f8, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.326] WriteFile (in: hFile=0x220, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.327] SetEndOfFile (hFile=0x220) returned 1 [0067.605] CloseHandle (hObject=0x220) returned 1 [0067.605] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.605] SetEndOfFile (hFile=0x1f8) returned 1 [0067.606] CloseHandle (hObject=0x1f8) returned 1 [0067.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0067.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.645] lstrlenW (lpString=".doc") returned 4 [0067.645] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0067.645] lstrlenW (lpString=".docx") returned 5 [0067.645] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0067.645] lstrlenW (lpString=".pdf") returned 4 [0067.645] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0067.645] lstrlenW (lpString=".xls") returned 4 [0067.645] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0067.645] lstrlenW (lpString=".xlsx") returned 5 [0067.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0067.646] lstrlenW (lpString=".ppt") returned 4 [0067.646] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0067.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.646] lstrlenW (lpString=".zip") returned 4 [0067.646] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0067.646] lstrlenW (lpString=".rar") returned 4 [0067.646] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0067.646] lstrlenW (lpString=".bz2") returned 4 [0067.646] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0067.646] lstrlenW (lpString=".7z") returned 3 [0067.646] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0067.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.646] lstrlenW (lpString=".dbf") returned 4 [0067.646] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0067.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.646] lstrlenW (lpString=".1cd") returned 4 [0067.646] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0067.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.646] lstrlenW (lpString=".jpg") returned 4 [0067.646] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0067.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.646] lstrlenW (lpString=".doc") returned 4 [0067.646] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0067.646] lstrlenW (lpString=".docx") returned 5 [0067.646] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0067.646] lstrlenW (lpString=".pdf") returned 4 [0067.646] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0067.646] lstrlenW (lpString=".xls") returned 4 [0067.646] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0067.646] lstrlenW (lpString=".xlsx") returned 5 [0067.646] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0067.647] lstrlenW (lpString=".ppt") returned 4 [0067.647] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0067.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.647] lstrlenW (lpString=".zip") returned 4 [0067.647] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0067.647] lstrlenW (lpString=".rar") returned 4 [0067.647] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0067.647] lstrlenW (lpString=".bz2") returned 4 [0067.647] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0067.647] lstrlenW (lpString=".7z") returned 3 [0067.647] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0067.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.647] lstrlenW (lpString=".dbf") returned 4 [0067.647] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0067.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.647] lstrlenW (lpString=".1cd") returned 4 [0067.647] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0067.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0067.647] lstrlenW (lpString=".jpg") returned 4 [0067.647] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0067.647] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0067.647] lstrlenW (lpString="AG00170_.GIF") returned 12 [0067.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.149] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=9248) returned 1 [0069.155] CloseHandle (hObject=0x200) returned 1 [0069.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0069.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.156] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.156] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.157] GetLastError () returned 0x0 [0069.157] ReadFile (in: hFile=0x200, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x2420, lpOverlapped=0x0) returned 1 [0069.159] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x2430, lpOverlapped=0x0) returned 1 [0069.160] ReadFile (in: hFile=0x200, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.160] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.160] SetEndOfFile (hFile=0x16c) returned 1 [0069.160] CloseHandle (hObject=0x16c) returned 1 [0069.160] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.160] SetEndOfFile (hFile=0x200) returned 1 [0069.161] CloseHandle (hObject=0x200) returned 1 [0069.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0069.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.162] lstrlenW (lpString=".doc") returned 4 [0069.162] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.162] lstrlenW (lpString=".docx") returned 5 [0069.162] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0069.162] lstrlenW (lpString=".pdf") returned 4 [0069.162] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.162] lstrlenW (lpString=".xls") returned 4 [0069.162] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.162] lstrlenW (lpString=".xlsx") returned 5 [0069.162] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0069.162] lstrlenW (lpString=".ppt") returned 4 [0069.162] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.162] lstrlenW (lpString=".zip") returned 4 [0069.162] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.162] lstrlenW (lpString=".rar") returned 4 [0069.162] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.162] lstrlenW (lpString=".bz2") returned 4 [0069.162] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.162] lstrlenW (lpString=".7z") returned 3 [0069.162] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.162] lstrlenW (lpString=".dbf") returned 4 [0069.162] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.162] lstrlenW (lpString=".1cd") returned 4 [0069.162] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.163] lstrlenW (lpString=".jpg") returned 4 [0069.163] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.163] lstrlenW (lpString=".doc") returned 4 [0069.163] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.163] lstrlenW (lpString=".docx") returned 5 [0069.163] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0069.163] lstrlenW (lpString=".pdf") returned 4 [0069.163] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.163] lstrlenW (lpString=".xls") returned 4 [0069.163] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.163] lstrlenW (lpString=".xlsx") returned 5 [0069.163] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0069.163] lstrlenW (lpString=".ppt") returned 4 [0069.163] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.163] lstrlenW (lpString=".zip") returned 4 [0069.163] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.163] lstrlenW (lpString=".rar") returned 4 [0069.163] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.163] lstrlenW (lpString=".bz2") returned 4 [0069.163] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.163] lstrlenW (lpString=".7z") returned 3 [0069.163] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.163] lstrlenW (lpString=".dbf") returned 4 [0069.163] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.163] lstrlenW (lpString=".1cd") returned 4 [0069.163] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0069.164] lstrlenW (lpString=".jpg") returned 4 [0069.164] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.164] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.164] lstrlenW (lpString="AN01039_.WMF") returned 12 [0069.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.164] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3344) returned 1 [0069.164] CloseHandle (hObject=0x200) returned 1 [0069.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0069.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.164] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.165] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.165] GetLastError () returned 0x0 [0069.165] ReadFile (in: hFile=0x200, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xd10, lpOverlapped=0x0) returned 1 [0069.166] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0069.167] ReadFile (in: hFile=0x200, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.167] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.167] SetEndOfFile (hFile=0x16c) returned 1 [0069.168] CloseHandle (hObject=0x16c) returned 1 [0069.168] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.168] SetEndOfFile (hFile=0x200) returned 1 [0069.169] CloseHandle (hObject=0x200) returned 1 [0069.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0069.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.169] lstrlenW (lpString=".doc") returned 4 [0069.169] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.169] lstrlenW (lpString=".docx") returned 5 [0069.169] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.169] lstrlenW (lpString=".pdf") returned 4 [0069.169] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.169] lstrlenW (lpString=".xls") returned 4 [0069.169] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.169] lstrlenW (lpString=".xlsx") returned 5 [0069.169] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.169] lstrlenW (lpString=".ppt") returned 4 [0069.169] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.169] lstrlenW (lpString=".zip") returned 4 [0069.169] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.169] lstrlenW (lpString=".rar") returned 4 [0069.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.170] lstrlenW (lpString=".bz2") returned 4 [0069.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.170] lstrlenW (lpString=".7z") returned 3 [0069.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.170] lstrlenW (lpString=".dbf") returned 4 [0069.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.170] lstrlenW (lpString=".1cd") returned 4 [0069.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.170] lstrlenW (lpString=".jpg") returned 4 [0069.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.170] lstrlenW (lpString=".doc") returned 4 [0069.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.170] lstrlenW (lpString=".docx") returned 5 [0069.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.170] lstrlenW (lpString=".pdf") returned 4 [0069.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.170] lstrlenW (lpString=".xls") returned 4 [0069.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.170] lstrlenW (lpString=".xlsx") returned 5 [0069.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.170] lstrlenW (lpString=".ppt") returned 4 [0069.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.170] lstrlenW (lpString=".zip") returned 4 [0069.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.170] lstrlenW (lpString=".rar") returned 4 [0069.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.171] lstrlenW (lpString=".bz2") returned 4 [0069.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.171] lstrlenW (lpString=".7z") returned 3 [0069.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.171] lstrlenW (lpString=".dbf") returned 4 [0069.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.171] lstrlenW (lpString=".1cd") returned 4 [0069.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0069.171] lstrlenW (lpString=".jpg") returned 4 [0069.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.171] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.171] lstrlenW (lpString="AN01044_.WMF") returned 12 [0069.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.171] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1596) returned 1 [0069.171] CloseHandle (hObject=0x200) returned 1 [0069.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0069.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.172] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.172] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.172] GetLastError () returned 0x0 [0069.172] ReadFile (in: hFile=0x200, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x63c, lpOverlapped=0x0) returned 1 [0069.174] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x640, lpOverlapped=0x0) returned 1 [0069.175] ReadFile (in: hFile=0x200, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.175] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.175] SetEndOfFile (hFile=0x16c) returned 1 [0069.175] CloseHandle (hObject=0x16c) returned 1 [0069.175] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.175] SetEndOfFile (hFile=0x200) returned 1 [0069.176] CloseHandle (hObject=0x200) returned 1 [0069.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0069.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.176] lstrlenW (lpString=".doc") returned 4 [0069.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.176] lstrlenW (lpString=".docx") returned 5 [0069.176] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.176] lstrlenW (lpString=".pdf") returned 4 [0069.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.176] lstrlenW (lpString=".xls") returned 4 [0069.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.177] lstrlenW (lpString=".xlsx") returned 5 [0069.177] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.177] lstrlenW (lpString=".ppt") returned 4 [0069.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.177] lstrlenW (lpString=".zip") returned 4 [0069.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.177] lstrlenW (lpString=".rar") returned 4 [0069.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.177] lstrlenW (lpString=".bz2") returned 4 [0069.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.177] lstrlenW (lpString=".7z") returned 3 [0069.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.177] lstrlenW (lpString=".dbf") returned 4 [0069.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.177] lstrlenW (lpString=".1cd") returned 4 [0069.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.177] lstrlenW (lpString=".jpg") returned 4 [0069.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.177] lstrlenW (lpString=".doc") returned 4 [0069.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.177] lstrlenW (lpString=".docx") returned 5 [0069.177] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.177] lstrlenW (lpString=".pdf") returned 4 [0069.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.177] lstrlenW (lpString=".xls") returned 4 [0069.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.177] lstrlenW (lpString=".xlsx") returned 5 [0069.178] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.178] lstrlenW (lpString=".ppt") returned 4 [0069.178] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.178] lstrlenW (lpString=".zip") returned 4 [0069.178] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.178] lstrlenW (lpString=".rar") returned 4 [0069.178] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.178] lstrlenW (lpString=".bz2") returned 4 [0069.178] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.178] lstrlenW (lpString=".7z") returned 3 [0069.178] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.178] lstrlenW (lpString=".dbf") returned 4 [0069.178] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.178] lstrlenW (lpString=".1cd") returned 4 [0069.178] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0069.178] lstrlenW (lpString=".jpg") returned 4 [0069.178] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.178] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.178] lstrlenW (lpString="AN01060_.WMF") returned 12 [0069.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.179] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=7968) returned 1 [0069.180] CloseHandle (hObject=0x200) returned 1 [0069.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0069.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.180] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.180] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.180] GetLastError () returned 0x0 [0069.180] ReadFile (in: hFile=0x200, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x1f20, lpOverlapped=0x0) returned 1 [0069.182] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0069.183] ReadFile (in: hFile=0x200, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.183] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.183] SetEndOfFile (hFile=0x16c) returned 1 [0069.183] CloseHandle (hObject=0x16c) returned 1 [0069.184] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.184] SetEndOfFile (hFile=0x200) returned 1 [0069.184] CloseHandle (hObject=0x200) returned 1 [0069.184] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.185] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0069.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.185] lstrlenW (lpString=".doc") returned 4 [0069.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.185] lstrlenW (lpString=".docx") returned 5 [0069.185] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.185] lstrlenW (lpString=".pdf") returned 4 [0069.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.185] lstrlenW (lpString=".xls") returned 4 [0069.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.185] lstrlenW (lpString=".xlsx") returned 5 [0069.185] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.185] lstrlenW (lpString=".ppt") returned 4 [0069.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.185] lstrlenW (lpString=".zip") returned 4 [0069.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.185] lstrlenW (lpString=".rar") returned 4 [0069.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.185] lstrlenW (lpString=".bz2") returned 4 [0069.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.185] lstrlenW (lpString=".7z") returned 3 [0069.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.185] lstrlenW (lpString=".dbf") returned 4 [0069.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.186] lstrlenW (lpString=".1cd") returned 4 [0069.186] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.186] lstrlenW (lpString=".jpg") returned 4 [0069.186] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.186] lstrlenW (lpString=".doc") returned 4 [0069.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.186] lstrlenW (lpString=".docx") returned 5 [0069.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.186] lstrlenW (lpString=".pdf") returned 4 [0069.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.186] lstrlenW (lpString=".xls") returned 4 [0069.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.186] lstrlenW (lpString=".xlsx") returned 5 [0069.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.186] lstrlenW (lpString=".ppt") returned 4 [0069.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.186] lstrlenW (lpString=".zip") returned 4 [0069.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.186] lstrlenW (lpString=".rar") returned 4 [0069.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.186] lstrlenW (lpString=".bz2") returned 4 [0069.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.186] lstrlenW (lpString=".7z") returned 3 [0069.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.186] lstrlenW (lpString=".dbf") returned 4 [0069.186] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.187] lstrlenW (lpString=".1cd") returned 4 [0069.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0069.187] lstrlenW (lpString=".jpg") returned 4 [0069.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.187] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.187] lstrlenW (lpString="AN01084_.WMF") returned 12 [0069.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.187] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=1832) returned 1 [0069.187] CloseHandle (hObject=0x200) returned 1 [0069.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0069.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.188] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.188] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.188] GetLastError () returned 0x0 [0069.188] ReadFile (in: hFile=0x200, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x728, lpOverlapped=0x0) returned 1 [0069.189] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x730, lpOverlapped=0x0) returned 1 [0069.190] ReadFile (in: hFile=0x200, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.190] WriteFile (in: hFile=0x16c, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.190] SetEndOfFile (hFile=0x16c) returned 1 [0069.191] CloseHandle (hObject=0x16c) returned 1 [0069.191] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.191] SetEndOfFile (hFile=0x200) returned 1 [0069.192] CloseHandle (hObject=0x200) returned 1 [0069.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0069.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.192] lstrlenW (lpString=".doc") returned 4 [0069.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.192] lstrlenW (lpString=".docx") returned 5 [0069.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.192] lstrlenW (lpString=".pdf") returned 4 [0069.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.192] lstrlenW (lpString=".xls") returned 4 [0069.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.192] lstrlenW (lpString=".xlsx") returned 5 [0069.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.192] lstrlenW (lpString=".ppt") returned 4 [0069.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.192] lstrlenW (lpString=".zip") returned 4 [0069.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.192] lstrlenW (lpString=".rar") returned 4 [0069.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.193] lstrlenW (lpString=".bz2") returned 4 [0069.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.193] lstrlenW (lpString=".7z") returned 3 [0069.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.193] lstrlenW (lpString=".dbf") returned 4 [0069.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.193] lstrlenW (lpString=".1cd") returned 4 [0069.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.193] lstrlenW (lpString=".jpg") returned 4 [0069.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.193] lstrlenW (lpString=".doc") returned 4 [0069.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.193] lstrlenW (lpString=".docx") returned 5 [0069.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.193] lstrlenW (lpString=".pdf") returned 4 [0069.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.193] lstrlenW (lpString=".xls") returned 4 [0069.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.193] lstrlenW (lpString=".xlsx") returned 5 [0069.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.193] lstrlenW (lpString=".ppt") returned 4 [0069.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.193] lstrlenW (lpString=".zip") returned 4 [0069.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.342] lstrlenW (lpString=".rar") returned 4 [0069.342] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.342] lstrlenW (lpString=".bz2") returned 4 [0069.342] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.342] lstrlenW (lpString=".7z") returned 3 [0069.342] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.342] lstrlenW (lpString=".dbf") returned 4 [0069.342] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.342] lstrlenW (lpString=".1cd") returned 4 [0069.342] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0069.342] lstrlenW (lpString=".jpg") returned 4 [0069.343] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.343] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.343] lstrlenW (lpString="AN01174_.WMF") returned 12 [0069.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.376] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=27858) returned 1 [0069.376] CloseHandle (hObject=0x1f4) returned 1 [0069.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0069.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.377] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.377] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0069.377] GetLastError () returned 0x0 [0069.377] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0069.379] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0069.380] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.380] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.381] SetEndOfFile (hFile=0x218) returned 1 [0069.381] CloseHandle (hObject=0x218) returned 1 [0069.381] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.381] SetEndOfFile (hFile=0x1f4) returned 1 [0069.382] CloseHandle (hObject=0x1f4) returned 1 [0069.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0069.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.383] lstrlenW (lpString=".doc") returned 4 [0069.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.383] lstrlenW (lpString=".docx") returned 5 [0069.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.383] lstrlenW (lpString=".pdf") returned 4 [0069.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.383] lstrlenW (lpString=".xls") returned 4 [0069.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.383] lstrlenW (lpString=".xlsx") returned 5 [0069.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.383] lstrlenW (lpString=".ppt") returned 4 [0069.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.383] lstrlenW (lpString=".zip") returned 4 [0069.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.383] lstrlenW (lpString=".rar") returned 4 [0069.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.383] lstrlenW (lpString=".bz2") returned 4 [0069.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.383] lstrlenW (lpString=".7z") returned 3 [0069.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.383] lstrlenW (lpString=".dbf") returned 4 [0069.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.383] lstrlenW (lpString=".1cd") returned 4 [0069.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.384] lstrlenW (lpString=".jpg") returned 4 [0069.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.384] lstrlenW (lpString=".doc") returned 4 [0069.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.384] lstrlenW (lpString=".docx") returned 5 [0069.384] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.384] lstrlenW (lpString=".pdf") returned 4 [0069.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.384] lstrlenW (lpString=".xls") returned 4 [0069.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.384] lstrlenW (lpString=".xlsx") returned 5 [0069.384] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.384] lstrlenW (lpString=".ppt") returned 4 [0069.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.384] lstrlenW (lpString=".zip") returned 4 [0069.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.384] lstrlenW (lpString=".rar") returned 4 [0069.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.384] lstrlenW (lpString=".bz2") returned 4 [0069.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.384] lstrlenW (lpString=".7z") returned 3 [0069.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.384] lstrlenW (lpString=".dbf") returned 4 [0069.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.384] lstrlenW (lpString=".1cd") returned 4 [0069.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0069.385] lstrlenW (lpString=".jpg") returned 4 [0069.385] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.385] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.385] lstrlenW (lpString="AN01184_.WMF") returned 12 [0069.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.385] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3746) returned 1 [0069.385] CloseHandle (hObject=0x1f4) returned 1 [0069.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0069.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.385] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.385] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0069.386] GetLastError () returned 0x0 [0069.386] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xea2, lpOverlapped=0x0) returned 1 [0069.387] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0069.388] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.388] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.389] SetEndOfFile (hFile=0x218) returned 1 [0069.389] CloseHandle (hObject=0x218) returned 1 [0069.389] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.389] SetEndOfFile (hFile=0x1f4) returned 1 [0069.390] CloseHandle (hObject=0x1f4) returned 1 [0069.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0069.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.390] lstrlenW (lpString=".doc") returned 4 [0069.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.390] lstrlenW (lpString=".docx") returned 5 [0069.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.390] lstrlenW (lpString=".pdf") returned 4 [0069.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.390] lstrlenW (lpString=".xls") returned 4 [0069.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.390] lstrlenW (lpString=".xlsx") returned 5 [0069.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.390] lstrlenW (lpString=".ppt") returned 4 [0069.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.391] lstrlenW (lpString=".zip") returned 4 [0069.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.391] lstrlenW (lpString=".rar") returned 4 [0069.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.391] lstrlenW (lpString=".bz2") returned 4 [0069.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.391] lstrlenW (lpString=".7z") returned 3 [0069.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.391] lstrlenW (lpString=".dbf") returned 4 [0069.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.391] lstrlenW (lpString=".1cd") returned 4 [0069.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.391] lstrlenW (lpString=".jpg") returned 4 [0069.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.391] lstrlenW (lpString=".doc") returned 4 [0069.391] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.391] lstrlenW (lpString=".docx") returned 5 [0069.391] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.391] lstrlenW (lpString=".pdf") returned 4 [0069.391] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.391] lstrlenW (lpString=".xls") returned 4 [0069.391] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.391] lstrlenW (lpString=".xlsx") returned 5 [0069.391] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.391] lstrlenW (lpString=".ppt") returned 4 [0069.391] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.392] lstrlenW (lpString=".zip") returned 4 [0069.392] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.392] lstrlenW (lpString=".rar") returned 4 [0069.392] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.392] lstrlenW (lpString=".bz2") returned 4 [0069.392] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.392] lstrlenW (lpString=".7z") returned 3 [0069.392] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.392] lstrlenW (lpString=".dbf") returned 4 [0069.392] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.392] lstrlenW (lpString=".1cd") returned 4 [0069.392] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0069.392] lstrlenW (lpString=".jpg") returned 4 [0069.392] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.392] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.392] lstrlenW (lpString="AN01216_.WMF") returned 12 [0069.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.392] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=5836) returned 1 [0069.393] CloseHandle (hObject=0x1f4) returned 1 [0069.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0069.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.393] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.393] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0069.393] GetLastError () returned 0x0 [0069.393] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0069.395] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0069.396] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.396] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.396] SetEndOfFile (hFile=0x218) returned 1 [0069.396] CloseHandle (hObject=0x218) returned 1 [0069.396] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.396] SetEndOfFile (hFile=0x1f4) returned 1 [0069.397] CloseHandle (hObject=0x1f4) returned 1 [0069.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0069.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.398] lstrlenW (lpString=".doc") returned 4 [0069.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.398] lstrlenW (lpString=".docx") returned 5 [0069.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.398] lstrlenW (lpString=".pdf") returned 4 [0069.398] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.398] lstrlenW (lpString=".xls") returned 4 [0069.398] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.398] lstrlenW (lpString=".xlsx") returned 5 [0069.398] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.398] lstrlenW (lpString=".ppt") returned 4 [0069.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.398] lstrlenW (lpString=".zip") returned 4 [0069.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.398] lstrlenW (lpString=".rar") returned 4 [0069.398] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.398] lstrlenW (lpString=".bz2") returned 4 [0069.398] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.398] lstrlenW (lpString=".7z") returned 3 [0069.398] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.398] lstrlenW (lpString=".dbf") returned 4 [0069.398] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.398] lstrlenW (lpString=".1cd") returned 4 [0069.398] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.399] lstrlenW (lpString=".jpg") returned 4 [0069.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.399] lstrlenW (lpString=".doc") returned 4 [0069.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.399] lstrlenW (lpString=".docx") returned 5 [0069.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.399] lstrlenW (lpString=".pdf") returned 4 [0069.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.399] lstrlenW (lpString=".xls") returned 4 [0069.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.399] lstrlenW (lpString=".xlsx") returned 5 [0069.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.399] lstrlenW (lpString=".ppt") returned 4 [0069.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.399] lstrlenW (lpString=".zip") returned 4 [0069.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.399] lstrlenW (lpString=".rar") returned 4 [0069.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.399] lstrlenW (lpString=".bz2") returned 4 [0069.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.399] lstrlenW (lpString=".7z") returned 3 [0069.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.399] lstrlenW (lpString=".dbf") returned 4 [0069.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.399] lstrlenW (lpString=".1cd") returned 4 [0069.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0069.400] lstrlenW (lpString=".jpg") returned 4 [0069.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.400] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.400] lstrlenW (lpString="AN01218_.WMF") returned 12 [0069.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.400] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=3012) returned 1 [0069.400] CloseHandle (hObject=0x1f4) returned 1 [0069.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0069.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.400] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.400] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0069.401] GetLastError () returned 0x0 [0069.401] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0069.402] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0069.403] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.403] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.403] SetEndOfFile (hFile=0x218) returned 1 [0069.403] CloseHandle (hObject=0x218) returned 1 [0069.404] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.404] SetEndOfFile (hFile=0x1f4) returned 1 [0069.404] CloseHandle (hObject=0x1f4) returned 1 [0069.404] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0069.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.405] lstrlenW (lpString=".doc") returned 4 [0069.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.405] lstrlenW (lpString=".docx") returned 5 [0069.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.405] lstrlenW (lpString=".pdf") returned 4 [0069.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.405] lstrlenW (lpString=".xls") returned 4 [0069.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.405] lstrlenW (lpString=".xlsx") returned 5 [0069.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.405] lstrlenW (lpString=".ppt") returned 4 [0069.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.405] lstrlenW (lpString=".zip") returned 4 [0069.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.405] lstrlenW (lpString=".rar") returned 4 [0069.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.405] lstrlenW (lpString=".bz2") returned 4 [0069.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.405] lstrlenW (lpString=".7z") returned 3 [0069.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.406] lstrlenW (lpString=".dbf") returned 4 [0069.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.406] lstrlenW (lpString=".1cd") returned 4 [0069.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.406] lstrlenW (lpString=".jpg") returned 4 [0069.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.406] lstrlenW (lpString=".doc") returned 4 [0069.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.406] lstrlenW (lpString=".docx") returned 5 [0069.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.406] lstrlenW (lpString=".pdf") returned 4 [0069.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.406] lstrlenW (lpString=".xls") returned 4 [0069.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.406] lstrlenW (lpString=".xlsx") returned 5 [0069.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.406] lstrlenW (lpString=".ppt") returned 4 [0069.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.406] lstrlenW (lpString=".zip") returned 4 [0069.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.406] lstrlenW (lpString=".rar") returned 4 [0069.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.406] lstrlenW (lpString=".bz2") returned 4 [0069.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.406] lstrlenW (lpString=".7z") returned 3 [0069.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.407] lstrlenW (lpString=".dbf") returned 4 [0069.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.407] lstrlenW (lpString=".1cd") returned 4 [0069.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0069.407] lstrlenW (lpString=".jpg") returned 4 [0069.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.407] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.407] lstrlenW (lpString="AN01251_.WMF") returned 12 [0069.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.407] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2756) returned 1 [0069.407] CloseHandle (hObject=0x1f4) returned 1 [0069.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0069.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.409] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.409] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0069.410] GetLastError () returned 0x0 [0069.410] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xac4, lpOverlapped=0x0) returned 1 [0069.733] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0069.740] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.740] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.740] SetEndOfFile (hFile=0x218) returned 1 [0069.741] CloseHandle (hObject=0x218) returned 1 [0069.741] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.741] SetEndOfFile (hFile=0x1f4) returned 1 [0069.742] CloseHandle (hObject=0x1f4) returned 1 [0069.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0069.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.742] lstrlenW (lpString=".doc") returned 4 [0069.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.742] lstrlenW (lpString=".docx") returned 5 [0069.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.742] lstrlenW (lpString=".pdf") returned 4 [0069.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.742] lstrlenW (lpString=".xls") returned 4 [0069.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.742] lstrlenW (lpString=".xlsx") returned 5 [0069.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.743] lstrlenW (lpString=".ppt") returned 4 [0069.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.743] lstrlenW (lpString=".zip") returned 4 [0069.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.743] lstrlenW (lpString=".rar") returned 4 [0069.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.743] lstrlenW (lpString=".bz2") returned 4 [0069.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.743] lstrlenW (lpString=".7z") returned 3 [0069.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.743] lstrlenW (lpString=".dbf") returned 4 [0069.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.743] lstrlenW (lpString=".1cd") returned 4 [0069.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.743] lstrlenW (lpString=".jpg") returned 4 [0069.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.743] lstrlenW (lpString=".doc") returned 4 [0069.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.743] lstrlenW (lpString=".docx") returned 5 [0069.743] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.743] lstrlenW (lpString=".pdf") returned 4 [0069.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.743] lstrlenW (lpString=".xls") returned 4 [0069.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.743] lstrlenW (lpString=".xlsx") returned 5 [0069.743] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.744] lstrlenW (lpString=".ppt") returned 4 [0069.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.744] lstrlenW (lpString=".zip") returned 4 [0069.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.744] lstrlenW (lpString=".rar") returned 4 [0069.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.744] lstrlenW (lpString=".bz2") returned 4 [0069.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.744] lstrlenW (lpString=".7z") returned 3 [0069.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.744] lstrlenW (lpString=".dbf") returned 4 [0069.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.744] lstrlenW (lpString=".1cd") returned 4 [0069.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0069.744] lstrlenW (lpString=".jpg") returned 4 [0069.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.744] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.744] lstrlenW (lpString="AN04235_.WMF") returned 12 [0069.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.745] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=7804) returned 1 [0069.745] CloseHandle (hObject=0x1f4) returned 1 [0069.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0069.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.745] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.745] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0069.746] GetLastError () returned 0x0 [0069.746] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0069.747] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0069.748] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.748] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.748] SetEndOfFile (hFile=0x218) returned 1 [0069.749] CloseHandle (hObject=0x218) returned 1 [0069.749] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.749] SetEndOfFile (hFile=0x1f4) returned 1 [0069.750] CloseHandle (hObject=0x1f4) returned 1 [0069.750] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.750] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0069.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.750] lstrlenW (lpString=".doc") returned 4 [0069.750] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.750] lstrlenW (lpString=".docx") returned 5 [0069.750] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.750] lstrlenW (lpString=".pdf") returned 4 [0069.750] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.750] lstrlenW (lpString=".xls") returned 4 [0069.750] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.750] lstrlenW (lpString=".xlsx") returned 5 [0069.750] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.750] lstrlenW (lpString=".ppt") returned 4 [0069.750] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.751] lstrlenW (lpString=".zip") returned 4 [0069.751] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.751] lstrlenW (lpString=".rar") returned 4 [0069.751] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.751] lstrlenW (lpString=".bz2") returned 4 [0069.751] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.751] lstrlenW (lpString=".7z") returned 3 [0069.751] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.751] lstrlenW (lpString=".dbf") returned 4 [0069.751] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.751] lstrlenW (lpString=".1cd") returned 4 [0069.751] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.751] lstrlenW (lpString=".jpg") returned 4 [0069.751] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.751] lstrlenW (lpString=".doc") returned 4 [0069.751] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.751] lstrlenW (lpString=".docx") returned 5 [0069.751] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.751] lstrlenW (lpString=".pdf") returned 4 [0069.751] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.751] lstrlenW (lpString=".xls") returned 4 [0069.751] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.751] lstrlenW (lpString=".xlsx") returned 5 [0069.751] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.751] lstrlenW (lpString=".ppt") returned 4 [0069.751] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.752] lstrlenW (lpString=".zip") returned 4 [0069.752] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.752] lstrlenW (lpString=".rar") returned 4 [0069.752] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.752] lstrlenW (lpString=".bz2") returned 4 [0069.752] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.752] lstrlenW (lpString=".7z") returned 3 [0069.752] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.752] lstrlenW (lpString=".dbf") returned 4 [0069.752] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.752] lstrlenW (lpString=".1cd") returned 4 [0069.752] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0069.752] lstrlenW (lpString=".jpg") returned 4 [0069.752] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.752] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.752] lstrlenW (lpString="AN04267_.WMF") returned 12 [0069.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.753] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=7804) returned 1 [0069.753] CloseHandle (hObject=0x1f4) returned 1 [0069.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0069.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.753] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.753] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0069.753] GetLastError () returned 0x0 [0069.753] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0069.757] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0069.758] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.759] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.759] SetEndOfFile (hFile=0x218) returned 1 [0069.759] CloseHandle (hObject=0x218) returned 1 [0069.759] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.759] SetEndOfFile (hFile=0x1f4) returned 1 [0069.760] CloseHandle (hObject=0x1f4) returned 1 [0069.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0069.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.760] lstrlenW (lpString=".doc") returned 4 [0069.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.760] lstrlenW (lpString=".docx") returned 5 [0069.760] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.760] lstrlenW (lpString=".pdf") returned 4 [0069.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.760] lstrlenW (lpString=".xls") returned 4 [0069.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.761] lstrlenW (lpString=".xlsx") returned 5 [0069.761] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.761] lstrlenW (lpString=".ppt") returned 4 [0069.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.761] lstrlenW (lpString=".zip") returned 4 [0069.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.761] lstrlenW (lpString=".rar") returned 4 [0069.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.761] lstrlenW (lpString=".bz2") returned 4 [0069.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.761] lstrlenW (lpString=".7z") returned 3 [0069.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.761] lstrlenW (lpString=".dbf") returned 4 [0069.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.761] lstrlenW (lpString=".1cd") returned 4 [0069.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.761] lstrlenW (lpString=".jpg") returned 4 [0069.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.761] lstrlenW (lpString=".doc") returned 4 [0069.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.761] lstrlenW (lpString=".docx") returned 5 [0069.761] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.761] lstrlenW (lpString=".pdf") returned 4 [0069.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.761] lstrlenW (lpString=".xls") returned 4 [0069.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.762] lstrlenW (lpString=".xlsx") returned 5 [0069.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.762] lstrlenW (lpString=".ppt") returned 4 [0069.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.762] lstrlenW (lpString=".zip") returned 4 [0069.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.762] lstrlenW (lpString=".rar") returned 4 [0069.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.762] lstrlenW (lpString=".bz2") returned 4 [0069.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.762] lstrlenW (lpString=".7z") returned 3 [0069.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.762] lstrlenW (lpString=".dbf") returned 4 [0069.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.762] lstrlenW (lpString=".1cd") returned 4 [0069.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0069.762] lstrlenW (lpString=".jpg") returned 4 [0069.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.762] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.762] lstrlenW (lpString="AN04269_.WMF") returned 12 [0069.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.763] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2016) returned 1 [0069.763] CloseHandle (hObject=0x1f4) returned 1 [0069.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0069.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.763] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.763] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0069.763] GetLastError () returned 0x0 [0069.763] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0069.765] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0069.766] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.766] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.766] SetEndOfFile (hFile=0x218) returned 1 [0069.766] CloseHandle (hObject=0x218) returned 1 [0069.767] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.767] SetEndOfFile (hFile=0x1f4) returned 1 [0069.767] CloseHandle (hObject=0x1f4) returned 1 [0069.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0069.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.768] lstrlenW (lpString=".doc") returned 4 [0069.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.768] lstrlenW (lpString=".docx") returned 5 [0069.768] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.768] lstrlenW (lpString=".pdf") returned 4 [0069.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.768] lstrlenW (lpString=".xls") returned 4 [0069.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.768] lstrlenW (lpString=".xlsx") returned 5 [0069.768] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.768] lstrlenW (lpString=".ppt") returned 4 [0069.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.768] lstrlenW (lpString=".zip") returned 4 [0069.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.768] lstrlenW (lpString=".rar") returned 4 [0069.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.768] lstrlenW (lpString=".bz2") returned 4 [0069.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.768] lstrlenW (lpString=".7z") returned 3 [0069.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.769] lstrlenW (lpString=".dbf") returned 4 [0069.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.769] lstrlenW (lpString=".1cd") returned 4 [0069.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.769] lstrlenW (lpString=".jpg") returned 4 [0069.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.769] lstrlenW (lpString=".doc") returned 4 [0069.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.769] lstrlenW (lpString=".docx") returned 5 [0069.769] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.769] lstrlenW (lpString=".pdf") returned 4 [0069.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.769] lstrlenW (lpString=".xls") returned 4 [0069.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.769] lstrlenW (lpString=".xlsx") returned 5 [0069.769] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.769] lstrlenW (lpString=".ppt") returned 4 [0069.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.769] lstrlenW (lpString=".zip") returned 4 [0069.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.769] lstrlenW (lpString=".rar") returned 4 [0069.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.769] lstrlenW (lpString=".bz2") returned 4 [0069.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.769] lstrlenW (lpString=".7z") returned 3 [0069.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.770] lstrlenW (lpString=".dbf") returned 4 [0069.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.770] lstrlenW (lpString=".1cd") returned 4 [0069.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0069.770] lstrlenW (lpString=".jpg") returned 4 [0069.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.770] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.770] lstrlenW (lpString="AN04323_.WMF") returned 12 [0069.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.771] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=2492) returned 1 [0069.771] CloseHandle (hObject=0x1f4) returned 1 [0069.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0069.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0069.771] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.771] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0069.772] GetLastError () returned 0x0 [0069.772] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0070.066] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0070.066] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.067] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.067] SetEndOfFile (hFile=0x218) returned 1 [0070.067] CloseHandle (hObject=0x218) returned 1 [0070.067] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.067] SetEndOfFile (hFile=0x1f4) returned 1 [0070.068] CloseHandle (hObject=0x1f4) returned 1 [0070.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0070.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0071.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.203] lstrlenW (lpString=".doc") returned 4 [0071.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.203] lstrlenW (lpString=".docx") returned 5 [0071.203] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.203] lstrlenW (lpString=".pdf") returned 4 [0071.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.203] lstrlenW (lpString=".xls") returned 4 [0071.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.203] lstrlenW (lpString=".xlsx") returned 5 [0071.203] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.203] lstrlenW (lpString=".ppt") returned 4 [0071.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.203] lstrlenW (lpString=".zip") returned 4 [0071.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.203] lstrlenW (lpString=".rar") returned 4 [0071.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.203] lstrlenW (lpString=".bz2") returned 4 [0071.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.203] lstrlenW (lpString=".7z") returned 3 [0071.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.203] lstrlenW (lpString=".dbf") returned 4 [0071.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.203] lstrlenW (lpString=".1cd") returned 4 [0071.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.203] lstrlenW (lpString=".jpg") returned 4 [0071.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.204] lstrlenW (lpString=".doc") returned 4 [0071.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.204] lstrlenW (lpString=".docx") returned 5 [0071.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.204] lstrlenW (lpString=".pdf") returned 4 [0071.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.204] lstrlenW (lpString=".xls") returned 4 [0071.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.204] lstrlenW (lpString=".xlsx") returned 5 [0071.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.204] lstrlenW (lpString=".ppt") returned 4 [0071.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.204] lstrlenW (lpString=".zip") returned 4 [0071.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.204] lstrlenW (lpString=".rar") returned 4 [0071.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.204] lstrlenW (lpString=".bz2") returned 4 [0071.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.204] lstrlenW (lpString=".7z") returned 3 [0071.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.204] lstrlenW (lpString=".dbf") returned 4 [0071.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.204] lstrlenW (lpString=".1cd") returned 4 [0071.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0071.204] lstrlenW (lpString=".jpg") returned 4 [0071.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.205] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0071.205] lstrlenW (lpString="BD00173_.WMF") returned 12 [0071.205] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.571] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=16180) returned 1 [0071.571] CloseHandle (hObject=0x1f4) returned 1 [0071.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0071.571] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0071.590] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.591] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0071.591] GetLastError () returned 0x0 [0071.591] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x3f34, lpOverlapped=0x0) returned 1 [0071.620] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0071.621] ReadFile (in: hFile=0x1f4, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.622] WriteFile (in: hFile=0x218, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.622] SetEndOfFile (hFile=0x218) returned 1 [0071.622] CloseHandle (hObject=0x218) returned 1 [0071.622] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.622] SetEndOfFile (hFile=0x1f4) returned 1 [0071.623] CloseHandle (hObject=0x1f4) returned 1 [0071.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0071.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.825] lstrlenW (lpString=".doc") returned 4 [0071.825] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.825] lstrlenW (lpString=".docx") returned 5 [0071.825] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.825] lstrlenW (lpString=".pdf") returned 4 [0071.825] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.825] lstrlenW (lpString=".xls") returned 4 [0071.825] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.825] lstrlenW (lpString=".xlsx") returned 5 [0071.825] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.825] lstrlenW (lpString=".ppt") returned 4 [0071.825] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.826] lstrlenW (lpString=".zip") returned 4 [0071.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.826] lstrlenW (lpString=".rar") returned 4 [0071.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.826] lstrlenW (lpString=".bz2") returned 4 [0071.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.826] lstrlenW (lpString=".7z") returned 3 [0071.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.826] lstrlenW (lpString=".dbf") returned 4 [0071.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.826] lstrlenW (lpString=".1cd") returned 4 [0071.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.826] lstrlenW (lpString=".jpg") returned 4 [0071.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.826] lstrlenW (lpString=".doc") returned 4 [0071.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.826] lstrlenW (lpString=".docx") returned 5 [0071.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.826] lstrlenW (lpString=".pdf") returned 4 [0071.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.826] lstrlenW (lpString=".xls") returned 4 [0071.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.827] lstrlenW (lpString=".xlsx") returned 5 [0071.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.827] lstrlenW (lpString=".ppt") returned 4 [0071.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.827] lstrlenW (lpString=".zip") returned 4 [0071.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.827] lstrlenW (lpString=".rar") returned 4 [0071.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.827] lstrlenW (lpString=".bz2") returned 4 [0071.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.827] lstrlenW (lpString=".7z") returned 3 [0071.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.827] lstrlenW (lpString=".dbf") returned 4 [0071.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.827] lstrlenW (lpString=".1cd") returned 4 [0071.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0071.827] lstrlenW (lpString=".jpg") returned 4 [0071.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.827] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0071.828] lstrlenW (lpString="BD08773_.WMF") returned 12 [0071.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.287] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=24778) returned 1 [0072.287] CloseHandle (hObject=0x180) returned 1 [0072.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0072.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.287] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.287] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0072.287] GetLastError () returned 0x0 [0072.288] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x60ca, lpOverlapped=0x0) returned 1 [0072.435] WriteFile (in: hFile=0x1f0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0072.437] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.437] WriteFile (in: hFile=0x1f0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.437] SetEndOfFile (hFile=0x1f0) returned 1 [0072.437] CloseHandle (hObject=0x1f0) returned 1 [0072.437] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.437] SetEndOfFile (hFile=0x180) returned 1 [0072.438] CloseHandle (hObject=0x180) returned 1 [0072.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0072.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.439] lstrlenW (lpString=".doc") returned 4 [0072.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.439] lstrlenW (lpString=".docx") returned 5 [0072.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.439] lstrlenW (lpString=".pdf") returned 4 [0072.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.439] lstrlenW (lpString=".xls") returned 4 [0072.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.439] lstrlenW (lpString=".xlsx") returned 5 [0072.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.439] lstrlenW (lpString=".ppt") returned 4 [0072.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.439] lstrlenW (lpString=".zip") returned 4 [0072.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.439] lstrlenW (lpString=".rar") returned 4 [0072.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.440] lstrlenW (lpString=".bz2") returned 4 [0072.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.440] lstrlenW (lpString=".7z") returned 3 [0072.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.440] lstrlenW (lpString=".dbf") returned 4 [0072.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.440] lstrlenW (lpString=".1cd") returned 4 [0072.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.440] lstrlenW (lpString=".jpg") returned 4 [0072.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.440] lstrlenW (lpString=".doc") returned 4 [0072.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.440] lstrlenW (lpString=".docx") returned 5 [0072.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.440] lstrlenW (lpString=".pdf") returned 4 [0072.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.440] lstrlenW (lpString=".xls") returned 4 [0072.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.440] lstrlenW (lpString=".xlsx") returned 5 [0072.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.440] lstrlenW (lpString=".ppt") returned 4 [0072.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.440] lstrlenW (lpString=".zip") returned 4 [0072.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.440] lstrlenW (lpString=".rar") returned 4 [0072.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.441] lstrlenW (lpString=".bz2") returned 4 [0072.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.441] lstrlenW (lpString=".7z") returned 3 [0072.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.441] lstrlenW (lpString=".dbf") returned 4 [0072.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.441] lstrlenW (lpString=".1cd") returned 4 [0072.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0072.441] lstrlenW (lpString=".jpg") returned 4 [0072.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.441] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0072.441] lstrlenW (lpString="BD09031_.WMF") returned 12 [0072.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.442] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=47786) returned 1 [0072.442] CloseHandle (hObject=0x180) returned 1 [0072.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0072.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0072.442] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.442] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0072.442] GetLastError () returned 0x0 [0072.442] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0072.454] WriteFile (in: hFile=0x1f0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0072.455] ReadFile (in: hFile=0x180, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.455] WriteFile (in: hFile=0x1f0, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.455] SetEndOfFile (hFile=0x1f0) returned 1 [0072.621] CloseHandle (hObject=0x1f0) returned 1 [0072.621] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.621] SetEndOfFile (hFile=0x180) returned 1 [0072.622] CloseHandle (hObject=0x180) returned 1 [0072.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0073.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.182] lstrlenW (lpString=".doc") returned 4 [0073.182] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.182] lstrlenW (lpString=".docx") returned 5 [0073.182] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.182] lstrlenW (lpString=".pdf") returned 4 [0073.182] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.182] lstrlenW (lpString=".xls") returned 4 [0073.182] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.182] lstrlenW (lpString=".xlsx") returned 5 [0073.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.182] lstrlenW (lpString=".ppt") returned 4 [0073.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.182] lstrlenW (lpString=".zip") returned 4 [0073.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.182] lstrlenW (lpString=".rar") returned 4 [0073.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.183] lstrlenW (lpString=".bz2") returned 4 [0073.183] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.183] lstrlenW (lpString=".7z") returned 3 [0073.183] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.183] lstrlenW (lpString=".dbf") returned 4 [0073.183] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.183] lstrlenW (lpString=".1cd") returned 4 [0073.183] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.183] lstrlenW (lpString=".jpg") returned 4 [0073.183] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.183] lstrlenW (lpString=".doc") returned 4 [0073.183] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.183] lstrlenW (lpString=".docx") returned 5 [0073.183] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.183] lstrlenW (lpString=".pdf") returned 4 [0073.183] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.183] lstrlenW (lpString=".xls") returned 4 [0073.183] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.183] lstrlenW (lpString=".xlsx") returned 5 [0073.183] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.183] lstrlenW (lpString=".ppt") returned 4 [0073.183] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.183] lstrlenW (lpString=".zip") returned 4 [0073.183] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.183] lstrlenW (lpString=".rar") returned 4 [0073.183] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.184] lstrlenW (lpString=".bz2") returned 4 [0073.184] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.184] lstrlenW (lpString=".7z") returned 3 [0073.184] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.184] lstrlenW (lpString=".dbf") returned 4 [0073.184] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.184] lstrlenW (lpString=".1cd") returned 4 [0073.184] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0073.184] lstrlenW (lpString=".jpg") returned 4 [0073.184] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.184] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0073.184] lstrlenW (lpString="BD19582_.GIF") returned 12 [0073.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.195] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=15733) returned 1 [0073.195] CloseHandle (hObject=0x20c) returned 1 [0073.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0073.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.195] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.195] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0073.196] GetLastError () returned 0x0 [0073.196] ReadFile (in: hFile=0x20c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x3d75, lpOverlapped=0x0) returned 1 [0073.595] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0073.639] ReadFile (in: hFile=0x20c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.639] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.639] SetEndOfFile (hFile=0x180) returned 1 [0073.639] CloseHandle (hObject=0x180) returned 1 [0073.639] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.640] SetEndOfFile (hFile=0x20c) returned 1 [0073.641] CloseHandle (hObject=0x20c) returned 1 [0073.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.641] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0073.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.641] lstrlenW (lpString=".doc") returned 4 [0073.641] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.641] lstrlenW (lpString=".docx") returned 5 [0073.641] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.641] lstrlenW (lpString=".pdf") returned 4 [0073.641] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.641] lstrlenW (lpString=".xls") returned 4 [0073.641] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.641] lstrlenW (lpString=".xlsx") returned 5 [0073.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.642] lstrlenW (lpString=".ppt") returned 4 [0073.642] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.642] lstrlenW (lpString=".zip") returned 4 [0073.642] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.642] lstrlenW (lpString=".rar") returned 4 [0073.642] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.642] lstrlenW (lpString=".bz2") returned 4 [0073.642] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.642] lstrlenW (lpString=".7z") returned 3 [0073.642] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.642] lstrlenW (lpString=".dbf") returned 4 [0073.642] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.642] lstrlenW (lpString=".1cd") returned 4 [0073.642] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.642] lstrlenW (lpString=".jpg") returned 4 [0073.642] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.642] lstrlenW (lpString=".doc") returned 4 [0073.642] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.642] lstrlenW (lpString=".docx") returned 5 [0073.642] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.642] lstrlenW (lpString=".pdf") returned 4 [0073.642] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.642] lstrlenW (lpString=".xls") returned 4 [0073.642] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.642] lstrlenW (lpString=".xlsx") returned 5 [0073.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.643] lstrlenW (lpString=".ppt") returned 4 [0073.643] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.643] lstrlenW (lpString=".zip") returned 4 [0073.643] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.643] lstrlenW (lpString=".rar") returned 4 [0073.643] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.643] lstrlenW (lpString=".bz2") returned 4 [0073.643] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.643] lstrlenW (lpString=".7z") returned 3 [0073.643] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.643] lstrlenW (lpString=".dbf") returned 4 [0073.643] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.643] lstrlenW (lpString=".1cd") returned 4 [0073.643] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0073.643] lstrlenW (lpString=".jpg") returned 4 [0073.643] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.643] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0073.643] lstrlenW (lpString="BD19986_.WMF") returned 12 [0073.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.644] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=14486) returned 1 [0073.644] CloseHandle (hObject=0x20c) returned 1 [0073.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0073.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.644] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.644] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0073.645] GetLastError () returned 0x0 [0073.645] ReadFile (in: hFile=0x20c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x3896, lpOverlapped=0x0) returned 1 [0073.655] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0073.656] ReadFile (in: hFile=0x20c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.656] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.656] SetEndOfFile (hFile=0x180) returned 1 [0073.656] CloseHandle (hObject=0x180) returned 1 [0073.656] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.656] SetEndOfFile (hFile=0x20c) returned 1 [0073.657] CloseHandle (hObject=0x20c) returned 1 [0073.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0073.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.658] lstrlenW (lpString=".doc") returned 4 [0073.658] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString=".docx") returned 5 [0073.658] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.658] lstrlenW (lpString=".pdf") returned 4 [0073.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString=".xls") returned 4 [0073.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.658] lstrlenW (lpString=".xlsx") returned 5 [0073.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.658] lstrlenW (lpString=".ppt") returned 4 [0073.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.658] lstrlenW (lpString=".zip") returned 4 [0073.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.658] lstrlenW (lpString=".rar") returned 4 [0073.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString=".bz2") returned 4 [0073.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.658] lstrlenW (lpString=".7z") returned 3 [0073.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.658] lstrlenW (lpString=".dbf") returned 4 [0073.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.659] lstrlenW (lpString=".1cd") returned 4 [0073.659] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.659] lstrlenW (lpString=".jpg") returned 4 [0073.659] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.659] lstrlenW (lpString=".doc") returned 4 [0073.659] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.659] lstrlenW (lpString=".docx") returned 5 [0073.659] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.659] lstrlenW (lpString=".pdf") returned 4 [0073.659] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.659] lstrlenW (lpString=".xls") returned 4 [0073.659] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.659] lstrlenW (lpString=".xlsx") returned 5 [0073.659] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.659] lstrlenW (lpString=".ppt") returned 4 [0073.659] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.659] lstrlenW (lpString=".zip") returned 4 [0073.659] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.659] lstrlenW (lpString=".rar") returned 4 [0073.659] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.659] lstrlenW (lpString=".bz2") returned 4 [0073.659] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.659] lstrlenW (lpString=".7z") returned 3 [0073.659] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.659] lstrlenW (lpString=".dbf") returned 4 [0073.659] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.660] lstrlenW (lpString=".1cd") returned 4 [0073.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0073.660] lstrlenW (lpString=".jpg") returned 4 [0073.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.660] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0073.660] lstrlenW (lpString="BD20013_.WMF") returned 12 [0073.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.660] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=11058) returned 1 [0073.660] CloseHandle (hObject=0x20c) returned 1 [0073.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0073.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.661] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.661] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0073.661] GetLastError () returned 0x0 [0073.661] ReadFile (in: hFile=0x20c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x2b32, lpOverlapped=0x0) returned 1 [0073.674] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0073.675] ReadFile (in: hFile=0x20c, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.675] WriteFile (in: hFile=0x180, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.675] SetEndOfFile (hFile=0x180) returned 1 [0073.675] CloseHandle (hObject=0x180) returned 1 [0073.675] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.676] SetEndOfFile (hFile=0x20c) returned 1 [0073.676] CloseHandle (hObject=0x20c) returned 1 [0073.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0073.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.677] lstrlenW (lpString=".doc") returned 4 [0073.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.677] lstrlenW (lpString=".docx") returned 5 [0073.677] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.677] lstrlenW (lpString=".pdf") returned 4 [0073.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.677] lstrlenW (lpString=".xls") returned 4 [0073.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.677] lstrlenW (lpString=".xlsx") returned 5 [0073.677] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.677] lstrlenW (lpString=".ppt") returned 4 [0073.677] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.677] lstrlenW (lpString=".zip") returned 4 [0073.677] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.677] lstrlenW (lpString=".rar") returned 4 [0073.677] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.677] lstrlenW (lpString=".bz2") returned 4 [0073.677] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.677] lstrlenW (lpString=".7z") returned 3 [0073.677] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.677] lstrlenW (lpString=".dbf") returned 4 [0073.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.678] lstrlenW (lpString=".1cd") returned 4 [0073.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.678] lstrlenW (lpString=".jpg") returned 4 [0073.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.678] lstrlenW (lpString=".doc") returned 4 [0073.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString=".docx") returned 5 [0073.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.678] lstrlenW (lpString=".pdf") returned 4 [0073.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString=".xls") returned 4 [0073.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.678] lstrlenW (lpString=".xlsx") returned 5 [0073.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.678] lstrlenW (lpString=".ppt") returned 4 [0073.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.678] lstrlenW (lpString=".zip") returned 4 [0073.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.678] lstrlenW (lpString=".rar") returned 4 [0073.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString=".bz2") returned 4 [0073.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.678] lstrlenW (lpString=".7z") returned 3 [0073.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.678] lstrlenW (lpString=".dbf") returned 4 [0073.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.679] lstrlenW (lpString=".1cd") returned 4 [0073.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0073.679] lstrlenW (lpString=".jpg") returned 4 [0073.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.679] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0073.679] lstrlenW (lpString="BL00012_.WMF") returned 12 [0073.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0075.846] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=9818) returned 1 [0075.861] CloseHandle (hObject=0x244) returned 1 [0075.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0075.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0075.869] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.870] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0075.871] GetLastError () returned 0x0 [0075.871] ReadFile (in: hFile=0x244, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x265a, lpOverlapped=0x0) returned 1 [0075.872] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0076.212] ReadFile (in: hFile=0x244, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.215] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.215] SetEndOfFile (hFile=0x184) returned 1 [0076.215] CloseHandle (hObject=0x184) returned 1 [0076.215] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.215] SetEndOfFile (hFile=0x244) returned 1 [0076.216] CloseHandle (hObject=0x244) returned 1 [0076.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0076.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.217] lstrlenW (lpString=".doc") returned 4 [0076.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.217] lstrlenW (lpString=".docx") returned 5 [0076.217] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.217] lstrlenW (lpString=".pdf") returned 4 [0076.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.217] lstrlenW (lpString=".xls") returned 4 [0076.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.217] lstrlenW (lpString=".xlsx") returned 5 [0076.217] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.217] lstrlenW (lpString=".ppt") returned 4 [0076.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.217] lstrlenW (lpString=".zip") returned 4 [0076.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.217] lstrlenW (lpString=".rar") returned 4 [0076.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.217] lstrlenW (lpString=".bz2") returned 4 [0076.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.217] lstrlenW (lpString=".7z") returned 3 [0076.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.217] lstrlenW (lpString=".dbf") returned 4 [0076.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.217] lstrlenW (lpString=".1cd") returned 4 [0076.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.217] lstrlenW (lpString=".jpg") returned 4 [0076.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.217] lstrlenW (lpString=".doc") returned 4 [0076.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.218] lstrlenW (lpString=".docx") returned 5 [0076.218] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.218] lstrlenW (lpString=".pdf") returned 4 [0076.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.218] lstrlenW (lpString=".xls") returned 4 [0076.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.218] lstrlenW (lpString=".xlsx") returned 5 [0076.218] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.218] lstrlenW (lpString=".ppt") returned 4 [0076.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.218] lstrlenW (lpString=".zip") returned 4 [0076.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.218] lstrlenW (lpString=".rar") returned 4 [0076.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.218] lstrlenW (lpString=".bz2") returned 4 [0076.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.218] lstrlenW (lpString=".7z") returned 3 [0076.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.218] lstrlenW (lpString=".dbf") returned 4 [0076.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.218] lstrlenW (lpString=".1cd") returned 4 [0076.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0076.218] lstrlenW (lpString=".jpg") returned 4 [0076.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.219] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.219] lstrlenW (lpString="BL00296_.WMF") returned 12 [0076.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0076.219] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=812) returned 1 [0076.219] CloseHandle (hObject=0x244) returned 1 [0076.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0076.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0076.219] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.219] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0076.220] GetLastError () returned 0x0 [0076.220] ReadFile (in: hFile=0x244, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x32c, lpOverlapped=0x0) returned 1 [0076.221] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x330, lpOverlapped=0x0) returned 1 [0076.222] ReadFile (in: hFile=0x244, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.223] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.223] SetEndOfFile (hFile=0x184) returned 1 [0076.223] CloseHandle (hObject=0x184) returned 1 [0076.223] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.223] SetEndOfFile (hFile=0x244) returned 1 [0076.224] CloseHandle (hObject=0x244) returned 1 [0076.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0076.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.224] lstrlenW (lpString=".doc") returned 4 [0076.224] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.224] lstrlenW (lpString=".docx") returned 5 [0076.224] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.224] lstrlenW (lpString=".pdf") returned 4 [0076.224] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.224] lstrlenW (lpString=".xls") returned 4 [0076.224] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.224] lstrlenW (lpString=".xlsx") returned 5 [0076.224] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.224] lstrlenW (lpString=".ppt") returned 4 [0076.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.225] lstrlenW (lpString=".zip") returned 4 [0076.225] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.225] lstrlenW (lpString=".rar") returned 4 [0076.225] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString=".bz2") returned 4 [0076.225] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString=".7z") returned 3 [0076.225] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.225] lstrlenW (lpString=".dbf") returned 4 [0076.225] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.225] lstrlenW (lpString=".1cd") returned 4 [0076.225] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.225] lstrlenW (lpString=".jpg") returned 4 [0076.225] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.225] lstrlenW (lpString=".doc") returned 4 [0076.225] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString=".docx") returned 5 [0076.225] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.225] lstrlenW (lpString=".pdf") returned 4 [0076.225] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.225] lstrlenW (lpString=".xls") returned 4 [0076.225] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.225] lstrlenW (lpString=".xlsx") returned 5 [0076.225] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.225] lstrlenW (lpString=".ppt") returned 4 [0076.225] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.226] lstrlenW (lpString=".zip") returned 4 [0076.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.226] lstrlenW (lpString=".rar") returned 4 [0076.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.226] lstrlenW (lpString=".bz2") returned 4 [0076.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.226] lstrlenW (lpString=".7z") returned 3 [0076.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.226] lstrlenW (lpString=".dbf") returned 4 [0076.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.226] lstrlenW (lpString=".1cd") returned 4 [0076.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0076.226] lstrlenW (lpString=".jpg") returned 4 [0076.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.226] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.226] lstrlenW (lpString="BL00390_.WMF") returned 12 [0076.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0076.227] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=13102) returned 1 [0076.227] CloseHandle (hObject=0x244) returned 1 [0076.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0076.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0076.228] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.228] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0076.228] GetLastError () returned 0x0 [0076.228] ReadFile (in: hFile=0x244, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x332e, lpOverlapped=0x0) returned 1 [0076.230] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0076.231] ReadFile (in: hFile=0x244, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.231] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.231] SetEndOfFile (hFile=0x184) returned 1 [0076.231] CloseHandle (hObject=0x184) returned 1 [0076.231] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.231] SetEndOfFile (hFile=0x244) returned 1 [0076.232] CloseHandle (hObject=0x244) returned 1 [0076.232] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.232] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0076.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.233] lstrlenW (lpString=".doc") returned 4 [0076.233] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.233] lstrlenW (lpString=".docx") returned 5 [0076.233] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.233] lstrlenW (lpString=".pdf") returned 4 [0076.233] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.233] lstrlenW (lpString=".xls") returned 4 [0076.233] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.233] lstrlenW (lpString=".xlsx") returned 5 [0076.233] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.233] lstrlenW (lpString=".ppt") returned 4 [0076.233] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.233] lstrlenW (lpString=".zip") returned 4 [0076.233] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.233] lstrlenW (lpString=".rar") returned 4 [0076.233] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.233] lstrlenW (lpString=".bz2") returned 4 [0076.233] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.233] lstrlenW (lpString=".7z") returned 3 [0076.233] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.233] lstrlenW (lpString=".dbf") returned 4 [0076.233] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.233] lstrlenW (lpString=".1cd") returned 4 [0076.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.234] lstrlenW (lpString=".jpg") returned 4 [0076.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.234] lstrlenW (lpString=".doc") returned 4 [0076.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.234] lstrlenW (lpString=".docx") returned 5 [0076.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.234] lstrlenW (lpString=".pdf") returned 4 [0076.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.234] lstrlenW (lpString=".xls") returned 4 [0076.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.234] lstrlenW (lpString=".xlsx") returned 5 [0076.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.234] lstrlenW (lpString=".ppt") returned 4 [0076.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.234] lstrlenW (lpString=".zip") returned 4 [0076.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.234] lstrlenW (lpString=".rar") returned 4 [0076.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.234] lstrlenW (lpString=".bz2") returned 4 [0076.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.234] lstrlenW (lpString=".7z") returned 3 [0076.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.234] lstrlenW (lpString=".dbf") returned 4 [0076.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.235] lstrlenW (lpString=".1cd") returned 4 [0076.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0076.235] lstrlenW (lpString=".jpg") returned 4 [0076.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.235] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.235] lstrlenW (lpString="BL00392_.WMF") returned 12 [0076.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0076.235] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=27050) returned 1 [0076.235] CloseHandle (hObject=0x244) returned 1 [0076.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0076.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0076.236] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.236] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0076.236] GetLastError () returned 0x0 [0076.236] ReadFile (in: hFile=0x244, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x69aa, lpOverlapped=0x0) returned 1 [0076.238] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0076.239] ReadFile (in: hFile=0x244, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesRead=0x229fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.239] WriteFile (in: hFile=0x184, lpBuffer=0x3420020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x229fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3420020*, lpNumberOfBytesWritten=0x229fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.239] SetEndOfFile (hFile=0x184) returned 1 [0076.240] CloseHandle (hObject=0x184) returned 1 [0076.240] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.240] SetEndOfFile (hFile=0x244) returned 1 [0076.241] CloseHandle (hObject=0x244) returned 1 [0076.241] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0076.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.241] lstrlenW (lpString=".doc") returned 4 [0076.241] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.241] lstrlenW (lpString=".docx") returned 5 [0076.241] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.241] lstrlenW (lpString=".pdf") returned 4 [0076.241] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.241] lstrlenW (lpString=".xls") returned 4 [0076.241] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.241] lstrlenW (lpString=".xlsx") returned 5 [0076.241] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.241] lstrlenW (lpString=".ppt") returned 4 [0076.242] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.242] lstrlenW (lpString=".zip") returned 4 [0076.242] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.242] lstrlenW (lpString=".rar") returned 4 [0076.242] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.242] lstrlenW (lpString=".bz2") returned 4 [0076.242] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.242] lstrlenW (lpString=".7z") returned 3 [0076.242] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.242] lstrlenW (lpString=".dbf") returned 4 [0076.242] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.242] lstrlenW (lpString=".1cd") returned 4 [0076.242] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.242] lstrlenW (lpString=".jpg") returned 4 [0076.242] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.242] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.242] lstrlenW (lpString=".doc") returned 4 [0076.242] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.242] lstrlenW (lpString=".docx") returned 5 [0076.242] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.242] lstrlenW (lpString=".pdf") returned 4 [0076.242] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.242] lstrlenW (lpString=".xls") returned 4 [0076.242] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.242] lstrlenW (lpString=".xlsx") returned 5 [0076.242] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.243] lstrlenW (lpString=".ppt") returned 4 [0076.243] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.243] lstrlenW (lpString=".zip") returned 4 [0076.243] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.243] lstrlenW (lpString=".rar") returned 4 [0076.243] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.243] lstrlenW (lpString=".bz2") returned 4 [0076.243] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.243] lstrlenW (lpString=".7z") returned 3 [0076.243] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.243] lstrlenW (lpString=".dbf") returned 4 [0076.243] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.243] lstrlenW (lpString=".1cd") returned 4 [0076.243] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0076.243] lstrlenW (lpString=".jpg") returned 4 [0076.243] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.243] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.243] lstrlenW (lpString="BL00524_.WMF") returned 12 [0076.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0076.244] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x229ff1c | out: lpFileSize=0x229ff1c*=6996) returned 1 [0076.244] CloseHandle (hObject=0x244) returned 1 [0076.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0076.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0076.244] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.244] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x229fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0076.244] GetLastError () returned 0x0 [0076.244] ReadFile (hFile=0x244, lpBuffer=0x3420020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x229fed4, lpOverlapped=0x0) Thread: id = 15 os_tid = 0xa98 [0047.016] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x9704e0 [0047.016] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x9804e8 [0047.016] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920360 [0047.016] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x6) returned 0x90a3d0 [0047.017] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920378 [0047.017] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x3530020 [0047.017] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920390 [0047.017] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920390, Size=0x20) returned 0x905cc0 [0047.017] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920390 [0047.017] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920390, Size=0x20) returned 0x905ce8 [0047.017] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.017] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.017] Wow64DisableWow64FsRedirection (in: OldValue=0x2b5ff58 | out: OldValue=0x2b5ff58*=0x0) returned 1 [0047.017] lstrlenW (lpString="kernel32.dll") returned 12 [0047.017] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905cc0 | out: hHeap=0x8d0000) returned 1 [0047.017] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.017] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905ce8 | out: hHeap=0x8d0000) returned 1 [0047.018] Sleep (dwMilliseconds=0x64) [0047.229] Sleep (dwMilliseconds=0x64) [0047.475] lstrlenW (lpString="BCD") returned 3 [0047.475] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.475] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.475] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.475] lstrlenW (lpString=".doc") returned 4 [0047.475] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString=".docx") returned 5 [0047.476] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0047.476] lstrlenW (lpString=".pdf") returned 4 [0047.476] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString=".xls") returned 4 [0047.476] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString=".xlsx") returned 5 [0047.476] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0047.476] lstrlenW (lpString=".ppt") returned 4 [0047.476] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.476] lstrlenW (lpString=".zip") returned 4 [0047.476] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString=".rar") returned 4 [0047.476] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString=".bz2") returned 4 [0047.476] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString=".7z") returned 3 [0047.476] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0047.476] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.476] lstrlenW (lpString=".dbf") returned 4 [0047.476] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.476] lstrlenW (lpString=".1cd") returned 4 [0047.476] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.476] lstrlenW (lpString=".jpg") returned 4 [0047.476] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.476] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.476] lstrlenW (lpString=".doc") returned 4 [0047.476] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0047.476] lstrlenW (lpString=".docx") returned 5 [0047.476] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0047.477] lstrlenW (lpString=".pdf") returned 4 [0047.477] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0047.477] lstrlenW (lpString=".xls") returned 4 [0047.477] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0047.477] lstrlenW (lpString=".xlsx") returned 5 [0047.477] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0047.477] lstrlenW (lpString=".ppt") returned 4 [0047.477] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0047.477] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.477] lstrlenW (lpString=".zip") returned 4 [0047.477] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0047.477] lstrlenW (lpString=".rar") returned 4 [0047.477] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0047.477] lstrlenW (lpString=".bz2") returned 4 [0047.477] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0047.477] lstrlenW (lpString=".7z") returned 3 [0047.477] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0047.477] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.477] lstrlenW (lpString=".dbf") returned 4 [0047.477] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0047.477] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.477] lstrlenW (lpString=".1cd") returned 4 [0047.477] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0047.477] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0047.477] lstrlenW (lpString=".jpg") returned 4 [0047.477] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0047.477] lstrcmpiW (lpString1=".LOG1", lpString2=".wiki") returned -1 [0047.477] lstrlenW (lpString="BCD.LOG1") returned 8 [0047.477] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0047.570] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=0) returned 1 [0047.570] CloseHandle (hObject=0x168) returned 1 [0047.570] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.570] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.571] lstrlenW (lpString=".doc") returned 4 [0047.571] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0047.571] lstrlenW (lpString=".docx") returned 5 [0047.571] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0047.571] lstrlenW (lpString=".pdf") returned 4 [0047.571] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0047.571] lstrlenW (lpString=".xls") returned 4 [0047.571] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0047.571] lstrlenW (lpString=".xlsx") returned 5 [0047.571] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0047.571] lstrlenW (lpString=".ppt") returned 4 [0047.571] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0047.571] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.571] lstrlenW (lpString=".zip") returned 4 [0047.571] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0047.571] lstrlenW (lpString=".rar") returned 4 [0047.571] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0047.571] lstrlenW (lpString=".bz2") returned 4 [0047.571] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0047.571] lstrlenW (lpString=".7z") returned 3 [0047.571] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0047.571] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.571] lstrlenW (lpString=".dbf") returned 4 [0047.571] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0047.571] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.571] lstrlenW (lpString=".1cd") returned 4 [0047.571] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0047.571] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.571] lstrlenW (lpString=".jpg") returned 4 [0047.571] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0047.571] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.571] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.572] lstrlenW (lpString=".doc") returned 4 [0047.572] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0047.572] lstrlenW (lpString=".docx") returned 5 [0047.572] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0047.572] lstrlenW (lpString=".pdf") returned 4 [0047.572] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0047.572] lstrlenW (lpString=".xls") returned 4 [0047.572] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0047.572] lstrlenW (lpString=".xlsx") returned 5 [0047.572] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0047.572] lstrlenW (lpString=".ppt") returned 4 [0047.572] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0047.572] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.572] lstrlenW (lpString=".zip") returned 4 [0047.572] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0047.572] lstrlenW (lpString=".rar") returned 4 [0047.572] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0047.573] lstrlenW (lpString=".bz2") returned 4 [0047.573] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0047.573] lstrlenW (lpString=".7z") returned 3 [0047.573] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0047.573] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.573] lstrlenW (lpString=".dbf") returned 4 [0047.573] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0047.573] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.573] lstrlenW (lpString=".1cd") returned 4 [0047.573] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0047.573] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0047.573] lstrlenW (lpString=".jpg") returned 4 [0047.573] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0047.573] lstrcmpiW (lpString1=".ttf", lpString2=".wiki") returned -1 [0047.573] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0047.573] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.629] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1984228) returned 1 [0047.629] CloseHandle (hObject=0x164) returned 1 [0047.629] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0047.629] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.629] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0047.630] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.630] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.630] lstrlenW (lpString=".doc") returned 4 [0047.630] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0047.630] lstrlenW (lpString=".docx") returned 5 [0047.630] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0047.630] lstrlenW (lpString=".pdf") returned 4 [0047.630] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0047.630] lstrlenW (lpString=".xls") returned 4 [0047.630] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0047.630] lstrlenW (lpString=".xlsx") returned 5 [0047.630] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0047.630] lstrlenW (lpString=".ppt") returned 4 [0047.630] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0047.630] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.630] lstrlenW (lpString=".zip") returned 4 [0047.630] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0047.630] lstrlenW (lpString=".rar") returned 4 [0047.630] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0047.630] lstrlenW (lpString=".bz2") returned 4 [0047.630] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0047.630] lstrlenW (lpString=".7z") returned 3 [0047.630] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0047.630] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.630] lstrlenW (lpString=".dbf") returned 4 [0047.630] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0047.630] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.630] lstrlenW (lpString=".1cd") returned 4 [0047.630] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0047.630] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.630] lstrlenW (lpString=".jpg") returned 4 [0047.630] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0047.631] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.631] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.631] lstrlenW (lpString=".doc") returned 4 [0047.631] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0047.631] lstrlenW (lpString=".docx") returned 5 [0047.631] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0047.631] lstrlenW (lpString=".pdf") returned 4 [0047.631] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0047.631] lstrlenW (lpString=".xls") returned 4 [0047.631] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0047.631] lstrlenW (lpString=".xlsx") returned 5 [0047.631] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0047.631] lstrlenW (lpString=".ppt") returned 4 [0047.631] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0047.631] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.631] lstrlenW (lpString=".zip") returned 4 [0047.631] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0047.631] lstrlenW (lpString=".rar") returned 4 [0047.631] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0047.631] lstrlenW (lpString=".bz2") returned 4 [0047.631] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0047.631] lstrlenW (lpString=".7z") returned 3 [0047.631] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0047.631] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.631] lstrlenW (lpString=".dbf") returned 4 [0047.631] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0047.631] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.631] lstrlenW (lpString=".1cd") returned 4 [0047.631] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0047.632] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0047.632] lstrlenW (lpString=".jpg") returned 4 [0047.632] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0047.632] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.632] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.632] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.632] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=88144) returned 1 [0047.632] CloseHandle (hObject=0x164) returned 1 [0047.632] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0047.632] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.632] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.632] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.632] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.632] lstrlenW (lpString=".doc") returned 4 [0047.632] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.632] lstrlenW (lpString=".docx") returned 5 [0047.633] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.633] lstrlenW (lpString=".pdf") returned 4 [0047.633] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.633] lstrlenW (lpString=".xls") returned 4 [0047.633] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.633] lstrlenW (lpString=".xlsx") returned 5 [0047.633] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.633] lstrlenW (lpString=".ppt") returned 4 [0047.633] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.633] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.633] lstrlenW (lpString=".zip") returned 4 [0047.633] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.633] lstrlenW (lpString=".rar") returned 4 [0047.633] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.633] lstrlenW (lpString=".bz2") returned 4 [0047.633] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.633] lstrlenW (lpString=".7z") returned 3 [0047.633] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.633] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.633] lstrlenW (lpString=".dbf") returned 4 [0047.633] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.633] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.633] lstrlenW (lpString=".1cd") returned 4 [0047.633] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.633] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.633] lstrlenW (lpString=".jpg") returned 4 [0047.633] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.633] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.633] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.633] lstrlenW (lpString=".doc") returned 4 [0047.634] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.634] lstrlenW (lpString=".docx") returned 5 [0047.634] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.634] lstrlenW (lpString=".pdf") returned 4 [0047.634] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.634] lstrlenW (lpString=".xls") returned 4 [0047.634] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.634] lstrlenW (lpString=".xlsx") returned 5 [0047.634] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.634] lstrlenW (lpString=".ppt") returned 4 [0047.634] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.634] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.634] lstrlenW (lpString=".zip") returned 4 [0047.634] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.634] lstrlenW (lpString=".rar") returned 4 [0047.634] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.634] lstrlenW (lpString=".bz2") returned 4 [0047.634] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.634] lstrlenW (lpString=".7z") returned 3 [0047.635] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.635] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.635] lstrlenW (lpString=".dbf") returned 4 [0047.636] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.636] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.636] lstrlenW (lpString=".1cd") returned 4 [0047.636] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.636] lstrlenW (lpString="C:\\Boot\\nb-NO\\bootmgr.exe.mui") returned 29 [0047.636] lstrlenW (lpString=".jpg") returned 4 [0047.636] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.636] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.637] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.637] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.637] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=90704) returned 1 [0047.637] CloseHandle (hObject=0x164) returned 1 [0047.637] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0047.637] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.637] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.637] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.637] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.637] lstrlenW (lpString=".doc") returned 4 [0047.637] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.637] lstrlenW (lpString=".docx") returned 5 [0047.637] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.637] lstrlenW (lpString=".pdf") returned 4 [0047.637] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.637] lstrlenW (lpString=".xls") returned 4 [0047.637] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.637] lstrlenW (lpString=".xlsx") returned 5 [0047.637] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.637] lstrlenW (lpString=".ppt") returned 4 [0047.638] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.638] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.638] lstrlenW (lpString=".zip") returned 4 [0047.638] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.638] lstrlenW (lpString=".rar") returned 4 [0047.638] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.638] lstrlenW (lpString=".bz2") returned 4 [0047.638] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.638] lstrlenW (lpString=".7z") returned 3 [0047.638] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.638] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.638] lstrlenW (lpString=".dbf") returned 4 [0047.638] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.638] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.638] lstrlenW (lpString=".1cd") returned 4 [0047.638] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.638] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.638] lstrlenW (lpString=".jpg") returned 4 [0047.638] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.638] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.638] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.638] lstrlenW (lpString=".doc") returned 4 [0047.638] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.638] lstrlenW (lpString=".docx") returned 5 [0047.638] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.638] lstrlenW (lpString=".pdf") returned 4 [0047.638] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.638] lstrlenW (lpString=".xls") returned 4 [0047.638] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.638] lstrlenW (lpString=".xlsx") returned 5 [0047.639] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.639] lstrlenW (lpString=".ppt") returned 4 [0047.639] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.639] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.639] lstrlenW (lpString=".zip") returned 4 [0047.639] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.639] lstrlenW (lpString=".rar") returned 4 [0047.639] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.639] lstrlenW (lpString=".bz2") returned 4 [0047.639] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.639] lstrlenW (lpString=".7z") returned 3 [0047.639] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.639] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.639] lstrlenW (lpString=".dbf") returned 4 [0047.639] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.639] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.639] lstrlenW (lpString=".1cd") returned 4 [0047.639] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.639] lstrlenW (lpString="C:\\Boot\\nl-NL\\bootmgr.exe.mui") returned 29 [0047.639] lstrlenW (lpString=".jpg") returned 4 [0047.639] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.639] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.639] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.639] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.640] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=90704) returned 1 [0047.640] CloseHandle (hObject=0x164) returned 1 [0047.640] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0047.640] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.640] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.640] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.640] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.640] lstrlenW (lpString=".doc") returned 4 [0047.640] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.640] lstrlenW (lpString=".docx") returned 5 [0047.640] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.640] lstrlenW (lpString=".pdf") returned 4 [0047.640] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.640] lstrlenW (lpString=".xls") returned 4 [0047.640] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.640] lstrlenW (lpString=".xlsx") returned 5 [0047.640] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.640] lstrlenW (lpString=".ppt") returned 4 [0047.640] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.640] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.640] lstrlenW (lpString=".zip") returned 4 [0047.640] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.640] lstrlenW (lpString=".rar") returned 4 [0047.640] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.641] lstrlenW (lpString=".bz2") returned 4 [0047.641] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.641] lstrlenW (lpString=".7z") returned 3 [0047.641] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.641] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.641] lstrlenW (lpString=".dbf") returned 4 [0047.641] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.641] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.641] lstrlenW (lpString=".1cd") returned 4 [0047.641] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.641] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.641] lstrlenW (lpString=".jpg") returned 4 [0047.641] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.641] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.641] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.641] lstrlenW (lpString=".doc") returned 4 [0047.641] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.641] lstrlenW (lpString=".docx") returned 5 [0047.641] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.641] lstrlenW (lpString=".pdf") returned 4 [0047.641] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.641] lstrlenW (lpString=".xls") returned 4 [0047.641] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.641] lstrlenW (lpString=".xlsx") returned 5 [0047.641] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.641] lstrlenW (lpString=".ppt") returned 4 [0047.641] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.641] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.641] lstrlenW (lpString=".zip") returned 4 [0047.641] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.641] lstrlenW (lpString=".rar") returned 4 [0047.642] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.642] lstrlenW (lpString=".bz2") returned 4 [0047.642] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.642] lstrlenW (lpString=".7z") returned 3 [0047.642] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.642] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.642] lstrlenW (lpString=".dbf") returned 4 [0047.642] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.642] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.642] lstrlenW (lpString=".1cd") returned 4 [0047.642] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.642] lstrlenW (lpString="C:\\Boot\\pl-PL\\bootmgr.exe.mui") returned 29 [0047.642] lstrlenW (lpString=".jpg") returned 4 [0047.642] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.642] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.642] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.642] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.642] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=90176) returned 1 [0047.642] CloseHandle (hObject=0x164) returned 1 [0047.642] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0047.642] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.643] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.643] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0047.643] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0047.643] lstrlenW (lpString=".doc") returned 4 [0047.643] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.643] lstrlenW (lpString=".docx") returned 5 [0047.643] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.643] lstrlenW (lpString=".pdf") returned 4 [0047.643] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.643] lstrlenW (lpString=".xls") returned 4 [0047.643] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.643] lstrlenW (lpString=".xlsx") returned 5 [0047.643] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.643] lstrlenW (lpString=".ppt") returned 4 [0047.643] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.643] lstrlenW (lpString="C:\\Boot\\pt-BR\\bootmgr.exe.mui") returned 29 [0047.643] lstrlenW (lpString=".zip") returned 4 [0047.643] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.643] lstrlenW (lpString=".rar") returned 4 [0047.643] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.643] lstrlenW (lpString=".bz2") returned 4 [0047.643] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.643] lstrlenW (lpString=".7z") returned 3 [0047.643] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0048.040] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2503680) returned 1 [0048.040] CloseHandle (hObject=0x190) returned 1 [0048.040] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0048.040] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.040] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0048.041] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0048.041] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.041] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.041] ReadFile (in: hFile=0x190, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.059] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.059] ReadFile (in: hFile=0x190, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.071] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.071] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.071] ReadFile (in: hFile=0x190, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.356] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.356] WriteFile (in: hFile=0x190, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0048.521] SetEndOfFile (hFile=0x190) returned 1 [0048.521] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f754b0 [0048.525] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.525] WriteFile (in: hFile=0x190, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.527] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.527] WriteFile (in: hFile=0x190, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.533] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.533] WriteFile (in: hFile=0x190, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.536] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f754b0 | out: hHeap=0x8d0000) returned 1 [0048.536] CloseHandle (hObject=0x190) returned 1 [0049.124] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0049.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.400] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.400] lstrlenW (lpString=".doc") returned 4 [0049.400] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.400] lstrlenW (lpString=".docx") returned 5 [0049.400] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0049.400] lstrlenW (lpString=".pdf") returned 4 [0049.400] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.400] lstrlenW (lpString=".xls") returned 4 [0049.400] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.401] lstrlenW (lpString=".xlsx") returned 5 [0049.401] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0049.401] lstrlenW (lpString=".ppt") returned 4 [0049.401] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.401] lstrlenW (lpString=".zip") returned 4 [0049.401] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.401] lstrlenW (lpString=".rar") returned 4 [0049.401] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.401] lstrlenW (lpString=".bz2") returned 4 [0049.401] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.401] lstrlenW (lpString=".7z") returned 3 [0049.401] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.401] lstrlenW (lpString=".dbf") returned 4 [0049.401] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.401] lstrlenW (lpString=".1cd") returned 4 [0049.401] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.401] lstrlenW (lpString=".jpg") returned 4 [0049.401] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.401] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.401] lstrlenW (lpString=".doc") returned 4 [0049.401] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0049.401] lstrlenW (lpString=".docx") returned 5 [0049.401] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0049.401] lstrlenW (lpString=".pdf") returned 4 [0049.402] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0049.402] lstrlenW (lpString=".xls") returned 4 [0049.402] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0049.402] lstrlenW (lpString=".xlsx") returned 5 [0049.402] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0049.402] lstrlenW (lpString=".ppt") returned 4 [0049.402] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0049.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.402] lstrlenW (lpString=".zip") returned 4 [0049.402] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0049.402] lstrlenW (lpString=".rar") returned 4 [0049.402] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0049.402] lstrlenW (lpString=".bz2") returned 4 [0049.402] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0049.402] lstrlenW (lpString=".7z") returned 3 [0049.402] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0049.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.402] lstrlenW (lpString=".dbf") returned 4 [0049.402] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0049.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.402] lstrlenW (lpString=".1cd") returned 4 [0049.402] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0049.402] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0049.402] lstrlenW (lpString=".jpg") returned 4 [0049.402] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0049.403] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0049.403] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0049.403] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0049.404] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2513920) returned 1 [0049.404] CloseHandle (hObject=0x1a4) returned 1 [0049.404] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0049.404] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.404] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0049.404] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0049.405] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.405] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.405] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.426] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.426] ReadFile (in: hFile=0x1a4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.435] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.435] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.435] ReadFile (in: hFile=0x1a4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.732] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.732] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0049.805] SetEndOfFile (hFile=0x1a4) returned 1 [0049.806] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f854b0 [0049.809] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.810] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.811] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.811] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.817] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.817] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.129] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b0 | out: hHeap=0x8d0000) returned 1 [0050.252] CloseHandle (hObject=0x1a4) returned 1 [0050.823] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.823] lstrlenW (lpString=".doc") returned 4 [0050.823] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.823] lstrlenW (lpString=".docx") returned 5 [0050.823] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0050.823] lstrlenW (lpString=".pdf") returned 4 [0050.823] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.823] lstrlenW (lpString=".xls") returned 4 [0050.823] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.823] lstrlenW (lpString=".xlsx") returned 5 [0050.823] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0050.823] lstrlenW (lpString=".ppt") returned 4 [0050.823] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.823] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.823] lstrlenW (lpString=".zip") returned 4 [0050.823] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.823] lstrlenW (lpString=".rar") returned 4 [0050.823] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.823] lstrlenW (lpString=".bz2") returned 4 [0050.823] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.824] lstrlenW (lpString=".7z") returned 3 [0050.824] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.824] lstrlenW (lpString=".dbf") returned 4 [0050.824] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.824] lstrlenW (lpString=".1cd") returned 4 [0050.824] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.824] lstrlenW (lpString=".jpg") returned 4 [0050.824] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.824] lstrlenW (lpString=".doc") returned 4 [0050.824] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.824] lstrlenW (lpString=".docx") returned 5 [0050.824] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0050.824] lstrlenW (lpString=".pdf") returned 4 [0050.824] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.824] lstrlenW (lpString=".xls") returned 4 [0050.824] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.824] lstrlenW (lpString=".xlsx") returned 5 [0050.824] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0050.824] lstrlenW (lpString=".ppt") returned 4 [0050.824] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.824] lstrlenW (lpString=".zip") returned 4 [0050.824] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.824] lstrlenW (lpString=".rar") returned 4 [0050.824] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.825] lstrlenW (lpString=".bz2") returned 4 [0050.825] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.825] lstrlenW (lpString=".7z") returned 3 [0050.825] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.825] lstrlenW (lpString=".dbf") returned 4 [0050.825] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.825] lstrlenW (lpString=".1cd") returned 4 [0050.825] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0050.825] lstrlenW (lpString=".jpg") returned 4 [0050.825] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.825] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0050.825] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0050.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0050.825] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2865664) returned 1 [0050.825] CloseHandle (hObject=0x1a4) returned 1 [0050.826] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0050.826] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.826] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0050.826] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0050.826] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.826] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.826] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.831] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.831] ReadFile (in: hFile=0x1a4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.186] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0051.186] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0051.186] ReadFile (in: hFile=0x1a4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.202] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.202] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0052.007] SetEndOfFile (hFile=0x1a4) returned 1 [0052.007] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f13470 [0052.007] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.007] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.009] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.009] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.014] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0052.014] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.016] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0052.016] CloseHandle (hObject=0x1a4) returned 1 [0052.413] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0052.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.413] lstrlenW (lpString=".doc") returned 4 [0052.413] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.414] lstrlenW (lpString=".docx") returned 5 [0052.414] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.414] lstrlenW (lpString=".pdf") returned 4 [0052.414] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.414] lstrlenW (lpString=".xls") returned 4 [0052.414] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.414] lstrlenW (lpString=".xlsx") returned 5 [0052.414] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.414] lstrlenW (lpString=".ppt") returned 4 [0052.414] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.414] lstrlenW (lpString=".zip") returned 4 [0052.414] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.414] lstrlenW (lpString=".rar") returned 4 [0052.414] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.414] lstrlenW (lpString=".bz2") returned 4 [0052.414] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.414] lstrlenW (lpString=".7z") returned 3 [0052.414] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.414] lstrlenW (lpString=".dbf") returned 4 [0052.414] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.414] lstrlenW (lpString=".1cd") returned 4 [0052.414] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.414] lstrlenW (lpString=".jpg") returned 4 [0052.414] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.414] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.414] lstrlenW (lpString=".doc") returned 4 [0052.414] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0052.415] lstrlenW (lpString=".docx") returned 5 [0052.415] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0052.415] lstrlenW (lpString=".pdf") returned 4 [0052.415] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0052.415] lstrlenW (lpString=".xls") returned 4 [0052.415] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0052.415] lstrlenW (lpString=".xlsx") returned 5 [0052.415] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0052.415] lstrlenW (lpString=".ppt") returned 4 [0052.415] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0052.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.415] lstrlenW (lpString=".zip") returned 4 [0052.415] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0052.415] lstrlenW (lpString=".rar") returned 4 [0052.415] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0052.415] lstrlenW (lpString=".bz2") returned 4 [0052.415] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0052.415] lstrlenW (lpString=".7z") returned 3 [0052.415] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0052.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.415] lstrlenW (lpString=".dbf") returned 4 [0052.415] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0052.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.415] lstrlenW (lpString=".1cd") returned 4 [0052.415] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0052.415] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0052.415] lstrlenW (lpString=".jpg") returned 4 [0052.415] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0052.415] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0052.416] lstrlenW (lpString="WordMUI.msi") returned 11 [0052.416] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0052.416] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2522624) returned 1 [0052.416] CloseHandle (hObject=0x1a4) returned 1 [0052.416] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0052.416] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.416] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0052.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0052.417] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0052.417] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.417] ReadFile (in: hFile=0x1a4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.616] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.616] ReadFile (in: hFile=0x1a4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.625] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.625] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0052.625] ReadFile (in: hFile=0x1a4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.643] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.643] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0052.927] SetEndOfFile (hFile=0x1a4) returned 1 [0052.927] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f854b0 [0053.283] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.283] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.285] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.285] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.291] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0053.291] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.294] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b0 | out: hHeap=0x8d0000) returned 1 [0053.294] CloseHandle (hObject=0x1a4) returned 1 [0053.937] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0053.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.938] lstrlenW (lpString=".doc") returned 4 [0053.938] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.938] lstrlenW (lpString=".docx") returned 5 [0053.938] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.938] lstrlenW (lpString=".pdf") returned 4 [0053.938] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.938] lstrlenW (lpString=".xls") returned 4 [0053.938] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.938] lstrlenW (lpString=".xlsx") returned 5 [0053.938] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.938] lstrlenW (lpString=".ppt") returned 4 [0053.938] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.938] lstrlenW (lpString=".zip") returned 4 [0053.938] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.938] lstrlenW (lpString=".rar") returned 4 [0053.938] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.938] lstrlenW (lpString=".bz2") returned 4 [0053.938] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.938] lstrlenW (lpString=".7z") returned 3 [0053.938] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.938] lstrlenW (lpString=".dbf") returned 4 [0053.938] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.938] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.938] lstrlenW (lpString=".1cd") returned 4 [0053.939] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.939] lstrlenW (lpString=".jpg") returned 4 [0053.939] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.939] lstrlenW (lpString=".doc") returned 4 [0053.939] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.939] lstrlenW (lpString=".docx") returned 5 [0053.939] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0053.939] lstrlenW (lpString=".pdf") returned 4 [0053.939] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.939] lstrlenW (lpString=".xls") returned 4 [0053.939] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.939] lstrlenW (lpString=".xlsx") returned 5 [0053.939] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0053.939] lstrlenW (lpString=".ppt") returned 4 [0053.939] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.939] lstrlenW (lpString=".zip") returned 4 [0053.939] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.939] lstrlenW (lpString=".rar") returned 4 [0053.939] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.939] lstrlenW (lpString=".bz2") returned 4 [0053.939] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.939] lstrlenW (lpString=".7z") returned 3 [0053.939] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.939] lstrlenW (lpString=".dbf") returned 4 [0053.939] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.939] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.939] lstrlenW (lpString=".1cd") returned 4 [0053.940] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.940] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0053.940] lstrlenW (lpString=".jpg") returned 4 [0053.940] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.940] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0053.940] lstrlenW (lpString="Proof.msi") returned 9 [0053.940] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.142] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=881152) returned 1 [0054.142] CloseHandle (hObject=0x198) returned 1 [0054.142] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0054.143] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.143] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.143] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.143] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.143] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.143] GetLastError () returned 0x0 [0054.143] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0054.165] WriteFile (in: hFile=0x200, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0054.179] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.179] WriteFile (in: hFile=0x200, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.179] SetEndOfFile (hFile=0x200) returned 1 [0054.179] CloseHandle (hObject=0x200) returned 1 [0054.250] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.250] SetEndOfFile (hFile=0x198) returned 1 [0054.509] CloseHandle (hObject=0x198) returned 1 [0054.509] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.509] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0054.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.509] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.509] lstrlenW (lpString=".doc") returned 4 [0054.509] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.509] lstrlenW (lpString=".docx") returned 5 [0054.509] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0054.509] lstrlenW (lpString=".pdf") returned 4 [0054.509] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.509] lstrlenW (lpString=".xls") returned 4 [0054.509] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.509] lstrlenW (lpString=".xlsx") returned 5 [0054.510] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0054.510] lstrlenW (lpString=".ppt") returned 4 [0054.510] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.510] lstrlenW (lpString=".zip") returned 4 [0054.510] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.510] lstrlenW (lpString=".rar") returned 4 [0054.510] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.510] lstrlenW (lpString=".bz2") returned 4 [0054.510] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.510] lstrlenW (lpString=".7z") returned 3 [0054.510] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.510] lstrlenW (lpString=".dbf") returned 4 [0054.510] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.510] lstrlenW (lpString=".1cd") returned 4 [0054.510] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.510] lstrlenW (lpString=".jpg") returned 4 [0054.510] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.510] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.510] lstrlenW (lpString=".doc") returned 4 [0054.510] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.510] lstrlenW (lpString=".docx") returned 5 [0054.510] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0054.510] lstrlenW (lpString=".pdf") returned 4 [0054.510] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.510] lstrlenW (lpString=".xls") returned 4 [0054.510] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.510] lstrlenW (lpString=".xlsx") returned 5 [0054.510] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0054.510] lstrlenW (lpString=".ppt") returned 4 [0054.510] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.511] lstrlenW (lpString=".zip") returned 4 [0054.511] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.511] lstrlenW (lpString=".rar") returned 4 [0054.511] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.511] lstrlenW (lpString=".bz2") returned 4 [0054.511] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.511] lstrlenW (lpString=".7z") returned 3 [0054.511] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.511] lstrlenW (lpString=".dbf") returned 4 [0054.511] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.511] lstrlenW (lpString=".1cd") returned 4 [0054.511] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.511] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0054.511] lstrlenW (lpString=".jpg") returned 4 [0054.511] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.511] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0054.511] lstrlenW (lpString="Proof.msi") returned 9 [0054.511] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.512] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=885760) returned 1 [0054.512] CloseHandle (hObject=0x198) returned 1 [0054.512] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0054.512] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.512] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.512] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.512] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0054.512] GetLastError () returned 0x0 [0054.512] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0054.530] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0054.544] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.544] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.545] SetEndOfFile (hFile=0x1f8) returned 1 [0054.545] CloseHandle (hObject=0x1f8) returned 1 [0054.942] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.942] SetEndOfFile (hFile=0x198) returned 1 [0054.949] CloseHandle (hObject=0x198) returned 1 [0054.949] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.949] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0054.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.950] lstrlenW (lpString=".doc") returned 4 [0054.950] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.950] lstrlenW (lpString=".docx") returned 5 [0054.950] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0054.950] lstrlenW (lpString=".pdf") returned 4 [0054.950] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.950] lstrlenW (lpString=".xls") returned 4 [0054.950] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.950] lstrlenW (lpString=".xlsx") returned 5 [0054.950] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0054.950] lstrlenW (lpString=".ppt") returned 4 [0054.950] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.950] lstrlenW (lpString=".zip") returned 4 [0054.950] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.950] lstrlenW (lpString=".rar") returned 4 [0054.950] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.950] lstrlenW (lpString=".bz2") returned 4 [0054.950] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.950] lstrlenW (lpString=".7z") returned 3 [0054.950] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.950] lstrlenW (lpString=".dbf") returned 4 [0054.950] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.951] lstrlenW (lpString=".1cd") returned 4 [0054.951] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.951] lstrlenW (lpString=".jpg") returned 4 [0054.951] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.951] lstrlenW (lpString=".doc") returned 4 [0054.951] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0054.951] lstrlenW (lpString=".docx") returned 5 [0054.951] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0054.951] lstrlenW (lpString=".pdf") returned 4 [0054.951] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0054.951] lstrlenW (lpString=".xls") returned 4 [0054.951] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0054.951] lstrlenW (lpString=".xlsx") returned 5 [0054.951] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0054.951] lstrlenW (lpString=".ppt") returned 4 [0054.951] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0054.951] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.951] lstrlenW (lpString=".zip") returned 4 [0054.951] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0054.951] lstrlenW (lpString=".rar") returned 4 [0054.951] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0054.951] lstrlenW (lpString=".bz2") returned 4 [0054.951] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0054.951] lstrlenW (lpString=".7z") returned 3 [0054.951] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0054.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.952] lstrlenW (lpString=".dbf") returned 4 [0054.952] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0054.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.952] lstrlenW (lpString=".1cd") returned 4 [0054.952] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0054.952] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0054.952] lstrlenW (lpString=".jpg") returned 4 [0054.952] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0054.952] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0054.952] lstrlenW (lpString="Proofing.msi") returned 12 [0054.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.952] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=868864) returned 1 [0054.952] CloseHandle (hObject=0x198) returned 1 [0054.952] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0054.953] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0054.953] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.953] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.953] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0054.953] GetLastError () returned 0x0 [0054.953] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0054.973] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0055.293] ReadFile (in: hFile=0x198, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.293] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.293] SetEndOfFile (hFile=0x1f8) returned 1 [0055.293] CloseHandle (hObject=0x1f8) returned 1 [0055.300] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.301] SetEndOfFile (hFile=0x198) returned 1 [0055.308] CloseHandle (hObject=0x198) returned 1 [0055.308] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.308] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0055.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.309] lstrlenW (lpString=".doc") returned 4 [0055.309] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.309] lstrlenW (lpString=".docx") returned 5 [0055.309] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0055.309] lstrlenW (lpString=".pdf") returned 4 [0055.309] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.309] lstrlenW (lpString=".xls") returned 4 [0055.309] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.309] lstrlenW (lpString=".xlsx") returned 5 [0055.309] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0055.309] lstrlenW (lpString=".ppt") returned 4 [0055.309] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.309] lstrlenW (lpString=".zip") returned 4 [0055.309] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.309] lstrlenW (lpString=".rar") returned 4 [0055.309] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.309] lstrlenW (lpString=".bz2") returned 4 [0055.309] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.309] lstrlenW (lpString=".7z") returned 3 [0055.309] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.309] lstrlenW (lpString=".dbf") returned 4 [0055.309] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.309] lstrlenW (lpString=".1cd") returned 4 [0055.309] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.309] lstrlenW (lpString=".jpg") returned 4 [0055.309] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.326] lstrlenW (lpString=".doc") returned 4 [0055.326] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.326] lstrlenW (lpString=".docx") returned 5 [0055.326] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0055.326] lstrlenW (lpString=".pdf") returned 4 [0055.326] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.326] lstrlenW (lpString=".xls") returned 4 [0055.326] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.326] lstrlenW (lpString=".xlsx") returned 5 [0055.326] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0055.326] lstrlenW (lpString=".ppt") returned 4 [0055.326] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.326] lstrlenW (lpString=".zip") returned 4 [0055.326] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.326] lstrlenW (lpString=".rar") returned 4 [0055.326] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.326] lstrlenW (lpString=".bz2") returned 4 [0055.326] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.326] lstrlenW (lpString=".7z") returned 3 [0055.326] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.326] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.327] lstrlenW (lpString=".dbf") returned 4 [0055.327] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.327] lstrlenW (lpString=".1cd") returned 4 [0055.327] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0055.327] lstrlenW (lpString=".jpg") returned 4 [0055.327] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.327] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0055.327] lstrlenW (lpString="InfLR.cab") returned 9 [0055.327] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0055.327] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=18874884) returned 1 [0055.327] CloseHandle (hObject=0x198) returned 1 [0055.328] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0055.328] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.328] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0055.328] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0055.328] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0055.328] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.328] ReadFile (in: hFile=0x198, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.569] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.569] ReadFile (in: hFile=0x198, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.781] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.781] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0055.781] ReadFile (in: hFile=0x198, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.807] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.807] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0055.822] SetEndOfFile (hFile=0x198) returned 1 [0055.823] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f854b0 [0055.823] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0055.823] WriteFile (in: hFile=0x198, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.259] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.259] WriteFile (in: hFile=0x198, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.263] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.263] WriteFile (in: hFile=0x198, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.266] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b0 | out: hHeap=0x8d0000) returned 1 [0056.266] CloseHandle (hObject=0x198) returned 1 [0056.362] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0056.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.362] lstrlenW (lpString=".doc") returned 4 [0056.362] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.363] lstrlenW (lpString=".docx") returned 5 [0056.363] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.363] lstrlenW (lpString=".pdf") returned 4 [0056.363] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.363] lstrlenW (lpString=".xls") returned 4 [0056.363] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.363] lstrlenW (lpString=".xlsx") returned 5 [0056.363] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.363] lstrlenW (lpString=".ppt") returned 4 [0056.363] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.363] lstrlenW (lpString=".zip") returned 4 [0056.363] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.363] lstrlenW (lpString=".rar") returned 4 [0056.363] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.363] lstrlenW (lpString=".bz2") returned 4 [0056.363] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.363] lstrlenW (lpString=".7z") returned 3 [0056.363] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.363] lstrlenW (lpString=".dbf") returned 4 [0056.363] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.363] lstrlenW (lpString=".1cd") returned 4 [0056.363] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.363] lstrlenW (lpString=".jpg") returned 4 [0056.363] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.363] lstrlenW (lpString=".doc") returned 4 [0056.363] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.364] lstrlenW (lpString=".docx") returned 5 [0056.364] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.364] lstrlenW (lpString=".pdf") returned 4 [0056.364] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.364] lstrlenW (lpString=".xls") returned 4 [0056.364] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.364] lstrlenW (lpString=".xlsx") returned 5 [0056.364] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.364] lstrlenW (lpString=".ppt") returned 4 [0056.364] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.364] lstrlenW (lpString=".zip") returned 4 [0056.364] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.364] lstrlenW (lpString=".rar") returned 4 [0056.364] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.364] lstrlenW (lpString=".bz2") returned 4 [0056.364] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.364] lstrlenW (lpString=".7z") returned 3 [0056.364] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.364] lstrlenW (lpString=".dbf") returned 4 [0056.364] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.364] lstrlenW (lpString=".1cd") returned 4 [0056.364] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.364] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0056.364] lstrlenW (lpString=".jpg") returned 4 [0056.364] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.364] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0056.364] lstrlenW (lpString="VisioLR.cab") returned 11 [0056.365] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0056.365] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=50823389) returned 1 [0056.365] CloseHandle (hObject=0x198) returned 1 [0056.365] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0056.365] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.365] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0056.366] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0056.366] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0056.366] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.366] ReadFile (in: hFile=0x198, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.396] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.396] ReadFile (in: hFile=0x198, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.410] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.410] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.410] ReadFile (in: hFile=0x198, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.553] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.553] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0056.571] SetEndOfFile (hFile=0x198) returned 1 [0056.572] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x401b510 [0056.865] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.865] WriteFile (in: hFile=0x198, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.865] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.865] WriteFile (in: hFile=0x198, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.866] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.866] WriteFile (in: hFile=0x198, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.868] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401b510 | out: hHeap=0x8d0000) returned 1 [0056.871] CloseHandle (hObject=0x198) returned 1 [0056.871] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0056.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.871] lstrlenW (lpString=".doc") returned 4 [0056.871] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.871] lstrlenW (lpString=".docx") returned 5 [0056.871] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.871] lstrlenW (lpString=".pdf") returned 4 [0056.871] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.871] lstrlenW (lpString=".xls") returned 4 [0056.871] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.871] lstrlenW (lpString=".xlsx") returned 5 [0056.871] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.871] lstrlenW (lpString=".ppt") returned 4 [0056.871] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.871] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.871] lstrlenW (lpString=".zip") returned 4 [0056.871] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.872] lstrlenW (lpString=".rar") returned 4 [0056.872] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.872] lstrlenW (lpString=".bz2") returned 4 [0056.872] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.872] lstrlenW (lpString=".7z") returned 3 [0056.872] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.872] lstrlenW (lpString=".dbf") returned 4 [0056.872] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.872] lstrlenW (lpString=".1cd") returned 4 [0056.872] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.872] lstrlenW (lpString=".jpg") returned 4 [0056.872] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.872] lstrlenW (lpString=".doc") returned 4 [0056.872] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.872] lstrlenW (lpString=".docx") returned 5 [0056.872] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0056.872] lstrlenW (lpString=".pdf") returned 4 [0056.872] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.872] lstrlenW (lpString=".xls") returned 4 [0056.872] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.872] lstrlenW (lpString=".xlsx") returned 5 [0056.872] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0056.872] lstrlenW (lpString=".ppt") returned 4 [0056.872] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.872] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.872] lstrlenW (lpString=".zip") returned 4 [0056.872] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.873] lstrlenW (lpString=".rar") returned 4 [0056.873] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.873] lstrlenW (lpString=".bz2") returned 4 [0056.873] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.873] lstrlenW (lpString=".7z") returned 3 [0056.873] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.873] lstrlenW (lpString=".dbf") returned 4 [0056.873] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.873] lstrlenW (lpString=".1cd") returned 4 [0056.873] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.873] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0056.873] lstrlenW (lpString=".jpg") returned 4 [0056.873] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.873] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0056.873] lstrlenW (lpString="OnoteLR.cab") returned 11 [0056.873] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0056.873] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=17456632) returned 1 [0056.874] CloseHandle (hObject=0x198) returned 1 [0056.874] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0056.874] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.874] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0056.874] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0056.874] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0056.874] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.874] ReadFile (in: hFile=0x198, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.879] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.879] ReadFile (in: hFile=0x198, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.883] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.883] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.883] ReadFile (in: hFile=0x198, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.898] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.898] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0057.206] SetEndOfFile (hFile=0x198) returned 1 [0057.206] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x401b510 [0057.206] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.206] WriteFile (in: hFile=0x198, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.207] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.207] WriteFile (in: hFile=0x198, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.208] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.208] WriteFile (in: hFile=0x198, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.210] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401b510 | out: hHeap=0x8d0000) returned 1 [0057.210] CloseHandle (hObject=0x198) returned 1 [0057.210] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.211] lstrlenW (lpString=".doc") returned 4 [0057.211] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0057.211] lstrlenW (lpString=".docx") returned 5 [0057.211] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0057.211] lstrlenW (lpString=".pdf") returned 4 [0057.211] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0057.211] lstrlenW (lpString=".xls") returned 4 [0057.211] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0057.211] lstrlenW (lpString=".xlsx") returned 5 [0057.211] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0057.211] lstrlenW (lpString=".ppt") returned 4 [0057.211] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0057.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.211] lstrlenW (lpString=".zip") returned 4 [0057.211] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0057.211] lstrlenW (lpString=".rar") returned 4 [0057.211] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0057.211] lstrlenW (lpString=".bz2") returned 4 [0057.211] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0057.211] lstrlenW (lpString=".7z") returned 3 [0057.211] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0057.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.211] lstrlenW (lpString=".dbf") returned 4 [0057.211] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0057.211] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.211] lstrlenW (lpString=".1cd") returned 4 [0057.211] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0057.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.212] lstrlenW (lpString=".jpg") returned 4 [0057.212] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0057.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.212] lstrlenW (lpString=".doc") returned 4 [0057.212] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0057.212] lstrlenW (lpString=".docx") returned 5 [0057.212] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0057.212] lstrlenW (lpString=".pdf") returned 4 [0057.212] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0057.212] lstrlenW (lpString=".xls") returned 4 [0057.212] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0057.212] lstrlenW (lpString=".xlsx") returned 5 [0057.212] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0057.212] lstrlenW (lpString=".ppt") returned 4 [0057.212] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0057.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.212] lstrlenW (lpString=".zip") returned 4 [0057.212] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0057.212] lstrlenW (lpString=".rar") returned 4 [0057.212] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0057.212] lstrlenW (lpString=".bz2") returned 4 [0057.212] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0057.212] lstrlenW (lpString=".7z") returned 3 [0057.212] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0057.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.212] lstrlenW (lpString=".dbf") returned 4 [0057.212] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0057.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.212] lstrlenW (lpString=".1cd") returned 4 [0057.212] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0057.212] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0057.213] lstrlenW (lpString=".jpg") returned 4 [0057.213] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0057.213] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0057.213] lstrlenW (lpString="GrooveLR.cab") returned 12 [0057.213] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0057.213] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=4095519) returned 1 [0057.213] CloseHandle (hObject=0x198) returned 1 [0057.213] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0057.213] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.214] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0057.214] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0057.214] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0057.214] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.214] ReadFile (in: hFile=0x198, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.219] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.219] ReadFile (in: hFile=0x198, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.222] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.222] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.222] ReadFile (in: hFile=0x198, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.490] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.490] WriteFile (in: hFile=0x198, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0057.513] SetEndOfFile (hFile=0x198) returned 1 [0057.513] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x401b510 [0057.517] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.517] WriteFile (in: hFile=0x198, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.519] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.519] WriteFile (in: hFile=0x198, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.521] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.521] WriteFile (in: hFile=0x198, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.523] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401b510 | out: hHeap=0x8d0000) returned 1 [0057.523] CloseHandle (hObject=0x198) returned 1 [0057.523] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.524] lstrlenW (lpString=".doc") returned 4 [0057.524] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0057.524] lstrlenW (lpString=".docx") returned 5 [0057.524] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0057.524] lstrlenW (lpString=".pdf") returned 4 [0057.524] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0057.524] lstrlenW (lpString=".xls") returned 4 [0057.524] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0057.524] lstrlenW (lpString=".xlsx") returned 5 [0057.524] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0057.524] lstrlenW (lpString=".ppt") returned 4 [0057.524] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0057.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.524] lstrlenW (lpString=".zip") returned 4 [0057.524] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0057.524] lstrlenW (lpString=".rar") returned 4 [0057.524] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0057.524] lstrlenW (lpString=".bz2") returned 4 [0057.524] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0057.524] lstrlenW (lpString=".7z") returned 3 [0057.524] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0057.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.524] lstrlenW (lpString=".dbf") returned 4 [0057.524] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0057.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.524] lstrlenW (lpString=".1cd") returned 4 [0057.524] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0057.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.525] lstrlenW (lpString=".jpg") returned 4 [0057.525] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0057.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.623] lstrlenW (lpString=".doc") returned 4 [0057.623] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0057.623] lstrlenW (lpString=".docx") returned 5 [0057.623] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0057.623] lstrlenW (lpString=".pdf") returned 4 [0057.623] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0057.623] lstrlenW (lpString=".xls") returned 4 [0057.623] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0057.623] lstrlenW (lpString=".xlsx") returned 5 [0057.623] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0057.623] lstrlenW (lpString=".ppt") returned 4 [0057.623] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0057.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.623] lstrlenW (lpString=".zip") returned 4 [0057.623] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0057.623] lstrlenW (lpString=".rar") returned 4 [0057.623] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0057.623] lstrlenW (lpString=".bz2") returned 4 [0057.623] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0057.623] lstrlenW (lpString=".7z") returned 3 [0057.623] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0057.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.623] lstrlenW (lpString=".dbf") returned 4 [0057.623] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0057.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.623] lstrlenW (lpString=".1cd") returned 4 [0057.623] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0057.623] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0057.623] lstrlenW (lpString=".jpg") returned 4 [0057.624] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0057.624] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0057.624] lstrlenW (lpString="dwintl20.dll") returned 12 [0057.624] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.625] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=107912) returned 1 [0057.625] CloseHandle (hObject=0x180) returned 1 [0057.625] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0057.625] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.625] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0057.625] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.625] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.625] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.806] GetLastError () returned 0x0 [0057.806] ReadFile (in: hFile=0x180, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0057.980] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0057.982] ReadFile (in: hFile=0x180, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.982] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.982] SetEndOfFile (hFile=0x1f0) returned 1 [0057.982] CloseHandle (hObject=0x1f0) returned 1 [0057.982] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.982] SetEndOfFile (hFile=0x180) returned 1 [0057.984] CloseHandle (hObject=0x180) returned 1 [0057.984] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.984] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0057.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.984] lstrlenW (lpString=".doc") returned 4 [0057.984] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.984] lstrlenW (lpString=".docx") returned 5 [0057.984] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0057.984] lstrlenW (lpString=".pdf") returned 4 [0057.984] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.984] lstrlenW (lpString=".xls") returned 4 [0057.984] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.984] lstrlenW (lpString=".xlsx") returned 5 [0057.985] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0057.985] lstrlenW (lpString=".ppt") returned 4 [0057.985] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.985] lstrlenW (lpString=".zip") returned 4 [0057.985] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.985] lstrlenW (lpString=".rar") returned 4 [0057.985] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.985] lstrlenW (lpString=".bz2") returned 4 [0057.985] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.985] lstrlenW (lpString=".7z") returned 3 [0057.985] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.985] lstrlenW (lpString=".dbf") returned 4 [0057.985] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.985] lstrlenW (lpString=".1cd") returned 4 [0057.985] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.985] lstrlenW (lpString=".jpg") returned 4 [0057.985] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.985] lstrlenW (lpString=".doc") returned 4 [0057.985] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0057.985] lstrlenW (lpString=".docx") returned 5 [0057.985] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0057.985] lstrlenW (lpString=".pdf") returned 4 [0057.985] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0057.985] lstrlenW (lpString=".xls") returned 4 [0057.985] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0057.985] lstrlenW (lpString=".xlsx") returned 5 [0057.985] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0057.986] lstrlenW (lpString=".ppt") returned 4 [0057.986] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0057.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.986] lstrlenW (lpString=".zip") returned 4 [0057.986] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0057.986] lstrlenW (lpString=".rar") returned 4 [0057.986] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0057.986] lstrlenW (lpString=".bz2") returned 4 [0057.986] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0057.986] lstrlenW (lpString=".7z") returned 3 [0057.986] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0057.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.986] lstrlenW (lpString=".dbf") returned 4 [0057.986] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0057.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.986] lstrlenW (lpString=".1cd") returned 4 [0057.986] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0057.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0057.986] lstrlenW (lpString=".jpg") returned 4 [0057.986] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0057.986] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0057.986] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0057.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.332] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1857) returned 1 [0058.332] CloseHandle (hObject=0x1f8) returned 1 [0058.332] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0058.332] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.332] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.332] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.333] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.333] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.333] GetLastError () returned 0x0 [0058.333] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x741, lpOverlapped=0x0) returned 1 [0058.334] WriteFile (in: hFile=0x180, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x750, lpOverlapped=0x0) returned 1 [0058.339] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.339] WriteFile (in: hFile=0x180, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0058.339] SetEndOfFile (hFile=0x180) returned 1 [0058.339] CloseHandle (hObject=0x180) returned 1 [0058.339] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.339] SetEndOfFile (hFile=0x1f8) returned 1 [0058.340] CloseHandle (hObject=0x1f8) returned 1 [0058.340] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.340] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0058.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.340] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.341] lstrlenW (lpString=".doc") returned 4 [0058.341] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0058.341] lstrlenW (lpString=".docx") returned 5 [0058.341] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0058.341] lstrlenW (lpString=".pdf") returned 4 [0058.341] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0058.341] lstrlenW (lpString=".xls") returned 4 [0058.341] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0058.341] lstrlenW (lpString=".xlsx") returned 5 [0058.341] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0058.341] lstrlenW (lpString=".ppt") returned 4 [0058.341] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0058.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.341] lstrlenW (lpString=".zip") returned 4 [0058.341] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0058.341] lstrlenW (lpString=".rar") returned 4 [0058.341] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0058.341] lstrlenW (lpString=".bz2") returned 4 [0058.341] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0058.341] lstrlenW (lpString=".7z") returned 3 [0058.341] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0058.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.341] lstrlenW (lpString=".dbf") returned 4 [0058.341] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0058.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.341] lstrlenW (lpString=".1cd") returned 4 [0058.341] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0058.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.341] lstrlenW (lpString=".jpg") returned 4 [0058.341] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0058.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.342] lstrlenW (lpString=".doc") returned 4 [0058.342] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0058.342] lstrlenW (lpString=".docx") returned 5 [0058.342] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0058.342] lstrlenW (lpString=".pdf") returned 4 [0058.342] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0058.342] lstrlenW (lpString=".xls") returned 4 [0058.342] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0058.342] lstrlenW (lpString=".xlsx") returned 5 [0058.342] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0058.342] lstrlenW (lpString=".ppt") returned 4 [0058.342] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0058.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.342] lstrlenW (lpString=".zip") returned 4 [0058.342] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0058.342] lstrlenW (lpString=".rar") returned 4 [0058.342] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0058.342] lstrlenW (lpString=".bz2") returned 4 [0058.342] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0058.342] lstrlenW (lpString=".7z") returned 3 [0058.342] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0058.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.342] lstrlenW (lpString=".dbf") returned 4 [0058.342] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0058.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.342] lstrlenW (lpString=".1cd") returned 4 [0058.342] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0058.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0058.342] lstrlenW (lpString=".jpg") returned 4 [0058.342] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0058.343] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0058.343] lstrlenW (lpString="OfficeLR.cab") returned 12 [0058.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.343] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=14127746) returned 1 [0058.343] CloseHandle (hObject=0x1f8) returned 1 [0058.343] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0058.343] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.343] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0058.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.344] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.344] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.344] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.349] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.349] ReadFile (in: hFile=0x1f8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.352] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.352] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.352] ReadFile (in: hFile=0x1f8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.653] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.653] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0058.756] SetEndOfFile (hFile=0x1f8) returned 1 [0058.756] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x400b508 [0058.760] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.760] WriteFile (in: hFile=0x1f8, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.761] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.761] WriteFile (in: hFile=0x1f8, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.762] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.762] WriteFile (in: hFile=0x1f8, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.764] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0058.764] CloseHandle (hObject=0x1f8) returned 1 [0058.764] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.765] lstrlenW (lpString=".doc") returned 4 [0058.765] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.765] lstrlenW (lpString=".docx") returned 5 [0058.765] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0058.765] lstrlenW (lpString=".pdf") returned 4 [0058.765] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.765] lstrlenW (lpString=".xls") returned 4 [0058.765] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.765] lstrlenW (lpString=".xlsx") returned 5 [0058.765] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0058.765] lstrlenW (lpString=".ppt") returned 4 [0058.765] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.765] lstrlenW (lpString=".zip") returned 4 [0058.765] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.765] lstrlenW (lpString=".rar") returned 4 [0058.765] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.765] lstrlenW (lpString=".bz2") returned 4 [0058.765] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.765] lstrlenW (lpString=".7z") returned 3 [0058.765] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.765] lstrlenW (lpString=".dbf") returned 4 [0058.765] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.765] lstrlenW (lpString=".1cd") returned 4 [0058.765] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.765] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.766] lstrlenW (lpString=".jpg") returned 4 [0058.766] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.766] lstrlenW (lpString=".doc") returned 4 [0058.766] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.766] lstrlenW (lpString=".docx") returned 5 [0058.766] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0058.766] lstrlenW (lpString=".pdf") returned 4 [0058.766] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.766] lstrlenW (lpString=".xls") returned 4 [0058.766] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.766] lstrlenW (lpString=".xlsx") returned 5 [0058.766] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0058.766] lstrlenW (lpString=".ppt") returned 4 [0058.766] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.766] lstrlenW (lpString=".zip") returned 4 [0058.766] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.766] lstrlenW (lpString=".rar") returned 4 [0058.766] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.766] lstrlenW (lpString=".bz2") returned 4 [0058.766] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.766] lstrlenW (lpString=".7z") returned 3 [0058.766] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.766] lstrlenW (lpString=".dbf") returned 4 [0058.766] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.766] lstrlenW (lpString=".1cd") returned 4 [0058.766] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.766] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0058.767] lstrlenW (lpString=".jpg") returned 4 [0058.767] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.767] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0058.767] lstrlenW (lpString="AccLR.cab") returned 9 [0058.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.767] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=28016276) returned 1 [0058.767] CloseHandle (hObject=0x1f8) returned 1 [0058.767] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0058.767] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.767] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0058.768] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.768] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.768] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.768] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.858] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.858] ReadFile (in: hFile=0x1f8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.865] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.865] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.865] ReadFile (in: hFile=0x1f8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.890] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.890] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0058.909] SetEndOfFile (hFile=0x1f8) returned 1 [0058.911] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x401b510 [0058.912] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.912] WriteFile (in: hFile=0x1f8, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.913] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.067] WriteFile (in: hFile=0x1f8, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.173] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.173] WriteFile (in: hFile=0x1f8, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.175] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401b510 | out: hHeap=0x8d0000) returned 1 [0059.175] CloseHandle (hObject=0x1f8) returned 1 [0059.175] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0059.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.176] lstrlenW (lpString=".doc") returned 4 [0059.176] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.176] lstrlenW (lpString=".docx") returned 5 [0059.176] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0059.176] lstrlenW (lpString=".pdf") returned 4 [0059.176] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.176] lstrlenW (lpString=".xls") returned 4 [0059.176] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.176] lstrlenW (lpString=".xlsx") returned 5 [0059.176] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0059.176] lstrlenW (lpString=".ppt") returned 4 [0059.176] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.176] lstrlenW (lpString=".zip") returned 4 [0059.176] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.176] lstrlenW (lpString=".rar") returned 4 [0059.176] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.176] lstrlenW (lpString=".bz2") returned 4 [0059.176] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.176] lstrlenW (lpString=".7z") returned 3 [0059.176] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.176] lstrlenW (lpString=".dbf") returned 4 [0059.176] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.176] lstrlenW (lpString=".1cd") returned 4 [0059.176] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.176] lstrlenW (lpString=".jpg") returned 4 [0059.176] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.177] lstrlenW (lpString=".doc") returned 4 [0059.177] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.177] lstrlenW (lpString=".docx") returned 5 [0059.177] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0059.177] lstrlenW (lpString=".pdf") returned 4 [0059.177] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.177] lstrlenW (lpString=".xls") returned 4 [0059.177] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.177] lstrlenW (lpString=".xlsx") returned 5 [0059.177] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0059.177] lstrlenW (lpString=".ppt") returned 4 [0059.177] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.177] lstrlenW (lpString=".zip") returned 4 [0059.177] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.177] lstrlenW (lpString=".rar") returned 4 [0059.177] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.177] lstrlenW (lpString=".bz2") returned 4 [0059.177] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.177] lstrlenW (lpString=".7z") returned 3 [0059.177] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.177] lstrlenW (lpString=".dbf") returned 4 [0059.177] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.177] lstrlenW (lpString=".1cd") returned 4 [0059.177] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0059.177] lstrlenW (lpString=".jpg") returned 4 [0059.177] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.178] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0059.178] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0059.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0059.178] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=36233052) returned 1 [0059.178] CloseHandle (hObject=0x1f8) returned 1 [0059.178] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0059.178] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.178] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0059.179] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0059.179] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0059.179] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.179] ReadFile (in: hFile=0x1f8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.217] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.217] ReadFile (in: hFile=0x1f8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.323] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.323] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.323] ReadFile (in: hFile=0x1f8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.351] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.351] WriteFile (in: hFile=0x1f8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0059.707] SetEndOfFile (hFile=0x1f8) returned 1 [0059.707] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f754b0 [0059.707] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.707] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.708] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.708] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.709] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.709] WriteFile (in: hFile=0x1f8, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.715] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f754b0 | out: hHeap=0x8d0000) returned 1 [0059.715] CloseHandle (hObject=0x1f8) returned 1 [0059.716] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0059.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.716] lstrlenW (lpString=".doc") returned 4 [0059.716] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.716] lstrlenW (lpString=".docx") returned 5 [0059.716] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0059.716] lstrlenW (lpString=".pdf") returned 4 [0059.716] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.716] lstrlenW (lpString=".xls") returned 4 [0059.716] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.716] lstrlenW (lpString=".xlsx") returned 5 [0059.716] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0059.716] lstrlenW (lpString=".ppt") returned 4 [0059.716] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.716] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.716] lstrlenW (lpString=".zip") returned 4 [0059.716] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.716] lstrlenW (lpString=".rar") returned 4 [0059.716] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.716] lstrlenW (lpString=".bz2") returned 4 [0059.716] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.716] lstrlenW (lpString=".7z") returned 3 [0059.717] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.717] lstrlenW (lpString=".dbf") returned 4 [0059.717] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.717] lstrlenW (lpString=".1cd") returned 4 [0059.717] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.717] lstrlenW (lpString=".jpg") returned 4 [0059.717] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.717] lstrlenW (lpString=".doc") returned 4 [0059.717] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0059.717] lstrlenW (lpString=".docx") returned 5 [0059.717] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0059.717] lstrlenW (lpString=".pdf") returned 4 [0059.717] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0059.717] lstrlenW (lpString=".xls") returned 4 [0059.717] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0059.717] lstrlenW (lpString=".xlsx") returned 5 [0059.717] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0059.717] lstrlenW (lpString=".ppt") returned 4 [0059.717] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0059.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.717] lstrlenW (lpString=".zip") returned 4 [0059.717] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0059.717] lstrlenW (lpString=".rar") returned 4 [0059.717] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0059.717] lstrlenW (lpString=".bz2") returned 4 [0059.717] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0059.717] lstrlenW (lpString=".7z") returned 3 [0059.717] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0059.717] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.718] lstrlenW (lpString=".dbf") returned 4 [0059.718] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0059.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.718] lstrlenW (lpString=".1cd") returned 4 [0059.718] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0059.718] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0059.718] lstrlenW (lpString=".jpg") returned 4 [0059.718] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0059.718] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0059.718] lstrlenW (lpString="ProPrWW.cab") returned 11 [0059.718] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0060.547] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=177720283) returned 1 [0060.547] CloseHandle (hObject=0x218) returned 1 [0060.547] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0060.548] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.548] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0061.164] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0061.196] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0061.196] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.196] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.204] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.204] ReadFile (in: hFile=0x1d8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.208] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0061.208] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0061.208] ReadFile (in: hFile=0x1d8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.223] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.223] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0061.302] SetEndOfFile (hFile=0x1d8) returned 1 [0061.302] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f13470 [0061.304] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.304] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.305] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.305] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.306] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0061.306] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.308] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0061.308] CloseHandle (hObject=0x1d8) returned 1 [0061.308] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0061.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.308] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.308] lstrlenW (lpString=".doc") returned 4 [0061.308] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.308] lstrlenW (lpString=".docx") returned 5 [0061.309] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0061.309] lstrlenW (lpString=".pdf") returned 4 [0061.309] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.309] lstrlenW (lpString=".xls") returned 4 [0061.309] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.309] lstrlenW (lpString=".xlsx") returned 5 [0061.309] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0061.309] lstrlenW (lpString=".ppt") returned 4 [0061.309] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.309] lstrlenW (lpString=".zip") returned 4 [0061.309] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.309] lstrlenW (lpString=".rar") returned 4 [0061.309] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.309] lstrlenW (lpString=".bz2") returned 4 [0061.309] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.309] lstrlenW (lpString=".7z") returned 3 [0061.309] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.309] lstrlenW (lpString=".dbf") returned 4 [0061.309] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.309] lstrlenW (lpString=".1cd") returned 4 [0061.309] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.309] lstrlenW (lpString=".jpg") returned 4 [0061.309] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.309] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.309] lstrlenW (lpString=".doc") returned 4 [0061.309] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0061.309] lstrlenW (lpString=".docx") returned 5 [0061.310] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0061.310] lstrlenW (lpString=".pdf") returned 4 [0061.310] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0061.310] lstrlenW (lpString=".xls") returned 4 [0061.310] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0061.310] lstrlenW (lpString=".xlsx") returned 5 [0061.310] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0061.310] lstrlenW (lpString=".ppt") returned 4 [0061.310] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0061.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.310] lstrlenW (lpString=".zip") returned 4 [0061.310] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0061.310] lstrlenW (lpString=".rar") returned 4 [0061.310] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0061.310] lstrlenW (lpString=".bz2") returned 4 [0061.310] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0061.310] lstrlenW (lpString=".7z") returned 3 [0061.310] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0061.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.310] lstrlenW (lpString=".dbf") returned 4 [0061.310] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0061.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.310] lstrlenW (lpString=".1cd") returned 4 [0061.310] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0061.310] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0061.310] lstrlenW (lpString=".jpg") returned 4 [0061.310] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0061.310] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0061.311] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0061.311] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.475] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=10798080) returned 1 [0062.475] CloseHandle (hObject=0x1e4) returned 1 [0062.475] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0063.214] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.297] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0063.297] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0063.298] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0063.298] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.298] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.301] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.301] ReadFile (in: hFile=0x1e4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.304] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.304] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.304] ReadFile (in: hFile=0x1e4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.322] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.322] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0063.341] SetEndOfFile (hFile=0x1e4) returned 1 [0063.341] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f554a0 [0063.673] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.673] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.674] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.674] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.676] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.676] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.681] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0063.681] CloseHandle (hObject=0x1e4) returned 1 [0063.681] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0063.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.682] lstrlenW (lpString=".doc") returned 4 [0063.682] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.682] lstrlenW (lpString=".docx") returned 5 [0063.682] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0063.682] lstrlenW (lpString=".pdf") returned 4 [0063.682] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.682] lstrlenW (lpString=".xls") returned 4 [0063.682] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.682] lstrlenW (lpString=".xlsx") returned 5 [0063.682] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0063.682] lstrlenW (lpString=".ppt") returned 4 [0063.682] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.682] lstrlenW (lpString=".zip") returned 4 [0063.682] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.682] lstrlenW (lpString=".rar") returned 4 [0063.682] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.682] lstrlenW (lpString=".bz2") returned 4 [0063.682] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.682] lstrlenW (lpString=".7z") returned 3 [0063.682] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.682] lstrlenW (lpString=".dbf") returned 4 [0063.682] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.682] lstrlenW (lpString=".1cd") returned 4 [0063.682] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.682] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.682] lstrlenW (lpString=".jpg") returned 4 [0063.682] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.683] lstrlenW (lpString=".doc") returned 4 [0063.683] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.683] lstrlenW (lpString=".docx") returned 5 [0063.683] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0063.683] lstrlenW (lpString=".pdf") returned 4 [0063.683] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.683] lstrlenW (lpString=".xls") returned 4 [0063.683] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.683] lstrlenW (lpString=".xlsx") returned 5 [0063.683] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0063.683] lstrlenW (lpString=".ppt") returned 4 [0063.683] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.683] lstrlenW (lpString=".zip") returned 4 [0063.683] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.683] lstrlenW (lpString=".rar") returned 4 [0063.683] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.683] lstrlenW (lpString=".bz2") returned 4 [0063.683] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.683] lstrlenW (lpString=".7z") returned 3 [0063.683] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.683] lstrlenW (lpString=".dbf") returned 4 [0063.683] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.683] lstrlenW (lpString=".1cd") returned 4 [0063.683] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.683] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0063.683] lstrlenW (lpString=".jpg") returned 4 [0063.683] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.684] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0063.684] lstrlenW (lpString="Office32WW.msi") returned 14 [0063.684] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0063.684] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1992192) returned 1 [0063.684] CloseHandle (hObject=0x1e4) returned 1 [0063.684] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0063.684] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.684] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0063.685] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0063.685] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0063.685] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.685] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.689] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.691] ReadFile (in: hFile=0x1e4, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.695] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.695] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0063.695] ReadFile (in: hFile=0x1e4, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.712] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.712] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0063.905] SetEndOfFile (hFile=0x1e4) returned 1 [0063.905] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x404b528 [0063.910] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.910] WriteFile (in: hFile=0x1e4, lpBuffer=0x404b528*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x404b528*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.911] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.911] WriteFile (in: hFile=0x1e4, lpBuffer=0x404b528*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x404b528*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.913] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0063.913] WriteFile (in: hFile=0x1e4, lpBuffer=0x404b528*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x404b528*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.915] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x404b528 | out: hHeap=0x8d0000) returned 1 [0063.915] CloseHandle (hObject=0x1e4) returned 1 [0063.915] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0063.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.916] lstrlenW (lpString=".doc") returned 4 [0063.916] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.916] lstrlenW (lpString=".docx") returned 5 [0063.916] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0063.916] lstrlenW (lpString=".pdf") returned 4 [0063.916] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.916] lstrlenW (lpString=".xls") returned 4 [0063.916] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.916] lstrlenW (lpString=".xlsx") returned 5 [0063.916] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0063.916] lstrlenW (lpString=".ppt") returned 4 [0063.916] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.916] lstrlenW (lpString=".zip") returned 4 [0063.916] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.916] lstrlenW (lpString=".rar") returned 4 [0063.916] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.916] lstrlenW (lpString=".bz2") returned 4 [0063.916] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.916] lstrlenW (lpString=".7z") returned 3 [0063.916] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.916] lstrlenW (lpString=".dbf") returned 4 [0063.917] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.917] lstrlenW (lpString=".1cd") returned 4 [0063.917] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.917] lstrlenW (lpString=".jpg") returned 4 [0063.917] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.917] lstrlenW (lpString=".doc") returned 4 [0063.917] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0063.917] lstrlenW (lpString=".docx") returned 5 [0063.917] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0063.917] lstrlenW (lpString=".pdf") returned 4 [0063.917] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0063.917] lstrlenW (lpString=".xls") returned 4 [0063.918] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0063.918] lstrlenW (lpString=".xlsx") returned 5 [0063.918] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0063.918] lstrlenW (lpString=".ppt") returned 4 [0063.918] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0063.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.918] lstrlenW (lpString=".zip") returned 4 [0063.918] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0063.918] lstrlenW (lpString=".rar") returned 4 [0063.918] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0063.918] lstrlenW (lpString=".bz2") returned 4 [0063.918] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0063.918] lstrlenW (lpString=".7z") returned 3 [0063.918] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0063.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.918] lstrlenW (lpString=".dbf") returned 4 [0063.918] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0063.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.918] lstrlenW (lpString=".1cd") returned 4 [0063.918] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0063.918] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0063.918] lstrlenW (lpString=".jpg") returned 4 [0063.918] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0063.918] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0063.918] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0063.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0064.109] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=36233052) returned 1 [0064.109] CloseHandle (hObject=0x1d8) returned 1 [0064.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0064.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.110] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0064.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0064.110] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.110] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.110] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.267] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.267] ReadFile (in: hFile=0x1d8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.270] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.270] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.270] ReadFile (in: hFile=0x1d8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.286] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.286] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0064.433] SetEndOfFile (hFile=0x1d8) returned 1 [0064.579] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f554a0 [0064.579] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.579] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.647] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.647] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.647] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.648] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.650] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0064.652] CloseHandle (hObject=0x1d8) returned 1 [0064.655] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0064.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.656] lstrlenW (lpString=".doc") returned 4 [0064.656] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0064.656] lstrlenW (lpString=".docx") returned 5 [0064.656] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0064.656] lstrlenW (lpString=".pdf") returned 4 [0064.656] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0064.656] lstrlenW (lpString=".xls") returned 4 [0064.656] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0064.656] lstrlenW (lpString=".xlsx") returned 5 [0064.656] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0064.656] lstrlenW (lpString=".ppt") returned 4 [0064.656] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0064.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.656] lstrlenW (lpString=".zip") returned 4 [0064.656] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0064.656] lstrlenW (lpString=".rar") returned 4 [0064.656] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0064.656] lstrlenW (lpString=".bz2") returned 4 [0064.656] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0064.656] lstrlenW (lpString=".7z") returned 3 [0064.656] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0064.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.656] lstrlenW (lpString=".dbf") returned 4 [0064.656] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0064.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.656] lstrlenW (lpString=".1cd") returned 4 [0064.656] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0064.656] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.656] lstrlenW (lpString=".jpg") returned 4 [0064.656] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0064.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.657] lstrlenW (lpString=".doc") returned 4 [0064.657] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0064.657] lstrlenW (lpString=".docx") returned 5 [0064.657] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0064.657] lstrlenW (lpString=".pdf") returned 4 [0064.657] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0064.657] lstrlenW (lpString=".xls") returned 4 [0064.657] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0064.657] lstrlenW (lpString=".xlsx") returned 5 [0064.657] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0064.657] lstrlenW (lpString=".ppt") returned 4 [0064.657] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0064.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.657] lstrlenW (lpString=".zip") returned 4 [0064.657] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0064.657] lstrlenW (lpString=".rar") returned 4 [0064.657] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0064.657] lstrlenW (lpString=".bz2") returned 4 [0064.657] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0064.657] lstrlenW (lpString=".7z") returned 3 [0064.657] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0064.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.657] lstrlenW (lpString=".dbf") returned 4 [0064.657] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0064.657] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.657] lstrlenW (lpString=".1cd") returned 4 [0064.657] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0064.658] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0064.658] lstrlenW (lpString=".jpg") returned 4 [0064.658] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0064.658] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0064.658] lstrlenW (lpString="VisiorWW.msi") returned 12 [0064.658] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0064.658] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=12060672) returned 1 [0064.658] CloseHandle (hObject=0x1d8) returned 1 [0064.658] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0064.659] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.659] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0064.659] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0064.659] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.659] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.660] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.663] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.665] ReadFile (in: hFile=0x1d8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.674] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.674] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.674] ReadFile (in: hFile=0x1d8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.892] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.893] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0064.912] SetEndOfFile (hFile=0x1d8) returned 1 [0064.912] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f554a0 [0064.915] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.915] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.917] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.917] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.923] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.923] WriteFile (in: hFile=0x1d8, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.925] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0064.925] CloseHandle (hObject=0x1d8) returned 1 [0064.925] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0064.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.925] lstrlenW (lpString=".doc") returned 4 [0064.925] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0064.925] lstrlenW (lpString=".docx") returned 5 [0064.925] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0064.925] lstrlenW (lpString=".pdf") returned 4 [0064.925] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0064.925] lstrlenW (lpString=".xls") returned 4 [0064.925] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0064.925] lstrlenW (lpString=".xlsx") returned 5 [0064.925] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0064.925] lstrlenW (lpString=".ppt") returned 4 [0064.925] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0064.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.926] lstrlenW (lpString=".zip") returned 4 [0064.926] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0064.926] lstrlenW (lpString=".rar") returned 4 [0064.926] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0064.926] lstrlenW (lpString=".bz2") returned 4 [0064.926] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0064.926] lstrlenW (lpString=".7z") returned 3 [0064.926] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0064.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.926] lstrlenW (lpString=".dbf") returned 4 [0064.926] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0064.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.926] lstrlenW (lpString=".1cd") returned 4 [0064.926] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0064.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.926] lstrlenW (lpString=".jpg") returned 4 [0064.926] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.926] lstrlenW (lpString=".doc") returned 4 [0064.926] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0064.926] lstrlenW (lpString=".docx") returned 5 [0064.926] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0064.926] lstrlenW (lpString=".pdf") returned 4 [0064.926] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0064.926] lstrlenW (lpString=".xls") returned 4 [0064.926] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0064.926] lstrlenW (lpString=".xlsx") returned 5 [0064.926] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0064.927] lstrlenW (lpString=".ppt") returned 4 [0064.927] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0064.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.927] lstrlenW (lpString=".zip") returned 4 [0064.927] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0064.927] lstrlenW (lpString=".rar") returned 4 [0064.927] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0064.927] lstrlenW (lpString=".bz2") returned 4 [0064.927] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0064.927] lstrlenW (lpString=".7z") returned 3 [0064.927] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0064.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.927] lstrlenW (lpString=".dbf") returned 4 [0064.927] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0064.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.927] lstrlenW (lpString=".1cd") returned 4 [0064.927] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0064.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0064.927] lstrlenW (lpString=".jpg") returned 4 [0064.927] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0064.927] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0064.927] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0064.927] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.223] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=1369952) returned 1 [0066.223] CloseHandle (hObject=0x21c) returned 1 [0066.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0066.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.701] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x224 [0066.709] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.709] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0066.729] GetLastError () returned 0x0 [0066.729] ReadFile (in: hFile=0x224, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0066.754] WriteFile (in: hFile=0x228, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0066.769] ReadFile (in: hFile=0x224, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0067.338] WriteFile (in: hFile=0x228, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0067.349] ReadFile (in: hFile=0x224, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.349] WriteFile (in: hFile=0x228, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0067.349] SetEndOfFile (hFile=0x228) returned 1 [0067.349] CloseHandle (hObject=0x228) returned 1 [0067.350] SetFilePointerEx (in: hFile=0x224, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.350] SetEndOfFile (hFile=0x224) returned 1 [0067.353] CloseHandle (hObject=0x224) returned 1 [0067.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.354] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0067.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.354] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.354] lstrlenW (lpString=".doc") returned 4 [0067.354] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.354] lstrlenW (lpString=".docx") returned 5 [0067.354] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0067.354] lstrlenW (lpString=".pdf") returned 4 [0067.354] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.354] lstrlenW (lpString=".xls") returned 4 [0067.354] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.354] lstrlenW (lpString=".xlsx") returned 5 [0067.354] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0067.354] lstrlenW (lpString=".ppt") returned 4 [0067.354] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.355] lstrlenW (lpString=".zip") returned 4 [0067.355] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.355] lstrlenW (lpString=".rar") returned 4 [0067.355] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.355] lstrlenW (lpString=".bz2") returned 4 [0067.355] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.355] lstrlenW (lpString=".7z") returned 3 [0067.355] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.355] lstrlenW (lpString=".dbf") returned 4 [0067.355] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.355] lstrlenW (lpString=".1cd") returned 4 [0067.355] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.355] lstrlenW (lpString=".jpg") returned 4 [0067.355] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.355] lstrlenW (lpString=".doc") returned 4 [0067.355] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.355] lstrlenW (lpString=".docx") returned 5 [0067.355] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0067.355] lstrlenW (lpString=".pdf") returned 4 [0067.355] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.355] lstrlenW (lpString=".xls") returned 4 [0067.355] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.355] lstrlenW (lpString=".xlsx") returned 5 [0067.355] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0067.355] lstrlenW (lpString=".ppt") returned 4 [0067.355] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.356] lstrlenW (lpString=".zip") returned 4 [0067.356] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.356] lstrlenW (lpString=".rar") returned 4 [0067.356] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.356] lstrlenW (lpString=".bz2") returned 4 [0067.356] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.356] lstrlenW (lpString=".7z") returned 3 [0067.356] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.356] lstrlenW (lpString=".dbf") returned 4 [0067.356] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.356] lstrlenW (lpString=".1cd") returned 4 [0067.356] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0067.356] lstrlenW (lpString=".jpg") returned 4 [0067.356] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.356] lstrcmpiW (lpString1=".FNT", lpString2=".wiki") returned -1 [0067.356] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0067.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.727] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=606062) returned 1 [0067.727] CloseHandle (hObject=0x220) returned 1 [0067.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0067.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.728] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.728] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.728] GetLastError () returned 0x0 [0067.728] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0067.741] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0067.752] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.752] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.752] SetEndOfFile (hFile=0x1f4) returned 1 [0067.752] CloseHandle (hObject=0x1f4) returned 1 [0067.753] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.753] SetEndOfFile (hFile=0x220) returned 1 [0067.759] CloseHandle (hObject=0x220) returned 1 [0067.759] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.759] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0067.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.759] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.759] lstrlenW (lpString=".doc") returned 4 [0067.760] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0067.760] lstrlenW (lpString=".docx") returned 5 [0067.760] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0067.760] lstrlenW (lpString=".pdf") returned 4 [0067.760] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0067.760] lstrlenW (lpString=".xls") returned 4 [0067.760] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0067.760] lstrlenW (lpString=".xlsx") returned 5 [0067.760] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0067.760] lstrlenW (lpString=".ppt") returned 4 [0067.760] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0067.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.760] lstrlenW (lpString=".zip") returned 4 [0067.760] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0067.760] lstrlenW (lpString=".rar") returned 4 [0067.760] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0067.760] lstrlenW (lpString=".bz2") returned 4 [0067.760] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0067.760] lstrlenW (lpString=".7z") returned 3 [0067.760] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0067.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.760] lstrlenW (lpString=".dbf") returned 4 [0067.760] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0067.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.760] lstrlenW (lpString=".1cd") returned 4 [0067.760] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0067.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.760] lstrlenW (lpString=".jpg") returned 4 [0067.760] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0067.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.760] lstrlenW (lpString=".doc") returned 4 [0067.761] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0067.761] lstrlenW (lpString=".docx") returned 5 [0067.761] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0067.761] lstrlenW (lpString=".pdf") returned 4 [0067.761] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0067.761] lstrlenW (lpString=".xls") returned 4 [0067.761] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0067.761] lstrlenW (lpString=".xlsx") returned 5 [0067.761] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0067.761] lstrlenW (lpString=".ppt") returned 4 [0067.761] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0067.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.761] lstrlenW (lpString=".zip") returned 4 [0067.761] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0067.761] lstrlenW (lpString=".rar") returned 4 [0067.761] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0067.761] lstrlenW (lpString=".bz2") returned 4 [0067.761] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0067.761] lstrlenW (lpString=".7z") returned 3 [0067.761] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0067.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.761] lstrlenW (lpString=".dbf") returned 4 [0067.761] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0067.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.761] lstrlenW (lpString=".1cd") returned 4 [0067.761] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0067.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0067.761] lstrlenW (lpString=".jpg") returned 4 [0067.761] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0067.761] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0067.762] lstrlenW (lpString="PNG32.FLT") returned 9 [0067.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.762] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=302976) returned 1 [0067.762] CloseHandle (hObject=0x220) returned 1 [0067.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0067.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.763] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.763] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.786] GetLastError () returned 0x0 [0067.786] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0067.795] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0067.800] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.801] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0067.801] SetEndOfFile (hFile=0x1f4) returned 1 [0067.801] CloseHandle (hObject=0x1f4) returned 1 [0067.801] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.801] SetEndOfFile (hFile=0x220) returned 1 [0067.804] CloseHandle (hObject=0x220) returned 1 [0067.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.804] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0067.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.805] lstrlenW (lpString=".doc") returned 4 [0067.805] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.805] lstrlenW (lpString=".docx") returned 5 [0067.805] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.805] lstrlenW (lpString=".pdf") returned 4 [0067.805] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.805] lstrlenW (lpString=".xls") returned 4 [0067.805] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.805] lstrlenW (lpString=".xlsx") returned 5 [0067.805] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.805] lstrlenW (lpString=".ppt") returned 4 [0067.805] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.805] lstrlenW (lpString=".zip") returned 4 [0067.977] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.977] lstrlenW (lpString=".rar") returned 4 [0067.977] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.977] lstrlenW (lpString=".bz2") returned 4 [0067.977] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.977] lstrlenW (lpString=".7z") returned 3 [0067.977] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.977] lstrlenW (lpString=".dbf") returned 4 [0067.977] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.977] lstrlenW (lpString=".1cd") returned 4 [0067.977] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.977] lstrlenW (lpString=".jpg") returned 4 [0067.977] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.977] lstrlenW (lpString=".doc") returned 4 [0067.977] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.977] lstrlenW (lpString=".docx") returned 5 [0067.977] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.978] lstrlenW (lpString=".pdf") returned 4 [0067.978] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.978] lstrlenW (lpString=".xls") returned 4 [0067.978] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.978] lstrlenW (lpString=".xlsx") returned 5 [0067.978] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.978] lstrlenW (lpString=".ppt") returned 4 [0067.978] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.978] lstrlenW (lpString=".zip") returned 4 [0067.978] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.978] lstrlenW (lpString=".rar") returned 4 [0067.978] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.978] lstrlenW (lpString=".bz2") returned 4 [0067.978] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.978] lstrlenW (lpString=".7z") returned 3 [0067.978] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.978] lstrlenW (lpString=".dbf") returned 4 [0067.978] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.978] lstrlenW (lpString=".1cd") returned 4 [0067.978] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0067.978] lstrlenW (lpString=".jpg") returned 4 [0067.978] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.978] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0067.978] lstrlenW (lpString="msitss55.dll") returned 12 [0067.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0068.216] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=430080) returned 1 [0068.216] CloseHandle (hObject=0x1e0) returned 1 [0068.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0068.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0068.217] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.217] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.224] GetLastError () returned 0x0 [0068.225] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x69000, lpOverlapped=0x0) returned 1 [0068.233] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x69010, lpOverlapped=0x0) returned 1 [0068.240] ReadFile (in: hFile=0x1e0, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.240] WriteFile (in: hFile=0x1ec, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.240] SetEndOfFile (hFile=0x1ec) returned 1 [0068.240] CloseHandle (hObject=0x1ec) returned 1 [0068.240] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.240] SetEndOfFile (hFile=0x1e0) returned 1 [0068.244] CloseHandle (hObject=0x1e0) returned 1 [0068.244] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.244] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0068.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.245] lstrlenW (lpString=".doc") returned 4 [0068.245] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.245] lstrlenW (lpString=".docx") returned 5 [0068.245] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0068.245] lstrlenW (lpString=".pdf") returned 4 [0068.245] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.245] lstrlenW (lpString=".xls") returned 4 [0068.245] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.245] lstrlenW (lpString=".xlsx") returned 5 [0068.245] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0068.245] lstrlenW (lpString=".ppt") returned 4 [0068.245] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.245] lstrlenW (lpString=".zip") returned 4 [0068.245] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.245] lstrlenW (lpString=".rar") returned 4 [0068.245] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.245] lstrlenW (lpString=".bz2") returned 4 [0068.245] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.245] lstrlenW (lpString=".7z") returned 3 [0068.245] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.245] lstrlenW (lpString=".dbf") returned 4 [0068.245] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.245] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.245] lstrlenW (lpString=".1cd") returned 4 [0068.245] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.246] lstrlenW (lpString=".jpg") returned 4 [0068.246] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.246] lstrlenW (lpString=".doc") returned 4 [0068.246] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.246] lstrlenW (lpString=".docx") returned 5 [0068.246] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0068.246] lstrlenW (lpString=".pdf") returned 4 [0068.246] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.246] lstrlenW (lpString=".xls") returned 4 [0068.246] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.246] lstrlenW (lpString=".xlsx") returned 5 [0068.246] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0068.246] lstrlenW (lpString=".ppt") returned 4 [0068.246] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.246] lstrlenW (lpString=".zip") returned 4 [0068.246] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.246] lstrlenW (lpString=".rar") returned 4 [0068.246] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.246] lstrlenW (lpString=".bz2") returned 4 [0068.246] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.246] lstrlenW (lpString=".7z") returned 3 [0068.246] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.246] lstrlenW (lpString=".dbf") returned 4 [0068.246] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.246] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.246] lstrlenW (lpString=".1cd") returned 4 [0068.246] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0068.247] lstrlenW (lpString=".jpg") returned 4 [0068.247] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.247] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0068.247] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0068.247] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0068.250] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=4096) returned 1 [0068.250] CloseHandle (hObject=0x174) returned 1 [0068.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0068.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.250] lstrlenW (lpString=".doc") returned 4 [0068.250] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.250] lstrlenW (lpString=".docx") returned 5 [0068.250] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.251] lstrlenW (lpString=".pdf") returned 4 [0068.251] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.251] lstrlenW (lpString=".xls") returned 4 [0068.251] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.251] lstrlenW (lpString=".xlsx") returned 5 [0068.251] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.251] lstrlenW (lpString=".ppt") returned 4 [0068.251] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.251] lstrlenW (lpString=".zip") returned 4 [0068.251] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.251] lstrlenW (lpString=".rar") returned 4 [0068.251] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.251] lstrlenW (lpString=".bz2") returned 4 [0068.251] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.251] lstrlenW (lpString=".7z") returned 3 [0068.251] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.251] lstrlenW (lpString=".dbf") returned 4 [0068.251] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.251] lstrlenW (lpString=".1cd") returned 4 [0068.251] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.251] lstrlenW (lpString=".jpg") returned 4 [0068.251] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.251] lstrlenW (lpString=".doc") returned 4 [0068.251] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.251] lstrlenW (lpString=".docx") returned 5 [0068.251] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.251] lstrlenW (lpString=".pdf") returned 4 [0068.252] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.252] lstrlenW (lpString=".xls") returned 4 [0068.252] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.252] lstrlenW (lpString=".xlsx") returned 5 [0068.252] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.252] lstrlenW (lpString=".ppt") returned 4 [0068.252] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.252] lstrlenW (lpString=".zip") returned 4 [0068.252] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.252] lstrlenW (lpString=".rar") returned 4 [0068.252] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.252] lstrlenW (lpString=".bz2") returned 4 [0068.252] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.252] lstrlenW (lpString=".7z") returned 3 [0068.252] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.252] lstrlenW (lpString=".dbf") returned 4 [0068.252] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.252] lstrlenW (lpString=".1cd") returned 4 [0068.252] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0068.252] lstrlenW (lpString=".jpg") returned 4 [0068.252] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.252] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0068.252] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0068.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0068.262] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=8704) returned 1 [0068.262] CloseHandle (hObject=0x174) returned 1 [0068.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0068.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.263] lstrlenW (lpString=".doc") returned 4 [0068.263] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.263] lstrlenW (lpString=".docx") returned 5 [0068.263] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0068.263] lstrlenW (lpString=".pdf") returned 4 [0068.263] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.263] lstrlenW (lpString=".xls") returned 4 [0068.263] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.263] lstrlenW (lpString=".xlsx") returned 5 [0068.263] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0068.263] lstrlenW (lpString=".ppt") returned 4 [0068.263] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.263] lstrlenW (lpString=".zip") returned 4 [0068.263] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.264] lstrlenW (lpString=".rar") returned 4 [0068.264] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.264] lstrlenW (lpString=".bz2") returned 4 [0068.264] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.264] lstrlenW (lpString=".7z") returned 3 [0068.264] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.264] lstrlenW (lpString=".dbf") returned 4 [0068.264] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.264] lstrlenW (lpString=".1cd") returned 4 [0068.264] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.264] lstrlenW (lpString=".jpg") returned 4 [0068.264] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.264] lstrlenW (lpString=".doc") returned 4 [0068.264] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.264] lstrlenW (lpString=".docx") returned 5 [0068.264] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0068.264] lstrlenW (lpString=".pdf") returned 4 [0068.264] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.264] lstrlenW (lpString=".xls") returned 4 [0068.264] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.264] lstrlenW (lpString=".xlsx") returned 5 [0068.264] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0068.264] lstrlenW (lpString=".ppt") returned 4 [0068.264] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.264] lstrlenW (lpString=".zip") returned 4 [0068.264] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.265] lstrlenW (lpString=".rar") returned 4 [0068.265] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.265] lstrlenW (lpString=".bz2") returned 4 [0068.265] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.265] lstrlenW (lpString=".7z") returned 3 [0068.265] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.265] lstrlenW (lpString=".dbf") returned 4 [0068.265] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.265] lstrlenW (lpString=".1cd") returned 4 [0068.265] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0068.265] lstrlenW (lpString=".jpg") returned 4 [0068.265] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.265] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0068.265] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0068.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0068.265] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=4608) returned 1 [0068.265] CloseHandle (hObject=0x174) returned 1 [0068.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0068.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.266] lstrlenW (lpString=".doc") returned 4 [0068.266] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.266] lstrlenW (lpString=".docx") returned 5 [0068.266] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.266] lstrlenW (lpString=".pdf") returned 4 [0068.266] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.266] lstrlenW (lpString=".xls") returned 4 [0068.266] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.266] lstrlenW (lpString=".xlsx") returned 5 [0068.266] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.266] lstrlenW (lpString=".ppt") returned 4 [0068.266] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.266] lstrlenW (lpString=".zip") returned 4 [0068.266] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.266] lstrlenW (lpString=".rar") returned 4 [0068.266] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.266] lstrlenW (lpString=".bz2") returned 4 [0068.266] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.266] lstrlenW (lpString=".7z") returned 3 [0068.266] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.266] lstrlenW (lpString=".dbf") returned 4 [0068.266] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.267] lstrlenW (lpString=".1cd") returned 4 [0068.267] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.267] lstrlenW (lpString=".jpg") returned 4 [0068.267] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.267] lstrlenW (lpString=".doc") returned 4 [0068.267] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.267] lstrlenW (lpString=".docx") returned 5 [0068.267] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.267] lstrlenW (lpString=".pdf") returned 4 [0068.267] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.267] lstrlenW (lpString=".xls") returned 4 [0068.267] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.267] lstrlenW (lpString=".xlsx") returned 5 [0068.267] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.267] lstrlenW (lpString=".ppt") returned 4 [0068.267] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.267] lstrlenW (lpString=".zip") returned 4 [0068.267] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.267] lstrlenW (lpString=".rar") returned 4 [0068.267] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.267] lstrlenW (lpString=".bz2") returned 4 [0068.267] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.267] lstrlenW (lpString=".7z") returned 3 [0068.267] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.267] lstrlenW (lpString=".dbf") returned 4 [0068.267] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.267] lstrlenW (lpString=".1cd") returned 4 [0068.268] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.268] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0068.268] lstrlenW (lpString=".jpg") returned 4 [0068.268] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.268] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0068.268] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0068.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.203] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=9216) returned 1 [0069.203] CloseHandle (hObject=0x20c) returned 1 [0069.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0069.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.203] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.203] lstrlenW (lpString=".doc") returned 4 [0069.203] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.203] lstrlenW (lpString=".docx") returned 5 [0069.203] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.203] lstrlenW (lpString=".pdf") returned 4 [0069.203] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.203] lstrlenW (lpString=".xls") returned 4 [0069.203] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.203] lstrlenW (lpString=".xlsx") returned 5 [0069.204] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.204] lstrlenW (lpString=".ppt") returned 4 [0069.204] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.204] lstrlenW (lpString=".zip") returned 4 [0069.204] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.204] lstrlenW (lpString=".rar") returned 4 [0069.204] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.204] lstrlenW (lpString=".bz2") returned 4 [0069.204] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.204] lstrlenW (lpString=".7z") returned 3 [0069.204] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.204] lstrlenW (lpString=".dbf") returned 4 [0069.204] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.204] lstrlenW (lpString=".1cd") returned 4 [0069.204] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.204] lstrlenW (lpString=".jpg") returned 4 [0069.204] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.204] lstrlenW (lpString=".doc") returned 4 [0069.204] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.204] lstrlenW (lpString=".docx") returned 5 [0069.204] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.204] lstrlenW (lpString=".pdf") returned 4 [0069.204] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.204] lstrlenW (lpString=".xls") returned 4 [0069.204] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.204] lstrlenW (lpString=".xlsx") returned 5 [0069.204] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.205] lstrlenW (lpString=".ppt") returned 4 [0069.205] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.205] lstrlenW (lpString=".zip") returned 4 [0069.205] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.205] lstrlenW (lpString=".rar") returned 4 [0069.205] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.205] lstrlenW (lpString=".bz2") returned 4 [0069.205] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.205] lstrlenW (lpString=".7z") returned 3 [0069.205] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.205] lstrlenW (lpString=".dbf") returned 4 [0069.205] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.205] lstrlenW (lpString=".1cd") returned 4 [0069.205] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.205] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0069.205] lstrlenW (lpString=".jpg") returned 4 [0069.205] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.205] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0069.205] lstrlenW (lpString="IpsMigrationPlugin.dll.mui") returned 26 [0069.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.206] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2560) returned 1 [0069.206] CloseHandle (hObject=0x20c) returned 1 [0069.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui")) returned 0x20 [0069.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\ipsmigrationplugin.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.206] lstrlenW (lpString=".doc") returned 4 [0069.206] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.206] lstrlenW (lpString=".docx") returned 5 [0069.206] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.206] lstrlenW (lpString=".pdf") returned 4 [0069.206] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.206] lstrlenW (lpString=".xls") returned 4 [0069.206] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.206] lstrlenW (lpString=".xlsx") returned 5 [0069.206] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.206] lstrlenW (lpString=".ppt") returned 4 [0069.206] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.206] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.206] lstrlenW (lpString=".zip") returned 4 [0069.206] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.206] lstrlenW (lpString=".rar") returned 4 [0069.206] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.207] lstrlenW (lpString=".bz2") returned 4 [0069.207] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.207] lstrlenW (lpString=".7z") returned 3 [0069.207] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.207] lstrlenW (lpString=".dbf") returned 4 [0069.207] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.207] lstrlenW (lpString=".1cd") returned 4 [0069.207] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.207] lstrlenW (lpString=".jpg") returned 4 [0069.207] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.207] lstrlenW (lpString=".doc") returned 4 [0069.207] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.207] lstrlenW (lpString=".docx") returned 5 [0069.207] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.207] lstrlenW (lpString=".pdf") returned 4 [0069.207] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.207] lstrlenW (lpString=".xls") returned 4 [0069.207] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.207] lstrlenW (lpString=".xlsx") returned 5 [0069.207] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.207] lstrlenW (lpString=".ppt") returned 4 [0069.207] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.207] lstrlenW (lpString=".zip") returned 4 [0069.207] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.207] lstrlenW (lpString=".rar") returned 4 [0069.207] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.207] lstrlenW (lpString=".bz2") returned 4 [0069.207] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.208] lstrlenW (lpString=".7z") returned 3 [0069.208] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.208] lstrlenW (lpString=".dbf") returned 4 [0069.208] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.208] lstrlenW (lpString=".1cd") returned 4 [0069.208] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\IpsMigrationPlugin.dll.mui") returned 83 [0069.208] lstrlenW (lpString=".jpg") returned 4 [0069.208] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.208] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0069.208] lstrlenW (lpString="micaut.dll.mui") returned 14 [0069.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.209] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=8704) returned 1 [0069.209] CloseHandle (hObject=0x20c) returned 1 [0069.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui")) returned 0x20 [0069.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\micaut.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0069.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0069.209] lstrlenW (lpString=".doc") returned 4 [0069.210] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.210] lstrlenW (lpString=".docx") returned 5 [0069.210] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.210] lstrlenW (lpString=".pdf") returned 4 [0069.210] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.210] lstrlenW (lpString=".xls") returned 4 [0069.210] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.210] lstrlenW (lpString=".xlsx") returned 5 [0069.210] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.210] lstrlenW (lpString=".ppt") returned 4 [0069.210] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0069.210] lstrlenW (lpString=".zip") returned 4 [0069.210] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.210] lstrlenW (lpString=".rar") returned 4 [0069.210] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.210] lstrlenW (lpString=".bz2") returned 4 [0069.210] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.210] lstrlenW (lpString=".7z") returned 3 [0069.210] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\micaut.dll.mui") returned 71 [0069.210] lstrlenW (lpString=".dbf") returned 4 [0069.210] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.858] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.858] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.858] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0069.865] GetLastError () returned 0x0 [0069.865] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x25b50, lpOverlapped=0x0) returned 1 [0069.870] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0069.873] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.874] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.874] SetEndOfFile (hFile=0x204) returned 1 [0069.874] CloseHandle (hObject=0x204) returned 1 [0069.874] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.874] SetEndOfFile (hFile=0x1d8) returned 1 [0069.876] CloseHandle (hObject=0x1d8) returned 1 [0069.876] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.876] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0069.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.877] lstrlenW (lpString=".doc") returned 4 [0069.877] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.877] lstrlenW (lpString=".docx") returned 5 [0069.877] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0069.877] lstrlenW (lpString=".pdf") returned 4 [0069.877] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.877] lstrlenW (lpString=".xls") returned 4 [0069.877] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.877] lstrlenW (lpString=".xlsx") returned 5 [0069.877] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0069.877] lstrlenW (lpString=".ppt") returned 4 [0069.877] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.877] lstrlenW (lpString=".zip") returned 4 [0069.877] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.877] lstrlenW (lpString=".rar") returned 4 [0069.877] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.877] lstrlenW (lpString=".bz2") returned 4 [0069.877] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.877] lstrlenW (lpString=".7z") returned 3 [0069.877] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.877] lstrlenW (lpString=".dbf") returned 4 [0069.877] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.877] lstrlenW (lpString=".1cd") returned 4 [0069.877] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.877] lstrlenW (lpString=".jpg") returned 4 [0069.877] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.878] lstrlenW (lpString=".doc") returned 4 [0069.878] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.878] lstrlenW (lpString=".docx") returned 5 [0069.878] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0069.878] lstrlenW (lpString=".pdf") returned 4 [0069.878] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.878] lstrlenW (lpString=".xls") returned 4 [0069.878] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.878] lstrlenW (lpString=".xlsx") returned 5 [0069.878] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0069.878] lstrlenW (lpString=".ppt") returned 4 [0069.878] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.878] lstrlenW (lpString=".zip") returned 4 [0069.878] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.878] lstrlenW (lpString=".rar") returned 4 [0069.878] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.878] lstrlenW (lpString=".bz2") returned 4 [0069.878] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.878] lstrlenW (lpString=".7z") returned 3 [0069.878] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.878] lstrlenW (lpString=".dbf") returned 4 [0069.878] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.878] lstrlenW (lpString=".1cd") returned 4 [0069.878] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0069.878] lstrlenW (lpString=".jpg") returned 4 [0069.878] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.879] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0069.879] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0069.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0069.879] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=2528128) returned 1 [0069.879] CloseHandle (hObject=0x1d8) returned 1 [0069.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0069.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0069.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0069.881] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0069.881] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.881] ReadFile (in: hFile=0x1d8, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0069.889] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0069.889] ReadFile (in: hFile=0x1d8, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.122] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0070.122] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0070.122] ReadFile (in: hFile=0x1d8, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0070.138] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.138] WriteFile (in: hFile=0x1d8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0070.155] SetEndOfFile (hFile=0x1d8) returned 1 [0070.362] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x407bd40 [0070.366] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.366] WriteFile (in: hFile=0x1d8, lpBuffer=0x407bd40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x407bd40*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.367] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.367] WriteFile (in: hFile=0x1d8, lpBuffer=0x407bd40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x407bd40*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.373] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0070.373] WriteFile (in: hFile=0x1d8, lpBuffer=0x407bd40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x407bd40*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0070.376] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x407bd40 | out: hHeap=0x8d0000) returned 1 [0070.376] CloseHandle (hObject=0x1d8) returned 1 [0070.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0070.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.376] lstrlenW (lpString=".doc") returned 4 [0070.376] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0070.376] lstrlenW (lpString=".docx") returned 5 [0070.376] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0070.377] lstrlenW (lpString=".pdf") returned 4 [0070.377] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0070.377] lstrlenW (lpString=".xls") returned 4 [0070.377] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0070.377] lstrlenW (lpString=".xlsx") returned 5 [0070.377] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0070.377] lstrlenW (lpString=".ppt") returned 4 [0070.377] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0070.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.377] lstrlenW (lpString=".zip") returned 4 [0070.377] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0070.377] lstrlenW (lpString=".rar") returned 4 [0070.377] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0070.377] lstrlenW (lpString=".bz2") returned 4 [0070.377] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0070.377] lstrlenW (lpString=".7z") returned 3 [0070.377] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0070.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.377] lstrlenW (lpString=".dbf") returned 4 [0070.377] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0070.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.377] lstrlenW (lpString=".1cd") returned 4 [0070.377] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0070.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.377] lstrlenW (lpString=".jpg") returned 4 [0070.377] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0070.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.377] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.377] lstrlenW (lpString=".doc") returned 4 [0070.377] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0070.377] lstrlenW (lpString=".docx") returned 5 [0070.377] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0070.378] lstrlenW (lpString=".pdf") returned 4 [0070.378] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0070.378] lstrlenW (lpString=".xls") returned 4 [0070.378] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0070.378] lstrlenW (lpString=".xlsx") returned 5 [0070.378] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0070.378] lstrlenW (lpString=".ppt") returned 4 [0070.378] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0070.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.378] lstrlenW (lpString=".zip") returned 4 [0070.378] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0070.378] lstrlenW (lpString=".rar") returned 4 [0070.378] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0070.378] lstrlenW (lpString=".bz2") returned 4 [0070.378] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0070.378] lstrlenW (lpString=".7z") returned 3 [0070.378] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0070.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.378] lstrlenW (lpString=".dbf") returned 4 [0070.378] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0070.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.378] lstrlenW (lpString=".1cd") returned 4 [0070.378] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0070.378] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0070.378] lstrlenW (lpString=".jpg") returned 4 [0070.378] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0070.378] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0070.378] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0070.379] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.980] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=11656) returned 1 [0071.980] CloseHandle (hObject=0x1e4) returned 1 [0071.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0071.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.980] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.980] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.981] GetLastError () returned 0x0 [0071.981] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x2d88, lpOverlapped=0x0) returned 1 [0071.982] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0071.983] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.983] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.983] SetEndOfFile (hFile=0x210) returned 1 [0071.984] CloseHandle (hObject=0x210) returned 1 [0071.984] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.984] SetEndOfFile (hFile=0x1e4) returned 1 [0071.985] CloseHandle (hObject=0x1e4) returned 1 [0071.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.985] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0071.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.985] lstrlenW (lpString=".doc") returned 4 [0071.985] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.985] lstrlenW (lpString=".docx") returned 5 [0071.985] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0071.985] lstrlenW (lpString=".pdf") returned 4 [0071.985] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.985] lstrlenW (lpString=".xls") returned 4 [0071.985] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.985] lstrlenW (lpString=".xlsx") returned 5 [0071.985] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0071.985] lstrlenW (lpString=".ppt") returned 4 [0071.986] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.986] lstrlenW (lpString=".zip") returned 4 [0071.986] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.986] lstrlenW (lpString=".rar") returned 4 [0071.986] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.986] lstrlenW (lpString=".bz2") returned 4 [0071.986] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.986] lstrlenW (lpString=".7z") returned 3 [0071.986] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.986] lstrlenW (lpString=".dbf") returned 4 [0071.986] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.986] lstrlenW (lpString=".1cd") returned 4 [0071.986] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.986] lstrlenW (lpString=".jpg") returned 4 [0071.987] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.987] lstrlenW (lpString=".doc") returned 4 [0071.987] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.987] lstrlenW (lpString=".docx") returned 5 [0071.987] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0071.987] lstrlenW (lpString=".pdf") returned 4 [0071.987] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.987] lstrlenW (lpString=".xls") returned 4 [0071.987] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.987] lstrlenW (lpString=".xlsx") returned 5 [0071.987] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0071.987] lstrlenW (lpString=".ppt") returned 4 [0071.987] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.987] lstrlenW (lpString=".zip") returned 4 [0071.987] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.987] lstrlenW (lpString=".rar") returned 4 [0071.987] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.987] lstrlenW (lpString=".bz2") returned 4 [0071.987] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.987] lstrlenW (lpString=".7z") returned 3 [0071.987] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.987] lstrlenW (lpString=".dbf") returned 4 [0071.987] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.987] lstrlenW (lpString=".1cd") returned 4 [0071.987] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0071.987] lstrlenW (lpString=".jpg") returned 4 [0071.987] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.988] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0071.988] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0071.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.988] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=442272) returned 1 [0071.988] CloseHandle (hObject=0x1e4) returned 1 [0071.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0071.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0071.988] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.989] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.989] GetLastError () returned 0x0 [0071.989] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0071.998] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x6bfb0, lpOverlapped=0x0) returned 1 [0072.007] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.007] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.007] SetEndOfFile (hFile=0x210) returned 1 [0072.007] CloseHandle (hObject=0x210) returned 1 [0072.007] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.007] SetEndOfFile (hFile=0x1e4) returned 1 [0072.011] CloseHandle (hObject=0x1e4) returned 1 [0072.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.011] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0072.011] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.012] lstrlenW (lpString=".doc") returned 4 [0072.012] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.012] lstrlenW (lpString=".docx") returned 5 [0072.012] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0072.012] lstrlenW (lpString=".pdf") returned 4 [0072.012] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.012] lstrlenW (lpString=".xls") returned 4 [0072.012] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.012] lstrlenW (lpString=".xlsx") returned 5 [0072.012] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0072.012] lstrlenW (lpString=".ppt") returned 4 [0072.012] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.012] lstrlenW (lpString=".zip") returned 4 [0072.012] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.012] lstrlenW (lpString=".rar") returned 4 [0072.012] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.012] lstrlenW (lpString=".bz2") returned 4 [0072.012] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.012] lstrlenW (lpString=".7z") returned 3 [0072.012] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.012] lstrlenW (lpString=".dbf") returned 4 [0072.012] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.012] lstrlenW (lpString=".1cd") returned 4 [0072.012] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.012] lstrlenW (lpString=".jpg") returned 4 [0072.012] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.013] lstrlenW (lpString=".doc") returned 4 [0072.013] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.013] lstrlenW (lpString=".docx") returned 5 [0072.013] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0072.013] lstrlenW (lpString=".pdf") returned 4 [0072.013] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.013] lstrlenW (lpString=".xls") returned 4 [0072.013] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.013] lstrlenW (lpString=".xlsx") returned 5 [0072.013] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0072.013] lstrlenW (lpString=".ppt") returned 4 [0072.013] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.013] lstrlenW (lpString=".zip") returned 4 [0072.013] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.013] lstrlenW (lpString=".rar") returned 4 [0072.013] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.013] lstrlenW (lpString=".bz2") returned 4 [0072.013] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.013] lstrlenW (lpString=".7z") returned 3 [0072.013] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.013] lstrlenW (lpString=".dbf") returned 4 [0072.013] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.013] lstrlenW (lpString=".1cd") returned 4 [0072.013] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0072.013] lstrlenW (lpString=".jpg") returned 4 [0072.013] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.014] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0072.014] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0072.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.014] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=899992) returned 1 [0072.014] CloseHandle (hObject=0x1e4) returned 1 [0072.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0072.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0072.014] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.015] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.015] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0072.015] GetLastError () returned 0x0 [0072.015] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0xdbb98, lpOverlapped=0x0) returned 1 [0072.305] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xdbba0, lpOverlapped=0x0) returned 1 [0072.320] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.320] WriteFile (in: hFile=0x210, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.320] SetEndOfFile (hFile=0x210) returned 1 [0072.320] CloseHandle (hObject=0x210) returned 1 [0072.321] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.321] SetEndOfFile (hFile=0x1e4) returned 1 [0072.328] CloseHandle (hObject=0x1e4) returned 1 [0072.328] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.328] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0072.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.329] lstrlenW (lpString=".doc") returned 4 [0072.329] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.329] lstrlenW (lpString=".docx") returned 5 [0072.329] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0072.329] lstrlenW (lpString=".pdf") returned 4 [0072.329] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.329] lstrlenW (lpString=".xls") returned 4 [0072.329] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.329] lstrlenW (lpString=".xlsx") returned 5 [0072.329] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0072.329] lstrlenW (lpString=".ppt") returned 4 [0072.329] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.329] lstrlenW (lpString=".zip") returned 4 [0072.329] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.329] lstrlenW (lpString=".rar") returned 4 [0072.329] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.329] lstrlenW (lpString=".bz2") returned 4 [0072.329] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.465] lstrlenW (lpString=".7z") returned 3 [0072.465] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.465] lstrlenW (lpString=".dbf") returned 4 [0072.465] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.466] lstrlenW (lpString=".1cd") returned 4 [0072.466] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.466] lstrlenW (lpString=".jpg") returned 4 [0072.466] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.466] lstrlenW (lpString=".doc") returned 4 [0072.466] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.466] lstrlenW (lpString=".docx") returned 5 [0072.466] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0072.466] lstrlenW (lpString=".pdf") returned 4 [0072.466] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.466] lstrlenW (lpString=".xls") returned 4 [0072.466] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.466] lstrlenW (lpString=".xlsx") returned 5 [0072.466] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0072.466] lstrlenW (lpString=".ppt") returned 4 [0072.466] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.466] lstrlenW (lpString=".zip") returned 4 [0072.466] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.466] lstrlenW (lpString=".rar") returned 4 [0072.466] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.466] lstrlenW (lpString=".bz2") returned 4 [0072.466] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.466] lstrlenW (lpString=".7z") returned 3 [0072.466] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.466] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.466] lstrlenW (lpString=".dbf") returned 4 [0072.466] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.467] lstrlenW (lpString=".1cd") returned 4 [0072.467] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0072.467] lstrlenW (lpString=".jpg") returned 4 [0072.467] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.467] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0072.467] lstrlenW (lpString="ACER3X.DLL") returned 10 [0072.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0073.812] GetFileSizeEx (in: hFile=0x234, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=451480) returned 1 [0073.812] CloseHandle (hObject=0x234) returned 1 [0073.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0073.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0073.812] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.812] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.812] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0073.813] GetLastError () returned 0x0 [0073.813] ReadFile (in: hFile=0x234, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x6e398, lpOverlapped=0x0) returned 1 [0073.823] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x6e3a0, lpOverlapped=0x0) returned 1 [0073.832] ReadFile (in: hFile=0x234, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.832] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0073.832] SetEndOfFile (hFile=0x20c) returned 1 [0073.832] CloseHandle (hObject=0x20c) returned 1 [0073.832] SetFilePointerEx (in: hFile=0x234, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.832] SetEndOfFile (hFile=0x234) returned 1 [0073.836] CloseHandle (hObject=0x234) returned 1 [0073.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.836] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1 [0073.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.836] lstrlenW (lpString=".doc") returned 4 [0073.837] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.837] lstrlenW (lpString=".docx") returned 5 [0073.837] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0073.837] lstrlenW (lpString=".pdf") returned 4 [0073.837] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.837] lstrlenW (lpString=".xls") returned 4 [0073.837] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.837] lstrlenW (lpString=".xlsx") returned 5 [0073.837] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0073.837] lstrlenW (lpString=".ppt") returned 4 [0073.837] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.837] lstrlenW (lpString=".zip") returned 4 [0073.837] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.837] lstrlenW (lpString=".rar") returned 4 [0073.837] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.837] lstrlenW (lpString=".bz2") returned 4 [0073.837] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.837] lstrlenW (lpString=".7z") returned 3 [0073.837] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.837] lstrlenW (lpString=".dbf") returned 4 [0073.837] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.837] lstrlenW (lpString=".1cd") returned 4 [0073.837] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.837] lstrlenW (lpString=".jpg") returned 4 [0073.837] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.837] lstrlenW (lpString=".doc") returned 4 [0073.837] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.838] lstrlenW (lpString=".docx") returned 5 [0073.838] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0073.838] lstrlenW (lpString=".pdf") returned 4 [0073.838] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.838] lstrlenW (lpString=".xls") returned 4 [0073.838] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.838] lstrlenW (lpString=".xlsx") returned 5 [0073.838] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0073.838] lstrlenW (lpString=".ppt") returned 4 [0073.838] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.838] lstrlenW (lpString=".zip") returned 4 [0073.838] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.838] lstrlenW (lpString=".rar") returned 4 [0073.838] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.838] lstrlenW (lpString=".bz2") returned 4 [0073.838] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.838] lstrlenW (lpString=".7z") returned 3 [0073.838] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.838] lstrlenW (lpString=".dbf") returned 4 [0073.838] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.838] lstrlenW (lpString=".1cd") returned 4 [0073.838] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0073.838] lstrlenW (lpString=".jpg") returned 4 [0073.838] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.838] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0073.839] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0073.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.790] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=318368) returned 1 [0074.790] CloseHandle (hObject=0x204) returned 1 [0074.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0074.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0074.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.792] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.792] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0074.792] GetLastError () returned 0x0 [0074.792] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x4dba0, lpOverlapped=0x0) returned 1 [0074.800] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4dbb0, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x4dbb0, lpOverlapped=0x0) returned 1 [0074.807] ReadFile (in: hFile=0x204, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.807] WriteFile (in: hFile=0x1e0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0074.807] SetEndOfFile (hFile=0x1e0) returned 1 [0074.807] CloseHandle (hObject=0x1e0) returned 1 [0074.807] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.807] SetEndOfFile (hFile=0x204) returned 1 [0074.810] CloseHandle (hObject=0x204) returned 1 [0074.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0074.811] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 1 [0074.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.811] lstrlenW (lpString=".doc") returned 4 [0074.811] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.811] lstrlenW (lpString=".docx") returned 5 [0074.811] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0074.811] lstrlenW (lpString=".pdf") returned 4 [0074.811] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.811] lstrlenW (lpString=".xls") returned 4 [0074.811] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.811] lstrlenW (lpString=".xlsx") returned 5 [0074.811] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0074.811] lstrlenW (lpString=".ppt") returned 4 [0074.811] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.811] lstrlenW (lpString=".zip") returned 4 [0074.811] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.811] lstrlenW (lpString=".rar") returned 4 [0074.811] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.811] lstrlenW (lpString=".bz2") returned 4 [0074.811] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.812] lstrlenW (lpString=".7z") returned 3 [0074.812] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.812] lstrlenW (lpString=".dbf") returned 4 [0074.812] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.812] lstrlenW (lpString=".1cd") returned 4 [0074.812] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.812] lstrlenW (lpString=".jpg") returned 4 [0074.812] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.812] lstrlenW (lpString=".doc") returned 4 [0074.812] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.812] lstrlenW (lpString=".docx") returned 5 [0074.812] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0074.812] lstrlenW (lpString=".pdf") returned 4 [0074.812] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.812] lstrlenW (lpString=".xls") returned 4 [0074.812] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.812] lstrlenW (lpString=".xlsx") returned 5 [0074.812] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0074.812] lstrlenW (lpString=".ppt") returned 4 [0074.812] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.812] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.812] lstrlenW (lpString=".zip") returned 4 [0074.812] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.812] lstrlenW (lpString=".rar") returned 4 [0074.812] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.812] lstrlenW (lpString=".bz2") returned 4 [0074.812] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.812] lstrlenW (lpString=".7z") returned 3 [0074.813] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.813] lstrlenW (lpString=".dbf") returned 4 [0074.813] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.813] lstrlenW (lpString=".1cd") returned 4 [0074.813] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0074.813] lstrlenW (lpString=".jpg") returned 4 [0074.813] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.813] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0074.813] lstrlenW (lpString="Csi.dll") returned 7 [0074.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.814] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=5072816) returned 1 [0074.814] CloseHandle (hObject=0x204) returned 1 [0074.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0074.814] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0074.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0074.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0074.815] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0074.816] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.816] ReadFile (in: hFile=0x204, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.820] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.820] ReadFile (in: hFile=0x204, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.823] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.823] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0074.823] ReadFile (in: hFile=0x204, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.838] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.838] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc00fa, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc00fa, lpOverlapped=0x0) returned 1 [0075.043] SetEndOfFile (hFile=0x204) returned 1 [0075.043] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x402bd18 [0075.047] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0075.047] WriteFile (in: hFile=0x204, lpBuffer=0x402bd18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x402bd18*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.048] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x19cd3a, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0075.049] WriteFile (in: hFile=0x204, lpBuffer=0x402bd18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x402bd18*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.050] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x4967b0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0075.051] WriteFile (in: hFile=0x204, lpBuffer=0x402bd18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x402bd18*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.052] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0075.053] CloseHandle (hObject=0x204) returned 1 [0075.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.053] lstrlenW (lpString=".doc") returned 4 [0075.053] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.053] lstrlenW (lpString=".docx") returned 5 [0075.053] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0075.053] lstrlenW (lpString=".pdf") returned 4 [0075.053] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.053] lstrlenW (lpString=".xls") returned 4 [0075.053] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.053] lstrlenW (lpString=".xlsx") returned 5 [0075.053] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0075.053] lstrlenW (lpString=".ppt") returned 4 [0075.053] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.053] lstrlenW (lpString=".zip") returned 4 [0075.054] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.054] lstrlenW (lpString=".rar") returned 4 [0075.054] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.054] lstrlenW (lpString=".bz2") returned 4 [0075.054] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.054] lstrlenW (lpString=".7z") returned 3 [0075.054] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.054] lstrlenW (lpString=".dbf") returned 4 [0075.054] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.054] lstrlenW (lpString=".1cd") returned 4 [0075.054] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.054] lstrlenW (lpString=".jpg") returned 4 [0075.054] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.054] lstrlenW (lpString=".doc") returned 4 [0075.054] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.054] lstrlenW (lpString=".docx") returned 5 [0075.054] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0075.054] lstrlenW (lpString=".pdf") returned 4 [0075.054] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.054] lstrlenW (lpString=".xls") returned 4 [0075.054] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.054] lstrlenW (lpString=".xlsx") returned 5 [0075.054] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0075.054] lstrlenW (lpString=".ppt") returned 4 [0075.054] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.054] lstrlenW (lpString=".zip") returned 4 [0075.055] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.055] lstrlenW (lpString=".rar") returned 4 [0075.055] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.055] lstrlenW (lpString=".bz2") returned 4 [0075.055] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.055] lstrlenW (lpString=".7z") returned 3 [0075.055] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.055] lstrlenW (lpString=".dbf") returned 4 [0075.055] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.055] lstrlenW (lpString=".1cd") returned 4 [0075.055] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll") returned 63 [0075.055] lstrlenW (lpString=".jpg") returned 4 [0075.055] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.055] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0075.055] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0075.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0075.315] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=71032) returned 1 [0075.315] CloseHandle (hObject=0x228) returned 1 [0075.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 0x20 [0075.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0075.316] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.316] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0075.316] GetLastError () returned 0x0 [0075.316] ReadFile (in: hFile=0x228, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x11578, lpOverlapped=0x0) returned 1 [0075.319] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x11580, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0x11580, lpOverlapped=0x0) returned 1 [0075.331] ReadFile (in: hFile=0x228, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b5fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x2b5fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.331] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0075.331] SetEndOfFile (hFile=0x204) returned 1 [0075.331] CloseHandle (hObject=0x204) returned 1 [0075.331] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.332] SetEndOfFile (hFile=0x228) returned 1 [0075.333] CloseHandle (hObject=0x228) returned 1 [0075.333] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.333] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll")) returned 1 [0075.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.333] lstrlenW (lpString=".doc") returned 4 [0075.333] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0075.333] lstrlenW (lpString=".docx") returned 5 [0075.333] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0075.333] lstrlenW (lpString=".pdf") returned 4 [0075.333] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0075.333] lstrlenW (lpString=".xls") returned 4 [0075.333] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0075.333] lstrlenW (lpString=".xlsx") returned 5 [0075.333] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0075.333] lstrlenW (lpString=".ppt") returned 4 [0075.333] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0075.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.334] lstrlenW (lpString=".zip") returned 4 [0075.334] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0075.334] lstrlenW (lpString=".rar") returned 4 [0075.334] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0075.334] lstrlenW (lpString=".bz2") returned 4 [0075.334] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0075.334] lstrlenW (lpString=".7z") returned 3 [0075.334] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0075.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.334] lstrlenW (lpString=".dbf") returned 4 [0075.334] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0075.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.334] lstrlenW (lpString=".1cd") returned 4 [0075.334] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0075.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.334] lstrlenW (lpString=".jpg") returned 4 [0075.334] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0075.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.334] lstrlenW (lpString=".doc") returned 4 [0075.334] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0075.334] lstrlenW (lpString=".docx") returned 5 [0075.334] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0075.334] lstrlenW (lpString=".pdf") returned 4 [0075.334] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0075.334] lstrlenW (lpString=".xls") returned 4 [0075.334] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0075.334] lstrlenW (lpString=".xlsx") returned 5 [0075.334] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0075.334] lstrlenW (lpString=".ppt") returned 4 [0075.334] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0075.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.334] lstrlenW (lpString=".zip") returned 4 [0075.335] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0075.335] lstrlenW (lpString=".rar") returned 4 [0075.335] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0075.335] lstrlenW (lpString=".bz2") returned 4 [0075.335] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0075.335] lstrlenW (lpString=".7z") returned 3 [0075.335] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0075.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.335] lstrlenW (lpString=".dbf") returned 4 [0075.335] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0075.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.335] lstrlenW (lpString=".1cd") returned 4 [0075.335] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0075.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL") returned 67 [0075.335] lstrlenW (lpString=".jpg") returned 4 [0075.335] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0075.335] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0075.335] lstrlenW (lpString="IACOM2.DLL") returned 10 [0075.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0075.336] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2b5ff1c | out: lpFileSize=0x2b5ff1c*=4289376) returned 1 [0075.336] CloseHandle (hObject=0x228) returned 1 [0075.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll")) returned 0x20 [0075.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.336] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0075.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0075.337] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0x0) returned 1 [0075.337] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.337] ReadFile (in: hFile=0x228, lpBuffer=0x3530058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3530058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.342] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.343] ReadFile (in: hFile=0x228, lpBuffer=0x3570058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x3570058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.346] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b5fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0075.346] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc2c | out: lpNewFilePointer=0x0) returned 1 [0075.346] ReadFile (in: hFile=0x228, lpBuffer=0x35b0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b5fc38, lpOverlapped=0x0 | out: lpBuffer=0x35b0058*, lpNumberOfBytesRead=0x2b5fc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.451] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.451] WriteFile (in: hFile=0x228, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b5fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x2b5fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0075.466] SetEndOfFile (hFile=0x228) returned 1 [0076.199] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f13470 [0076.203] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.203] WriteFile (in: hFile=0x228, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.204] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x15d120, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.204] WriteFile (in: hFile=0x228, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.207] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x3d7360, lpNewFilePointer=0x0, dwMoveMethod=0x2b5fc7c | out: lpNewFilePointer=0x0) returned 1 [0076.207] WriteFile (in: hFile=0x228, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b5fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2b5fc88*=0x40000, lpOverlapped=0x0) returned 1 [0076.208] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0076.208] CloseHandle (hObject=0x228) returned 1 [0076.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.209] lstrlenW (lpString=".doc") returned 4 [0076.209] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0076.209] lstrlenW (lpString=".docx") returned 5 [0076.209] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0076.209] lstrlenW (lpString=".pdf") returned 4 [0076.209] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0076.209] lstrlenW (lpString=".xls") returned 4 [0076.209] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0076.209] lstrlenW (lpString=".xlsx") returned 5 [0076.209] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0076.209] lstrlenW (lpString=".ppt") returned 4 [0076.209] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0076.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.209] lstrlenW (lpString=".zip") returned 4 [0076.209] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0076.209] lstrlenW (lpString=".rar") returned 4 [0076.209] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0076.209] lstrlenW (lpString=".bz2") returned 4 [0076.209] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0076.209] lstrlenW (lpString=".7z") returned 3 [0076.209] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0076.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.209] lstrlenW (lpString=".dbf") returned 4 [0076.209] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0076.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.209] lstrlenW (lpString=".1cd") returned 4 [0076.209] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0076.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.209] lstrlenW (lpString=".jpg") returned 4 [0076.210] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0076.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.210] lstrlenW (lpString=".doc") returned 4 [0076.210] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0076.210] lstrlenW (lpString=".docx") returned 5 [0076.210] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0076.210] lstrlenW (lpString=".pdf") returned 4 [0076.210] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0076.210] lstrlenW (lpString=".xls") returned 4 [0076.210] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0076.210] lstrlenW (lpString=".xlsx") returned 5 [0076.210] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0076.210] lstrlenW (lpString=".ppt") returned 4 [0076.210] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0076.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.210] lstrlenW (lpString=".zip") returned 4 [0076.210] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0076.210] lstrlenW (lpString=".rar") returned 4 [0076.210] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0076.210] lstrlenW (lpString=".bz2") returned 4 [0076.210] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0076.210] lstrlenW (lpString=".7z") returned 3 [0076.210] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0076.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.210] lstrlenW (lpString=".dbf") returned 4 [0076.210] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0076.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.210] lstrlenW (lpString=".1cd") returned 4 [0076.210] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0076.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL") returned 66 [0076.210] lstrlenW (lpString=".jpg") returned 4 [0076.210] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0076.211] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0076.211] lstrlenW (lpString="MSO.DLL") returned 7 [0076.211] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 16 os_tid = 0xaa4 [0047.018] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x990700 [0047.018] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x9a0708 [0047.019] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920390 [0047.019] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x6) returned 0x923150 [0047.019] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9203a8 [0047.019] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x3640020 [0047.019] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9203c0 [0047.019] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9203c0, Size=0x20) returned 0x905ce8 [0047.019] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9203c0 [0047.019] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9203c0, Size=0x20) returned 0x905cc0 [0047.019] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.020] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.020] Wow64DisableWow64FsRedirection (in: OldValue=0x2c9ff58 | out: OldValue=0x2c9ff58*=0x0) returned 1 [0047.020] lstrlenW (lpString="kernel32.dll") returned 12 [0047.020] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905ce8 | out: hHeap=0x8d0000) returned 1 [0047.020] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.020] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905cc0 | out: hHeap=0x8d0000) returned 1 [0047.020] Sleep (dwMilliseconds=0x64) [0047.229] Sleep (dwMilliseconds=0x64) [0047.478] Sleep (dwMilliseconds=0x64) [0047.625] lstrcmpiW (lpString1=".BAK", lpString2=".wiki") returned -1 [0047.625] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0047.625] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.024] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8192) returned 1 [0048.024] CloseHandle (hObject=0x18c) returned 1 [0048.024] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0048.024] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\bootsect.bak.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.024] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0048.024] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.024] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.025] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.025] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\bootsect.bak.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0048.025] GetLastError () returned 0x0 [0048.025] ReadFile (in: hFile=0x18c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x2000, lpOverlapped=0x0) returned 1 [0048.046] WriteFile (in: hFile=0x184, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0048.047] ReadFile (in: hFile=0x18c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.047] WriteFile (in: hFile=0x184, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.047] SetEndOfFile (hFile=0x184) returned 1 [0048.048] CloseHandle (hObject=0x184) returned 1 [0048.048] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.048] SetEndOfFile (hFile=0x18c) returned 1 [0048.049] CloseHandle (hObject=0x18c) returned 1 [0048.049] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x27) returned 1 [0048.050] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0048.050] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.050] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.050] lstrlenW (lpString=".doc") returned 4 [0048.050] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0048.050] lstrlenW (lpString=".docx") returned 5 [0048.050] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0048.050] lstrlenW (lpString=".pdf") returned 4 [0048.050] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0048.050] lstrlenW (lpString=".xls") returned 4 [0048.050] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0048.050] lstrlenW (lpString=".xlsx") returned 5 [0048.050] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0048.050] lstrlenW (lpString=".ppt") returned 4 [0048.050] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0048.050] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.050] lstrlenW (lpString=".zip") returned 4 [0048.050] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0048.050] lstrlenW (lpString=".rar") returned 4 [0048.051] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0048.051] lstrlenW (lpString=".bz2") returned 4 [0048.051] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0048.051] lstrlenW (lpString=".7z") returned 3 [0048.051] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0048.051] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.051] lstrlenW (lpString=".dbf") returned 4 [0048.051] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0048.051] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.051] lstrlenW (lpString=".1cd") returned 4 [0048.051] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0048.051] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.051] lstrlenW (lpString=".jpg") returned 4 [0048.051] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0048.051] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.051] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.051] lstrlenW (lpString=".doc") returned 4 [0048.051] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0048.051] lstrlenW (lpString=".docx") returned 5 [0048.051] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0048.051] lstrlenW (lpString=".pdf") returned 4 [0048.051] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0048.051] lstrlenW (lpString=".xls") returned 4 [0048.051] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0048.051] lstrlenW (lpString=".xlsx") returned 5 [0048.051] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0048.051] lstrlenW (lpString=".ppt") returned 4 [0048.051] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0048.051] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.051] lstrlenW (lpString=".zip") returned 4 [0048.051] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0048.051] lstrlenW (lpString=".rar") returned 4 [0048.051] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0048.052] lstrlenW (lpString=".bz2") returned 4 [0048.052] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0048.052] lstrlenW (lpString=".7z") returned 3 [0048.052] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0048.052] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.052] lstrlenW (lpString=".dbf") returned 4 [0048.052] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0048.052] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.052] lstrlenW (lpString=".1cd") returned 4 [0048.052] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0048.052] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0048.052] lstrlenW (lpString=".jpg") returned 4 [0048.052] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0048.052] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.052] lstrlenW (lpString="Setup.xml") returned 9 [0048.052] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.052] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2424) returned 1 [0048.052] CloseHandle (hObject=0x18c) returned 1 [0048.052] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.053] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.053] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.053] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.053] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.053] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0048.090] GetLastError () returned 0x0 [0048.090] ReadFile (in: hFile=0x18c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x978, lpOverlapped=0x0) returned 1 [0048.100] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x980, lpOverlapped=0x0) returned 1 [0048.101] ReadFile (in: hFile=0x18c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.101] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.101] SetEndOfFile (hFile=0x194) returned 1 [0048.101] CloseHandle (hObject=0x194) returned 1 [0048.102] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.102] SetEndOfFile (hFile=0x18c) returned 1 [0048.103] CloseHandle (hObject=0x18c) returned 1 [0048.103] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.104] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.104] lstrlenW (lpString=".doc") returned 4 [0048.104] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.104] lstrlenW (lpString=".docx") returned 5 [0048.104] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.104] lstrlenW (lpString=".pdf") returned 4 [0048.104] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.104] lstrlenW (lpString=".xls") returned 4 [0048.104] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.104] lstrlenW (lpString=".xlsx") returned 5 [0048.104] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.104] lstrlenW (lpString=".ppt") returned 4 [0048.104] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.104] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.104] lstrlenW (lpString=".zip") returned 4 [0048.104] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.105] lstrlenW (lpString=".rar") returned 4 [0048.105] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.105] lstrlenW (lpString=".bz2") returned 4 [0048.105] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.105] lstrlenW (lpString=".7z") returned 3 [0048.105] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.105] lstrlenW (lpString=".dbf") returned 4 [0048.105] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.105] lstrlenW (lpString=".1cd") returned 4 [0048.105] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.105] lstrlenW (lpString=".jpg") returned 4 [0048.105] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.105] lstrlenW (lpString=".doc") returned 4 [0048.105] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.105] lstrlenW (lpString=".docx") returned 5 [0048.105] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.105] lstrlenW (lpString=".pdf") returned 4 [0048.105] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.105] lstrlenW (lpString=".xls") returned 4 [0048.105] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.105] lstrlenW (lpString=".xlsx") returned 5 [0048.105] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.105] lstrlenW (lpString=".ppt") returned 4 [0048.105] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.106] lstrlenW (lpString=".zip") returned 4 [0048.106] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.106] lstrlenW (lpString=".rar") returned 4 [0048.106] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.106] lstrlenW (lpString=".bz2") returned 4 [0048.106] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.106] lstrlenW (lpString=".7z") returned 3 [0048.106] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.106] lstrlenW (lpString=".dbf") returned 4 [0048.106] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.106] lstrlenW (lpString=".1cd") returned 4 [0048.106] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.106] lstrlenW (lpString=".jpg") returned 4 [0048.106] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.106] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.106] lstrlenW (lpString="WordMUI.xml") returned 11 [0048.106] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.107] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1800) returned 1 [0048.107] CloseHandle (hObject=0x18c) returned 1 [0048.107] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0048.107] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.107] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.107] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.107] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0048.107] GetLastError () returned 0x0 [0048.107] ReadFile (in: hFile=0x18c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x708, lpOverlapped=0x0) returned 1 [0048.356] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x710, lpOverlapped=0x0) returned 1 [0048.540] ReadFile (in: hFile=0x18c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.541] WriteFile (in: hFile=0x194, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0048.541] SetEndOfFile (hFile=0x194) returned 1 [0048.541] CloseHandle (hObject=0x194) returned 1 [0048.543] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.543] SetEndOfFile (hFile=0x18c) returned 1 [0048.544] CloseHandle (hObject=0x18c) returned 1 [0048.544] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.544] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0048.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.544] lstrlenW (lpString=".doc") returned 4 [0048.544] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.544] lstrlenW (lpString=".docx") returned 5 [0048.544] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.544] lstrlenW (lpString=".pdf") returned 4 [0048.545] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.545] lstrlenW (lpString=".xls") returned 4 [0048.545] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.545] lstrlenW (lpString=".xlsx") returned 5 [0048.545] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.545] lstrlenW (lpString=".ppt") returned 4 [0048.545] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.545] lstrlenW (lpString=".zip") returned 4 [0048.545] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.545] lstrlenW (lpString=".rar") returned 4 [0048.545] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.545] lstrlenW (lpString=".bz2") returned 4 [0048.545] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.545] lstrlenW (lpString=".7z") returned 3 [0048.545] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.545] lstrlenW (lpString=".dbf") returned 4 [0048.545] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.545] lstrlenW (lpString=".1cd") returned 4 [0048.545] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.545] lstrlenW (lpString=".jpg") returned 4 [0048.545] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.545] lstrlenW (lpString=".doc") returned 4 [0048.545] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.545] lstrlenW (lpString=".docx") returned 5 [0048.545] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.545] lstrlenW (lpString=".pdf") returned 4 [0048.546] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.546] lstrlenW (lpString=".xls") returned 4 [0048.546] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.546] lstrlenW (lpString=".xlsx") returned 5 [0048.546] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.546] lstrlenW (lpString=".ppt") returned 4 [0048.546] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.546] lstrlenW (lpString=".zip") returned 4 [0048.546] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.546] lstrlenW (lpString=".rar") returned 4 [0048.546] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.546] lstrlenW (lpString=".bz2") returned 4 [0048.546] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.546] lstrlenW (lpString=".7z") returned 3 [0048.546] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.546] lstrlenW (lpString=".dbf") returned 4 [0048.546] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.546] lstrlenW (lpString=".1cd") returned 4 [0048.546] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.546] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0048.546] lstrlenW (lpString=".jpg") returned 4 [0048.546] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.546] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.546] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0048.546] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.867] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1452) returned 1 [0048.867] CloseHandle (hObject=0x17c) returned 1 [0048.867] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0048.867] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.868] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.868] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.868] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.868] GetLastError () returned 0x0 [0048.868] ReadFile (in: hFile=0x17c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0048.870] WriteFile (in: hFile=0x1ac, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0048.871] ReadFile (in: hFile=0x17c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.871] WriteFile (in: hFile=0x1ac, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0048.871] SetEndOfFile (hFile=0x1ac) returned 1 [0048.872] CloseHandle (hObject=0x1ac) returned 1 [0048.872] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.872] SetEndOfFile (hFile=0x17c) returned 1 [0048.873] CloseHandle (hObject=0x17c) returned 1 [0048.873] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.873] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0048.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.874] lstrlenW (lpString=".doc") returned 4 [0048.874] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.874] lstrlenW (lpString=".docx") returned 5 [0048.874] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.874] lstrlenW (lpString=".pdf") returned 4 [0048.874] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.874] lstrlenW (lpString=".xls") returned 4 [0048.874] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.874] lstrlenW (lpString=".xlsx") returned 5 [0048.874] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.874] lstrlenW (lpString=".ppt") returned 4 [0048.874] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.874] lstrlenW (lpString=".zip") returned 4 [0048.874] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.874] lstrlenW (lpString=".rar") returned 4 [0048.874] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.874] lstrlenW (lpString=".bz2") returned 4 [0048.874] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.874] lstrlenW (lpString=".7z") returned 3 [0048.874] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.874] lstrlenW (lpString=".dbf") returned 4 [0048.874] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.874] lstrlenW (lpString=".1cd") returned 4 [0048.875] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.875] lstrlenW (lpString=".jpg") returned 4 [0048.875] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.875] lstrlenW (lpString=".doc") returned 4 [0048.875] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.875] lstrlenW (lpString=".docx") returned 5 [0048.875] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.875] lstrlenW (lpString=".pdf") returned 4 [0048.875] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.875] lstrlenW (lpString=".xls") returned 4 [0048.875] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.875] lstrlenW (lpString=".xlsx") returned 5 [0048.875] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.875] lstrlenW (lpString=".ppt") returned 4 [0048.875] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.875] lstrlenW (lpString=".zip") returned 4 [0048.875] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.875] lstrlenW (lpString=".rar") returned 4 [0048.875] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.875] lstrlenW (lpString=".bz2") returned 4 [0048.875] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.875] lstrlenW (lpString=".7z") returned 3 [0048.875] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.875] lstrlenW (lpString=".dbf") returned 4 [0048.875] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.875] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.875] lstrlenW (lpString=".1cd") returned 4 [0048.876] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.876] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0048.876] lstrlenW (lpString=".jpg") returned 4 [0048.876] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.876] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.876] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0048.876] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.876] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=819) returned 1 [0048.876] CloseHandle (hObject=0x17c) returned 1 [0048.876] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0048.876] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.876] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.877] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.877] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.877] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.877] GetLastError () returned 0x0 [0048.877] ReadFile (in: hFile=0x17c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x333, lpOverlapped=0x0) returned 1 [0048.878] WriteFile (in: hFile=0x1ac, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x340, lpOverlapped=0x0) returned 1 [0048.879] ReadFile (in: hFile=0x17c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.879] WriteFile (in: hFile=0x1ac, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0048.879] SetEndOfFile (hFile=0x1ac) returned 1 [0048.879] CloseHandle (hObject=0x1ac) returned 1 [0048.880] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.880] SetEndOfFile (hFile=0x17c) returned 1 [0048.881] CloseHandle (hObject=0x17c) returned 1 [0048.881] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.881] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0048.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0048.881] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0048.881] lstrlenW (lpString=".doc") returned 4 [0048.881] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.882] lstrlenW (lpString=".docx") returned 5 [0048.882] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0048.882] lstrlenW (lpString=".pdf") returned 4 [0048.882] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.882] lstrlenW (lpString=".xls") returned 4 [0048.882] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.882] lstrlenW (lpString=".xlsx") returned 5 [0048.882] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0048.882] lstrlenW (lpString=".ppt") returned 4 [0048.882] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0048.882] lstrlenW (lpString=".zip") returned 4 [0048.882] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.882] lstrlenW (lpString=".rar") returned 4 [0048.882] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.882] lstrlenW (lpString=".bz2") returned 4 [0048.882] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.882] lstrlenW (lpString=".7z") returned 3 [0048.882] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0048.882] lstrlenW (lpString=".dbf") returned 4 [0048.882] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0048.882] lstrlenW (lpString=".1cd") returned 4 [0048.882] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.882] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0049.019] lstrlenW (lpString=".jpg") returned 4 [0049.019] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0049.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0049.019] lstrlenW (lpString=".doc") returned 4 [0049.019] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.019] lstrlenW (lpString=".docx") returned 5 [0049.019] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0049.019] lstrlenW (lpString=".pdf") returned 4 [0049.019] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.019] lstrlenW (lpString=".xls") returned 4 [0049.019] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.020] lstrlenW (lpString=".xlsx") returned 5 [0049.020] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0049.020] lstrlenW (lpString=".ppt") returned 4 [0049.020] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0049.020] lstrlenW (lpString=".zip") returned 4 [0049.020] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.020] lstrlenW (lpString=".rar") returned 4 [0049.020] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.020] lstrlenW (lpString=".bz2") returned 4 [0049.020] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.020] lstrlenW (lpString=".7z") returned 3 [0049.020] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0049.020] lstrlenW (lpString=".dbf") returned 4 [0049.020] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0049.020] lstrlenW (lpString=".1cd") returned 4 [0049.020] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0049.020] lstrlenW (lpString=".jpg") returned 4 [0049.020] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.020] lstrcmpiW (lpString1=".chm", lpString2=".wiki") returned -1 [0049.020] lstrlenW (lpString="pss10r.chm") returned 10 [0049.020] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0049.669] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=27195) returned 1 [0049.669] CloseHandle (hObject=0x1bc) returned 1 [0049.669] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0049.669] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.669] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0049.669] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.669] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.669] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0049.670] GetLastError () returned 0x0 [0049.670] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0049.742] WriteFile (in: hFile=0x1c0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0049.743] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.743] WriteFile (in: hFile=0x1c0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0049.743] SetEndOfFile (hFile=0x1c0) returned 1 [0049.743] CloseHandle (hObject=0x1c0) returned 1 [0049.744] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.744] SetEndOfFile (hFile=0x1bc) returned 1 [0049.745] CloseHandle (hObject=0x1bc) returned 1 [0049.745] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0049.745] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0049.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.745] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.745] lstrlenW (lpString=".doc") returned 4 [0049.745] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0049.746] lstrlenW (lpString=".docx") returned 5 [0049.746] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0049.746] lstrlenW (lpString=".pdf") returned 4 [0049.746] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0049.746] lstrlenW (lpString=".xls") returned 4 [0049.746] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0049.746] lstrlenW (lpString=".xlsx") returned 5 [0049.746] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0049.746] lstrlenW (lpString=".ppt") returned 4 [0049.746] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0049.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.746] lstrlenW (lpString=".zip") returned 4 [0049.746] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0049.746] lstrlenW (lpString=".rar") returned 4 [0049.746] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0049.746] lstrlenW (lpString=".bz2") returned 4 [0049.746] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0049.746] lstrlenW (lpString=".7z") returned 3 [0049.746] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0049.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.746] lstrlenW (lpString=".dbf") returned 4 [0049.746] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0049.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.746] lstrlenW (lpString=".1cd") returned 4 [0049.746] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0049.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.746] lstrlenW (lpString=".jpg") returned 4 [0049.746] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0049.746] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.747] lstrlenW (lpString=".doc") returned 4 [0049.747] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0049.747] lstrlenW (lpString=".docx") returned 5 [0049.747] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0049.747] lstrlenW (lpString=".pdf") returned 4 [0049.747] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0049.747] lstrlenW (lpString=".xls") returned 4 [0049.747] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0049.747] lstrlenW (lpString=".xlsx") returned 5 [0049.747] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0049.747] lstrlenW (lpString=".ppt") returned 4 [0049.747] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0049.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.747] lstrlenW (lpString=".zip") returned 4 [0049.747] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0049.747] lstrlenW (lpString=".rar") returned 4 [0049.747] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0049.747] lstrlenW (lpString=".bz2") returned 4 [0049.747] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0049.747] lstrlenW (lpString=".7z") returned 3 [0049.747] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0049.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.747] lstrlenW (lpString=".dbf") returned 4 [0049.747] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0049.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.747] lstrlenW (lpString=".1cd") returned 4 [0049.747] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0049.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0049.747] lstrlenW (lpString=".jpg") returned 4 [0049.747] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0049.748] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0049.748] lstrlenW (lpString="Setup.xml") returned 9 [0049.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0049.748] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9352) returned 1 [0049.748] CloseHandle (hObject=0x1bc) returned 1 [0049.748] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0049.748] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0049.748] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.748] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.748] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0049.749] GetLastError () returned 0x0 [0049.749] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x2488, lpOverlapped=0x0) returned 1 [0049.920] WriteFile (in: hFile=0x1c0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0049.921] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.922] WriteFile (in: hFile=0x1c0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.922] SetEndOfFile (hFile=0x1c0) returned 1 [0049.922] CloseHandle (hObject=0x1c0) returned 1 [0049.924] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.924] SetEndOfFile (hFile=0x1bc) returned 1 [0049.925] CloseHandle (hObject=0x1bc) returned 1 [0049.925] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0049.925] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0049.925] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.926] lstrlenW (lpString=".doc") returned 4 [0049.926] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString=".docx") returned 5 [0049.926] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0049.926] lstrlenW (lpString=".pdf") returned 4 [0049.926] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString=".xls") returned 4 [0049.926] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString=".xlsx") returned 5 [0049.926] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0049.926] lstrlenW (lpString=".ppt") returned 4 [0049.926] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.926] lstrlenW (lpString=".zip") returned 4 [0049.926] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.926] lstrlenW (lpString=".rar") returned 4 [0049.926] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString=".bz2") returned 4 [0049.926] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString=".7z") returned 3 [0049.926] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.926] lstrlenW (lpString=".dbf") returned 4 [0049.926] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.926] lstrlenW (lpString=".1cd") returned 4 [0049.926] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.926] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.926] lstrlenW (lpString=".jpg") returned 4 [0049.927] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.927] lstrlenW (lpString=".doc") returned 4 [0049.927] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString=".docx") returned 5 [0049.927] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0049.927] lstrlenW (lpString=".pdf") returned 4 [0049.927] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString=".xls") returned 4 [0049.927] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString=".xlsx") returned 5 [0049.927] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0049.927] lstrlenW (lpString=".ppt") returned 4 [0049.927] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.927] lstrlenW (lpString=".zip") returned 4 [0049.927] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.927] lstrlenW (lpString=".rar") returned 4 [0049.927] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString=".bz2") returned 4 [0049.927] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString=".7z") returned 3 [0049.927] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.927] lstrlenW (lpString=".dbf") returned 4 [0049.927] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.927] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.927] lstrlenW (lpString=".1cd") returned 4 [0049.927] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.928] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.928] lstrlenW (lpString=".jpg") returned 4 [0049.928] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.928] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0049.928] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0049.928] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0049.928] GetFileSizeEx (in: hFile=0x1bc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=819) returned 1 [0049.928] CloseHandle (hObject=0x1bc) returned 1 [0049.928] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0049.928] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.928] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0049.929] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.929] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.929] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c0 [0049.929] GetLastError () returned 0x0 [0049.929] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x333, lpOverlapped=0x0) returned 1 [0050.117] WriteFile (in: hFile=0x1c0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x340, lpOverlapped=0x0) returned 1 [0050.119] ReadFile (in: hFile=0x1bc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.119] WriteFile (in: hFile=0x1c0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0050.119] SetEndOfFile (hFile=0x1c0) returned 1 [0050.119] CloseHandle (hObject=0x1c0) returned 1 [0050.120] SetFilePointerEx (in: hFile=0x1bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.120] SetEndOfFile (hFile=0x1bc) returned 1 [0050.120] CloseHandle (hObject=0x1bc) returned 1 [0050.121] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.121] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0050.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.121] lstrlenW (lpString=".doc") returned 4 [0050.121] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.121] lstrlenW (lpString=".docx") returned 5 [0050.121] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0050.121] lstrlenW (lpString=".pdf") returned 4 [0050.121] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.121] lstrlenW (lpString=".xls") returned 4 [0050.121] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.121] lstrlenW (lpString=".xlsx") returned 5 [0050.121] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0050.121] lstrlenW (lpString=".ppt") returned 4 [0050.121] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.121] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.121] lstrlenW (lpString=".zip") returned 4 [0050.121] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.121] lstrlenW (lpString=".rar") returned 4 [0050.122] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.122] lstrlenW (lpString=".bz2") returned 4 [0050.122] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.122] lstrlenW (lpString=".7z") returned 3 [0050.122] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.122] lstrlenW (lpString=".dbf") returned 4 [0050.122] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.122] lstrlenW (lpString=".1cd") returned 4 [0050.122] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.122] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.122] lstrlenW (lpString=".jpg") returned 4 [0050.122] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.357] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.357] lstrlenW (lpString=".doc") returned 4 [0050.357] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.357] lstrlenW (lpString=".docx") returned 5 [0050.357] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0050.358] lstrlenW (lpString=".pdf") returned 4 [0050.358] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".xls") returned 4 [0050.358] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".xlsx") returned 5 [0050.358] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0050.358] lstrlenW (lpString=".ppt") returned 4 [0050.358] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.358] lstrlenW (lpString=".zip") returned 4 [0050.358] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.358] lstrlenW (lpString=".rar") returned 4 [0050.358] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".bz2") returned 4 [0050.358] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString=".7z") returned 3 [0050.358] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.358] lstrlenW (lpString=".dbf") returned 4 [0050.358] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.358] lstrlenW (lpString=".1cd") returned 4 [0050.358] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.358] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0050.358] lstrlenW (lpString=".jpg") returned 4 [0050.358] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.358] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0050.359] lstrlenW (lpString="Office32WW.xml") returned 14 [0050.359] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0050.626] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4274) returned 1 [0050.626] CloseHandle (hObject=0x168) returned 1 [0050.626] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0050.626] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.626] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0050.626] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.626] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.627] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.627] GetLastError () returned 0x0 [0050.627] ReadFile (in: hFile=0x168, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0050.628] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0050.629] ReadFile (in: hFile=0x168, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.629] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0050.629] SetEndOfFile (hFile=0x1b0) returned 1 [0050.630] CloseHandle (hObject=0x1b0) returned 1 [0050.631] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.631] SetEndOfFile (hFile=0x168) returned 1 [0050.631] CloseHandle (hObject=0x168) returned 1 [0050.632] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.632] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0050.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.632] lstrlenW (lpString=".doc") returned 4 [0050.632] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.632] lstrlenW (lpString=".docx") returned 5 [0050.632] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.632] lstrlenW (lpString=".pdf") returned 4 [0050.632] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.632] lstrlenW (lpString=".xls") returned 4 [0050.632] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.632] lstrlenW (lpString=".xlsx") returned 5 [0050.632] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.632] lstrlenW (lpString=".ppt") returned 4 [0050.632] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.632] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.632] lstrlenW (lpString=".zip") returned 4 [0050.632] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.633] lstrlenW (lpString=".rar") returned 4 [0050.633] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.633] lstrlenW (lpString=".bz2") returned 4 [0050.633] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.633] lstrlenW (lpString=".7z") returned 3 [0050.633] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.633] lstrlenW (lpString=".dbf") returned 4 [0050.633] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.633] lstrlenW (lpString=".1cd") returned 4 [0050.633] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.633] lstrlenW (lpString=".jpg") returned 4 [0050.633] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.633] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.633] lstrlenW (lpString=".doc") returned 4 [0050.633] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.633] lstrlenW (lpString=".docx") returned 5 [0050.633] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.633] lstrlenW (lpString=".pdf") returned 4 [0050.633] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.633] lstrlenW (lpString=".xls") returned 4 [0050.633] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.633] lstrlenW (lpString=".xlsx") returned 5 [0050.633] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.633] lstrlenW (lpString=".ppt") returned 4 [0050.633] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.634] lstrlenW (lpString=".zip") returned 4 [0050.634] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.634] lstrlenW (lpString=".rar") returned 4 [0050.634] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.634] lstrlenW (lpString=".bz2") returned 4 [0050.634] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.634] lstrlenW (lpString=".7z") returned 3 [0050.634] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.634] lstrlenW (lpString=".dbf") returned 4 [0050.634] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.634] lstrlenW (lpString=".1cd") returned 4 [0050.634] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.634] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0050.634] lstrlenW (lpString=".jpg") returned 4 [0050.634] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.635] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0050.635] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0050.635] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0050.637] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6421) returned 1 [0050.637] CloseHandle (hObject=0x168) returned 1 [0050.637] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0050.637] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0050.637] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.637] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.637] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.638] GetLastError () returned 0x0 [0050.638] ReadFile (in: hFile=0x168, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1915, lpOverlapped=0x0) returned 1 [0050.639] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0050.640] ReadFile (in: hFile=0x168, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.640] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xee, lpOverlapped=0x0) returned 1 [0050.640] SetEndOfFile (hFile=0x1b0) returned 1 [0050.640] CloseHandle (hObject=0x1b0) returned 1 [0050.641] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.641] SetEndOfFile (hFile=0x168) returned 1 [0050.643] CloseHandle (hObject=0x168) returned 1 [0050.643] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.643] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0050.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.644] lstrlenW (lpString=".doc") returned 4 [0050.644] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.644] lstrlenW (lpString=".docx") returned 5 [0050.644] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.644] lstrlenW (lpString=".pdf") returned 4 [0050.644] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.644] lstrlenW (lpString=".xls") returned 4 [0050.644] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.644] lstrlenW (lpString=".xlsx") returned 5 [0050.644] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.644] lstrlenW (lpString=".ppt") returned 4 [0050.644] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.644] lstrlenW (lpString=".zip") returned 4 [0050.644] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.644] lstrlenW (lpString=".rar") returned 4 [0050.644] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.644] lstrlenW (lpString=".bz2") returned 4 [0050.644] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.644] lstrlenW (lpString=".7z") returned 3 [0050.644] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.644] lstrlenW (lpString=".dbf") returned 4 [0050.644] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.644] lstrlenW (lpString=".1cd") returned 4 [0050.644] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.644] lstrlenW (lpString=".jpg") returned 4 [0050.645] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.645] lstrlenW (lpString=".doc") returned 4 [0050.645] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.645] lstrlenW (lpString=".docx") returned 5 [0050.645] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.645] lstrlenW (lpString=".pdf") returned 4 [0050.645] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.645] lstrlenW (lpString=".xls") returned 4 [0050.645] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.645] lstrlenW (lpString=".xlsx") returned 5 [0050.645] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.645] lstrlenW (lpString=".ppt") returned 4 [0050.645] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.645] lstrlenW (lpString=".zip") returned 4 [0050.645] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.645] lstrlenW (lpString=".rar") returned 4 [0050.645] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.645] lstrlenW (lpString=".bz2") returned 4 [0050.645] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.645] lstrlenW (lpString=".7z") returned 3 [0050.645] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.645] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.645] lstrlenW (lpString=".dbf") returned 4 [0050.645] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.646] lstrlenW (lpString=".1cd") returned 4 [0050.646] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.646] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0050.646] lstrlenW (lpString=".jpg") returned 4 [0050.646] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.646] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0050.646] lstrlenW (lpString="Setup.xml") returned 9 [0050.646] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0050.646] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=16683) returned 1 [0050.646] CloseHandle (hObject=0x168) returned 1 [0050.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0050.646] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0050.647] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.647] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.647] GetLastError () returned 0x0 [0050.647] ReadFile (in: hFile=0x168, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x412b, lpOverlapped=0x0) returned 1 [0050.649] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0050.650] ReadFile (in: hFile=0x168, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.650] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.650] SetEndOfFile (hFile=0x1b0) returned 1 [0050.650] CloseHandle (hObject=0x1b0) returned 1 [0050.651] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.651] SetEndOfFile (hFile=0x168) returned 1 [0050.652] CloseHandle (hObject=0x168) returned 1 [0050.652] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.653] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0050.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.653] lstrlenW (lpString=".doc") returned 4 [0050.653] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.653] lstrlenW (lpString=".docx") returned 5 [0050.653] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.653] lstrlenW (lpString=".pdf") returned 4 [0050.653] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.653] lstrlenW (lpString=".xls") returned 4 [0050.653] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.653] lstrlenW (lpString=".xlsx") returned 5 [0050.653] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.653] lstrlenW (lpString=".ppt") returned 4 [0050.653] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.653] lstrlenW (lpString=".zip") returned 4 [0050.653] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.653] lstrlenW (lpString=".rar") returned 4 [0050.653] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.653] lstrlenW (lpString=".bz2") returned 4 [0050.654] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.654] lstrlenW (lpString=".7z") returned 3 [0050.654] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.654] lstrlenW (lpString=".dbf") returned 4 [0050.654] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.654] lstrlenW (lpString=".1cd") returned 4 [0050.654] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.654] lstrlenW (lpString=".jpg") returned 4 [0050.654] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.654] lstrlenW (lpString=".doc") returned 4 [0050.654] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.654] lstrlenW (lpString=".docx") returned 5 [0050.654] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.654] lstrlenW (lpString=".pdf") returned 4 [0050.654] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.654] lstrlenW (lpString=".xls") returned 4 [0050.654] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.654] lstrlenW (lpString=".xlsx") returned 5 [0050.654] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.654] lstrlenW (lpString=".ppt") returned 4 [0050.655] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.655] lstrlenW (lpString=".zip") returned 4 [0050.655] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.655] lstrlenW (lpString=".rar") returned 4 [0050.655] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.655] lstrlenW (lpString=".bz2") returned 4 [0050.655] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.655] lstrlenW (lpString=".7z") returned 3 [0050.655] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.655] lstrlenW (lpString=".dbf") returned 4 [0050.655] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.655] lstrlenW (lpString=".1cd") returned 4 [0050.655] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.655] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.655] lstrlenW (lpString=".jpg") returned 4 [0050.655] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.655] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0050.655] lstrlenW (lpString="Office32WW.xml") returned 14 [0050.655] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0050.656] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4274) returned 1 [0050.656] CloseHandle (hObject=0x168) returned 1 [0050.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0050.656] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0050.657] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.657] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.657] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.657] GetLastError () returned 0x0 [0050.657] ReadFile (in: hFile=0x168, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0051.101] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0051.102] ReadFile (in: hFile=0x168, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.102] WriteFile (in: hFile=0x1b0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0051.102] SetEndOfFile (hFile=0x1b0) returned 1 [0051.102] CloseHandle (hObject=0x1b0) returned 1 [0051.103] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.103] SetEndOfFile (hFile=0x168) returned 1 [0051.104] CloseHandle (hObject=0x168) returned 1 [0051.104] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0051.104] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0051.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.105] lstrlenW (lpString=".doc") returned 4 [0051.105] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.105] lstrlenW (lpString=".docx") returned 5 [0051.105] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0051.105] lstrlenW (lpString=".pdf") returned 4 [0051.105] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.105] lstrlenW (lpString=".xls") returned 4 [0051.105] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.105] lstrlenW (lpString=".xlsx") returned 5 [0051.105] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0051.105] lstrlenW (lpString=".ppt") returned 4 [0051.105] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.105] lstrlenW (lpString=".zip") returned 4 [0051.105] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.105] lstrlenW (lpString=".rar") returned 4 [0051.105] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.105] lstrlenW (lpString=".bz2") returned 4 [0051.105] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.105] lstrlenW (lpString=".7z") returned 3 [0051.105] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.105] lstrlenW (lpString=".dbf") returned 4 [0051.105] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.105] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.105] lstrlenW (lpString=".1cd") returned 4 [0051.106] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.106] lstrlenW (lpString=".jpg") returned 4 [0051.106] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.106] lstrlenW (lpString=".doc") returned 4 [0051.106] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.106] lstrlenW (lpString=".docx") returned 5 [0051.106] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0051.106] lstrlenW (lpString=".pdf") returned 4 [0051.106] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.106] lstrlenW (lpString=".xls") returned 4 [0051.106] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.106] lstrlenW (lpString=".xlsx") returned 5 [0051.106] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0051.106] lstrlenW (lpString=".ppt") returned 4 [0051.106] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.106] lstrlenW (lpString=".zip") returned 4 [0051.106] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.106] lstrlenW (lpString=".rar") returned 4 [0051.106] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.106] lstrlenW (lpString=".bz2") returned 4 [0051.106] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.106] lstrlenW (lpString=".7z") returned 3 [0051.106] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.106] lstrlenW (lpString=".dbf") returned 4 [0051.106] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.106] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.107] lstrlenW (lpString=".1cd") returned 4 [0051.107] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0051.107] lstrlenW (lpString=".jpg") returned 4 [0051.107] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.107] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.107] lstrlenW (lpString="Alphabet.xml") returned 12 [0051.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0051.270] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=791686) returned 1 [0051.270] CloseHandle (hObject=0x1b4) returned 1 [0051.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0051.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.270] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.271] lstrlenW (lpString=".doc") returned 4 [0051.271] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.271] lstrlenW (lpString=".docx") returned 5 [0051.271] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0051.271] lstrlenW (lpString=".pdf") returned 4 [0051.271] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.271] lstrlenW (lpString=".xls") returned 4 [0051.271] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.271] lstrlenW (lpString=".xlsx") returned 5 [0051.271] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0051.271] lstrlenW (lpString=".ppt") returned 4 [0051.271] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.271] lstrlenW (lpString=".zip") returned 4 [0051.271] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.271] lstrlenW (lpString=".rar") returned 4 [0051.271] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.271] lstrlenW (lpString=".bz2") returned 4 [0051.271] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.271] lstrlenW (lpString=".7z") returned 3 [0051.271] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.271] lstrlenW (lpString=".dbf") returned 4 [0051.271] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.272] lstrlenW (lpString=".1cd") returned 4 [0051.272] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.272] lstrlenW (lpString=".jpg") returned 4 [0051.272] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.272] lstrlenW (lpString=".doc") returned 4 [0051.272] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.272] lstrlenW (lpString=".docx") returned 5 [0051.272] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0051.272] lstrlenW (lpString=".pdf") returned 4 [0051.272] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.272] lstrlenW (lpString=".xls") returned 4 [0051.272] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.272] lstrlenW (lpString=".xlsx") returned 5 [0051.272] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0051.272] lstrlenW (lpString=".ppt") returned 4 [0051.272] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.272] lstrlenW (lpString=".zip") returned 4 [0051.272] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.272] lstrlenW (lpString=".rar") returned 4 [0051.272] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.272] lstrlenW (lpString=".bz2") returned 4 [0051.272] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.272] lstrlenW (lpString=".7z") returned 3 [0051.272] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.272] lstrlenW (lpString=".dbf") returned 4 [0051.273] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.273] lstrlenW (lpString=".1cd") returned 4 [0051.273] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0051.273] lstrlenW (lpString=".jpg") returned 4 [0051.273] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.273] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.273] lstrlenW (lpString="auxbase.xml") returned 11 [0051.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0051.274] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1434) returned 1 [0051.274] CloseHandle (hObject=0x1b4) returned 1 [0051.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0051.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.274] lstrlenW (lpString=".doc") returned 4 [0051.274] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.274] lstrlenW (lpString=".docx") returned 5 [0051.274] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.274] lstrlenW (lpString=".pdf") returned 4 [0051.274] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.274] lstrlenW (lpString=".xls") returned 4 [0051.275] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.275] lstrlenW (lpString=".xlsx") returned 5 [0051.275] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.275] lstrlenW (lpString=".ppt") returned 4 [0051.275] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.275] lstrlenW (lpString=".zip") returned 4 [0051.275] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.275] lstrlenW (lpString=".rar") returned 4 [0051.275] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.275] lstrlenW (lpString=".bz2") returned 4 [0051.275] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.275] lstrlenW (lpString=".7z") returned 3 [0051.275] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.275] lstrlenW (lpString=".dbf") returned 4 [0051.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.275] lstrlenW (lpString=".1cd") returned 4 [0051.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.275] lstrlenW (lpString=".jpg") returned 4 [0051.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.275] lstrlenW (lpString=".doc") returned 4 [0051.275] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.275] lstrlenW (lpString=".docx") returned 5 [0051.275] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.275] lstrlenW (lpString=".pdf") returned 4 [0051.275] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString=".xls") returned 4 [0051.276] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString=".xlsx") returned 5 [0051.276] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.276] lstrlenW (lpString=".ppt") returned 4 [0051.276] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.276] lstrlenW (lpString=".zip") returned 4 [0051.276] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.276] lstrlenW (lpString=".rar") returned 4 [0051.276] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString=".bz2") returned 4 [0051.276] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString=".7z") returned 3 [0051.276] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.276] lstrlenW (lpString=".dbf") returned 4 [0051.276] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.276] lstrlenW (lpString=".1cd") returned 4 [0051.276] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.276] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0051.276] lstrlenW (lpString=".jpg") returned 4 [0051.276] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.276] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.276] lstrlenW (lpString="auxpad.xml") returned 10 [0051.277] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0051.277] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=212) returned 1 [0051.277] CloseHandle (hObject=0x1b4) returned 1 [0051.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0051.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.278] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.278] lstrlenW (lpString=".doc") returned 4 [0051.278] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.278] lstrlenW (lpString=".docx") returned 5 [0051.278] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0051.278] lstrlenW (lpString=".pdf") returned 4 [0051.278] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.278] lstrlenW (lpString=".xls") returned 4 [0051.278] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.278] lstrlenW (lpString=".xlsx") returned 5 [0051.278] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0051.278] lstrlenW (lpString=".ppt") returned 4 [0051.278] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.278] lstrlenW (lpString=".zip") returned 4 [0051.278] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.278] lstrlenW (lpString=".rar") returned 4 [0051.278] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.278] lstrlenW (lpString=".bz2") returned 4 [0051.278] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.278] lstrlenW (lpString=".7z") returned 3 [0051.278] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.278] lstrlenW (lpString=".dbf") returned 4 [0051.278] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.278] lstrlenW (lpString=".1cd") returned 4 [0051.278] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.279] lstrlenW (lpString=".jpg") returned 4 [0051.279] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.279] lstrlenW (lpString=".doc") returned 4 [0051.279] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.279] lstrlenW (lpString=".docx") returned 5 [0051.279] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0051.279] lstrlenW (lpString=".pdf") returned 4 [0051.279] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.279] lstrlenW (lpString=".xls") returned 4 [0051.279] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.279] lstrlenW (lpString=".xlsx") returned 5 [0051.279] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0051.279] lstrlenW (lpString=".ppt") returned 4 [0051.279] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.279] lstrlenW (lpString=".zip") returned 4 [0051.279] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.279] lstrlenW (lpString=".rar") returned 4 [0051.279] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.279] lstrlenW (lpString=".bz2") returned 4 [0051.279] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.279] lstrlenW (lpString=".7z") returned 3 [0051.279] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.279] lstrlenW (lpString=".dbf") returned 4 [0051.279] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.280] lstrlenW (lpString=".1cd") returned 4 [0051.280] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0051.280] lstrlenW (lpString=".jpg") returned 4 [0051.280] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.280] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.280] lstrlenW (lpString="ea.xml") returned 6 [0051.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0051.280] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=384) returned 1 [0051.280] CloseHandle (hObject=0x1b4) returned 1 [0051.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0051.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.280] lstrlenW (lpString=".doc") returned 4 [0051.281] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.281] lstrlenW (lpString=".docx") returned 5 [0051.281] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.281] lstrlenW (lpString=".pdf") returned 4 [0051.281] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.281] lstrlenW (lpString=".xls") returned 4 [0051.281] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.281] lstrlenW (lpString=".xlsx") returned 5 [0051.281] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.281] lstrlenW (lpString=".ppt") returned 4 [0051.281] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.281] lstrlenW (lpString=".zip") returned 4 [0051.281] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.281] lstrlenW (lpString=".rar") returned 4 [0051.281] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.281] lstrlenW (lpString=".bz2") returned 4 [0051.281] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.281] lstrlenW (lpString=".7z") returned 3 [0051.281] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.281] lstrlenW (lpString=".dbf") returned 4 [0051.281] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.281] lstrlenW (lpString=".1cd") returned 4 [0051.281] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.281] lstrlenW (lpString=".jpg") returned 4 [0051.281] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.282] lstrlenW (lpString=".doc") returned 4 [0051.282] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.282] lstrlenW (lpString=".docx") returned 5 [0051.282] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0051.282] lstrlenW (lpString=".pdf") returned 4 [0051.282] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.282] lstrlenW (lpString=".xls") returned 4 [0051.282] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.282] lstrlenW (lpString=".xlsx") returned 5 [0051.282] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0051.282] lstrlenW (lpString=".ppt") returned 4 [0051.282] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.282] lstrlenW (lpString=".zip") returned 4 [0051.282] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.282] lstrlenW (lpString=".rar") returned 4 [0051.282] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.282] lstrlenW (lpString=".bz2") returned 4 [0051.282] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.282] lstrlenW (lpString=".7z") returned 3 [0051.282] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.282] lstrlenW (lpString=".dbf") returned 4 [0051.282] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.282] lstrlenW (lpString=".1cd") returned 4 [0051.282] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0051.282] lstrlenW (lpString=".jpg") returned 4 [0051.282] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.283] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.283] lstrlenW (lpString="keypadbase.xml") returned 14 [0051.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0051.283] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1118) returned 1 [0051.283] CloseHandle (hObject=0x1b4) returned 1 [0051.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml")) returned 0x20 [0051.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.284] lstrlenW (lpString=".doc") returned 4 [0051.284] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.284] lstrlenW (lpString=".docx") returned 5 [0051.284] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.284] lstrlenW (lpString=".pdf") returned 4 [0051.284] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.284] lstrlenW (lpString=".xls") returned 4 [0051.284] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.284] lstrlenW (lpString=".xlsx") returned 5 [0051.284] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.284] lstrlenW (lpString=".ppt") returned 4 [0051.284] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.284] lstrlenW (lpString=".zip") returned 4 [0051.284] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.284] lstrlenW (lpString=".rar") returned 4 [0051.284] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.284] lstrlenW (lpString=".bz2") returned 4 [0051.284] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.284] lstrlenW (lpString=".7z") returned 3 [0051.284] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.284] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.285] lstrlenW (lpString=".dbf") returned 4 [0051.285] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.285] lstrlenW (lpString=".1cd") returned 4 [0051.285] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.285] lstrlenW (lpString=".jpg") returned 4 [0051.285] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.285] lstrlenW (lpString=".doc") returned 4 [0051.285] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.285] lstrlenW (lpString=".docx") returned 5 [0051.285] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.285] lstrlenW (lpString=".pdf") returned 4 [0051.285] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.285] lstrlenW (lpString=".xls") returned 4 [0051.285] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.285] lstrlenW (lpString=".xlsx") returned 5 [0051.285] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.285] lstrlenW (lpString=".ppt") returned 4 [0051.286] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.286] lstrlenW (lpString=".zip") returned 4 [0051.286] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.286] lstrlenW (lpString=".rar") returned 4 [0051.286] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.286] lstrlenW (lpString=".bz2") returned 4 [0051.286] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.286] lstrlenW (lpString=".7z") returned 3 [0051.286] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.286] lstrlenW (lpString=".dbf") returned 4 [0051.286] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.286] lstrlenW (lpString=".1cd") returned 4 [0051.286] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\keypadbase.xml") returned 86 [0051.286] lstrlenW (lpString=".jpg") returned 4 [0051.286] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.286] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.286] lstrlenW (lpString="kor-kor.xml") returned 11 [0051.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0051.287] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=392) returned 1 [0051.287] CloseHandle (hObject=0x1b4) returned 1 [0051.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml")) returned 0x20 [0051.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0051.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0051.287] lstrlenW (lpString=".doc") returned 4 [0051.287] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.287] lstrlenW (lpString=".docx") returned 5 [0051.287] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0051.287] lstrlenW (lpString=".pdf") returned 4 [0051.287] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.287] lstrlenW (lpString=".xls") returned 4 [0051.287] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.287] lstrlenW (lpString=".xlsx") returned 5 [0051.287] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0051.287] lstrlenW (lpString=".ppt") returned 4 [0051.287] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0051.287] lstrlenW (lpString=".zip") returned 4 [0051.287] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.287] lstrlenW (lpString=".rar") returned 4 [0051.287] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.288] lstrlenW (lpString=".bz2") returned 4 [0051.288] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.288] lstrlenW (lpString=".7z") returned 3 [0051.288] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\kor-kor.xml") returned 83 [0051.288] lstrlenW (lpString=".dbf") returned 4 [0051.288] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.455] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2227968) returned 1 [0053.455] CloseHandle (hObject=0x1dc) returned 1 [0053.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0053.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.455] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0053.828] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.828] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.829] GetLastError () returned 0x0 [0053.829] ReadFile (in: hFile=0x1f4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x795, lpOverlapped=0x0) returned 1 [0053.830] WriteFile (in: hFile=0x1f0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0053.831] ReadFile (in: hFile=0x1f4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.831] WriteFile (in: hFile=0x1f0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0053.831] SetEndOfFile (hFile=0x1f0) returned 1 [0053.831] CloseHandle (hObject=0x1f0) returned 1 [0053.832] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.832] SetEndOfFile (hFile=0x1f4) returned 1 [0053.833] CloseHandle (hObject=0x1f4) returned 1 [0053.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.833] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0053.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.834] lstrlenW (lpString=".doc") returned 4 [0053.834] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0053.834] lstrlenW (lpString=".docx") returned 5 [0053.834] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0053.834] lstrlenW (lpString=".pdf") returned 4 [0053.834] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0053.834] lstrlenW (lpString=".xls") returned 4 [0053.834] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0053.834] lstrlenW (lpString=".xlsx") returned 5 [0053.834] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0053.834] lstrlenW (lpString=".ppt") returned 4 [0053.834] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0053.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.834] lstrlenW (lpString=".zip") returned 4 [0053.834] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0053.834] lstrlenW (lpString=".rar") returned 4 [0053.834] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0053.834] lstrlenW (lpString=".bz2") returned 4 [0053.834] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0053.834] lstrlenW (lpString=".7z") returned 3 [0053.834] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0053.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.834] lstrlenW (lpString=".dbf") returned 4 [0053.834] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0053.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.834] lstrlenW (lpString=".1cd") returned 4 [0053.834] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0053.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.835] lstrlenW (lpString=".jpg") returned 4 [0053.835] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0053.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.835] lstrlenW (lpString=".doc") returned 4 [0053.835] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0053.835] lstrlenW (lpString=".docx") returned 5 [0053.835] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0053.835] lstrlenW (lpString=".pdf") returned 4 [0053.835] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0053.835] lstrlenW (lpString=".xls") returned 4 [0053.835] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0053.835] lstrlenW (lpString=".xlsx") returned 5 [0053.835] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0053.835] lstrlenW (lpString=".ppt") returned 4 [0053.835] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0053.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.835] lstrlenW (lpString=".zip") returned 4 [0053.835] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0053.835] lstrlenW (lpString=".rar") returned 4 [0053.835] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0053.835] lstrlenW (lpString=".bz2") returned 4 [0053.835] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0053.835] lstrlenW (lpString=".7z") returned 3 [0053.835] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0053.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.835] lstrlenW (lpString=".dbf") returned 4 [0053.835] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0053.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.835] lstrlenW (lpString=".1cd") returned 4 [0053.835] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0053.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0053.836] lstrlenW (lpString=".jpg") returned 4 [0053.836] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0053.836] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0053.836] lstrlenW (lpString="BRANDING.XML") returned 12 [0053.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.837] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=596341) returned 1 [0053.837] CloseHandle (hObject=0x1f4) returned 1 [0053.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0053.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.838] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.838] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.838] GetLastError () returned 0x0 [0053.838] ReadFile (in: hFile=0x1f4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x91975, lpOverlapped=0x0) returned 1 [0053.850] WriteFile (in: hFile=0x1f0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0053.861] ReadFile (in: hFile=0x1f4, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.861] WriteFile (in: hFile=0x1f0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.862] SetEndOfFile (hFile=0x1f0) returned 1 [0053.862] CloseHandle (hObject=0x1f0) returned 1 [0053.868] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.868] SetEndOfFile (hFile=0x1f4) returned 1 [0053.873] CloseHandle (hObject=0x1f4) returned 1 [0053.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.874] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0053.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0053.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0053.874] lstrlenW (lpString=".doc") returned 4 [0053.874] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.874] lstrlenW (lpString=".docx") returned 5 [0053.874] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0053.874] lstrlenW (lpString=".pdf") returned 4 [0053.874] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.874] lstrlenW (lpString=".xls") returned 4 [0053.874] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.874] lstrlenW (lpString=".xlsx") returned 5 [0053.874] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0053.874] lstrlenW (lpString=".ppt") returned 4 [0053.874] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0053.874] lstrlenW (lpString=".zip") returned 4 [0054.073] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.073] lstrlenW (lpString=".rar") returned 4 [0054.073] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.073] lstrlenW (lpString=".bz2") returned 4 [0054.073] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.073] lstrlenW (lpString=".7z") returned 3 [0054.073] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0054.073] lstrlenW (lpString=".dbf") returned 4 [0054.073] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0054.073] lstrlenW (lpString=".1cd") returned 4 [0054.073] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0054.073] lstrlenW (lpString=".jpg") returned 4 [0054.073] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0054.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0054.073] lstrlenW (lpString=".doc") returned 4 [0054.073] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.073] lstrlenW (lpString=".docx") returned 5 [0054.073] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0054.074] lstrlenW (lpString=".pdf") returned 4 [0054.074] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.074] lstrlenW (lpString=".xls") returned 4 [0054.074] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.074] lstrlenW (lpString=".xlsx") returned 5 [0054.074] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0054.074] lstrlenW (lpString=".ppt") returned 4 [0054.074] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0054.074] lstrlenW (lpString=".zip") returned 4 [0054.074] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.074] lstrlenW (lpString=".rar") returned 4 [0054.074] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.074] lstrlenW (lpString=".bz2") returned 4 [0054.074] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.074] lstrlenW (lpString=".7z") returned 3 [0054.074] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0054.074] lstrlenW (lpString=".dbf") returned 4 [0054.074] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0054.074] lstrlenW (lpString=".1cd") returned 4 [0054.074] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0054.074] lstrlenW (lpString=".jpg") returned 4 [0054.074] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.074] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0054.074] lstrlenW (lpString="OCT.CHM") returned 7 [0054.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.075] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=71236) returned 1 [0054.075] CloseHandle (hObject=0x1f0) returned 1 [0054.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0054.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.075] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.076] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0054.076] GetLastError () returned 0x0 [0054.076] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x11644, lpOverlapped=0x0) returned 1 [0054.080] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0054.082] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.082] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0054.082] SetEndOfFile (hFile=0x1f8) returned 1 [0054.082] CloseHandle (hObject=0x1f8) returned 1 [0054.084] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.084] SetEndOfFile (hFile=0x1f0) returned 1 [0054.085] CloseHandle (hObject=0x1f0) returned 1 [0054.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.085] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0054.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.085] lstrlenW (lpString=".doc") returned 4 [0054.085] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0054.085] lstrlenW (lpString=".docx") returned 5 [0054.085] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0054.085] lstrlenW (lpString=".pdf") returned 4 [0054.086] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0054.086] lstrlenW (lpString=".xls") returned 4 [0054.086] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0054.086] lstrlenW (lpString=".xlsx") returned 5 [0054.086] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0054.086] lstrlenW (lpString=".ppt") returned 4 [0054.086] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0054.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.086] lstrlenW (lpString=".zip") returned 4 [0054.086] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0054.086] lstrlenW (lpString=".rar") returned 4 [0054.086] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0054.086] lstrlenW (lpString=".bz2") returned 4 [0054.086] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0054.086] lstrlenW (lpString=".7z") returned 3 [0054.086] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0054.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.086] lstrlenW (lpString=".dbf") returned 4 [0054.086] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0054.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.086] lstrlenW (lpString=".1cd") returned 4 [0054.086] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0054.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.086] lstrlenW (lpString=".jpg") returned 4 [0054.086] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0054.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.086] lstrlenW (lpString=".doc") returned 4 [0054.086] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0054.086] lstrlenW (lpString=".docx") returned 5 [0054.086] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0054.086] lstrlenW (lpString=".pdf") returned 4 [0054.087] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0054.087] lstrlenW (lpString=".xls") returned 4 [0054.087] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0054.087] lstrlenW (lpString=".xlsx") returned 5 [0054.087] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0054.087] lstrlenW (lpString=".ppt") returned 4 [0054.087] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0054.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.087] lstrlenW (lpString=".zip") returned 4 [0054.087] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0054.087] lstrlenW (lpString=".rar") returned 4 [0054.087] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0054.087] lstrlenW (lpString=".bz2") returned 4 [0054.087] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0054.087] lstrlenW (lpString=".7z") returned 3 [0054.087] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0054.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.087] lstrlenW (lpString=".dbf") returned 4 [0054.087] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0054.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.087] lstrlenW (lpString=".1cd") returned 4 [0054.087] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0054.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0054.087] lstrlenW (lpString=".jpg") returned 4 [0054.087] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0054.087] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.087] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0054.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.088] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5557) returned 1 [0054.088] CloseHandle (hObject=0x1f0) returned 1 [0054.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0054.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.089] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.089] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0054.089] GetLastError () returned 0x0 [0054.089] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0054.091] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0054.092] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.092] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xee, lpOverlapped=0x0) returned 1 [0054.092] SetEndOfFile (hFile=0x1f8) returned 1 [0054.092] CloseHandle (hObject=0x1f8) returned 1 [0054.092] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.093] SetEndOfFile (hFile=0x1f0) returned 1 [0054.093] CloseHandle (hObject=0x1f0) returned 1 [0054.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.094] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0054.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.094] lstrlenW (lpString=".doc") returned 4 [0054.094] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.094] lstrlenW (lpString=".docx") returned 5 [0054.094] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.094] lstrlenW (lpString=".pdf") returned 4 [0054.094] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.094] lstrlenW (lpString=".xls") returned 4 [0054.094] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.094] lstrlenW (lpString=".xlsx") returned 5 [0054.094] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.094] lstrlenW (lpString=".ppt") returned 4 [0054.094] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.094] lstrlenW (lpString=".zip") returned 4 [0054.094] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.095] lstrlenW (lpString=".rar") returned 4 [0054.095] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.095] lstrlenW (lpString=".bz2") returned 4 [0054.095] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.095] lstrlenW (lpString=".7z") returned 3 [0054.095] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.095] lstrlenW (lpString=".dbf") returned 4 [0054.095] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.095] lstrlenW (lpString=".1cd") returned 4 [0054.095] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.095] lstrlenW (lpString=".jpg") returned 4 [0054.095] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.095] lstrlenW (lpString=".doc") returned 4 [0054.095] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.095] lstrlenW (lpString=".docx") returned 5 [0054.095] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.095] lstrlenW (lpString=".pdf") returned 4 [0054.095] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.095] lstrlenW (lpString=".xls") returned 4 [0054.095] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.095] lstrlenW (lpString=".xlsx") returned 5 [0054.095] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.095] lstrlenW (lpString=".ppt") returned 4 [0054.095] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.095] lstrlenW (lpString=".zip") returned 4 [0054.095] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.095] lstrlenW (lpString=".rar") returned 4 [0054.096] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.096] lstrlenW (lpString=".bz2") returned 4 [0054.096] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.096] lstrlenW (lpString=".7z") returned 3 [0054.096] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.096] lstrlenW (lpString=".dbf") returned 4 [0054.096] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.096] lstrlenW (lpString=".1cd") returned 4 [0054.096] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0054.096] lstrlenW (lpString=".jpg") returned 4 [0054.096] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.096] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.096] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0054.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.096] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=819) returned 1 [0054.096] CloseHandle (hObject=0x1f0) returned 1 [0054.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0054.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.097] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.097] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0054.097] GetLastError () returned 0x0 [0054.097] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x333, lpOverlapped=0x0) returned 1 [0054.099] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x340, lpOverlapped=0x0) returned 1 [0054.099] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.099] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0054.100] SetEndOfFile (hFile=0x1f8) returned 1 [0054.100] CloseHandle (hObject=0x1f8) returned 1 [0054.100] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.100] SetEndOfFile (hFile=0x1f0) returned 1 [0054.101] CloseHandle (hObject=0x1f0) returned 1 [0054.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.101] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0054.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.102] lstrlenW (lpString=".doc") returned 4 [0054.102] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.102] lstrlenW (lpString=".docx") returned 5 [0054.102] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0054.102] lstrlenW (lpString=".pdf") returned 4 [0054.102] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.102] lstrlenW (lpString=".xls") returned 4 [0054.102] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.102] lstrlenW (lpString=".xlsx") returned 5 [0054.102] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0054.102] lstrlenW (lpString=".ppt") returned 4 [0054.102] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.102] lstrlenW (lpString=".zip") returned 4 [0054.102] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.102] lstrlenW (lpString=".rar") returned 4 [0054.102] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.102] lstrlenW (lpString=".bz2") returned 4 [0054.102] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.102] lstrlenW (lpString=".7z") returned 3 [0054.102] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.102] lstrlenW (lpString=".dbf") returned 4 [0054.102] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.102] lstrlenW (lpString=".1cd") returned 4 [0054.102] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.103] lstrlenW (lpString=".jpg") returned 4 [0054.103] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.103] lstrlenW (lpString=".doc") returned 4 [0054.103] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.103] lstrlenW (lpString=".docx") returned 5 [0054.103] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0054.103] lstrlenW (lpString=".pdf") returned 4 [0054.103] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.103] lstrlenW (lpString=".xls") returned 4 [0054.103] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.103] lstrlenW (lpString=".xlsx") returned 5 [0054.103] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0054.103] lstrlenW (lpString=".ppt") returned 4 [0054.103] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.103] lstrlenW (lpString=".zip") returned 4 [0054.103] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.103] lstrlenW (lpString=".rar") returned 4 [0054.103] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.103] lstrlenW (lpString=".bz2") returned 4 [0054.103] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.103] lstrlenW (lpString=".7z") returned 3 [0054.103] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.103] lstrlenW (lpString=".dbf") returned 4 [0054.103] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.103] lstrlenW (lpString=".1cd") returned 4 [0054.103] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0054.104] lstrlenW (lpString=".jpg") returned 4 [0054.104] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.104] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0054.104] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0054.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.105] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=37689) returned 1 [0054.105] CloseHandle (hObject=0x1f0) returned 1 [0054.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0054.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.105] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.105] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0054.105] GetLastError () returned 0x0 [0054.105] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x9339, lpOverlapped=0x0) returned 1 [0054.205] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0054.460] ReadFile (in: hFile=0x1f0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.461] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0054.461] SetEndOfFile (hFile=0x1f8) returned 1 [0054.461] CloseHandle (hObject=0x1f8) returned 1 [0054.462] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.462] SetEndOfFile (hFile=0x1f0) returned 1 [0054.463] CloseHandle (hObject=0x1f0) returned 1 [0054.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.463] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0055.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.247] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.247] lstrlenW (lpString=".doc") returned 4 [0055.247] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.248] lstrlenW (lpString=".docx") returned 5 [0055.248] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0055.248] lstrlenW (lpString=".pdf") returned 4 [0055.248] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.248] lstrlenW (lpString=".xls") returned 4 [0055.248] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.248] lstrlenW (lpString=".xlsx") returned 5 [0055.248] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0055.248] lstrlenW (lpString=".ppt") returned 4 [0055.248] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.248] lstrlenW (lpString=".zip") returned 4 [0055.248] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.248] lstrlenW (lpString=".rar") returned 4 [0055.248] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.248] lstrlenW (lpString=".bz2") returned 4 [0055.248] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.248] lstrlenW (lpString=".7z") returned 3 [0055.248] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.248] lstrlenW (lpString=".dbf") returned 4 [0055.248] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.248] lstrlenW (lpString=".1cd") returned 4 [0055.248] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.248] lstrlenW (lpString=".jpg") returned 4 [0055.248] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.248] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.248] lstrlenW (lpString=".doc") returned 4 [0055.248] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0055.249] lstrlenW (lpString=".docx") returned 5 [0055.249] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0055.249] lstrlenW (lpString=".pdf") returned 4 [0055.249] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0055.249] lstrlenW (lpString=".xls") returned 4 [0055.249] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0055.249] lstrlenW (lpString=".xlsx") returned 5 [0055.249] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0055.249] lstrlenW (lpString=".ppt") returned 4 [0055.249] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0055.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.249] lstrlenW (lpString=".zip") returned 4 [0055.249] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0055.249] lstrlenW (lpString=".rar") returned 4 [0055.249] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0055.249] lstrlenW (lpString=".bz2") returned 4 [0055.249] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0055.249] lstrlenW (lpString=".7z") returned 3 [0055.249] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0055.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.249] lstrlenW (lpString=".dbf") returned 4 [0055.249] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0055.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.249] lstrlenW (lpString=".1cd") returned 4 [0055.249] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0055.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0055.249] lstrlenW (lpString=".jpg") returned 4 [0055.249] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0055.249] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.250] lstrlenW (lpString="SETUP.XML") returned 9 [0055.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.278] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=16683) returned 1 [0055.279] CloseHandle (hObject=0x20c) returned 1 [0055.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0055.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.279] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.279] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0055.279] GetLastError () returned 0x0 [0055.279] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x412b, lpOverlapped=0x0) returned 1 [0055.284] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0055.285] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.285] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.285] SetEndOfFile (hFile=0x210) returned 1 [0055.536] CloseHandle (hObject=0x210) returned 1 [0055.537] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.537] SetEndOfFile (hFile=0x20c) returned 1 [0055.538] CloseHandle (hObject=0x20c) returned 1 [0055.538] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.539] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0055.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.539] lstrlenW (lpString=".doc") returned 4 [0055.539] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.539] lstrlenW (lpString=".docx") returned 5 [0055.539] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0055.539] lstrlenW (lpString=".pdf") returned 4 [0055.539] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.539] lstrlenW (lpString=".xls") returned 4 [0055.539] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.539] lstrlenW (lpString=".xlsx") returned 5 [0055.539] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0055.539] lstrlenW (lpString=".ppt") returned 4 [0055.539] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.539] lstrlenW (lpString=".zip") returned 4 [0055.539] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.539] lstrlenW (lpString=".rar") returned 4 [0055.539] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.539] lstrlenW (lpString=".bz2") returned 4 [0055.539] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.539] lstrlenW (lpString=".7z") returned 3 [0055.539] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.540] lstrlenW (lpString=".dbf") returned 4 [0055.540] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.540] lstrlenW (lpString=".1cd") returned 4 [0055.540] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.540] lstrlenW (lpString=".jpg") returned 4 [0055.540] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.540] lstrlenW (lpString=".doc") returned 4 [0055.540] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.540] lstrlenW (lpString=".docx") returned 5 [0055.540] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0055.540] lstrlenW (lpString=".pdf") returned 4 [0055.540] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.540] lstrlenW (lpString=".xls") returned 4 [0055.540] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.540] lstrlenW (lpString=".xlsx") returned 5 [0055.540] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0055.540] lstrlenW (lpString=".ppt") returned 4 [0055.540] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.540] lstrlenW (lpString=".zip") returned 4 [0055.540] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.540] lstrlenW (lpString=".rar") returned 4 [0055.540] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.540] lstrlenW (lpString=".bz2") returned 4 [0055.540] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.540] lstrlenW (lpString=".7z") returned 3 [0055.540] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.540] lstrlenW (lpString=".dbf") returned 4 [0055.541] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.541] lstrlenW (lpString=".1cd") returned 4 [0055.541] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.541] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0055.541] lstrlenW (lpString=".jpg") returned 4 [0055.541] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.541] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.541] lstrlenW (lpString="Proof.XML") returned 9 [0055.541] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.545] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1457) returned 1 [0055.545] CloseHandle (hObject=0x20c) returned 1 [0055.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0055.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.545] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.545] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0055.545] GetLastError () returned 0x0 [0055.545] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0055.547] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0055.549] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.549] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.549] SetEndOfFile (hFile=0x210) returned 1 [0055.549] CloseHandle (hObject=0x210) returned 1 [0055.550] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.550] SetEndOfFile (hFile=0x20c) returned 1 [0055.550] CloseHandle (hObject=0x20c) returned 1 [0055.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.551] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0055.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.551] lstrlenW (lpString=".doc") returned 4 [0055.551] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.551] lstrlenW (lpString=".docx") returned 5 [0055.551] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0055.551] lstrlenW (lpString=".pdf") returned 4 [0055.551] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.551] lstrlenW (lpString=".xls") returned 4 [0055.551] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.551] lstrlenW (lpString=".xlsx") returned 5 [0055.551] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0055.551] lstrlenW (lpString=".ppt") returned 4 [0055.551] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.552] lstrlenW (lpString=".zip") returned 4 [0055.552] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.552] lstrlenW (lpString=".rar") returned 4 [0055.552] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.552] lstrlenW (lpString=".bz2") returned 4 [0055.552] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.552] lstrlenW (lpString=".7z") returned 3 [0055.552] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.552] lstrlenW (lpString=".dbf") returned 4 [0055.552] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.552] lstrlenW (lpString=".1cd") returned 4 [0055.552] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.552] lstrlenW (lpString=".jpg") returned 4 [0055.552] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.552] lstrlenW (lpString=".doc") returned 4 [0055.552] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.552] lstrlenW (lpString=".docx") returned 5 [0055.552] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0055.552] lstrlenW (lpString=".pdf") returned 4 [0055.552] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.552] lstrlenW (lpString=".xls") returned 4 [0055.552] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.552] lstrlenW (lpString=".xlsx") returned 5 [0055.552] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0055.552] lstrlenW (lpString=".ppt") returned 4 [0055.552] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.553] lstrlenW (lpString=".zip") returned 4 [0055.553] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.553] lstrlenW (lpString=".rar") returned 4 [0055.553] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.553] lstrlenW (lpString=".bz2") returned 4 [0055.553] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.553] lstrlenW (lpString=".7z") returned 3 [0055.553] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.553] lstrlenW (lpString=".dbf") returned 4 [0055.553] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.553] lstrlenW (lpString=".1cd") returned 4 [0055.553] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0055.553] lstrlenW (lpString=".jpg") returned 4 [0055.553] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.553] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.553] lstrlenW (lpString="Proof.XML") returned 9 [0055.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.554] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1458) returned 1 [0055.554] CloseHandle (hObject=0x20c) returned 1 [0055.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0055.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.554] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.554] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0055.554] GetLastError () returned 0x0 [0055.554] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0055.556] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0055.557] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.557] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.557] SetEndOfFile (hFile=0x210) returned 1 [0055.557] CloseHandle (hObject=0x210) returned 1 [0055.558] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.558] SetEndOfFile (hFile=0x20c) returned 1 [0055.559] CloseHandle (hObject=0x20c) returned 1 [0055.559] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.559] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0055.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.560] lstrlenW (lpString=".doc") returned 4 [0055.560] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.560] lstrlenW (lpString=".docx") returned 5 [0055.560] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0055.560] lstrlenW (lpString=".pdf") returned 4 [0055.560] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.560] lstrlenW (lpString=".xls") returned 4 [0055.560] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.560] lstrlenW (lpString=".xlsx") returned 5 [0055.560] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0055.560] lstrlenW (lpString=".ppt") returned 4 [0055.560] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.560] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.560] lstrlenW (lpString=".zip") returned 4 [0055.560] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.560] lstrlenW (lpString=".rar") returned 4 [0055.560] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.561] lstrlenW (lpString=".bz2") returned 4 [0055.561] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.561] lstrlenW (lpString=".7z") returned 3 [0055.561] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.561] lstrlenW (lpString=".dbf") returned 4 [0055.561] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.561] lstrlenW (lpString=".1cd") returned 4 [0055.561] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.561] lstrlenW (lpString=".jpg") returned 4 [0055.561] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.561] lstrlenW (lpString=".doc") returned 4 [0055.561] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.561] lstrlenW (lpString=".docx") returned 5 [0055.561] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0055.561] lstrlenW (lpString=".pdf") returned 4 [0055.561] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.561] lstrlenW (lpString=".xls") returned 4 [0055.561] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.561] lstrlenW (lpString=".xlsx") returned 5 [0055.561] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0055.561] lstrlenW (lpString=".ppt") returned 4 [0055.561] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.561] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.561] lstrlenW (lpString=".zip") returned 4 [0055.561] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.561] lstrlenW (lpString=".rar") returned 4 [0055.561] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.561] lstrlenW (lpString=".bz2") returned 4 [0055.562] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.562] lstrlenW (lpString=".7z") returned 3 [0055.562] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.562] lstrlenW (lpString=".dbf") returned 4 [0055.562] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.562] lstrlenW (lpString=".1cd") returned 4 [0055.562] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0055.562] lstrlenW (lpString=".jpg") returned 4 [0055.562] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.562] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.562] lstrlenW (lpString="Proofing.XML") returned 12 [0055.562] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.563] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=811) returned 1 [0055.563] CloseHandle (hObject=0x20c) returned 1 [0055.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0055.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0055.563] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.563] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0055.564] GetLastError () returned 0x0 [0055.564] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x32b, lpOverlapped=0x0) returned 1 [0055.778] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x330, lpOverlapped=0x0) returned 1 [0055.779] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.779] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.779] SetEndOfFile (hFile=0x210) returned 1 [0056.234] CloseHandle (hObject=0x210) returned 1 [0056.235] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.235] SetEndOfFile (hFile=0x20c) returned 1 [0056.273] CloseHandle (hObject=0x20c) returned 1 [0056.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.273] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0056.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.274] lstrlenW (lpString=".doc") returned 4 [0056.274] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.274] lstrlenW (lpString=".docx") returned 5 [0056.274] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0056.274] lstrlenW (lpString=".pdf") returned 4 [0056.274] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.274] lstrlenW (lpString=".xls") returned 4 [0056.274] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.274] lstrlenW (lpString=".xlsx") returned 5 [0056.274] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0056.274] lstrlenW (lpString=".ppt") returned 4 [0056.274] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.274] lstrlenW (lpString=".zip") returned 4 [0056.274] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.274] lstrlenW (lpString=".rar") returned 4 [0056.274] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.274] lstrlenW (lpString=".bz2") returned 4 [0056.274] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.274] lstrlenW (lpString=".7z") returned 3 [0056.274] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.274] lstrlenW (lpString=".dbf") returned 4 [0056.274] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.274] lstrlenW (lpString=".1cd") returned 4 [0056.274] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.274] lstrlenW (lpString=".jpg") returned 4 [0056.274] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.274] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.275] lstrlenW (lpString=".doc") returned 4 [0056.275] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.275] lstrlenW (lpString=".docx") returned 5 [0056.275] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0056.275] lstrlenW (lpString=".pdf") returned 4 [0056.275] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.275] lstrlenW (lpString=".xls") returned 4 [0056.275] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.275] lstrlenW (lpString=".xlsx") returned 5 [0056.275] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0056.275] lstrlenW (lpString=".ppt") returned 4 [0056.275] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.275] lstrlenW (lpString=".zip") returned 4 [0056.275] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.275] lstrlenW (lpString=".rar") returned 4 [0056.275] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.275] lstrlenW (lpString=".bz2") returned 4 [0056.275] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.275] lstrlenW (lpString=".7z") returned 3 [0056.275] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.275] lstrlenW (lpString=".dbf") returned 4 [0056.275] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.275] lstrlenW (lpString=".1cd") returned 4 [0056.275] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.275] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0056.275] lstrlenW (lpString=".jpg") returned 4 [0056.275] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.276] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.276] lstrlenW (lpString="WordMUI.XML") returned 11 [0056.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0056.599] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1800) returned 1 [0056.599] CloseHandle (hObject=0x1f8) returned 1 [0056.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0056.599] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0056.599] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.599] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.599] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0056.670] GetLastError () returned 0x0 [0056.670] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x708, lpOverlapped=0x0) returned 1 [0056.699] WriteFile (in: hFile=0x1e8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x710, lpOverlapped=0x0) returned 1 [0056.700] ReadFile (in: hFile=0x1f8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.700] WriteFile (in: hFile=0x1e8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.701] SetEndOfFile (hFile=0x1e8) returned 1 [0056.701] CloseHandle (hObject=0x1e8) returned 1 [0056.701] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.701] SetEndOfFile (hFile=0x1f8) returned 1 [0056.702] CloseHandle (hObject=0x1f8) returned 1 [0056.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.702] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.702] lstrlenW (lpString=".doc") returned 4 [0056.702] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.702] lstrlenW (lpString=".docx") returned 5 [0056.702] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0056.702] lstrlenW (lpString=".pdf") returned 4 [0056.702] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.702] lstrlenW (lpString=".xls") returned 4 [0056.703] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.703] lstrlenW (lpString=".xlsx") returned 5 [0056.703] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0056.703] lstrlenW (lpString=".ppt") returned 4 [0056.703] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.703] lstrlenW (lpString=".zip") returned 4 [0056.703] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.703] lstrlenW (lpString=".rar") returned 4 [0056.703] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.703] lstrlenW (lpString=".bz2") returned 4 [0056.703] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.703] lstrlenW (lpString=".7z") returned 3 [0056.703] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.703] lstrlenW (lpString=".dbf") returned 4 [0056.703] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.703] lstrlenW (lpString=".1cd") returned 4 [0056.703] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.703] lstrlenW (lpString=".jpg") returned 4 [0056.703] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.703] lstrlenW (lpString=".doc") returned 4 [0056.703] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.703] lstrlenW (lpString=".docx") returned 5 [0056.703] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0056.703] lstrlenW (lpString=".pdf") returned 4 [0056.703] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.703] lstrlenW (lpString=".xls") returned 4 [0056.703] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.704] lstrlenW (lpString=".xlsx") returned 5 [0056.704] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0056.704] lstrlenW (lpString=".ppt") returned 4 [0056.704] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.704] lstrlenW (lpString=".zip") returned 4 [0056.704] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.704] lstrlenW (lpString=".rar") returned 4 [0056.704] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.704] lstrlenW (lpString=".bz2") returned 4 [0056.704] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.704] lstrlenW (lpString=".7z") returned 3 [0056.704] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.704] lstrlenW (lpString=".dbf") returned 4 [0056.704] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.704] lstrlenW (lpString=".1cd") returned 4 [0056.704] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0056.704] lstrlenW (lpString=".jpg") returned 4 [0056.704] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.704] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0056.704] lstrlenW (lpString="Bears.jpg") returned 9 [0056.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.706] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1074) returned 1 [0056.706] CloseHandle (hObject=0x214) returned 1 [0056.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0056.706] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.706] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.706] lstrlenW (lpString=".doc") returned 4 [0056.706] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.706] lstrlenW (lpString=".docx") returned 5 [0056.706] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0056.706] lstrlenW (lpString=".pdf") returned 4 [0056.706] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.706] lstrlenW (lpString=".xls") returned 4 [0056.706] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.706] lstrlenW (lpString=".xlsx") returned 5 [0056.706] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0056.707] lstrlenW (lpString=".ppt") returned 4 [0056.707] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.707] lstrlenW (lpString=".zip") returned 4 [0056.707] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.707] lstrlenW (lpString=".rar") returned 4 [0056.707] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.707] lstrlenW (lpString=".bz2") returned 4 [0056.707] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.707] lstrlenW (lpString=".7z") returned 3 [0056.707] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.707] lstrlenW (lpString=".dbf") returned 4 [0056.707] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0056.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.707] lstrlenW (lpString=".1cd") returned 4 [0056.707] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0056.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.707] lstrlenW (lpString=".jpg") returned 4 [0056.707] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0056.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.707] lstrlenW (lpString=".doc") returned 4 [0056.707] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.707] lstrlenW (lpString=".docx") returned 5 [0056.707] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0056.707] lstrlenW (lpString=".pdf") returned 4 [0056.707] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.707] lstrlenW (lpString=".xls") returned 4 [0056.707] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.707] lstrlenW (lpString=".xlsx") returned 5 [0056.707] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0056.707] lstrlenW (lpString=".ppt") returned 4 [0056.708] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.708] lstrlenW (lpString=".zip") returned 4 [0056.708] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.708] lstrlenW (lpString=".rar") returned 4 [0056.708] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.708] lstrlenW (lpString=".bz2") returned 4 [0056.708] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.708] lstrlenW (lpString=".7z") returned 3 [0056.708] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.708] lstrlenW (lpString=".dbf") returned 4 [0056.708] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0056.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.708] lstrlenW (lpString=".1cd") returned 4 [0056.708] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0056.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0056.708] lstrlenW (lpString=".jpg") returned 4 [0056.708] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0056.708] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0056.708] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0056.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0058.323] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2575) returned 1 [0058.323] CloseHandle (hObject=0x1f8) returned 1 [0058.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0058.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.323] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.323] lstrlenW (lpString=".doc") returned 4 [0058.323] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0058.323] lstrlenW (lpString=".docx") returned 5 [0058.323] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0058.323] lstrlenW (lpString=".pdf") returned 4 [0058.323] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0058.323] lstrlenW (lpString=".xls") returned 4 [0058.323] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0058.323] lstrlenW (lpString=".xlsx") returned 5 [0058.324] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0058.324] lstrlenW (lpString=".ppt") returned 4 [0058.324] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0058.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.324] lstrlenW (lpString=".zip") returned 4 [0058.324] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0058.324] lstrlenW (lpString=".rar") returned 4 [0058.324] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0058.324] lstrlenW (lpString=".bz2") returned 4 [0058.324] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0058.324] lstrlenW (lpString=".7z") returned 3 [0058.324] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0058.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.324] lstrlenW (lpString=".dbf") returned 4 [0058.324] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0058.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.324] lstrlenW (lpString=".1cd") returned 4 [0058.324] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0058.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.324] lstrlenW (lpString=".jpg") returned 4 [0058.324] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0058.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.324] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.324] lstrlenW (lpString=".doc") returned 4 [0058.324] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0058.324] lstrlenW (lpString=".docx") returned 5 [0058.324] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0058.324] lstrlenW (lpString=".pdf") returned 4 [0058.324] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0058.324] lstrlenW (lpString=".xls") returned 4 [0058.324] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0058.324] lstrlenW (lpString=".xlsx") returned 5 [0058.324] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0058.325] lstrlenW (lpString=".ppt") returned 4 [0058.325] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0058.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.325] lstrlenW (lpString=".zip") returned 4 [0058.325] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0058.325] lstrlenW (lpString=".rar") returned 4 [0058.325] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0058.325] lstrlenW (lpString=".bz2") returned 4 [0058.325] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0058.325] lstrlenW (lpString=".7z") returned 3 [0058.325] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0058.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.325] lstrlenW (lpString=".dbf") returned 4 [0058.325] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0058.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.325] lstrlenW (lpString=".1cd") returned 4 [0058.325] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0058.325] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0058.325] lstrlenW (lpString=".jpg") returned 4 [0058.325] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0058.325] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0058.325] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.831] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=34916) returned 1 [0058.831] CloseHandle (hObject=0x180) returned 1 [0058.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0058.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.831] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.831] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0058.832] GetLastError () returned 0x0 [0058.832] ReadFile (in: hFile=0x180, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x8864, lpOverlapped=0x0) returned 1 [0058.868] WriteFile (in: hFile=0x1fc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0058.870] ReadFile (in: hFile=0x180, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.870] WriteFile (in: hFile=0x1fc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.870] SetEndOfFile (hFile=0x1fc) returned 1 [0058.870] CloseHandle (hObject=0x1fc) returned 1 [0058.870] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.870] SetEndOfFile (hFile=0x180) returned 1 [0058.871] CloseHandle (hObject=0x180) returned 1 [0058.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.871] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0058.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.872] lstrlenW (lpString=".doc") returned 4 [0058.872] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.872] lstrlenW (lpString=".docx") returned 5 [0058.872] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.872] lstrlenW (lpString=".pdf") returned 4 [0058.872] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.872] lstrlenW (lpString=".xls") returned 4 [0058.872] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.872] lstrlenW (lpString=".xlsx") returned 5 [0058.872] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.872] lstrlenW (lpString=".ppt") returned 4 [0058.872] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.872] lstrlenW (lpString=".zip") returned 4 [0058.872] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.872] lstrlenW (lpString=".rar") returned 4 [0058.872] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.872] lstrlenW (lpString=".bz2") returned 4 [0058.872] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.872] lstrlenW (lpString=".7z") returned 3 [0058.872] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.872] lstrlenW (lpString=".dbf") returned 4 [0058.872] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.872] lstrlenW (lpString=".1cd") returned 4 [0058.872] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.872] lstrlenW (lpString=".jpg") returned 4 [0058.872] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.873] lstrlenW (lpString=".doc") returned 4 [0058.873] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.873] lstrlenW (lpString=".docx") returned 5 [0058.873] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.873] lstrlenW (lpString=".pdf") returned 4 [0058.873] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.873] lstrlenW (lpString=".xls") returned 4 [0058.873] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.873] lstrlenW (lpString=".xlsx") returned 5 [0058.873] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.873] lstrlenW (lpString=".ppt") returned 4 [0058.873] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.873] lstrlenW (lpString=".zip") returned 4 [0058.873] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.873] lstrlenW (lpString=".rar") returned 4 [0058.873] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.873] lstrlenW (lpString=".bz2") returned 4 [0058.873] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.873] lstrlenW (lpString=".7z") returned 3 [0058.873] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.873] lstrlenW (lpString=".dbf") returned 4 [0058.873] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.873] lstrlenW (lpString=".1cd") returned 4 [0058.873] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0058.873] lstrlenW (lpString=".jpg") returned 4 [0058.873] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.874] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0058.874] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.874] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1925) returned 1 [0058.874] CloseHandle (hObject=0x180) returned 1 [0058.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0058.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.874] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.874] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.875] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0058.914] GetLastError () returned 0x0 [0058.914] ReadFile (in: hFile=0x180, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x785, lpOverlapped=0x0) returned 1 [0058.918] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x790, lpOverlapped=0x0) returned 1 [0058.919] ReadFile (in: hFile=0x180, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.919] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.919] SetEndOfFile (hFile=0x200) returned 1 [0058.919] CloseHandle (hObject=0x200) returned 1 [0058.919] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.919] SetEndOfFile (hFile=0x180) returned 1 [0058.920] CloseHandle (hObject=0x180) returned 1 [0058.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.920] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0058.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.920] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.921] lstrlenW (lpString=".doc") returned 4 [0058.921] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.921] lstrlenW (lpString=".docx") returned 5 [0058.921] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.921] lstrlenW (lpString=".pdf") returned 4 [0058.921] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.921] lstrlenW (lpString=".xls") returned 4 [0058.921] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.921] lstrlenW (lpString=".xlsx") returned 5 [0058.921] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.921] lstrlenW (lpString=".ppt") returned 4 [0058.921] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.921] lstrlenW (lpString=".zip") returned 4 [0058.921] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.921] lstrlenW (lpString=".rar") returned 4 [0058.921] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.921] lstrlenW (lpString=".bz2") returned 4 [0058.921] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.921] lstrlenW (lpString=".7z") returned 3 [0058.921] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.921] lstrlenW (lpString=".dbf") returned 4 [0058.921] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.921] lstrlenW (lpString=".1cd") returned 4 [0058.921] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.921] lstrlenW (lpString=".jpg") returned 4 [0058.921] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.921] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.922] lstrlenW (lpString=".doc") returned 4 [0058.922] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.922] lstrlenW (lpString=".docx") returned 5 [0058.922] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.922] lstrlenW (lpString=".pdf") returned 4 [0058.922] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.922] lstrlenW (lpString=".xls") returned 4 [0058.922] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.922] lstrlenW (lpString=".xlsx") returned 5 [0058.922] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.922] lstrlenW (lpString=".ppt") returned 4 [0058.922] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.922] lstrlenW (lpString=".zip") returned 4 [0058.922] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.922] lstrlenW (lpString=".rar") returned 4 [0058.922] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.922] lstrlenW (lpString=".bz2") returned 4 [0058.922] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.922] lstrlenW (lpString=".7z") returned 3 [0058.922] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.922] lstrlenW (lpString=".dbf") returned 4 [0058.922] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.922] lstrlenW (lpString=".1cd") returned 4 [0058.922] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.922] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0058.922] lstrlenW (lpString=".jpg") returned 4 [0058.922] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.923] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0058.923] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.924] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=27407) returned 1 [0058.924] CloseHandle (hObject=0x180) returned 1 [0058.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0058.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.924] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.924] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0058.925] GetLastError () returned 0x0 [0058.925] ReadFile (in: hFile=0x180, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0058.928] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0058.929] ReadFile (in: hFile=0x180, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.929] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.929] SetEndOfFile (hFile=0x200) returned 1 [0058.930] CloseHandle (hObject=0x200) returned 1 [0058.930] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.930] SetEndOfFile (hFile=0x180) returned 1 [0058.931] CloseHandle (hObject=0x180) returned 1 [0058.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.931] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0058.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.931] lstrlenW (lpString=".doc") returned 4 [0058.931] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.931] lstrlenW (lpString=".docx") returned 5 [0058.931] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.931] lstrlenW (lpString=".pdf") returned 4 [0058.932] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.932] lstrlenW (lpString=".xls") returned 4 [0058.932] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.932] lstrlenW (lpString=".xlsx") returned 5 [0058.932] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.932] lstrlenW (lpString=".ppt") returned 4 [0058.932] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.932] lstrlenW (lpString=".zip") returned 4 [0058.932] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.932] lstrlenW (lpString=".rar") returned 4 [0058.932] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.932] lstrlenW (lpString=".bz2") returned 4 [0058.932] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.932] lstrlenW (lpString=".7z") returned 3 [0058.932] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.932] lstrlenW (lpString=".dbf") returned 4 [0058.932] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.932] lstrlenW (lpString=".1cd") returned 4 [0058.932] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.932] lstrlenW (lpString=".jpg") returned 4 [0058.932] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.932] lstrlenW (lpString=".doc") returned 4 [0058.932] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.932] lstrlenW (lpString=".docx") returned 5 [0058.933] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.933] lstrlenW (lpString=".pdf") returned 4 [0058.933] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.933] lstrlenW (lpString=".xls") returned 4 [0058.933] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.933] lstrlenW (lpString=".xlsx") returned 5 [0058.933] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.933] lstrlenW (lpString=".ppt") returned 4 [0058.933] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.933] lstrlenW (lpString=".zip") returned 4 [0058.933] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.933] lstrlenW (lpString=".rar") returned 4 [0058.933] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.933] lstrlenW (lpString=".bz2") returned 4 [0058.933] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.933] lstrlenW (lpString=".7z") returned 3 [0058.933] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.933] lstrlenW (lpString=".dbf") returned 4 [0058.933] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.933] lstrlenW (lpString=".1cd") returned 4 [0058.933] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0058.933] lstrlenW (lpString=".jpg") returned 4 [0058.933] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.934] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0058.934] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.934] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3479) returned 1 [0058.934] CloseHandle (hObject=0x180) returned 1 [0058.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0058.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.934] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.934] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0058.936] GetLastError () returned 0x0 [0058.936] ReadFile (in: hFile=0x180, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xd97, lpOverlapped=0x0) returned 1 [0058.941] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0058.942] ReadFile (in: hFile=0x180, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.942] WriteFile (in: hFile=0x200, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.942] SetEndOfFile (hFile=0x200) returned 1 [0058.942] CloseHandle (hObject=0x200) returned 1 [0058.942] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.942] SetEndOfFile (hFile=0x180) returned 1 [0058.943] CloseHandle (hObject=0x180) returned 1 [0058.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.943] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0058.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0058.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0058.944] lstrlenW (lpString=".doc") returned 4 [0058.944] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.944] lstrlenW (lpString=".docx") returned 5 [0058.944] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.944] lstrlenW (lpString=".pdf") returned 4 [0058.944] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.944] lstrlenW (lpString=".xls") returned 4 [0058.944] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.944] lstrlenW (lpString=".xlsx") returned 5 [0058.944] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.944] lstrlenW (lpString=".ppt") returned 4 [0058.944] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0058.944] lstrlenW (lpString=".zip") returned 4 [0058.944] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.944] lstrlenW (lpString=".rar") returned 4 [0058.944] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.944] lstrlenW (lpString=".bz2") returned 4 [0058.944] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.944] lstrlenW (lpString=".7z") returned 3 [0059.067] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0059.067] lstrlenW (lpString=".dbf") returned 4 [0059.067] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0059.067] lstrlenW (lpString=".1cd") returned 4 [0059.067] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0059.067] lstrlenW (lpString=".jpg") returned 4 [0059.067] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0059.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0059.067] lstrlenW (lpString=".doc") returned 4 [0059.067] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.067] lstrlenW (lpString=".docx") returned 5 [0059.067] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.067] lstrlenW (lpString=".pdf") returned 4 [0059.067] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.067] lstrlenW (lpString=".xls") returned 4 [0059.067] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.067] lstrlenW (lpString=".xlsx") returned 5 [0059.067] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.067] lstrlenW (lpString=".ppt") returned 4 [0059.067] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0059.068] lstrlenW (lpString=".zip") returned 4 [0059.068] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.068] lstrlenW (lpString=".rar") returned 4 [0059.068] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.068] lstrlenW (lpString=".bz2") returned 4 [0059.068] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.068] lstrlenW (lpString=".7z") returned 3 [0059.068] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0059.068] lstrlenW (lpString=".dbf") returned 4 [0059.068] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0059.068] lstrlenW (lpString=".1cd") returned 4 [0059.068] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0059.068] lstrlenW (lpString=".jpg") returned 4 [0059.068] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.068] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.068] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.068] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.069] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=31837) returned 1 [0059.069] CloseHandle (hObject=0x1d8) returned 1 [0059.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0059.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.069] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.069] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0059.069] GetLastError () returned 0x0 [0059.069] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0059.219] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0059.220] ReadFile (in: hFile=0x1d8, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.220] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.221] SetEndOfFile (hFile=0x218) returned 1 [0059.221] CloseHandle (hObject=0x218) returned 1 [0059.221] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.221] SetEndOfFile (hFile=0x1d8) returned 1 [0059.222] CloseHandle (hObject=0x1d8) returned 1 [0059.222] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.222] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0059.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.222] lstrlenW (lpString=".doc") returned 4 [0059.222] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.222] lstrlenW (lpString=".docx") returned 5 [0059.223] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.223] lstrlenW (lpString=".pdf") returned 4 [0059.223] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.223] lstrlenW (lpString=".xls") returned 4 [0059.223] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.223] lstrlenW (lpString=".xlsx") returned 5 [0059.223] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.223] lstrlenW (lpString=".ppt") returned 4 [0059.223] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.223] lstrlenW (lpString=".zip") returned 4 [0059.223] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.223] lstrlenW (lpString=".rar") returned 4 [0059.223] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.223] lstrlenW (lpString=".bz2") returned 4 [0059.223] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.223] lstrlenW (lpString=".7z") returned 3 [0059.223] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.223] lstrlenW (lpString=".dbf") returned 4 [0059.223] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.223] lstrlenW (lpString=".1cd") returned 4 [0059.223] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.223] lstrlenW (lpString=".jpg") returned 4 [0059.223] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.223] lstrlenW (lpString=".doc") returned 4 [0059.224] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.224] lstrlenW (lpString=".docx") returned 5 [0059.224] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.224] lstrlenW (lpString=".pdf") returned 4 [0059.224] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.224] lstrlenW (lpString=".xls") returned 4 [0059.224] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.224] lstrlenW (lpString=".xlsx") returned 5 [0059.224] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.224] lstrlenW (lpString=".ppt") returned 4 [0059.224] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.224] lstrlenW (lpString=".zip") returned 4 [0059.224] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.224] lstrlenW (lpString=".rar") returned 4 [0059.224] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.224] lstrlenW (lpString=".bz2") returned 4 [0059.224] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.224] lstrlenW (lpString=".7z") returned 3 [0059.224] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.224] lstrlenW (lpString=".dbf") returned 4 [0059.224] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.224] lstrlenW (lpString=".1cd") returned 4 [0059.224] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0059.224] lstrlenW (lpString=".jpg") returned 4 [0059.224] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.225] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.225] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.325] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1363) returned 1 [0059.325] CloseHandle (hObject=0x1fc) returned 1 [0059.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0059.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.325] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.325] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.325] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0059.376] GetLastError () returned 0x0 [0059.376] ReadFile (in: hFile=0x1fc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x553, lpOverlapped=0x0) returned 1 [0059.388] WriteFile (in: hFile=0x1e0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x560, lpOverlapped=0x0) returned 1 [0059.389] ReadFile (in: hFile=0x1fc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.389] WriteFile (in: hFile=0x1e0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.389] SetEndOfFile (hFile=0x1e0) returned 1 [0059.389] CloseHandle (hObject=0x1e0) returned 1 [0059.389] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.389] SetEndOfFile (hFile=0x1fc) returned 1 [0059.390] CloseHandle (hObject=0x1fc) returned 1 [0059.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.390] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0059.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.391] lstrlenW (lpString=".doc") returned 4 [0059.391] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.391] lstrlenW (lpString=".docx") returned 5 [0059.391] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.391] lstrlenW (lpString=".pdf") returned 4 [0059.391] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.391] lstrlenW (lpString=".xls") returned 4 [0059.391] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.391] lstrlenW (lpString=".xlsx") returned 5 [0059.391] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.391] lstrlenW (lpString=".ppt") returned 4 [0059.391] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.391] lstrlenW (lpString=".zip") returned 4 [0059.391] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.391] lstrlenW (lpString=".rar") returned 4 [0059.391] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.391] lstrlenW (lpString=".bz2") returned 4 [0059.391] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.391] lstrlenW (lpString=".7z") returned 3 [0059.391] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.391] lstrlenW (lpString=".dbf") returned 4 [0059.391] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.392] lstrlenW (lpString=".1cd") returned 4 [0059.392] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.392] lstrlenW (lpString=".jpg") returned 4 [0059.392] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.392] lstrlenW (lpString=".doc") returned 4 [0059.392] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.392] lstrlenW (lpString=".docx") returned 5 [0059.392] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.392] lstrlenW (lpString=".pdf") returned 4 [0059.392] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.392] lstrlenW (lpString=".xls") returned 4 [0059.392] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.392] lstrlenW (lpString=".xlsx") returned 5 [0059.392] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.392] lstrlenW (lpString=".ppt") returned 4 [0059.392] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.392] lstrlenW (lpString=".zip") returned 4 [0059.392] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.392] lstrlenW (lpString=".rar") returned 4 [0059.392] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.392] lstrlenW (lpString=".bz2") returned 4 [0059.392] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.392] lstrlenW (lpString=".7z") returned 3 [0059.392] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.392] lstrlenW (lpString=".dbf") returned 4 [0059.392] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.392] lstrlenW (lpString=".1cd") returned 4 [0059.393] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0059.393] lstrlenW (lpString=".jpg") returned 4 [0059.393] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.393] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.393] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.393] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1287) returned 1 [0059.393] CloseHandle (hObject=0x1fc) returned 1 [0059.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0059.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.394] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.394] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.394] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0059.395] GetLastError () returned 0x0 [0059.395] ReadFile (in: hFile=0x1fc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x507, lpOverlapped=0x0) returned 1 [0059.397] WriteFile (in: hFile=0x1e0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x510, lpOverlapped=0x0) returned 1 [0059.398] ReadFile (in: hFile=0x1fc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.398] WriteFile (in: hFile=0x1e0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.398] SetEndOfFile (hFile=0x1e0) returned 1 [0059.398] CloseHandle (hObject=0x1e0) returned 1 [0059.398] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.398] SetEndOfFile (hFile=0x1fc) returned 1 [0059.399] CloseHandle (hObject=0x1fc) returned 1 [0059.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.400] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0059.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.400] lstrlenW (lpString=".doc") returned 4 [0059.400] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.400] lstrlenW (lpString=".docx") returned 5 [0059.400] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.400] lstrlenW (lpString=".pdf") returned 4 [0059.400] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.400] lstrlenW (lpString=".xls") returned 4 [0059.400] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.400] lstrlenW (lpString=".xlsx") returned 5 [0059.400] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.400] lstrlenW (lpString=".ppt") returned 4 [0059.400] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.400] lstrlenW (lpString=".zip") returned 4 [0059.400] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.400] lstrlenW (lpString=".rar") returned 4 [0059.400] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.400] lstrlenW (lpString=".bz2") returned 4 [0059.400] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.400] lstrlenW (lpString=".7z") returned 3 [0059.401] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.401] lstrlenW (lpString=".dbf") returned 4 [0059.401] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.401] lstrlenW (lpString=".1cd") returned 4 [0059.401] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.401] lstrlenW (lpString=".jpg") returned 4 [0059.401] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.401] lstrlenW (lpString=".doc") returned 4 [0059.401] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.401] lstrlenW (lpString=".docx") returned 5 [0059.401] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.401] lstrlenW (lpString=".pdf") returned 4 [0059.401] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.401] lstrlenW (lpString=".xls") returned 4 [0059.401] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.401] lstrlenW (lpString=".xlsx") returned 5 [0059.401] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.401] lstrlenW (lpString=".ppt") returned 4 [0059.401] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.401] lstrlenW (lpString=".zip") returned 4 [0059.401] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.401] lstrlenW (lpString=".rar") returned 4 [0059.401] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.401] lstrlenW (lpString=".bz2") returned 4 [0059.401] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.402] lstrlenW (lpString=".7z") returned 3 [0059.402] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.402] lstrlenW (lpString=".dbf") returned 4 [0059.402] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.402] lstrlenW (lpString=".1cd") returned 4 [0059.402] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0059.402] lstrlenW (lpString=".jpg") returned 4 [0059.402] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.402] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.402] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.402] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=28595) returned 1 [0059.402] CloseHandle (hObject=0x1fc) returned 1 [0059.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0059.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.403] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.403] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0059.403] GetLastError () returned 0x0 [0059.403] ReadFile (in: hFile=0x1fc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0059.406] WriteFile (in: hFile=0x1e0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0059.408] ReadFile (in: hFile=0x1fc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.408] WriteFile (in: hFile=0x1e0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.409] SetEndOfFile (hFile=0x1e0) returned 1 [0059.409] CloseHandle (hObject=0x1e0) returned 1 [0059.409] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.409] SetEndOfFile (hFile=0x1fc) returned 1 [0059.410] CloseHandle (hObject=0x1fc) returned 1 [0059.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.410] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0059.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.410] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.410] lstrlenW (lpString=".doc") returned 4 [0059.411] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.411] lstrlenW (lpString=".docx") returned 5 [0059.411] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.411] lstrlenW (lpString=".pdf") returned 4 [0059.411] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.411] lstrlenW (lpString=".xls") returned 4 [0059.411] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.411] lstrlenW (lpString=".xlsx") returned 5 [0059.411] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.411] lstrlenW (lpString=".ppt") returned 4 [0059.411] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.411] lstrlenW (lpString=".zip") returned 4 [0059.411] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.411] lstrlenW (lpString=".rar") returned 4 [0059.411] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.411] lstrlenW (lpString=".bz2") returned 4 [0059.411] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.411] lstrlenW (lpString=".7z") returned 3 [0059.411] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.411] lstrlenW (lpString=".dbf") returned 4 [0059.411] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.411] lstrlenW (lpString=".1cd") returned 4 [0059.411] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.411] lstrlenW (lpString=".jpg") returned 4 [0059.411] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.412] lstrlenW (lpString=".doc") returned 4 [0059.412] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.412] lstrlenW (lpString=".docx") returned 5 [0059.412] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.412] lstrlenW (lpString=".pdf") returned 4 [0059.412] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.412] lstrlenW (lpString=".xls") returned 4 [0059.412] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.412] lstrlenW (lpString=".xlsx") returned 5 [0059.412] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.412] lstrlenW (lpString=".ppt") returned 4 [0059.412] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.412] lstrlenW (lpString=".zip") returned 4 [0059.412] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.412] lstrlenW (lpString=".rar") returned 4 [0059.412] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.412] lstrlenW (lpString=".bz2") returned 4 [0059.412] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.412] lstrlenW (lpString=".7z") returned 3 [0059.412] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.412] lstrlenW (lpString=".dbf") returned 4 [0059.412] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.412] lstrlenW (lpString=".1cd") returned 4 [0059.726] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0059.726] lstrlenW (lpString=".jpg") returned 4 [0059.726] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.726] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.726] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.726] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.043] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=18817) returned 1 [0060.054] CloseHandle (hObject=0x1e4) returned 1 [0060.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0060.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.071] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.071] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.071] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0060.071] GetLastError () returned 0x0 [0060.071] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x4981, lpOverlapped=0x0) returned 1 [0060.072] WriteFile (in: hFile=0x184, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4990, lpOverlapped=0x0) returned 1 [0060.074] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.074] WriteFile (in: hFile=0x184, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.074] SetEndOfFile (hFile=0x184) returned 1 [0060.074] CloseHandle (hObject=0x184) returned 1 [0060.074] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.074] SetEndOfFile (hFile=0x208) returned 1 [0060.075] CloseHandle (hObject=0x208) returned 1 [0060.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.075] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0060.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.075] lstrlenW (lpString=".doc") returned 4 [0060.075] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.075] lstrlenW (lpString=".docx") returned 5 [0060.075] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.076] lstrlenW (lpString=".pdf") returned 4 [0060.076] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.076] lstrlenW (lpString=".xls") returned 4 [0060.076] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.076] lstrlenW (lpString=".xlsx") returned 5 [0060.076] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.076] lstrlenW (lpString=".ppt") returned 4 [0060.076] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.076] lstrlenW (lpString=".zip") returned 4 [0060.076] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.076] lstrlenW (lpString=".rar") returned 4 [0060.076] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.076] lstrlenW (lpString=".bz2") returned 4 [0060.076] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.076] lstrlenW (lpString=".7z") returned 3 [0060.076] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.076] lstrlenW (lpString=".dbf") returned 4 [0060.076] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.076] lstrlenW (lpString=".1cd") returned 4 [0060.076] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.076] lstrlenW (lpString=".jpg") returned 4 [0060.076] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.076] lstrlenW (lpString=".doc") returned 4 [0060.076] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.076] lstrlenW (lpString=".docx") returned 5 [0060.076] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.077] lstrlenW (lpString=".pdf") returned 4 [0060.077] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.077] lstrlenW (lpString=".xls") returned 4 [0060.077] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.077] lstrlenW (lpString=".xlsx") returned 5 [0060.077] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.077] lstrlenW (lpString=".ppt") returned 4 [0060.077] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.077] lstrlenW (lpString=".zip") returned 4 [0060.077] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.077] lstrlenW (lpString=".rar") returned 4 [0060.077] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.077] lstrlenW (lpString=".bz2") returned 4 [0060.077] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.077] lstrlenW (lpString=".7z") returned 3 [0060.077] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.077] lstrlenW (lpString=".dbf") returned 4 [0060.077] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.077] lstrlenW (lpString=".1cd") returned 4 [0060.077] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0060.077] lstrlenW (lpString=".jpg") returned 4 [0060.077] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.077] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.077] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.078] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1659) returned 1 [0060.078] CloseHandle (hObject=0x208) returned 1 [0060.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0060.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.078] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.078] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.081] GetLastError () returned 0x0 [0060.081] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x67b, lpOverlapped=0x0) returned 1 [0060.195] WriteFile (in: hFile=0x20c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x680, lpOverlapped=0x0) returned 1 [0060.200] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.201] WriteFile (in: hFile=0x20c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.201] SetEndOfFile (hFile=0x20c) returned 1 [0060.201] CloseHandle (hObject=0x20c) returned 1 [0060.201] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.201] SetEndOfFile (hFile=0x208) returned 1 [0060.202] CloseHandle (hObject=0x208) returned 1 [0060.202] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.202] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0060.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.203] lstrlenW (lpString=".doc") returned 4 [0060.203] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.203] lstrlenW (lpString=".docx") returned 5 [0060.203] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.203] lstrlenW (lpString=".pdf") returned 4 [0060.203] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.203] lstrlenW (lpString=".xls") returned 4 [0060.203] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.203] lstrlenW (lpString=".xlsx") returned 5 [0060.203] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.203] lstrlenW (lpString=".ppt") returned 4 [0060.203] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.203] lstrlenW (lpString=".zip") returned 4 [0060.203] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.203] lstrlenW (lpString=".rar") returned 4 [0060.203] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.203] lstrlenW (lpString=".bz2") returned 4 [0060.203] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.203] lstrlenW (lpString=".7z") returned 3 [0060.203] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.203] lstrlenW (lpString=".dbf") returned 4 [0060.203] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.203] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.203] lstrlenW (lpString=".1cd") returned 4 [0060.203] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.204] lstrlenW (lpString=".jpg") returned 4 [0060.204] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.204] lstrlenW (lpString=".doc") returned 4 [0060.204] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.204] lstrlenW (lpString=".docx") returned 5 [0060.204] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.204] lstrlenW (lpString=".pdf") returned 4 [0060.204] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.204] lstrlenW (lpString=".xls") returned 4 [0060.204] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.204] lstrlenW (lpString=".xlsx") returned 5 [0060.204] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.204] lstrlenW (lpString=".ppt") returned 4 [0060.204] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.204] lstrlenW (lpString=".zip") returned 4 [0060.204] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.204] lstrlenW (lpString=".rar") returned 4 [0060.204] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.204] lstrlenW (lpString=".bz2") returned 4 [0060.204] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.204] lstrlenW (lpString=".7z") returned 3 [0060.204] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.204] lstrlenW (lpString=".dbf") returned 4 [0060.204] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.204] lstrlenW (lpString=".1cd") returned 4 [0060.204] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.204] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0060.205] lstrlenW (lpString=".jpg") returned 4 [0060.205] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.205] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.205] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.205] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1379) returned 1 [0060.205] CloseHandle (hObject=0x208) returned 1 [0060.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0060.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.205] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.206] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.206] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.206] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0060.231] GetLastError () returned 0x0 [0060.231] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x563, lpOverlapped=0x0) returned 1 [0060.247] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x570, lpOverlapped=0x0) returned 1 [0060.248] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.248] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.248] SetEndOfFile (hFile=0x218) returned 1 [0060.249] CloseHandle (hObject=0x218) returned 1 [0060.249] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.249] SetEndOfFile (hFile=0x208) returned 1 [0060.250] CloseHandle (hObject=0x208) returned 1 [0060.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.250] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0060.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.250] lstrlenW (lpString=".doc") returned 4 [0060.250] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.250] lstrlenW (lpString=".docx") returned 5 [0060.250] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.250] lstrlenW (lpString=".pdf") returned 4 [0060.250] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.250] lstrlenW (lpString=".xls") returned 4 [0060.250] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.250] lstrlenW (lpString=".xlsx") returned 5 [0060.250] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.250] lstrlenW (lpString=".ppt") returned 4 [0060.250] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.251] lstrlenW (lpString=".zip") returned 4 [0060.251] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.251] lstrlenW (lpString=".rar") returned 4 [0060.251] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.251] lstrlenW (lpString=".bz2") returned 4 [0060.251] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.251] lstrlenW (lpString=".7z") returned 3 [0060.251] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.251] lstrlenW (lpString=".dbf") returned 4 [0060.251] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.251] lstrlenW (lpString=".1cd") returned 4 [0060.251] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.251] lstrlenW (lpString=".jpg") returned 4 [0060.251] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.251] lstrlenW (lpString=".doc") returned 4 [0060.251] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.251] lstrlenW (lpString=".docx") returned 5 [0060.251] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.251] lstrlenW (lpString=".pdf") returned 4 [0060.251] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.251] lstrlenW (lpString=".xls") returned 4 [0060.251] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.251] lstrlenW (lpString=".xlsx") returned 5 [0060.251] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.251] lstrlenW (lpString=".ppt") returned 4 [0060.251] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.251] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.251] lstrlenW (lpString=".zip") returned 4 [0060.252] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.252] lstrlenW (lpString=".rar") returned 4 [0060.252] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.252] lstrlenW (lpString=".bz2") returned 4 [0060.252] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.252] lstrlenW (lpString=".7z") returned 3 [0060.252] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.252] lstrlenW (lpString=".dbf") returned 4 [0060.252] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.252] lstrlenW (lpString=".1cd") returned 4 [0060.252] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.252] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0060.252] lstrlenW (lpString=".jpg") returned 4 [0060.252] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.252] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.252] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.252] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.253] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2574) returned 1 [0060.253] CloseHandle (hObject=0x208) returned 1 [0060.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0060.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.253] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.253] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.274] GetLastError () returned 0x0 [0060.275] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xa0e, lpOverlapped=0x0) returned 1 [0060.291] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0060.292] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.292] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.292] SetEndOfFile (hFile=0x1ec) returned 1 [0060.292] CloseHandle (hObject=0x1ec) returned 1 [0060.292] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.292] SetEndOfFile (hFile=0x208) returned 1 [0060.293] CloseHandle (hObject=0x208) returned 1 [0060.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.293] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0060.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.294] lstrlenW (lpString=".doc") returned 4 [0060.294] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.294] lstrlenW (lpString=".docx") returned 5 [0060.294] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.294] lstrlenW (lpString=".pdf") returned 4 [0060.294] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.294] lstrlenW (lpString=".xls") returned 4 [0060.294] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.294] lstrlenW (lpString=".xlsx") returned 5 [0060.294] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.294] lstrlenW (lpString=".ppt") returned 4 [0060.294] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.294] lstrlenW (lpString=".zip") returned 4 [0060.294] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.294] lstrlenW (lpString=".rar") returned 4 [0060.294] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.294] lstrlenW (lpString=".bz2") returned 4 [0060.294] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.294] lstrlenW (lpString=".7z") returned 3 [0060.294] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.294] lstrlenW (lpString=".dbf") returned 4 [0060.294] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.294] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.295] lstrlenW (lpString=".1cd") returned 4 [0060.295] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.295] lstrlenW (lpString=".jpg") returned 4 [0060.295] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.295] lstrlenW (lpString=".doc") returned 4 [0060.295] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.295] lstrlenW (lpString=".docx") returned 5 [0060.295] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.295] lstrlenW (lpString=".pdf") returned 4 [0060.295] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString=".xls") returned 4 [0060.295] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString=".xlsx") returned 5 [0060.295] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.295] lstrlenW (lpString=".ppt") returned 4 [0060.295] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.295] lstrlenW (lpString=".zip") returned 4 [0060.295] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString=".rar") returned 4 [0060.295] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.295] lstrlenW (lpString=".bz2") returned 4 [0060.295] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.295] lstrlenW (lpString=".7z") returned 3 [0060.295] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.295] lstrlenW (lpString=".dbf") returned 4 [0060.296] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.296] lstrlenW (lpString=".1cd") returned 4 [0060.296] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0060.296] lstrlenW (lpString=".jpg") returned 4 [0060.296] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.296] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.296] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.296] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.537] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=16738) returned 1 [0060.537] CloseHandle (hObject=0x1ec) returned 1 [0060.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0060.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.537] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.538] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.538] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.538] GetLastError () returned 0x0 [0060.538] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x4162, lpOverlapped=0x0) returned 1 [0060.540] WriteFile (in: hFile=0x20c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0060.541] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.541] WriteFile (in: hFile=0x20c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.541] SetEndOfFile (hFile=0x20c) returned 1 [0060.541] CloseHandle (hObject=0x20c) returned 1 [0060.541] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.541] SetEndOfFile (hFile=0x1ec) returned 1 [0060.542] CloseHandle (hObject=0x1ec) returned 1 [0060.542] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.542] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0060.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.543] lstrlenW (lpString=".doc") returned 4 [0060.543] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.543] lstrlenW (lpString=".docx") returned 5 [0060.543] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.543] lstrlenW (lpString=".pdf") returned 4 [0060.543] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.543] lstrlenW (lpString=".xls") returned 4 [0060.543] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.543] lstrlenW (lpString=".xlsx") returned 5 [0060.543] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.543] lstrlenW (lpString=".ppt") returned 4 [0060.543] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.543] lstrlenW (lpString=".zip") returned 4 [0060.543] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.543] lstrlenW (lpString=".rar") returned 4 [0060.543] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.543] lstrlenW (lpString=".bz2") returned 4 [0060.543] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.543] lstrlenW (lpString=".7z") returned 3 [0060.543] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.543] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.543] lstrlenW (lpString=".dbf") returned 4 [0060.543] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.544] lstrlenW (lpString=".1cd") returned 4 [0060.544] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.544] lstrlenW (lpString=".jpg") returned 4 [0060.544] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.544] lstrlenW (lpString=".doc") returned 4 [0060.544] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.544] lstrlenW (lpString=".docx") returned 5 [0060.544] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.544] lstrlenW (lpString=".pdf") returned 4 [0060.544] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.544] lstrlenW (lpString=".xls") returned 4 [0060.544] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.544] lstrlenW (lpString=".xlsx") returned 5 [0060.544] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.544] lstrlenW (lpString=".ppt") returned 4 [0060.544] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.544] lstrlenW (lpString=".zip") returned 4 [0060.544] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.544] lstrlenW (lpString=".rar") returned 4 [0060.544] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.544] lstrlenW (lpString=".bz2") returned 4 [0060.544] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.544] lstrlenW (lpString=".7z") returned 3 [0060.544] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.544] lstrlenW (lpString=".dbf") returned 4 [0060.544] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.545] lstrlenW (lpString=".1cd") returned 4 [0060.545] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0060.545] lstrlenW (lpString=".jpg") returned 4 [0060.545] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.545] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.545] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.545] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1423) returned 1 [0060.545] CloseHandle (hObject=0x1ec) returned 1 [0060.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0060.545] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.546] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.546] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.546] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0060.612] GetLastError () returned 0x0 [0060.612] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x58f, lpOverlapped=0x0) returned 1 [0060.683] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x590, lpOverlapped=0x0) returned 1 [0060.684] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.684] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.684] SetEndOfFile (hFile=0x1f8) returned 1 [0060.684] CloseHandle (hObject=0x1f8) returned 1 [0060.685] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.685] SetEndOfFile (hFile=0x1ec) returned 1 [0060.685] CloseHandle (hObject=0x1ec) returned 1 [0060.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.686] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0060.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.686] lstrlenW (lpString=".doc") returned 4 [0060.686] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.686] lstrlenW (lpString=".docx") returned 5 [0060.686] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.686] lstrlenW (lpString=".pdf") returned 4 [0060.686] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString=".xls") returned 4 [0060.686] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString=".xlsx") returned 5 [0060.686] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.686] lstrlenW (lpString=".ppt") returned 4 [0060.686] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.686] lstrlenW (lpString=".zip") returned 4 [0060.686] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString=".rar") returned 4 [0060.686] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.686] lstrlenW (lpString=".bz2") returned 4 [0060.686] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.687] lstrlenW (lpString=".7z") returned 3 [0060.687] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.687] lstrlenW (lpString=".dbf") returned 4 [0060.687] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.687] lstrlenW (lpString=".1cd") returned 4 [0060.687] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.687] lstrlenW (lpString=".jpg") returned 4 [0060.687] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.687] lstrlenW (lpString=".doc") returned 4 [0060.687] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.687] lstrlenW (lpString=".docx") returned 5 [0060.687] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.687] lstrlenW (lpString=".pdf") returned 4 [0060.687] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.687] lstrlenW (lpString=".xls") returned 4 [0060.687] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.687] lstrlenW (lpString=".xlsx") returned 5 [0060.687] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.687] lstrlenW (lpString=".ppt") returned 4 [0060.687] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.687] lstrlenW (lpString=".zip") returned 4 [0060.687] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.687] lstrlenW (lpString=".rar") returned 4 [0060.687] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.687] lstrlenW (lpString=".bz2") returned 4 [0060.687] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.688] lstrlenW (lpString=".7z") returned 3 [0060.688] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.688] lstrlenW (lpString=".dbf") returned 4 [0060.688] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.688] lstrlenW (lpString=".1cd") returned 4 [0060.688] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0060.688] lstrlenW (lpString=".jpg") returned 4 [0060.688] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.688] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.688] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.688] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=53115) returned 1 [0060.689] CloseHandle (hObject=0x1ec) returned 1 [0060.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0060.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.689] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.689] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0060.689] GetLastError () returned 0x0 [0060.689] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0060.706] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0060.709] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.709] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.709] SetEndOfFile (hFile=0x1f8) returned 1 [0060.709] CloseHandle (hObject=0x1f8) returned 1 [0060.709] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.710] SetEndOfFile (hFile=0x1ec) returned 1 [0060.711] CloseHandle (hObject=0x1ec) returned 1 [0060.711] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.711] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0060.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.711] lstrlenW (lpString=".doc") returned 4 [0060.711] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.711] lstrlenW (lpString=".docx") returned 5 [0060.711] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.712] lstrlenW (lpString=".pdf") returned 4 [0060.712] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.712] lstrlenW (lpString=".xls") returned 4 [0060.712] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.712] lstrlenW (lpString=".xlsx") returned 5 [0060.712] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.712] lstrlenW (lpString=".ppt") returned 4 [0060.712] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.712] lstrlenW (lpString=".zip") returned 4 [0060.712] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.712] lstrlenW (lpString=".rar") returned 4 [0060.712] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.712] lstrlenW (lpString=".bz2") returned 4 [0060.712] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.712] lstrlenW (lpString=".7z") returned 3 [0060.712] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.712] lstrlenW (lpString=".dbf") returned 4 [0060.712] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.712] lstrlenW (lpString=".1cd") returned 4 [0060.712] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.712] lstrlenW (lpString=".jpg") returned 4 [0060.712] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.712] lstrlenW (lpString=".doc") returned 4 [0060.712] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.712] lstrlenW (lpString=".docx") returned 5 [0060.712] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.712] lstrlenW (lpString=".pdf") returned 4 [0060.713] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.713] lstrlenW (lpString=".xls") returned 4 [0060.713] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.713] lstrlenW (lpString=".xlsx") returned 5 [0060.713] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.713] lstrlenW (lpString=".ppt") returned 4 [0060.713] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.713] lstrlenW (lpString=".zip") returned 4 [0060.713] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.713] lstrlenW (lpString=".rar") returned 4 [0060.713] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.713] lstrlenW (lpString=".bz2") returned 4 [0060.713] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.713] lstrlenW (lpString=".7z") returned 3 [0060.713] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.713] lstrlenW (lpString=".dbf") returned 4 [0060.713] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.713] lstrlenW (lpString=".1cd") returned 4 [0060.713] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0060.713] lstrlenW (lpString=".jpg") returned 4 [0060.713] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.713] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.713] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.714] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2604) returned 1 [0060.714] CloseHandle (hObject=0x1ec) returned 1 [0060.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0060.714] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.714] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.714] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0060.716] GetLastError () returned 0x0 [0060.716] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0060.737] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0060.738] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.738] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.738] SetEndOfFile (hFile=0x1f8) returned 1 [0060.738] CloseHandle (hObject=0x1f8) returned 1 [0060.739] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.739] SetEndOfFile (hFile=0x1ec) returned 1 [0060.739] CloseHandle (hObject=0x1ec) returned 1 [0060.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.740] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0060.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.740] lstrlenW (lpString=".doc") returned 4 [0060.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.740] lstrlenW (lpString=".docx") returned 5 [0060.740] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.740] lstrlenW (lpString=".pdf") returned 4 [0060.740] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.740] lstrlenW (lpString=".xls") returned 4 [0060.740] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.740] lstrlenW (lpString=".xlsx") returned 5 [0060.740] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.740] lstrlenW (lpString=".ppt") returned 4 [0060.740] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.740] lstrlenW (lpString=".zip") returned 4 [0060.740] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.740] lstrlenW (lpString=".rar") returned 4 [0060.740] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.741] lstrlenW (lpString=".bz2") returned 4 [0060.741] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.741] lstrlenW (lpString=".7z") returned 3 [0060.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.741] lstrlenW (lpString=".dbf") returned 4 [0060.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.741] lstrlenW (lpString=".1cd") returned 4 [0060.741] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.741] lstrlenW (lpString=".jpg") returned 4 [0060.741] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.741] lstrlenW (lpString=".doc") returned 4 [0060.741] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.741] lstrlenW (lpString=".docx") returned 5 [0060.741] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.741] lstrlenW (lpString=".pdf") returned 4 [0060.741] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.741] lstrlenW (lpString=".xls") returned 4 [0060.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.741] lstrlenW (lpString=".xlsx") returned 5 [0060.741] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.741] lstrlenW (lpString=".ppt") returned 4 [0060.741] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.741] lstrlenW (lpString=".zip") returned 4 [0060.741] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.741] lstrlenW (lpString=".rar") returned 4 [0060.741] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.742] lstrlenW (lpString=".bz2") returned 4 [0060.742] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.742] lstrlenW (lpString=".7z") returned 3 [0060.742] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.742] lstrlenW (lpString=".dbf") returned 4 [0060.742] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.742] lstrlenW (lpString=".1cd") returned 4 [0060.742] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0060.742] lstrlenW (lpString=".jpg") returned 4 [0060.742] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.742] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.742] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.742] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.743] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4100) returned 1 [0060.743] CloseHandle (hObject=0x1ec) returned 1 [0060.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0060.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.743] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.743] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0060.745] GetLastError () returned 0x0 [0060.745] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1004, lpOverlapped=0x0) returned 1 [0060.772] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0060.773] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.773] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.774] SetEndOfFile (hFile=0x1f8) returned 1 [0060.774] CloseHandle (hObject=0x1f8) returned 1 [0060.774] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.774] SetEndOfFile (hFile=0x1ec) returned 1 [0060.775] CloseHandle (hObject=0x1ec) returned 1 [0060.775] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.775] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0060.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.775] lstrlenW (lpString=".doc") returned 4 [0060.775] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.775] lstrlenW (lpString=".docx") returned 5 [0060.775] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.775] lstrlenW (lpString=".pdf") returned 4 [0060.775] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.775] lstrlenW (lpString=".xls") returned 4 [0060.775] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.775] lstrlenW (lpString=".xlsx") returned 5 [0060.776] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.776] lstrlenW (lpString=".ppt") returned 4 [0060.776] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.776] lstrlenW (lpString=".zip") returned 4 [0060.776] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.776] lstrlenW (lpString=".rar") returned 4 [0060.776] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.776] lstrlenW (lpString=".bz2") returned 4 [0060.776] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.776] lstrlenW (lpString=".7z") returned 3 [0060.776] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.776] lstrlenW (lpString=".dbf") returned 4 [0060.776] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.776] lstrlenW (lpString=".1cd") returned 4 [0060.776] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.776] lstrlenW (lpString=".jpg") returned 4 [0060.776] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.776] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.776] lstrlenW (lpString=".doc") returned 4 [0060.776] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.776] lstrlenW (lpString=".docx") returned 5 [0060.776] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.776] lstrlenW (lpString=".pdf") returned 4 [0060.776] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.776] lstrlenW (lpString=".xls") returned 4 [0060.776] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.776] lstrlenW (lpString=".xlsx") returned 5 [0060.777] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.777] lstrlenW (lpString=".ppt") returned 4 [0060.777] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.777] lstrlenW (lpString=".zip") returned 4 [0060.777] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.777] lstrlenW (lpString=".rar") returned 4 [0060.777] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.777] lstrlenW (lpString=".bz2") returned 4 [0060.777] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.777] lstrlenW (lpString=".7z") returned 3 [0060.777] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.777] lstrlenW (lpString=".dbf") returned 4 [0060.777] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.777] lstrlenW (lpString=".1cd") returned 4 [0060.777] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.777] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0060.777] lstrlenW (lpString=".jpg") returned 4 [0060.777] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.777] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.777] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.778] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3611) returned 1 [0060.778] CloseHandle (hObject=0x1ec) returned 1 [0060.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0060.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.778] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.778] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0060.780] GetLastError () returned 0x0 [0060.780] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0060.782] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0060.783] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.783] WriteFile (in: hFile=0x1f8, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.783] SetEndOfFile (hFile=0x1f8) returned 1 [0060.783] CloseHandle (hObject=0x1f8) returned 1 [0060.784] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.784] SetEndOfFile (hFile=0x1ec) returned 1 [0060.784] CloseHandle (hObject=0x1ec) returned 1 [0060.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0060.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0060.785] lstrlenW (lpString=".doc") returned 4 [0060.785] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.785] lstrlenW (lpString=".docx") returned 5 [0060.785] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.785] lstrlenW (lpString=".pdf") returned 4 [0061.011] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.012] lstrlenW (lpString=".xls") returned 4 [0061.012] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.012] lstrlenW (lpString=".xlsx") returned 5 [0061.012] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.012] lstrlenW (lpString=".ppt") returned 4 [0061.012] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0061.012] lstrlenW (lpString=".zip") returned 4 [0061.012] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.012] lstrlenW (lpString=".rar") returned 4 [0061.012] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.012] lstrlenW (lpString=".bz2") returned 4 [0061.012] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.012] lstrlenW (lpString=".7z") returned 3 [0061.012] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0061.012] lstrlenW (lpString=".dbf") returned 4 [0061.012] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0061.012] lstrlenW (lpString=".1cd") returned 4 [0061.012] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0061.012] lstrlenW (lpString=".jpg") returned 4 [0061.012] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0061.012] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0061.012] lstrlenW (lpString=".doc") returned 4 [0061.012] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.012] lstrlenW (lpString=".docx") returned 5 [0061.012] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.012] lstrlenW (lpString=".pdf") returned 4 [0061.012] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.012] lstrlenW (lpString=".xls") returned 4 [0061.013] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.013] lstrlenW (lpString=".xlsx") returned 5 [0061.013] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.013] lstrlenW (lpString=".ppt") returned 4 [0061.013] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0061.013] lstrlenW (lpString=".zip") returned 4 [0061.013] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.013] lstrlenW (lpString=".rar") returned 4 [0061.013] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.013] lstrlenW (lpString=".bz2") returned 4 [0061.013] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.013] lstrlenW (lpString=".7z") returned 3 [0061.013] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0061.013] lstrlenW (lpString=".dbf") returned 4 [0061.013] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0061.013] lstrlenW (lpString=".1cd") returned 4 [0061.013] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.013] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0061.013] lstrlenW (lpString=".jpg") returned 4 [0061.013] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.013] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0061.013] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0061.013] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0061.014] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1675) returned 1 [0061.014] CloseHandle (hObject=0x1fc) returned 1 [0061.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0061.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0061.014] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.014] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.014] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.293] GetLastError () returned 0x0 [0061.293] ReadFile (in: hFile=0x1fc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x68b, lpOverlapped=0x0) returned 1 [0061.352] WriteFile (in: hFile=0x1f0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x690, lpOverlapped=0x0) returned 1 [0061.353] ReadFile (in: hFile=0x1fc, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.353] WriteFile (in: hFile=0x1f0, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.354] SetEndOfFile (hFile=0x1f0) returned 1 [0061.354] CloseHandle (hObject=0x1f0) returned 1 [0061.354] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.354] SetEndOfFile (hFile=0x1fc) returned 1 [0061.355] CloseHandle (hObject=0x1fc) returned 1 [0061.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.355] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0061.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.355] lstrlenW (lpString=".doc") returned 4 [0061.355] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.355] lstrlenW (lpString=".docx") returned 5 [0061.355] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.355] lstrlenW (lpString=".pdf") returned 4 [0061.355] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.355] lstrlenW (lpString=".xls") returned 4 [0061.355] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.355] lstrlenW (lpString=".xlsx") returned 5 [0061.355] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.355] lstrlenW (lpString=".ppt") returned 4 [0061.355] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.355] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.356] lstrlenW (lpString=".zip") returned 4 [0061.356] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.356] lstrlenW (lpString=".rar") returned 4 [0061.356] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.356] lstrlenW (lpString=".bz2") returned 4 [0061.356] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.356] lstrlenW (lpString=".7z") returned 3 [0061.356] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.356] lstrlenW (lpString=".dbf") returned 4 [0061.356] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.356] lstrlenW (lpString=".1cd") returned 4 [0061.356] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.356] lstrlenW (lpString=".jpg") returned 4 [0061.356] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.356] lstrlenW (lpString=".doc") returned 4 [0061.356] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.356] lstrlenW (lpString=".docx") returned 5 [0061.356] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.356] lstrlenW (lpString=".pdf") returned 4 [0061.356] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.356] lstrlenW (lpString=".xls") returned 4 [0061.356] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.356] lstrlenW (lpString=".xlsx") returned 5 [0061.356] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.356] lstrlenW (lpString=".ppt") returned 4 [0061.356] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.356] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.357] lstrlenW (lpString=".zip") returned 4 [0061.357] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.357] lstrlenW (lpString=".rar") returned 4 [0061.357] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.357] lstrlenW (lpString=".bz2") returned 4 [0061.357] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.357] lstrlenW (lpString=".7z") returned 3 [0061.357] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.357] lstrlenW (lpString=".dbf") returned 4 [0061.357] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.357] lstrlenW (lpString=".1cd") returned 4 [0061.357] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.357] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0061.357] lstrlenW (lpString=".jpg") returned 4 [0061.357] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.357] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0061.357] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0061.357] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.538] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=42453) returned 1 [0061.538] CloseHandle (hObject=0x21c) returned 1 [0061.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0061.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.538] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.538] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0061.539] GetLastError () returned 0x0 [0061.539] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0061.989] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0061.991] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.991] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.992] SetEndOfFile (hFile=0x1ec) returned 1 [0061.992] CloseHandle (hObject=0x1ec) returned 1 [0061.992] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.992] SetEndOfFile (hFile=0x21c) returned 1 [0061.993] CloseHandle (hObject=0x21c) returned 1 [0061.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.993] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0061.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.994] lstrlenW (lpString=".doc") returned 4 [0061.994] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.994] lstrlenW (lpString=".docx") returned 5 [0061.994] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.994] lstrlenW (lpString=".pdf") returned 4 [0061.994] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.994] lstrlenW (lpString=".xls") returned 4 [0061.994] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.994] lstrlenW (lpString=".xlsx") returned 5 [0061.994] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.994] lstrlenW (lpString=".ppt") returned 4 [0061.994] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.994] lstrlenW (lpString=".zip") returned 4 [0061.994] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.994] lstrlenW (lpString=".rar") returned 4 [0061.994] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.994] lstrlenW (lpString=".bz2") returned 4 [0061.994] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.994] lstrlenW (lpString=".7z") returned 3 [0061.994] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.995] lstrlenW (lpString=".dbf") returned 4 [0061.995] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.995] lstrlenW (lpString=".1cd") returned 4 [0061.995] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.995] lstrlenW (lpString=".jpg") returned 4 [0061.995] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.995] lstrlenW (lpString=".doc") returned 4 [0061.995] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.995] lstrlenW (lpString=".docx") returned 5 [0061.995] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.995] lstrlenW (lpString=".pdf") returned 4 [0061.995] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.995] lstrlenW (lpString=".xls") returned 4 [0061.995] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.995] lstrlenW (lpString=".xlsx") returned 5 [0061.995] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.995] lstrlenW (lpString=".ppt") returned 4 [0061.995] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.995] lstrlenW (lpString=".zip") returned 4 [0061.995] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.995] lstrlenW (lpString=".rar") returned 4 [0061.995] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.995] lstrlenW (lpString=".bz2") returned 4 [0061.995] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.995] lstrlenW (lpString=".7z") returned 3 [0061.995] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.996] lstrlenW (lpString=".dbf") returned 4 [0061.996] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.996] lstrlenW (lpString=".1cd") returned 4 [0061.996] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0061.996] lstrlenW (lpString=".jpg") returned 4 [0061.996] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.996] lstrcmpiW (lpString1=".MSG", lpString2=".wiki") returned -1 [0061.996] lstrlenW (lpString="FPEXT.MSG") returned 9 [0061.996] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.997] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=169637) returned 1 [0061.997] CloseHandle (hObject=0x21c) returned 1 [0061.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0061.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.997] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0061.997] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.998] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0061.998] GetLastError () returned 0x0 [0061.998] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x296a5, lpOverlapped=0x0) returned 1 [0062.227] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0062.232] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.232] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.232] SetEndOfFile (hFile=0x1ec) returned 1 [0062.233] CloseHandle (hObject=0x1ec) returned 1 [0062.233] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.233] SetEndOfFile (hFile=0x21c) returned 1 [0062.235] CloseHandle (hObject=0x21c) returned 1 [0062.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0062.235] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0062.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.235] lstrlenW (lpString=".doc") returned 4 [0062.235] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0062.235] lstrlenW (lpString=".docx") returned 5 [0062.235] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0062.235] lstrlenW (lpString=".pdf") returned 4 [0062.235] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0062.235] lstrlenW (lpString=".xls") returned 4 [0062.235] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0062.235] lstrlenW (lpString=".xlsx") returned 5 [0062.235] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0062.236] lstrlenW (lpString=".ppt") returned 4 [0062.236] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0062.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.236] lstrlenW (lpString=".zip") returned 4 [0062.236] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0062.236] lstrlenW (lpString=".rar") returned 4 [0062.236] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0062.236] lstrlenW (lpString=".bz2") returned 4 [0062.236] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0062.236] lstrlenW (lpString=".7z") returned 3 [0062.236] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0062.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.236] lstrlenW (lpString=".dbf") returned 4 [0062.236] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0062.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.236] lstrlenW (lpString=".1cd") returned 4 [0062.236] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0062.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.236] lstrlenW (lpString=".jpg") returned 4 [0062.236] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0062.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.236] lstrlenW (lpString=".doc") returned 4 [0062.236] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0062.236] lstrlenW (lpString=".docx") returned 5 [0062.236] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0062.236] lstrlenW (lpString=".pdf") returned 4 [0062.236] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0062.236] lstrlenW (lpString=".xls") returned 4 [0062.236] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0062.236] lstrlenW (lpString=".xlsx") returned 5 [0062.237] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0062.237] lstrlenW (lpString=".ppt") returned 4 [0062.237] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0062.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.237] lstrlenW (lpString=".zip") returned 4 [0062.237] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0062.237] lstrlenW (lpString=".rar") returned 4 [0062.237] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0062.237] lstrlenW (lpString=".bz2") returned 4 [0062.237] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0062.237] lstrlenW (lpString=".7z") returned 3 [0062.237] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0062.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.237] lstrlenW (lpString=".dbf") returned 4 [0062.237] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0062.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.237] lstrlenW (lpString=".1cd") returned 4 [0062.237] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0062.237] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0062.237] lstrlenW (lpString=".jpg") returned 4 [0062.237] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0062.237] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0062.237] lstrlenW (lpString="desktop.ini") returned 11 [0062.237] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.238] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=174) returned 1 [0062.238] CloseHandle (hObject=0x21c) returned 1 [0062.238] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0062.238] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.238] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.238] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.238] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.238] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0062.239] GetLastError () returned 0x0 [0062.239] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xae, lpOverlapped=0x0) returned 1 [0062.239] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0062.240] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.240] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0062.240] SetEndOfFile (hFile=0x1ec) returned 1 [0062.241] CloseHandle (hObject=0x1ec) returned 1 [0062.241] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.241] SetEndOfFile (hFile=0x21c) returned 1 [0062.241] CloseHandle (hObject=0x21c) returned 1 [0062.242] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x26) returned 1 [0062.242] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0062.242] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.242] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.242] lstrlenW (lpString=".doc") returned 4 [0062.242] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0062.242] lstrlenW (lpString=".docx") returned 5 [0062.242] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0062.242] lstrlenW (lpString=".pdf") returned 4 [0062.242] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0062.242] lstrlenW (lpString=".xls") returned 4 [0062.242] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0062.242] lstrlenW (lpString=".xlsx") returned 5 [0062.242] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0062.242] lstrlenW (lpString=".ppt") returned 4 [0062.242] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0062.242] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.242] lstrlenW (lpString=".zip") returned 4 [0062.242] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0062.243] lstrlenW (lpString=".rar") returned 4 [0062.243] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0062.243] lstrlenW (lpString=".bz2") returned 4 [0062.243] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0062.243] lstrlenW (lpString=".7z") returned 3 [0062.243] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0062.243] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.243] lstrlenW (lpString=".dbf") returned 4 [0062.243] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0062.243] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.243] lstrlenW (lpString=".1cd") returned 4 [0062.243] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0062.243] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.243] lstrlenW (lpString=".jpg") returned 4 [0062.243] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0062.243] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.243] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.243] lstrlenW (lpString=".doc") returned 4 [0062.243] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0062.243] lstrlenW (lpString=".docx") returned 5 [0062.243] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0062.243] lstrlenW (lpString=".pdf") returned 4 [0062.243] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0062.243] lstrlenW (lpString=".xls") returned 4 [0062.243] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0062.243] lstrlenW (lpString=".xlsx") returned 5 [0062.243] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0062.243] lstrlenW (lpString=".ppt") returned 4 [0062.243] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0062.243] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.243] lstrlenW (lpString=".zip") returned 4 [0062.243] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0062.244] lstrlenW (lpString=".rar") returned 4 [0062.244] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0062.244] lstrlenW (lpString=".bz2") returned 4 [0062.244] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0062.244] lstrlenW (lpString=".7z") returned 3 [0062.244] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0062.244] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.244] lstrlenW (lpString=".dbf") returned 4 [0062.244] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0062.244] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.244] lstrlenW (lpString=".1cd") returned 4 [0062.244] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0062.244] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0062.244] lstrlenW (lpString=".jpg") returned 4 [0062.244] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0062.244] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0062.244] lstrlenW (lpString="DissolveAnother.png") returned 19 [0062.244] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.245] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=27935) returned 1 [0062.245] CloseHandle (hObject=0x21c) returned 1 [0062.245] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0062.246] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.246] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.246] lstrlenW (lpString=".doc") returned 4 [0062.246] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.246] lstrlenW (lpString=".docx") returned 5 [0062.246] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0062.246] lstrlenW (lpString=".pdf") returned 4 [0062.246] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.246] lstrlenW (lpString=".xls") returned 4 [0062.246] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.246] lstrlenW (lpString=".xlsx") returned 5 [0062.246] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0062.246] lstrlenW (lpString=".ppt") returned 4 [0062.246] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.246] lstrlenW (lpString=".zip") returned 4 [0062.246] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.246] lstrlenW (lpString=".rar") returned 4 [0062.246] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.246] lstrlenW (lpString=".bz2") returned 4 [0062.246] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.246] lstrlenW (lpString=".7z") returned 3 [0062.246] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.246] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.246] lstrlenW (lpString=".dbf") returned 4 [0062.246] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.247] lstrlenW (lpString=".1cd") returned 4 [0062.247] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.247] lstrlenW (lpString=".jpg") returned 4 [0062.247] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.247] lstrlenW (lpString=".doc") returned 4 [0062.247] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.247] lstrlenW (lpString=".docx") returned 5 [0062.247] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0062.247] lstrlenW (lpString=".pdf") returned 4 [0062.247] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.247] lstrlenW (lpString=".xls") returned 4 [0062.247] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.247] lstrlenW (lpString=".xlsx") returned 5 [0062.247] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0062.247] lstrlenW (lpString=".ppt") returned 4 [0062.247] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.247] lstrlenW (lpString=".zip") returned 4 [0062.247] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.247] lstrlenW (lpString=".rar") returned 4 [0062.247] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.247] lstrlenW (lpString=".bz2") returned 4 [0062.247] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.247] lstrlenW (lpString=".7z") returned 3 [0062.247] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.247] lstrlenW (lpString=".dbf") returned 4 [0062.247] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.247] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.248] lstrlenW (lpString=".1cd") returned 4 [0062.248] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.248] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0062.248] lstrlenW (lpString=".jpg") returned 4 [0062.248] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.248] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0062.248] lstrlenW (lpString="DissolveNoise.png") returned 17 [0062.248] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.248] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=751669) returned 1 [0062.248] CloseHandle (hObject=0x21c) returned 1 [0062.248] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0062.248] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.248] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.249] lstrlenW (lpString=".doc") returned 4 [0062.249] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.249] lstrlenW (lpString=".docx") returned 5 [0062.249] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0062.249] lstrlenW (lpString=".pdf") returned 4 [0062.249] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.249] lstrlenW (lpString=".xls") returned 4 [0062.249] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.249] lstrlenW (lpString=".xlsx") returned 5 [0062.249] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0062.249] lstrlenW (lpString=".ppt") returned 4 [0062.249] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.249] lstrlenW (lpString=".zip") returned 4 [0062.249] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.249] lstrlenW (lpString=".rar") returned 4 [0062.249] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.249] lstrlenW (lpString=".bz2") returned 4 [0062.249] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.249] lstrlenW (lpString=".7z") returned 3 [0062.249] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.249] lstrlenW (lpString=".dbf") returned 4 [0062.249] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.249] lstrlenW (lpString=".1cd") returned 4 [0062.249] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.249] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.249] lstrlenW (lpString=".jpg") returned 4 [0062.249] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.250] lstrlenW (lpString=".doc") returned 4 [0062.250] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.250] lstrlenW (lpString=".docx") returned 5 [0062.250] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0062.250] lstrlenW (lpString=".pdf") returned 4 [0062.250] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.250] lstrlenW (lpString=".xls") returned 4 [0062.250] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.250] lstrlenW (lpString=".xlsx") returned 5 [0062.250] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0062.250] lstrlenW (lpString=".ppt") returned 4 [0062.250] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.250] lstrlenW (lpString=".zip") returned 4 [0062.250] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.250] lstrlenW (lpString=".rar") returned 4 [0062.250] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.250] lstrlenW (lpString=".bz2") returned 4 [0062.250] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.250] lstrlenW (lpString=".7z") returned 3 [0062.250] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.250] lstrlenW (lpString=".dbf") returned 4 [0062.250] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.250] lstrlenW (lpString=".1cd") returned 4 [0062.250] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.250] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0062.250] lstrlenW (lpString=".jpg") returned 4 [0062.250] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.251] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0062.251] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0062.251] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.252] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=10123) returned 1 [0062.252] CloseHandle (hObject=0x21c) returned 1 [0062.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0062.252] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.252] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.252] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.252] lstrlenW (lpString=".doc") returned 4 [0062.252] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.252] lstrlenW (lpString=".docx") returned 5 [0062.252] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0062.252] lstrlenW (lpString=".pdf") returned 4 [0062.252] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.252] lstrlenW (lpString=".xls") returned 4 [0062.252] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.252] lstrlenW (lpString=".xlsx") returned 5 [0062.252] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0062.252] lstrlenW (lpString=".ppt") returned 4 [0062.253] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.253] lstrlenW (lpString=".zip") returned 4 [0062.253] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.253] lstrlenW (lpString=".rar") returned 4 [0062.253] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.253] lstrlenW (lpString=".bz2") returned 4 [0062.253] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.253] lstrlenW (lpString=".7z") returned 3 [0062.253] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.253] lstrlenW (lpString=".dbf") returned 4 [0062.253] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.253] lstrlenW (lpString=".1cd") returned 4 [0062.253] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.253] lstrlenW (lpString=".jpg") returned 4 [0062.253] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.253] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.253] lstrlenW (lpString=".doc") returned 4 [0062.253] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.253] lstrlenW (lpString=".docx") returned 5 [0062.253] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0062.253] lstrlenW (lpString=".pdf") returned 4 [0062.253] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.253] lstrlenW (lpString=".xls") returned 4 [0062.253] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.253] lstrlenW (lpString=".xlsx") returned 5 [0062.253] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0062.253] lstrlenW (lpString=".ppt") returned 4 [0062.254] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.254] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.254] lstrlenW (lpString=".zip") returned 4 [0062.254] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.254] lstrlenW (lpString=".rar") returned 4 [0062.254] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.254] lstrlenW (lpString=".bz2") returned 4 [0062.254] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.254] lstrlenW (lpString=".7z") returned 3 [0062.254] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.254] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.254] lstrlenW (lpString=".dbf") returned 4 [0062.254] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.254] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.254] lstrlenW (lpString=".1cd") returned 4 [0062.254] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.254] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0062.254] lstrlenW (lpString=".jpg") returned 4 [0062.254] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.254] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0062.254] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0062.254] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0062.255] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3286) returned 1 [0062.255] CloseHandle (hObject=0x21c) returned 1 [0062.255] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0062.255] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.255] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.255] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.255] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.255] lstrlenW (lpString=".doc") returned 4 [0062.255] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.255] lstrlenW (lpString=".docx") returned 5 [0062.255] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0062.255] lstrlenW (lpString=".pdf") returned 4 [0062.255] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.255] lstrlenW (lpString=".xls") returned 4 [0062.255] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.255] lstrlenW (lpString=".xlsx") returned 5 [0062.255] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0062.255] lstrlenW (lpString=".ppt") returned 4 [0062.255] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.255] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.255] lstrlenW (lpString=".zip") returned 4 [0062.255] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.255] lstrlenW (lpString=".rar") returned 4 [0062.255] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.255] lstrlenW (lpString=".bz2") returned 4 [0062.256] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.256] lstrlenW (lpString=".7z") returned 3 [0062.256] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.256] lstrlenW (lpString=".dbf") returned 4 [0062.256] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.256] lstrlenW (lpString=".1cd") returned 4 [0062.256] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.256] lstrlenW (lpString=".jpg") returned 4 [0062.256] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.256] lstrlenW (lpString=".doc") returned 4 [0062.256] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.256] lstrlenW (lpString=".docx") returned 5 [0062.256] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0062.256] lstrlenW (lpString=".pdf") returned 4 [0062.256] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.256] lstrlenW (lpString=".xls") returned 4 [0062.256] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.256] lstrlenW (lpString=".xlsx") returned 5 [0062.256] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0062.256] lstrlenW (lpString=".ppt") returned 4 [0062.256] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.256] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.256] lstrlenW (lpString=".zip") returned 4 [0062.256] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.256] lstrlenW (lpString=".rar") returned 4 [0062.256] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.256] lstrlenW (lpString=".bz2") returned 4 [0062.256] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.257] lstrlenW (lpString=".7z") returned 3 [0062.257] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.257] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.257] lstrlenW (lpString=".dbf") returned 4 [0062.257] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.257] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.257] lstrlenW (lpString=".1cd") returned 4 [0062.257] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.257] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0062.257] lstrlenW (lpString=".jpg") returned 4 [0062.257] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.257] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0062.257] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0062.257] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0062.483] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3316) returned 1 [0062.484] CloseHandle (hObject=0x1e4) returned 1 [0062.484] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0063.211] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.211] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.211] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.211] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.211] lstrlenW (lpString=".doc") returned 4 [0063.212] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.212] lstrlenW (lpString=".docx") returned 5 [0063.212] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0063.212] lstrlenW (lpString=".pdf") returned 4 [0063.212] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.212] lstrlenW (lpString=".xls") returned 4 [0063.212] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.212] lstrlenW (lpString=".xlsx") returned 5 [0063.212] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0063.212] lstrlenW (lpString=".ppt") returned 4 [0063.212] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.212] lstrlenW (lpString=".zip") returned 4 [0063.212] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.212] lstrlenW (lpString=".rar") returned 4 [0063.212] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.212] lstrlenW (lpString=".bz2") returned 4 [0063.212] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.212] lstrlenW (lpString=".7z") returned 3 [0063.212] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.212] lstrlenW (lpString=".dbf") returned 4 [0063.212] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.212] lstrlenW (lpString=".1cd") returned 4 [0063.212] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.212] lstrlenW (lpString=".jpg") returned 4 [0063.212] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.212] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.212] lstrlenW (lpString=".doc") returned 4 [0063.213] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.213] lstrlenW (lpString=".docx") returned 5 [0063.213] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0063.213] lstrlenW (lpString=".pdf") returned 4 [0063.213] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.213] lstrlenW (lpString=".xls") returned 4 [0063.213] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.213] lstrlenW (lpString=".xlsx") returned 5 [0063.213] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0063.213] lstrlenW (lpString=".ppt") returned 4 [0063.213] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.213] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.213] lstrlenW (lpString=".zip") returned 4 [0063.213] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.213] lstrlenW (lpString=".rar") returned 4 [0063.213] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.213] lstrlenW (lpString=".bz2") returned 4 [0063.213] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.213] lstrlenW (lpString=".7z") returned 3 [0063.213] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.213] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.213] lstrlenW (lpString=".dbf") returned 4 [0063.213] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.213] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.213] lstrlenW (lpString=".1cd") returned 4 [0063.213] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.213] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0063.213] lstrlenW (lpString=".jpg") returned 4 [0063.213] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.214] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0063.214] lstrlenW (lpString="nav_uparrow.png") returned 15 [0063.214] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0063.468] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4200) returned 1 [0063.469] CloseHandle (hObject=0x198) returned 1 [0063.469] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png")) returned 0x20 [0063.469] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.469] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\nav_uparrow.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.469] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.469] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.469] lstrlenW (lpString=".doc") returned 4 [0063.469] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.469] lstrlenW (lpString=".docx") returned 5 [0063.469] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0063.469] lstrlenW (lpString=".pdf") returned 4 [0063.469] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.469] lstrlenW (lpString=".xls") returned 4 [0063.469] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.469] lstrlenW (lpString=".xlsx") returned 5 [0063.469] lstrcmpiW (lpString1=".xlsx", lpString2="w.png") returned -1 [0063.469] lstrlenW (lpString=".ppt") returned 4 [0063.469] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.469] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.469] lstrlenW (lpString=".zip") returned 4 [0063.469] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.469] lstrlenW (lpString=".rar") returned 4 [0063.469] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.469] lstrlenW (lpString=".bz2") returned 4 [0063.470] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.470] lstrlenW (lpString=".7z") returned 3 [0063.470] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.470] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.470] lstrlenW (lpString=".dbf") returned 4 [0063.470] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.470] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.470] lstrlenW (lpString=".1cd") returned 4 [0063.470] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.470] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.470] lstrlenW (lpString=".jpg") returned 4 [0063.470] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.470] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.470] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.470] lstrlenW (lpString=".doc") returned 4 [0063.470] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.470] lstrlenW (lpString=".docx") returned 5 [0063.470] lstrcmpiW (lpString1=".docx", lpString2="w.png") returned -1 [0063.470] lstrlenW (lpString=".pdf") returned 4 [0063.470] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.470] lstrlenW (lpString=".xls") returned 4 [0063.470] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.470] lstrlenW (lpString=".xlsx") returned 5 [0063.470] lstrcmpiW (lpString1=".xlsx", lpString2="w.png") returned -1 [0063.470] lstrlenW (lpString=".ppt") returned 4 [0063.470] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.470] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.470] lstrlenW (lpString=".zip") returned 4 [0063.470] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.470] lstrlenW (lpString=".rar") returned 4 [0063.470] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.470] lstrlenW (lpString=".bz2") returned 4 [0063.471] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.471] lstrlenW (lpString=".7z") returned 3 [0063.471] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.471] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.471] lstrlenW (lpString=".dbf") returned 4 [0063.471] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.471] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.471] lstrlenW (lpString=".1cd") returned 4 [0063.471] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.471] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\nav_uparrow.png") returned 67 [0063.471] lstrlenW (lpString=".jpg") returned 4 [0063.471] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.471] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0063.471] lstrlenW (lpString="circleround_glass.png") returned 21 [0063.471] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0063.977] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=27281) returned 1 [0063.977] CloseHandle (hObject=0x1d8) returned 1 [0063.977] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png")) returned 0x20 [0063.977] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\circleround_glass.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0063.978] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.978] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.978] lstrlenW (lpString=".doc") returned 4 [0063.978] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.978] lstrlenW (lpString=".docx") returned 5 [0063.978] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0063.978] lstrlenW (lpString=".pdf") returned 4 [0063.978] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.978] lstrlenW (lpString=".xls") returned 4 [0063.978] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.978] lstrlenW (lpString=".xlsx") returned 5 [0063.978] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0063.978] lstrlenW (lpString=".ppt") returned 4 [0063.978] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.978] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.978] lstrlenW (lpString=".zip") returned 4 [0063.978] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.978] lstrlenW (lpString=".rar") returned 4 [0063.978] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.978] lstrlenW (lpString=".bz2") returned 4 [0063.978] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.978] lstrlenW (lpString=".7z") returned 3 [0063.978] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.978] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.978] lstrlenW (lpString=".dbf") returned 4 [0063.978] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.978] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.978] lstrlenW (lpString=".1cd") returned 4 [0063.978] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.978] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.978] lstrlenW (lpString=".jpg") returned 4 [0063.978] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.979] lstrlenW (lpString=".doc") returned 4 [0063.979] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0063.979] lstrlenW (lpString=".docx") returned 5 [0063.979] lstrcmpiW (lpString1=".docx", lpString2="s.png") returned -1 [0063.979] lstrlenW (lpString=".pdf") returned 4 [0063.979] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0063.979] lstrlenW (lpString=".xls") returned 4 [0063.979] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0063.979] lstrlenW (lpString=".xlsx") returned 5 [0063.979] lstrcmpiW (lpString1=".xlsx", lpString2="s.png") returned -1 [0063.979] lstrlenW (lpString=".ppt") returned 4 [0063.979] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0063.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.979] lstrlenW (lpString=".zip") returned 4 [0063.979] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0063.979] lstrlenW (lpString=".rar") returned 4 [0063.979] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0063.979] lstrlenW (lpString=".bz2") returned 4 [0063.979] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0063.979] lstrlenW (lpString=".7z") returned 3 [0063.979] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0063.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.979] lstrlenW (lpString=".dbf") returned 4 [0063.979] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0063.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.979] lstrlenW (lpString=".1cd") returned 4 [0063.979] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0063.979] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\circleround_glass.png") returned 65 [0063.979] lstrlenW (lpString=".jpg") returned 4 [0063.979] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0063.980] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0063.980] lstrlenW (lpString="blackbars60.png") returned 15 [0063.980] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.296] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6431) returned 1 [0064.296] CloseHandle (hObject=0x1e4) returned 1 [0064.296] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png")) returned 0x20 [0064.297] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.297] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\blackbars60.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.297] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.297] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.297] lstrlenW (lpString=".doc") returned 4 [0064.297] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.297] lstrlenW (lpString=".docx") returned 5 [0064.297] lstrcmpiW (lpString1=".docx", lpString2="0.png") returned -1 [0064.297] lstrlenW (lpString=".pdf") returned 4 [0064.297] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.297] lstrlenW (lpString=".xls") returned 4 [0064.297] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.297] lstrlenW (lpString=".xlsx") returned 5 [0064.297] lstrcmpiW (lpString1=".xlsx", lpString2="0.png") returned -1 [0064.297] lstrlenW (lpString=".ppt") returned 4 [0064.297] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.297] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.297] lstrlenW (lpString=".zip") returned 4 [0064.297] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.297] lstrlenW (lpString=".rar") returned 4 [0064.297] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.297] lstrlenW (lpString=".bz2") returned 4 [0064.297] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.297] lstrlenW (lpString=".7z") returned 3 [0064.297] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.297] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.297] lstrlenW (lpString=".dbf") returned 4 [0064.297] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.298] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.298] lstrlenW (lpString=".1cd") returned 4 [0064.298] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.298] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.298] lstrlenW (lpString=".jpg") returned 4 [0064.298] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.298] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.298] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.298] lstrlenW (lpString=".doc") returned 4 [0064.298] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.298] lstrlenW (lpString=".docx") returned 5 [0064.298] lstrcmpiW (lpString1=".docx", lpString2="0.png") returned -1 [0064.298] lstrlenW (lpString=".pdf") returned 4 [0064.298] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.298] lstrlenW (lpString=".xls") returned 4 [0064.298] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.298] lstrlenW (lpString=".xlsx") returned 5 [0064.298] lstrcmpiW (lpString1=".xlsx", lpString2="0.png") returned -1 [0064.298] lstrlenW (lpString=".ppt") returned 4 [0064.298] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.298] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.298] lstrlenW (lpString=".zip") returned 4 [0064.298] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.298] lstrlenW (lpString=".rar") returned 4 [0064.298] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.298] lstrlenW (lpString=".bz2") returned 4 [0064.298] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.298] lstrlenW (lpString=".7z") returned 3 [0064.298] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.298] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.298] lstrlenW (lpString=".dbf") returned 4 [0064.298] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.299] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.299] lstrlenW (lpString=".1cd") returned 4 [0064.299] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.299] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\blackbars60.png") returned 73 [0064.299] lstrlenW (lpString=".jpg") returned 4 [0064.299] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.299] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0064.299] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0064.299] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.301] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3130) returned 1 [0064.301] CloseHandle (hObject=0x1e4) returned 1 [0064.301] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png")) returned 0x20 [0064.301] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.301] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.301] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.301] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.301] lstrlenW (lpString=".doc") returned 4 [0064.301] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.301] lstrlenW (lpString=".docx") returned 5 [0064.301] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.301] lstrlenW (lpString=".pdf") returned 4 [0064.301] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.301] lstrlenW (lpString=".xls") returned 4 [0064.301] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.301] lstrlenW (lpString=".xlsx") returned 5 [0064.301] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.301] lstrlenW (lpString=".ppt") returned 4 [0064.301] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.301] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.301] lstrlenW (lpString=".zip") returned 4 [0064.302] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.302] lstrlenW (lpString=".rar") returned 4 [0064.302] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.302] lstrlenW (lpString=".bz2") returned 4 [0064.302] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.302] lstrlenW (lpString=".7z") returned 3 [0064.302] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.302] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.302] lstrlenW (lpString=".dbf") returned 4 [0064.302] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.302] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.302] lstrlenW (lpString=".1cd") returned 4 [0064.302] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.302] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.302] lstrlenW (lpString=".jpg") returned 4 [0064.302] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.302] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.302] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.302] lstrlenW (lpString=".doc") returned 4 [0064.302] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.302] lstrlenW (lpString=".docx") returned 5 [0064.302] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.302] lstrlenW (lpString=".pdf") returned 4 [0064.302] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.302] lstrlenW (lpString=".xls") returned 4 [0064.302] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.302] lstrlenW (lpString=".xlsx") returned 5 [0064.302] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.302] lstrlenW (lpString=".ppt") returned 4 [0064.302] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.302] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.302] lstrlenW (lpString=".zip") returned 4 [0064.302] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.303] lstrlenW (lpString=".rar") returned 4 [0064.303] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.303] lstrlenW (lpString=".bz2") returned 4 [0064.303] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.303] lstrlenW (lpString=".7z") returned 3 [0064.303] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.303] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.303] lstrlenW (lpString=".dbf") returned 4 [0064.303] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.303] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.303] lstrlenW (lpString=".1cd") returned 4 [0064.303] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.303] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationLeft_SelectionSubpicture.png") returned 96 [0064.303] lstrlenW (lpString=".jpg") returned 4 [0064.303] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.303] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0064.303] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0064.303] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.307] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=5025) returned 1 [0064.307] CloseHandle (hObject=0x1e4) returned 1 [0064.307] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png")) returned 0x20 [0064.307] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.307] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.308] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.308] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.308] lstrlenW (lpString=".doc") returned 4 [0064.308] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.308] lstrlenW (lpString=".docx") returned 5 [0064.308] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0064.308] lstrlenW (lpString=".pdf") returned 4 [0064.308] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.308] lstrlenW (lpString=".xls") returned 4 [0064.308] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.308] lstrlenW (lpString=".xlsx") returned 5 [0064.308] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0064.308] lstrlenW (lpString=".ppt") returned 4 [0064.308] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.308] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.308] lstrlenW (lpString=".zip") returned 4 [0064.308] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.308] lstrlenW (lpString=".rar") returned 4 [0064.308] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.308] lstrlenW (lpString=".bz2") returned 4 [0064.308] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.308] lstrlenW (lpString=".7z") returned 3 [0064.308] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.308] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.308] lstrlenW (lpString=".dbf") returned 4 [0064.308] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.308] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.308] lstrlenW (lpString=".1cd") returned 4 [0064.308] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.308] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.308] lstrlenW (lpString=".jpg") returned 4 [0064.308] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.309] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.309] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.309] lstrlenW (lpString=".doc") returned 4 [0064.309] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.309] lstrlenW (lpString=".docx") returned 5 [0064.309] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0064.309] lstrlenW (lpString=".pdf") returned 4 [0064.309] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.309] lstrlenW (lpString=".xls") returned 4 [0064.309] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.309] lstrlenW (lpString=".xlsx") returned 5 [0064.309] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0064.309] lstrlenW (lpString=".ppt") returned 4 [0064.309] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.309] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.309] lstrlenW (lpString=".zip") returned 4 [0064.309] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.309] lstrlenW (lpString=".rar") returned 4 [0064.309] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.309] lstrlenW (lpString=".bz2") returned 4 [0064.309] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.309] lstrlenW (lpString=".7z") returned 3 [0064.309] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.309] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.309] lstrlenW (lpString=".dbf") returned 4 [0064.309] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.309] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.309] lstrlenW (lpString=".1cd") returned 4 [0064.309] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.309] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_ButtonGraphic.png") returned 91 [0064.309] lstrlenW (lpString=".jpg") returned 4 [0064.309] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.310] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0064.310] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0064.310] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.313] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3118) returned 1 [0064.313] CloseHandle (hObject=0x1e4) returned 1 [0064.313] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png")) returned 0x20 [0064.313] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.313] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.313] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.313] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.313] lstrlenW (lpString=".doc") returned 4 [0064.313] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.313] lstrlenW (lpString=".docx") returned 5 [0064.313] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.313] lstrlenW (lpString=".pdf") returned 4 [0064.313] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.313] lstrlenW (lpString=".xls") returned 4 [0064.313] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.314] lstrlenW (lpString=".xlsx") returned 5 [0064.314] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.314] lstrlenW (lpString=".ppt") returned 4 [0064.314] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.314] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.314] lstrlenW (lpString=".zip") returned 4 [0064.314] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.314] lstrlenW (lpString=".rar") returned 4 [0064.314] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.314] lstrlenW (lpString=".bz2") returned 4 [0064.314] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.314] lstrlenW (lpString=".7z") returned 3 [0064.314] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.314] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.314] lstrlenW (lpString=".dbf") returned 4 [0064.314] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.314] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.314] lstrlenW (lpString=".1cd") returned 4 [0064.314] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.314] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.314] lstrlenW (lpString=".jpg") returned 4 [0064.314] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.314] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.314] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.314] lstrlenW (lpString=".doc") returned 4 [0064.314] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.314] lstrlenW (lpString=".docx") returned 5 [0064.314] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0064.314] lstrlenW (lpString=".pdf") returned 4 [0064.314] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.314] lstrlenW (lpString=".xls") returned 4 [0064.314] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.314] lstrlenW (lpString=".xlsx") returned 5 [0064.315] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0064.315] lstrlenW (lpString=".ppt") returned 4 [0064.315] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.315] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.315] lstrlenW (lpString=".zip") returned 4 [0064.315] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.315] lstrlenW (lpString=".rar") returned 4 [0064.315] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.315] lstrlenW (lpString=".bz2") returned 4 [0064.315] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.315] lstrlenW (lpString=".7z") returned 3 [0064.315] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.315] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.315] lstrlenW (lpString=".dbf") returned 4 [0064.315] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0064.315] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.315] lstrlenW (lpString=".1cd") returned 4 [0064.315] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0064.315] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationRight_SelectionSubpicture.png") returned 97 [0064.315] lstrlenW (lpString=".jpg") returned 4 [0064.315] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0064.315] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0064.315] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0064.315] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0064.317] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4955) returned 1 [0064.317] CloseHandle (hObject=0x1e4) returned 1 [0064.317] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png")) returned 0x20 [0064.317] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.317] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\layeredtitles\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.317] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0064.317] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0064.317] lstrlenW (lpString=".doc") returned 4 [0064.317] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0064.317] lstrlenW (lpString=".docx") returned 5 [0064.317] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0064.317] lstrlenW (lpString=".pdf") returned 4 [0064.317] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0064.317] lstrlenW (lpString=".xls") returned 4 [0064.317] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0064.317] lstrlenW (lpString=".xlsx") returned 5 [0064.317] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0064.317] lstrlenW (lpString=".ppt") returned 4 [0064.317] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0064.317] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0064.317] lstrlenW (lpString=".zip") returned 4 [0064.317] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0064.317] lstrlenW (lpString=".rar") returned 4 [0064.318] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0064.318] lstrlenW (lpString=".bz2") returned 4 [0064.318] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0064.318] lstrlenW (lpString=".7z") returned 3 [0064.318] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0064.318] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\LayeredTitles\\NavigationUp_ButtonGraphic.png") returned 88 [0064.318] lstrlenW (lpString=".dbf") returned 4 [0064.318] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0065.358] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.358] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0065.358] GetLastError () returned 0x0 [0065.358] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0065.366] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0065.389] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.389] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.389] SetEndOfFile (hFile=0x21c) returned 1 [0065.390] CloseHandle (hObject=0x21c) returned 1 [0065.390] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.390] SetEndOfFile (hFile=0x200) returned 1 [0065.391] CloseHandle (hObject=0x200) returned 1 [0065.391] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0065.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.392] lstrlenW (lpString=".doc") returned 4 [0065.392] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.392] lstrlenW (lpString=".docx") returned 5 [0065.392] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0065.392] lstrlenW (lpString=".pdf") returned 4 [0065.392] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.392] lstrlenW (lpString=".xls") returned 4 [0065.392] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.392] lstrlenW (lpString=".xlsx") returned 5 [0065.392] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0065.392] lstrlenW (lpString=".ppt") returned 4 [0065.392] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.392] lstrlenW (lpString=".zip") returned 4 [0065.392] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.392] lstrlenW (lpString=".rar") returned 4 [0065.392] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.392] lstrlenW (lpString=".bz2") returned 4 [0065.392] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.392] lstrlenW (lpString=".7z") returned 3 [0065.392] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.392] lstrlenW (lpString=".dbf") returned 4 [0065.392] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.392] lstrlenW (lpString=".1cd") returned 4 [0065.392] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.393] lstrlenW (lpString=".jpg") returned 4 [0065.393] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.393] lstrlenW (lpString=".doc") returned 4 [0065.393] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.393] lstrlenW (lpString=".docx") returned 5 [0065.393] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0065.393] lstrlenW (lpString=".pdf") returned 4 [0065.393] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.393] lstrlenW (lpString=".xls") returned 4 [0065.393] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.393] lstrlenW (lpString=".xlsx") returned 5 [0065.393] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0065.393] lstrlenW (lpString=".ppt") returned 4 [0065.393] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.393] lstrlenW (lpString=".zip") returned 4 [0065.393] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.393] lstrlenW (lpString=".rar") returned 4 [0065.393] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.393] lstrlenW (lpString=".bz2") returned 4 [0065.393] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.393] lstrlenW (lpString=".7z") returned 3 [0065.393] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.393] lstrlenW (lpString=".dbf") returned 4 [0065.393] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.393] lstrlenW (lpString=".1cd") returned 4 [0065.394] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0065.394] lstrlenW (lpString=".jpg") returned 4 [0065.394] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.394] lstrcmpiW (lpString1=".xsl", lpString2=".wiki") returned 1 [0065.394] lstrlenW (lpString="sql2000.xsl") returned 11 [0065.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0065.448] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=34076) returned 1 [0065.448] CloseHandle (hObject=0x200) returned 1 [0065.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0065.448] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0065.448] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.448] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0065.449] GetLastError () returned 0x0 [0065.449] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x851c, lpOverlapped=0x0) returned 1 [0065.459] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x8520, lpOverlapped=0x0) returned 1 [0065.461] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.461] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xea, lpOverlapped=0x0) returned 1 [0065.461] SetEndOfFile (hFile=0x21c) returned 1 [0065.461] CloseHandle (hObject=0x21c) returned 1 [0065.461] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.461] SetEndOfFile (hFile=0x200) returned 1 [0065.462] CloseHandle (hObject=0x200) returned 1 [0065.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0065.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.463] lstrlenW (lpString=".doc") returned 4 [0065.463] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.463] lstrlenW (lpString=".docx") returned 5 [0065.463] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.463] lstrlenW (lpString=".pdf") returned 4 [0065.463] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.463] lstrlenW (lpString=".xls") returned 4 [0065.463] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.463] lstrlenW (lpString=".xlsx") returned 5 [0065.463] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.463] lstrlenW (lpString=".ppt") returned 4 [0065.463] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.463] lstrlenW (lpString=".zip") returned 4 [0065.463] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.463] lstrlenW (lpString=".rar") returned 4 [0065.463] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.463] lstrlenW (lpString=".bz2") returned 4 [0065.463] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.463] lstrlenW (lpString=".7z") returned 3 [0065.463] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.464] lstrlenW (lpString=".dbf") returned 4 [0065.464] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.464] lstrlenW (lpString=".1cd") returned 4 [0065.464] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.464] lstrlenW (lpString=".jpg") returned 4 [0065.464] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.464] lstrlenW (lpString=".doc") returned 4 [0065.464] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.464] lstrlenW (lpString=".docx") returned 5 [0065.464] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.464] lstrlenW (lpString=".pdf") returned 4 [0065.464] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.464] lstrlenW (lpString=".xls") returned 4 [0065.464] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.464] lstrlenW (lpString=".xlsx") returned 5 [0065.464] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.464] lstrlenW (lpString=".ppt") returned 4 [0065.464] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.464] lstrlenW (lpString=".zip") returned 4 [0065.464] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.464] lstrlenW (lpString=".rar") returned 4 [0065.464] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.464] lstrlenW (lpString=".bz2") returned 4 [0065.464] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.464] lstrlenW (lpString=".7z") returned 3 [0065.465] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.465] lstrlenW (lpString=".dbf") returned 4 [0065.465] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.465] lstrlenW (lpString=".1cd") returned 4 [0065.465] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0065.465] lstrlenW (lpString=".jpg") returned 4 [0065.465] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.465] lstrcmpiW (lpString1=".xsl", lpString2=".wiki") returned 1 [0065.465] lstrlenW (lpString="sql70.xsl") returned 9 [0065.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0065.468] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=32146) returned 1 [0065.468] CloseHandle (hObject=0x200) returned 1 [0065.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0065.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0065.469] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.469] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0065.469] GetLastError () returned 0x0 [0065.469] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x7d92, lpOverlapped=0x0) returned 1 [0065.471] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0065.472] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.472] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.473] SetEndOfFile (hFile=0x21c) returned 1 [0065.473] CloseHandle (hObject=0x21c) returned 1 [0065.473] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.473] SetEndOfFile (hFile=0x200) returned 1 [0065.474] CloseHandle (hObject=0x200) returned 1 [0065.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0065.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.474] lstrlenW (lpString=".doc") returned 4 [0065.474] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.474] lstrlenW (lpString=".docx") returned 5 [0065.475] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.475] lstrlenW (lpString=".pdf") returned 4 [0065.475] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.475] lstrlenW (lpString=".xls") returned 4 [0065.475] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.475] lstrlenW (lpString=".xlsx") returned 5 [0065.475] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.475] lstrlenW (lpString=".ppt") returned 4 [0065.475] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.475] lstrlenW (lpString=".zip") returned 4 [0065.475] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.475] lstrlenW (lpString=".rar") returned 4 [0065.475] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.475] lstrlenW (lpString=".bz2") returned 4 [0065.475] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.475] lstrlenW (lpString=".7z") returned 3 [0065.475] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.475] lstrlenW (lpString=".dbf") returned 4 [0065.475] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.475] lstrlenW (lpString=".1cd") returned 4 [0065.475] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.475] lstrlenW (lpString=".jpg") returned 4 [0065.475] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.475] lstrlenW (lpString=".doc") returned 4 [0065.476] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.476] lstrlenW (lpString=".docx") returned 5 [0065.476] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.476] lstrlenW (lpString=".pdf") returned 4 [0065.476] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.476] lstrlenW (lpString=".xls") returned 4 [0065.476] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.476] lstrlenW (lpString=".xlsx") returned 5 [0065.476] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.476] lstrlenW (lpString=".ppt") returned 4 [0065.476] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.476] lstrlenW (lpString=".zip") returned 4 [0065.476] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.476] lstrlenW (lpString=".rar") returned 4 [0065.476] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.476] lstrlenW (lpString=".bz2") returned 4 [0065.476] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.476] lstrlenW (lpString=".7z") returned 3 [0065.476] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.476] lstrlenW (lpString=".dbf") returned 4 [0065.476] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.476] lstrlenW (lpString=".1cd") returned 4 [0065.476] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0065.476] lstrlenW (lpString=".jpg") returned 4 [0065.476] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.477] lstrcmpiW (lpString1=".xsl", lpString2=".wiki") returned 1 [0065.477] lstrlenW (lpString="sql90.xsl") returned 9 [0065.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0065.477] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=39515) returned 1 [0065.477] CloseHandle (hObject=0x200) returned 1 [0065.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0065.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0065.477] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.477] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0065.478] GetLastError () returned 0x0 [0065.478] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0066.178] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0066.180] ReadFile (in: hFile=0x200, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.180] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0066.180] SetEndOfFile (hFile=0x21c) returned 1 [0066.180] CloseHandle (hObject=0x21c) returned 1 [0066.180] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.180] SetEndOfFile (hFile=0x200) returned 1 [0066.181] CloseHandle (hObject=0x200) returned 1 [0066.181] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0066.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.182] lstrlenW (lpString=".doc") returned 4 [0066.182] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0066.182] lstrlenW (lpString=".docx") returned 5 [0066.182] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0066.182] lstrlenW (lpString=".pdf") returned 4 [0066.182] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0066.182] lstrlenW (lpString=".xls") returned 4 [0066.182] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0066.182] lstrlenW (lpString=".xlsx") returned 5 [0066.182] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0066.182] lstrlenW (lpString=".ppt") returned 4 [0066.182] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0066.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.182] lstrlenW (lpString=".zip") returned 4 [0066.182] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0066.182] lstrlenW (lpString=".rar") returned 4 [0066.182] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0066.182] lstrlenW (lpString=".bz2") returned 4 [0066.182] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0066.182] lstrlenW (lpString=".7z") returned 3 [0066.182] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0066.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.182] lstrlenW (lpString=".dbf") returned 4 [0066.182] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0066.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.183] lstrlenW (lpString=".1cd") returned 4 [0066.183] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0066.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.183] lstrlenW (lpString=".jpg") returned 4 [0066.183] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0066.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.183] lstrlenW (lpString=".doc") returned 4 [0066.183] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0066.183] lstrlenW (lpString=".docx") returned 5 [0066.183] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0066.183] lstrlenW (lpString=".pdf") returned 4 [0066.183] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0066.183] lstrlenW (lpString=".xls") returned 4 [0066.183] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0066.183] lstrlenW (lpString=".xlsx") returned 5 [0066.183] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0066.183] lstrlenW (lpString=".ppt") returned 4 [0066.183] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0066.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.183] lstrlenW (lpString=".zip") returned 4 [0066.183] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0066.183] lstrlenW (lpString=".rar") returned 4 [0066.183] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0066.183] lstrlenW (lpString=".bz2") returned 4 [0066.183] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0066.183] lstrlenW (lpString=".7z") returned 3 [0066.184] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0066.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.184] lstrlenW (lpString=".dbf") returned 4 [0066.184] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0066.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.184] lstrlenW (lpString=".1cd") returned 4 [0066.184] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0066.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0066.184] lstrlenW (lpString=".jpg") returned 4 [0066.184] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0066.184] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.184] lstrlenW (lpString="AG00037_.GIF") returned 12 [0066.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.544] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6684) returned 1 [0066.544] CloseHandle (hObject=0x198) returned 1 [0066.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0066.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.552] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.552] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.552] GetLastError () returned 0x0 [0066.552] ReadFile (in: hFile=0x198, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0066.554] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0066.555] ReadFile (in: hFile=0x198, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.555] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.555] SetEndOfFile (hFile=0x218) returned 1 [0066.555] CloseHandle (hObject=0x218) returned 1 [0066.555] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.555] SetEndOfFile (hFile=0x198) returned 1 [0066.556] CloseHandle (hObject=0x198) returned 1 [0066.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.556] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0066.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.557] lstrlenW (lpString=".doc") returned 4 [0066.557] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.557] lstrlenW (lpString=".docx") returned 5 [0066.557] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.557] lstrlenW (lpString=".pdf") returned 4 [0066.557] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.557] lstrlenW (lpString=".xls") returned 4 [0066.557] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.557] lstrlenW (lpString=".xlsx") returned 5 [0066.557] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.557] lstrlenW (lpString=".ppt") returned 4 [0066.557] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.557] lstrlenW (lpString=".zip") returned 4 [0066.557] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.557] lstrlenW (lpString=".rar") returned 4 [0066.557] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.557] lstrlenW (lpString=".bz2") returned 4 [0066.557] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.557] lstrlenW (lpString=".7z") returned 3 [0066.557] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.557] lstrlenW (lpString=".dbf") returned 4 [0066.557] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.557] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.557] lstrlenW (lpString=".1cd") returned 4 [0066.558] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.558] lstrlenW (lpString=".jpg") returned 4 [0066.558] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.558] lstrlenW (lpString=".doc") returned 4 [0066.558] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.558] lstrlenW (lpString=".docx") returned 5 [0066.558] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.558] lstrlenW (lpString=".pdf") returned 4 [0066.558] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.558] lstrlenW (lpString=".xls") returned 4 [0066.558] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.558] lstrlenW (lpString=".xlsx") returned 5 [0066.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.558] lstrlenW (lpString=".ppt") returned 4 [0066.558] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.558] lstrlenW (lpString=".zip") returned 4 [0066.558] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.558] lstrlenW (lpString=".rar") returned 4 [0066.558] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.558] lstrlenW (lpString=".bz2") returned 4 [0066.558] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.558] lstrlenW (lpString=".7z") returned 3 [0066.558] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.558] lstrlenW (lpString=".dbf") returned 4 [0066.558] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.559] lstrlenW (lpString=".1cd") returned 4 [0066.559] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0066.559] lstrlenW (lpString=".jpg") returned 4 [0066.559] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.559] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.559] lstrlenW (lpString="AG00090_.GIF") returned 12 [0066.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.559] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=517) returned 1 [0066.559] CloseHandle (hObject=0x198) returned 1 [0066.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0066.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.559] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.560] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.560] GetLastError () returned 0x0 [0066.560] ReadFile (in: hFile=0x198, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x205, lpOverlapped=0x0) returned 1 [0066.561] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x210, lpOverlapped=0x0) returned 1 [0066.562] ReadFile (in: hFile=0x198, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.562] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.562] SetEndOfFile (hFile=0x218) returned 1 [0066.562] CloseHandle (hObject=0x218) returned 1 [0066.562] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.562] SetEndOfFile (hFile=0x198) returned 1 [0066.563] CloseHandle (hObject=0x198) returned 1 [0066.563] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.563] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0066.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.563] lstrlenW (lpString=".doc") returned 4 [0066.563] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.564] lstrlenW (lpString=".docx") returned 5 [0066.564] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.564] lstrlenW (lpString=".pdf") returned 4 [0066.564] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.564] lstrlenW (lpString=".xls") returned 4 [0066.564] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.564] lstrlenW (lpString=".xlsx") returned 5 [0066.564] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.564] lstrlenW (lpString=".ppt") returned 4 [0066.564] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.564] lstrlenW (lpString=".zip") returned 4 [0066.564] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.564] lstrlenW (lpString=".rar") returned 4 [0066.564] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.564] lstrlenW (lpString=".bz2") returned 4 [0066.564] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.564] lstrlenW (lpString=".7z") returned 3 [0066.564] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.564] lstrlenW (lpString=".dbf") returned 4 [0066.564] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.564] lstrlenW (lpString=".1cd") returned 4 [0066.564] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.564] lstrlenW (lpString=".jpg") returned 4 [0066.564] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.564] lstrlenW (lpString=".doc") returned 4 [0066.564] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.565] lstrlenW (lpString=".docx") returned 5 [0066.565] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.565] lstrlenW (lpString=".pdf") returned 4 [0066.565] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.565] lstrlenW (lpString=".xls") returned 4 [0066.565] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.565] lstrlenW (lpString=".xlsx") returned 5 [0066.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.565] lstrlenW (lpString=".ppt") returned 4 [0066.565] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.565] lstrlenW (lpString=".zip") returned 4 [0066.565] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.565] lstrlenW (lpString=".rar") returned 4 [0066.565] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.565] lstrlenW (lpString=".bz2") returned 4 [0066.565] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.565] lstrlenW (lpString=".7z") returned 3 [0066.565] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.565] lstrlenW (lpString=".dbf") returned 4 [0066.565] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.565] lstrlenW (lpString=".1cd") returned 4 [0066.565] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0066.565] lstrlenW (lpString=".jpg") returned 4 [0066.565] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.565] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.566] lstrlenW (lpString="AG00092_.GIF") returned 12 [0066.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.566] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=502) returned 1 [0066.566] CloseHandle (hObject=0x198) returned 1 [0066.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0066.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.566] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.566] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.566] GetLastError () returned 0x0 [0066.567] ReadFile (in: hFile=0x198, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1f6, lpOverlapped=0x0) returned 1 [0066.567] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x200, lpOverlapped=0x0) returned 1 [0066.568] ReadFile (in: hFile=0x198, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.568] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.568] SetEndOfFile (hFile=0x218) returned 1 [0066.569] CloseHandle (hObject=0x218) returned 1 [0066.569] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.569] SetEndOfFile (hFile=0x198) returned 1 [0066.569] CloseHandle (hObject=0x198) returned 1 [0066.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0066.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.570] lstrlenW (lpString=".doc") returned 4 [0066.570] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.570] lstrlenW (lpString=".docx") returned 5 [0066.570] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.570] lstrlenW (lpString=".pdf") returned 4 [0066.570] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.570] lstrlenW (lpString=".xls") returned 4 [0066.570] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.570] lstrlenW (lpString=".xlsx") returned 5 [0066.570] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.570] lstrlenW (lpString=".ppt") returned 4 [0066.570] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.570] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.570] lstrlenW (lpString=".zip") returned 4 [0066.570] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.570] lstrlenW (lpString=".rar") returned 4 [0066.570] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.571] lstrlenW (lpString=".bz2") returned 4 [0066.571] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.571] lstrlenW (lpString=".7z") returned 3 [0066.571] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.571] lstrlenW (lpString=".dbf") returned 4 [0066.571] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.571] lstrlenW (lpString=".1cd") returned 4 [0066.571] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.571] lstrlenW (lpString=".jpg") returned 4 [0066.571] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.571] lstrlenW (lpString=".doc") returned 4 [0066.571] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.571] lstrlenW (lpString=".docx") returned 5 [0066.571] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.571] lstrlenW (lpString=".pdf") returned 4 [0066.571] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.571] lstrlenW (lpString=".xls") returned 4 [0066.571] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.571] lstrlenW (lpString=".xlsx") returned 5 [0066.571] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.571] lstrlenW (lpString=".ppt") returned 4 [0066.571] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.571] lstrlenW (lpString=".zip") returned 4 [0066.571] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.571] lstrlenW (lpString=".rar") returned 4 [0066.571] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.572] lstrlenW (lpString=".bz2") returned 4 [0066.572] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.572] lstrlenW (lpString=".7z") returned 3 [0066.572] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.572] lstrlenW (lpString=".dbf") returned 4 [0066.572] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.572] lstrlenW (lpString=".1cd") returned 4 [0066.572] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0066.572] lstrlenW (lpString=".jpg") returned 4 [0066.572] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.572] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.572] lstrlenW (lpString="AG00103_.GIF") returned 12 [0066.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.573] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=12702) returned 1 [0066.573] CloseHandle (hObject=0x198) returned 1 [0066.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0066.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.573] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.573] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.574] GetLastError () returned 0x0 [0066.574] ReadFile (in: hFile=0x198, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x319e, lpOverlapped=0x0) returned 1 [0066.576] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0066.579] ReadFile (in: hFile=0x198, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.579] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.579] SetEndOfFile (hFile=0x218) returned 1 [0066.579] CloseHandle (hObject=0x218) returned 1 [0066.579] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.579] SetEndOfFile (hFile=0x198) returned 1 [0066.580] CloseHandle (hObject=0x198) returned 1 [0066.580] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0066.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.581] lstrlenW (lpString=".doc") returned 4 [0066.581] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.581] lstrlenW (lpString=".docx") returned 5 [0066.581] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.581] lstrlenW (lpString=".pdf") returned 4 [0066.581] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.581] lstrlenW (lpString=".xls") returned 4 [0066.581] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.581] lstrlenW (lpString=".xlsx") returned 5 [0066.581] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.581] lstrlenW (lpString=".ppt") returned 4 [0066.581] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.581] lstrlenW (lpString=".zip") returned 4 [0066.581] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.581] lstrlenW (lpString=".rar") returned 4 [0066.581] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.581] lstrlenW (lpString=".bz2") returned 4 [0066.581] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.581] lstrlenW (lpString=".7z") returned 3 [0066.581] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.581] lstrlenW (lpString=".dbf") returned 4 [0066.581] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.582] lstrlenW (lpString=".1cd") returned 4 [0066.582] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.582] lstrlenW (lpString=".jpg") returned 4 [0066.582] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.582] lstrlenW (lpString=".doc") returned 4 [0066.582] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.582] lstrlenW (lpString=".docx") returned 5 [0066.582] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.582] lstrlenW (lpString=".pdf") returned 4 [0066.582] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.582] lstrlenW (lpString=".xls") returned 4 [0066.582] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.582] lstrlenW (lpString=".xlsx") returned 5 [0066.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.582] lstrlenW (lpString=".ppt") returned 4 [0066.582] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.582] lstrlenW (lpString=".zip") returned 4 [0066.582] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.582] lstrlenW (lpString=".rar") returned 4 [0066.582] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.582] lstrlenW (lpString=".bz2") returned 4 [0066.582] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.582] lstrlenW (lpString=".7z") returned 3 [0066.582] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.582] lstrlenW (lpString=".dbf") returned 4 [0066.582] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.582] lstrlenW (lpString=".1cd") returned 4 [0066.583] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0066.583] lstrlenW (lpString=".jpg") returned 4 [0066.583] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.583] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.583] lstrlenW (lpString="AG00120_.GIF") returned 12 [0066.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.583] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3484) returned 1 [0066.583] CloseHandle (hObject=0x198) returned 1 [0066.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0066.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.583] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.584] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0066.584] GetLastError () returned 0x0 [0066.584] ReadFile (in: hFile=0x198, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0067.275] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0067.276] ReadFile (in: hFile=0x198, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.276] WriteFile (in: hFile=0x218, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.276] SetEndOfFile (hFile=0x218) returned 1 [0067.276] CloseHandle (hObject=0x218) returned 1 [0067.277] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.277] SetEndOfFile (hFile=0x198) returned 1 [0067.277] CloseHandle (hObject=0x198) returned 1 [0067.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0067.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.478] lstrlenW (lpString=".doc") returned 4 [0067.478] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0067.478] lstrlenW (lpString=".docx") returned 5 [0067.479] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0067.479] lstrlenW (lpString=".pdf") returned 4 [0067.479] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0067.479] lstrlenW (lpString=".xls") returned 4 [0067.479] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0067.479] lstrlenW (lpString=".xlsx") returned 5 [0067.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0067.479] lstrlenW (lpString=".ppt") returned 4 [0067.479] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.479] lstrlenW (lpString=".zip") returned 4 [0067.479] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0067.479] lstrlenW (lpString=".rar") returned 4 [0067.479] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0067.479] lstrlenW (lpString=".bz2") returned 4 [0067.479] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0067.479] lstrlenW (lpString=".7z") returned 3 [0067.479] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.479] lstrlenW (lpString=".dbf") returned 4 [0067.479] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.479] lstrlenW (lpString=".1cd") returned 4 [0067.479] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.479] lstrlenW (lpString=".jpg") returned 4 [0067.479] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.479] lstrlenW (lpString=".doc") returned 4 [0067.479] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0067.479] lstrlenW (lpString=".docx") returned 5 [0067.480] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0067.480] lstrlenW (lpString=".pdf") returned 4 [0067.480] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0067.480] lstrlenW (lpString=".xls") returned 4 [0067.480] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0067.480] lstrlenW (lpString=".xlsx") returned 5 [0067.480] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0067.480] lstrlenW (lpString=".ppt") returned 4 [0067.480] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0067.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.480] lstrlenW (lpString=".zip") returned 4 [0067.480] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0067.480] lstrlenW (lpString=".rar") returned 4 [0067.480] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0067.480] lstrlenW (lpString=".bz2") returned 4 [0067.480] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0067.480] lstrlenW (lpString=".7z") returned 3 [0067.480] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0067.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.480] lstrlenW (lpString=".dbf") returned 4 [0067.480] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0067.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.480] lstrlenW (lpString=".1cd") returned 4 [0067.480] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0067.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0067.480] lstrlenW (lpString=".jpg") returned 4 [0067.480] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0067.480] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0067.480] lstrlenW (lpString="AG00167_.GIF") returned 12 [0067.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.080] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4894) returned 1 [0068.080] CloseHandle (hObject=0x1ec) returned 1 [0068.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0068.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.088] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.088] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0068.170] GetLastError () returned 0x0 [0068.177] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x131e, lpOverlapped=0x0) returned 1 [0068.209] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0068.210] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.210] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.210] SetEndOfFile (hFile=0x174) returned 1 [0068.210] CloseHandle (hObject=0x174) returned 1 [0068.210] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.210] SetEndOfFile (hFile=0x1ec) returned 1 [0068.211] CloseHandle (hObject=0x1ec) returned 1 [0068.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0068.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.212] lstrlenW (lpString=".doc") returned 4 [0068.212] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.212] lstrlenW (lpString=".docx") returned 5 [0068.212] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.212] lstrlenW (lpString=".pdf") returned 4 [0068.212] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.212] lstrlenW (lpString=".xls") returned 4 [0068.212] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.212] lstrlenW (lpString=".xlsx") returned 5 [0068.212] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.212] lstrlenW (lpString=".ppt") returned 4 [0068.212] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.212] lstrlenW (lpString=".zip") returned 4 [0068.212] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.212] lstrlenW (lpString=".rar") returned 4 [0068.212] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.212] lstrlenW (lpString=".bz2") returned 4 [0068.212] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.212] lstrlenW (lpString=".7z") returned 3 [0068.212] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.212] lstrlenW (lpString=".dbf") returned 4 [0068.213] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.213] lstrlenW (lpString=".1cd") returned 4 [0068.213] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.213] lstrlenW (lpString=".jpg") returned 4 [0068.213] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.213] lstrlenW (lpString=".doc") returned 4 [0068.213] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.213] lstrlenW (lpString=".docx") returned 5 [0068.213] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.213] lstrlenW (lpString=".pdf") returned 4 [0068.213] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.213] lstrlenW (lpString=".xls") returned 4 [0068.213] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.213] lstrlenW (lpString=".xlsx") returned 5 [0068.213] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.213] lstrlenW (lpString=".ppt") returned 4 [0068.213] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.213] lstrlenW (lpString=".zip") returned 4 [0068.213] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.213] lstrlenW (lpString=".rar") returned 4 [0068.213] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.213] lstrlenW (lpString=".bz2") returned 4 [0068.213] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.213] lstrlenW (lpString=".7z") returned 3 [0068.213] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.213] lstrlenW (lpString=".dbf") returned 4 [0068.213] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.214] lstrlenW (lpString=".1cd") returned 4 [0068.214] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0068.214] lstrlenW (lpString=".jpg") returned 4 [0068.214] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.214] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0068.214] lstrlenW (lpString="AN00853_.WMF") returned 12 [0068.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.214] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=20578) returned 1 [0068.214] CloseHandle (hObject=0x1ec) returned 1 [0068.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0068.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.215] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.215] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0068.215] GetLastError () returned 0x0 [0068.215] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5062, lpOverlapped=0x0) returned 1 [0068.218] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0068.219] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.219] WriteFile (in: hFile=0x174, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.219] SetEndOfFile (hFile=0x174) returned 1 [0068.219] CloseHandle (hObject=0x174) returned 1 [0068.219] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.219] SetEndOfFile (hFile=0x1ec) returned 1 [0068.220] CloseHandle (hObject=0x1ec) returned 1 [0068.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0068.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.221] lstrlenW (lpString=".doc") returned 4 [0068.221] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.221] lstrlenW (lpString=".docx") returned 5 [0068.221] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.221] lstrlenW (lpString=".pdf") returned 4 [0068.221] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.221] lstrlenW (lpString=".xls") returned 4 [0068.221] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.221] lstrlenW (lpString=".xlsx") returned 5 [0068.221] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.221] lstrlenW (lpString=".ppt") returned 4 [0068.221] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.221] lstrlenW (lpString=".zip") returned 4 [0068.221] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.221] lstrlenW (lpString=".rar") returned 4 [0068.221] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.221] lstrlenW (lpString=".bz2") returned 4 [0068.221] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.221] lstrlenW (lpString=".7z") returned 3 [0068.221] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.221] lstrlenW (lpString=".dbf") returned 4 [0068.222] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.222] lstrlenW (lpString=".1cd") returned 4 [0068.222] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.222] lstrlenW (lpString=".jpg") returned 4 [0068.222] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.222] lstrlenW (lpString=".doc") returned 4 [0068.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.222] lstrlenW (lpString=".docx") returned 5 [0068.222] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.222] lstrlenW (lpString=".pdf") returned 4 [0068.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.222] lstrlenW (lpString=".xls") returned 4 [0068.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.222] lstrlenW (lpString=".xlsx") returned 5 [0068.222] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.222] lstrlenW (lpString=".ppt") returned 4 [0068.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.222] lstrlenW (lpString=".zip") returned 4 [0068.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.222] lstrlenW (lpString=".rar") returned 4 [0068.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.222] lstrlenW (lpString=".bz2") returned 4 [0068.222] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.222] lstrlenW (lpString=".7z") returned 3 [0068.222] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.222] lstrlenW (lpString=".dbf") returned 4 [0068.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.223] lstrlenW (lpString=".1cd") returned 4 [0068.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0068.223] lstrlenW (lpString=".jpg") returned 4 [0068.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.223] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0068.223] lstrlenW (lpString="AN00914_.WMF") returned 12 [0068.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0068.248] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=10832) returned 1 [0068.248] CloseHandle (hObject=0x1e0) returned 1 [0068.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0068.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0068.248] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.248] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.248] GetLastError () returned 0x0 [0068.248] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x2a50, lpOverlapped=0x0) returned 1 [0068.254] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0068.255] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.255] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.255] SetEndOfFile (hFile=0x1ec) returned 1 [0068.255] CloseHandle (hObject=0x1ec) returned 1 [0068.255] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.255] SetEndOfFile (hFile=0x1e0) returned 1 [0068.256] CloseHandle (hObject=0x1e0) returned 1 [0068.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.256] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0068.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.257] lstrlenW (lpString=".doc") returned 4 [0068.257] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.257] lstrlenW (lpString=".docx") returned 5 [0068.257] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.257] lstrlenW (lpString=".pdf") returned 4 [0068.257] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.257] lstrlenW (lpString=".xls") returned 4 [0068.257] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.257] lstrlenW (lpString=".xlsx") returned 5 [0068.257] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.257] lstrlenW (lpString=".ppt") returned 4 [0068.257] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.257] lstrlenW (lpString=".zip") returned 4 [0068.257] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.257] lstrlenW (lpString=".rar") returned 4 [0068.257] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.257] lstrlenW (lpString=".bz2") returned 4 [0068.257] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.257] lstrlenW (lpString=".7z") returned 3 [0068.257] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.257] lstrlenW (lpString=".dbf") returned 4 [0068.257] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.257] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.257] lstrlenW (lpString=".1cd") returned 4 [0068.257] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.258] lstrlenW (lpString=".jpg") returned 4 [0068.258] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.258] lstrlenW (lpString=".doc") returned 4 [0068.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.258] lstrlenW (lpString=".docx") returned 5 [0068.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.258] lstrlenW (lpString=".pdf") returned 4 [0068.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.258] lstrlenW (lpString=".xls") returned 4 [0068.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.258] lstrlenW (lpString=".xlsx") returned 5 [0068.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.258] lstrlenW (lpString=".ppt") returned 4 [0068.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.258] lstrlenW (lpString=".zip") returned 4 [0068.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.258] lstrlenW (lpString=".rar") returned 4 [0068.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.258] lstrlenW (lpString=".bz2") returned 4 [0068.258] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.258] lstrlenW (lpString=".7z") returned 3 [0068.258] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.258] lstrlenW (lpString=".dbf") returned 4 [0068.258] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.258] lstrlenW (lpString=".1cd") returned 4 [0068.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0068.259] lstrlenW (lpString=".jpg") returned 4 [0068.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.259] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0068.259] lstrlenW (lpString="AN00932_.WMF") returned 12 [0068.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0068.259] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=14428) returned 1 [0068.259] CloseHandle (hObject=0x1e0) returned 1 [0068.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0068.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0068.259] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.259] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.260] GetLastError () returned 0x0 [0068.260] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x385c, lpOverlapped=0x0) returned 1 [0068.269] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3860, lpOverlapped=0x0) returned 1 [0068.270] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.270] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.270] SetEndOfFile (hFile=0x1ec) returned 1 [0068.270] CloseHandle (hObject=0x1ec) returned 1 [0068.270] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.270] SetEndOfFile (hFile=0x1e0) returned 1 [0068.271] CloseHandle (hObject=0x1e0) returned 1 [0068.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0068.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.272] lstrlenW (lpString=".doc") returned 4 [0068.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.272] lstrlenW (lpString=".docx") returned 5 [0068.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.272] lstrlenW (lpString=".pdf") returned 4 [0068.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.272] lstrlenW (lpString=".xls") returned 4 [0068.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.272] lstrlenW (lpString=".xlsx") returned 5 [0068.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.272] lstrlenW (lpString=".ppt") returned 4 [0068.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.272] lstrlenW (lpString=".zip") returned 4 [0068.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.272] lstrlenW (lpString=".rar") returned 4 [0068.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.272] lstrlenW (lpString=".bz2") returned 4 [0068.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.272] lstrlenW (lpString=".7z") returned 3 [0068.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.273] lstrlenW (lpString=".dbf") returned 4 [0068.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.273] lstrlenW (lpString=".1cd") returned 4 [0068.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.273] lstrlenW (lpString=".jpg") returned 4 [0068.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.273] lstrlenW (lpString=".doc") returned 4 [0068.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.273] lstrlenW (lpString=".docx") returned 5 [0068.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.273] lstrlenW (lpString=".pdf") returned 4 [0068.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.273] lstrlenW (lpString=".xls") returned 4 [0068.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.273] lstrlenW (lpString=".xlsx") returned 5 [0068.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.273] lstrlenW (lpString=".ppt") returned 4 [0068.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.273] lstrlenW (lpString=".zip") returned 4 [0068.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.273] lstrlenW (lpString=".rar") returned 4 [0068.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.274] lstrlenW (lpString=".bz2") returned 4 [0068.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.274] lstrlenW (lpString=".7z") returned 3 [0068.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.274] lstrlenW (lpString=".dbf") returned 4 [0068.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.274] lstrlenW (lpString=".1cd") returned 4 [0068.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0068.274] lstrlenW (lpString=".jpg") returned 4 [0068.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.274] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0068.274] lstrlenW (lpString="AN00965_.WMF") returned 12 [0068.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0068.274] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7072) returned 1 [0068.274] CloseHandle (hObject=0x1e0) returned 1 [0068.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0068.275] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0068.275] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.275] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0068.275] GetLastError () returned 0x0 [0068.275] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0069.201] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0069.202] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.202] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.202] SetEndOfFile (hFile=0x1ec) returned 1 [0069.387] CloseHandle (hObject=0x1ec) returned 1 [0069.402] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.402] SetEndOfFile (hFile=0x1e0) returned 1 [0069.413] CloseHandle (hObject=0x1e0) returned 1 [0069.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0069.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.414] lstrlenW (lpString=".doc") returned 4 [0069.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.414] lstrlenW (lpString=".docx") returned 5 [0069.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.414] lstrlenW (lpString=".pdf") returned 4 [0069.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.414] lstrlenW (lpString=".xls") returned 4 [0069.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.414] lstrlenW (lpString=".xlsx") returned 5 [0069.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.414] lstrlenW (lpString=".ppt") returned 4 [0069.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.414] lstrlenW (lpString=".zip") returned 4 [0069.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.414] lstrlenW (lpString=".rar") returned 4 [0069.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.414] lstrlenW (lpString=".bz2") returned 4 [0069.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.414] lstrlenW (lpString=".7z") returned 3 [0069.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.414] lstrlenW (lpString=".dbf") returned 4 [0069.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.414] lstrlenW (lpString=".1cd") returned 4 [0069.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.414] lstrlenW (lpString=".jpg") returned 4 [0069.414] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.415] lstrlenW (lpString=".doc") returned 4 [0069.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.415] lstrlenW (lpString=".docx") returned 5 [0069.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.415] lstrlenW (lpString=".pdf") returned 4 [0069.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.415] lstrlenW (lpString=".xls") returned 4 [0069.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.415] lstrlenW (lpString=".xlsx") returned 5 [0069.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.415] lstrlenW (lpString=".ppt") returned 4 [0069.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.415] lstrlenW (lpString=".zip") returned 4 [0069.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.415] lstrlenW (lpString=".rar") returned 4 [0069.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.415] lstrlenW (lpString=".bz2") returned 4 [0069.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.415] lstrlenW (lpString=".7z") returned 3 [0069.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.415] lstrlenW (lpString=".dbf") returned 4 [0069.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.415] lstrlenW (lpString=".1cd") returned 4 [0069.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0069.415] lstrlenW (lpString=".jpg") returned 4 [0069.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.416] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.416] lstrlenW (lpString="AN01545_.WMF") returned 12 [0069.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.416] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7372) returned 1 [0069.416] CloseHandle (hObject=0x1e0) returned 1 [0069.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0069.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.416] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.416] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.417] GetLastError () returned 0x0 [0069.417] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0069.418] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0069.421] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.421] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.421] SetEndOfFile (hFile=0x1ec) returned 1 [0069.422] CloseHandle (hObject=0x1ec) returned 1 [0069.422] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.422] SetEndOfFile (hFile=0x1e0) returned 1 [0069.423] CloseHandle (hObject=0x1e0) returned 1 [0069.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0069.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.423] lstrlenW (lpString=".doc") returned 4 [0069.423] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.423] lstrlenW (lpString=".docx") returned 5 [0069.423] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.423] lstrlenW (lpString=".pdf") returned 4 [0069.423] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.423] lstrlenW (lpString=".xls") returned 4 [0069.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.423] lstrlenW (lpString=".xlsx") returned 5 [0069.423] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.423] lstrlenW (lpString=".ppt") returned 4 [0069.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.423] lstrlenW (lpString=".zip") returned 4 [0069.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.423] lstrlenW (lpString=".rar") returned 4 [0069.424] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.424] lstrlenW (lpString=".bz2") returned 4 [0069.424] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.424] lstrlenW (lpString=".7z") returned 3 [0069.424] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.424] lstrlenW (lpString=".dbf") returned 4 [0069.424] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.424] lstrlenW (lpString=".1cd") returned 4 [0069.424] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.424] lstrlenW (lpString=".jpg") returned 4 [0069.424] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.424] lstrlenW (lpString=".doc") returned 4 [0069.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.424] lstrlenW (lpString=".docx") returned 5 [0069.424] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.424] lstrlenW (lpString=".pdf") returned 4 [0069.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.424] lstrlenW (lpString=".xls") returned 4 [0069.424] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.424] lstrlenW (lpString=".xlsx") returned 5 [0069.424] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.424] lstrlenW (lpString=".ppt") returned 4 [0069.424] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.424] lstrlenW (lpString=".zip") returned 4 [0069.424] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.424] lstrlenW (lpString=".rar") returned 4 [0069.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.425] lstrlenW (lpString=".bz2") returned 4 [0069.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.425] lstrlenW (lpString=".7z") returned 3 [0069.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.425] lstrlenW (lpString=".dbf") returned 4 [0069.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.425] lstrlenW (lpString=".1cd") returned 4 [0069.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0069.425] lstrlenW (lpString=".jpg") returned 4 [0069.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.425] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.425] lstrlenW (lpString="AN02122_.WMF") returned 12 [0069.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.426] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7540) returned 1 [0069.426] CloseHandle (hObject=0x1e0) returned 1 [0069.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0069.426] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.426] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.426] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.427] GetLastError () returned 0x0 [0069.427] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1d74, lpOverlapped=0x0) returned 1 [0069.428] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0069.429] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.429] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.429] SetEndOfFile (hFile=0x1ec) returned 1 [0069.430] CloseHandle (hObject=0x1ec) returned 1 [0069.430] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.430] SetEndOfFile (hFile=0x1e0) returned 1 [0069.431] CloseHandle (hObject=0x1e0) returned 1 [0069.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0069.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.431] lstrlenW (lpString=".doc") returned 4 [0069.431] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.431] lstrlenW (lpString=".docx") returned 5 [0069.431] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.431] lstrlenW (lpString=".pdf") returned 4 [0069.431] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.431] lstrlenW (lpString=".xls") returned 4 [0069.431] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.431] lstrlenW (lpString=".xlsx") returned 5 [0069.431] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.431] lstrlenW (lpString=".ppt") returned 4 [0069.431] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.431] lstrlenW (lpString=".zip") returned 4 [0069.431] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.432] lstrlenW (lpString=".rar") returned 4 [0069.432] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.432] lstrlenW (lpString=".bz2") returned 4 [0069.432] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.432] lstrlenW (lpString=".7z") returned 3 [0069.432] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.432] lstrlenW (lpString=".dbf") returned 4 [0069.432] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.432] lstrlenW (lpString=".1cd") returned 4 [0069.432] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.432] lstrlenW (lpString=".jpg") returned 4 [0069.432] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.432] lstrlenW (lpString=".doc") returned 4 [0069.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.432] lstrlenW (lpString=".docx") returned 5 [0069.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.432] lstrlenW (lpString=".pdf") returned 4 [0069.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.432] lstrlenW (lpString=".xls") returned 4 [0069.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.432] lstrlenW (lpString=".xlsx") returned 5 [0069.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.432] lstrlenW (lpString=".ppt") returned 4 [0069.432] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.432] lstrlenW (lpString=".zip") returned 4 [0069.432] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.432] lstrlenW (lpString=".rar") returned 4 [0069.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.433] lstrlenW (lpString=".bz2") returned 4 [0069.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.433] lstrlenW (lpString=".7z") returned 3 [0069.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.433] lstrlenW (lpString=".dbf") returned 4 [0069.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.433] lstrlenW (lpString=".1cd") returned 4 [0069.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0069.433] lstrlenW (lpString=".jpg") returned 4 [0069.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.433] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.433] lstrlenW (lpString="AN02559_.WMF") returned 12 [0069.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.433] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6632) returned 1 [0069.433] CloseHandle (hObject=0x1e0) returned 1 [0069.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0069.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.434] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.434] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.434] GetLastError () returned 0x0 [0069.434] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x19e8, lpOverlapped=0x0) returned 1 [0069.436] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0069.437] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.437] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.437] SetEndOfFile (hFile=0x1ec) returned 1 [0069.437] CloseHandle (hObject=0x1ec) returned 1 [0069.438] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.438] SetEndOfFile (hFile=0x1e0) returned 1 [0069.438] CloseHandle (hObject=0x1e0) returned 1 [0069.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0069.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.439] lstrlenW (lpString=".doc") returned 4 [0069.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.439] lstrlenW (lpString=".docx") returned 5 [0069.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.439] lstrlenW (lpString=".pdf") returned 4 [0069.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.439] lstrlenW (lpString=".xls") returned 4 [0069.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.439] lstrlenW (lpString=".xlsx") returned 5 [0069.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.439] lstrlenW (lpString=".ppt") returned 4 [0069.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.439] lstrlenW (lpString=".zip") returned 4 [0069.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.439] lstrlenW (lpString=".rar") returned 4 [0069.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.439] lstrlenW (lpString=".bz2") returned 4 [0069.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.439] lstrlenW (lpString=".7z") returned 3 [0069.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.440] lstrlenW (lpString=".dbf") returned 4 [0069.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.440] lstrlenW (lpString=".1cd") returned 4 [0069.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.440] lstrlenW (lpString=".jpg") returned 4 [0069.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.440] lstrlenW (lpString=".doc") returned 4 [0069.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.440] lstrlenW (lpString=".docx") returned 5 [0069.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.440] lstrlenW (lpString=".pdf") returned 4 [0069.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.440] lstrlenW (lpString=".xls") returned 4 [0069.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.440] lstrlenW (lpString=".xlsx") returned 5 [0069.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.440] lstrlenW (lpString=".ppt") returned 4 [0069.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.440] lstrlenW (lpString=".zip") returned 4 [0069.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.440] lstrlenW (lpString=".rar") returned 4 [0069.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.440] lstrlenW (lpString=".bz2") returned 4 [0069.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.440] lstrlenW (lpString=".7z") returned 3 [0069.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.441] lstrlenW (lpString=".dbf") returned 4 [0069.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.441] lstrlenW (lpString=".1cd") returned 4 [0069.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0069.441] lstrlenW (lpString=".jpg") returned 4 [0069.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.441] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.441] lstrlenW (lpString="AN02724_.WMF") returned 12 [0069.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.442] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2108) returned 1 [0069.442] CloseHandle (hObject=0x1e0) returned 1 [0069.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0069.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.442] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.442] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.442] GetLastError () returned 0x0 [0069.443] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x83c, lpOverlapped=0x0) returned 1 [0069.444] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x840, lpOverlapped=0x0) returned 1 [0069.445] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.445] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.445] SetEndOfFile (hFile=0x1ec) returned 1 [0069.445] CloseHandle (hObject=0x1ec) returned 1 [0069.445] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.446] SetEndOfFile (hFile=0x1e0) returned 1 [0069.446] CloseHandle (hObject=0x1e0) returned 1 [0069.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0069.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.447] lstrlenW (lpString=".doc") returned 4 [0069.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.447] lstrlenW (lpString=".docx") returned 5 [0069.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.447] lstrlenW (lpString=".pdf") returned 4 [0069.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.447] lstrlenW (lpString=".xls") returned 4 [0069.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.447] lstrlenW (lpString=".xlsx") returned 5 [0069.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.447] lstrlenW (lpString=".ppt") returned 4 [0069.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.447] lstrlenW (lpString=".zip") returned 4 [0069.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.447] lstrlenW (lpString=".rar") returned 4 [0069.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.447] lstrlenW (lpString=".bz2") returned 4 [0069.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.447] lstrlenW (lpString=".7z") returned 3 [0069.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.447] lstrlenW (lpString=".dbf") returned 4 [0069.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.448] lstrlenW (lpString=".1cd") returned 4 [0069.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.448] lstrlenW (lpString=".jpg") returned 4 [0069.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.448] lstrlenW (lpString=".doc") returned 4 [0069.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.448] lstrlenW (lpString=".docx") returned 5 [0069.448] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.448] lstrlenW (lpString=".pdf") returned 4 [0069.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.448] lstrlenW (lpString=".xls") returned 4 [0069.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.448] lstrlenW (lpString=".xlsx") returned 5 [0069.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.448] lstrlenW (lpString=".ppt") returned 4 [0069.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.448] lstrlenW (lpString=".zip") returned 4 [0069.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.448] lstrlenW (lpString=".rar") returned 4 [0069.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.448] lstrlenW (lpString=".bz2") returned 4 [0069.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.448] lstrlenW (lpString=".7z") returned 3 [0069.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.448] lstrlenW (lpString=".dbf") returned 4 [0069.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.449] lstrlenW (lpString=".1cd") returned 4 [0069.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0069.449] lstrlenW (lpString=".jpg") returned 4 [0069.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.449] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.449] lstrlenW (lpString="AN03500_.WMF") returned 12 [0069.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.449] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9240) returned 1 [0069.449] CloseHandle (hObject=0x1e0) returned 1 [0069.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0069.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.449] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.450] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.450] GetLastError () returned 0x0 [0069.450] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x2418, lpOverlapped=0x0) returned 1 [0069.773] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2420, lpOverlapped=0x0) returned 1 [0069.775] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.775] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.775] SetEndOfFile (hFile=0x1ec) returned 1 [0069.775] CloseHandle (hObject=0x1ec) returned 1 [0069.775] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.775] SetEndOfFile (hFile=0x1e0) returned 1 [0069.776] CloseHandle (hObject=0x1e0) returned 1 [0069.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0069.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.777] lstrlenW (lpString=".doc") returned 4 [0069.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.777] lstrlenW (lpString=".docx") returned 5 [0069.777] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.777] lstrlenW (lpString=".pdf") returned 4 [0069.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.777] lstrlenW (lpString=".xls") returned 4 [0069.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.777] lstrlenW (lpString=".xlsx") returned 5 [0069.777] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.777] lstrlenW (lpString=".ppt") returned 4 [0069.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.777] lstrlenW (lpString=".zip") returned 4 [0069.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.777] lstrlenW (lpString=".rar") returned 4 [0069.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.777] lstrlenW (lpString=".bz2") returned 4 [0069.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.777] lstrlenW (lpString=".7z") returned 3 [0069.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.777] lstrlenW (lpString=".dbf") returned 4 [0069.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.778] lstrlenW (lpString=".1cd") returned 4 [0069.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.778] lstrlenW (lpString=".jpg") returned 4 [0069.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.778] lstrlenW (lpString=".doc") returned 4 [0069.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.778] lstrlenW (lpString=".docx") returned 5 [0069.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.778] lstrlenW (lpString=".pdf") returned 4 [0069.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.778] lstrlenW (lpString=".xls") returned 4 [0069.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.778] lstrlenW (lpString=".xlsx") returned 5 [0069.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.778] lstrlenW (lpString=".ppt") returned 4 [0069.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.778] lstrlenW (lpString=".zip") returned 4 [0069.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.778] lstrlenW (lpString=".rar") returned 4 [0069.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.778] lstrlenW (lpString=".bz2") returned 4 [0069.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.778] lstrlenW (lpString=".7z") returned 3 [0069.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.778] lstrlenW (lpString=".dbf") returned 4 [0069.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.779] lstrlenW (lpString=".1cd") returned 4 [0069.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0069.779] lstrlenW (lpString=".jpg") returned 4 [0069.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.779] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.779] lstrlenW (lpString="AN04326_.WMF") returned 12 [0069.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.779] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3348) returned 1 [0069.779] CloseHandle (hObject=0x1e0) returned 1 [0069.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0069.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.780] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.780] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.780] GetLastError () returned 0x0 [0069.780] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xd14, lpOverlapped=0x0) returned 1 [0069.782] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0069.782] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.782] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.783] SetEndOfFile (hFile=0x1ec) returned 1 [0069.783] CloseHandle (hObject=0x1ec) returned 1 [0069.783] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.783] SetEndOfFile (hFile=0x1e0) returned 1 [0069.784] CloseHandle (hObject=0x1e0) returned 1 [0069.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0069.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.784] lstrlenW (lpString=".doc") returned 4 [0069.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.784] lstrlenW (lpString=".docx") returned 5 [0069.784] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.784] lstrlenW (lpString=".pdf") returned 4 [0069.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.784] lstrlenW (lpString=".xls") returned 4 [0069.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.784] lstrlenW (lpString=".xlsx") returned 5 [0069.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.785] lstrlenW (lpString=".ppt") returned 4 [0069.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.785] lstrlenW (lpString=".zip") returned 4 [0069.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.785] lstrlenW (lpString=".rar") returned 4 [0069.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.785] lstrlenW (lpString=".bz2") returned 4 [0069.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.785] lstrlenW (lpString=".7z") returned 3 [0069.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.785] lstrlenW (lpString=".dbf") returned 4 [0069.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.785] lstrlenW (lpString=".1cd") returned 4 [0069.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.785] lstrlenW (lpString=".jpg") returned 4 [0069.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.785] lstrlenW (lpString=".doc") returned 4 [0069.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.785] lstrlenW (lpString=".docx") returned 5 [0069.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.785] lstrlenW (lpString=".pdf") returned 4 [0069.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.785] lstrlenW (lpString=".xls") returned 4 [0069.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.785] lstrlenW (lpString=".xlsx") returned 5 [0069.786] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.786] lstrlenW (lpString=".ppt") returned 4 [0069.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.786] lstrlenW (lpString=".zip") returned 4 [0069.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.786] lstrlenW (lpString=".rar") returned 4 [0069.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.786] lstrlenW (lpString=".bz2") returned 4 [0069.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.786] lstrlenW (lpString=".7z") returned 3 [0069.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.786] lstrlenW (lpString=".dbf") returned 4 [0069.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.786] lstrlenW (lpString=".1cd") returned 4 [0069.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0069.786] lstrlenW (lpString=".jpg") returned 4 [0069.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.786] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.786] lstrlenW (lpString="AN04332_.WMF") returned 12 [0069.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.787] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4296) returned 1 [0069.787] CloseHandle (hObject=0x1e0) returned 1 [0069.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0069.787] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.788] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.788] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.788] GetLastError () returned 0x0 [0069.788] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x10c8, lpOverlapped=0x0) returned 1 [0069.790] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0069.791] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.791] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.791] SetEndOfFile (hFile=0x1ec) returned 1 [0069.791] CloseHandle (hObject=0x1ec) returned 1 [0069.791] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.791] SetEndOfFile (hFile=0x1e0) returned 1 [0069.792] CloseHandle (hObject=0x1e0) returned 1 [0069.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0069.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.793] lstrlenW (lpString=".doc") returned 4 [0069.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.793] lstrlenW (lpString=".docx") returned 5 [0069.793] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.793] lstrlenW (lpString=".pdf") returned 4 [0069.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.793] lstrlenW (lpString=".xls") returned 4 [0069.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.793] lstrlenW (lpString=".xlsx") returned 5 [0069.793] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.793] lstrlenW (lpString=".ppt") returned 4 [0069.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.793] lstrlenW (lpString=".zip") returned 4 [0069.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.793] lstrlenW (lpString=".rar") returned 4 [0069.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.793] lstrlenW (lpString=".bz2") returned 4 [0069.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.793] lstrlenW (lpString=".7z") returned 3 [0069.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.793] lstrlenW (lpString=".dbf") returned 4 [0069.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.793] lstrlenW (lpString=".1cd") returned 4 [0069.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.793] lstrlenW (lpString=".jpg") returned 4 [0069.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.794] lstrlenW (lpString=".doc") returned 4 [0069.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.794] lstrlenW (lpString=".docx") returned 5 [0069.794] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.794] lstrlenW (lpString=".pdf") returned 4 [0069.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.794] lstrlenW (lpString=".xls") returned 4 [0069.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.794] lstrlenW (lpString=".xlsx") returned 5 [0069.794] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.794] lstrlenW (lpString=".ppt") returned 4 [0069.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.794] lstrlenW (lpString=".zip") returned 4 [0069.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.794] lstrlenW (lpString=".rar") returned 4 [0069.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.794] lstrlenW (lpString=".bz2") returned 4 [0069.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.794] lstrlenW (lpString=".7z") returned 3 [0069.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.794] lstrlenW (lpString=".dbf") returned 4 [0069.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.794] lstrlenW (lpString=".1cd") returned 4 [0069.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0069.794] lstrlenW (lpString=".jpg") returned 4 [0069.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.795] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.795] lstrlenW (lpString="AN04355_.WMF") returned 12 [0069.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.795] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3228) returned 1 [0069.795] CloseHandle (hObject=0x1e0) returned 1 [0069.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0069.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.795] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.795] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.796] GetLastError () returned 0x0 [0069.796] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0069.798] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0069.799] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.799] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.799] SetEndOfFile (hFile=0x1ec) returned 1 [0069.799] CloseHandle (hObject=0x1ec) returned 1 [0069.800] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.800] SetEndOfFile (hFile=0x1e0) returned 1 [0069.800] CloseHandle (hObject=0x1e0) returned 1 [0069.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0069.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.801] lstrlenW (lpString=".doc") returned 4 [0069.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.801] lstrlenW (lpString=".docx") returned 5 [0069.801] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.801] lstrlenW (lpString=".pdf") returned 4 [0069.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.801] lstrlenW (lpString=".xls") returned 4 [0069.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.801] lstrlenW (lpString=".xlsx") returned 5 [0069.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.801] lstrlenW (lpString=".ppt") returned 4 [0069.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.801] lstrlenW (lpString=".zip") returned 4 [0069.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.801] lstrlenW (lpString=".rar") returned 4 [0069.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.801] lstrlenW (lpString=".bz2") returned 4 [0069.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.801] lstrlenW (lpString=".7z") returned 3 [0069.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.802] lstrlenW (lpString=".dbf") returned 4 [0069.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.802] lstrlenW (lpString=".1cd") returned 4 [0069.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.802] lstrlenW (lpString=".jpg") returned 4 [0069.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.802] lstrlenW (lpString=".doc") returned 4 [0069.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.802] lstrlenW (lpString=".docx") returned 5 [0069.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.802] lstrlenW (lpString=".pdf") returned 4 [0069.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.802] lstrlenW (lpString=".xls") returned 4 [0069.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.802] lstrlenW (lpString=".xlsx") returned 5 [0069.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.802] lstrlenW (lpString=".ppt") returned 4 [0069.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.803] lstrlenW (lpString=".zip") returned 4 [0069.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.803] lstrlenW (lpString=".rar") returned 4 [0069.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.803] lstrlenW (lpString=".bz2") returned 4 [0069.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.803] lstrlenW (lpString=".7z") returned 3 [0069.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.803] lstrlenW (lpString=".dbf") returned 4 [0069.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.803] lstrlenW (lpString=".1cd") returned 4 [0069.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0069.803] lstrlenW (lpString=".jpg") returned 4 [0069.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.803] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.803] lstrlenW (lpString="AN04369_.WMF") returned 12 [0069.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.804] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4808) returned 1 [0069.804] CloseHandle (hObject=0x1e0) returned 1 [0069.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0069.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.804] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.804] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.804] GetLastError () returned 0x0 [0069.804] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0069.807] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0069.808] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.808] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.808] SetEndOfFile (hFile=0x1ec) returned 1 [0069.808] CloseHandle (hObject=0x1ec) returned 1 [0069.808] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.808] SetEndOfFile (hFile=0x1e0) returned 1 [0069.809] CloseHandle (hObject=0x1e0) returned 1 [0069.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0069.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.810] lstrlenW (lpString=".doc") returned 4 [0069.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.810] lstrlenW (lpString=".docx") returned 5 [0069.810] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.810] lstrlenW (lpString=".pdf") returned 4 [0069.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.810] lstrlenW (lpString=".xls") returned 4 [0069.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.810] lstrlenW (lpString=".xlsx") returned 5 [0069.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.810] lstrlenW (lpString=".ppt") returned 4 [0069.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.810] lstrlenW (lpString=".zip") returned 4 [0069.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.810] lstrlenW (lpString=".rar") returned 4 [0069.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.810] lstrlenW (lpString=".bz2") returned 4 [0069.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.810] lstrlenW (lpString=".7z") returned 3 [0069.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.810] lstrlenW (lpString=".dbf") returned 4 [0069.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.810] lstrlenW (lpString=".1cd") returned 4 [0069.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.810] lstrlenW (lpString=".jpg") returned 4 [0069.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.811] lstrlenW (lpString=".doc") returned 4 [0069.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.811] lstrlenW (lpString=".docx") returned 5 [0069.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.811] lstrlenW (lpString=".pdf") returned 4 [0069.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.811] lstrlenW (lpString=".xls") returned 4 [0069.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.811] lstrlenW (lpString=".xlsx") returned 5 [0069.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.811] lstrlenW (lpString=".ppt") returned 4 [0069.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.811] lstrlenW (lpString=".zip") returned 4 [0069.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.811] lstrlenW (lpString=".rar") returned 4 [0069.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.811] lstrlenW (lpString=".bz2") returned 4 [0069.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.811] lstrlenW (lpString=".7z") returned 3 [0069.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.811] lstrlenW (lpString=".dbf") returned 4 [0069.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.811] lstrlenW (lpString=".1cd") returned 4 [0069.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0069.811] lstrlenW (lpString=".jpg") returned 4 [0069.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.812] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.812] lstrlenW (lpString="AN04384_.WMF") returned 12 [0069.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.812] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4996) returned 1 [0069.812] CloseHandle (hObject=0x1e0) returned 1 [0069.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0069.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0069.812] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.812] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0069.813] GetLastError () returned 0x0 [0069.813] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1384, lpOverlapped=0x0) returned 1 [0070.069] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0070.070] ReadFile (in: hFile=0x1e0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.070] WriteFile (in: hFile=0x1ec, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.070] SetEndOfFile (hFile=0x1ec) returned 1 [0071.318] CloseHandle (hObject=0x1ec) returned 1 [0071.458] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.458] SetEndOfFile (hFile=0x1e0) returned 1 [0071.459] CloseHandle (hObject=0x1e0) returned 1 [0071.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0071.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.718] lstrlenW (lpString=".doc") returned 4 [0071.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.718] lstrlenW (lpString=".docx") returned 5 [0071.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.718] lstrlenW (lpString=".pdf") returned 4 [0071.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.718] lstrlenW (lpString=".xls") returned 4 [0071.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.718] lstrlenW (lpString=".xlsx") returned 5 [0071.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.718] lstrlenW (lpString=".ppt") returned 4 [0071.718] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.718] lstrlenW (lpString=".zip") returned 4 [0071.718] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.718] lstrlenW (lpString=".rar") returned 4 [0071.718] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.718] lstrlenW (lpString=".bz2") returned 4 [0071.718] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.718] lstrlenW (lpString=".7z") returned 3 [0071.718] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.719] lstrlenW (lpString=".dbf") returned 4 [0071.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.719] lstrlenW (lpString=".1cd") returned 4 [0071.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.719] lstrlenW (lpString=".jpg") returned 4 [0071.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.719] lstrlenW (lpString=".doc") returned 4 [0071.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.719] lstrlenW (lpString=".docx") returned 5 [0071.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.719] lstrlenW (lpString=".pdf") returned 4 [0071.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.719] lstrlenW (lpString=".xls") returned 4 [0071.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.719] lstrlenW (lpString=".xlsx") returned 5 [0071.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.719] lstrlenW (lpString=".ppt") returned 4 [0071.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.719] lstrlenW (lpString=".zip") returned 4 [0071.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.719] lstrlenW (lpString=".rar") returned 4 [0071.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.719] lstrlenW (lpString=".bz2") returned 4 [0071.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.719] lstrlenW (lpString=".7z") returned 3 [0071.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.720] lstrlenW (lpString=".dbf") returned 4 [0071.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.720] lstrlenW (lpString=".1cd") returned 4 [0071.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0071.720] lstrlenW (lpString=".jpg") returned 4 [0071.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.720] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0071.720] lstrlenW (lpString="BD08758_.WMF") returned 12 [0071.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.824] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=24320) returned 1 [0071.824] CloseHandle (hObject=0x1ec) returned 1 [0071.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0071.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.825] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.825] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.825] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0072.288] GetLastError () returned 0x0 [0072.288] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5f00, lpOverlapped=0x0) returned 1 [0072.451] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0072.452] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.453] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.453] SetEndOfFile (hFile=0x16c) returned 1 [0072.953] CloseHandle (hObject=0x16c) returned 1 [0072.960] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.961] SetEndOfFile (hFile=0x1ec) returned 1 [0072.996] CloseHandle (hObject=0x1ec) returned 1 [0072.998] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0073.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.080] lstrlenW (lpString=".doc") returned 4 [0073.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.080] lstrlenW (lpString=".docx") returned 5 [0073.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.080] lstrlenW (lpString=".pdf") returned 4 [0073.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.080] lstrlenW (lpString=".xls") returned 4 [0073.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.080] lstrlenW (lpString=".xlsx") returned 5 [0073.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.080] lstrlenW (lpString=".ppt") returned 4 [0073.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.080] lstrlenW (lpString=".zip") returned 4 [0073.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.080] lstrlenW (lpString=".rar") returned 4 [0073.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.080] lstrlenW (lpString=".bz2") returned 4 [0073.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.080] lstrlenW (lpString=".7z") returned 3 [0073.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.080] lstrlenW (lpString=".dbf") returned 4 [0073.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.080] lstrlenW (lpString=".1cd") returned 4 [0073.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.080] lstrlenW (lpString=".jpg") returned 4 [0073.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.081] lstrlenW (lpString=".doc") returned 4 [0073.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.081] lstrlenW (lpString=".docx") returned 5 [0073.081] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.081] lstrlenW (lpString=".pdf") returned 4 [0073.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.081] lstrlenW (lpString=".xls") returned 4 [0073.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.081] lstrlenW (lpString=".xlsx") returned 5 [0073.081] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.081] lstrlenW (lpString=".ppt") returned 4 [0073.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.081] lstrlenW (lpString=".zip") returned 4 [0073.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.081] lstrlenW (lpString=".rar") returned 4 [0073.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.081] lstrlenW (lpString=".bz2") returned 4 [0073.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.081] lstrlenW (lpString=".7z") returned 3 [0073.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.081] lstrlenW (lpString=".dbf") returned 4 [0073.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.081] lstrlenW (lpString=".1cd") returned 4 [0073.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0073.081] lstrlenW (lpString=".jpg") returned 4 [0073.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.082] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0073.082] lstrlenW (lpString="BD09664_.WMF") returned 12 [0073.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.082] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=7966) returned 1 [0073.082] CloseHandle (hObject=0x1ec) returned 1 [0073.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0073.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.082] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.083] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0073.083] GetLastError () returned 0x0 [0073.083] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0073.156] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0073.157] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.157] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.157] SetEndOfFile (hFile=0x16c) returned 1 [0073.158] CloseHandle (hObject=0x16c) returned 1 [0073.158] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.158] SetEndOfFile (hFile=0x1ec) returned 1 [0073.159] CloseHandle (hObject=0x1ec) returned 1 [0073.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.159] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0073.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.159] lstrlenW (lpString=".doc") returned 4 [0073.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.159] lstrlenW (lpString=".docx") returned 5 [0073.159] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.159] lstrlenW (lpString=".pdf") returned 4 [0073.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.159] lstrlenW (lpString=".xls") returned 4 [0073.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.159] lstrlenW (lpString=".xlsx") returned 5 [0073.159] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.160] lstrlenW (lpString=".ppt") returned 4 [0073.160] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.160] lstrlenW (lpString=".zip") returned 4 [0073.160] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.160] lstrlenW (lpString=".rar") returned 4 [0073.160] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.160] lstrlenW (lpString=".bz2") returned 4 [0073.160] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.160] lstrlenW (lpString=".7z") returned 3 [0073.160] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.160] lstrlenW (lpString=".dbf") returned 4 [0073.160] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.160] lstrlenW (lpString=".1cd") returned 4 [0073.160] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.160] lstrlenW (lpString=".jpg") returned 4 [0073.160] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.160] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.160] lstrlenW (lpString=".doc") returned 4 [0073.160] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.160] lstrlenW (lpString=".docx") returned 5 [0073.160] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.160] lstrlenW (lpString=".pdf") returned 4 [0073.160] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.160] lstrlenW (lpString=".xls") returned 4 [0073.160] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.160] lstrlenW (lpString=".xlsx") returned 5 [0073.160] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.160] lstrlenW (lpString=".ppt") returned 4 [0073.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.161] lstrlenW (lpString=".zip") returned 4 [0073.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.161] lstrlenW (lpString=".rar") returned 4 [0073.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.161] lstrlenW (lpString=".bz2") returned 4 [0073.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.161] lstrlenW (lpString=".7z") returned 3 [0073.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.161] lstrlenW (lpString=".dbf") returned 4 [0073.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.161] lstrlenW (lpString=".1cd") returned 4 [0073.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0073.161] lstrlenW (lpString=".jpg") returned 4 [0073.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.161] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0073.161] lstrlenW (lpString="BD10890_.GIF") returned 12 [0073.161] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.162] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=13515) returned 1 [0073.162] CloseHandle (hObject=0x1ec) returned 1 [0073.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0073.162] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.162] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.162] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0073.163] GetLastError () returned 0x0 [0073.163] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x34cb, lpOverlapped=0x0) returned 1 [0073.170] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0073.171] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.171] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.171] SetEndOfFile (hFile=0x16c) returned 1 [0073.171] CloseHandle (hObject=0x16c) returned 1 [0073.171] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.172] SetEndOfFile (hFile=0x1ec) returned 1 [0073.173] CloseHandle (hObject=0x1ec) returned 1 [0073.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0073.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.173] lstrlenW (lpString=".doc") returned 4 [0073.173] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.173] lstrlenW (lpString=".docx") returned 5 [0073.173] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.173] lstrlenW (lpString=".pdf") returned 4 [0073.173] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.173] lstrlenW (lpString=".xls") returned 4 [0073.173] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.173] lstrlenW (lpString=".xlsx") returned 5 [0073.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.173] lstrlenW (lpString=".ppt") returned 4 [0073.173] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.174] lstrlenW (lpString=".zip") returned 4 [0073.174] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.174] lstrlenW (lpString=".rar") returned 4 [0073.174] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.174] lstrlenW (lpString=".bz2") returned 4 [0073.174] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.174] lstrlenW (lpString=".7z") returned 3 [0073.174] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.174] lstrlenW (lpString=".dbf") returned 4 [0073.174] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.174] lstrlenW (lpString=".1cd") returned 4 [0073.174] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.174] lstrlenW (lpString=".jpg") returned 4 [0073.174] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.174] lstrlenW (lpString=".doc") returned 4 [0073.174] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.174] lstrlenW (lpString=".docx") returned 5 [0073.174] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.174] lstrlenW (lpString=".pdf") returned 4 [0073.174] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.174] lstrlenW (lpString=".xls") returned 4 [0073.174] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.174] lstrlenW (lpString=".xlsx") returned 5 [0073.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.174] lstrlenW (lpString=".ppt") returned 4 [0073.174] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.175] lstrlenW (lpString=".zip") returned 4 [0073.175] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.175] lstrlenW (lpString=".rar") returned 4 [0073.175] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.175] lstrlenW (lpString=".bz2") returned 4 [0073.175] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.175] lstrlenW (lpString=".7z") returned 3 [0073.175] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.175] lstrlenW (lpString=".dbf") returned 4 [0073.175] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.175] lstrlenW (lpString=".1cd") returned 4 [0073.175] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0073.175] lstrlenW (lpString=".jpg") returned 4 [0073.175] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.175] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0073.175] lstrlenW (lpString="BD19563_.GIF") returned 12 [0073.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.176] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=20454) returned 1 [0073.176] CloseHandle (hObject=0x1ec) returned 1 [0073.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0073.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.176] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.176] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0073.176] GetLastError () returned 0x0 [0073.176] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0073.572] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0073.579] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.579] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.579] SetEndOfFile (hFile=0x16c) returned 1 [0073.580] CloseHandle (hObject=0x16c) returned 1 [0073.580] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.580] SetEndOfFile (hFile=0x1ec) returned 1 [0073.581] CloseHandle (hObject=0x1ec) returned 1 [0073.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0073.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.581] lstrlenW (lpString=".doc") returned 4 [0073.581] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.581] lstrlenW (lpString=".docx") returned 5 [0073.581] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.581] lstrlenW (lpString=".pdf") returned 4 [0073.581] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.581] lstrlenW (lpString=".xls") returned 4 [0073.581] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.581] lstrlenW (lpString=".xlsx") returned 5 [0073.582] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.582] lstrlenW (lpString=".ppt") returned 4 [0073.582] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.582] lstrlenW (lpString=".zip") returned 4 [0073.582] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.582] lstrlenW (lpString=".rar") returned 4 [0073.582] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.582] lstrlenW (lpString=".bz2") returned 4 [0073.582] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.582] lstrlenW (lpString=".7z") returned 3 [0073.582] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.582] lstrlenW (lpString=".dbf") returned 4 [0073.582] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.582] lstrlenW (lpString=".1cd") returned 4 [0073.582] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.582] lstrlenW (lpString=".jpg") returned 4 [0073.582] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.582] lstrlenW (lpString=".doc") returned 4 [0073.582] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.582] lstrlenW (lpString=".docx") returned 5 [0073.582] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.582] lstrlenW (lpString=".pdf") returned 4 [0073.582] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.582] lstrlenW (lpString=".xls") returned 4 [0073.582] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.582] lstrlenW (lpString=".xlsx") returned 5 [0073.583] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.583] lstrlenW (lpString=".ppt") returned 4 [0073.583] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.583] lstrlenW (lpString=".zip") returned 4 [0073.583] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.583] lstrlenW (lpString=".rar") returned 4 [0073.583] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.583] lstrlenW (lpString=".bz2") returned 4 [0073.583] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.583] lstrlenW (lpString=".7z") returned 3 [0073.583] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.583] lstrlenW (lpString=".dbf") returned 4 [0073.583] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.583] lstrlenW (lpString=".1cd") returned 4 [0073.583] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0073.583] lstrlenW (lpString=".jpg") returned 4 [0073.583] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.583] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0073.583] lstrlenW (lpString="BD19827_.WMF") returned 12 [0073.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.584] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9710) returned 1 [0073.584] CloseHandle (hObject=0x1ec) returned 1 [0073.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0073.584] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.584] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.584] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0073.585] GetLastError () returned 0x0 [0073.585] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x25ee, lpOverlapped=0x0) returned 1 [0073.608] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0073.609] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.609] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.609] SetEndOfFile (hFile=0x16c) returned 1 [0073.610] CloseHandle (hObject=0x16c) returned 1 [0073.610] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.610] SetEndOfFile (hFile=0x1ec) returned 1 [0073.611] CloseHandle (hObject=0x1ec) returned 1 [0073.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0073.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.611] lstrlenW (lpString=".doc") returned 4 [0073.611] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.611] lstrlenW (lpString=".docx") returned 5 [0073.611] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.611] lstrlenW (lpString=".pdf") returned 4 [0073.611] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.611] lstrlenW (lpString=".xls") returned 4 [0073.611] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.611] lstrlenW (lpString=".xlsx") returned 5 [0073.611] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.612] lstrlenW (lpString=".ppt") returned 4 [0073.612] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.612] lstrlenW (lpString=".zip") returned 4 [0073.612] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.612] lstrlenW (lpString=".rar") returned 4 [0073.612] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.612] lstrlenW (lpString=".bz2") returned 4 [0073.612] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.612] lstrlenW (lpString=".7z") returned 3 [0073.612] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.612] lstrlenW (lpString=".dbf") returned 4 [0073.612] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.612] lstrlenW (lpString=".1cd") returned 4 [0073.612] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.612] lstrlenW (lpString=".jpg") returned 4 [0073.612] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.612] lstrlenW (lpString=".doc") returned 4 [0073.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.612] lstrlenW (lpString=".docx") returned 5 [0073.612] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.612] lstrlenW (lpString=".pdf") returned 4 [0073.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.612] lstrlenW (lpString=".xls") returned 4 [0073.612] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.612] lstrlenW (lpString=".xlsx") returned 5 [0073.612] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.613] lstrlenW (lpString=".ppt") returned 4 [0073.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.613] lstrlenW (lpString=".zip") returned 4 [0073.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.613] lstrlenW (lpString=".rar") returned 4 [0073.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString=".bz2") returned 4 [0073.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString=".7z") returned 3 [0073.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.613] lstrlenW (lpString=".dbf") returned 4 [0073.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.613] lstrlenW (lpString=".1cd") returned 4 [0073.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0073.613] lstrlenW (lpString=".jpg") returned 4 [0073.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.613] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0073.613] lstrlenW (lpString="BD19828_.WMF") returned 12 [0073.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.614] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=8772) returned 1 [0073.614] CloseHandle (hObject=0x1ec) returned 1 [0073.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0073.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0073.614] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.614] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0073.615] GetLastError () returned 0x0 [0073.615] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x2244, lpOverlapped=0x0) returned 1 [0073.841] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0073.842] ReadFile (in: hFile=0x1ec, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.842] WriteFile (in: hFile=0x16c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.842] SetEndOfFile (hFile=0x16c) returned 1 [0074.435] CloseHandle (hObject=0x16c) returned 1 [0074.435] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.435] SetEndOfFile (hFile=0x1ec) returned 1 [0074.436] CloseHandle (hObject=0x1ec) returned 1 [0074.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0074.437] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0074.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.927] lstrlenW (lpString=".doc") returned 4 [0074.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.927] lstrlenW (lpString=".docx") returned 5 [0074.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.927] lstrlenW (lpString=".pdf") returned 4 [0074.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.927] lstrlenW (lpString=".xls") returned 4 [0074.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.927] lstrlenW (lpString=".xlsx") returned 5 [0074.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.927] lstrlenW (lpString=".ppt") returned 4 [0074.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.927] lstrlenW (lpString=".zip") returned 4 [0074.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.927] lstrlenW (lpString=".rar") returned 4 [0074.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.928] lstrlenW (lpString=".bz2") returned 4 [0074.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.928] lstrlenW (lpString=".7z") returned 3 [0074.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.928] lstrlenW (lpString=".dbf") returned 4 [0074.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.928] lstrlenW (lpString=".1cd") returned 4 [0074.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.928] lstrlenW (lpString=".jpg") returned 4 [0074.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.928] lstrlenW (lpString=".doc") returned 4 [0074.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.928] lstrlenW (lpString=".docx") returned 5 [0074.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.928] lstrlenW (lpString=".pdf") returned 4 [0074.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.928] lstrlenW (lpString=".xls") returned 4 [0074.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.928] lstrlenW (lpString=".xlsx") returned 5 [0074.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.928] lstrlenW (lpString=".ppt") returned 4 [0074.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.928] lstrlenW (lpString=".zip") returned 4 [0074.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.928] lstrlenW (lpString=".rar") returned 4 [0074.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.929] lstrlenW (lpString=".bz2") returned 4 [0074.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.929] lstrlenW (lpString=".7z") returned 3 [0074.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.929] lstrlenW (lpString=".dbf") returned 4 [0074.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.929] lstrlenW (lpString=".1cd") returned 4 [0074.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0074.929] lstrlenW (lpString=".jpg") returned 4 [0074.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.929] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0074.929] lstrlenW (lpString="BL00105_.WMF") returned 12 [0074.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.803] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=880) returned 1 [0075.803] CloseHandle (hObject=0x170) returned 1 [0075.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0075.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.804] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.804] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0075.804] GetLastError () returned 0x0 [0075.804] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x370, lpOverlapped=0x0) returned 1 [0075.808] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x380, lpOverlapped=0x0) returned 1 [0075.809] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.809] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.809] SetEndOfFile (hFile=0x1dc) returned 1 [0075.809] CloseHandle (hObject=0x1dc) returned 1 [0075.809] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.809] SetEndOfFile (hFile=0x170) returned 1 [0075.810] CloseHandle (hObject=0x170) returned 1 [0075.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0075.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.811] lstrlenW (lpString=".doc") returned 4 [0075.811] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.811] lstrlenW (lpString=".docx") returned 5 [0075.811] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.811] lstrlenW (lpString=".pdf") returned 4 [0075.811] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.811] lstrlenW (lpString=".xls") returned 4 [0075.811] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.811] lstrlenW (lpString=".xlsx") returned 5 [0075.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.811] lstrlenW (lpString=".ppt") returned 4 [0075.811] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.811] lstrlenW (lpString=".zip") returned 4 [0075.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.811] lstrlenW (lpString=".rar") returned 4 [0075.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.811] lstrlenW (lpString=".bz2") returned 4 [0075.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.811] lstrlenW (lpString=".7z") returned 3 [0075.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.811] lstrlenW (lpString=".dbf") returned 4 [0075.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.811] lstrlenW (lpString=".1cd") returned 4 [0075.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.811] lstrlenW (lpString=".jpg") returned 4 [0075.812] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.812] lstrlenW (lpString=".doc") returned 4 [0075.812] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.812] lstrlenW (lpString=".docx") returned 5 [0075.812] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.812] lstrlenW (lpString=".pdf") returned 4 [0075.812] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.812] lstrlenW (lpString=".xls") returned 4 [0075.812] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.812] lstrlenW (lpString=".xlsx") returned 5 [0075.812] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.812] lstrlenW (lpString=".ppt") returned 4 [0075.812] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.812] lstrlenW (lpString=".zip") returned 4 [0075.812] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.812] lstrlenW (lpString=".rar") returned 4 [0075.812] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.812] lstrlenW (lpString=".bz2") returned 4 [0075.812] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.812] lstrlenW (lpString=".7z") returned 3 [0075.812] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.812] lstrlenW (lpString=".dbf") returned 4 [0075.812] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.812] lstrlenW (lpString=".1cd") returned 4 [0075.812] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0075.812] lstrlenW (lpString=".jpg") returned 4 [0075.813] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.813] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0075.813] lstrlenW (lpString="BL00122_.WMF") returned 12 [0075.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.813] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=10146) returned 1 [0075.813] CloseHandle (hObject=0x170) returned 1 [0075.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0075.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.813] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.813] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0075.814] GetLastError () returned 0x0 [0075.814] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x27a2, lpOverlapped=0x0) returned 1 [0075.818] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0075.819] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.819] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.819] SetEndOfFile (hFile=0x1dc) returned 1 [0075.819] CloseHandle (hObject=0x1dc) returned 1 [0075.819] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.820] SetEndOfFile (hFile=0x170) returned 1 [0075.820] CloseHandle (hObject=0x170) returned 1 [0075.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0075.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.821] lstrlenW (lpString=".doc") returned 4 [0075.821] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.821] lstrlenW (lpString=".docx") returned 5 [0075.821] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.821] lstrlenW (lpString=".pdf") returned 4 [0075.821] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.821] lstrlenW (lpString=".xls") returned 4 [0075.821] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.821] lstrlenW (lpString=".xlsx") returned 5 [0075.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.821] lstrlenW (lpString=".ppt") returned 4 [0075.821] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.821] lstrlenW (lpString=".zip") returned 4 [0075.821] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.821] lstrlenW (lpString=".rar") returned 4 [0075.821] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.821] lstrlenW (lpString=".bz2") returned 4 [0075.821] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.821] lstrlenW (lpString=".7z") returned 3 [0075.821] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.821] lstrlenW (lpString=".dbf") returned 4 [0075.821] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.822] lstrlenW (lpString=".1cd") returned 4 [0075.822] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.822] lstrlenW (lpString=".jpg") returned 4 [0075.822] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.822] lstrlenW (lpString=".doc") returned 4 [0075.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.822] lstrlenW (lpString=".docx") returned 5 [0075.822] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.822] lstrlenW (lpString=".pdf") returned 4 [0075.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.822] lstrlenW (lpString=".xls") returned 4 [0075.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.822] lstrlenW (lpString=".xlsx") returned 5 [0075.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.822] lstrlenW (lpString=".ppt") returned 4 [0075.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.822] lstrlenW (lpString=".zip") returned 4 [0075.822] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.822] lstrlenW (lpString=".rar") returned 4 [0075.822] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.822] lstrlenW (lpString=".bz2") returned 4 [0075.822] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.822] lstrlenW (lpString=".7z") returned 3 [0075.822] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.822] lstrlenW (lpString=".dbf") returned 4 [0075.822] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.823] lstrlenW (lpString=".1cd") returned 4 [0075.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0075.823] lstrlenW (lpString=".jpg") returned 4 [0075.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.823] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0075.823] lstrlenW (lpString="BL00130_.WMF") returned 12 [0075.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.823] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1464) returned 1 [0075.823] CloseHandle (hObject=0x170) returned 1 [0075.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0075.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.824] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.824] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0075.824] GetLastError () returned 0x0 [0075.824] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0075.826] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0075.827] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.827] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.827] SetEndOfFile (hFile=0x1dc) returned 1 [0075.827] CloseHandle (hObject=0x1dc) returned 1 [0075.827] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.827] SetEndOfFile (hFile=0x170) returned 1 [0075.828] CloseHandle (hObject=0x170) returned 1 [0075.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0075.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.828] lstrlenW (lpString=".doc") returned 4 [0075.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.828] lstrlenW (lpString=".docx") returned 5 [0075.828] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.828] lstrlenW (lpString=".pdf") returned 4 [0075.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.829] lstrlenW (lpString=".xls") returned 4 [0075.829] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.829] lstrlenW (lpString=".xlsx") returned 5 [0075.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.829] lstrlenW (lpString=".ppt") returned 4 [0075.829] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.829] lstrlenW (lpString=".zip") returned 4 [0075.829] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.829] lstrlenW (lpString=".rar") returned 4 [0075.829] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.829] lstrlenW (lpString=".bz2") returned 4 [0075.829] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.829] lstrlenW (lpString=".7z") returned 3 [0075.829] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.829] lstrlenW (lpString=".dbf") returned 4 [0075.829] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.829] lstrlenW (lpString=".1cd") returned 4 [0075.829] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.829] lstrlenW (lpString=".jpg") returned 4 [0075.829] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.829] lstrlenW (lpString=".doc") returned 4 [0075.829] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.829] lstrlenW (lpString=".docx") returned 5 [0075.829] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.829] lstrlenW (lpString=".pdf") returned 4 [0075.829] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.829] lstrlenW (lpString=".xls") returned 4 [0075.830] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.830] lstrlenW (lpString=".xlsx") returned 5 [0075.830] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.830] lstrlenW (lpString=".ppt") returned 4 [0075.830] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.830] lstrlenW (lpString=".zip") returned 4 [0075.830] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.830] lstrlenW (lpString=".rar") returned 4 [0075.830] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.830] lstrlenW (lpString=".bz2") returned 4 [0075.830] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.830] lstrlenW (lpString=".7z") returned 3 [0075.830] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.830] lstrlenW (lpString=".dbf") returned 4 [0075.830] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.830] lstrlenW (lpString=".1cd") returned 4 [0075.830] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0075.830] lstrlenW (lpString=".jpg") returned 4 [0075.830] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.830] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0075.830] lstrlenW (lpString="BL00148_.WMF") returned 12 [0075.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.831] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1696) returned 1 [0075.831] CloseHandle (hObject=0x170) returned 1 [0075.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0075.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.831] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.831] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0075.831] GetLastError () returned 0x0 [0075.831] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0075.833] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0075.834] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.834] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.834] SetEndOfFile (hFile=0x1dc) returned 1 [0075.834] CloseHandle (hObject=0x1dc) returned 1 [0075.834] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.834] SetEndOfFile (hFile=0x170) returned 1 [0075.835] CloseHandle (hObject=0x170) returned 1 [0075.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0075.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.836] lstrlenW (lpString=".doc") returned 4 [0075.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.836] lstrlenW (lpString=".docx") returned 5 [0075.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.836] lstrlenW (lpString=".pdf") returned 4 [0075.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.836] lstrlenW (lpString=".xls") returned 4 [0075.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.836] lstrlenW (lpString=".xlsx") returned 5 [0075.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.836] lstrlenW (lpString=".ppt") returned 4 [0075.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.836] lstrlenW (lpString=".zip") returned 4 [0075.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.836] lstrlenW (lpString=".rar") returned 4 [0075.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.836] lstrlenW (lpString=".bz2") returned 4 [0075.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.836] lstrlenW (lpString=".7z") returned 3 [0075.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.836] lstrlenW (lpString=".dbf") returned 4 [0075.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.836] lstrlenW (lpString=".1cd") returned 4 [0075.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.836] lstrlenW (lpString=".jpg") returned 4 [0075.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.837] lstrlenW (lpString=".doc") returned 4 [0075.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.837] lstrlenW (lpString=".docx") returned 5 [0075.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.837] lstrlenW (lpString=".pdf") returned 4 [0075.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.837] lstrlenW (lpString=".xls") returned 4 [0075.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.837] lstrlenW (lpString=".xlsx") returned 5 [0075.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.837] lstrlenW (lpString=".ppt") returned 4 [0075.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.837] lstrlenW (lpString=".zip") returned 4 [0075.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.837] lstrlenW (lpString=".rar") returned 4 [0075.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.837] lstrlenW (lpString=".bz2") returned 4 [0075.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.837] lstrlenW (lpString=".7z") returned 3 [0075.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.837] lstrlenW (lpString=".dbf") returned 4 [0075.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.837] lstrlenW (lpString=".1cd") returned 4 [0075.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0075.837] lstrlenW (lpString=".jpg") returned 4 [0075.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.838] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0075.838] lstrlenW (lpString="BL00152_.WMF") returned 12 [0075.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.838] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1516) returned 1 [0075.838] CloseHandle (hObject=0x170) returned 1 [0075.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0075.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.838] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.838] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0075.839] GetLastError () returned 0x0 [0075.839] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0075.993] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0075.994] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.994] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.994] SetEndOfFile (hFile=0x1dc) returned 1 [0075.995] CloseHandle (hObject=0x1dc) returned 1 [0075.995] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.995] SetEndOfFile (hFile=0x170) returned 1 [0075.996] CloseHandle (hObject=0x170) returned 1 [0075.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0075.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.996] lstrlenW (lpString=".doc") returned 4 [0075.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.996] lstrlenW (lpString=".docx") returned 5 [0075.996] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.996] lstrlenW (lpString=".pdf") returned 4 [0075.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.996] lstrlenW (lpString=".xls") returned 4 [0075.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.996] lstrlenW (lpString=".xlsx") returned 5 [0075.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.997] lstrlenW (lpString=".ppt") returned 4 [0075.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.997] lstrlenW (lpString=".zip") returned 4 [0075.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.997] lstrlenW (lpString=".rar") returned 4 [0075.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString=".bz2") returned 4 [0075.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString=".7z") returned 3 [0075.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.997] lstrlenW (lpString=".dbf") returned 4 [0075.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.997] lstrlenW (lpString=".1cd") returned 4 [0075.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.997] lstrlenW (lpString=".jpg") returned 4 [0075.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.997] lstrlenW (lpString=".doc") returned 4 [0075.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString=".docx") returned 5 [0075.997] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.997] lstrlenW (lpString=".pdf") returned 4 [0075.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.997] lstrlenW (lpString=".xls") returned 4 [0075.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.997] lstrlenW (lpString=".xlsx") returned 5 [0075.997] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.997] lstrlenW (lpString=".ppt") returned 4 [0075.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.998] lstrlenW (lpString=".zip") returned 4 [0075.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.998] lstrlenW (lpString=".rar") returned 4 [0075.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString=".bz2") returned 4 [0075.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString=".7z") returned 3 [0075.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.998] lstrlenW (lpString=".dbf") returned 4 [0075.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.998] lstrlenW (lpString=".1cd") returned 4 [0075.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0075.998] lstrlenW (lpString=".jpg") returned 4 [0075.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.998] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0075.998] lstrlenW (lpString="BL00247_.WMF") returned 12 [0075.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.999] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=14444) returned 1 [0075.999] CloseHandle (hObject=0x170) returned 1 [0075.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0075.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0075.999] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.999] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0075.999] GetLastError () returned 0x0 [0075.999] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x386c, lpOverlapped=0x0) returned 1 [0076.008] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x3870, lpOverlapped=0x0) returned 1 [0076.009] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.009] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.009] SetEndOfFile (hFile=0x1dc) returned 1 [0076.009] CloseHandle (hObject=0x1dc) returned 1 [0076.009] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.009] SetEndOfFile (hFile=0x170) returned 1 [0076.010] CloseHandle (hObject=0x170) returned 1 [0076.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.011] lstrlenW (lpString=".doc") returned 4 [0076.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString=".docx") returned 5 [0076.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.011] lstrlenW (lpString=".pdf") returned 4 [0076.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString=".xls") returned 4 [0076.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.011] lstrlenW (lpString=".xlsx") returned 5 [0076.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.011] lstrlenW (lpString=".ppt") returned 4 [0076.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.011] lstrlenW (lpString=".zip") returned 4 [0076.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.011] lstrlenW (lpString=".rar") returned 4 [0076.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString=".bz2") returned 4 [0076.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString=".7z") returned 3 [0076.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.011] lstrlenW (lpString=".dbf") returned 4 [0076.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.011] lstrlenW (lpString=".1cd") returned 4 [0076.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.011] lstrlenW (lpString=".jpg") returned 4 [0076.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.012] lstrlenW (lpString=".doc") returned 4 [0076.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString=".docx") returned 5 [0076.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.012] lstrlenW (lpString=".pdf") returned 4 [0076.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString=".xls") returned 4 [0076.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.012] lstrlenW (lpString=".xlsx") returned 5 [0076.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.012] lstrlenW (lpString=".ppt") returned 4 [0076.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.012] lstrlenW (lpString=".zip") returned 4 [0076.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.012] lstrlenW (lpString=".rar") returned 4 [0076.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString=".bz2") returned 4 [0076.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString=".7z") returned 3 [0076.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.012] lstrlenW (lpString=".dbf") returned 4 [0076.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.013] lstrlenW (lpString=".1cd") returned 4 [0076.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0076.013] lstrlenW (lpString=".jpg") returned 4 [0076.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.013] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.013] lstrlenW (lpString="BL00252_.WMF") returned 12 [0076.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.013] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4708) returned 1 [0076.013] CloseHandle (hObject=0x170) returned 1 [0076.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0076.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.013] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.014] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0076.014] GetLastError () returned 0x0 [0076.014] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1264, lpOverlapped=0x0) returned 1 [0076.020] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0076.021] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.021] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.021] SetEndOfFile (hFile=0x1dc) returned 1 [0076.022] CloseHandle (hObject=0x1dc) returned 1 [0076.022] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.022] SetEndOfFile (hFile=0x170) returned 1 [0076.023] CloseHandle (hObject=0x170) returned 1 [0076.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0076.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.023] lstrlenW (lpString=".doc") returned 4 [0076.023] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.023] lstrlenW (lpString=".docx") returned 5 [0076.023] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.023] lstrlenW (lpString=".pdf") returned 4 [0076.023] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.023] lstrlenW (lpString=".xls") returned 4 [0076.023] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.023] lstrlenW (lpString=".xlsx") returned 5 [0076.023] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.023] lstrlenW (lpString=".ppt") returned 4 [0076.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.024] lstrlenW (lpString=".zip") returned 4 [0076.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.024] lstrlenW (lpString=".rar") returned 4 [0076.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.024] lstrlenW (lpString=".bz2") returned 4 [0076.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.024] lstrlenW (lpString=".7z") returned 3 [0076.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.024] lstrlenW (lpString=".dbf") returned 4 [0076.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.024] lstrlenW (lpString=".1cd") returned 4 [0076.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.024] lstrlenW (lpString=".jpg") returned 4 [0076.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.024] lstrlenW (lpString=".doc") returned 4 [0076.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.024] lstrlenW (lpString=".docx") returned 5 [0076.024] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.024] lstrlenW (lpString=".pdf") returned 4 [0076.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.024] lstrlenW (lpString=".xls") returned 4 [0076.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.024] lstrlenW (lpString=".xlsx") returned 5 [0076.024] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.024] lstrlenW (lpString=".ppt") returned 4 [0076.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.025] lstrlenW (lpString=".zip") returned 4 [0076.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.025] lstrlenW (lpString=".rar") returned 4 [0076.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.025] lstrlenW (lpString=".bz2") returned 4 [0076.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.025] lstrlenW (lpString=".7z") returned 3 [0076.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.025] lstrlenW (lpString=".dbf") returned 4 [0076.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.025] lstrlenW (lpString=".1cd") returned 4 [0076.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0076.025] lstrlenW (lpString=".jpg") returned 4 [0076.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.025] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.025] lstrlenW (lpString="BL00261_.WMF") returned 12 [0076.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.026] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=12482) returned 1 [0076.026] CloseHandle (hObject=0x170) returned 1 [0076.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0076.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.027] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.027] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0076.028] GetLastError () returned 0x0 [0076.028] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0076.030] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0076.031] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.031] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.031] SetEndOfFile (hFile=0x1dc) returned 1 [0076.031] CloseHandle (hObject=0x1dc) returned 1 [0076.031] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.031] SetEndOfFile (hFile=0x170) returned 1 [0076.032] CloseHandle (hObject=0x170) returned 1 [0076.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.032] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0076.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.032] lstrlenW (lpString=".doc") returned 4 [0076.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.032] lstrlenW (lpString=".docx") returned 5 [0076.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.032] lstrlenW (lpString=".pdf") returned 4 [0076.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.033] lstrlenW (lpString=".xls") returned 4 [0076.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.033] lstrlenW (lpString=".xlsx") returned 5 [0076.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.033] lstrlenW (lpString=".ppt") returned 4 [0076.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.033] lstrlenW (lpString=".zip") returned 4 [0076.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.033] lstrlenW (lpString=".rar") returned 4 [0076.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.033] lstrlenW (lpString=".bz2") returned 4 [0076.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.033] lstrlenW (lpString=".7z") returned 3 [0076.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.033] lstrlenW (lpString=".dbf") returned 4 [0076.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.033] lstrlenW (lpString=".1cd") returned 4 [0076.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.033] lstrlenW (lpString=".jpg") returned 4 [0076.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.033] lstrlenW (lpString=".doc") returned 4 [0076.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.033] lstrlenW (lpString=".docx") returned 5 [0076.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.033] lstrlenW (lpString=".pdf") returned 4 [0076.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString=".xls") returned 4 [0076.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.034] lstrlenW (lpString=".xlsx") returned 5 [0076.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.034] lstrlenW (lpString=".ppt") returned 4 [0076.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.034] lstrlenW (lpString=".zip") returned 4 [0076.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.034] lstrlenW (lpString=".rar") returned 4 [0076.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString=".bz2") returned 4 [0076.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString=".7z") returned 3 [0076.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.034] lstrlenW (lpString=".dbf") returned 4 [0076.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.034] lstrlenW (lpString=".1cd") returned 4 [0076.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0076.034] lstrlenW (lpString=".jpg") returned 4 [0076.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.034] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.034] lstrlenW (lpString="BL00262_.WMF") returned 12 [0076.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.035] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=2556) returned 1 [0076.035] CloseHandle (hObject=0x170) returned 1 [0076.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0076.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.036] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.036] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0076.036] GetLastError () returned 0x0 [0076.036] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0076.038] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0076.038] ReadFile (in: hFile=0x170, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.038] WriteFile (in: hFile=0x1dc, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.039] SetEndOfFile (hFile=0x1dc) returned 1 [0076.039] CloseHandle (hObject=0x1dc) returned 1 [0076.039] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.039] SetEndOfFile (hFile=0x170) returned 1 [0076.040] CloseHandle (hObject=0x170) returned 1 [0076.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0076.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.040] lstrlenW (lpString=".doc") returned 4 [0076.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.040] lstrlenW (lpString=".docx") returned 5 [0076.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.040] lstrlenW (lpString=".pdf") returned 4 [0076.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.040] lstrlenW (lpString=".xls") returned 4 [0076.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.040] lstrlenW (lpString=".xlsx") returned 5 [0076.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.040] lstrlenW (lpString=".ppt") returned 4 [0076.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.040] lstrlenW (lpString=".zip") returned 4 [0076.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.041] lstrlenW (lpString=".rar") returned 4 [0076.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.041] lstrlenW (lpString=".bz2") returned 4 [0076.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.041] lstrlenW (lpString=".7z") returned 3 [0076.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.041] lstrlenW (lpString=".dbf") returned 4 [0076.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.041] lstrlenW (lpString=".1cd") returned 4 [0076.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.041] lstrlenW (lpString=".jpg") returned 4 [0076.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.041] lstrlenW (lpString=".doc") returned 4 [0076.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.041] lstrlenW (lpString=".docx") returned 5 [0076.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.041] lstrlenW (lpString=".pdf") returned 4 [0076.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.041] lstrlenW (lpString=".xls") returned 4 [0076.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.041] lstrlenW (lpString=".xlsx") returned 5 [0076.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.041] lstrlenW (lpString=".ppt") returned 4 [0076.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.042] lstrlenW (lpString=".zip") returned 4 [0076.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.042] lstrlenW (lpString=".rar") returned 4 [0076.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.042] lstrlenW (lpString=".bz2") returned 4 [0076.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.042] lstrlenW (lpString=".7z") returned 3 [0076.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.042] lstrlenW (lpString=".dbf") returned 4 [0076.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.042] lstrlenW (lpString=".1cd") returned 4 [0076.245] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.245] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0076.245] lstrlenW (lpString=".jpg") returned 4 [0076.245] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.245] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.245] lstrlenW (lpString="BL00525_.WMF") returned 12 [0076.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.246] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=9590) returned 1 [0076.246] CloseHandle (hObject=0x228) returned 1 [0076.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0076.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.246] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.246] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.247] GetLastError () returned 0x0 [0076.247] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x2576, lpOverlapped=0x0) returned 1 [0076.255] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0076.256] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.256] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.256] SetEndOfFile (hFile=0x204) returned 1 [0076.256] CloseHandle (hObject=0x204) returned 1 [0076.257] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.257] SetEndOfFile (hFile=0x228) returned 1 [0076.257] CloseHandle (hObject=0x228) returned 1 [0076.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0076.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.258] lstrlenW (lpString=".doc") returned 4 [0076.258] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.258] lstrlenW (lpString=".docx") returned 5 [0076.258] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.258] lstrlenW (lpString=".pdf") returned 4 [0076.258] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.258] lstrlenW (lpString=".xls") returned 4 [0076.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.258] lstrlenW (lpString=".xlsx") returned 5 [0076.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.258] lstrlenW (lpString=".ppt") returned 4 [0076.258] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.258] lstrlenW (lpString=".zip") returned 4 [0076.258] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.258] lstrlenW (lpString=".rar") returned 4 [0076.258] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.259] lstrlenW (lpString=".bz2") returned 4 [0076.259] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.259] lstrlenW (lpString=".7z") returned 3 [0076.259] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.259] lstrlenW (lpString=".dbf") returned 4 [0076.259] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.259] lstrlenW (lpString=".1cd") returned 4 [0076.259] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.259] lstrlenW (lpString=".jpg") returned 4 [0076.259] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.259] lstrlenW (lpString=".doc") returned 4 [0076.259] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.259] lstrlenW (lpString=".docx") returned 5 [0076.259] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.259] lstrlenW (lpString=".pdf") returned 4 [0076.259] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.259] lstrlenW (lpString=".xls") returned 4 [0076.259] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.259] lstrlenW (lpString=".xlsx") returned 5 [0076.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.259] lstrlenW (lpString=".ppt") returned 4 [0076.259] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.259] lstrlenW (lpString=".zip") returned 4 [0076.259] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.259] lstrlenW (lpString=".rar") returned 4 [0076.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.260] lstrlenW (lpString=".bz2") returned 4 [0076.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.260] lstrlenW (lpString=".7z") returned 3 [0076.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.260] lstrlenW (lpString=".dbf") returned 4 [0076.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.260] lstrlenW (lpString=".1cd") returned 4 [0076.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0076.260] lstrlenW (lpString=".jpg") returned 4 [0076.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.260] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.260] lstrlenW (lpString="BL00526_.WMF") returned 12 [0076.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.261] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=27552) returned 1 [0076.261] CloseHandle (hObject=0x228) returned 1 [0076.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0076.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.261] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.261] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.262] GetLastError () returned 0x0 [0076.262] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0076.264] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0076.265] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.265] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.265] SetEndOfFile (hFile=0x204) returned 1 [0076.265] CloseHandle (hObject=0x204) returned 1 [0076.265] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.265] SetEndOfFile (hFile=0x228) returned 1 [0076.266] CloseHandle (hObject=0x228) returned 1 [0076.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0076.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.267] lstrlenW (lpString=".doc") returned 4 [0076.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.267] lstrlenW (lpString=".docx") returned 5 [0076.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.267] lstrlenW (lpString=".pdf") returned 4 [0076.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.267] lstrlenW (lpString=".xls") returned 4 [0076.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.267] lstrlenW (lpString=".xlsx") returned 5 [0076.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.267] lstrlenW (lpString=".ppt") returned 4 [0076.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.267] lstrlenW (lpString=".zip") returned 4 [0076.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.267] lstrlenW (lpString=".rar") returned 4 [0076.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.267] lstrlenW (lpString=".bz2") returned 4 [0076.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.267] lstrlenW (lpString=".7z") returned 3 [0076.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.268] lstrlenW (lpString=".dbf") returned 4 [0076.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.268] lstrlenW (lpString=".1cd") returned 4 [0076.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.268] lstrlenW (lpString=".jpg") returned 4 [0076.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.268] lstrlenW (lpString=".doc") returned 4 [0076.268] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.268] lstrlenW (lpString=".docx") returned 5 [0076.268] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.268] lstrlenW (lpString=".pdf") returned 4 [0076.268] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.268] lstrlenW (lpString=".xls") returned 4 [0076.268] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.268] lstrlenW (lpString=".xlsx") returned 5 [0076.268] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.268] lstrlenW (lpString=".ppt") returned 4 [0076.268] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.268] lstrlenW (lpString=".zip") returned 4 [0076.268] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.268] lstrlenW (lpString=".rar") returned 4 [0076.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.268] lstrlenW (lpString=".bz2") returned 4 [0076.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.268] lstrlenW (lpString=".7z") returned 3 [0076.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.269] lstrlenW (lpString=".dbf") returned 4 [0076.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.269] lstrlenW (lpString=".1cd") returned 4 [0076.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0076.269] lstrlenW (lpString=".jpg") returned 4 [0076.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.269] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.269] lstrlenW (lpString="BL00648_.WMF") returned 12 [0076.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.269] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=11500) returned 1 [0076.269] CloseHandle (hObject=0x228) returned 1 [0076.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0076.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.270] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.270] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.270] GetLastError () returned 0x0 [0076.270] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x2cec, lpOverlapped=0x0) returned 1 [0076.272] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0076.273] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.273] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.273] SetEndOfFile (hFile=0x204) returned 1 [0076.273] CloseHandle (hObject=0x204) returned 1 [0076.273] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.273] SetEndOfFile (hFile=0x228) returned 1 [0076.274] CloseHandle (hObject=0x228) returned 1 [0076.274] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0076.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.275] lstrlenW (lpString=".doc") returned 4 [0076.275] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.275] lstrlenW (lpString=".docx") returned 5 [0076.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.275] lstrlenW (lpString=".pdf") returned 4 [0076.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.275] lstrlenW (lpString=".xls") returned 4 [0076.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.275] lstrlenW (lpString=".xlsx") returned 5 [0076.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.275] lstrlenW (lpString=".ppt") returned 4 [0076.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.275] lstrlenW (lpString=".zip") returned 4 [0076.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.275] lstrlenW (lpString=".rar") returned 4 [0076.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.275] lstrlenW (lpString=".bz2") returned 4 [0076.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.275] lstrlenW (lpString=".7z") returned 3 [0076.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.275] lstrlenW (lpString=".dbf") returned 4 [0076.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.276] lstrlenW (lpString=".1cd") returned 4 [0076.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.276] lstrlenW (lpString=".jpg") returned 4 [0076.276] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.276] lstrlenW (lpString=".doc") returned 4 [0076.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.276] lstrlenW (lpString=".docx") returned 5 [0076.276] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.276] lstrlenW (lpString=".pdf") returned 4 [0076.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.276] lstrlenW (lpString=".xls") returned 4 [0076.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.276] lstrlenW (lpString=".xlsx") returned 5 [0076.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.276] lstrlenW (lpString=".ppt") returned 4 [0076.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.276] lstrlenW (lpString=".zip") returned 4 [0076.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.276] lstrlenW (lpString=".rar") returned 4 [0076.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.276] lstrlenW (lpString=".bz2") returned 4 [0076.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.276] lstrlenW (lpString=".7z") returned 3 [0076.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.276] lstrlenW (lpString=".dbf") returned 4 [0076.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.277] lstrlenW (lpString=".1cd") returned 4 [0076.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0076.277] lstrlenW (lpString=".jpg") returned 4 [0076.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.277] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.277] lstrlenW (lpString="BL00921_.WMF") returned 12 [0076.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.278] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=4408) returned 1 [0076.278] CloseHandle (hObject=0x228) returned 1 [0076.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0076.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.278] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.278] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.278] GetLastError () returned 0x0 [0076.279] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1138, lpOverlapped=0x0) returned 1 [0076.280] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0076.281] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.281] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.281] SetEndOfFile (hFile=0x204) returned 1 [0076.282] CloseHandle (hObject=0x204) returned 1 [0076.282] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.282] SetEndOfFile (hFile=0x228) returned 1 [0076.283] CloseHandle (hObject=0x228) returned 1 [0076.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0076.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.283] lstrlenW (lpString=".doc") returned 4 [0076.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.283] lstrlenW (lpString=".docx") returned 5 [0076.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.283] lstrlenW (lpString=".pdf") returned 4 [0076.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.283] lstrlenW (lpString=".xls") returned 4 [0076.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.283] lstrlenW (lpString=".xlsx") returned 5 [0076.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.283] lstrlenW (lpString=".ppt") returned 4 [0076.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.284] lstrlenW (lpString=".zip") returned 4 [0076.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.284] lstrlenW (lpString=".rar") returned 4 [0076.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.284] lstrlenW (lpString=".bz2") returned 4 [0076.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.284] lstrlenW (lpString=".7z") returned 3 [0076.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.284] lstrlenW (lpString=".dbf") returned 4 [0076.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.284] lstrlenW (lpString=".1cd") returned 4 [0076.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.284] lstrlenW (lpString=".jpg") returned 4 [0076.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.284] lstrlenW (lpString=".doc") returned 4 [0076.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.284] lstrlenW (lpString=".docx") returned 5 [0076.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.284] lstrlenW (lpString=".pdf") returned 4 [0076.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.284] lstrlenW (lpString=".xls") returned 4 [0076.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.284] lstrlenW (lpString=".xlsx") returned 5 [0076.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.284] lstrlenW (lpString=".ppt") returned 4 [0076.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.285] lstrlenW (lpString=".zip") returned 4 [0076.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.285] lstrlenW (lpString=".rar") returned 4 [0076.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.285] lstrlenW (lpString=".bz2") returned 4 [0076.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.285] lstrlenW (lpString=".7z") returned 3 [0076.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.285] lstrlenW (lpString=".dbf") returned 4 [0076.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.285] lstrlenW (lpString=".1cd") returned 4 [0076.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0076.285] lstrlenW (lpString=".jpg") returned 4 [0076.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.285] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.285] lstrlenW (lpString="BL00923_.WMF") returned 12 [0076.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.286] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=6256) returned 1 [0076.286] CloseHandle (hObject=0x228) returned 1 [0076.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0076.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.288] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.288] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.288] GetLastError () returned 0x0 [0076.288] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x1870, lpOverlapped=0x0) returned 1 [0076.290] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x1880, lpOverlapped=0x0) returned 1 [0076.292] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.292] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.292] SetEndOfFile (hFile=0x204) returned 1 [0076.292] CloseHandle (hObject=0x204) returned 1 [0076.292] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.292] SetEndOfFile (hFile=0x228) returned 1 [0076.293] CloseHandle (hObject=0x228) returned 1 [0076.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.293] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0076.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.293] lstrlenW (lpString=".doc") returned 4 [0076.293] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.293] lstrlenW (lpString=".docx") returned 5 [0076.293] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.293] lstrlenW (lpString=".pdf") returned 4 [0076.294] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.294] lstrlenW (lpString=".xls") returned 4 [0076.294] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.294] lstrlenW (lpString=".xlsx") returned 5 [0076.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.294] lstrlenW (lpString=".ppt") returned 4 [0076.294] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.294] lstrlenW (lpString=".zip") returned 4 [0076.294] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.294] lstrlenW (lpString=".rar") returned 4 [0076.294] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.294] lstrlenW (lpString=".bz2") returned 4 [0076.294] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.294] lstrlenW (lpString=".7z") returned 3 [0076.294] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.294] lstrlenW (lpString=".dbf") returned 4 [0076.294] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.294] lstrlenW (lpString=".1cd") returned 4 [0076.294] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.294] lstrlenW (lpString=".jpg") returned 4 [0076.294] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.294] lstrlenW (lpString=".doc") returned 4 [0076.294] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.294] lstrlenW (lpString=".docx") returned 5 [0076.294] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.294] lstrlenW (lpString=".pdf") returned 4 [0076.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.295] lstrlenW (lpString=".xls") returned 4 [0076.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.295] lstrlenW (lpString=".xlsx") returned 5 [0076.295] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.295] lstrlenW (lpString=".ppt") returned 4 [0076.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.295] lstrlenW (lpString=".zip") returned 4 [0076.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.295] lstrlenW (lpString=".rar") returned 4 [0076.295] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.295] lstrlenW (lpString=".bz2") returned 4 [0076.295] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.295] lstrlenW (lpString=".7z") returned 3 [0076.295] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.295] lstrlenW (lpString=".dbf") returned 4 [0076.295] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.295] lstrlenW (lpString=".1cd") returned 4 [0076.295] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0076.295] lstrlenW (lpString=".jpg") returned 4 [0076.295] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.295] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.295] lstrlenW (lpString="BL00932_.WMF") returned 12 [0076.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.296] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=19476) returned 1 [0076.296] CloseHandle (hObject=0x228) returned 1 [0076.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0076.296] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.297] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.297] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.297] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.297] GetLastError () returned 0x0 [0076.297] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x4c14, lpOverlapped=0x0) returned 1 [0076.299] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0076.300] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.300] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.300] SetEndOfFile (hFile=0x204) returned 1 [0076.300] CloseHandle (hObject=0x204) returned 1 [0076.300] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.300] SetEndOfFile (hFile=0x228) returned 1 [0076.301] CloseHandle (hObject=0x228) returned 1 [0076.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0076.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.301] lstrlenW (lpString=".doc") returned 4 [0076.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.302] lstrlenW (lpString=".docx") returned 5 [0076.302] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.302] lstrlenW (lpString=".pdf") returned 4 [0076.302] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.302] lstrlenW (lpString=".xls") returned 4 [0076.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.302] lstrlenW (lpString=".xlsx") returned 5 [0076.302] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.302] lstrlenW (lpString=".ppt") returned 4 [0076.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.302] lstrlenW (lpString=".zip") returned 4 [0076.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.302] lstrlenW (lpString=".rar") returned 4 [0076.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.302] lstrlenW (lpString=".bz2") returned 4 [0076.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.302] lstrlenW (lpString=".7z") returned 3 [0076.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.302] lstrlenW (lpString=".dbf") returned 4 [0076.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.302] lstrlenW (lpString=".1cd") returned 4 [0076.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.302] lstrlenW (lpString=".jpg") returned 4 [0076.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.302] lstrlenW (lpString=".doc") returned 4 [0076.302] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.303] lstrlenW (lpString=".docx") returned 5 [0076.303] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.303] lstrlenW (lpString=".pdf") returned 4 [0076.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.303] lstrlenW (lpString=".xls") returned 4 [0076.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.303] lstrlenW (lpString=".xlsx") returned 5 [0076.303] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.303] lstrlenW (lpString=".ppt") returned 4 [0076.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.303] lstrlenW (lpString=".zip") returned 4 [0076.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.303] lstrlenW (lpString=".rar") returned 4 [0076.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.303] lstrlenW (lpString=".bz2") returned 4 [0076.303] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.303] lstrlenW (lpString=".7z") returned 3 [0076.303] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.303] lstrlenW (lpString=".dbf") returned 4 [0076.303] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.303] lstrlenW (lpString=".1cd") returned 4 [0076.303] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0076.303] lstrlenW (lpString=".jpg") returned 4 [0076.303] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.303] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.304] lstrlenW (lpString="BL00985_.WMF") returned 12 [0076.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.304] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3768) returned 1 [0076.304] CloseHandle (hObject=0x228) returned 1 [0076.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0076.304] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.304] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.304] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.305] GetLastError () returned 0x0 [0076.305] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xeb8, lpOverlapped=0x0) returned 1 [0076.306] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0076.307] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.307] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.308] SetEndOfFile (hFile=0x204) returned 1 [0076.308] CloseHandle (hObject=0x204) returned 1 [0076.308] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.308] SetEndOfFile (hFile=0x228) returned 1 [0076.309] CloseHandle (hObject=0x228) returned 1 [0076.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0076.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.310] lstrlenW (lpString=".doc") returned 4 [0076.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.310] lstrlenW (lpString=".docx") returned 5 [0076.310] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.310] lstrlenW (lpString=".pdf") returned 4 [0076.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.310] lstrlenW (lpString=".xls") returned 4 [0076.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.310] lstrlenW (lpString=".xlsx") returned 5 [0076.310] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.310] lstrlenW (lpString=".ppt") returned 4 [0076.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.310] lstrlenW (lpString=".zip") returned 4 [0076.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.310] lstrlenW (lpString=".rar") returned 4 [0076.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.310] lstrlenW (lpString=".bz2") returned 4 [0076.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.310] lstrlenW (lpString=".7z") returned 3 [0076.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.310] lstrlenW (lpString=".dbf") returned 4 [0076.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.310] lstrlenW (lpString=".1cd") returned 4 [0076.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.310] lstrlenW (lpString=".jpg") returned 4 [0076.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.311] lstrlenW (lpString=".doc") returned 4 [0076.311] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.311] lstrlenW (lpString=".docx") returned 5 [0076.311] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.311] lstrlenW (lpString=".pdf") returned 4 [0076.311] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.311] lstrlenW (lpString=".xls") returned 4 [0076.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.311] lstrlenW (lpString=".xlsx") returned 5 [0076.311] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.311] lstrlenW (lpString=".ppt") returned 4 [0076.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.311] lstrlenW (lpString=".zip") returned 4 [0076.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.311] lstrlenW (lpString=".rar") returned 4 [0076.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.311] lstrlenW (lpString=".bz2") returned 4 [0076.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.311] lstrlenW (lpString=".7z") returned 3 [0076.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.311] lstrlenW (lpString=".dbf") returned 4 [0076.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.311] lstrlenW (lpString=".1cd") returned 4 [0076.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0076.311] lstrlenW (lpString=".jpg") returned 4 [0076.312] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.312] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.312] lstrlenW (lpString="BOAT.WMF") returned 8 [0076.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.312] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=3350) returned 1 [0076.312] CloseHandle (hObject=0x228) returned 1 [0076.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0076.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.313] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.313] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.313] GetLastError () returned 0x0 [0076.313] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0xd16, lpOverlapped=0x0) returned 1 [0076.315] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0076.316] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.316] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0076.316] SetEndOfFile (hFile=0x204) returned 1 [0076.316] CloseHandle (hObject=0x204) returned 1 [0076.316] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.316] SetEndOfFile (hFile=0x228) returned 1 [0076.317] CloseHandle (hObject=0x228) returned 1 [0076.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0076.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.317] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.317] lstrlenW (lpString=".doc") returned 4 [0076.317] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.317] lstrlenW (lpString=".docx") returned 5 [0076.317] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0076.318] lstrlenW (lpString=".pdf") returned 4 [0076.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.318] lstrlenW (lpString=".xls") returned 4 [0076.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.318] lstrlenW (lpString=".xlsx") returned 5 [0076.318] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0076.318] lstrlenW (lpString=".ppt") returned 4 [0076.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.318] lstrlenW (lpString=".zip") returned 4 [0076.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.318] lstrlenW (lpString=".rar") returned 4 [0076.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.318] lstrlenW (lpString=".bz2") returned 4 [0076.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.318] lstrlenW (lpString=".7z") returned 3 [0076.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.318] lstrlenW (lpString=".dbf") returned 4 [0076.318] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.318] lstrlenW (lpString=".1cd") returned 4 [0076.318] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.318] lstrlenW (lpString=".jpg") returned 4 [0076.318] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.318] lstrlenW (lpString=".doc") returned 4 [0076.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.318] lstrlenW (lpString=".docx") returned 5 [0076.319] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0076.319] lstrlenW (lpString=".pdf") returned 4 [0076.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.319] lstrlenW (lpString=".xls") returned 4 [0076.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.319] lstrlenW (lpString=".xlsx") returned 5 [0076.319] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0076.319] lstrlenW (lpString=".ppt") returned 4 [0076.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.319] lstrlenW (lpString=".zip") returned 4 [0076.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.319] lstrlenW (lpString=".rar") returned 4 [0076.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.319] lstrlenW (lpString=".bz2") returned 4 [0076.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.319] lstrlenW (lpString=".7z") returned 3 [0076.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.319] lstrlenW (lpString=".dbf") returned 4 [0076.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.319] lstrlenW (lpString=".1cd") returned 4 [0076.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0076.319] lstrlenW (lpString=".jpg") returned 4 [0076.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.319] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.319] lstrlenW (lpString="BOATINST.WMF") returned 12 [0076.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.320] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=29004) returned 1 [0076.320] CloseHandle (hObject=0x228) returned 1 [0076.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0076.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.320] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.320] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.321] GetLastError () returned 0x0 [0076.321] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x714c, lpOverlapped=0x0) returned 1 [0076.323] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0x7150, lpOverlapped=0x0) returned 1 [0076.325] ReadFile (in: hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2c9fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.325] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2c9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.325] SetEndOfFile (hFile=0x204) returned 1 [0076.325] CloseHandle (hObject=0x204) returned 1 [0076.325] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.325] SetEndOfFile (hFile=0x228) returned 1 [0076.326] CloseHandle (hObject=0x228) returned 1 [0076.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.326] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0076.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.327] lstrlenW (lpString=".doc") returned 4 [0076.327] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.327] lstrlenW (lpString=".docx") returned 5 [0076.327] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0076.327] lstrlenW (lpString=".pdf") returned 4 [0076.327] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.327] lstrlenW (lpString=".xls") returned 4 [0076.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.327] lstrlenW (lpString=".xlsx") returned 5 [0076.327] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0076.327] lstrlenW (lpString=".ppt") returned 4 [0076.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.327] lstrlenW (lpString=".zip") returned 4 [0076.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.327] lstrlenW (lpString=".rar") returned 4 [0076.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.327] lstrlenW (lpString=".bz2") returned 4 [0076.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.327] lstrlenW (lpString=".7z") returned 3 [0076.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.327] lstrlenW (lpString=".dbf") returned 4 [0076.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.327] lstrlenW (lpString=".1cd") returned 4 [0076.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.327] lstrlenW (lpString=".jpg") returned 4 [0076.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.328] lstrlenW (lpString=".doc") returned 4 [0076.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.328] lstrlenW (lpString=".docx") returned 5 [0076.328] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0076.328] lstrlenW (lpString=".pdf") returned 4 [0076.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.328] lstrlenW (lpString=".xls") returned 4 [0076.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.328] lstrlenW (lpString=".xlsx") returned 5 [0076.328] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0076.328] lstrlenW (lpString=".ppt") returned 4 [0076.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.328] lstrlenW (lpString=".zip") returned 4 [0076.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.328] lstrlenW (lpString=".rar") returned 4 [0076.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.328] lstrlenW (lpString=".bz2") returned 4 [0076.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.328] lstrlenW (lpString=".7z") returned 3 [0076.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.328] lstrlenW (lpString=".dbf") returned 4 [0076.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.328] lstrlenW (lpString=".1cd") returned 4 [0076.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0076.328] lstrlenW (lpString=".jpg") returned 4 [0076.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.329] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.329] lstrlenW (lpString="BS00076_.WMF") returned 12 [0076.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.329] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x2c9ff1c | out: lpFileSize=0x2c9ff1c*=1330) returned 1 [0076.329] CloseHandle (hObject=0x228) returned 1 [0076.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0076.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0076.329] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.329] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c9fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0076.330] GetLastError () returned 0x0 [0076.330] ReadFile (hFile=0x228, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c9fed4, lpOverlapped=0x0) Thread: id = 17 os_tid = 0xaa8 [0047.020] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x9b0920 [0047.021] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x3750048 [0047.021] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9203c0 [0047.021] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x6) returned 0x923160 [0047.021] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9203d8 [0047.021] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x3850020 [0047.022] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9203f0 [0047.022] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9203f0, Size=0x20) returned 0x905cc0 [0047.022] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9203f0 [0047.022] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9203f0, Size=0x20) returned 0x905ce8 [0047.022] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.022] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.022] Wow64DisableWow64FsRedirection (in: OldValue=0x2ddff58 | out: OldValue=0x2ddff58*=0x0) returned 1 [0047.022] lstrlenW (lpString="kernel32.dll") returned 12 [0047.022] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905cc0 | out: hHeap=0x8d0000) returned 1 [0047.022] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.022] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905ce8 | out: hHeap=0x8d0000) returned 1 [0047.023] Sleep (dwMilliseconds=0x64) [0047.230] Sleep (dwMilliseconds=0x64) [0047.478] lstrcmpiW (lpString1=".LOG2", lpString2=".wiki") returned -1 [0047.478] lstrlenW (lpString="BCD.LOG2") returned 8 [0047.478] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0047.538] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=0) returned 1 [0047.545] CloseHandle (hObject=0x168) returned 1 [0047.550] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.550] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.550] lstrlenW (lpString=".doc") returned 4 [0047.551] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0047.551] lstrlenW (lpString=".docx") returned 5 [0047.551] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0047.551] lstrlenW (lpString=".pdf") returned 4 [0047.551] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0047.551] lstrlenW (lpString=".xls") returned 4 [0047.551] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0047.551] lstrlenW (lpString=".xlsx") returned 5 [0047.551] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0047.551] lstrlenW (lpString=".ppt") returned 4 [0047.551] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0047.551] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.551] lstrlenW (lpString=".zip") returned 4 [0047.551] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0047.551] lstrlenW (lpString=".rar") returned 4 [0047.551] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0047.551] lstrlenW (lpString=".bz2") returned 4 [0047.551] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0047.551] lstrlenW (lpString=".7z") returned 3 [0047.551] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0047.551] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.551] lstrlenW (lpString=".dbf") returned 4 [0047.551] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0047.551] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.551] lstrlenW (lpString=".1cd") returned 4 [0047.551] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0047.551] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.551] lstrlenW (lpString=".jpg") returned 4 [0047.551] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0047.552] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.552] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.552] lstrlenW (lpString=".doc") returned 4 [0047.552] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0047.552] lstrlenW (lpString=".docx") returned 5 [0047.552] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0047.552] lstrlenW (lpString=".pdf") returned 4 [0047.552] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0047.552] lstrlenW (lpString=".xls") returned 4 [0047.552] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0047.552] lstrlenW (lpString=".xlsx") returned 5 [0047.552] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0047.552] lstrlenW (lpString=".ppt") returned 4 [0047.552] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0047.552] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.552] lstrlenW (lpString=".zip") returned 4 [0047.552] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0047.552] lstrlenW (lpString=".rar") returned 4 [0047.552] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0047.552] lstrlenW (lpString=".bz2") returned 4 [0047.552] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0047.552] lstrlenW (lpString=".7z") returned 3 [0047.552] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0047.552] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.552] lstrlenW (lpString=".dbf") returned 4 [0047.552] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0047.552] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.552] lstrlenW (lpString=".1cd") returned 4 [0047.552] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0047.552] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0047.553] lstrlenW (lpString=".jpg") returned 4 [0047.553] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0047.553] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.553] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.553] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0047.553] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=85056) returned 1 [0047.553] CloseHandle (hObject=0x168) returned 1 [0047.553] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui")) returned 0x20 [0047.553] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.553] CreateFileW (lpFileName="C:\\Boot\\en-US\\bootmgr.exe.mui" (normalized: "c:\\boot\\en-us\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.553] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.553] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.553] lstrlenW (lpString=".doc") returned 4 [0047.554] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.554] lstrlenW (lpString=".docx") returned 5 [0047.554] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.554] lstrlenW (lpString=".pdf") returned 4 [0047.554] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.554] lstrlenW (lpString=".xls") returned 4 [0047.554] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.554] lstrlenW (lpString=".xlsx") returned 5 [0047.554] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.554] lstrlenW (lpString=".ppt") returned 4 [0047.554] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.554] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.554] lstrlenW (lpString=".zip") returned 4 [0047.554] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.554] lstrlenW (lpString=".rar") returned 4 [0047.554] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.554] lstrlenW (lpString=".bz2") returned 4 [0047.554] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.554] lstrlenW (lpString=".7z") returned 3 [0047.554] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.554] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.554] lstrlenW (lpString=".dbf") returned 4 [0047.554] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.554] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.554] lstrlenW (lpString=".1cd") returned 4 [0047.554] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.554] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.554] lstrlenW (lpString=".jpg") returned 4 [0047.554] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.554] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.555] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.555] lstrlenW (lpString=".doc") returned 4 [0047.555] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.555] lstrlenW (lpString=".docx") returned 5 [0047.555] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.555] lstrlenW (lpString=".pdf") returned 4 [0047.555] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.555] lstrlenW (lpString=".xls") returned 4 [0047.555] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.555] lstrlenW (lpString=".xlsx") returned 5 [0047.555] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.555] lstrlenW (lpString=".ppt") returned 4 [0047.555] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.555] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.555] lstrlenW (lpString=".zip") returned 4 [0047.555] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.555] lstrlenW (lpString=".rar") returned 4 [0047.555] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.555] lstrlenW (lpString=".bz2") returned 4 [0047.555] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.555] lstrlenW (lpString=".7z") returned 3 [0047.555] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.555] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.555] lstrlenW (lpString=".dbf") returned 4 [0047.555] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.555] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.555] lstrlenW (lpString=".1cd") returned 4 [0047.555] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.555] lstrlenW (lpString="C:\\Boot\\en-US\\bootmgr.exe.mui") returned 29 [0047.555] lstrlenW (lpString=".jpg") returned 4 [0047.555] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.556] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.556] lstrlenW (lpString="memtest.exe.mui") returned 15 [0047.556] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0047.556] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=43600) returned 1 [0047.556] CloseHandle (hObject=0x168) returned 1 [0047.556] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui")) returned 0x20 [0047.556] GetFileAttributesW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\en-us\\memtest.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.556] CreateFileW (lpFileName="C:\\Boot\\en-US\\memtest.exe.mui" (normalized: "c:\\boot\\en-us\\memtest.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.556] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.556] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.556] lstrlenW (lpString=".doc") returned 4 [0047.556] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.556] lstrlenW (lpString=".docx") returned 5 [0047.556] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.556] lstrlenW (lpString=".pdf") returned 4 [0047.556] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.557] lstrlenW (lpString=".xls") returned 4 [0047.557] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.557] lstrlenW (lpString=".xlsx") returned 5 [0047.557] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.557] lstrlenW (lpString=".ppt") returned 4 [0047.557] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.557] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.557] lstrlenW (lpString=".zip") returned 4 [0047.557] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.557] lstrlenW (lpString=".rar") returned 4 [0047.557] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.557] lstrlenW (lpString=".bz2") returned 4 [0047.557] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.557] lstrlenW (lpString=".7z") returned 3 [0047.557] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.557] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.557] lstrlenW (lpString=".dbf") returned 4 [0047.557] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.557] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.557] lstrlenW (lpString=".1cd") returned 4 [0047.557] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.557] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.557] lstrlenW (lpString=".jpg") returned 4 [0047.557] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.557] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.557] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.557] lstrlenW (lpString=".doc") returned 4 [0047.557] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.557] lstrlenW (lpString=".docx") returned 5 [0047.557] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.557] lstrlenW (lpString=".pdf") returned 4 [0047.558] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.558] lstrlenW (lpString=".xls") returned 4 [0047.558] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.558] lstrlenW (lpString=".xlsx") returned 5 [0047.558] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.558] lstrlenW (lpString=".ppt") returned 4 [0047.558] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.558] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.558] lstrlenW (lpString=".zip") returned 4 [0047.558] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.558] lstrlenW (lpString=".rar") returned 4 [0047.558] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.558] lstrlenW (lpString=".bz2") returned 4 [0047.558] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.558] lstrlenW (lpString=".7z") returned 3 [0047.558] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.558] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.558] lstrlenW (lpString=".dbf") returned 4 [0047.558] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.558] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.558] lstrlenW (lpString=".1cd") returned 4 [0047.558] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.558] lstrlenW (lpString="C:\\Boot\\en-US\\memtest.exe.mui") returned 29 [0047.558] lstrlenW (lpString=".jpg") returned 4 [0047.558] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.558] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.558] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.558] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0047.559] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=90192) returned 1 [0047.559] CloseHandle (hObject=0x168) returned 1 [0047.559] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui")) returned 0x20 [0047.559] GetFileAttributesW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.559] CreateFileW (lpFileName="C:\\Boot\\es-ES\\bootmgr.exe.mui" (normalized: "c:\\boot\\es-es\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.559] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.559] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.559] lstrlenW (lpString=".doc") returned 4 [0047.559] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.559] lstrlenW (lpString=".docx") returned 5 [0047.559] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.559] lstrlenW (lpString=".pdf") returned 4 [0047.559] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.559] lstrlenW (lpString=".xls") returned 4 [0047.559] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.559] lstrlenW (lpString=".xlsx") returned 5 [0047.559] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.559] lstrlenW (lpString=".ppt") returned 4 [0047.559] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.560] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.560] lstrlenW (lpString=".zip") returned 4 [0047.560] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.560] lstrlenW (lpString=".rar") returned 4 [0047.560] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.560] lstrlenW (lpString=".bz2") returned 4 [0047.560] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.560] lstrlenW (lpString=".7z") returned 3 [0047.560] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.560] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.560] lstrlenW (lpString=".dbf") returned 4 [0047.560] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.560] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.560] lstrlenW (lpString=".1cd") returned 4 [0047.560] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.560] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.560] lstrlenW (lpString=".jpg") returned 4 [0047.560] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.560] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.560] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.560] lstrlenW (lpString=".doc") returned 4 [0047.560] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.560] lstrlenW (lpString=".docx") returned 5 [0047.560] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.560] lstrlenW (lpString=".pdf") returned 4 [0047.560] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.560] lstrlenW (lpString=".xls") returned 4 [0047.560] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.560] lstrlenW (lpString=".xlsx") returned 5 [0047.560] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.560] lstrlenW (lpString=".ppt") returned 4 [0047.561] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.561] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.561] lstrlenW (lpString=".zip") returned 4 [0047.561] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.561] lstrlenW (lpString=".rar") returned 4 [0047.561] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.561] lstrlenW (lpString=".bz2") returned 4 [0047.561] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.561] lstrlenW (lpString=".7z") returned 3 [0047.561] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.561] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.561] lstrlenW (lpString=".dbf") returned 4 [0047.561] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.561] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.561] lstrlenW (lpString=".1cd") returned 4 [0047.561] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.561] lstrlenW (lpString="C:\\Boot\\es-ES\\bootmgr.exe.mui") returned 29 [0047.561] lstrlenW (lpString=".jpg") returned 4 [0047.561] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.561] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.561] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.561] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0047.561] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=89152) returned 1 [0047.562] CloseHandle (hObject=0x168) returned 1 [0047.562] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui")) returned 0x20 [0047.562] GetFileAttributesW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.562] CreateFileW (lpFileName="C:\\Boot\\fi-FI\\bootmgr.exe.mui" (normalized: "c:\\boot\\fi-fi\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.562] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.562] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.562] lstrlenW (lpString=".doc") returned 4 [0047.562] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.562] lstrlenW (lpString=".docx") returned 5 [0047.562] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.562] lstrlenW (lpString=".pdf") returned 4 [0047.562] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.562] lstrlenW (lpString=".xls") returned 4 [0047.562] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.562] lstrlenW (lpString=".xlsx") returned 5 [0047.562] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.562] lstrlenW (lpString=".ppt") returned 4 [0047.562] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.562] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.562] lstrlenW (lpString=".zip") returned 4 [0047.562] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.562] lstrlenW (lpString=".rar") returned 4 [0047.562] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.562] lstrlenW (lpString=".bz2") returned 4 [0047.562] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.562] lstrlenW (lpString=".7z") returned 3 [0047.563] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.563] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.563] lstrlenW (lpString=".dbf") returned 4 [0047.563] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.563] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.563] lstrlenW (lpString=".1cd") returned 4 [0047.563] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.563] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.563] lstrlenW (lpString=".jpg") returned 4 [0047.563] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.563] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.563] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.563] lstrlenW (lpString=".doc") returned 4 [0047.563] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.563] lstrlenW (lpString=".docx") returned 5 [0047.563] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.563] lstrlenW (lpString=".pdf") returned 4 [0047.563] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.563] lstrlenW (lpString=".xls") returned 4 [0047.563] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.563] lstrlenW (lpString=".xlsx") returned 5 [0047.563] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.563] lstrlenW (lpString=".ppt") returned 4 [0047.563] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.563] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.563] lstrlenW (lpString=".zip") returned 4 [0047.563] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.563] lstrlenW (lpString=".rar") returned 4 [0047.563] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.563] lstrlenW (lpString=".bz2") returned 4 [0047.563] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.563] lstrlenW (lpString=".7z") returned 3 [0047.564] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.564] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.564] lstrlenW (lpString=".dbf") returned 4 [0047.564] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.564] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.564] lstrlenW (lpString=".1cd") returned 4 [0047.564] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.564] lstrlenW (lpString="C:\\Boot\\fi-FI\\bootmgr.exe.mui") returned 29 [0047.564] lstrlenW (lpString=".jpg") returned 4 [0047.564] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.564] lstrcmpiW (lpString1=".ttf", lpString2=".wiki") returned -1 [0047.564] lstrlenW (lpString="chs_boot.ttf") returned 12 [0047.564] CreateFileW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0047.564] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3694080) returned 1 [0047.564] CloseHandle (hObject=0x168) returned 1 [0047.567] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf")) returned 0x20 [0047.567] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.567] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0047.568] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.568] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.568] lstrlenW (lpString=".doc") returned 4 [0047.568] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0047.568] lstrlenW (lpString=".docx") returned 5 [0047.568] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0047.568] lstrlenW (lpString=".pdf") returned 4 [0047.568] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0047.568] lstrlenW (lpString=".xls") returned 4 [0047.568] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0047.568] lstrlenW (lpString=".xlsx") returned 5 [0047.568] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0047.568] lstrlenW (lpString=".ppt") returned 4 [0047.568] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0047.568] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.568] lstrlenW (lpString=".zip") returned 4 [0047.568] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0047.568] lstrlenW (lpString=".rar") returned 4 [0047.568] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0047.568] lstrlenW (lpString=".bz2") returned 4 [0047.568] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0047.568] lstrlenW (lpString=".7z") returned 3 [0047.568] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0047.568] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.568] lstrlenW (lpString=".dbf") returned 4 [0047.568] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0047.568] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.568] lstrlenW (lpString=".1cd") returned 4 [0047.568] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0047.568] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.568] lstrlenW (lpString=".jpg") returned 4 [0047.568] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0047.569] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.569] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.569] lstrlenW (lpString=".doc") returned 4 [0047.569] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0047.569] lstrlenW (lpString=".docx") returned 5 [0047.569] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0047.569] lstrlenW (lpString=".pdf") returned 4 [0047.569] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0047.569] lstrlenW (lpString=".xls") returned 4 [0047.569] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0047.569] lstrlenW (lpString=".xlsx") returned 5 [0047.569] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0047.569] lstrlenW (lpString=".ppt") returned 4 [0047.569] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0047.569] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.569] lstrlenW (lpString=".zip") returned 4 [0047.569] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0047.569] lstrlenW (lpString=".rar") returned 4 [0047.569] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0047.569] lstrlenW (lpString=".bz2") returned 4 [0047.569] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0047.569] lstrlenW (lpString=".7z") returned 3 [0047.569] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0047.569] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.569] lstrlenW (lpString=".dbf") returned 4 [0047.569] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0047.569] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.569] lstrlenW (lpString=".1cd") returned 4 [0047.569] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0047.569] lstrlenW (lpString="C:\\Boot\\Fonts\\chs_boot.ttf") returned 26 [0047.569] lstrlenW (lpString=".jpg") returned 4 [0047.569] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0047.570] lstrcmpiW (lpString1=".ttf", lpString2=".wiki") returned -1 [0047.570] lstrlenW (lpString="cht_boot.ttf") returned 12 [0047.570] CreateFileW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x164 [0047.626] GetFileSizeEx (in: hFile=0x164, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3876772) returned 1 [0047.626] CloseHandle (hObject=0x164) returned 1 [0047.626] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf")) returned 0x20 [0047.626] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.627] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0047.627] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0047.627] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0047.627] lstrlenW (lpString=".doc") returned 4 [0047.627] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0047.627] lstrlenW (lpString=".docx") returned 5 [0047.627] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0047.627] lstrlenW (lpString=".pdf") returned 4 [0047.627] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0047.627] lstrlenW (lpString=".xls") returned 4 [0047.627] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0047.627] lstrlenW (lpString=".xlsx") returned 5 [0047.627] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0047.627] lstrlenW (lpString=".ppt") returned 4 [0047.627] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0047.627] lstrlenW (lpString="C:\\Boot\\Fonts\\cht_boot.ttf") returned 26 [0047.627] lstrlenW (lpString=".zip") returned 4 [0047.627] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0047.627] lstrlenW (lpString=".rar") returned 4 [0047.627] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0047.627] lstrlenW (lpString=".bz2") returned 4 [0047.627] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0047.627] lstrlenW (lpString=".7z") returned 3 [0047.627] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0047.628] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0048.094] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0048.094] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.094] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1 [0048.094] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.094] ReadFile (in: hFile=0x178, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.116] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.116] ReadFile (in: hFile=0x178, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.169] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.169] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.169] ReadFile (in: hFile=0x178, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.190] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.190] WriteFile (in: hFile=0x178, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0048.364] SetEndOfFile (hFile=0x178) returned 1 [0048.610] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f754b0 [0048.610] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.610] WriteFile (in: hFile=0x178, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.611] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.611] WriteFile (in: hFile=0x178, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.612] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.612] WriteFile (in: hFile=0x178, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.613] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f754b0 | out: hHeap=0x8d0000) returned 1 [0048.613] CloseHandle (hObject=0x178) returned 1 [0050.248] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.248] lstrlenW (lpString=".doc") returned 4 [0050.249] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.249] lstrlenW (lpString=".docx") returned 5 [0050.249] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0050.249] lstrlenW (lpString=".pdf") returned 4 [0050.249] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.249] lstrlenW (lpString=".xls") returned 4 [0050.249] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.249] lstrlenW (lpString=".xlsx") returned 5 [0050.249] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0050.249] lstrlenW (lpString=".ppt") returned 4 [0050.249] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.249] lstrlenW (lpString=".zip") returned 4 [0050.249] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.249] lstrlenW (lpString=".rar") returned 4 [0050.249] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.249] lstrlenW (lpString=".bz2") returned 4 [0050.249] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.249] lstrlenW (lpString=".7z") returned 3 [0050.249] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.249] lstrlenW (lpString=".dbf") returned 4 [0050.249] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.249] lstrlenW (lpString=".1cd") returned 4 [0050.249] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.249] lstrlenW (lpString=".jpg") returned 4 [0050.249] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.362] lstrlenW (lpString=".doc") returned 4 [0050.362] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.362] lstrlenW (lpString=".docx") returned 5 [0050.362] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0050.362] lstrlenW (lpString=".pdf") returned 4 [0050.362] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.362] lstrlenW (lpString=".xls") returned 4 [0050.362] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.362] lstrlenW (lpString=".xlsx") returned 5 [0050.362] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0050.362] lstrlenW (lpString=".ppt") returned 4 [0050.362] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.362] lstrlenW (lpString=".zip") returned 4 [0050.362] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.362] lstrlenW (lpString=".rar") returned 4 [0050.362] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.362] lstrlenW (lpString=".bz2") returned 4 [0050.362] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.362] lstrlenW (lpString=".7z") returned 3 [0050.362] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.362] lstrlenW (lpString=".dbf") returned 4 [0050.362] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.362] lstrlenW (lpString=".1cd") returned 4 [0050.362] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0050.363] lstrlenW (lpString=".jpg") returned 4 [0050.363] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.363] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0050.363] lstrlenW (lpString="OutlkLR.cab") returned 11 [0050.363] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0050.363] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=14819276) returned 1 [0050.363] CloseHandle (hObject=0x1a8) returned 1 [0050.363] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0050.363] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.363] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0050.364] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0050.364] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1 [0050.364] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.364] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.672] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.672] ReadFile (in: hFile=0x1a8, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.691] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.691] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.691] ReadFile (in: hFile=0x1a8, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.737] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.737] WriteFile (in: hFile=0x1a8, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0050.750] SetEndOfFile (hFile=0x1a8) returned 1 [0050.750] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f854b0 [0050.751] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.751] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.751] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.751] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.752] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.752] WriteFile (in: hFile=0x1a8, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.754] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b0 | out: hHeap=0x8d0000) returned 1 [0050.754] CloseHandle (hObject=0x1a8) returned 1 [0053.456] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0053.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.457] lstrlenW (lpString=".doc") returned 4 [0053.457] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.457] lstrlenW (lpString=".docx") returned 5 [0053.457] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.457] lstrlenW (lpString=".pdf") returned 4 [0053.457] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.457] lstrlenW (lpString=".xls") returned 4 [0053.457] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.457] lstrlenW (lpString=".xlsx") returned 5 [0053.457] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.457] lstrlenW (lpString=".ppt") returned 4 [0053.457] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.457] lstrlenW (lpString=".zip") returned 4 [0053.457] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.457] lstrlenW (lpString=".rar") returned 4 [0053.457] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.457] lstrlenW (lpString=".bz2") returned 4 [0053.457] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.457] lstrlenW (lpString=".7z") returned 3 [0053.457] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.457] lstrlenW (lpString=".dbf") returned 4 [0053.457] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.457] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.457] lstrlenW (lpString=".1cd") returned 4 [0053.458] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.458] lstrlenW (lpString=".jpg") returned 4 [0053.458] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.458] lstrlenW (lpString=".doc") returned 4 [0053.458] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.458] lstrlenW (lpString=".docx") returned 5 [0053.458] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.458] lstrlenW (lpString=".pdf") returned 4 [0053.458] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.458] lstrlenW (lpString=".xls") returned 4 [0053.458] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.458] lstrlenW (lpString=".xlsx") returned 5 [0053.458] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.458] lstrlenW (lpString=".ppt") returned 4 [0053.458] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.458] lstrlenW (lpString=".zip") returned 4 [0053.458] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.458] lstrlenW (lpString=".rar") returned 4 [0053.458] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.458] lstrlenW (lpString=".bz2") returned 4 [0053.458] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.458] lstrlenW (lpString=".7z") returned 3 [0053.458] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.458] lstrlenW (lpString=".dbf") returned 4 [0053.458] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.458] lstrlenW (lpString=".1cd") returned 4 [0053.458] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0053.459] lstrlenW (lpString=".jpg") returned 4 [0053.459] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.459] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0053.459] lstrlenW (lpString="Proof.msi") returned 9 [0053.459] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0053.459] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=875520) returned 1 [0053.459] CloseHandle (hObject=0x1a8) returned 1 [0053.459] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0053.459] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.459] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0053.460] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.460] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.460] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0053.460] GetLastError () returned 0x0 [0053.460] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0053.481] WriteFile (in: hFile=0x1dc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0053.496] ReadFile (in: hFile=0x1a8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0053.496] WriteFile (in: hFile=0x1dc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.496] SetEndOfFile (hFile=0x1dc) returned 1 [0053.496] CloseHandle (hObject=0x1dc) returned 1 [0053.880] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.880] SetEndOfFile (hFile=0x1a8) returned 1 [0053.888] CloseHandle (hObject=0x1a8) returned 1 [0053.888] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0053.888] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0053.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.888] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.888] lstrlenW (lpString=".doc") returned 4 [0053.888] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.888] lstrlenW (lpString=".docx") returned 5 [0053.888] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0053.888] lstrlenW (lpString=".pdf") returned 4 [0053.888] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.888] lstrlenW (lpString=".xls") returned 4 [0053.888] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.889] lstrlenW (lpString=".xlsx") returned 5 [0053.889] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0053.889] lstrlenW (lpString=".ppt") returned 4 [0053.889] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.889] lstrlenW (lpString=".zip") returned 4 [0053.889] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.889] lstrlenW (lpString=".rar") returned 4 [0053.889] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.889] lstrlenW (lpString=".bz2") returned 4 [0053.889] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.889] lstrlenW (lpString=".7z") returned 3 [0053.889] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.889] lstrlenW (lpString=".dbf") returned 4 [0053.889] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.889] lstrlenW (lpString=".1cd") returned 4 [0053.889] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.889] lstrlenW (lpString=".jpg") returned 4 [0053.889] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.889] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.889] lstrlenW (lpString=".doc") returned 4 [0053.889] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0053.889] lstrlenW (lpString=".docx") returned 5 [0053.889] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0053.889] lstrlenW (lpString=".pdf") returned 4 [0053.889] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0053.889] lstrlenW (lpString=".xls") returned 4 [0053.890] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0053.890] lstrlenW (lpString=".xlsx") returned 5 [0053.890] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0053.890] lstrlenW (lpString=".ppt") returned 4 [0053.890] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0053.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.890] lstrlenW (lpString=".zip") returned 4 [0053.890] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0053.890] lstrlenW (lpString=".rar") returned 4 [0053.890] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0053.890] lstrlenW (lpString=".bz2") returned 4 [0053.890] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0053.890] lstrlenW (lpString=".7z") returned 3 [0053.890] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0053.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.890] lstrlenW (lpString=".dbf") returned 4 [0053.890] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0053.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.890] lstrlenW (lpString=".1cd") returned 4 [0053.890] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0053.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0053.890] lstrlenW (lpString=".jpg") returned 4 [0053.890] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0053.890] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0053.891] lstrlenW (lpString="Proof.cab") returned 9 [0053.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0054.140] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=13642474) returned 1 [0054.140] CloseHandle (hObject=0x1fc) returned 1 [0054.140] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0054.140] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.140] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0054.464] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0054.464] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1 [0054.464] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.464] ReadFile (in: hFile=0x1f0, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.469] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.469] ReadFile (in: hFile=0x1f0, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.473] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.473] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0054.473] ReadFile (in: hFile=0x1f0, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.491] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.491] WriteFile (in: hFile=0x1f0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0054.778] SetEndOfFile (hFile=0x1f0) returned 1 [0054.778] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f13470 [0055.065] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.066] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.067] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.067] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.067] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.067] WriteFile (in: hFile=0x1f0, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.069] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0055.069] CloseHandle (hObject=0x1f0) returned 1 [0057.392] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.393] lstrlenW (lpString=".doc") returned 4 [0057.393] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0057.393] lstrlenW (lpString=".docx") returned 5 [0057.393] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0057.393] lstrlenW (lpString=".pdf") returned 4 [0057.393] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0057.393] lstrlenW (lpString=".xls") returned 4 [0057.393] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0057.393] lstrlenW (lpString=".xlsx") returned 5 [0057.393] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0057.393] lstrlenW (lpString=".ppt") returned 4 [0057.393] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0057.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.393] lstrlenW (lpString=".zip") returned 4 [0057.393] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0057.393] lstrlenW (lpString=".rar") returned 4 [0057.393] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0057.393] lstrlenW (lpString=".bz2") returned 4 [0057.393] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0057.393] lstrlenW (lpString=".7z") returned 3 [0057.393] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0057.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.393] lstrlenW (lpString=".dbf") returned 4 [0057.393] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0057.393] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.393] lstrlenW (lpString=".1cd") returned 4 [0057.393] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0057.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.394] lstrlenW (lpString=".jpg") returned 4 [0057.394] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0057.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.394] lstrlenW (lpString=".doc") returned 4 [0057.394] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0057.394] lstrlenW (lpString=".docx") returned 5 [0057.394] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0057.394] lstrlenW (lpString=".pdf") returned 4 [0057.394] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0057.394] lstrlenW (lpString=".xls") returned 4 [0057.394] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0057.394] lstrlenW (lpString=".xlsx") returned 5 [0057.394] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0057.394] lstrlenW (lpString=".ppt") returned 4 [0057.394] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0057.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.394] lstrlenW (lpString=".zip") returned 4 [0057.394] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0057.394] lstrlenW (lpString=".rar") returned 4 [0057.394] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0057.394] lstrlenW (lpString=".bz2") returned 4 [0057.394] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0057.394] lstrlenW (lpString=".7z") returned 3 [0057.394] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0057.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.394] lstrlenW (lpString=".dbf") returned 4 [0057.394] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0057.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.394] lstrlenW (lpString=".1cd") returned 4 [0057.394] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0057.394] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0057.395] lstrlenW (lpString=".jpg") returned 4 [0057.395] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0057.395] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0057.395] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0057.395] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.395] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2507776) returned 1 [0057.395] CloseHandle (hObject=0x1f0) returned 1 [0057.395] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0057.395] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.395] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0057.396] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.396] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1 [0057.396] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.396] ReadFile (in: hFile=0x1f0, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.448] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.448] ReadFile (in: hFile=0x1f0, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.457] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.458] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.458] ReadFile (in: hFile=0x1f0, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.474] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.474] WriteFile (in: hFile=0x1f0, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0057.732] SetEndOfFile (hFile=0x1f0) returned 1 [0057.732] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x400b508 [0057.736] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.737] WriteFile (in: hFile=0x1f0, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.738] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.738] WriteFile (in: hFile=0x1f0, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.744] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0057.744] WriteFile (in: hFile=0x1f0, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.747] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0057.747] CloseHandle (hObject=0x1f0) returned 1 [0057.747] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.748] lstrlenW (lpString=".doc") returned 4 [0057.748] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0057.748] lstrlenW (lpString=".docx") returned 5 [0057.748] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0057.748] lstrlenW (lpString=".pdf") returned 4 [0057.748] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0057.748] lstrlenW (lpString=".xls") returned 4 [0057.748] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0057.748] lstrlenW (lpString=".xlsx") returned 5 [0057.748] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0057.748] lstrlenW (lpString=".ppt") returned 4 [0057.748] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0057.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.748] lstrlenW (lpString=".zip") returned 4 [0057.748] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0057.748] lstrlenW (lpString=".rar") returned 4 [0057.748] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0057.748] lstrlenW (lpString=".bz2") returned 4 [0057.748] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0057.748] lstrlenW (lpString=".7z") returned 3 [0057.748] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0057.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.748] lstrlenW (lpString=".dbf") returned 4 [0057.748] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0057.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.748] lstrlenW (lpString=".1cd") returned 4 [0057.748] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0057.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.749] lstrlenW (lpString=".jpg") returned 4 [0057.749] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0057.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.749] lstrlenW (lpString=".doc") returned 4 [0057.749] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0057.749] lstrlenW (lpString=".docx") returned 5 [0057.749] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0057.749] lstrlenW (lpString=".pdf") returned 4 [0057.749] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0057.749] lstrlenW (lpString=".xls") returned 4 [0057.749] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0057.749] lstrlenW (lpString=".xlsx") returned 5 [0057.749] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0057.749] lstrlenW (lpString=".ppt") returned 4 [0057.749] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0057.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.749] lstrlenW (lpString=".zip") returned 4 [0057.749] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0057.749] lstrlenW (lpString=".rar") returned 4 [0057.749] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0057.749] lstrlenW (lpString=".bz2") returned 4 [0057.749] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0057.749] lstrlenW (lpString=".7z") returned 3 [0057.749] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0057.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.749] lstrlenW (lpString=".dbf") returned 4 [0057.749] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0057.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.749] lstrlenW (lpString=".1cd") returned 4 [0057.750] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0057.750] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0057.750] lstrlenW (lpString=".jpg") returned 4 [0057.750] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0057.750] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0057.750] lstrlenW (lpString="DW20.EXE") returned 8 [0057.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.807] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=838536) returned 1 [0057.807] CloseHandle (hObject=0x1ec) returned 1 [0057.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0057.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.807] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.807] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0057.808] GetLastError () returned 0x0 [0057.808] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xccb88, lpOverlapped=0x0) returned 1 [0057.949] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0057.963] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0057.963] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0057.963] SetEndOfFile (hFile=0x210) returned 1 [0057.964] CloseHandle (hObject=0x210) returned 1 [0057.964] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.964] SetEndOfFile (hFile=0x1ec) returned 1 [0057.971] CloseHandle (hObject=0x1ec) returned 1 [0057.971] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.971] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0057.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.971] lstrlenW (lpString=".doc") returned 4 [0057.971] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0057.972] lstrlenW (lpString=".docx") returned 5 [0057.972] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0057.972] lstrlenW (lpString=".pdf") returned 4 [0057.972] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0057.972] lstrlenW (lpString=".xls") returned 4 [0057.972] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0057.972] lstrlenW (lpString=".xlsx") returned 5 [0057.972] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0057.972] lstrlenW (lpString=".ppt") returned 4 [0057.972] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.972] lstrlenW (lpString=".zip") returned 4 [0057.972] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0057.972] lstrlenW (lpString=".rar") returned 4 [0057.972] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0057.972] lstrlenW (lpString=".bz2") returned 4 [0057.972] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0057.972] lstrlenW (lpString=".7z") returned 3 [0057.972] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.972] lstrlenW (lpString=".dbf") returned 4 [0057.972] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.972] lstrlenW (lpString=".1cd") returned 4 [0057.972] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.972] lstrlenW (lpString=".jpg") returned 4 [0057.972] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.972] lstrlenW (lpString=".doc") returned 4 [0057.972] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0057.972] lstrlenW (lpString=".docx") returned 5 [0057.973] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0057.973] lstrlenW (lpString=".pdf") returned 4 [0057.973] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0057.973] lstrlenW (lpString=".xls") returned 4 [0057.973] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0057.973] lstrlenW (lpString=".xlsx") returned 5 [0057.973] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0057.973] lstrlenW (lpString=".ppt") returned 4 [0057.973] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0057.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.973] lstrlenW (lpString=".zip") returned 4 [0057.973] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0057.973] lstrlenW (lpString=".rar") returned 4 [0057.973] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0057.973] lstrlenW (lpString=".bz2") returned 4 [0057.973] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0057.973] lstrlenW (lpString=".7z") returned 3 [0057.973] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0057.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.973] lstrlenW (lpString=".dbf") returned 4 [0057.973] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0057.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.973] lstrlenW (lpString=".1cd") returned 4 [0057.973] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0057.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0057.973] lstrlenW (lpString=".jpg") returned 4 [0057.973] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0057.973] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0057.973] lstrlenW (lpString="dwtrig20.exe") returned 12 [0057.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.974] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=519584) returned 1 [0057.974] CloseHandle (hObject=0x1ec) returned 1 [0057.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0057.974] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0057.974] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.974] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.414] GetLastError () returned 0x0 [0058.414] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0058.425] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0058.433] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.434] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.434] SetEndOfFile (hFile=0x180) returned 1 [0058.434] CloseHandle (hObject=0x180) returned 1 [0058.434] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.434] SetEndOfFile (hFile=0x1ec) returned 1 [0058.438] CloseHandle (hObject=0x1ec) returned 1 [0058.438] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.438] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0058.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.439] lstrlenW (lpString=".doc") returned 4 [0058.439] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.439] lstrlenW (lpString=".docx") returned 5 [0058.439] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0058.439] lstrlenW (lpString=".pdf") returned 4 [0058.439] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.439] lstrlenW (lpString=".xls") returned 4 [0058.439] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.439] lstrlenW (lpString=".xlsx") returned 5 [0058.439] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0058.439] lstrlenW (lpString=".ppt") returned 4 [0058.439] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0058.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.439] lstrlenW (lpString=".zip") returned 4 [0058.439] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0058.439] lstrlenW (lpString=".rar") returned 4 [0058.439] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0058.439] lstrlenW (lpString=".bz2") returned 4 [0058.439] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0058.439] lstrlenW (lpString=".7z") returned 3 [0058.439] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0058.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.439] lstrlenW (lpString=".dbf") returned 4 [0058.439] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0058.439] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.440] lstrlenW (lpString=".1cd") returned 4 [0058.440] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0058.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.440] lstrlenW (lpString=".jpg") returned 4 [0058.440] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0058.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.440] lstrlenW (lpString=".doc") returned 4 [0058.440] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0058.440] lstrlenW (lpString=".docx") returned 5 [0058.440] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0058.440] lstrlenW (lpString=".pdf") returned 4 [0058.440] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0058.440] lstrlenW (lpString=".xls") returned 4 [0058.440] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0058.440] lstrlenW (lpString=".xlsx") returned 5 [0058.440] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0058.440] lstrlenW (lpString=".ppt") returned 4 [0058.440] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0058.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.440] lstrlenW (lpString=".zip") returned 4 [0058.440] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0058.440] lstrlenW (lpString=".rar") returned 4 [0058.440] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0058.440] lstrlenW (lpString=".bz2") returned 4 [0058.440] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0058.440] lstrlenW (lpString=".7z") returned 3 [0058.440] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0058.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.440] lstrlenW (lpString=".dbf") returned 4 [0058.440] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0058.440] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.440] lstrlenW (lpString=".1cd") returned 4 [0058.441] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0058.441] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0058.441] lstrlenW (lpString=".jpg") returned 4 [0058.441] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0058.441] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0058.441] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0058.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.441] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=868864) returned 1 [0058.441] CloseHandle (hObject=0x1ec) returned 1 [0058.441] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0058.441] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.441] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.442] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.442] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.442] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.442] GetLastError () returned 0x0 [0058.442] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xd4200, lpOverlapped=0x0) returned 1 [0058.459] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0058.475] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.475] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0058.475] SetEndOfFile (hFile=0x180) returned 1 [0058.475] CloseHandle (hObject=0x180) returned 1 [0058.475] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.475] SetEndOfFile (hFile=0x1ec) returned 1 [0058.483] CloseHandle (hObject=0x1ec) returned 1 [0058.483] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.483] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0058.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.483] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.483] lstrlenW (lpString=".doc") returned 4 [0058.483] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.483] lstrlenW (lpString=".docx") returned 5 [0058.483] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0058.483] lstrlenW (lpString=".pdf") returned 4 [0058.483] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.483] lstrlenW (lpString=".xls") returned 4 [0058.483] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.483] lstrlenW (lpString=".xlsx") returned 5 [0058.484] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0058.484] lstrlenW (lpString=".ppt") returned 4 [0058.484] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.484] lstrlenW (lpString=".zip") returned 4 [0058.484] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.484] lstrlenW (lpString=".rar") returned 4 [0058.484] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.484] lstrlenW (lpString=".bz2") returned 4 [0058.484] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.484] lstrlenW (lpString=".7z") returned 3 [0058.484] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.484] lstrlenW (lpString=".dbf") returned 4 [0058.484] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.484] lstrlenW (lpString=".1cd") returned 4 [0058.484] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.484] lstrlenW (lpString=".jpg") returned 4 [0058.484] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.484] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.484] lstrlenW (lpString=".doc") returned 4 [0058.484] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.484] lstrlenW (lpString=".docx") returned 5 [0058.484] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0058.484] lstrlenW (lpString=".pdf") returned 4 [0058.484] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.484] lstrlenW (lpString=".xls") returned 4 [0058.484] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.484] lstrlenW (lpString=".xlsx") returned 5 [0058.484] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0058.485] lstrlenW (lpString=".ppt") returned 4 [0058.485] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.485] lstrlenW (lpString=".zip") returned 4 [0058.485] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.485] lstrlenW (lpString=".rar") returned 4 [0058.485] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.485] lstrlenW (lpString=".bz2") returned 4 [0058.485] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.485] lstrlenW (lpString=".7z") returned 3 [0058.485] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.485] lstrlenW (lpString=".dbf") returned 4 [0058.485] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.485] lstrlenW (lpString=".1cd") returned 4 [0058.485] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0058.485] lstrlenW (lpString=".jpg") returned 4 [0058.485] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.485] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0058.485] lstrlenW (lpString="osetupui.dll") returned 12 [0058.485] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.486] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=191872) returned 1 [0058.486] CloseHandle (hObject=0x1ec) returned 1 [0058.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0058.486] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.486] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.486] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.486] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.487] GetLastError () returned 0x0 [0058.487] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0058.491] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0058.496] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.496] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.496] SetEndOfFile (hFile=0x180) returned 1 [0058.496] CloseHandle (hObject=0x180) returned 1 [0058.496] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.496] SetEndOfFile (hFile=0x1ec) returned 1 [0058.498] CloseHandle (hObject=0x1ec) returned 1 [0058.498] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.498] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0058.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.498] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.498] lstrlenW (lpString=".doc") returned 4 [0058.498] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.498] lstrlenW (lpString=".docx") returned 5 [0058.499] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0058.499] lstrlenW (lpString=".pdf") returned 4 [0058.499] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.499] lstrlenW (lpString=".xls") returned 4 [0058.499] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.499] lstrlenW (lpString=".xlsx") returned 5 [0058.499] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0058.499] lstrlenW (lpString=".ppt") returned 4 [0058.499] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.499] lstrlenW (lpString=".zip") returned 4 [0058.499] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.499] lstrlenW (lpString=".rar") returned 4 [0058.499] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.499] lstrlenW (lpString=".bz2") returned 4 [0058.499] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.499] lstrlenW (lpString=".7z") returned 3 [0058.499] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.499] lstrlenW (lpString=".dbf") returned 4 [0058.499] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.499] lstrlenW (lpString=".1cd") returned 4 [0058.499] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.499] lstrlenW (lpString=".jpg") returned 4 [0058.499] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.499] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.499] lstrlenW (lpString=".doc") returned 4 [0058.499] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.499] lstrlenW (lpString=".docx") returned 5 [0058.500] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0058.500] lstrlenW (lpString=".pdf") returned 4 [0058.500] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.500] lstrlenW (lpString=".xls") returned 4 [0058.500] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.500] lstrlenW (lpString=".xlsx") returned 5 [0058.500] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0058.500] lstrlenW (lpString=".ppt") returned 4 [0058.500] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.500] lstrlenW (lpString=".zip") returned 4 [0058.500] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.500] lstrlenW (lpString=".rar") returned 4 [0058.500] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.500] lstrlenW (lpString=".bz2") returned 4 [0058.500] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.500] lstrlenW (lpString=".7z") returned 3 [0058.500] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.500] lstrlenW (lpString=".dbf") returned 4 [0058.500] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.500] lstrlenW (lpString=".1cd") returned 4 [0058.500] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.500] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0058.500] lstrlenW (lpString=".jpg") returned 4 [0058.500] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.500] lstrcmpiW (lpString1=".MST", lpString2=".wiki") returned -1 [0058.500] lstrlenW (lpString="ShellUI.MST") returned 11 [0058.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.501] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3584) returned 1 [0058.501] CloseHandle (hObject=0x1ec) returned 1 [0058.501] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0058.501] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.501] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.501] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.501] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.502] GetLastError () returned 0x0 [0058.502] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xe00, lpOverlapped=0x0) returned 1 [0058.504] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe10, lpOverlapped=0x0) returned 1 [0058.504] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.504] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.505] SetEndOfFile (hFile=0x180) returned 1 [0058.505] CloseHandle (hObject=0x180) returned 1 [0058.505] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.505] SetEndOfFile (hFile=0x1ec) returned 1 [0058.506] CloseHandle (hObject=0x1ec) returned 1 [0058.506] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.506] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0058.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.506] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.506] lstrlenW (lpString=".doc") returned 4 [0058.506] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0058.506] lstrlenW (lpString=".docx") returned 5 [0058.506] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0058.506] lstrlenW (lpString=".pdf") returned 4 [0058.506] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0058.506] lstrlenW (lpString=".xls") returned 4 [0058.506] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0058.506] lstrlenW (lpString=".xlsx") returned 5 [0058.506] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0058.506] lstrlenW (lpString=".ppt") returned 4 [0058.506] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0058.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.507] lstrlenW (lpString=".zip") returned 4 [0058.507] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0058.507] lstrlenW (lpString=".rar") returned 4 [0058.507] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0058.507] lstrlenW (lpString=".bz2") returned 4 [0058.507] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0058.507] lstrlenW (lpString=".7z") returned 3 [0058.507] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0058.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.507] lstrlenW (lpString=".dbf") returned 4 [0058.507] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0058.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.507] lstrlenW (lpString=".1cd") returned 4 [0058.507] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0058.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.507] lstrlenW (lpString=".jpg") returned 4 [0058.507] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0058.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.507] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.507] lstrlenW (lpString=".doc") returned 4 [0058.507] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0058.507] lstrlenW (lpString=".docx") returned 5 [0058.507] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0058.507] lstrlenW (lpString=".pdf") returned 4 [0058.507] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0058.507] lstrlenW (lpString=".xls") returned 4 [0058.507] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0058.507] lstrlenW (lpString=".xlsx") returned 5 [0058.507] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0058.555] lstrlenW (lpString=".ppt") returned 4 [0058.555] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0058.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.555] lstrlenW (lpString=".zip") returned 4 [0058.555] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0058.555] lstrlenW (lpString=".rar") returned 4 [0058.555] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0058.555] lstrlenW (lpString=".bz2") returned 4 [0058.555] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0058.555] lstrlenW (lpString=".7z") returned 3 [0058.555] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0058.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.555] lstrlenW (lpString=".dbf") returned 4 [0058.555] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0058.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.555] lstrlenW (lpString=".1cd") returned 4 [0058.555] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0058.555] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0058.555] lstrlenW (lpString=".jpg") returned 4 [0058.555] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0058.556] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0058.556] lstrlenW (lpString="AccessMUI.msi") returned 13 [0058.556] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.558] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2517504) returned 1 [0058.559] CloseHandle (hObject=0x180) returned 1 [0058.559] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0058.559] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.559] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0058.559] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.559] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1 [0058.560] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.560] ReadFile (in: hFile=0x180, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.564] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.565] ReadFile (in: hFile=0x180, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.574] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.574] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.574] ReadFile (in: hFile=0x180, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.661] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.661] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0058.808] SetEndOfFile (hFile=0x180) returned 1 [0058.809] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x400b508 [0058.809] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.809] WriteFile (in: hFile=0x180, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.810] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.810] WriteFile (in: hFile=0x180, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.816] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.816] WriteFile (in: hFile=0x180, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.819] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0058.819] CloseHandle (hObject=0x180) returned 1 [0058.819] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0058.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0058.819] lstrlenW (lpString=".doc") returned 4 [0059.063] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.063] lstrlenW (lpString=".docx") returned 5 [0059.063] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0059.063] lstrlenW (lpString=".pdf") returned 4 [0059.063] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.063] lstrlenW (lpString=".xls") returned 4 [0059.063] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.063] lstrlenW (lpString=".xlsx") returned 5 [0059.064] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0059.064] lstrlenW (lpString=".ppt") returned 4 [0059.064] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0059.064] lstrlenW (lpString=".zip") returned 4 [0059.064] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.064] lstrlenW (lpString=".rar") returned 4 [0059.064] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.064] lstrlenW (lpString=".bz2") returned 4 [0059.064] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.064] lstrlenW (lpString=".7z") returned 3 [0059.064] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0059.064] lstrlenW (lpString=".dbf") returned 4 [0059.064] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0059.064] lstrlenW (lpString=".1cd") returned 4 [0059.064] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0059.064] lstrlenW (lpString=".jpg") returned 4 [0059.064] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0059.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0059.064] lstrlenW (lpString=".doc") returned 4 [0059.064] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.064] lstrlenW (lpString=".docx") returned 5 [0059.064] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0059.064] lstrlenW (lpString=".pdf") returned 4 [0059.064] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.064] lstrlenW (lpString=".xls") returned 4 [0059.064] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.064] lstrlenW (lpString=".xlsx") returned 5 [0059.064] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0059.065] lstrlenW (lpString=".ppt") returned 4 [0059.065] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0059.065] lstrlenW (lpString=".zip") returned 4 [0059.065] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.065] lstrlenW (lpString=".rar") returned 4 [0059.065] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.065] lstrlenW (lpString=".bz2") returned 4 [0059.065] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.065] lstrlenW (lpString=".7z") returned 3 [0059.065] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0059.065] lstrlenW (lpString=".dbf") returned 4 [0059.065] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0059.065] lstrlenW (lpString=".1cd") returned 4 [0059.065] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.065] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0059.065] lstrlenW (lpString=".jpg") returned 4 [0059.065] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.065] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0059.065] lstrlenW (lpString="ose.exe") returned 7 [0059.065] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0059.066] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=174440) returned 1 [0059.066] CloseHandle (hObject=0x208) returned 1 [0059.066] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0059.066] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0059.066] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.066] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.066] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0059.066] GetLastError () returned 0x0 [0059.066] ReadFile (in: hFile=0x208, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0059.191] WriteFile (in: hFile=0x1e4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0059.194] ReadFile (in: hFile=0x208, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.194] WriteFile (in: hFile=0x1e4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0059.195] SetEndOfFile (hFile=0x1e4) returned 1 [0059.195] CloseHandle (hObject=0x1e4) returned 1 [0059.195] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.195] SetEndOfFile (hFile=0x208) returned 1 [0059.197] CloseHandle (hObject=0x208) returned 1 [0059.197] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0059.197] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0059.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.197] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.197] lstrlenW (lpString=".doc") returned 4 [0059.197] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.197] lstrlenW (lpString=".docx") returned 5 [0059.197] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0059.197] lstrlenW (lpString=".pdf") returned 4 [0059.197] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.197] lstrlenW (lpString=".xls") returned 4 [0059.197] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.197] lstrlenW (lpString=".xlsx") returned 5 [0059.197] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0059.197] lstrlenW (lpString=".ppt") returned 4 [0059.198] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.198] lstrlenW (lpString=".zip") returned 4 [0059.198] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.198] lstrlenW (lpString=".rar") returned 4 [0059.198] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.198] lstrlenW (lpString=".bz2") returned 4 [0059.198] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.198] lstrlenW (lpString=".7z") returned 3 [0059.198] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.198] lstrlenW (lpString=".dbf") returned 4 [0059.198] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.198] lstrlenW (lpString=".1cd") returned 4 [0059.198] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.198] lstrlenW (lpString=".jpg") returned 4 [0059.198] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.198] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.198] lstrlenW (lpString=".doc") returned 4 [0059.198] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0059.198] lstrlenW (lpString=".docx") returned 5 [0059.198] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0059.198] lstrlenW (lpString=".pdf") returned 4 [0059.198] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0059.198] lstrlenW (lpString=".xls") returned 4 [0059.198] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0059.198] lstrlenW (lpString=".xlsx") returned 5 [0059.199] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0059.199] lstrlenW (lpString=".ppt") returned 4 [0059.199] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0059.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.199] lstrlenW (lpString=".zip") returned 4 [0059.199] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0059.199] lstrlenW (lpString=".rar") returned 4 [0059.199] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0059.199] lstrlenW (lpString=".bz2") returned 4 [0059.199] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0059.199] lstrlenW (lpString=".7z") returned 3 [0059.199] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0059.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.199] lstrlenW (lpString=".dbf") returned 4 [0059.199] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0059.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.199] lstrlenW (lpString=".1cd") returned 4 [0059.199] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0059.199] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0059.199] lstrlenW (lpString=".jpg") returned 4 [0059.199] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0059.199] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0059.199] lstrlenW (lpString="PidGenX.dll") returned 11 [0059.199] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0059.200] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1463568) returned 1 [0059.200] CloseHandle (hObject=0x208) returned 1 [0059.200] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0059.200] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0059.200] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.200] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.200] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0059.200] GetLastError () returned 0x0 [0059.200] ReadFile (in: hFile=0x208, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0059.249] WriteFile (in: hFile=0x1e4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0059.611] ReadFile (in: hFile=0x208, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x65520, lpOverlapped=0x0) returned 1 [0059.624] WriteFile (in: hFile=0x1e4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0059.857] ReadFile (in: hFile=0x208, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.857] WriteFile (in: hFile=0x1e4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.857] SetEndOfFile (hFile=0x1e4) returned 1 [0060.028] CloseHandle (hObject=0x1e4) returned 1 [0060.028] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.028] SetEndOfFile (hFile=0x208) returned 1 [0060.032] CloseHandle (hObject=0x208) returned 1 [0060.032] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0060.032] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0060.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.442] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.442] lstrlenW (lpString=".doc") returned 4 [0060.442] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.442] lstrlenW (lpString=".docx") returned 5 [0060.442] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0060.442] lstrlenW (lpString=".pdf") returned 4 [0060.442] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.442] lstrlenW (lpString=".xls") returned 4 [0060.442] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.442] lstrlenW (lpString=".xlsx") returned 5 [0060.442] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0060.443] lstrlenW (lpString=".ppt") returned 4 [0060.443] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.443] lstrlenW (lpString=".zip") returned 4 [0060.443] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.443] lstrlenW (lpString=".rar") returned 4 [0060.443] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.443] lstrlenW (lpString=".bz2") returned 4 [0060.443] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.443] lstrlenW (lpString=".7z") returned 3 [0060.443] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.443] lstrlenW (lpString=".dbf") returned 4 [0060.443] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.443] lstrlenW (lpString=".1cd") returned 4 [0060.443] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.443] lstrlenW (lpString=".jpg") returned 4 [0060.443] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.443] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.443] lstrlenW (lpString=".doc") returned 4 [0060.443] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0060.443] lstrlenW (lpString=".docx") returned 5 [0060.443] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0060.443] lstrlenW (lpString=".pdf") returned 4 [0060.443] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0060.443] lstrlenW (lpString=".xls") returned 4 [0060.443] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0060.443] lstrlenW (lpString=".xlsx") returned 5 [0060.443] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0060.443] lstrlenW (lpString=".ppt") returned 4 [0060.444] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0060.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.444] lstrlenW (lpString=".zip") returned 4 [0060.444] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0060.444] lstrlenW (lpString=".rar") returned 4 [0060.444] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0060.444] lstrlenW (lpString=".bz2") returned 4 [0060.444] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0060.444] lstrlenW (lpString=".7z") returned 3 [0060.444] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0060.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.444] lstrlenW (lpString=".dbf") returned 4 [0060.444] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0060.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.444] lstrlenW (lpString=".1cd") returned 4 [0060.444] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0060.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0060.444] lstrlenW (lpString=".jpg") returned 4 [0060.444] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0060.444] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0060.444] lstrlenW (lpString="Office32WW.msi") returned 14 [0060.444] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.585] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1992192) returned 1 [0060.586] CloseHandle (hObject=0x1fc) returned 1 [0060.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0060.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.586] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0060.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.587] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1 [0060.587] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.587] ReadFile (in: hFile=0x1fc, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.591] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.592] ReadFile (in: hFile=0x1fc, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.595] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.595] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.595] ReadFile (in: hFile=0x1fc, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.614] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.614] WriteFile (in: hFile=0x1fc, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0060.701] SetEndOfFile (hFile=0x1fc) returned 1 [0060.701] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f554a0 [0060.718] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.718] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.719] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.719] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.721] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.721] WriteFile (in: hFile=0x1fc, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.723] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0060.723] CloseHandle (hObject=0x1fc) returned 1 [0060.724] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0060.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.724] lstrlenW (lpString=".doc") returned 4 [0060.724] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.724] lstrlenW (lpString=".docx") returned 5 [0060.724] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0060.724] lstrlenW (lpString=".pdf") returned 4 [0060.724] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.724] lstrlenW (lpString=".xls") returned 4 [0060.724] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.724] lstrlenW (lpString=".xlsx") returned 5 [0060.724] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0060.724] lstrlenW (lpString=".ppt") returned 4 [0060.724] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.724] lstrlenW (lpString=".zip") returned 4 [0060.724] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.724] lstrlenW (lpString=".rar") returned 4 [0060.724] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.724] lstrlenW (lpString=".bz2") returned 4 [0060.724] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.724] lstrlenW (lpString=".7z") returned 3 [0060.724] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.724] lstrlenW (lpString=".dbf") returned 4 [0060.724] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.724] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.725] lstrlenW (lpString=".1cd") returned 4 [0060.725] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.725] lstrlenW (lpString=".jpg") returned 4 [0060.725] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.725] lstrlenW (lpString=".doc") returned 4 [0060.725] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.725] lstrlenW (lpString=".docx") returned 5 [0060.725] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0060.725] lstrlenW (lpString=".pdf") returned 4 [0060.725] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.725] lstrlenW (lpString=".xls") returned 4 [0060.725] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.725] lstrlenW (lpString=".xlsx") returned 5 [0060.725] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0060.725] lstrlenW (lpString=".ppt") returned 4 [0060.725] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.725] lstrlenW (lpString=".zip") returned 4 [0060.725] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.725] lstrlenW (lpString=".rar") returned 4 [0060.725] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.725] lstrlenW (lpString=".bz2") returned 4 [0060.725] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.725] lstrlenW (lpString=".7z") returned 3 [0060.725] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.725] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.725] lstrlenW (lpString=".dbf") returned 4 [0060.725] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.726] lstrlenW (lpString=".1cd") returned 4 [0060.726] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.726] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0060.726] lstrlenW (lpString=".jpg") returned 4 [0060.726] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.726] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0060.726] lstrlenW (lpString="ose.exe") returned 7 [0060.726] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.726] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=174440) returned 1 [0060.726] CloseHandle (hObject=0x1fc) returned 1 [0060.726] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0060.726] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0060.727] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.727] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.727] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0060.727] GetLastError () returned 0x0 [0060.727] ReadFile (in: hFile=0x1fc, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0060.750] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0061.006] ReadFile (in: hFile=0x1fc, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0061.006] WriteFile (in: hFile=0x180, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0061.006] SetEndOfFile (hFile=0x180) returned 1 [0061.006] CloseHandle (hObject=0x180) returned 1 [0061.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.007] SetEndOfFile (hFile=0x1fc) returned 1 [0061.008] CloseHandle (hObject=0x1fc) returned 1 [0061.008] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0061.009] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0061.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.009] lstrlenW (lpString=".doc") returned 4 [0061.009] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0061.009] lstrlenW (lpString=".docx") returned 5 [0061.009] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0061.009] lstrlenW (lpString=".pdf") returned 4 [0061.009] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0061.009] lstrlenW (lpString=".xls") returned 4 [0061.009] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0061.009] lstrlenW (lpString=".xlsx") returned 5 [0061.009] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0061.009] lstrlenW (lpString=".ppt") returned 4 [0061.009] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0061.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.009] lstrlenW (lpString=".zip") returned 4 [0061.009] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0061.009] lstrlenW (lpString=".rar") returned 4 [0061.009] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0061.009] lstrlenW (lpString=".bz2") returned 4 [0061.009] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0061.009] lstrlenW (lpString=".7z") returned 3 [0061.009] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.009] lstrlenW (lpString=".dbf") returned 4 [0061.010] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0061.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.010] lstrlenW (lpString=".1cd") returned 4 [0061.010] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0061.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.010] lstrlenW (lpString=".jpg") returned 4 [0061.010] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0061.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.010] lstrlenW (lpString=".doc") returned 4 [0061.010] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0061.010] lstrlenW (lpString=".docx") returned 5 [0061.010] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0061.010] lstrlenW (lpString=".pdf") returned 4 [0061.010] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0061.010] lstrlenW (lpString=".xls") returned 4 [0061.010] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0061.010] lstrlenW (lpString=".xlsx") returned 5 [0061.010] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0061.010] lstrlenW (lpString=".ppt") returned 4 [0061.010] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0061.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.010] lstrlenW (lpString=".zip") returned 4 [0061.010] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0061.010] lstrlenW (lpString=".rar") returned 4 [0061.010] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0061.010] lstrlenW (lpString=".bz2") returned 4 [0061.010] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0061.010] lstrlenW (lpString=".7z") returned 3 [0061.010] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.010] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.010] lstrlenW (lpString=".dbf") returned 4 [0061.011] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0061.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.011] lstrlenW (lpString=".1cd") returned 4 [0061.011] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0061.011] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0061.011] lstrlenW (lpString=".jpg") returned 4 [0061.011] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0061.011] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0061.011] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0061.011] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0061.201] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=36233052) returned 1 [0061.201] CloseHandle (hObject=0x1e4) returned 1 [0061.201] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0061.201] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.311] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0062.484] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.422] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1 [0063.422] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0063.422] ReadFile (in: hFile=0x208, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.426] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0063.428] ReadFile (in: hFile=0x208, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.433] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.433] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0063.433] ReadFile (in: hFile=0x208, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.449] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.449] WriteFile (in: hFile=0x208, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0063.468] SetEndOfFile (hFile=0x208) returned 1 [0063.468] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x404b528 [0063.630] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.630] WriteFile (in: hFile=0x208, lpBuffer=0x404b528*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x404b528*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.631] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.631] WriteFile (in: hFile=0x208, lpBuffer=0x404b528*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x404b528*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.632] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.632] WriteFile (in: hFile=0x208, lpBuffer=0x404b528*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x404b528*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.634] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x404b528 | out: hHeap=0x8d0000) returned 1 [0063.634] CloseHandle (hObject=0x208) returned 1 [0063.635] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0063.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.636] lstrlenW (lpString=".doc") returned 4 [0063.636] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0063.636] lstrlenW (lpString=".docx") returned 5 [0063.636] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0063.636] lstrlenW (lpString=".pdf") returned 4 [0063.636] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0063.636] lstrlenW (lpString=".xls") returned 4 [0063.636] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0063.636] lstrlenW (lpString=".xlsx") returned 5 [0063.636] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0063.636] lstrlenW (lpString=".ppt") returned 4 [0063.636] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0063.636] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.636] lstrlenW (lpString=".zip") returned 4 [0063.636] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0063.636] lstrlenW (lpString=".rar") returned 4 [0063.636] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0063.636] lstrlenW (lpString=".bz2") returned 4 [0063.636] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0063.636] lstrlenW (lpString=".7z") returned 3 [0063.636] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0063.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.637] lstrlenW (lpString=".dbf") returned 4 [0063.637] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0063.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.637] lstrlenW (lpString=".1cd") returned 4 [0063.637] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0063.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.637] lstrlenW (lpString=".jpg") returned 4 [0063.637] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0063.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.637] lstrlenW (lpString=".doc") returned 4 [0063.637] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0063.637] lstrlenW (lpString=".docx") returned 5 [0063.637] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0063.637] lstrlenW (lpString=".pdf") returned 4 [0063.637] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0063.637] lstrlenW (lpString=".xls") returned 4 [0063.637] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0063.637] lstrlenW (lpString=".xlsx") returned 5 [0063.637] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0063.637] lstrlenW (lpString=".ppt") returned 4 [0063.637] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0063.637] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.637] lstrlenW (lpString=".zip") returned 4 [0063.637] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0063.637] lstrlenW (lpString=".rar") returned 4 [0063.637] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0063.637] lstrlenW (lpString=".bz2") returned 4 [0063.637] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0063.637] lstrlenW (lpString=".7z") returned 3 [0063.637] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0063.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.638] lstrlenW (lpString=".dbf") returned 4 [0063.638] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0063.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.638] lstrlenW (lpString=".1cd") returned 4 [0063.638] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0063.638] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0063.638] lstrlenW (lpString=".jpg") returned 4 [0063.638] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0063.638] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0063.638] lstrlenW (lpString="setup.exe") returned 9 [0063.638] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.639] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1377656) returned 1 [0063.639] CloseHandle (hObject=0x208) returned 1 [0063.639] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0063.639] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.639] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.639] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.639] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0063.639] GetLastError () returned 0x0 [0063.639] ReadFile (in: hFile=0x208, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0063.667] WriteFile (in: hFile=0x204, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0063.819] ReadFile (in: hFile=0x208, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x50588, lpOverlapped=0x0) returned 1 [0063.833] WriteFile (in: hFile=0x204, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x50590, lpOverlapped=0x0) returned 1 [0064.093] ReadFile (in: hFile=0x208, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.093] WriteFile (in: hFile=0x204, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0064.114] SetEndOfFile (hFile=0x204) returned 1 [0064.114] CloseHandle (hObject=0x204) returned 1 [0064.114] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.114] SetEndOfFile (hFile=0x208) returned 1 [0064.125] CloseHandle (hObject=0x208) returned 1 [0064.125] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0064.125] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0064.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.125] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.125] lstrlenW (lpString=".doc") returned 4 [0064.125] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0064.126] lstrlenW (lpString=".docx") returned 5 [0064.126] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0064.126] lstrlenW (lpString=".pdf") returned 4 [0064.126] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0064.126] lstrlenW (lpString=".xls") returned 4 [0064.126] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0064.126] lstrlenW (lpString=".xlsx") returned 5 [0064.126] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0064.126] lstrlenW (lpString=".ppt") returned 4 [0064.126] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0064.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.126] lstrlenW (lpString=".zip") returned 4 [0064.126] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0064.126] lstrlenW (lpString=".rar") returned 4 [0064.126] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0064.126] lstrlenW (lpString=".bz2") returned 4 [0064.126] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0064.126] lstrlenW (lpString=".7z") returned 3 [0064.126] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0064.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.126] lstrlenW (lpString=".dbf") returned 4 [0064.126] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0064.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.126] lstrlenW (lpString=".1cd") returned 4 [0064.126] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0064.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.126] lstrlenW (lpString=".jpg") returned 4 [0064.126] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0064.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.126] lstrlenW (lpString=".doc") returned 4 [0064.126] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0064.126] lstrlenW (lpString=".docx") returned 5 [0064.127] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0064.127] lstrlenW (lpString=".pdf") returned 4 [0064.127] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0064.127] lstrlenW (lpString=".xls") returned 4 [0064.127] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0064.127] lstrlenW (lpString=".xlsx") returned 5 [0064.127] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0064.127] lstrlenW (lpString=".ppt") returned 4 [0064.127] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0064.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.127] lstrlenW (lpString=".zip") returned 4 [0064.127] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0064.127] lstrlenW (lpString=".rar") returned 4 [0064.127] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0064.127] lstrlenW (lpString=".bz2") returned 4 [0064.127] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0064.127] lstrlenW (lpString=".7z") returned 3 [0064.127] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0064.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.127] lstrlenW (lpString=".dbf") returned 4 [0064.127] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0064.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.127] lstrlenW (lpString=".1cd") returned 4 [0064.127] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0064.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.127] lstrlenW (lpString=".jpg") returned 4 [0064.127] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0064.127] lstrcmpiW (lpString1=".xrm-ms", lpString2=".wiki") returned 1 [0064.127] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0064.128] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0064.128] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=715834) returned 1 [0064.128] CloseHandle (hObject=0x208) returned 1 [0064.135] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0064.135] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.135] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0064.135] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.135] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.135] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0064.136] GetLastError () returned 0x0 [0064.136] ReadFile (in: hFile=0x208, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0064.197] WriteFile (in: hFile=0x204, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0064.208] ReadFile (in: hFile=0x208, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.208] WriteFile (in: hFile=0x204, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x104, lpOverlapped=0x0) returned 1 [0064.208] SetEndOfFile (hFile=0x204) returned 1 [0064.209] CloseHandle (hObject=0x204) returned 1 [0064.209] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.209] SetEndOfFile (hFile=0x208) returned 1 [0064.215] CloseHandle (hObject=0x208) returned 1 [0064.215] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0064.215] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0064.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.215] lstrlenW (lpString=".doc") returned 4 [0064.215] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0064.215] lstrlenW (lpString=".docx") returned 5 [0064.215] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0064.215] lstrlenW (lpString=".pdf") returned 4 [0064.215] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0064.215] lstrlenW (lpString=".xls") returned 4 [0064.215] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString=".xlsx") returned 5 [0064.216] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0064.216] lstrlenW (lpString=".ppt") returned 4 [0064.216] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.216] lstrlenW (lpString=".zip") returned 4 [0064.216] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString=".rar") returned 4 [0064.216] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString=".bz2") returned 4 [0064.216] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString=".7z") returned 3 [0064.216] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0064.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.216] lstrlenW (lpString=".dbf") returned 4 [0064.216] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.216] lstrlenW (lpString=".1cd") returned 4 [0064.216] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.216] lstrlenW (lpString=".jpg") returned 4 [0064.216] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.216] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.216] lstrlenW (lpString=".doc") returned 4 [0064.216] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString=".docx") returned 5 [0064.216] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0064.216] lstrlenW (lpString=".pdf") returned 4 [0064.216] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString=".xls") returned 4 [0064.216] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0064.216] lstrlenW (lpString=".xlsx") returned 5 [0064.217] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0064.217] lstrlenW (lpString=".ppt") returned 4 [0064.217] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0064.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.217] lstrlenW (lpString=".zip") returned 4 [0064.217] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0064.217] lstrlenW (lpString=".rar") returned 4 [0064.217] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0064.217] lstrlenW (lpString=".bz2") returned 4 [0064.217] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0064.217] lstrlenW (lpString=".7z") returned 3 [0064.217] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0064.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.217] lstrlenW (lpString=".dbf") returned 4 [0064.217] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0064.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.217] lstrlenW (lpString=".1cd") returned 4 [0064.217] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0064.217] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0064.217] lstrlenW (lpString=".jpg") returned 4 [0064.413] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0064.413] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0064.413] lstrlenW (lpString="VisiorWW.cab") returned 12 [0064.413] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.852] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=195011319) returned 1 [0064.852] CloseHandle (hObject=0x198) returned 1 [0064.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0064.852] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.852] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0064.853] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0064.853] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0x0) returned 1 [0064.853] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0064.853] ReadFile (in: hFile=0x198, lpBuffer=0x3850058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3850058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.861] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0064.861] ReadFile (in: hFile=0x198, lpBuffer=0x3890058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x3890058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.864] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2ddfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.865] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc2c | out: lpNewFilePointer=0x0) returned 1 [0064.865] ReadFile (in: hFile=0x198, lpBuffer=0x38d0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2ddfc38, lpOverlapped=0x0 | out: lpBuffer=0x38d0058*, lpNumberOfBytesRead=0x2ddfc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.880] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.880] WriteFile (in: hFile=0x198, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2ddfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0064.996] SetEndOfFile (hFile=0x198) returned 1 [0064.996] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f554a0 [0064.996] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0064.996] WriteFile (in: hFile=0x198, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.997] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0064.997] WriteFile (in: hFile=0x198, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.999] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfc7c | out: lpNewFilePointer=0x0) returned 1 [0064.999] WriteFile (in: hFile=0x198, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2ddfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x2ddfc88*=0x40000, lpOverlapped=0x0) returned 1 [0065.001] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0065.001] CloseHandle (hObject=0x198) returned 1 [0065.001] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0065.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.001] lstrlenW (lpString=".doc") returned 4 [0065.001] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0065.001] lstrlenW (lpString=".docx") returned 5 [0065.001] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0065.001] lstrlenW (lpString=".pdf") returned 4 [0065.002] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0065.002] lstrlenW (lpString=".xls") returned 4 [0065.002] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0065.002] lstrlenW (lpString=".xlsx") returned 5 [0065.002] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0065.002] lstrlenW (lpString=".ppt") returned 4 [0065.002] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0065.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.002] lstrlenW (lpString=".zip") returned 4 [0065.002] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0065.002] lstrlenW (lpString=".rar") returned 4 [0065.002] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0065.002] lstrlenW (lpString=".bz2") returned 4 [0065.002] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0065.002] lstrlenW (lpString=".7z") returned 3 [0065.002] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0065.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.002] lstrlenW (lpString=".dbf") returned 4 [0065.002] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0065.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.002] lstrlenW (lpString=".1cd") returned 4 [0065.002] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0065.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.002] lstrlenW (lpString=".jpg") returned 4 [0065.002] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0065.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.002] lstrlenW (lpString=".doc") returned 4 [0065.002] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0065.002] lstrlenW (lpString=".docx") returned 5 [0065.003] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0065.003] lstrlenW (lpString=".pdf") returned 4 [0065.003] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0065.003] lstrlenW (lpString=".xls") returned 4 [0065.003] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0065.003] lstrlenW (lpString=".xlsx") returned 5 [0065.003] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0065.003] lstrlenW (lpString=".ppt") returned 4 [0065.003] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0065.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.003] lstrlenW (lpString=".zip") returned 4 [0065.003] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0065.003] lstrlenW (lpString=".rar") returned 4 [0065.003] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0065.003] lstrlenW (lpString=".bz2") returned 4 [0065.003] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0065.003] lstrlenW (lpString=".7z") returned 3 [0065.003] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0065.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.003] lstrlenW (lpString=".dbf") returned 4 [0065.003] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0065.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.003] lstrlenW (lpString=".1cd") returned 4 [0065.003] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0065.003] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0065.003] lstrlenW (lpString=".jpg") returned 4 [0065.003] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0065.004] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0065.004] lstrlenW (lpString="EEINTL.DLL") returned 10 [0065.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.004] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=64096) returned 1 [0065.004] CloseHandle (hObject=0x198) returned 1 [0065.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0065.005] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.005] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.005] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.005] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0065.045] GetLastError () returned 0x0 [0065.045] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xfa60, lpOverlapped=0x0) returned 1 [0065.047] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0065.049] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.049] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0065.049] SetEndOfFile (hFile=0x174) returned 1 [0065.049] CloseHandle (hObject=0x174) returned 1 [0065.049] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.049] SetEndOfFile (hFile=0x198) returned 1 [0065.050] CloseHandle (hObject=0x198) returned 1 [0065.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.051] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0065.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.051] lstrlenW (lpString=".doc") returned 4 [0065.051] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.051] lstrlenW (lpString=".docx") returned 5 [0065.051] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0065.051] lstrlenW (lpString=".pdf") returned 4 [0065.051] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.051] lstrlenW (lpString=".xls") returned 4 [0065.051] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.051] lstrlenW (lpString=".xlsx") returned 5 [0065.051] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0065.051] lstrlenW (lpString=".ppt") returned 4 [0065.051] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.051] lstrlenW (lpString=".zip") returned 4 [0065.051] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.051] lstrlenW (lpString=".rar") returned 4 [0065.051] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.052] lstrlenW (lpString=".bz2") returned 4 [0065.052] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.052] lstrlenW (lpString=".7z") returned 3 [0065.052] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.052] lstrlenW (lpString=".dbf") returned 4 [0065.052] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.052] lstrlenW (lpString=".1cd") returned 4 [0065.052] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.052] lstrlenW (lpString=".jpg") returned 4 [0065.052] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.052] lstrlenW (lpString=".doc") returned 4 [0065.052] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.052] lstrlenW (lpString=".docx") returned 5 [0065.052] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0065.052] lstrlenW (lpString=".pdf") returned 4 [0065.052] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.052] lstrlenW (lpString=".xls") returned 4 [0065.052] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.052] lstrlenW (lpString=".xlsx") returned 5 [0065.052] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0065.052] lstrlenW (lpString=".ppt") returned 4 [0065.052] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.052] lstrlenW (lpString=".zip") returned 4 [0065.052] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.052] lstrlenW (lpString=".rar") returned 4 [0065.053] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.053] lstrlenW (lpString=".bz2") returned 4 [0065.053] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.053] lstrlenW (lpString=".7z") returned 3 [0065.053] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.053] lstrlenW (lpString=".dbf") returned 4 [0065.053] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.053] lstrlenW (lpString=".1cd") returned 4 [0065.053] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0065.053] lstrlenW (lpString=".jpg") returned 4 [0065.053] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.053] lstrcmpiW (lpString1=".CNT", lpString2=".wiki") returned -1 [0065.053] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0065.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.054] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2557) returned 1 [0065.054] CloseHandle (hObject=0x198) returned 1 [0065.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0065.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.055] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.055] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0065.056] GetLastError () returned 0x0 [0065.056] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x9fd, lpOverlapped=0x0) returned 1 [0065.057] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xa00, lpOverlapped=0x0) returned 1 [0065.058] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.058] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.058] SetEndOfFile (hFile=0x174) returned 1 [0065.058] CloseHandle (hObject=0x174) returned 1 [0065.058] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.058] SetEndOfFile (hFile=0x198) returned 1 [0065.059] CloseHandle (hObject=0x198) returned 1 [0065.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.059] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0065.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.060] lstrlenW (lpString=".doc") returned 4 [0065.060] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0065.060] lstrlenW (lpString=".docx") returned 5 [0065.060] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0065.060] lstrlenW (lpString=".pdf") returned 4 [0065.060] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0065.060] lstrlenW (lpString=".xls") returned 4 [0065.060] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0065.060] lstrlenW (lpString=".xlsx") returned 5 [0065.060] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0065.060] lstrlenW (lpString=".ppt") returned 4 [0065.060] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0065.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.060] lstrlenW (lpString=".zip") returned 4 [0065.060] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0065.060] lstrlenW (lpString=".rar") returned 4 [0065.060] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0065.060] lstrlenW (lpString=".bz2") returned 4 [0065.061] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0065.061] lstrlenW (lpString=".7z") returned 3 [0065.061] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0065.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.061] lstrlenW (lpString=".dbf") returned 4 [0065.061] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0065.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.061] lstrlenW (lpString=".1cd") returned 4 [0065.061] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0065.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.061] lstrlenW (lpString=".jpg") returned 4 [0065.061] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0065.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.061] lstrlenW (lpString=".doc") returned 4 [0065.061] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0065.061] lstrlenW (lpString=".docx") returned 5 [0065.061] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0065.061] lstrlenW (lpString=".pdf") returned 4 [0065.061] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0065.061] lstrlenW (lpString=".xls") returned 4 [0065.061] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0065.061] lstrlenW (lpString=".xlsx") returned 5 [0065.061] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0065.061] lstrlenW (lpString=".ppt") returned 4 [0065.061] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0065.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.061] lstrlenW (lpString=".zip") returned 4 [0065.061] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0065.061] lstrlenW (lpString=".rar") returned 4 [0065.062] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0065.062] lstrlenW (lpString=".bz2") returned 4 [0065.062] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0065.062] lstrlenW (lpString=".7z") returned 3 [0065.062] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0065.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.062] lstrlenW (lpString=".dbf") returned 4 [0065.062] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0065.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.062] lstrlenW (lpString=".1cd") returned 4 [0065.062] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0065.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0065.062] lstrlenW (lpString=".jpg") returned 4 [0065.062] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0065.062] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0065.062] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0065.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.063] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=543304) returned 1 [0065.063] CloseHandle (hObject=0x198) returned 1 [0065.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0065.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.063] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.063] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.063] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0065.064] GetLastError () returned 0x0 [0065.064] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x84a48, lpOverlapped=0x0) returned 1 [0065.075] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0065.087] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.087] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.087] SetEndOfFile (hFile=0x174) returned 1 [0065.087] CloseHandle (hObject=0x174) returned 1 [0065.088] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.088] SetEndOfFile (hFile=0x198) returned 1 [0065.094] CloseHandle (hObject=0x198) returned 1 [0065.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.095] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0065.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.095] lstrlenW (lpString=".doc") returned 4 [0065.095] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0065.095] lstrlenW (lpString=".docx") returned 5 [0065.095] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0065.095] lstrlenW (lpString=".pdf") returned 4 [0065.095] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0065.095] lstrlenW (lpString=".xls") returned 4 [0065.095] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0065.095] lstrlenW (lpString=".xlsx") returned 5 [0065.095] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0065.095] lstrlenW (lpString=".ppt") returned 4 [0065.095] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0065.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.095] lstrlenW (lpString=".zip") returned 4 [0065.095] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0065.095] lstrlenW (lpString=".rar") returned 4 [0065.095] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0065.096] lstrlenW (lpString=".bz2") returned 4 [0065.096] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0065.096] lstrlenW (lpString=".7z") returned 3 [0065.096] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0065.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.096] lstrlenW (lpString=".dbf") returned 4 [0065.096] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0065.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.096] lstrlenW (lpString=".1cd") returned 4 [0065.096] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0065.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.096] lstrlenW (lpString=".jpg") returned 4 [0065.096] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0065.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.096] lstrlenW (lpString=".doc") returned 4 [0065.096] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0065.096] lstrlenW (lpString=".docx") returned 5 [0065.096] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0065.096] lstrlenW (lpString=".pdf") returned 4 [0065.096] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0065.096] lstrlenW (lpString=".xls") returned 4 [0065.096] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0065.096] lstrlenW (lpString=".xlsx") returned 5 [0065.096] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0065.096] lstrlenW (lpString=".ppt") returned 4 [0065.096] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0065.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.096] lstrlenW (lpString=".zip") returned 4 [0065.096] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0065.096] lstrlenW (lpString=".rar") returned 4 [0065.097] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0065.097] lstrlenW (lpString=".bz2") returned 4 [0065.097] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0065.097] lstrlenW (lpString=".7z") returned 3 [0065.097] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0065.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.097] lstrlenW (lpString=".dbf") returned 4 [0065.097] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0065.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.097] lstrlenW (lpString=".1cd") returned 4 [0065.097] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0065.097] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0065.097] lstrlenW (lpString=".jpg") returned 4 [0065.097] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0065.097] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0065.097] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0065.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.098] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=566) returned 1 [0065.098] CloseHandle (hObject=0x198) returned 1 [0065.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0065.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.098] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.098] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.098] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.099] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0065.099] GetLastError () returned 0x0 [0065.099] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x236, lpOverlapped=0x0) returned 1 [0065.100] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x240, lpOverlapped=0x0) returned 1 [0065.101] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.101] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfe, lpOverlapped=0x0) returned 1 [0065.101] SetEndOfFile (hFile=0x174) returned 1 [0065.101] CloseHandle (hObject=0x174) returned 1 [0065.101] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.101] SetEndOfFile (hFile=0x198) returned 1 [0065.102] CloseHandle (hObject=0x198) returned 1 [0065.102] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.102] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0065.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.103] lstrlenW (lpString=".doc") returned 4 [0065.103] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0065.103] lstrlenW (lpString=".docx") returned 5 [0065.103] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0065.103] lstrlenW (lpString=".pdf") returned 4 [0065.103] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0065.103] lstrlenW (lpString=".xls") returned 4 [0065.103] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0065.103] lstrlenW (lpString=".xlsx") returned 5 [0065.103] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0065.103] lstrlenW (lpString=".ppt") returned 4 [0065.103] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0065.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.103] lstrlenW (lpString=".zip") returned 4 [0065.103] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0065.103] lstrlenW (lpString=".rar") returned 4 [0065.103] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0065.103] lstrlenW (lpString=".bz2") returned 4 [0065.103] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0065.103] lstrlenW (lpString=".7z") returned 3 [0065.103] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0065.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.103] lstrlenW (lpString=".dbf") returned 4 [0065.103] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0065.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.104] lstrlenW (lpString=".1cd") returned 4 [0065.104] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0065.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.104] lstrlenW (lpString=".jpg") returned 4 [0065.104] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0065.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.104] lstrlenW (lpString=".doc") returned 4 [0065.104] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0065.104] lstrlenW (lpString=".docx") returned 5 [0065.104] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0065.104] lstrlenW (lpString=".pdf") returned 4 [0065.104] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0065.104] lstrlenW (lpString=".xls") returned 4 [0065.104] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0065.104] lstrlenW (lpString=".xlsx") returned 5 [0065.104] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0065.104] lstrlenW (lpString=".ppt") returned 4 [0065.104] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0065.104] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.104] lstrlenW (lpString=".zip") returned 4 [0065.104] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0065.104] lstrlenW (lpString=".rar") returned 4 [0065.104] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0065.104] lstrlenW (lpString=".bz2") returned 4 [0065.104] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0065.104] lstrlenW (lpString=".7z") returned 3 [0065.104] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0065.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.105] lstrlenW (lpString=".dbf") returned 4 [0065.105] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0065.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.105] lstrlenW (lpString=".1cd") returned 4 [0065.105] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0065.105] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0065.105] lstrlenW (lpString=".jpg") returned 4 [0065.105] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0065.105] lstrcmpiW (lpString1=".HLP", lpString2=".wiki") returned -1 [0065.105] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0065.105] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.105] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=176311) returned 1 [0065.105] CloseHandle (hObject=0x198) returned 1 [0065.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0065.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.106] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.106] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.106] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0065.146] GetLastError () returned 0x0 [0065.146] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0065.150] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0065.153] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.153] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.153] SetEndOfFile (hFile=0x174) returned 1 [0065.153] CloseHandle (hObject=0x174) returned 1 [0065.154] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.154] SetEndOfFile (hFile=0x198) returned 1 [0065.156] CloseHandle (hObject=0x198) returned 1 [0065.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.156] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0065.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.156] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.157] lstrlenW (lpString=".doc") returned 4 [0065.157] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0065.157] lstrlenW (lpString=".docx") returned 5 [0065.157] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0065.157] lstrlenW (lpString=".pdf") returned 4 [0065.157] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0065.157] lstrlenW (lpString=".xls") returned 4 [0065.157] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0065.157] lstrlenW (lpString=".xlsx") returned 5 [0065.157] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0065.157] lstrlenW (lpString=".ppt") returned 4 [0065.157] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0065.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.157] lstrlenW (lpString=".zip") returned 4 [0065.157] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0065.157] lstrlenW (lpString=".rar") returned 4 [0065.157] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0065.157] lstrlenW (lpString=".bz2") returned 4 [0065.157] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0065.157] lstrlenW (lpString=".7z") returned 3 [0065.157] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0065.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.157] lstrlenW (lpString=".dbf") returned 4 [0065.157] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0065.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.157] lstrlenW (lpString=".1cd") returned 4 [0065.157] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0065.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.157] lstrlenW (lpString=".jpg") returned 4 [0065.157] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.158] lstrlenW (lpString=".doc") returned 4 [0065.158] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0065.158] lstrlenW (lpString=".docx") returned 5 [0065.158] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0065.158] lstrlenW (lpString=".pdf") returned 4 [0065.158] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0065.158] lstrlenW (lpString=".xls") returned 4 [0065.158] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0065.158] lstrlenW (lpString=".xlsx") returned 5 [0065.158] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0065.158] lstrlenW (lpString=".ppt") returned 4 [0065.158] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.158] lstrlenW (lpString=".zip") returned 4 [0065.158] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0065.158] lstrlenW (lpString=".rar") returned 4 [0065.158] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0065.158] lstrlenW (lpString=".bz2") returned 4 [0065.158] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0065.158] lstrlenW (lpString=".7z") returned 3 [0065.158] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.158] lstrlenW (lpString=".dbf") returned 4 [0065.158] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0065.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.158] lstrlenW (lpString=".1cd") returned 4 [0065.158] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0065.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0065.159] lstrlenW (lpString=".jpg") returned 4 [0065.159] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0065.159] lstrcmpiW (lpString1=".TTF", lpString2=".wiki") returned -1 [0065.159] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0065.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.159] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=7656) returned 1 [0065.159] CloseHandle (hObject=0x198) returned 1 [0065.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0065.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.160] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.160] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0065.160] GetLastError () returned 0x0 [0065.160] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x1de8, lpOverlapped=0x0) returned 1 [0065.162] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0065.163] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.163] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0065.163] SetEndOfFile (hFile=0x174) returned 1 [0065.163] CloseHandle (hObject=0x174) returned 1 [0065.163] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.163] SetEndOfFile (hFile=0x198) returned 1 [0065.164] CloseHandle (hObject=0x198) returned 1 [0065.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.164] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0065.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.165] lstrlenW (lpString=".doc") returned 4 [0065.165] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0065.165] lstrlenW (lpString=".docx") returned 5 [0065.165] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0065.165] lstrlenW (lpString=".pdf") returned 4 [0065.165] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0065.165] lstrlenW (lpString=".xls") returned 4 [0065.165] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0065.165] lstrlenW (lpString=".xlsx") returned 5 [0065.165] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0065.165] lstrlenW (lpString=".ppt") returned 4 [0065.165] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0065.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.165] lstrlenW (lpString=".zip") returned 4 [0065.165] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0065.165] lstrlenW (lpString=".rar") returned 4 [0065.165] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0065.165] lstrlenW (lpString=".bz2") returned 4 [0065.165] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0065.165] lstrlenW (lpString=".7z") returned 3 [0065.165] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0065.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.165] lstrlenW (lpString=".dbf") returned 4 [0065.165] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0065.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.165] lstrlenW (lpString=".1cd") returned 4 [0065.165] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0065.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.165] lstrlenW (lpString=".jpg") returned 4 [0065.165] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0065.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.166] lstrlenW (lpString=".doc") returned 4 [0065.166] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0065.166] lstrlenW (lpString=".docx") returned 5 [0065.166] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0065.166] lstrlenW (lpString=".pdf") returned 4 [0065.166] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0065.166] lstrlenW (lpString=".xls") returned 4 [0065.166] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0065.166] lstrlenW (lpString=".xlsx") returned 5 [0065.166] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0065.166] lstrlenW (lpString=".ppt") returned 4 [0065.166] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0065.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.166] lstrlenW (lpString=".zip") returned 4 [0065.166] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0065.166] lstrlenW (lpString=".rar") returned 4 [0065.166] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0065.166] lstrlenW (lpString=".bz2") returned 4 [0065.166] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0065.166] lstrlenW (lpString=".7z") returned 3 [0065.166] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0065.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.166] lstrlenW (lpString=".dbf") returned 4 [0065.166] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0065.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.166] lstrlenW (lpString=".1cd") returned 4 [0065.166] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0065.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0065.166] lstrlenW (lpString=".jpg") returned 4 [0065.167] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0065.167] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0065.167] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0065.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.167] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=31104) returned 1 [0065.167] CloseHandle (hObject=0x198) returned 1 [0065.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0065.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.168] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.168] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.168] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0065.168] GetLastError () returned 0x0 [0065.168] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x7980, lpOverlapped=0x0) returned 1 [0065.170] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x7990, lpOverlapped=0x0) returned 1 [0065.172] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.172] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0065.172] SetEndOfFile (hFile=0x174) returned 1 [0065.172] CloseHandle (hObject=0x174) returned 1 [0065.172] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.172] SetEndOfFile (hFile=0x198) returned 1 [0065.173] CloseHandle (hObject=0x198) returned 1 [0065.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.174] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0065.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.174] lstrlenW (lpString=".doc") returned 4 [0065.174] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.174] lstrlenW (lpString=".docx") returned 5 [0065.174] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0065.174] lstrlenW (lpString=".pdf") returned 4 [0065.174] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.174] lstrlenW (lpString=".xls") returned 4 [0065.174] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.174] lstrlenW (lpString=".xlsx") returned 5 [0065.174] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0065.174] lstrlenW (lpString=".ppt") returned 4 [0065.174] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.174] lstrlenW (lpString=".zip") returned 4 [0065.174] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.174] lstrlenW (lpString=".rar") returned 4 [0065.174] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.174] lstrlenW (lpString=".bz2") returned 4 [0065.174] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.174] lstrlenW (lpString=".7z") returned 3 [0065.174] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.174] lstrlenW (lpString=".dbf") returned 4 [0065.175] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.175] lstrlenW (lpString=".1cd") returned 4 [0065.175] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.175] lstrlenW (lpString=".jpg") returned 4 [0065.175] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.175] lstrlenW (lpString=".doc") returned 4 [0065.175] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0065.175] lstrlenW (lpString=".docx") returned 5 [0065.175] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0065.175] lstrlenW (lpString=".pdf") returned 4 [0065.175] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0065.175] lstrlenW (lpString=".xls") returned 4 [0065.175] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0065.175] lstrlenW (lpString=".xlsx") returned 5 [0065.175] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0065.175] lstrlenW (lpString=".ppt") returned 4 [0065.175] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0065.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.175] lstrlenW (lpString=".zip") returned 4 [0065.175] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0065.175] lstrlenW (lpString=".rar") returned 4 [0065.175] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0065.175] lstrlenW (lpString=".bz2") returned 4 [0065.175] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0065.175] lstrlenW (lpString=".7z") returned 3 [0065.175] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0065.175] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.176] lstrlenW (lpString=".dbf") returned 4 [0065.176] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0065.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.176] lstrlenW (lpString=".1cd") returned 4 [0065.176] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0065.176] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0065.176] lstrlenW (lpString=".jpg") returned 4 [0065.176] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0065.176] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0065.176] lstrlenW (lpString="msgfilt.dll") returned 11 [0065.176] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.177] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=38768) returned 1 [0065.177] CloseHandle (hObject=0x198) returned 1 [0065.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0065.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0065.177] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.177] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.177] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0066.461] GetLastError () returned 0x0 [0066.461] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x9770, lpOverlapped=0x0) returned 1 [0066.463] WriteFile (in: hFile=0x200, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x9780, lpOverlapped=0x0) returned 1 [0066.464] ReadFile (in: hFile=0x198, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0066.465] WriteFile (in: hFile=0x200, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.465] SetEndOfFile (hFile=0x200) returned 1 [0066.465] CloseHandle (hObject=0x200) returned 1 [0066.465] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.465] SetEndOfFile (hFile=0x198) returned 1 [0066.466] CloseHandle (hObject=0x198) returned 1 [0066.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.466] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0066.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.467] lstrlenW (lpString=".doc") returned 4 [0066.467] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.467] lstrlenW (lpString=".docx") returned 5 [0066.467] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0066.467] lstrlenW (lpString=".pdf") returned 4 [0066.467] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.467] lstrlenW (lpString=".xls") returned 4 [0066.467] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.467] lstrlenW (lpString=".xlsx") returned 5 [0066.467] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0066.467] lstrlenW (lpString=".ppt") returned 4 [0066.467] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.467] lstrlenW (lpString=".zip") returned 4 [0066.467] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.467] lstrlenW (lpString=".rar") returned 4 [0066.467] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.467] lstrlenW (lpString=".bz2") returned 4 [0066.467] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.467] lstrlenW (lpString=".7z") returned 3 [0066.467] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.467] lstrlenW (lpString=".dbf") returned 4 [0066.467] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.467] lstrlenW (lpString=".1cd") returned 4 [0066.467] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.467] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.467] lstrlenW (lpString=".jpg") returned 4 [0066.467] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.468] lstrlenW (lpString=".doc") returned 4 [0066.468] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.468] lstrlenW (lpString=".docx") returned 5 [0066.468] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0066.468] lstrlenW (lpString=".pdf") returned 4 [0066.468] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.468] lstrlenW (lpString=".xls") returned 4 [0066.468] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.468] lstrlenW (lpString=".xlsx") returned 5 [0066.468] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0066.468] lstrlenW (lpString=".ppt") returned 4 [0066.468] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.468] lstrlenW (lpString=".zip") returned 4 [0066.468] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.468] lstrlenW (lpString=".rar") returned 4 [0066.468] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.468] lstrlenW (lpString=".bz2") returned 4 [0066.468] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.468] lstrlenW (lpString=".7z") returned 3 [0066.468] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.468] lstrlenW (lpString=".dbf") returned 4 [0066.468] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.468] lstrlenW (lpString=".1cd") returned 4 [0066.468] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.468] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0066.468] lstrlenW (lpString=".jpg") returned 4 [0066.468] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.469] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0066.469] lstrlenW (lpString="offfiltx.dll") returned 12 [0066.469] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0067.189] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1486736) returned 1 [0067.189] CloseHandle (hObject=0x16c) returned 1 [0067.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0067.190] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0067.190] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.190] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.190] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0067.191] GetLastError () returned 0x0 [0067.191] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0067.216] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0067.402] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0067.416] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0067.426] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0067.426] WriteFile (in: hFile=0x184, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.426] SetEndOfFile (hFile=0x184) returned 1 [0067.426] CloseHandle (hObject=0x184) returned 1 [0067.426] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.426] SetEndOfFile (hFile=0x16c) returned 1 [0067.430] CloseHandle (hObject=0x16c) returned 1 [0067.430] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.430] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.431] lstrlenW (lpString=".doc") returned 4 [0067.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0067.431] lstrlenW (lpString=".docx") returned 5 [0067.431] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0067.431] lstrlenW (lpString=".pdf") returned 4 [0067.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0067.431] lstrlenW (lpString=".xls") returned 4 [0067.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0067.431] lstrlenW (lpString=".xlsx") returned 5 [0067.431] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0067.431] lstrlenW (lpString=".ppt") returned 4 [0067.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.431] lstrlenW (lpString=".zip") returned 4 [0067.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0067.431] lstrlenW (lpString=".rar") returned 4 [0067.431] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0067.431] lstrlenW (lpString=".bz2") returned 4 [0067.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0067.431] lstrlenW (lpString=".7z") returned 3 [0067.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.431] lstrlenW (lpString=".dbf") returned 4 [0067.431] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.431] lstrlenW (lpString=".1cd") returned 4 [0067.431] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0067.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.431] lstrlenW (lpString=".jpg") returned 4 [0067.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0067.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.432] lstrlenW (lpString=".doc") returned 4 [0067.432] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0067.432] lstrlenW (lpString=".docx") returned 5 [0067.432] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0067.432] lstrlenW (lpString=".pdf") returned 4 [0067.432] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0067.432] lstrlenW (lpString=".xls") returned 4 [0067.432] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0067.432] lstrlenW (lpString=".xlsx") returned 5 [0067.432] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0067.432] lstrlenW (lpString=".ppt") returned 4 [0067.503] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0067.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.504] lstrlenW (lpString=".zip") returned 4 [0067.504] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0067.504] lstrlenW (lpString=".rar") returned 4 [0067.504] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0067.504] lstrlenW (lpString=".bz2") returned 4 [0067.504] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0067.504] lstrlenW (lpString=".7z") returned 3 [0067.504] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0067.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.504] lstrlenW (lpString=".dbf") returned 4 [0067.504] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0067.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.504] lstrlenW (lpString=".1cd") returned 4 [0067.504] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0067.504] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0067.504] lstrlenW (lpString=".jpg") returned 4 [0067.504] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0067.504] lstrcmpiW (lpString1=".CGM", lpString2=".wiki") returned -1 [0067.504] lstrlenW (lpString="MS.CGM") returned 6 [0067.504] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0067.868] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1908) returned 1 [0067.868] CloseHandle (hObject=0x1e8) returned 1 [0067.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0067.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0067.869] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.869] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.869] GetLastError () returned 0x0 [0067.869] ReadFile (in: hFile=0x1e8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x774, lpOverlapped=0x0) returned 1 [0067.871] WriteFile (in: hFile=0x220, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x780, lpOverlapped=0x0) returned 1 [0067.872] ReadFile (in: hFile=0x1e8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0067.872] WriteFile (in: hFile=0x220, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0067.872] SetEndOfFile (hFile=0x220) returned 1 [0067.872] CloseHandle (hObject=0x220) returned 1 [0067.872] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.872] SetEndOfFile (hFile=0x1e8) returned 1 [0067.873] CloseHandle (hObject=0x1e8) returned 1 [0067.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.874] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0067.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.874] lstrlenW (lpString=".doc") returned 4 [0067.874] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0067.874] lstrlenW (lpString=".docx") returned 5 [0067.874] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0067.874] lstrlenW (lpString=".pdf") returned 4 [0067.874] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0067.874] lstrlenW (lpString=".xls") returned 4 [0067.874] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0067.874] lstrlenW (lpString=".xlsx") returned 5 [0067.874] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0067.874] lstrlenW (lpString=".ppt") returned 4 [0067.874] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0067.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.874] lstrlenW (lpString=".zip") returned 4 [0067.874] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0067.874] lstrlenW (lpString=".rar") returned 4 [0067.874] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0067.874] lstrlenW (lpString=".bz2") returned 4 [0067.874] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0067.874] lstrlenW (lpString=".7z") returned 3 [0067.874] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0067.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.874] lstrlenW (lpString=".dbf") returned 4 [0067.874] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0067.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.875] lstrlenW (lpString=".1cd") returned 4 [0067.875] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0067.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.875] lstrlenW (lpString=".jpg") returned 4 [0067.875] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0067.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.875] lstrlenW (lpString=".doc") returned 4 [0067.875] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0067.875] lstrlenW (lpString=".docx") returned 5 [0067.875] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0067.875] lstrlenW (lpString=".pdf") returned 4 [0067.875] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0067.875] lstrlenW (lpString=".xls") returned 4 [0067.875] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0067.875] lstrlenW (lpString=".xlsx") returned 5 [0067.875] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0067.875] lstrlenW (lpString=".ppt") returned 4 [0067.875] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0067.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.875] lstrlenW (lpString=".zip") returned 4 [0067.875] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0067.875] lstrlenW (lpString=".rar") returned 4 [0067.875] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0067.875] lstrlenW (lpString=".bz2") returned 4 [0067.875] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0067.875] lstrlenW (lpString=".7z") returned 3 [0067.875] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0067.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.875] lstrlenW (lpString=".dbf") returned 4 [0067.875] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0067.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.876] lstrlenW (lpString=".1cd") returned 4 [0067.876] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0067.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0067.876] lstrlenW (lpString=".jpg") returned 4 [0067.876] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0067.876] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0067.876] lstrlenW (lpString="hxds.dll") returned 8 [0067.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0067.877] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1257984) returned 1 [0067.877] CloseHandle (hObject=0x1e8) returned 1 [0067.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0067.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0067.877] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.877] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.878] GetLastError () returned 0x0 [0067.878] ReadFile (in: hFile=0x1e8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0067.899] WriteFile (in: hFile=0x220, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0068.024] ReadFile (in: hFile=0x1e8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x33210, lpOverlapped=0x0) returned 1 [0068.035] WriteFile (in: hFile=0x220, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x33220, lpOverlapped=0x0) returned 1 [0068.041] ReadFile (in: hFile=0x1e8, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0068.041] WriteFile (in: hFile=0x220, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0068.041] SetEndOfFile (hFile=0x220) returned 1 [0068.276] CloseHandle (hObject=0x220) returned 1 [0068.277] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.277] SetEndOfFile (hFile=0x1e8) returned 1 [0068.279] CloseHandle (hObject=0x1e8) returned 1 [0068.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.279] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0068.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.279] lstrlenW (lpString=".doc") returned 4 [0068.279] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.280] lstrlenW (lpString=".docx") returned 5 [0068.280] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0068.280] lstrlenW (lpString=".pdf") returned 4 [0068.280] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.280] lstrlenW (lpString=".xls") returned 4 [0068.280] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.280] lstrlenW (lpString=".xlsx") returned 5 [0068.280] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0068.280] lstrlenW (lpString=".ppt") returned 4 [0068.280] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.280] lstrlenW (lpString=".zip") returned 4 [0068.280] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.280] lstrlenW (lpString=".rar") returned 4 [0068.280] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.280] lstrlenW (lpString=".bz2") returned 4 [0068.280] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.280] lstrlenW (lpString=".7z") returned 3 [0068.280] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.280] lstrlenW (lpString=".dbf") returned 4 [0068.280] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.280] lstrlenW (lpString=".1cd") returned 4 [0068.280] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.280] lstrlenW (lpString=".jpg") returned 4 [0068.280] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.280] lstrlenW (lpString=".doc") returned 4 [0068.280] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0068.280] lstrlenW (lpString=".docx") returned 5 [0068.281] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0068.281] lstrlenW (lpString=".pdf") returned 4 [0068.281] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0068.281] lstrlenW (lpString=".xls") returned 4 [0068.281] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0068.281] lstrlenW (lpString=".xlsx") returned 5 [0068.281] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0068.281] lstrlenW (lpString=".ppt") returned 4 [0068.281] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0068.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.281] lstrlenW (lpString=".zip") returned 4 [0068.281] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0068.281] lstrlenW (lpString=".rar") returned 4 [0068.281] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0068.281] lstrlenW (lpString=".bz2") returned 4 [0068.281] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0068.281] lstrlenW (lpString=".7z") returned 3 [0068.281] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0068.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.281] lstrlenW (lpString=".dbf") returned 4 [0068.281] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0068.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.281] lstrlenW (lpString=".1cd") returned 4 [0068.281] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0068.281] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0068.281] lstrlenW (lpString=".jpg") returned 4 [0068.281] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0068.281] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0068.281] lstrlenW (lpString="InputPersonalization.exe.mui") returned 28 [0068.282] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.211] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2560) returned 1 [0069.212] CloseHandle (hObject=0x20c) returned 1 [0069.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui")) returned 0x20 [0069.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inputpersonalization.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.212] lstrlenW (lpString=".doc") returned 4 [0069.212] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.212] lstrlenW (lpString=".docx") returned 5 [0069.212] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.212] lstrlenW (lpString=".pdf") returned 4 [0069.212] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.212] lstrlenW (lpString=".xls") returned 4 [0069.212] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.212] lstrlenW (lpString=".xlsx") returned 5 [0069.212] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.212] lstrlenW (lpString=".ppt") returned 4 [0069.212] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.212] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.212] lstrlenW (lpString=".zip") returned 4 [0069.212] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.212] lstrlenW (lpString=".rar") returned 4 [0069.212] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.212] lstrlenW (lpString=".bz2") returned 4 [0069.212] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.212] lstrlenW (lpString=".7z") returned 3 [0069.212] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.213] lstrlenW (lpString=".dbf") returned 4 [0069.213] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.213] lstrlenW (lpString=".1cd") returned 4 [0069.213] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.213] lstrlenW (lpString=".jpg") returned 4 [0069.213] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.213] lstrlenW (lpString=".doc") returned 4 [0069.213] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.213] lstrlenW (lpString=".docx") returned 5 [0069.213] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.213] lstrlenW (lpString=".pdf") returned 4 [0069.213] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.213] lstrlenW (lpString=".xls") returned 4 [0069.213] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.213] lstrlenW (lpString=".xlsx") returned 5 [0069.213] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.213] lstrlenW (lpString=".ppt") returned 4 [0069.213] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.213] lstrlenW (lpString=".zip") returned 4 [0069.213] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.213] lstrlenW (lpString=".rar") returned 4 [0069.213] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.213] lstrlenW (lpString=".bz2") returned 4 [0069.213] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.213] lstrlenW (lpString=".7z") returned 3 [0069.213] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.213] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.214] lstrlenW (lpString=".dbf") returned 4 [0069.214] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.214] lstrlenW (lpString=".1cd") returned 4 [0069.214] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InputPersonalization.exe.mui") returned 85 [0069.214] lstrlenW (lpString=".jpg") returned 4 [0069.214] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.214] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0069.214] lstrlenW (lpString="rtscom.dll.mui") returned 14 [0069.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.214] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=2560) returned 1 [0069.214] CloseHandle (hObject=0x20c) returned 1 [0069.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0069.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.214] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.215] lstrlenW (lpString=".doc") returned 4 [0069.215] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.215] lstrlenW (lpString=".docx") returned 5 [0069.215] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.215] lstrlenW (lpString=".pdf") returned 4 [0069.215] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.215] lstrlenW (lpString=".xls") returned 4 [0069.215] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.215] lstrlenW (lpString=".xlsx") returned 5 [0069.215] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.215] lstrlenW (lpString=".ppt") returned 4 [0069.215] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.215] lstrlenW (lpString=".zip") returned 4 [0069.215] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.215] lstrlenW (lpString=".rar") returned 4 [0069.215] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.215] lstrlenW (lpString=".bz2") returned 4 [0069.215] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.215] lstrlenW (lpString=".7z") returned 3 [0069.215] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.215] lstrlenW (lpString=".dbf") returned 4 [0069.215] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.215] lstrlenW (lpString=".1cd") returned 4 [0069.215] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.215] lstrlenW (lpString=".jpg") returned 4 [0069.215] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.216] lstrlenW (lpString=".doc") returned 4 [0069.216] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.216] lstrlenW (lpString=".docx") returned 5 [0069.216] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.216] lstrlenW (lpString=".pdf") returned 4 [0069.216] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.216] lstrlenW (lpString=".xls") returned 4 [0069.216] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.216] lstrlenW (lpString=".xlsx") returned 5 [0069.216] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.216] lstrlenW (lpString=".ppt") returned 4 [0069.216] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.216] lstrlenW (lpString=".zip") returned 4 [0069.216] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.216] lstrlenW (lpString=".rar") returned 4 [0069.216] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.216] lstrlenW (lpString=".bz2") returned 4 [0069.216] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.216] lstrlenW (lpString=".7z") returned 3 [0069.216] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.216] lstrlenW (lpString=".dbf") returned 4 [0069.216] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.216] lstrlenW (lpString=".1cd") returned 4 [0069.216] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.216] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0069.216] lstrlenW (lpString=".jpg") returned 4 [0069.216] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.217] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0069.217] lstrlenW (lpString="ShapeCollector.exe.mui") returned 22 [0069.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.217] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=43520) returned 1 [0069.217] CloseHandle (hObject=0x20c) returned 1 [0069.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0069.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.217] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.217] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.217] lstrlenW (lpString=".doc") returned 4 [0069.217] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.217] lstrlenW (lpString=".docx") returned 5 [0069.217] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.217] lstrlenW (lpString=".pdf") returned 4 [0069.217] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.217] lstrlenW (lpString=".xls") returned 4 [0069.217] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.217] lstrlenW (lpString=".xlsx") returned 5 [0069.218] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.218] lstrlenW (lpString=".ppt") returned 4 [0069.218] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.218] lstrlenW (lpString=".zip") returned 4 [0069.218] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.218] lstrlenW (lpString=".rar") returned 4 [0069.218] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.218] lstrlenW (lpString=".bz2") returned 4 [0069.218] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.218] lstrlenW (lpString=".7z") returned 3 [0069.218] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.218] lstrlenW (lpString=".dbf") returned 4 [0069.218] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.218] lstrlenW (lpString=".1cd") returned 4 [0069.218] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.218] lstrlenW (lpString=".jpg") returned 4 [0069.218] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.218] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.218] lstrlenW (lpString=".doc") returned 4 [0069.218] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.218] lstrlenW (lpString=".docx") returned 5 [0069.218] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.218] lstrlenW (lpString=".pdf") returned 4 [0069.218] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.218] lstrlenW (lpString=".xls") returned 4 [0069.218] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.218] lstrlenW (lpString=".xlsx") returned 5 [0069.219] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.219] lstrlenW (lpString=".ppt") returned 4 [0069.219] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.219] lstrlenW (lpString=".zip") returned 4 [0069.219] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.219] lstrlenW (lpString=".rar") returned 4 [0069.219] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.219] lstrlenW (lpString=".bz2") returned 4 [0069.219] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.219] lstrlenW (lpString=".7z") returned 3 [0069.219] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.219] lstrlenW (lpString=".dbf") returned 4 [0069.219] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.219] lstrlenW (lpString=".1cd") returned 4 [0069.219] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0069.219] lstrlenW (lpString=".jpg") returned 4 [0069.219] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.219] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0069.219] lstrlenW (lpString="tabskb.dll.mui") returned 14 [0069.219] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.221] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3072) returned 1 [0069.221] CloseHandle (hObject=0x20c) returned 1 [0069.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui")) returned 0x20 [0069.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tabskb.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.221] lstrlenW (lpString=".doc") returned 4 [0069.221] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.221] lstrlenW (lpString=".docx") returned 5 [0069.221] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.221] lstrlenW (lpString=".pdf") returned 4 [0069.221] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.221] lstrlenW (lpString=".xls") returned 4 [0069.221] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.221] lstrlenW (lpString=".xlsx") returned 5 [0069.221] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.221] lstrlenW (lpString=".ppt") returned 4 [0069.221] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.221] lstrlenW (lpString=".zip") returned 4 [0069.221] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.221] lstrlenW (lpString=".rar") returned 4 [0069.221] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.221] lstrlenW (lpString=".bz2") returned 4 [0069.221] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.222] lstrlenW (lpString=".7z") returned 3 [0069.222] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.222] lstrlenW (lpString=".dbf") returned 4 [0069.222] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.222] lstrlenW (lpString=".1cd") returned 4 [0069.222] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.222] lstrlenW (lpString=".jpg") returned 4 [0069.222] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.222] lstrlenW (lpString=".doc") returned 4 [0069.222] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.222] lstrlenW (lpString=".docx") returned 5 [0069.222] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.222] lstrlenW (lpString=".pdf") returned 4 [0069.222] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.222] lstrlenW (lpString=".xls") returned 4 [0069.222] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.222] lstrlenW (lpString=".xlsx") returned 5 [0069.222] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.222] lstrlenW (lpString=".ppt") returned 4 [0069.222] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.222] lstrlenW (lpString=".zip") returned 4 [0069.222] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.222] lstrlenW (lpString=".rar") returned 4 [0069.222] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.222] lstrlenW (lpString=".bz2") returned 4 [0069.222] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.222] lstrlenW (lpString=".7z") returned 3 [0069.223] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.223] lstrlenW (lpString=".dbf") returned 4 [0069.223] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.223] lstrlenW (lpString=".1cd") returned 4 [0069.223] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.223] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tabskb.dll.mui") returned 71 [0069.223] lstrlenW (lpString=".jpg") returned 4 [0069.223] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.223] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0069.223] lstrlenW (lpString="TipBand.dll.mui") returned 15 [0069.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.224] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=3072) returned 1 [0069.224] CloseHandle (hObject=0x20c) returned 1 [0069.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0069.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.224] lstrlenW (lpString=".doc") returned 4 [0069.224] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.225] lstrlenW (lpString=".docx") returned 5 [0069.225] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.225] lstrlenW (lpString=".pdf") returned 4 [0069.225] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.225] lstrlenW (lpString=".xls") returned 4 [0069.225] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.225] lstrlenW (lpString=".xlsx") returned 5 [0069.225] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.225] lstrlenW (lpString=".ppt") returned 4 [0069.225] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.225] lstrlenW (lpString=".zip") returned 4 [0069.225] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.225] lstrlenW (lpString=".rar") returned 4 [0069.225] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.225] lstrlenW (lpString=".bz2") returned 4 [0069.225] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.225] lstrlenW (lpString=".7z") returned 3 [0069.225] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.225] lstrlenW (lpString=".dbf") returned 4 [0069.225] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.225] lstrlenW (lpString=".1cd") returned 4 [0069.225] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.225] lstrlenW (lpString=".jpg") returned 4 [0069.225] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.225] lstrlenW (lpString=".doc") returned 4 [0069.225] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.226] lstrlenW (lpString=".docx") returned 5 [0069.226] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.226] lstrlenW (lpString=".pdf") returned 4 [0069.226] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.226] lstrlenW (lpString=".xls") returned 4 [0069.226] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.226] lstrlenW (lpString=".xlsx") returned 5 [0069.226] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.226] lstrlenW (lpString=".ppt") returned 4 [0069.226] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.226] lstrlenW (lpString=".zip") returned 4 [0069.226] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.226] lstrlenW (lpString=".rar") returned 4 [0069.226] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.226] lstrlenW (lpString=".bz2") returned 4 [0069.226] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.226] lstrlenW (lpString=".7z") returned 3 [0069.226] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.226] lstrlenW (lpString=".dbf") returned 4 [0069.226] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.226] lstrlenW (lpString=".1cd") returned 4 [0069.226] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0069.226] lstrlenW (lpString=".jpg") returned 4 [0069.226] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.226] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0069.227] lstrlenW (lpString="TipRes.dll.mui") returned 14 [0069.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.227] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=32768) returned 1 [0069.227] CloseHandle (hObject=0x20c) returned 1 [0069.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0069.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0069.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0069.227] lstrlenW (lpString=".doc") returned 4 [0069.227] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.227] lstrlenW (lpString=".docx") returned 5 [0069.227] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.227] lstrlenW (lpString=".pdf") returned 4 [0069.227] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.227] lstrlenW (lpString=".xls") returned 4 [0069.227] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.227] lstrlenW (lpString=".xlsx") returned 5 [0069.227] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.227] lstrlenW (lpString=".ppt") returned 4 [0069.227] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0069.228] lstrlenW (lpString=".zip") returned 4 [0069.228] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.228] lstrlenW (lpString=".rar") returned 4 [0069.228] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.228] lstrlenW (lpString=".bz2") returned 4 [0069.228] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.228] lstrlenW (lpString=".7z") returned 3 [0069.228] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0069.228] lstrlenW (lpString=".dbf") returned 4 [0069.228] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.232] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0069.239] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0069.240] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0069.500] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.500] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0069.501] GetLastError () returned 0x0 [0069.501] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x665a0, lpOverlapped=0x0) returned 1 [0069.560] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0069.567] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0069.567] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0069.567] SetEndOfFile (hFile=0x210) returned 1 [0069.567] CloseHandle (hObject=0x210) returned 1 [0069.567] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.567] SetEndOfFile (hFile=0x16c) returned 1 [0069.571] CloseHandle (hObject=0x16c) returned 1 [0069.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.572] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0069.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.572] lstrlenW (lpString=".doc") returned 4 [0069.572] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.572] lstrlenW (lpString=".docx") returned 5 [0069.572] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0069.572] lstrlenW (lpString=".pdf") returned 4 [0069.572] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.572] lstrlenW (lpString=".xls") returned 4 [0069.572] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.572] lstrlenW (lpString=".xlsx") returned 5 [0069.572] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0069.572] lstrlenW (lpString=".ppt") returned 4 [0069.572] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.572] lstrlenW (lpString=".zip") returned 4 [0069.572] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.572] lstrlenW (lpString=".rar") returned 4 [0069.572] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.572] lstrlenW (lpString=".bz2") returned 4 [0069.572] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.572] lstrlenW (lpString=".7z") returned 3 [0069.573] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.573] lstrlenW (lpString=".dbf") returned 4 [0069.573] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.573] lstrlenW (lpString=".1cd") returned 4 [0069.573] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.573] lstrlenW (lpString=".jpg") returned 4 [0069.573] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.573] lstrlenW (lpString=".doc") returned 4 [0069.573] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.573] lstrlenW (lpString=".docx") returned 5 [0069.573] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0069.573] lstrlenW (lpString=".pdf") returned 4 [0069.573] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.573] lstrlenW (lpString=".xls") returned 4 [0069.573] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.573] lstrlenW (lpString=".xlsx") returned 5 [0069.573] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0069.573] lstrlenW (lpString=".ppt") returned 4 [0069.573] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.573] lstrlenW (lpString=".zip") returned 4 [0069.573] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.573] lstrlenW (lpString=".rar") returned 4 [0069.573] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.573] lstrlenW (lpString=".bz2") returned 4 [0069.573] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.573] lstrlenW (lpString=".7z") returned 3 [0069.574] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.574] lstrlenW (lpString=".dbf") returned 4 [0069.574] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.574] lstrlenW (lpString=".1cd") returned 4 [0069.574] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0069.574] lstrlenW (lpString=".jpg") returned 4 [0069.574] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.574] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0069.574] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0069.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.575] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=26624) returned 1 [0069.575] CloseHandle (hObject=0x16c) returned 1 [0069.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0069.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.575] lstrlenW (lpString=".doc") returned 4 [0069.575] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.575] lstrlenW (lpString=".docx") returned 5 [0069.575] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.575] lstrlenW (lpString=".pdf") returned 4 [0069.575] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.575] lstrlenW (lpString=".xls") returned 4 [0069.575] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.575] lstrlenW (lpString=".xlsx") returned 5 [0069.575] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.575] lstrlenW (lpString=".ppt") returned 4 [0069.575] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.575] lstrlenW (lpString=".zip") returned 4 [0069.575] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.575] lstrlenW (lpString=".rar") returned 4 [0069.575] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.575] lstrlenW (lpString=".bz2") returned 4 [0069.575] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.576] lstrlenW (lpString=".7z") returned 3 [0069.576] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.576] lstrlenW (lpString=".dbf") returned 4 [0069.576] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.576] lstrlenW (lpString=".1cd") returned 4 [0069.576] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.576] lstrlenW (lpString=".jpg") returned 4 [0069.576] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.576] lstrlenW (lpString=".doc") returned 4 [0069.576] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.576] lstrlenW (lpString=".docx") returned 5 [0069.576] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0069.576] lstrlenW (lpString=".pdf") returned 4 [0069.576] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.576] lstrlenW (lpString=".xls") returned 4 [0069.576] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.576] lstrlenW (lpString=".xlsx") returned 5 [0069.576] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0069.576] lstrlenW (lpString=".ppt") returned 4 [0069.576] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.576] lstrlenW (lpString=".zip") returned 4 [0069.576] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.576] lstrlenW (lpString=".rar") returned 4 [0069.576] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.576] lstrlenW (lpString=".bz2") returned 4 [0069.576] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.576] lstrlenW (lpString=".7z") returned 3 [0069.577] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.577] lstrlenW (lpString=".dbf") returned 4 [0069.577] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.577] lstrlenW (lpString=".1cd") returned 4 [0069.577] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0069.577] lstrlenW (lpString=".jpg") returned 4 [0069.577] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.577] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0069.577] lstrlenW (lpString="msinfo32.exe") returned 12 [0069.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.577] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=378880) returned 1 [0069.577] CloseHandle (hObject=0x16c) returned 1 [0069.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0069.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.578] lstrlenW (lpString=".doc") returned 4 [0069.578] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0069.578] lstrlenW (lpString=".docx") returned 5 [0069.578] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0069.578] lstrlenW (lpString=".pdf") returned 4 [0069.578] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0069.578] lstrlenW (lpString=".xls") returned 4 [0069.578] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0069.578] lstrlenW (lpString=".xlsx") returned 5 [0069.578] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0069.578] lstrlenW (lpString=".ppt") returned 4 [0069.578] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0069.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.578] lstrlenW (lpString=".zip") returned 4 [0069.578] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0069.578] lstrlenW (lpString=".rar") returned 4 [0069.578] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0069.578] lstrlenW (lpString=".bz2") returned 4 [0069.578] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0069.578] lstrlenW (lpString=".7z") returned 3 [0069.578] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0069.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.578] lstrlenW (lpString=".dbf") returned 4 [0069.578] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0069.578] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.579] lstrlenW (lpString=".1cd") returned 4 [0069.579] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0069.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.579] lstrlenW (lpString=".jpg") returned 4 [0069.579] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.579] lstrlenW (lpString=".doc") returned 4 [0069.579] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0069.579] lstrlenW (lpString=".docx") returned 5 [0069.579] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0069.579] lstrlenW (lpString=".pdf") returned 4 [0069.579] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0069.579] lstrlenW (lpString=".xls") returned 4 [0069.579] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0069.579] lstrlenW (lpString=".xlsx") returned 5 [0069.579] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0069.579] lstrlenW (lpString=".ppt") returned 4 [0069.579] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0069.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.579] lstrlenW (lpString=".zip") returned 4 [0069.579] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0069.579] lstrlenW (lpString=".rar") returned 4 [0069.579] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0069.579] lstrlenW (lpString=".bz2") returned 4 [0069.579] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0069.579] lstrlenW (lpString=".7z") returned 3 [0069.579] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0069.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.579] lstrlenW (lpString=".dbf") returned 4 [0069.579] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0069.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.579] lstrlenW (lpString=".1cd") returned 4 [0069.580] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0069.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0069.580] lstrlenW (lpString=".jpg") returned 4 [0069.580] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.580] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0069.580] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0069.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.580] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=198056) returned 1 [0069.580] CloseHandle (hObject=0x16c) returned 1 [0069.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0069.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.581] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.581] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0069.581] GetLastError () returned 0x0 [0069.581] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x305a8, lpOverlapped=0x0) returned 1 [0069.947] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0069.952] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0069.952] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.952] SetEndOfFile (hFile=0x210) returned 1 [0069.952] CloseHandle (hObject=0x210) returned 1 [0069.952] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.952] SetEndOfFile (hFile=0x16c) returned 1 [0069.954] CloseHandle (hObject=0x16c) returned 1 [0069.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.954] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0069.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.955] lstrlenW (lpString=".doc") returned 4 [0069.955] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.955] lstrlenW (lpString=".docx") returned 5 [0069.955] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0069.955] lstrlenW (lpString=".pdf") returned 4 [0069.955] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.955] lstrlenW (lpString=".xls") returned 4 [0069.955] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.955] lstrlenW (lpString=".xlsx") returned 5 [0069.955] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0069.955] lstrlenW (lpString=".ppt") returned 4 [0069.955] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.955] lstrlenW (lpString=".zip") returned 4 [0069.955] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.955] lstrlenW (lpString=".rar") returned 4 [0069.955] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.955] lstrlenW (lpString=".bz2") returned 4 [0069.955] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.955] lstrlenW (lpString=".7z") returned 3 [0069.955] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.955] lstrlenW (lpString=".dbf") returned 4 [0069.955] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.955] lstrlenW (lpString=".1cd") returned 4 [0069.955] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.955] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.955] lstrlenW (lpString=".jpg") returned 4 [0069.955] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.956] lstrlenW (lpString=".doc") returned 4 [0069.956] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.956] lstrlenW (lpString=".docx") returned 5 [0069.956] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0069.956] lstrlenW (lpString=".pdf") returned 4 [0069.956] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.956] lstrlenW (lpString=".xls") returned 4 [0069.956] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.956] lstrlenW (lpString=".xlsx") returned 5 [0069.956] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0069.956] lstrlenW (lpString=".ppt") returned 4 [0069.956] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.956] lstrlenW (lpString=".zip") returned 4 [0069.956] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.956] lstrlenW (lpString=".rar") returned 4 [0069.956] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.956] lstrlenW (lpString=".bz2") returned 4 [0069.956] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.956] lstrlenW (lpString=".7z") returned 3 [0069.956] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.956] lstrlenW (lpString=".dbf") returned 4 [0069.956] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.956] lstrlenW (lpString=".1cd") returned 4 [0069.956] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0069.956] lstrlenW (lpString=".jpg") returned 4 [0069.956] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.957] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".wiki") returned -1 [0069.957] lstrlenW (lpString="MSOINTL.DLL.IDX_DLL") returned 19 [0069.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.957] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=55680) returned 1 [0069.957] CloseHandle (hObject=0x16c) returned 1 [0069.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 0x20 [0069.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.958] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.958] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0069.963] GetLastError () returned 0x0 [0069.963] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xd980, lpOverlapped=0x0) returned 1 [0069.965] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xd990, lpOverlapped=0x0) returned 1 [0069.967] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0069.967] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0069.967] SetEndOfFile (hFile=0x210) returned 1 [0069.967] CloseHandle (hObject=0x210) returned 1 [0069.967] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.968] SetEndOfFile (hFile=0x16c) returned 1 [0069.969] CloseHandle (hObject=0x16c) returned 1 [0069.969] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.969] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0069.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.969] lstrlenW (lpString=".doc") returned 4 [0069.969] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0069.969] lstrlenW (lpString=".docx") returned 5 [0069.969] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0069.969] lstrlenW (lpString=".pdf") returned 4 [0069.969] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0069.969] lstrlenW (lpString=".xls") returned 4 [0069.969] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0069.969] lstrlenW (lpString=".xlsx") returned 5 [0069.969] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0069.969] lstrlenW (lpString=".ppt") returned 4 [0069.969] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0069.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.970] lstrlenW (lpString=".zip") returned 4 [0069.970] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0069.970] lstrlenW (lpString=".rar") returned 4 [0069.970] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0069.970] lstrlenW (lpString=".bz2") returned 4 [0069.970] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0069.970] lstrlenW (lpString=".7z") returned 3 [0069.970] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.970] lstrlenW (lpString=".dbf") returned 4 [0069.970] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0069.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.970] lstrlenW (lpString=".1cd") returned 4 [0069.970] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0069.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.970] lstrlenW (lpString=".jpg") returned 4 [0069.970] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0069.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.970] lstrlenW (lpString=".doc") returned 4 [0069.970] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0069.970] lstrlenW (lpString=".docx") returned 5 [0069.970] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0069.970] lstrlenW (lpString=".pdf") returned 4 [0069.970] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0069.970] lstrlenW (lpString=".xls") returned 4 [0069.970] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0069.970] lstrlenW (lpString=".xlsx") returned 5 [0069.970] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0069.970] lstrlenW (lpString=".ppt") returned 4 [0069.971] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0069.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.971] lstrlenW (lpString=".zip") returned 4 [0069.971] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0069.971] lstrlenW (lpString=".rar") returned 4 [0069.971] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0069.971] lstrlenW (lpString=".bz2") returned 4 [0069.971] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0069.971] lstrlenW (lpString=".7z") returned 3 [0069.971] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.971] lstrlenW (lpString=".dbf") returned 4 [0069.971] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0069.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.971] lstrlenW (lpString=".1cd") returned 4 [0069.971] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0069.971] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0069.971] lstrlenW (lpString=".jpg") returned 4 [0069.971] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0069.971] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".wiki") returned -1 [0069.971] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0069.971] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.972] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=1388416) returned 1 [0069.972] CloseHandle (hObject=0x16c) returned 1 [0069.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0069.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0069.972] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.972] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.972] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0069.973] GetLastError () returned 0x0 [0069.973] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0070.164] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0070.185] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x52f90, lpOverlapped=0x0) returned 1 [0070.352] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x52fa0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x52fa0, lpOverlapped=0x0) returned 1 [0070.360] ReadFile (in: hFile=0x16c, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0070.360] WriteFile (in: hFile=0x210, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0070.360] SetEndOfFile (hFile=0x210) returned 1 [0071.210] CloseHandle (hObject=0x210) returned 1 [0071.321] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.334] SetEndOfFile (hFile=0x16c) returned 1 [0071.381] CloseHandle (hObject=0x16c) returned 1 [0071.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.383] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0071.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.383] lstrlenW (lpString=".doc") returned 4 [0071.383] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0071.383] lstrlenW (lpString=".docx") returned 5 [0071.383] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0071.383] lstrlenW (lpString=".pdf") returned 4 [0071.383] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0071.383] lstrlenW (lpString=".xls") returned 4 [0071.383] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString=".xlsx") returned 5 [0071.384] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0071.384] lstrlenW (lpString=".ppt") returned 4 [0071.384] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.384] lstrlenW (lpString=".zip") returned 4 [0071.384] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString=".rar") returned 4 [0071.384] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString=".bz2") returned 4 [0071.384] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString=".7z") returned 3 [0071.384] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.384] lstrlenW (lpString=".dbf") returned 4 [0071.384] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.384] lstrlenW (lpString=".1cd") returned 4 [0071.384] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.384] lstrlenW (lpString=".jpg") returned 4 [0071.384] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.384] lstrlenW (lpString=".doc") returned 4 [0071.384] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString=".docx") returned 5 [0071.384] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0071.384] lstrlenW (lpString=".pdf") returned 4 [0071.384] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString=".xls") returned 4 [0071.384] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0071.384] lstrlenW (lpString=".xlsx") returned 5 [0071.385] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0071.385] lstrlenW (lpString=".ppt") returned 4 [0071.385] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0071.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.385] lstrlenW (lpString=".zip") returned 4 [0071.385] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0071.385] lstrlenW (lpString=".rar") returned 4 [0071.385] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0071.385] lstrlenW (lpString=".bz2") returned 4 [0071.385] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0071.385] lstrlenW (lpString=".7z") returned 3 [0071.385] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.385] lstrlenW (lpString=".dbf") returned 4 [0071.385] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0071.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.385] lstrlenW (lpString=".1cd") returned 4 [0071.385] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0071.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0071.385] lstrlenW (lpString=".jpg") returned 4 [0071.385] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0071.385] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0071.385] lstrlenW (lpString="ACEERR.DLL") returned 10 [0071.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0072.283] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=43408) returned 1 [0072.283] CloseHandle (hObject=0x240) returned 1 [0072.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0072.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.283] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0072.283] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.283] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.284] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.284] GetLastError () returned 0x0 [0072.284] ReadFile (in: hFile=0x240, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0xa990, lpOverlapped=0x0) returned 1 [0072.336] WriteFile (in: hFile=0x1f4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xa9a0, lpOverlapped=0x0) returned 1 [0072.337] ReadFile (in: hFile=0x240, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0072.337] WriteFile (in: hFile=0x1f4, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0072.337] SetEndOfFile (hFile=0x1f4) returned 1 [0072.338] CloseHandle (hObject=0x1f4) returned 1 [0072.338] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.338] SetEndOfFile (hFile=0x240) returned 1 [0072.339] CloseHandle (hObject=0x240) returned 1 [0072.339] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.339] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0072.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.349] lstrlenW (lpString=".doc") returned 4 [0072.349] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.349] lstrlenW (lpString=".docx") returned 5 [0072.349] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0072.349] lstrlenW (lpString=".pdf") returned 4 [0072.350] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.350] lstrlenW (lpString=".xls") returned 4 [0072.350] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.350] lstrlenW (lpString=".xlsx") returned 5 [0072.350] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0072.350] lstrlenW (lpString=".ppt") returned 4 [0072.350] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.350] lstrlenW (lpString=".zip") returned 4 [0072.350] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.350] lstrlenW (lpString=".rar") returned 4 [0072.350] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.350] lstrlenW (lpString=".bz2") returned 4 [0072.350] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.350] lstrlenW (lpString=".7z") returned 3 [0072.350] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.350] lstrlenW (lpString=".dbf") returned 4 [0072.350] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.350] lstrlenW (lpString=".1cd") returned 4 [0072.350] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.350] lstrlenW (lpString=".jpg") returned 4 [0072.351] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.351] lstrlenW (lpString=".doc") returned 4 [0072.351] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.351] lstrlenW (lpString=".docx") returned 5 [0072.351] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0072.351] lstrlenW (lpString=".pdf") returned 4 [0072.351] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.351] lstrlenW (lpString=".xls") returned 4 [0072.351] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.351] lstrlenW (lpString=".xlsx") returned 5 [0072.351] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0072.351] lstrlenW (lpString=".ppt") returned 4 [0072.351] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.351] lstrlenW (lpString=".zip") returned 4 [0072.351] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.351] lstrlenW (lpString=".rar") returned 4 [0072.351] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.351] lstrlenW (lpString=".bz2") returned 4 [0072.351] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.351] lstrlenW (lpString=".7z") returned 3 [0072.351] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.351] lstrlenW (lpString=".dbf") returned 4 [0072.351] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.351] lstrlenW (lpString=".1cd") returned 4 [0072.351] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0072.352] lstrlenW (lpString=".jpg") returned 4 [0072.352] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.352] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0072.352] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0072.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.352] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=15800) returned 1 [0072.352] CloseHandle (hObject=0x1f4) returned 1 [0072.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0072.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.353] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.353] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.353] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0072.353] GetLastError () returned 0x0 [0072.353] ReadFile (in: hFile=0x1f4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x3db8, lpOverlapped=0x0) returned 1 [0072.355] WriteFile (in: hFile=0x200, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0072.356] ReadFile (in: hFile=0x1f4, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0072.356] WriteFile (in: hFile=0x200, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.356] SetEndOfFile (hFile=0x200) returned 1 [0072.356] CloseHandle (hObject=0x200) returned 1 [0072.356] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.356] SetEndOfFile (hFile=0x1f4) returned 1 [0072.357] CloseHandle (hObject=0x1f4) returned 1 [0072.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.357] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0072.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.358] lstrlenW (lpString=".doc") returned 4 [0072.358] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.358] lstrlenW (lpString=".docx") returned 5 [0072.358] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0072.358] lstrlenW (lpString=".pdf") returned 4 [0072.358] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.358] lstrlenW (lpString=".xls") returned 4 [0072.358] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.358] lstrlenW (lpString=".xlsx") returned 5 [0072.358] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0072.358] lstrlenW (lpString=".ppt") returned 4 [0072.358] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.358] lstrlenW (lpString=".zip") returned 4 [0072.358] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.358] lstrlenW (lpString=".rar") returned 4 [0072.358] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.358] lstrlenW (lpString=".bz2") returned 4 [0072.358] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.358] lstrlenW (lpString=".7z") returned 3 [0072.358] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.358] lstrlenW (lpString=".dbf") returned 4 [0072.358] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.358] lstrlenW (lpString=".1cd") returned 4 [0072.358] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.358] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.358] lstrlenW (lpString=".jpg") returned 4 [0072.358] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.359] lstrlenW (lpString=".doc") returned 4 [0072.359] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.359] lstrlenW (lpString=".docx") returned 5 [0072.359] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0072.359] lstrlenW (lpString=".pdf") returned 4 [0072.359] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.359] lstrlenW (lpString=".xls") returned 4 [0072.359] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.359] lstrlenW (lpString=".xlsx") returned 5 [0072.359] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0072.359] lstrlenW (lpString=".ppt") returned 4 [0072.359] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.359] lstrlenW (lpString=".zip") returned 4 [0072.359] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.359] lstrlenW (lpString=".rar") returned 4 [0072.359] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.359] lstrlenW (lpString=".bz2") returned 4 [0072.359] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.359] lstrlenW (lpString=".7z") returned 3 [0072.359] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.359] lstrlenW (lpString=".dbf") returned 4 [0072.359] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.359] lstrlenW (lpString=".1cd") returned 4 [0072.359] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.359] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0072.359] lstrlenW (lpString=".jpg") returned 4 [0072.359] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.360] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0072.360] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0072.360] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0072.361] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=537504) returned 1 [0072.361] CloseHandle (hObject=0x200) returned 1 [0072.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0072.361] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0072.361] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.361] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.361] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0072.362] GetLastError () returned 0x0 [0072.362] ReadFile (in: hFile=0x200, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x833a0, lpOverlapped=0x0) returned 1 [0072.373] WriteFile (in: hFile=0x218, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x833b0, lpOverlapped=0x0) returned 1 [0072.477] ReadFile (in: hFile=0x200, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0072.477] WriteFile (in: hFile=0x218, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.477] SetEndOfFile (hFile=0x218) returned 1 [0073.221] CloseHandle (hObject=0x218) returned 1 [0073.668] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.668] SetEndOfFile (hFile=0x200) returned 1 [0073.684] CloseHandle (hObject=0x200) returned 1 [0073.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1 [0074.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.020] lstrlenW (lpString=".doc") returned 4 [0074.020] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.020] lstrlenW (lpString=".docx") returned 5 [0074.020] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0074.020] lstrlenW (lpString=".pdf") returned 4 [0074.020] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.020] lstrlenW (lpString=".xls") returned 4 [0074.020] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.020] lstrlenW (lpString=".xlsx") returned 5 [0074.020] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0074.020] lstrlenW (lpString=".ppt") returned 4 [0074.020] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.020] lstrlenW (lpString=".zip") returned 4 [0074.020] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.020] lstrlenW (lpString=".rar") returned 4 [0074.021] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.021] lstrlenW (lpString=".bz2") returned 4 [0074.021] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.021] lstrlenW (lpString=".7z") returned 3 [0074.021] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.021] lstrlenW (lpString=".dbf") returned 4 [0074.021] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.021] lstrlenW (lpString=".1cd") returned 4 [0074.021] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.021] lstrlenW (lpString=".jpg") returned 4 [0074.021] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.021] lstrlenW (lpString=".doc") returned 4 [0074.021] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.021] lstrlenW (lpString=".docx") returned 5 [0074.021] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0074.021] lstrlenW (lpString=".pdf") returned 4 [0074.021] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.021] lstrlenW (lpString=".xls") returned 4 [0074.021] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.021] lstrlenW (lpString=".xlsx") returned 5 [0074.021] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0074.021] lstrlenW (lpString=".ppt") returned 4 [0074.021] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.021] lstrlenW (lpString=".zip") returned 4 [0074.021] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.021] lstrlenW (lpString=".rar") returned 4 [0074.022] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.022] lstrlenW (lpString=".bz2") returned 4 [0074.022] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.022] lstrlenW (lpString=".7z") returned 3 [0074.022] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.022] lstrlenW (lpString=".dbf") returned 4 [0074.022] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.022] lstrlenW (lpString=".1cd") returned 4 [0074.022] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0074.022] lstrlenW (lpString=".jpg") returned 4 [0074.022] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.022] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0074.022] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0074.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.438] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=502168) returned 1 [0074.438] CloseHandle (hObject=0x1ec) returned 1 [0074.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0074.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0074.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.439] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.439] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0074.667] GetLastError () returned 0x0 [0074.667] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x7a998, lpOverlapped=0x0) returned 1 [0074.677] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x7a9a0, lpOverlapped=0x0) returned 1 [0074.974] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0074.974] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0074.975] SetEndOfFile (hFile=0x174) returned 1 [0074.975] CloseHandle (hObject=0x174) returned 1 [0074.975] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.975] SetEndOfFile (hFile=0x1ec) returned 1 [0074.979] CloseHandle (hObject=0x1ec) returned 1 [0074.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0074.980] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 1 [0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.980] lstrlenW (lpString=".doc") returned 4 [0074.980] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.980] lstrlenW (lpString=".docx") returned 5 [0074.980] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0074.980] lstrlenW (lpString=".pdf") returned 4 [0074.980] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.980] lstrlenW (lpString=".xls") returned 4 [0074.980] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.980] lstrlenW (lpString=".xlsx") returned 5 [0074.980] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0074.980] lstrlenW (lpString=".ppt") returned 4 [0074.980] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.980] lstrlenW (lpString=".zip") returned 4 [0074.980] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.980] lstrlenW (lpString=".rar") returned 4 [0074.980] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.980] lstrlenW (lpString=".bz2") returned 4 [0074.980] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.980] lstrlenW (lpString=".7z") returned 3 [0074.981] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.981] lstrlenW (lpString=".dbf") returned 4 [0074.981] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.981] lstrlenW (lpString=".1cd") returned 4 [0074.981] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.981] lstrlenW (lpString=".jpg") returned 4 [0074.981] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.981] lstrlenW (lpString=".doc") returned 4 [0074.981] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.981] lstrlenW (lpString=".docx") returned 5 [0074.981] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0074.981] lstrlenW (lpString=".pdf") returned 4 [0074.981] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.981] lstrlenW (lpString=".xls") returned 4 [0074.981] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.981] lstrlenW (lpString=".xlsx") returned 5 [0074.981] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0074.981] lstrlenW (lpString=".ppt") returned 4 [0074.981] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.981] lstrlenW (lpString=".zip") returned 4 [0074.982] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.982] lstrlenW (lpString=".rar") returned 4 [0074.982] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.982] lstrlenW (lpString=".bz2") returned 4 [0074.982] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.982] lstrlenW (lpString=".7z") returned 3 [0074.982] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.982] lstrlenW (lpString=".dbf") returned 4 [0074.982] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.982] lstrlenW (lpString=".1cd") returned 4 [0074.982] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0074.982] lstrlenW (lpString=".jpg") returned 4 [0074.982] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.982] lstrcmpiW (lpString1=".ODF", lpString2=".wiki") returned -1 [0074.982] lstrlenW (lpString="OFFICE.ODF") returned 10 [0074.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.983] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=4297568) returned 1 [0074.983] CloseHandle (hObject=0x1ec) returned 1 [0074.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0074.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0074.983] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0074.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0074.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0074.984] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 1 [0074.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.985] lstrlenW (lpString=".doc") returned 4 [0074.985] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0074.985] lstrlenW (lpString=".docx") returned 5 [0074.985] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0074.985] lstrlenW (lpString=".pdf") returned 4 [0074.985] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0074.985] lstrlenW (lpString=".xls") returned 4 [0074.985] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0074.985] lstrlenW (lpString=".xlsx") returned 5 [0074.985] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0074.985] lstrlenW (lpString=".ppt") returned 4 [0074.985] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0074.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.985] lstrlenW (lpString=".zip") returned 4 [0074.985] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0074.985] lstrlenW (lpString=".rar") returned 4 [0074.985] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0074.985] lstrlenW (lpString=".bz2") returned 4 [0074.985] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0074.985] lstrlenW (lpString=".7z") returned 3 [0074.985] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0074.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.985] lstrlenW (lpString=".dbf") returned 4 [0074.985] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0074.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.985] lstrlenW (lpString=".1cd") returned 4 [0074.985] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0074.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.985] lstrlenW (lpString=".jpg") returned 4 [0074.985] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0074.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.985] lstrlenW (lpString=".doc") returned 4 [0074.986] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0074.986] lstrlenW (lpString=".docx") returned 5 [0074.986] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0074.986] lstrlenW (lpString=".pdf") returned 4 [0074.986] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0074.986] lstrlenW (lpString=".xls") returned 4 [0074.986] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0074.986] lstrlenW (lpString=".xlsx") returned 5 [0074.986] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0074.986] lstrlenW (lpString=".ppt") returned 4 [0074.986] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0074.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.986] lstrlenW (lpString=".zip") returned 4 [0074.986] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0074.986] lstrlenW (lpString=".rar") returned 4 [0074.986] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0074.986] lstrlenW (lpString=".bz2") returned 4 [0074.986] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0074.986] lstrlenW (lpString=".7z") returned 3 [0074.986] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0074.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.986] lstrlenW (lpString=".dbf") returned 4 [0074.986] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0074.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.986] lstrlenW (lpString=".1cd") returned 4 [0074.986] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0074.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0074.986] lstrlenW (lpString=".jpg") returned 4 [0074.986] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0074.987] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0074.987] lstrlenW (lpString="EXPSRV.DLL") returned 10 [0074.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.987] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=518984) returned 1 [0074.987] CloseHandle (hObject=0x1ec) returned 1 [0074.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0074.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0074.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0074.987] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.987] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.988] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0074.988] GetLastError () returned 0x0 [0074.988] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x7eb48, lpOverlapped=0x0) returned 1 [0075.219] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0x7eb50, lpOverlapped=0x0) returned 1 [0075.228] ReadFile (in: hFile=0x1ec, lpBuffer=0x3850020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ddfed4, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesRead=0x2ddfed4*=0x0, lpOverlapped=0x0) returned 1 [0075.228] WriteFile (in: hFile=0x174, lpBuffer=0x3850020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ddfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3850020*, lpNumberOfBytesWritten=0x2ddfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0075.228] SetEndOfFile (hFile=0x174) returned 1 [0075.228] CloseHandle (hObject=0x174) returned 1 [0075.229] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.229] SetEndOfFile (hFile=0x1ec) returned 1 [0075.235] CloseHandle (hObject=0x1ec) returned 1 [0075.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.235] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 1 [0075.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.422] lstrlenW (lpString=".doc") returned 4 [0075.422] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0075.422] lstrlenW (lpString=".docx") returned 5 [0075.422] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0075.422] lstrlenW (lpString=".pdf") returned 4 [0075.422] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0075.422] lstrlenW (lpString=".xls") returned 4 [0075.422] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0075.422] lstrlenW (lpString=".xlsx") returned 5 [0075.422] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0075.422] lstrlenW (lpString=".ppt") returned 4 [0075.422] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.422] lstrlenW (lpString=".zip") returned 4 [0075.422] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0075.422] lstrlenW (lpString=".rar") returned 4 [0075.422] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0075.422] lstrlenW (lpString=".bz2") returned 4 [0075.422] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0075.422] lstrlenW (lpString=".7z") returned 3 [0075.422] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.422] lstrlenW (lpString=".dbf") returned 4 [0075.422] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.422] lstrlenW (lpString=".1cd") returned 4 [0075.422] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.422] lstrlenW (lpString=".jpg") returned 4 [0075.422] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.422] lstrlenW (lpString=".doc") returned 4 [0075.423] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0075.423] lstrlenW (lpString=".docx") returned 5 [0075.423] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0075.423] lstrlenW (lpString=".pdf") returned 4 [0075.423] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0075.423] lstrlenW (lpString=".xls") returned 4 [0075.423] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0075.423] lstrlenW (lpString=".xlsx") returned 5 [0075.423] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0075.423] lstrlenW (lpString=".ppt") returned 4 [0075.423] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0075.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.423] lstrlenW (lpString=".zip") returned 4 [0075.423] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0075.423] lstrlenW (lpString=".rar") returned 4 [0075.423] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0075.423] lstrlenW (lpString=".bz2") returned 4 [0075.423] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0075.423] lstrlenW (lpString=".7z") returned 3 [0075.423] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0075.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.423] lstrlenW (lpString=".dbf") returned 4 [0075.423] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0075.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.423] lstrlenW (lpString=".1cd") returned 4 [0075.423] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0075.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0075.423] lstrlenW (lpString=".jpg") returned 4 [0075.423] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0075.423] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0075.424] lstrlenW (lpString="LICLUA.EXE") returned 10 [0075.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0075.424] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2ddff1c | out: lpFileSize=0x2ddff1c*=204168) returned 1 [0075.424] CloseHandle (hObject=0x180) returned 1 [0075.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe")) returned 0x20 [0075.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.424] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0075.424] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.425] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ddfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.425] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\LICLUA.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\liclua.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 18 os_tid = 0xaac [0047.023] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x3760260 [0047.023] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x3770268 [0047.024] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9203f0 [0047.024] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x6) returned 0x923170 [0047.024] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920408 [0047.024] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x3960020 [0047.024] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920420 [0047.024] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920420, Size=0x20) returned 0x905ce8 [0047.024] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920420 [0047.024] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920420, Size=0x20) returned 0x905cc0 [0047.024] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.025] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.025] Wow64DisableWow64FsRedirection (in: OldValue=0x2f1ff58 | out: OldValue=0x2f1ff58*=0x0) returned 1 [0047.025] lstrlenW (lpString="kernel32.dll") returned 12 [0047.025] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905ce8 | out: hHeap=0x8d0000) returned 1 [0047.025] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.025] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905cc0 | out: hHeap=0x8d0000) returned 1 [0047.025] Sleep (dwMilliseconds=0x64) [0047.230] Sleep (dwMilliseconds=0x64) [0047.479] Sleep (dwMilliseconds=0x64) [0047.647] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0047.647] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0047.647] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.301] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1565) returned 1 [0048.301] CloseHandle (hObject=0x1b0) returned 1 [0048.301] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0048.301] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.301] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.301] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0048.301] GetLastError () returned 0x0 [0048.301] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x61d, lpOverlapped=0x0) returned 1 [0048.315] WriteFile (in: hFile=0x1b4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x620, lpOverlapped=0x0) returned 1 [0048.316] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.316] WriteFile (in: hFile=0x1b4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.316] SetEndOfFile (hFile=0x1b4) returned 1 [0048.316] CloseHandle (hObject=0x1b4) returned 1 [0048.317] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.317] SetEndOfFile (hFile=0x1b0) returned 1 [0048.318] CloseHandle (hObject=0x1b0) returned 1 [0048.318] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.318] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0048.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.318] lstrlenW (lpString=".doc") returned 4 [0048.318] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.318] lstrlenW (lpString=".docx") returned 5 [0048.318] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.318] lstrlenW (lpString=".pdf") returned 4 [0048.318] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.318] lstrlenW (lpString=".xls") returned 4 [0048.318] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.318] lstrlenW (lpString=".xlsx") returned 5 [0048.318] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.318] lstrlenW (lpString=".ppt") returned 4 [0048.318] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.318] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.319] lstrlenW (lpString=".zip") returned 4 [0048.319] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.319] lstrlenW (lpString=".rar") returned 4 [0048.319] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.319] lstrlenW (lpString=".bz2") returned 4 [0048.319] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.319] lstrlenW (lpString=".7z") returned 3 [0048.319] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.319] lstrlenW (lpString=".dbf") returned 4 [0048.319] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.319] lstrlenW (lpString=".1cd") returned 4 [0048.319] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.319] lstrlenW (lpString=".jpg") returned 4 [0048.319] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.319] lstrlenW (lpString=".doc") returned 4 [0048.319] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.319] lstrlenW (lpString=".docx") returned 5 [0048.319] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.319] lstrlenW (lpString=".pdf") returned 4 [0048.319] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.319] lstrlenW (lpString=".xls") returned 4 [0048.319] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.319] lstrlenW (lpString=".xlsx") returned 5 [0048.319] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.319] lstrlenW (lpString=".ppt") returned 4 [0048.319] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.319] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.319] lstrlenW (lpString=".zip") returned 4 [0048.320] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.320] lstrlenW (lpString=".rar") returned 4 [0048.320] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.320] lstrlenW (lpString=".bz2") returned 4 [0048.320] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.320] lstrlenW (lpString=".7z") returned 3 [0048.320] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.320] lstrlenW (lpString=".dbf") returned 4 [0048.320] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.320] lstrlenW (lpString=".1cd") returned 4 [0048.320] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0048.320] lstrlenW (lpString=".jpg") returned 4 [0048.320] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.320] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.320] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0048.320] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.322] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1231) returned 1 [0048.322] CloseHandle (hObject=0x1b0) returned 1 [0048.322] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0048.322] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.322] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.322] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0048.322] GetLastError () returned 0x0 [0048.322] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0048.324] WriteFile (in: hFile=0x1b4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0048.324] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.325] WriteFile (in: hFile=0x1b4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0048.325] SetEndOfFile (hFile=0x1b4) returned 1 [0048.325] CloseHandle (hObject=0x1b4) returned 1 [0048.326] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.326] SetEndOfFile (hFile=0x1b0) returned 1 [0048.327] CloseHandle (hObject=0x1b0) returned 1 [0048.327] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.327] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0048.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.327] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.327] lstrlenW (lpString=".doc") returned 4 [0048.327] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.327] lstrlenW (lpString=".docx") returned 5 [0048.327] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.327] lstrlenW (lpString=".pdf") returned 4 [0048.327] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.327] lstrlenW (lpString=".xls") returned 4 [0048.327] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.328] lstrlenW (lpString=".xlsx") returned 5 [0048.328] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.328] lstrlenW (lpString=".ppt") returned 4 [0048.328] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.328] lstrlenW (lpString=".zip") returned 4 [0048.328] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.328] lstrlenW (lpString=".rar") returned 4 [0048.328] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.328] lstrlenW (lpString=".bz2") returned 4 [0048.328] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.328] lstrlenW (lpString=".7z") returned 3 [0048.328] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.328] lstrlenW (lpString=".dbf") returned 4 [0048.328] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.328] lstrlenW (lpString=".1cd") returned 4 [0048.328] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.328] lstrlenW (lpString=".jpg") returned 4 [0048.328] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.328] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.328] lstrlenW (lpString=".doc") returned 4 [0048.328] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.328] lstrlenW (lpString=".docx") returned 5 [0048.328] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.328] lstrlenW (lpString=".pdf") returned 4 [0048.328] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.328] lstrlenW (lpString=".xls") returned 4 [0048.328] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.328] lstrlenW (lpString=".xlsx") returned 5 [0048.329] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.329] lstrlenW (lpString=".ppt") returned 4 [0048.329] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.329] lstrlenW (lpString=".zip") returned 4 [0048.329] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.329] lstrlenW (lpString=".rar") returned 4 [0048.329] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.329] lstrlenW (lpString=".bz2") returned 4 [0048.329] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.329] lstrlenW (lpString=".7z") returned 3 [0048.329] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.329] lstrlenW (lpString=".dbf") returned 4 [0048.329] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.329] lstrlenW (lpString=".1cd") returned 4 [0048.329] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.329] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0048.329] lstrlenW (lpString=".jpg") returned 4 [0048.329] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.329] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.329] lstrlenW (lpString="Setup.xml") returned 9 [0048.329] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.330] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1852) returned 1 [0048.330] CloseHandle (hObject=0x1b0) returned 1 [0048.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.330] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.330] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.330] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.330] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.330] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.418] GetLastError () returned 0x0 [0048.418] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x73c, lpOverlapped=0x0) returned 1 [0048.419] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x740, lpOverlapped=0x0) returned 1 [0048.470] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.470] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.470] SetEndOfFile (hFile=0x1a8) returned 1 [0048.470] CloseHandle (hObject=0x1a8) returned 1 [0048.471] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.471] SetEndOfFile (hFile=0x1b0) returned 1 [0048.472] CloseHandle (hObject=0x1b0) returned 1 [0048.472] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.472] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.472] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.472] lstrlenW (lpString=".doc") returned 4 [0048.472] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.472] lstrlenW (lpString=".docx") returned 5 [0048.472] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.472] lstrlenW (lpString=".pdf") returned 4 [0048.472] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.473] lstrlenW (lpString=".xls") returned 4 [0048.473] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.473] lstrlenW (lpString=".xlsx") returned 5 [0048.473] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.473] lstrlenW (lpString=".ppt") returned 4 [0048.473] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.473] lstrlenW (lpString=".zip") returned 4 [0048.473] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.473] lstrlenW (lpString=".rar") returned 4 [0048.473] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.473] lstrlenW (lpString=".bz2") returned 4 [0048.473] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.473] lstrlenW (lpString=".7z") returned 3 [0048.473] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.473] lstrlenW (lpString=".dbf") returned 4 [0048.473] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.473] lstrlenW (lpString=".1cd") returned 4 [0048.473] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.473] lstrlenW (lpString=".jpg") returned 4 [0048.473] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.473] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.473] lstrlenW (lpString=".doc") returned 4 [0048.473] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.473] lstrlenW (lpString=".docx") returned 5 [0048.473] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.473] lstrlenW (lpString=".pdf") returned 4 [0048.473] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.474] lstrlenW (lpString=".xls") returned 4 [0048.474] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.474] lstrlenW (lpString=".xlsx") returned 5 [0048.474] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.474] lstrlenW (lpString=".ppt") returned 4 [0048.474] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.474] lstrlenW (lpString=".zip") returned 4 [0048.474] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.474] lstrlenW (lpString=".rar") returned 4 [0048.474] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.474] lstrlenW (lpString=".bz2") returned 4 [0048.474] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.474] lstrlenW (lpString=".7z") returned 3 [0048.474] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.474] lstrlenW (lpString=".dbf") returned 4 [0048.474] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.474] lstrlenW (lpString=".1cd") returned 4 [0048.474] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.474] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.474] lstrlenW (lpString=".jpg") returned 4 [0048.474] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.474] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.474] lstrlenW (lpString="Setup.xml") returned 9 [0048.474] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.476] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6241) returned 1 [0048.476] CloseHandle (hObject=0x1b0) returned 1 [0048.476] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.476] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.476] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.476] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.476] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.480] GetLastError () returned 0x0 [0048.480] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1861, lpOverlapped=0x0) returned 1 [0048.482] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0048.483] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.483] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.483] SetEndOfFile (hFile=0x1a8) returned 1 [0048.483] CloseHandle (hObject=0x1a8) returned 1 [0048.484] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.484] SetEndOfFile (hFile=0x1b0) returned 1 [0048.484] CloseHandle (hObject=0x1b0) returned 1 [0048.485] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.485] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.485] lstrlenW (lpString=".doc") returned 4 [0048.485] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.485] lstrlenW (lpString=".docx") returned 5 [0048.485] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.485] lstrlenW (lpString=".pdf") returned 4 [0048.485] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.485] lstrlenW (lpString=".xls") returned 4 [0048.485] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.485] lstrlenW (lpString=".xlsx") returned 5 [0048.485] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.485] lstrlenW (lpString=".ppt") returned 4 [0048.485] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.485] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.485] lstrlenW (lpString=".zip") returned 4 [0048.485] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.485] lstrlenW (lpString=".rar") returned 4 [0048.486] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.486] lstrlenW (lpString=".bz2") returned 4 [0048.486] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.486] lstrlenW (lpString=".7z") returned 3 [0048.486] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.486] lstrlenW (lpString=".dbf") returned 4 [0048.486] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.486] lstrlenW (lpString=".1cd") returned 4 [0048.486] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.486] lstrlenW (lpString=".jpg") returned 4 [0048.486] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.486] lstrlenW (lpString=".doc") returned 4 [0048.486] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.486] lstrlenW (lpString=".docx") returned 5 [0048.486] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.486] lstrlenW (lpString=".pdf") returned 4 [0048.486] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.486] lstrlenW (lpString=".xls") returned 4 [0048.486] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.486] lstrlenW (lpString=".xlsx") returned 5 [0048.486] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.486] lstrlenW (lpString=".ppt") returned 4 [0048.486] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.486] lstrlenW (lpString=".zip") returned 4 [0048.486] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.486] lstrlenW (lpString=".rar") returned 4 [0048.487] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.487] lstrlenW (lpString=".bz2") returned 4 [0048.487] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.487] lstrlenW (lpString=".7z") returned 3 [0048.487] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.487] lstrlenW (lpString=".dbf") returned 4 [0048.487] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.487] lstrlenW (lpString=".1cd") returned 4 [0048.487] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.487] lstrlenW (lpString=".jpg") returned 4 [0048.487] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.487] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.487] lstrlenW (lpString="VisioMUI.xml") returned 12 [0048.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.487] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9503) returned 1 [0048.487] CloseHandle (hObject=0x1b0) returned 1 [0048.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0048.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.488] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.488] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.488] GetLastError () returned 0x0 [0048.488] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x251f, lpOverlapped=0x0) returned 1 [0048.490] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0048.491] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.491] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.491] SetEndOfFile (hFile=0x1a8) returned 1 [0048.491] CloseHandle (hObject=0x1a8) returned 1 [0048.492] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.492] SetEndOfFile (hFile=0x1b0) returned 1 [0048.493] CloseHandle (hObject=0x1b0) returned 1 [0048.493] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.493] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0048.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.493] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.493] lstrlenW (lpString=".doc") returned 4 [0048.493] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.493] lstrlenW (lpString=".docx") returned 5 [0048.493] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.493] lstrlenW (lpString=".pdf") returned 4 [0048.493] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.493] lstrlenW (lpString=".xls") returned 4 [0048.493] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.493] lstrlenW (lpString=".xlsx") returned 5 [0048.493] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.494] lstrlenW (lpString=".ppt") returned 4 [0048.494] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.494] lstrlenW (lpString=".zip") returned 4 [0048.494] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.494] lstrlenW (lpString=".rar") returned 4 [0048.494] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.494] lstrlenW (lpString=".bz2") returned 4 [0048.494] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.494] lstrlenW (lpString=".7z") returned 3 [0048.494] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.494] lstrlenW (lpString=".dbf") returned 4 [0048.494] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.494] lstrlenW (lpString=".1cd") returned 4 [0048.494] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.494] lstrlenW (lpString=".jpg") returned 4 [0048.494] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.494] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.494] lstrlenW (lpString=".doc") returned 4 [0048.494] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.494] lstrlenW (lpString=".docx") returned 5 [0048.494] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.494] lstrlenW (lpString=".pdf") returned 4 [0048.494] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.494] lstrlenW (lpString=".xls") returned 4 [0048.494] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.494] lstrlenW (lpString=".xlsx") returned 5 [0048.495] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.495] lstrlenW (lpString=".ppt") returned 4 [0048.495] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.495] lstrlenW (lpString=".zip") returned 4 [0048.495] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.495] lstrlenW (lpString=".rar") returned 4 [0048.495] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.495] lstrlenW (lpString=".bz2") returned 4 [0048.495] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.495] lstrlenW (lpString=".7z") returned 3 [0048.495] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.495] lstrlenW (lpString=".dbf") returned 4 [0048.495] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.495] lstrlenW (lpString=".1cd") returned 4 [0048.495] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.495] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0048.495] lstrlenW (lpString=".jpg") returned 4 [0048.495] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.495] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.495] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0048.495] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.496] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1606) returned 1 [0048.496] CloseHandle (hObject=0x1b0) returned 1 [0048.496] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0048.496] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.496] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.497] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.497] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.497] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0048.497] GetLastError () returned 0x0 [0048.497] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x646, lpOverlapped=0x0) returned 1 [0048.498] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x650, lpOverlapped=0x0) returned 1 [0048.499] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.499] WriteFile (in: hFile=0x1a8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0048.499] SetEndOfFile (hFile=0x1a8) returned 1 [0048.499] CloseHandle (hObject=0x1a8) returned 1 [0048.500] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.500] SetEndOfFile (hFile=0x1b0) returned 1 [0048.501] CloseHandle (hObject=0x1b0) returned 1 [0048.501] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.501] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0048.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.501] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.501] lstrlenW (lpString=".doc") returned 4 [0048.501] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.501] lstrlenW (lpString=".docx") returned 5 [0048.502] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.502] lstrlenW (lpString=".pdf") returned 4 [0048.502] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.502] lstrlenW (lpString=".xls") returned 4 [0048.502] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.502] lstrlenW (lpString=".xlsx") returned 5 [0048.502] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.502] lstrlenW (lpString=".ppt") returned 4 [0048.502] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.502] lstrlenW (lpString=".zip") returned 4 [0048.502] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.502] lstrlenW (lpString=".rar") returned 4 [0048.502] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.502] lstrlenW (lpString=".bz2") returned 4 [0048.502] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.502] lstrlenW (lpString=".7z") returned 3 [0048.502] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.502] lstrlenW (lpString=".dbf") returned 4 [0048.502] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.502] lstrlenW (lpString=".1cd") returned 4 [0048.502] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.502] lstrlenW (lpString=".jpg") returned 4 [0048.502] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.502] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.502] lstrlenW (lpString=".doc") returned 4 [0048.503] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.503] lstrlenW (lpString=".docx") returned 5 [0048.503] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0048.503] lstrlenW (lpString=".pdf") returned 4 [0048.503] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.503] lstrlenW (lpString=".xls") returned 4 [0048.503] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.503] lstrlenW (lpString=".xlsx") returned 5 [0048.503] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0048.503] lstrlenW (lpString=".ppt") returned 4 [0048.503] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.503] lstrlenW (lpString=".zip") returned 4 [0048.503] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.503] lstrlenW (lpString=".rar") returned 4 [0048.503] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.503] lstrlenW (lpString=".bz2") returned 4 [0048.503] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.503] lstrlenW (lpString=".7z") returned 3 [0048.503] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.503] lstrlenW (lpString=".dbf") returned 4 [0048.503] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.503] lstrlenW (lpString=".1cd") returned 4 [0048.503] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.503] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0048.503] lstrlenW (lpString=".jpg") returned 4 [0048.503] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.504] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.504] lstrlenW (lpString="Setup.xml") returned 9 [0048.504] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.765] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1988) returned 1 [0048.765] CloseHandle (hObject=0x17c) returned 1 [0048.765] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.765] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.765] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.766] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.766] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.766] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.766] GetLastError () returned 0x0 [0048.766] ReadFile (in: hFile=0x17c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0048.768] WriteFile (in: hFile=0x1ac, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0048.769] ReadFile (in: hFile=0x17c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.769] WriteFile (in: hFile=0x1ac, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.769] SetEndOfFile (hFile=0x1ac) returned 1 [0048.769] CloseHandle (hObject=0x1ac) returned 1 [0048.770] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.770] SetEndOfFile (hFile=0x17c) returned 1 [0048.770] CloseHandle (hObject=0x17c) returned 1 [0048.770] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.771] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.771] lstrlenW (lpString=".doc") returned 4 [0048.771] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.771] lstrlenW (lpString=".docx") returned 5 [0048.771] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.771] lstrlenW (lpString=".pdf") returned 4 [0048.771] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.771] lstrlenW (lpString=".xls") returned 4 [0048.771] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.771] lstrlenW (lpString=".xlsx") returned 5 [0048.771] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.771] lstrlenW (lpString=".ppt") returned 4 [0048.771] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.771] lstrlenW (lpString=".zip") returned 4 [0048.771] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.771] lstrlenW (lpString=".rar") returned 4 [0048.771] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.771] lstrlenW (lpString=".bz2") returned 4 [0048.772] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.772] lstrlenW (lpString=".7z") returned 3 [0048.772] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.772] lstrlenW (lpString=".dbf") returned 4 [0048.772] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.772] lstrlenW (lpString=".1cd") returned 4 [0048.772] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.772] lstrlenW (lpString=".jpg") returned 4 [0048.772] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.772] lstrlenW (lpString=".doc") returned 4 [0048.772] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.772] lstrlenW (lpString=".docx") returned 5 [0048.772] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.772] lstrlenW (lpString=".pdf") returned 4 [0048.772] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.772] lstrlenW (lpString=".xls") returned 4 [0048.772] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.772] lstrlenW (lpString=".xlsx") returned 5 [0048.772] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.772] lstrlenW (lpString=".ppt") returned 4 [0048.772] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.772] lstrlenW (lpString=".zip") returned 4 [0048.772] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.772] lstrlenW (lpString=".rar") returned 4 [0048.772] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.772] lstrlenW (lpString=".bz2") returned 4 [0048.772] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.773] lstrlenW (lpString=".7z") returned 3 [0048.773] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.773] lstrlenW (lpString=".dbf") returned 4 [0048.773] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.773] lstrlenW (lpString=".1cd") returned 4 [0048.773] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.773] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.773] lstrlenW (lpString=".jpg") returned 4 [0048.773] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.773] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.773] lstrlenW (lpString="Setup.xml") returned 9 [0048.773] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0049.399] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1452) returned 1 [0049.399] CloseHandle (hObject=0x1b4) returned 1 [0049.399] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0049.399] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.399] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0049.400] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.400] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.400] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0049.724] GetLastError () returned 0x0 [0049.724] ReadFile (in: hFile=0x1b4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0049.931] WriteFile (in: hFile=0x1c4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0049.932] ReadFile (in: hFile=0x1b4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.932] WriteFile (in: hFile=0x1c4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.932] SetEndOfFile (hFile=0x1c4) returned 1 [0049.932] CloseHandle (hObject=0x1c4) returned 1 [0049.933] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.933] SetEndOfFile (hFile=0x1b4) returned 1 [0049.934] CloseHandle (hObject=0x1b4) returned 1 [0049.934] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0049.934] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0049.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.934] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.935] lstrlenW (lpString=".doc") returned 4 [0049.935] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.935] lstrlenW (lpString=".docx") returned 5 [0049.935] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0049.935] lstrlenW (lpString=".pdf") returned 4 [0049.935] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.935] lstrlenW (lpString=".xls") returned 4 [0049.935] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.935] lstrlenW (lpString=".xlsx") returned 5 [0049.935] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0049.935] lstrlenW (lpString=".ppt") returned 4 [0049.935] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.935] lstrlenW (lpString=".zip") returned 4 [0049.935] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.935] lstrlenW (lpString=".rar") returned 4 [0049.935] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.935] lstrlenW (lpString=".bz2") returned 4 [0049.935] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.935] lstrlenW (lpString=".7z") returned 3 [0049.935] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.935] lstrlenW (lpString=".dbf") returned 4 [0049.935] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.935] lstrlenW (lpString=".1cd") returned 4 [0049.935] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.935] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.935] lstrlenW (lpString=".jpg") returned 4 [0049.935] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.936] lstrlenW (lpString=".doc") returned 4 [0049.936] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.936] lstrlenW (lpString=".docx") returned 5 [0049.936] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0049.936] lstrlenW (lpString=".pdf") returned 4 [0049.936] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.936] lstrlenW (lpString=".xls") returned 4 [0049.936] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.936] lstrlenW (lpString=".xlsx") returned 5 [0049.936] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0049.936] lstrlenW (lpString=".ppt") returned 4 [0049.936] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.936] lstrlenW (lpString=".zip") returned 4 [0049.936] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.936] lstrlenW (lpString=".rar") returned 4 [0049.936] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.936] lstrlenW (lpString=".bz2") returned 4 [0049.936] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.936] lstrlenW (lpString=".7z") returned 3 [0049.936] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.936] lstrlenW (lpString=".dbf") returned 4 [0049.936] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.936] lstrlenW (lpString=".1cd") returned 4 [0049.936] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.936] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0049.936] lstrlenW (lpString=".jpg") returned 4 [0049.937] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.937] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0049.937] lstrlenW (lpString="Setup.xml") returned 9 [0049.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0049.937] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2624) returned 1 [0049.937] CloseHandle (hObject=0x1b4) returned 1 [0049.937] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0049.937] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0049.937] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.937] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.937] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1c4 [0049.938] GetLastError () returned 0x0 [0049.938] ReadFile (in: hFile=0x1b4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa40, lpOverlapped=0x0) returned 1 [0050.123] WriteFile (in: hFile=0x1c4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0050.124] ReadFile (in: hFile=0x1b4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.124] WriteFile (in: hFile=0x1c4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0050.124] SetEndOfFile (hFile=0x1c4) returned 1 [0050.124] CloseHandle (hObject=0x1c4) returned 1 [0050.125] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.125] SetEndOfFile (hFile=0x1b4) returned 1 [0050.126] CloseHandle (hObject=0x1b4) returned 1 [0050.126] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.126] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0050.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.126] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.126] lstrlenW (lpString=".doc") returned 4 [0050.126] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.126] lstrlenW (lpString=".docx") returned 5 [0050.126] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.126] lstrlenW (lpString=".pdf") returned 4 [0050.126] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.126] lstrlenW (lpString=".xls") returned 4 [0050.126] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.127] lstrlenW (lpString=".xlsx") returned 5 [0050.127] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.127] lstrlenW (lpString=".ppt") returned 4 [0050.127] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.127] lstrlenW (lpString=".zip") returned 4 [0050.127] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.127] lstrlenW (lpString=".rar") returned 4 [0050.127] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.127] lstrlenW (lpString=".bz2") returned 4 [0050.127] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.127] lstrlenW (lpString=".7z") returned 3 [0050.127] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.127] lstrlenW (lpString=".dbf") returned 4 [0050.127] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.127] lstrlenW (lpString=".1cd") returned 4 [0050.127] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.127] lstrlenW (lpString=".jpg") returned 4 [0050.127] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.359] lstrlenW (lpString=".doc") returned 4 [0050.359] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".docx") returned 5 [0050.359] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0050.359] lstrlenW (lpString=".pdf") returned 4 [0050.359] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".xls") returned 4 [0050.359] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".xlsx") returned 5 [0050.359] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0050.359] lstrlenW (lpString=".ppt") returned 4 [0050.359] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.359] lstrlenW (lpString=".zip") returned 4 [0050.359] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.359] lstrlenW (lpString=".rar") returned 4 [0050.359] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".bz2") returned 4 [0050.359] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.359] lstrlenW (lpString=".7z") returned 3 [0050.359] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.360] lstrlenW (lpString=".dbf") returned 4 [0050.360] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.360] lstrlenW (lpString=".1cd") returned 4 [0050.360] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0050.360] lstrlenW (lpString=".jpg") returned 4 [0050.360] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.360] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0050.360] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0050.360] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.648] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=16852) returned 1 [0050.667] CloseHandle (hObject=0x1ac) returned 1 [0050.667] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0050.667] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.667] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.667] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.667] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.668] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.668] GetLastError () returned 0x0 [0050.668] ReadFile (in: hFile=0x1ac, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0050.683] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0050.684] ReadFile (in: hFile=0x1ac, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.684] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0050.684] SetEndOfFile (hFile=0x178) returned 1 [0050.684] CloseHandle (hObject=0x178) returned 1 [0050.685] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.685] SetEndOfFile (hFile=0x1ac) returned 1 [0050.686] CloseHandle (hObject=0x1ac) returned 1 [0050.686] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.686] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0050.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.687] lstrlenW (lpString=".doc") returned 4 [0050.687] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.687] lstrlenW (lpString=".docx") returned 5 [0050.687] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.687] lstrlenW (lpString=".pdf") returned 4 [0050.687] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.687] lstrlenW (lpString=".xls") returned 4 [0050.687] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.687] lstrlenW (lpString=".xlsx") returned 5 [0050.687] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.687] lstrlenW (lpString=".ppt") returned 4 [0050.687] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.687] lstrlenW (lpString=".zip") returned 4 [0050.687] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.687] lstrlenW (lpString=".rar") returned 4 [0050.687] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.687] lstrlenW (lpString=".bz2") returned 4 [0050.687] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.687] lstrlenW (lpString=".7z") returned 3 [0050.687] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.687] lstrlenW (lpString=".dbf") returned 4 [0050.687] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.687] lstrlenW (lpString=".1cd") returned 4 [0050.687] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.687] lstrlenW (lpString=".jpg") returned 4 [0050.687] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.688] lstrlenW (lpString=".doc") returned 4 [0050.688] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.688] lstrlenW (lpString=".docx") returned 5 [0050.688] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.688] lstrlenW (lpString=".pdf") returned 4 [0050.688] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.688] lstrlenW (lpString=".xls") returned 4 [0050.688] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.688] lstrlenW (lpString=".xlsx") returned 5 [0050.688] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.688] lstrlenW (lpString=".ppt") returned 4 [0050.688] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.688] lstrlenW (lpString=".zip") returned 4 [0050.688] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.688] lstrlenW (lpString=".rar") returned 4 [0050.688] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.688] lstrlenW (lpString=".bz2") returned 4 [0050.688] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.688] lstrlenW (lpString=".7z") returned 3 [0050.688] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.688] lstrlenW (lpString=".dbf") returned 4 [0050.688] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.688] lstrlenW (lpString=".1cd") returned 4 [0050.688] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0050.689] lstrlenW (lpString=".jpg") returned 4 [0050.689] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.689] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0050.689] lstrlenW (lpString="VisiorWW.xml") returned 12 [0050.689] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.719] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8723) returned 1 [0050.720] CloseHandle (hObject=0x178) returned 1 [0050.720] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0050.720] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.720] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.720] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.720] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0050.720] GetLastError () returned 0x0 [0050.720] ReadFile (in: hFile=0x178, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2213, lpOverlapped=0x0) returned 1 [0050.757] WriteFile (in: hFile=0x1b8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0050.758] ReadFile (in: hFile=0x178, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.758] WriteFile (in: hFile=0x1b8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.758] SetEndOfFile (hFile=0x1b8) returned 1 [0050.758] CloseHandle (hObject=0x1b8) returned 1 [0050.759] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.759] SetEndOfFile (hFile=0x178) returned 1 [0050.760] CloseHandle (hObject=0x178) returned 1 [0050.760] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.760] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0050.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.760] lstrlenW (lpString=".doc") returned 4 [0050.760] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.761] lstrlenW (lpString=".docx") returned 5 [0050.761] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.761] lstrlenW (lpString=".pdf") returned 4 [0050.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.761] lstrlenW (lpString=".xls") returned 4 [0050.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.761] lstrlenW (lpString=".xlsx") returned 5 [0050.761] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.761] lstrlenW (lpString=".ppt") returned 4 [0050.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.761] lstrlenW (lpString=".zip") returned 4 [0050.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.761] lstrlenW (lpString=".rar") returned 4 [0050.761] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.761] lstrlenW (lpString=".bz2") returned 4 [0050.761] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.761] lstrlenW (lpString=".7z") returned 3 [0050.761] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.761] lstrlenW (lpString=".dbf") returned 4 [0050.761] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.761] lstrlenW (lpString=".1cd") returned 4 [0050.761] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.761] lstrlenW (lpString=".jpg") returned 4 [0050.761] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.762] lstrlenW (lpString=".doc") returned 4 [0050.762] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.762] lstrlenW (lpString=".docx") returned 5 [0050.762] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0050.762] lstrlenW (lpString=".pdf") returned 4 [0050.762] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.762] lstrlenW (lpString=".xls") returned 4 [0050.762] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.762] lstrlenW (lpString=".xlsx") returned 5 [0050.762] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0050.762] lstrlenW (lpString=".ppt") returned 4 [0050.762] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.762] lstrlenW (lpString=".zip") returned 4 [0050.762] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.762] lstrlenW (lpString=".rar") returned 4 [0050.762] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.762] lstrlenW (lpString=".bz2") returned 4 [0050.762] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.762] lstrlenW (lpString=".7z") returned 3 [0050.762] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.762] lstrlenW (lpString=".dbf") returned 4 [0050.762] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.762] lstrlenW (lpString=".1cd") returned 4 [0050.762] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.762] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0050.762] lstrlenW (lpString=".jpg") returned 4 [0050.762] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.763] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0050.763] lstrlenW (lpString="MS.PNG") returned 6 [0050.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.118] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1682) returned 1 [0051.118] CloseHandle (hObject=0x1a0) returned 1 [0051.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0051.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.118] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.118] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.118] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.119] GetLastError () returned 0x0 [0051.119] ReadFile (in: hFile=0x1a0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x692, lpOverlapped=0x0) returned 1 [0051.120] WriteFile (in: hFile=0x1b8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0051.121] ReadFile (in: hFile=0x1a0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.121] WriteFile (in: hFile=0x1b8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0051.121] SetEndOfFile (hFile=0x1b8) returned 1 [0051.121] CloseHandle (hObject=0x1b8) returned 1 [0051.122] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.122] SetEndOfFile (hFile=0x1a0) returned 1 [0051.123] CloseHandle (hObject=0x1a0) returned 1 [0051.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0051.123] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0051.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.123] lstrlenW (lpString=".doc") returned 4 [0051.124] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.124] lstrlenW (lpString=".docx") returned 5 [0051.124] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0051.124] lstrlenW (lpString=".pdf") returned 4 [0051.124] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.124] lstrlenW (lpString=".xls") returned 4 [0051.124] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.124] lstrlenW (lpString=".xlsx") returned 5 [0051.124] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0051.124] lstrlenW (lpString=".ppt") returned 4 [0051.124] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.124] lstrlenW (lpString=".zip") returned 4 [0051.124] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.124] lstrlenW (lpString=".rar") returned 4 [0051.124] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.124] lstrlenW (lpString=".bz2") returned 4 [0051.124] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.124] lstrlenW (lpString=".7z") returned 3 [0051.124] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.124] lstrlenW (lpString=".dbf") returned 4 [0051.124] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.124] lstrlenW (lpString=".1cd") returned 4 [0051.124] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.124] lstrlenW (lpString=".jpg") returned 4 [0051.124] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.125] lstrlenW (lpString=".doc") returned 4 [0051.125] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0051.125] lstrlenW (lpString=".docx") returned 5 [0051.125] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0051.125] lstrlenW (lpString=".pdf") returned 4 [0051.125] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0051.125] lstrlenW (lpString=".xls") returned 4 [0051.125] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0051.125] lstrlenW (lpString=".xlsx") returned 5 [0051.125] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0051.125] lstrlenW (lpString=".ppt") returned 4 [0051.125] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0051.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.125] lstrlenW (lpString=".zip") returned 4 [0051.125] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0051.125] lstrlenW (lpString=".rar") returned 4 [0051.125] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0051.125] lstrlenW (lpString=".bz2") returned 4 [0051.125] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0051.125] lstrlenW (lpString=".7z") returned 3 [0051.125] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0051.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.125] lstrlenW (lpString=".dbf") returned 4 [0051.125] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0051.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.125] lstrlenW (lpString=".1cd") returned 4 [0051.125] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0051.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0051.125] lstrlenW (lpString=".jpg") returned 4 [0051.125] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0051.126] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0051.126] lstrlenW (lpString="boxed-correct.avi") returned 17 [0051.126] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.127] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=89600) returned 1 [0051.127] CloseHandle (hObject=0x1a0) returned 1 [0051.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0051.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.127] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.128] lstrlenW (lpString=".doc") returned 4 [0051.128] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.128] lstrlenW (lpString=".docx") returned 5 [0051.128] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0051.128] lstrlenW (lpString=".pdf") returned 4 [0051.128] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.128] lstrlenW (lpString=".xls") returned 4 [0051.128] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.128] lstrlenW (lpString=".xlsx") returned 5 [0051.128] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0051.128] lstrlenW (lpString=".ppt") returned 4 [0051.128] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.128] lstrlenW (lpString=".zip") returned 4 [0051.128] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.128] lstrlenW (lpString=".rar") returned 4 [0051.128] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.128] lstrlenW (lpString=".bz2") returned 4 [0051.128] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.128] lstrlenW (lpString=".7z") returned 3 [0051.128] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.128] lstrlenW (lpString=".dbf") returned 4 [0051.128] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.128] lstrlenW (lpString=".1cd") returned 4 [0051.128] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.128] lstrlenW (lpString=".jpg") returned 4 [0051.129] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.129] lstrlenW (lpString=".doc") returned 4 [0051.129] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.129] lstrlenW (lpString=".docx") returned 5 [0051.129] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0051.129] lstrlenW (lpString=".pdf") returned 4 [0051.129] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.129] lstrlenW (lpString=".xls") returned 4 [0051.129] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.129] lstrlenW (lpString=".xlsx") returned 5 [0051.129] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0051.129] lstrlenW (lpString=".ppt") returned 4 [0051.129] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.129] lstrlenW (lpString=".zip") returned 4 [0051.129] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.129] lstrlenW (lpString=".rar") returned 4 [0051.130] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.130] lstrlenW (lpString=".bz2") returned 4 [0051.130] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.130] lstrlenW (lpString=".7z") returned 3 [0051.130] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.130] lstrlenW (lpString=".dbf") returned 4 [0051.130] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.130] lstrlenW (lpString=".1cd") returned 4 [0051.130] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0051.130] lstrlenW (lpString=".jpg") returned 4 [0051.130] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.130] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0051.130] lstrlenW (lpString="boxed-delete.avi") returned 16 [0051.130] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.131] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=31744) returned 1 [0051.131] CloseHandle (hObject=0x1b8) returned 1 [0051.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0051.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.131] lstrlenW (lpString=".doc") returned 4 [0051.132] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.132] lstrlenW (lpString=".docx") returned 5 [0051.132] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0051.132] lstrlenW (lpString=".pdf") returned 4 [0051.132] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.132] lstrlenW (lpString=".xls") returned 4 [0051.132] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.132] lstrlenW (lpString=".xlsx") returned 5 [0051.132] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0051.132] lstrlenW (lpString=".ppt") returned 4 [0051.132] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.132] lstrlenW (lpString=".zip") returned 4 [0051.132] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.132] lstrlenW (lpString=".rar") returned 4 [0051.132] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.132] lstrlenW (lpString=".bz2") returned 4 [0051.132] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.132] lstrlenW (lpString=".7z") returned 3 [0051.132] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.132] lstrlenW (lpString=".dbf") returned 4 [0051.132] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.132] lstrlenW (lpString=".1cd") returned 4 [0051.132] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.132] lstrlenW (lpString=".jpg") returned 4 [0051.132] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.132] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.133] lstrlenW (lpString=".doc") returned 4 [0051.133] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.133] lstrlenW (lpString=".docx") returned 5 [0051.133] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0051.133] lstrlenW (lpString=".pdf") returned 4 [0051.133] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.133] lstrlenW (lpString=".xls") returned 4 [0051.133] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.133] lstrlenW (lpString=".xlsx") returned 5 [0051.133] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0051.133] lstrlenW (lpString=".ppt") returned 4 [0051.133] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.133] lstrlenW (lpString=".zip") returned 4 [0051.133] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.133] lstrlenW (lpString=".rar") returned 4 [0051.133] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.133] lstrlenW (lpString=".bz2") returned 4 [0051.133] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.133] lstrlenW (lpString=".7z") returned 3 [0051.133] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.133] lstrlenW (lpString=".dbf") returned 4 [0051.133] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.133] lstrlenW (lpString=".1cd") returned 4 [0051.133] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.133] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0051.133] lstrlenW (lpString=".jpg") returned 4 [0051.133] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.134] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0051.134] lstrlenW (lpString="boxed-join.avi") returned 14 [0051.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.134] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=33280) returned 1 [0051.134] CloseHandle (hObject=0x1b8) returned 1 [0051.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0051.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.134] lstrlenW (lpString=".doc") returned 4 [0051.134] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.134] lstrlenW (lpString=".docx") returned 5 [0051.134] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0051.134] lstrlenW (lpString=".pdf") returned 4 [0051.134] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.135] lstrlenW (lpString=".xls") returned 4 [0051.135] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.135] lstrlenW (lpString=".xlsx") returned 5 [0051.135] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0051.135] lstrlenW (lpString=".ppt") returned 4 [0051.135] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.135] lstrlenW (lpString=".zip") returned 4 [0051.135] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.135] lstrlenW (lpString=".rar") returned 4 [0051.135] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.135] lstrlenW (lpString=".bz2") returned 4 [0051.135] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.135] lstrlenW (lpString=".7z") returned 3 [0051.135] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.135] lstrlenW (lpString=".dbf") returned 4 [0051.135] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.135] lstrlenW (lpString=".1cd") returned 4 [0051.135] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.135] lstrlenW (lpString=".jpg") returned 4 [0051.135] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.135] lstrlenW (lpString=".doc") returned 4 [0051.135] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.135] lstrlenW (lpString=".docx") returned 5 [0051.135] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0051.136] lstrlenW (lpString=".pdf") returned 4 [0051.136] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.136] lstrlenW (lpString=".xls") returned 4 [0051.136] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.136] lstrlenW (lpString=".xlsx") returned 5 [0051.136] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0051.136] lstrlenW (lpString=".ppt") returned 4 [0051.136] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.136] lstrlenW (lpString=".zip") returned 4 [0051.136] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.136] lstrlenW (lpString=".rar") returned 4 [0051.136] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.136] lstrlenW (lpString=".bz2") returned 4 [0051.136] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.136] lstrlenW (lpString=".7z") returned 3 [0051.136] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.136] lstrlenW (lpString=".dbf") returned 4 [0051.136] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.136] lstrlenW (lpString=".1cd") returned 4 [0051.136] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0051.136] lstrlenW (lpString=".jpg") returned 4 [0051.136] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.136] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0051.137] lstrlenW (lpString="boxed-split.avi") returned 15 [0051.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.137] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=62976) returned 1 [0051.137] CloseHandle (hObject=0x1b8) returned 1 [0051.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0051.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.137] lstrlenW (lpString=".doc") returned 4 [0051.137] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.137] lstrlenW (lpString=".docx") returned 5 [0051.137] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0051.137] lstrlenW (lpString=".pdf") returned 4 [0051.137] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.137] lstrlenW (lpString=".xls") returned 4 [0051.137] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.137] lstrlenW (lpString=".xlsx") returned 5 [0051.137] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0051.138] lstrlenW (lpString=".ppt") returned 4 [0051.138] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.138] lstrlenW (lpString=".zip") returned 4 [0051.138] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.138] lstrlenW (lpString=".rar") returned 4 [0051.138] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.138] lstrlenW (lpString=".bz2") returned 4 [0051.138] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.138] lstrlenW (lpString=".7z") returned 3 [0051.138] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.138] lstrlenW (lpString=".dbf") returned 4 [0051.138] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.138] lstrlenW (lpString=".1cd") returned 4 [0051.138] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.138] lstrlenW (lpString=".jpg") returned 4 [0051.138] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.138] lstrlenW (lpString=".doc") returned 4 [0051.138] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.138] lstrlenW (lpString=".docx") returned 5 [0051.138] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0051.139] lstrlenW (lpString=".pdf") returned 4 [0051.139] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.139] lstrlenW (lpString=".xls") returned 4 [0051.139] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.139] lstrlenW (lpString=".xlsx") returned 5 [0051.139] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0051.139] lstrlenW (lpString=".ppt") returned 4 [0051.139] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.139] lstrlenW (lpString=".zip") returned 4 [0051.139] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.139] lstrlenW (lpString=".rar") returned 4 [0051.139] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.139] lstrlenW (lpString=".bz2") returned 4 [0051.139] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.139] lstrlenW (lpString=".7z") returned 3 [0051.139] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.139] lstrlenW (lpString=".dbf") returned 4 [0051.139] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.139] lstrlenW (lpString=".1cd") returned 4 [0051.139] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0051.139] lstrlenW (lpString=".jpg") returned 4 [0051.140] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.140] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0051.140] lstrlenW (lpString="correct.avi") returned 11 [0051.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.140] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=197120) returned 1 [0051.140] CloseHandle (hObject=0x1b8) returned 1 [0051.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0051.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.141] lstrlenW (lpString=".doc") returned 4 [0051.141] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.141] lstrlenW (lpString=".docx") returned 5 [0051.141] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0051.141] lstrlenW (lpString=".pdf") returned 4 [0051.141] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.141] lstrlenW (lpString=".xls") returned 4 [0051.141] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.141] lstrlenW (lpString=".xlsx") returned 5 [0051.141] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0051.141] lstrlenW (lpString=".ppt") returned 4 [0051.141] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.141] lstrlenW (lpString=".zip") returned 4 [0051.141] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.141] lstrlenW (lpString=".rar") returned 4 [0051.141] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.141] lstrlenW (lpString=".bz2") returned 4 [0051.141] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.141] lstrlenW (lpString=".7z") returned 3 [0051.141] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.141] lstrlenW (lpString=".dbf") returned 4 [0051.141] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.141] lstrlenW (lpString=".1cd") returned 4 [0051.141] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.141] lstrlenW (lpString=".jpg") returned 4 [0051.141] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.142] lstrlenW (lpString=".doc") returned 4 [0051.142] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.142] lstrlenW (lpString=".docx") returned 5 [0051.142] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0051.142] lstrlenW (lpString=".pdf") returned 4 [0051.142] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.142] lstrlenW (lpString=".xls") returned 4 [0051.142] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.142] lstrlenW (lpString=".xlsx") returned 5 [0051.142] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0051.142] lstrlenW (lpString=".ppt") returned 4 [0051.142] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.142] lstrlenW (lpString=".zip") returned 4 [0051.142] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.142] lstrlenW (lpString=".rar") returned 4 [0051.142] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.142] lstrlenW (lpString=".bz2") returned 4 [0051.142] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.142] lstrlenW (lpString=".7z") returned 3 [0051.142] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.142] lstrlenW (lpString=".dbf") returned 4 [0051.142] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0051.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.142] lstrlenW (lpString=".1cd") returned 4 [0051.142] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0051.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0051.143] lstrlenW (lpString=".jpg") returned 4 [0051.143] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0051.143] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0051.143] lstrlenW (lpString="delete.avi") returned 10 [0051.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0051.144] GetFileSizeEx (in: hFile=0x1b8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=224256) returned 1 [0051.144] CloseHandle (hObject=0x1b8) returned 1 [0051.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0051.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0051.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0051.144] lstrlenW (lpString=".doc") returned 4 [0051.144] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0051.144] lstrlenW (lpString=".docx") returned 5 [0051.144] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0051.144] lstrlenW (lpString=".pdf") returned 4 [0051.144] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0051.144] lstrlenW (lpString=".xls") returned 4 [0051.144] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0051.144] lstrlenW (lpString=".xlsx") returned 5 [0051.144] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0051.144] lstrlenW (lpString=".ppt") returned 4 [0051.144] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0051.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0051.144] lstrlenW (lpString=".zip") returned 4 [0051.144] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0051.145] lstrlenW (lpString=".rar") returned 4 [0051.145] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0051.145] lstrlenW (lpString=".bz2") returned 4 [0051.145] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0051.145] lstrlenW (lpString=".7z") returned 3 [0051.145] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0051.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0051.145] lstrlenW (lpString=".dbf") returned 4 [0051.145] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0052.051] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0053.662] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0053.663] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.663] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.663] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.664] GetLastError () returned 0x0 [0053.664] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x545, lpOverlapped=0x0) returned 1 [0053.665] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x550, lpOverlapped=0x0) returned 1 [0053.666] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.666] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0053.666] SetEndOfFile (hFile=0x1f0) returned 1 [0053.667] CloseHandle (hObject=0x1f0) returned 1 [0053.667] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.667] SetEndOfFile (hFile=0x1ec) returned 1 [0053.668] CloseHandle (hObject=0x1ec) returned 1 [0053.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.669] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0053.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.669] lstrlenW (lpString=".doc") returned 4 [0053.669] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.669] lstrlenW (lpString=".docx") returned 5 [0053.669] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0053.669] lstrlenW (lpString=".pdf") returned 4 [0053.669] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.669] lstrlenW (lpString=".xls") returned 4 [0053.669] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.669] lstrlenW (lpString=".xlsx") returned 5 [0053.669] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0053.669] lstrlenW (lpString=".ppt") returned 4 [0053.669] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.669] lstrlenW (lpString=".zip") returned 4 [0053.669] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.669] lstrlenW (lpString=".rar") returned 4 [0053.669] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.669] lstrlenW (lpString=".bz2") returned 4 [0053.669] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.669] lstrlenW (lpString=".7z") returned 3 [0053.670] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.670] lstrlenW (lpString=".dbf") returned 4 [0053.670] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.670] lstrlenW (lpString=".1cd") returned 4 [0053.670] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.670] lstrlenW (lpString=".jpg") returned 4 [0053.670] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.670] lstrlenW (lpString=".doc") returned 4 [0053.670] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.670] lstrlenW (lpString=".docx") returned 5 [0053.670] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0053.670] lstrlenW (lpString=".pdf") returned 4 [0053.670] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.670] lstrlenW (lpString=".xls") returned 4 [0053.670] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.670] lstrlenW (lpString=".xlsx") returned 5 [0053.670] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0053.670] lstrlenW (lpString=".ppt") returned 4 [0053.670] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.670] lstrlenW (lpString=".zip") returned 4 [0053.670] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.670] lstrlenW (lpString=".rar") returned 4 [0053.670] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.670] lstrlenW (lpString=".bz2") returned 4 [0053.670] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.671] lstrlenW (lpString=".7z") returned 3 [0053.671] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.671] lstrlenW (lpString=".dbf") returned 4 [0053.671] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.671] lstrlenW (lpString=".1cd") returned 4 [0053.671] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0053.671] lstrlenW (lpString=".jpg") returned 4 [0053.671] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.671] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0053.671] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0053.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.672] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=819) returned 1 [0053.672] CloseHandle (hObject=0x1ec) returned 1 [0053.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0053.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.672] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.672] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.673] GetLastError () returned 0x0 [0053.673] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x333, lpOverlapped=0x0) returned 1 [0053.674] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x340, lpOverlapped=0x0) returned 1 [0053.675] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.675] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0053.675] SetEndOfFile (hFile=0x1f0) returned 1 [0053.675] CloseHandle (hObject=0x1f0) returned 1 [0053.676] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.676] SetEndOfFile (hFile=0x1ec) returned 1 [0053.677] CloseHandle (hObject=0x1ec) returned 1 [0053.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.677] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0053.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.677] lstrlenW (lpString=".doc") returned 4 [0053.677] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.677] lstrlenW (lpString=".docx") returned 5 [0053.678] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0053.678] lstrlenW (lpString=".pdf") returned 4 [0053.678] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.678] lstrlenW (lpString=".xls") returned 4 [0053.678] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.678] lstrlenW (lpString=".xlsx") returned 5 [0053.678] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0053.678] lstrlenW (lpString=".ppt") returned 4 [0053.678] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.678] lstrlenW (lpString=".zip") returned 4 [0053.678] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.678] lstrlenW (lpString=".rar") returned 4 [0053.678] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.678] lstrlenW (lpString=".bz2") returned 4 [0053.678] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.678] lstrlenW (lpString=".7z") returned 3 [0053.678] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.678] lstrlenW (lpString=".dbf") returned 4 [0053.678] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.678] lstrlenW (lpString=".1cd") returned 4 [0053.678] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.678] lstrlenW (lpString=".jpg") returned 4 [0053.678] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.678] lstrlenW (lpString=".doc") returned 4 [0053.678] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.678] lstrlenW (lpString=".docx") returned 5 [0053.679] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0053.679] lstrlenW (lpString=".pdf") returned 4 [0053.679] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.679] lstrlenW (lpString=".xls") returned 4 [0053.679] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.679] lstrlenW (lpString=".xlsx") returned 5 [0053.679] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0053.679] lstrlenW (lpString=".ppt") returned 4 [0053.679] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.679] lstrlenW (lpString=".zip") returned 4 [0053.679] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.679] lstrlenW (lpString=".rar") returned 4 [0053.679] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.679] lstrlenW (lpString=".bz2") returned 4 [0053.679] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.679] lstrlenW (lpString=".7z") returned 3 [0053.679] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.679] lstrlenW (lpString=".dbf") returned 4 [0053.679] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.679] lstrlenW (lpString=".1cd") returned 4 [0053.679] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0053.679] lstrlenW (lpString=".jpg") returned 4 [0053.679] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.679] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0053.680] lstrlenW (lpString="SETUP.XML") returned 9 [0053.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.680] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2624) returned 1 [0053.680] CloseHandle (hObject=0x1ec) returned 1 [0053.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0053.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.681] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.681] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.681] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.681] GetLastError () returned 0x0 [0053.681] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa40, lpOverlapped=0x0) returned 1 [0053.682] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0053.683] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.683] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.684] SetEndOfFile (hFile=0x1f0) returned 1 [0053.684] CloseHandle (hObject=0x1f0) returned 1 [0053.684] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.684] SetEndOfFile (hFile=0x1ec) returned 1 [0053.685] CloseHandle (hObject=0x1ec) returned 1 [0053.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.685] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0053.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.686] lstrlenW (lpString=".doc") returned 4 [0053.686] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.686] lstrlenW (lpString=".docx") returned 5 [0053.686] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0053.686] lstrlenW (lpString=".pdf") returned 4 [0053.686] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.686] lstrlenW (lpString=".xls") returned 4 [0053.686] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.686] lstrlenW (lpString=".xlsx") returned 5 [0053.686] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0053.686] lstrlenW (lpString=".ppt") returned 4 [0053.686] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.686] lstrlenW (lpString=".zip") returned 4 [0053.686] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.686] lstrlenW (lpString=".rar") returned 4 [0053.686] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.686] lstrlenW (lpString=".bz2") returned 4 [0053.686] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.686] lstrlenW (lpString=".7z") returned 3 [0053.686] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.687] lstrlenW (lpString=".dbf") returned 4 [0053.687] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.687] lstrlenW (lpString=".1cd") returned 4 [0053.687] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.687] lstrlenW (lpString=".jpg") returned 4 [0053.687] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.687] lstrlenW (lpString=".doc") returned 4 [0053.687] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.687] lstrlenW (lpString=".docx") returned 5 [0053.687] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0053.687] lstrlenW (lpString=".pdf") returned 4 [0053.687] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.687] lstrlenW (lpString=".xls") returned 4 [0053.687] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.687] lstrlenW (lpString=".xlsx") returned 5 [0053.687] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0053.687] lstrlenW (lpString=".ppt") returned 4 [0053.687] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.687] lstrlenW (lpString=".zip") returned 4 [0053.687] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.687] lstrlenW (lpString=".rar") returned 4 [0053.687] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.687] lstrlenW (lpString=".bz2") returned 4 [0053.688] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.688] lstrlenW (lpString=".7z") returned 3 [0053.688] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.688] lstrlenW (lpString=".dbf") returned 4 [0053.688] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.688] lstrlenW (lpString=".1cd") returned 4 [0053.688] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0053.688] lstrlenW (lpString=".jpg") returned 4 [0053.688] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.688] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0053.688] lstrlenW (lpString="SETUP.XML") returned 9 [0053.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.702] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2296) returned 1 [0053.721] CloseHandle (hObject=0x1f4) returned 1 [0053.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0053.721] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.722] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.722] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.722] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.723] GetLastError () returned 0x0 [0053.723] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0053.725] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x900, lpOverlapped=0x0) returned 1 [0053.726] ReadFile (in: hFile=0x1f4, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.726] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.726] SetEndOfFile (hFile=0x1f0) returned 1 [0053.726] CloseHandle (hObject=0x1f0) returned 1 [0053.727] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.727] SetEndOfFile (hFile=0x1f4) returned 1 [0053.728] CloseHandle (hObject=0x1f4) returned 1 [0053.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.728] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0053.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.728] lstrlenW (lpString=".doc") returned 4 [0053.728] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.728] lstrlenW (lpString=".docx") returned 5 [0053.728] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0053.728] lstrlenW (lpString=".pdf") returned 4 [0053.728] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.729] lstrlenW (lpString=".xls") returned 4 [0053.729] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.729] lstrlenW (lpString=".xlsx") returned 5 [0053.729] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0053.729] lstrlenW (lpString=".ppt") returned 4 [0053.729] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.729] lstrlenW (lpString=".zip") returned 4 [0053.729] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.729] lstrlenW (lpString=".rar") returned 4 [0053.729] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.729] lstrlenW (lpString=".bz2") returned 4 [0053.729] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.729] lstrlenW (lpString=".7z") returned 3 [0053.729] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.729] lstrlenW (lpString=".dbf") returned 4 [0053.729] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.729] lstrlenW (lpString=".1cd") returned 4 [0053.729] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.729] lstrlenW (lpString=".jpg") returned 4 [0053.729] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.729] lstrlenW (lpString=".doc") returned 4 [0053.729] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.729] lstrlenW (lpString=".docx") returned 5 [0053.730] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0053.730] lstrlenW (lpString=".pdf") returned 4 [0053.730] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.730] lstrlenW (lpString=".xls") returned 4 [0053.730] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.730] lstrlenW (lpString=".xlsx") returned 5 [0053.730] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0053.730] lstrlenW (lpString=".ppt") returned 4 [0053.730] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.730] lstrlenW (lpString=".zip") returned 4 [0053.730] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.730] lstrlenW (lpString=".rar") returned 4 [0053.730] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.730] lstrlenW (lpString=".bz2") returned 4 [0053.730] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.730] lstrlenW (lpString=".7z") returned 3 [0053.730] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.730] lstrlenW (lpString=".dbf") returned 4 [0053.730] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.730] lstrlenW (lpString=".1cd") returned 4 [0053.730] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0053.730] lstrlenW (lpString=".jpg") returned 4 [0053.730] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.730] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0053.731] lstrlenW (lpString="SETUP.XML") returned 9 [0053.731] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.198] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1852) returned 1 [0054.198] CloseHandle (hObject=0x208) returned 1 [0054.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0054.199] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.199] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.199] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.199] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.421] GetLastError () returned 0x0 [0054.421] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x73c, lpOverlapped=0x0) returned 1 [0054.432] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x740, lpOverlapped=0x0) returned 1 [0054.435] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.435] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.435] SetEndOfFile (hFile=0x180) returned 1 [0054.435] CloseHandle (hObject=0x180) returned 1 [0054.437] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.438] SetEndOfFile (hFile=0x208) returned 1 [0054.439] CloseHandle (hObject=0x208) returned 1 [0054.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.439] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0054.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.440] lstrlenW (lpString=".doc") returned 4 [0054.440] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.440] lstrlenW (lpString=".docx") returned 5 [0054.440] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.440] lstrlenW (lpString=".pdf") returned 4 [0054.440] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.440] lstrlenW (lpString=".xls") returned 4 [0054.440] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.440] lstrlenW (lpString=".xlsx") returned 5 [0054.440] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.440] lstrlenW (lpString=".ppt") returned 4 [0054.440] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.440] lstrlenW (lpString=".zip") returned 4 [0054.440] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.440] lstrlenW (lpString=".rar") returned 4 [0054.441] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.441] lstrlenW (lpString=".bz2") returned 4 [0054.441] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.441] lstrlenW (lpString=".7z") returned 3 [0054.441] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.441] lstrlenW (lpString=".dbf") returned 4 [0054.441] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.441] lstrlenW (lpString=".1cd") returned 4 [0054.441] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.441] lstrlenW (lpString=".jpg") returned 4 [0054.441] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.441] lstrlenW (lpString=".doc") returned 4 [0054.441] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.441] lstrlenW (lpString=".docx") returned 5 [0054.441] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.441] lstrlenW (lpString=".pdf") returned 4 [0054.441] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.441] lstrlenW (lpString=".xls") returned 4 [0054.441] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.441] lstrlenW (lpString=".xlsx") returned 5 [0054.441] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.441] lstrlenW (lpString=".ppt") returned 4 [0054.441] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.441] lstrlenW (lpString=".zip") returned 4 [0054.441] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.441] lstrlenW (lpString=".rar") returned 4 [0054.442] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.442] lstrlenW (lpString=".bz2") returned 4 [0054.442] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.442] lstrlenW (lpString=".7z") returned 3 [0054.442] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.442] lstrlenW (lpString=".dbf") returned 4 [0054.442] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.442] lstrlenW (lpString=".1cd") returned 4 [0054.442] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0054.442] lstrlenW (lpString=".jpg") returned 4 [0054.442] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.442] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0054.442] lstrlenW (lpString="PSS10O.CHM") returned 10 [0054.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.443] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=26929) returned 1 [0054.443] CloseHandle (hObject=0x208) returned 1 [0054.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0054.443] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.443] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.444] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.444] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.444] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.444] GetLastError () returned 0x0 [0054.444] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x6931, lpOverlapped=0x0) returned 1 [0054.446] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0054.448] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.448] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0054.448] SetEndOfFile (hFile=0x180) returned 1 [0054.448] CloseHandle (hObject=0x180) returned 1 [0054.449] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.449] SetEndOfFile (hFile=0x208) returned 1 [0054.450] CloseHandle (hObject=0x208) returned 1 [0054.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.450] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0054.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.451] lstrlenW (lpString=".doc") returned 4 [0054.451] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0054.451] lstrlenW (lpString=".docx") returned 5 [0054.451] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0054.451] lstrlenW (lpString=".pdf") returned 4 [0054.451] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0054.451] lstrlenW (lpString=".xls") returned 4 [0054.451] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0054.451] lstrlenW (lpString=".xlsx") returned 5 [0054.451] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0054.451] lstrlenW (lpString=".ppt") returned 4 [0054.451] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0054.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.451] lstrlenW (lpString=".zip") returned 4 [0054.451] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0054.451] lstrlenW (lpString=".rar") returned 4 [0054.451] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0054.451] lstrlenW (lpString=".bz2") returned 4 [0054.451] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0054.451] lstrlenW (lpString=".7z") returned 3 [0054.451] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0054.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.451] lstrlenW (lpString=".dbf") returned 4 [0054.451] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0054.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.451] lstrlenW (lpString=".1cd") returned 4 [0054.451] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0054.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.452] lstrlenW (lpString=".jpg") returned 4 [0054.452] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0054.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.452] lstrlenW (lpString=".doc") returned 4 [0054.452] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0054.452] lstrlenW (lpString=".docx") returned 5 [0054.452] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0054.452] lstrlenW (lpString=".pdf") returned 4 [0054.452] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0054.452] lstrlenW (lpString=".xls") returned 4 [0054.452] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0054.452] lstrlenW (lpString=".xlsx") returned 5 [0054.452] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0054.452] lstrlenW (lpString=".ppt") returned 4 [0054.452] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0054.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.452] lstrlenW (lpString=".zip") returned 4 [0054.452] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0054.452] lstrlenW (lpString=".rar") returned 4 [0054.452] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0054.452] lstrlenW (lpString=".bz2") returned 4 [0054.452] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0054.453] lstrlenW (lpString=".7z") returned 3 [0054.453] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0054.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.453] lstrlenW (lpString=".dbf") returned 4 [0054.453] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0054.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.453] lstrlenW (lpString=".1cd") returned 4 [0054.453] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0054.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0054.453] lstrlenW (lpString=".jpg") returned 4 [0054.453] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0054.453] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0054.453] lstrlenW (lpString="PSS10R.CHM") returned 10 [0054.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.454] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=27195) returned 1 [0054.454] CloseHandle (hObject=0x208) returned 1 [0054.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0054.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.454] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.455] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.455] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.455] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.455] GetLastError () returned 0x0 [0054.455] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0054.775] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0054.776] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.776] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0054.777] SetEndOfFile (hFile=0x180) returned 1 [0054.792] CloseHandle (hObject=0x180) returned 1 [0054.811] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.811] SetEndOfFile (hFile=0x208) returned 1 [0054.812] CloseHandle (hObject=0x208) returned 1 [0054.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.812] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0054.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.813] lstrlenW (lpString=".doc") returned 4 [0054.813] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0054.813] lstrlenW (lpString=".docx") returned 5 [0054.813] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0054.813] lstrlenW (lpString=".pdf") returned 4 [0054.813] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0054.813] lstrlenW (lpString=".xls") returned 4 [0054.813] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0054.813] lstrlenW (lpString=".xlsx") returned 5 [0054.813] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0054.813] lstrlenW (lpString=".ppt") returned 4 [0054.813] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0054.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.813] lstrlenW (lpString=".zip") returned 4 [0054.813] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0054.813] lstrlenW (lpString=".rar") returned 4 [0054.813] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0054.813] lstrlenW (lpString=".bz2") returned 4 [0054.813] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0054.813] lstrlenW (lpString=".7z") returned 3 [0054.813] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0054.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.813] lstrlenW (lpString=".dbf") returned 4 [0054.813] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0054.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.813] lstrlenW (lpString=".1cd") returned 4 [0054.813] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0054.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.814] lstrlenW (lpString=".jpg") returned 4 [0054.814] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0054.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.814] lstrlenW (lpString=".doc") returned 4 [0054.814] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0054.814] lstrlenW (lpString=".docx") returned 5 [0054.814] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0054.814] lstrlenW (lpString=".pdf") returned 4 [0054.814] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0054.814] lstrlenW (lpString=".xls") returned 4 [0054.814] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0054.814] lstrlenW (lpString=".xlsx") returned 5 [0054.814] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0054.814] lstrlenW (lpString=".ppt") returned 4 [0054.814] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0054.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.814] lstrlenW (lpString=".zip") returned 4 [0054.814] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0054.814] lstrlenW (lpString=".rar") returned 4 [0054.814] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0054.814] lstrlenW (lpString=".bz2") returned 4 [0054.814] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0054.814] lstrlenW (lpString=".7z") returned 3 [0054.814] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0054.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.814] lstrlenW (lpString=".dbf") returned 4 [0054.814] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0054.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.814] lstrlenW (lpString=".1cd") returned 4 [0054.815] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0054.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0054.815] lstrlenW (lpString=".jpg") returned 4 [0054.815] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0054.815] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.815] lstrlenW (lpString="SETUP.XML") returned 9 [0054.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.815] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2362) returned 1 [0054.815] CloseHandle (hObject=0x208) returned 1 [0054.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0054.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.816] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.816] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.816] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.816] GetLastError () returned 0x0 [0054.816] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x93a, lpOverlapped=0x0) returned 1 [0054.820] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x940, lpOverlapped=0x0) returned 1 [0054.821] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.821] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.821] SetEndOfFile (hFile=0x180) returned 1 [0054.821] CloseHandle (hObject=0x180) returned 1 [0054.822] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.822] SetEndOfFile (hFile=0x208) returned 1 [0054.823] CloseHandle (hObject=0x208) returned 1 [0054.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.823] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0054.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.823] lstrlenW (lpString=".doc") returned 4 [0054.823] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.823] lstrlenW (lpString=".docx") returned 5 [0054.823] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.823] lstrlenW (lpString=".pdf") returned 4 [0054.823] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.823] lstrlenW (lpString=".xls") returned 4 [0054.823] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.823] lstrlenW (lpString=".xlsx") returned 5 [0054.823] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.823] lstrlenW (lpString=".ppt") returned 4 [0054.823] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.824] lstrlenW (lpString=".zip") returned 4 [0054.824] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.824] lstrlenW (lpString=".rar") returned 4 [0054.824] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.824] lstrlenW (lpString=".bz2") returned 4 [0054.824] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.824] lstrlenW (lpString=".7z") returned 3 [0054.824] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.824] lstrlenW (lpString=".dbf") returned 4 [0054.824] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.824] lstrlenW (lpString=".1cd") returned 4 [0054.824] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.824] lstrlenW (lpString=".jpg") returned 4 [0054.824] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.824] lstrlenW (lpString=".doc") returned 4 [0054.824] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.824] lstrlenW (lpString=".docx") returned 5 [0054.824] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.824] lstrlenW (lpString=".pdf") returned 4 [0054.824] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.824] lstrlenW (lpString=".xls") returned 4 [0054.824] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.824] lstrlenW (lpString=".xlsx") returned 5 [0054.824] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.824] lstrlenW (lpString=".ppt") returned 4 [0054.824] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.825] lstrlenW (lpString=".zip") returned 4 [0054.825] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.825] lstrlenW (lpString=".rar") returned 4 [0054.825] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.825] lstrlenW (lpString=".bz2") returned 4 [0054.825] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.825] lstrlenW (lpString=".7z") returned 3 [0054.825] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.825] lstrlenW (lpString=".dbf") returned 4 [0054.825] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.825] lstrlenW (lpString=".1cd") returned 4 [0054.825] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0054.825] lstrlenW (lpString=".jpg") returned 4 [0054.825] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.825] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.825] lstrlenW (lpString="Office32WW.XML") returned 14 [0054.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.828] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4274) returned 1 [0054.828] CloseHandle (hObject=0x208) returned 1 [0054.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0054.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.829] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.829] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0054.829] GetLastError () returned 0x0 [0054.829] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0054.841] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0054.842] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.842] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0054.842] SetEndOfFile (hFile=0x180) returned 1 [0054.842] CloseHandle (hObject=0x180) returned 1 [0054.843] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.843] SetEndOfFile (hFile=0x208) returned 1 [0054.844] CloseHandle (hObject=0x208) returned 1 [0054.844] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.844] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0054.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.844] lstrlenW (lpString=".doc") returned 4 [0054.845] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.845] lstrlenW (lpString=".docx") returned 5 [0054.845] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0054.845] lstrlenW (lpString=".pdf") returned 4 [0054.845] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.845] lstrlenW (lpString=".xls") returned 4 [0054.845] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.845] lstrlenW (lpString=".xlsx") returned 5 [0054.845] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0054.845] lstrlenW (lpString=".ppt") returned 4 [0054.845] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.845] lstrlenW (lpString=".zip") returned 4 [0054.845] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.845] lstrlenW (lpString=".rar") returned 4 [0054.845] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.845] lstrlenW (lpString=".bz2") returned 4 [0054.845] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.845] lstrlenW (lpString=".7z") returned 3 [0054.845] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.845] lstrlenW (lpString=".dbf") returned 4 [0054.845] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.845] lstrlenW (lpString=".1cd") returned 4 [0054.845] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.845] lstrlenW (lpString=".jpg") returned 4 [0054.845] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.845] lstrlenW (lpString=".doc") returned 4 [0054.846] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.846] lstrlenW (lpString=".docx") returned 5 [0054.846] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0054.846] lstrlenW (lpString=".pdf") returned 4 [0054.846] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.846] lstrlenW (lpString=".xls") returned 4 [0054.846] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.846] lstrlenW (lpString=".xlsx") returned 5 [0054.846] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0054.846] lstrlenW (lpString=".ppt") returned 4 [0054.846] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.846] lstrlenW (lpString=".zip") returned 4 [0054.846] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.846] lstrlenW (lpString=".rar") returned 4 [0054.846] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.846] lstrlenW (lpString=".bz2") returned 4 [0054.846] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.846] lstrlenW (lpString=".7z") returned 3 [0054.846] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.846] lstrlenW (lpString=".dbf") returned 4 [0054.846] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.846] lstrlenW (lpString=".1cd") returned 4 [0054.846] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0054.846] lstrlenW (lpString=".jpg") returned 4 [0054.846] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.847] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.847] lstrlenW (lpString="SETUP.XML") returned 9 [0054.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.902] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1988) returned 1 [0054.902] CloseHandle (hObject=0x208) returned 1 [0054.903] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0054.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.912] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.912] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.912] GetLastError () returned 0x0 [0054.919] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0054.923] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0054.924] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.924] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.924] SetEndOfFile (hFile=0x1ec) returned 1 [0054.924] CloseHandle (hObject=0x1ec) returned 1 [0054.931] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.931] SetEndOfFile (hFile=0x208) returned 1 [0054.932] CloseHandle (hObject=0x208) returned 1 [0054.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.932] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0054.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.932] lstrlenW (lpString=".doc") returned 4 [0054.932] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.932] lstrlenW (lpString=".docx") returned 5 [0054.932] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.933] lstrlenW (lpString=".pdf") returned 4 [0054.933] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.933] lstrlenW (lpString=".xls") returned 4 [0054.933] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.933] lstrlenW (lpString=".xlsx") returned 5 [0054.933] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.933] lstrlenW (lpString=".ppt") returned 4 [0054.933] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.933] lstrlenW (lpString=".zip") returned 4 [0054.933] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.933] lstrlenW (lpString=".rar") returned 4 [0054.933] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.933] lstrlenW (lpString=".bz2") returned 4 [0054.933] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.933] lstrlenW (lpString=".7z") returned 3 [0054.933] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.933] lstrlenW (lpString=".dbf") returned 4 [0054.933] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.933] lstrlenW (lpString=".1cd") returned 4 [0054.933] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.933] lstrlenW (lpString=".jpg") returned 4 [0054.933] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.933] lstrlenW (lpString=".doc") returned 4 [0054.933] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.933] lstrlenW (lpString=".docx") returned 5 [0054.933] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.933] lstrlenW (lpString=".pdf") returned 4 [0054.934] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.934] lstrlenW (lpString=".xls") returned 4 [0054.934] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.934] lstrlenW (lpString=".xlsx") returned 5 [0054.934] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.934] lstrlenW (lpString=".ppt") returned 4 [0054.934] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.934] lstrlenW (lpString=".zip") returned 4 [0054.934] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.934] lstrlenW (lpString=".rar") returned 4 [0054.934] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.934] lstrlenW (lpString=".bz2") returned 4 [0054.934] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.934] lstrlenW (lpString=".7z") returned 3 [0054.934] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.934] lstrlenW (lpString=".dbf") returned 4 [0054.934] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.934] lstrlenW (lpString=".1cd") returned 4 [0054.934] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.934] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0054.934] lstrlenW (lpString=".jpg") returned 4 [0054.934] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.934] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.934] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0054.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.280] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6421) returned 1 [0055.280] CloseHandle (hObject=0x214) returned 1 [0055.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0055.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.281] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.281] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0055.546] GetLastError () returned 0x0 [0055.555] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1915, lpOverlapped=0x0) returned 1 [0055.733] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0055.735] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.735] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0055.735] SetEndOfFile (hFile=0x1e4) returned 1 [0055.735] CloseHandle (hObject=0x1e4) returned 1 [0055.735] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.736] SetEndOfFile (hFile=0x214) returned 1 [0055.736] CloseHandle (hObject=0x214) returned 1 [0055.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.737] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0055.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.737] lstrlenW (lpString=".doc") returned 4 [0055.737] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.737] lstrlenW (lpString=".docx") returned 5 [0055.737] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0055.737] lstrlenW (lpString=".pdf") returned 4 [0055.737] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.737] lstrlenW (lpString=".xls") returned 4 [0055.737] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.737] lstrlenW (lpString=".xlsx") returned 5 [0055.737] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0055.737] lstrlenW (lpString=".ppt") returned 4 [0055.737] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.737] lstrlenW (lpString=".zip") returned 4 [0055.737] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.737] lstrlenW (lpString=".rar") returned 4 [0055.737] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.737] lstrlenW (lpString=".bz2") returned 4 [0055.737] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.737] lstrlenW (lpString=".7z") returned 3 [0055.737] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.738] lstrlenW (lpString=".dbf") returned 4 [0055.738] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.738] lstrlenW (lpString=".1cd") returned 4 [0055.738] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.738] lstrlenW (lpString=".jpg") returned 4 [0055.738] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.738] lstrlenW (lpString=".doc") returned 4 [0055.738] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.738] lstrlenW (lpString=".docx") returned 5 [0055.738] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0055.738] lstrlenW (lpString=".pdf") returned 4 [0055.738] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.738] lstrlenW (lpString=".xls") returned 4 [0055.739] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.739] lstrlenW (lpString=".xlsx") returned 5 [0055.739] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0055.739] lstrlenW (lpString=".ppt") returned 4 [0055.739] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.739] lstrlenW (lpString=".zip") returned 4 [0055.739] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.739] lstrlenW (lpString=".rar") returned 4 [0055.739] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.739] lstrlenW (lpString=".bz2") returned 4 [0055.739] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.739] lstrlenW (lpString=".7z") returned 3 [0055.739] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.739] lstrlenW (lpString=".dbf") returned 4 [0055.739] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.739] lstrlenW (lpString=".1cd") returned 4 [0055.739] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0055.739] lstrlenW (lpString=".jpg") returned 4 [0055.739] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.739] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.739] lstrlenW (lpString="SETUP.XML") returned 9 [0055.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.740] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=31094) returned 1 [0055.740] CloseHandle (hObject=0x214) returned 1 [0055.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0055.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.740] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.740] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.740] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0055.990] GetLastError () returned 0x0 [0055.990] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7976, lpOverlapped=0x0) returned 1 [0055.992] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0055.993] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.993] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.993] SetEndOfFile (hFile=0x204) returned 1 [0055.993] CloseHandle (hObject=0x204) returned 1 [0055.994] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.994] SetEndOfFile (hFile=0x214) returned 1 [0055.995] CloseHandle (hObject=0x214) returned 1 [0055.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.996] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0055.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.996] lstrlenW (lpString=".doc") returned 4 [0055.996] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.996] lstrlenW (lpString=".docx") returned 5 [0055.996] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0055.996] lstrlenW (lpString=".pdf") returned 4 [0055.996] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.996] lstrlenW (lpString=".xls") returned 4 [0055.996] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.996] lstrlenW (lpString=".xlsx") returned 5 [0055.996] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0055.996] lstrlenW (lpString=".ppt") returned 4 [0055.996] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.996] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.996] lstrlenW (lpString=".zip") returned 4 [0055.996] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.996] lstrlenW (lpString=".rar") returned 4 [0055.996] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.997] lstrlenW (lpString=".bz2") returned 4 [0055.997] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.997] lstrlenW (lpString=".7z") returned 3 [0055.997] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.997] lstrlenW (lpString=".dbf") returned 4 [0055.997] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.997] lstrlenW (lpString=".1cd") returned 4 [0055.997] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.997] lstrlenW (lpString=".jpg") returned 4 [0055.997] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.997] lstrlenW (lpString=".doc") returned 4 [0055.997] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.997] lstrlenW (lpString=".docx") returned 5 [0055.997] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0055.997] lstrlenW (lpString=".pdf") returned 4 [0055.997] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.997] lstrlenW (lpString=".xls") returned 4 [0055.997] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.997] lstrlenW (lpString=".xlsx") returned 5 [0055.997] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0055.997] lstrlenW (lpString=".ppt") returned 4 [0055.997] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.997] lstrlenW (lpString=".zip") returned 4 [0055.997] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.997] lstrlenW (lpString=".rar") returned 4 [0055.997] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.997] lstrlenW (lpString=".bz2") returned 4 [0055.998] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.998] lstrlenW (lpString=".7z") returned 3 [0055.998] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.998] lstrlenW (lpString=".dbf") returned 4 [0055.998] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.998] lstrlenW (lpString=".1cd") returned 4 [0055.998] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0055.998] lstrlenW (lpString=".jpg") returned 4 [0055.998] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.998] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.998] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0055.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0055.998] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1450) returned 1 [0055.999] CloseHandle (hObject=0x214) returned 1 [0056.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0056.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.002] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.002] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0056.003] GetLastError () returned 0x0 [0056.003] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0056.005] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0056.006] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.006] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0056.006] SetEndOfFile (hFile=0x204) returned 1 [0056.006] CloseHandle (hObject=0x204) returned 1 [0056.007] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.007] SetEndOfFile (hFile=0x214) returned 1 [0056.008] CloseHandle (hObject=0x214) returned 1 [0056.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.008] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0056.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.008] lstrlenW (lpString=".doc") returned 4 [0056.008] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.008] lstrlenW (lpString=".docx") returned 5 [0056.009] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0056.009] lstrlenW (lpString=".pdf") returned 4 [0056.009] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.009] lstrlenW (lpString=".xls") returned 4 [0056.009] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.009] lstrlenW (lpString=".xlsx") returned 5 [0056.009] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0056.009] lstrlenW (lpString=".ppt") returned 4 [0056.009] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.009] lstrlenW (lpString=".zip") returned 4 [0056.009] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.009] lstrlenW (lpString=".rar") returned 4 [0056.009] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.009] lstrlenW (lpString=".bz2") returned 4 [0056.009] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.009] lstrlenW (lpString=".7z") returned 3 [0056.009] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.009] lstrlenW (lpString=".dbf") returned 4 [0056.009] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.009] lstrlenW (lpString=".1cd") returned 4 [0056.009] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.009] lstrlenW (lpString=".jpg") returned 4 [0056.009] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.009] lstrlenW (lpString=".doc") returned 4 [0056.009] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.009] lstrlenW (lpString=".docx") returned 5 [0056.009] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0056.010] lstrlenW (lpString=".pdf") returned 4 [0056.010] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.010] lstrlenW (lpString=".xls") returned 4 [0056.010] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.010] lstrlenW (lpString=".xlsx") returned 5 [0056.010] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0056.010] lstrlenW (lpString=".ppt") returned 4 [0056.010] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.010] lstrlenW (lpString=".zip") returned 4 [0056.010] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.010] lstrlenW (lpString=".rar") returned 4 [0056.010] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.010] lstrlenW (lpString=".bz2") returned 4 [0056.010] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.010] lstrlenW (lpString=".7z") returned 3 [0056.010] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.010] lstrlenW (lpString=".dbf") returned 4 [0056.010] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.010] lstrlenW (lpString=".1cd") returned 4 [0056.010] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.010] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0056.010] lstrlenW (lpString=".jpg") returned 4 [0056.010] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.010] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.010] lstrlenW (lpString="SETUP.XML") returned 9 [0056.011] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0056.011] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1608) returned 1 [0056.011] CloseHandle (hObject=0x1d8) returned 1 [0056.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0056.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0056.012] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.012] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.012] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.012] GetLastError () returned 0x0 [0056.012] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x648, lpOverlapped=0x0) returned 1 [0056.015] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x650, lpOverlapped=0x0) returned 1 [0056.016] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.016] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.017] SetEndOfFile (hFile=0x214) returned 1 [0056.017] CloseHandle (hObject=0x214) returned 1 [0056.017] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.017] SetEndOfFile (hFile=0x1d8) returned 1 [0056.018] CloseHandle (hObject=0x1d8) returned 1 [0056.018] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.018] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0056.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.019] lstrlenW (lpString=".doc") returned 4 [0056.019] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.019] lstrlenW (lpString=".docx") returned 5 [0056.019] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.019] lstrlenW (lpString=".pdf") returned 4 [0056.019] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.019] lstrlenW (lpString=".xls") returned 4 [0056.019] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.019] lstrlenW (lpString=".xlsx") returned 5 [0056.019] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.019] lstrlenW (lpString=".ppt") returned 4 [0056.019] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.019] lstrlenW (lpString=".zip") returned 4 [0056.019] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.019] lstrlenW (lpString=".rar") returned 4 [0056.019] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.019] lstrlenW (lpString=".bz2") returned 4 [0056.019] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.019] lstrlenW (lpString=".7z") returned 3 [0056.019] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.019] lstrlenW (lpString=".dbf") returned 4 [0056.019] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.019] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.019] lstrlenW (lpString=".1cd") returned 4 [0056.020] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.020] lstrlenW (lpString=".jpg") returned 4 [0056.020] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.020] lstrlenW (lpString=".doc") returned 4 [0056.020] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.020] lstrlenW (lpString=".docx") returned 5 [0056.020] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.020] lstrlenW (lpString=".pdf") returned 4 [0056.020] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.020] lstrlenW (lpString=".xls") returned 4 [0056.020] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.020] lstrlenW (lpString=".xlsx") returned 5 [0056.020] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.020] lstrlenW (lpString=".ppt") returned 4 [0056.020] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.020] lstrlenW (lpString=".zip") returned 4 [0056.020] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.020] lstrlenW (lpString=".rar") returned 4 [0056.020] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.020] lstrlenW (lpString=".bz2") returned 4 [0056.020] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.020] lstrlenW (lpString=".7z") returned 3 [0056.020] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.020] lstrlenW (lpString=".dbf") returned 4 [0056.020] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.020] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.020] lstrlenW (lpString=".1cd") returned 4 [0056.020] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0056.021] lstrlenW (lpString=".jpg") returned 4 [0056.021] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.021] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.021] lstrlenW (lpString="SETUP.XML") returned 9 [0056.021] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0056.022] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=6241) returned 1 [0056.022] CloseHandle (hObject=0x1d8) returned 1 [0056.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0056.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0056.022] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.022] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.022] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.022] GetLastError () returned 0x0 [0056.022] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1861, lpOverlapped=0x0) returned 1 [0056.024] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0056.031] ReadFile (in: hFile=0x1d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.031] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.031] SetEndOfFile (hFile=0x214) returned 1 [0056.032] CloseHandle (hObject=0x214) returned 1 [0056.032] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.032] SetEndOfFile (hFile=0x1d8) returned 1 [0056.033] CloseHandle (hObject=0x1d8) returned 1 [0056.033] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.033] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0056.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.034] lstrlenW (lpString=".doc") returned 4 [0056.034] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.034] lstrlenW (lpString=".docx") returned 5 [0056.034] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.034] lstrlenW (lpString=".pdf") returned 4 [0056.034] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.034] lstrlenW (lpString=".xls") returned 4 [0056.034] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.034] lstrlenW (lpString=".xlsx") returned 5 [0056.034] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.034] lstrlenW (lpString=".ppt") returned 4 [0056.034] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.034] lstrlenW (lpString=".zip") returned 4 [0056.034] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.034] lstrlenW (lpString=".rar") returned 4 [0056.034] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.034] lstrlenW (lpString=".bz2") returned 4 [0056.034] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.034] lstrlenW (lpString=".7z") returned 3 [0056.034] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.034] lstrlenW (lpString=".dbf") returned 4 [0056.034] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.034] lstrlenW (lpString=".1cd") returned 4 [0056.034] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.034] lstrlenW (lpString=".jpg") returned 4 [0056.034] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.035] lstrlenW (lpString=".doc") returned 4 [0056.035] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.035] lstrlenW (lpString=".docx") returned 5 [0056.035] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.035] lstrlenW (lpString=".pdf") returned 4 [0056.035] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.035] lstrlenW (lpString=".xls") returned 4 [0056.035] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.035] lstrlenW (lpString=".xlsx") returned 5 [0056.035] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.035] lstrlenW (lpString=".ppt") returned 4 [0056.035] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.035] lstrlenW (lpString=".zip") returned 4 [0056.035] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.035] lstrlenW (lpString=".rar") returned 4 [0056.035] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.035] lstrlenW (lpString=".bz2") returned 4 [0056.035] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.035] lstrlenW (lpString=".7z") returned 3 [0056.035] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.035] lstrlenW (lpString=".dbf") returned 4 [0056.035] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.035] lstrlenW (lpString=".1cd") returned 4 [0056.035] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0056.035] lstrlenW (lpString=".jpg") returned 4 [0056.035] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.036] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.036] lstrlenW (lpString="VisioMUI.XML") returned 12 [0056.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.309] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9503) returned 1 [0056.309] CloseHandle (hObject=0x20c) returned 1 [0056.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0056.309] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.309] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.309] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0056.389] GetLastError () returned 0x0 [0056.389] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x251f, lpOverlapped=0x0) returned 1 [0056.401] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0056.402] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.402] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.402] SetEndOfFile (hFile=0x1e4) returned 1 [0056.402] CloseHandle (hObject=0x1e4) returned 1 [0056.402] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.403] SetEndOfFile (hFile=0x20c) returned 1 [0056.403] CloseHandle (hObject=0x20c) returned 1 [0056.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.404] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0056.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.405] lstrlenW (lpString=".doc") returned 4 [0056.405] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.405] lstrlenW (lpString=".docx") returned 5 [0056.405] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0056.405] lstrlenW (lpString=".pdf") returned 4 [0056.405] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.405] lstrlenW (lpString=".xls") returned 4 [0056.405] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.405] lstrlenW (lpString=".xlsx") returned 5 [0056.405] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0056.405] lstrlenW (lpString=".ppt") returned 4 [0056.405] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.405] lstrlenW (lpString=".zip") returned 4 [0056.405] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.405] lstrlenW (lpString=".rar") returned 4 [0056.405] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.405] lstrlenW (lpString=".bz2") returned 4 [0056.405] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.405] lstrlenW (lpString=".7z") returned 3 [0056.405] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.405] lstrlenW (lpString=".dbf") returned 4 [0056.405] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.405] lstrlenW (lpString=".1cd") returned 4 [0056.405] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.405] lstrlenW (lpString=".jpg") returned 4 [0056.405] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.406] lstrlenW (lpString=".doc") returned 4 [0056.406] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.406] lstrlenW (lpString=".docx") returned 5 [0056.406] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0056.406] lstrlenW (lpString=".pdf") returned 4 [0056.406] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.406] lstrlenW (lpString=".xls") returned 4 [0056.406] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.406] lstrlenW (lpString=".xlsx") returned 5 [0056.406] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0056.406] lstrlenW (lpString=".ppt") returned 4 [0056.406] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.406] lstrlenW (lpString=".zip") returned 4 [0056.406] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.406] lstrlenW (lpString=".rar") returned 4 [0056.406] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.406] lstrlenW (lpString=".bz2") returned 4 [0056.406] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.406] lstrlenW (lpString=".7z") returned 3 [0056.406] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.406] lstrlenW (lpString=".dbf") returned 4 [0056.406] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.406] lstrlenW (lpString=".1cd") returned 4 [0056.406] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0056.406] lstrlenW (lpString=".jpg") returned 4 [0056.406] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.407] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.407] lstrlenW (lpString="DATES.XML") returned 9 [0056.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.407] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8918) returned 1 [0056.407] CloseHandle (hObject=0x20c) returned 1 [0056.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0056.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.407] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.407] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.419] GetLastError () returned 0x0 [0056.419] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0056.429] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0056.430] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.430] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.430] SetEndOfFile (hFile=0x180) returned 1 [0056.430] CloseHandle (hObject=0x180) returned 1 [0056.430] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.430] SetEndOfFile (hFile=0x20c) returned 1 [0056.431] CloseHandle (hObject=0x20c) returned 1 [0056.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.432] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0056.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.432] lstrlenW (lpString=".doc") returned 4 [0056.432] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.432] lstrlenW (lpString=".docx") returned 5 [0056.432] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0056.432] lstrlenW (lpString=".pdf") returned 4 [0056.432] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.432] lstrlenW (lpString=".xls") returned 4 [0056.432] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.432] lstrlenW (lpString=".xlsx") returned 5 [0056.432] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0056.432] lstrlenW (lpString=".ppt") returned 4 [0056.432] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.432] lstrlenW (lpString=".zip") returned 4 [0056.432] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.432] lstrlenW (lpString=".rar") returned 4 [0056.432] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.432] lstrlenW (lpString=".bz2") returned 4 [0056.432] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.432] lstrlenW (lpString=".7z") returned 3 [0056.432] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.432] lstrlenW (lpString=".dbf") returned 4 [0056.432] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.433] lstrlenW (lpString=".1cd") returned 4 [0056.433] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.433] lstrlenW (lpString=".jpg") returned 4 [0056.433] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.433] lstrlenW (lpString=".doc") returned 4 [0056.433] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.433] lstrlenW (lpString=".docx") returned 5 [0056.433] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0056.433] lstrlenW (lpString=".pdf") returned 4 [0056.433] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.433] lstrlenW (lpString=".xls") returned 4 [0056.433] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.433] lstrlenW (lpString=".xlsx") returned 5 [0056.433] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0056.433] lstrlenW (lpString=".ppt") returned 4 [0056.433] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.433] lstrlenW (lpString=".zip") returned 4 [0056.433] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.433] lstrlenW (lpString=".rar") returned 4 [0056.433] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.433] lstrlenW (lpString=".bz2") returned 4 [0056.433] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.433] lstrlenW (lpString=".7z") returned 3 [0056.434] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.434] lstrlenW (lpString=".dbf") returned 4 [0056.434] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.434] lstrlenW (lpString=".1cd") returned 4 [0056.434] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0056.434] lstrlenW (lpString=".jpg") returned 4 [0056.434] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.434] lstrcmpiW (lpString1=".DAT", lpString2=".wiki") returned -1 [0056.434] lstrlenW (lpString="STOCKS.DAT") returned 10 [0056.434] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.441] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=39017) returned 1 [0056.442] CloseHandle (hObject=0x20c) returned 1 [0056.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0056.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.442] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.442] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.442] GetLastError () returned 0x0 [0056.442] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x9869, lpOverlapped=0x0) returned 1 [0056.446] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0056.447] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.447] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0056.447] SetEndOfFile (hFile=0x180) returned 1 [0056.448] CloseHandle (hObject=0x180) returned 1 [0056.448] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.448] SetEndOfFile (hFile=0x20c) returned 1 [0056.574] CloseHandle (hObject=0x20c) returned 1 [0056.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.575] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0056.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.575] lstrlenW (lpString=".doc") returned 4 [0056.575] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0056.575] lstrlenW (lpString=".docx") returned 5 [0056.575] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0056.575] lstrlenW (lpString=".pdf") returned 4 [0056.576] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0056.576] lstrlenW (lpString=".xls") returned 4 [0056.576] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0056.576] lstrlenW (lpString=".xlsx") returned 5 [0056.576] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0056.576] lstrlenW (lpString=".ppt") returned 4 [0056.576] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0056.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.576] lstrlenW (lpString=".zip") returned 4 [0056.576] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0056.576] lstrlenW (lpString=".rar") returned 4 [0056.576] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0056.576] lstrlenW (lpString=".bz2") returned 4 [0056.576] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0056.576] lstrlenW (lpString=".7z") returned 3 [0056.576] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0056.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.576] lstrlenW (lpString=".dbf") returned 4 [0056.576] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0056.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.576] lstrlenW (lpString=".1cd") returned 4 [0056.576] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0056.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.576] lstrlenW (lpString=".jpg") returned 4 [0056.576] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0056.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.576] lstrlenW (lpString=".doc") returned 4 [0056.576] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0056.576] lstrlenW (lpString=".docx") returned 5 [0056.576] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0056.576] lstrlenW (lpString=".pdf") returned 4 [0056.576] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0056.577] lstrlenW (lpString=".xls") returned 4 [0056.577] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0056.577] lstrlenW (lpString=".xlsx") returned 5 [0056.577] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0056.577] lstrlenW (lpString=".ppt") returned 4 [0056.577] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0056.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.577] lstrlenW (lpString=".zip") returned 4 [0056.577] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0056.577] lstrlenW (lpString=".rar") returned 4 [0056.577] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0056.577] lstrlenW (lpString=".bz2") returned 4 [0056.577] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0056.577] lstrlenW (lpString=".7z") returned 3 [0056.577] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0056.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.577] lstrlenW (lpString=".dbf") returned 4 [0056.577] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0056.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.577] lstrlenW (lpString=".1cd") returned 4 [0056.577] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0056.577] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0056.577] lstrlenW (lpString=".jpg") returned 4 [0056.577] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0056.577] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.577] lstrlenW (lpString="STOCKS.XML") returned 10 [0056.577] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.578] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2687) returned 1 [0056.578] CloseHandle (hObject=0x20c) returned 1 [0056.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0056.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.578] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.578] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.578] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0056.579] GetLastError () returned 0x0 [0056.579] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa7f, lpOverlapped=0x0) returned 1 [0056.643] WriteFile (in: hFile=0x208, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa80, lpOverlapped=0x0) returned 1 [0056.644] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.644] WriteFile (in: hFile=0x208, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0056.644] SetEndOfFile (hFile=0x208) returned 1 [0056.645] CloseHandle (hObject=0x208) returned 1 [0056.645] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.645] SetEndOfFile (hFile=0x20c) returned 1 [0056.646] CloseHandle (hObject=0x20c) returned 1 [0056.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.646] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0056.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.646] lstrlenW (lpString=".doc") returned 4 [0056.646] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.646] lstrlenW (lpString=".docx") returned 5 [0056.646] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0056.646] lstrlenW (lpString=".pdf") returned 4 [0056.646] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.646] lstrlenW (lpString=".xls") returned 4 [0056.646] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.646] lstrlenW (lpString=".xlsx") returned 5 [0056.646] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0056.646] lstrlenW (lpString=".ppt") returned 4 [0056.646] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.646] lstrlenW (lpString=".zip") returned 4 [0056.646] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.647] lstrlenW (lpString=".rar") returned 4 [0056.647] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.647] lstrlenW (lpString=".bz2") returned 4 [0056.647] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.647] lstrlenW (lpString=".7z") returned 3 [0056.647] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.647] lstrlenW (lpString=".dbf") returned 4 [0056.647] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.647] lstrlenW (lpString=".1cd") returned 4 [0056.647] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.647] lstrlenW (lpString=".jpg") returned 4 [0056.647] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.647] lstrlenW (lpString=".doc") returned 4 [0056.647] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.647] lstrlenW (lpString=".docx") returned 5 [0056.647] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0056.647] lstrlenW (lpString=".pdf") returned 4 [0056.647] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.647] lstrlenW (lpString=".xls") returned 4 [0056.647] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.647] lstrlenW (lpString=".xlsx") returned 5 [0056.647] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0056.647] lstrlenW (lpString=".ppt") returned 4 [0056.647] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.647] lstrlenW (lpString=".zip") returned 4 [0056.647] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.647] lstrlenW (lpString=".rar") returned 4 [0056.648] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.648] lstrlenW (lpString=".bz2") returned 4 [0056.648] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.648] lstrlenW (lpString=".7z") returned 3 [0056.648] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.648] lstrlenW (lpString=".dbf") returned 4 [0056.648] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.648] lstrlenW (lpString=".1cd") returned 4 [0056.648] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0056.648] lstrlenW (lpString=".jpg") returned 4 [0056.648] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.648] lstrcmpiW (lpString1=".XSL", lpString2=".wiki") returned 1 [0056.648] lstrlenW (lpString="BASMLA.XSL") returned 10 [0056.648] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.648] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=227311) returned 1 [0056.649] CloseHandle (hObject=0x20c) returned 1 [0056.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0056.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.649] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.649] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0056.649] GetLastError () returned 0x0 [0056.649] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x377ef, lpOverlapped=0x0) returned 1 [0056.684] WriteFile (in: hFile=0x208, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0056.689] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.690] WriteFile (in: hFile=0x208, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0056.690] SetEndOfFile (hFile=0x208) returned 1 [0056.690] CloseHandle (hObject=0x208) returned 1 [0056.690] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.690] SetEndOfFile (hFile=0x20c) returned 1 [0056.692] CloseHandle (hObject=0x20c) returned 1 [0056.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.692] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0056.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.692] lstrlenW (lpString=".doc") returned 4 [0056.692] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0056.693] lstrlenW (lpString=".docx") returned 5 [0056.693] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0056.693] lstrlenW (lpString=".pdf") returned 4 [0056.693] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0056.693] lstrlenW (lpString=".xls") returned 4 [0056.693] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0056.693] lstrlenW (lpString=".xlsx") returned 5 [0056.693] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0056.693] lstrlenW (lpString=".ppt") returned 4 [0056.693] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0056.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.693] lstrlenW (lpString=".zip") returned 4 [0056.693] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0056.693] lstrlenW (lpString=".rar") returned 4 [0056.693] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0056.693] lstrlenW (lpString=".bz2") returned 4 [0056.693] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0056.693] lstrlenW (lpString=".7z") returned 3 [0056.693] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0056.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.693] lstrlenW (lpString=".dbf") returned 4 [0056.693] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0056.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.693] lstrlenW (lpString=".1cd") returned 4 [0056.693] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0056.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.693] lstrlenW (lpString=".jpg") returned 4 [0056.693] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0056.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.693] lstrlenW (lpString=".doc") returned 4 [0056.693] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0056.694] lstrlenW (lpString=".docx") returned 5 [0056.694] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0056.694] lstrlenW (lpString=".pdf") returned 4 [0056.694] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0056.694] lstrlenW (lpString=".xls") returned 4 [0056.694] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0056.694] lstrlenW (lpString=".xlsx") returned 5 [0056.694] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0056.694] lstrlenW (lpString=".ppt") returned 4 [0056.694] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.694] lstrlenW (lpString=".zip") returned 4 [0056.694] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0056.694] lstrlenW (lpString=".rar") returned 4 [0056.694] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0056.694] lstrlenW (lpString=".bz2") returned 4 [0056.694] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0056.694] lstrlenW (lpString=".7z") returned 3 [0056.694] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.694] lstrlenW (lpString=".dbf") returned 4 [0056.694] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.694] lstrlenW (lpString=".1cd") returned 4 [0056.694] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0056.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0056.694] lstrlenW (lpString=".jpg") returned 4 [0056.694] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0056.694] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0056.695] lstrlenW (lpString="Bears.htm") returned 9 [0056.695] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.709] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=255) returned 1 [0056.709] CloseHandle (hObject=0x214) returned 1 [0056.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0056.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.710] lstrlenW (lpString=".doc") returned 4 [0056.710] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.710] lstrlenW (lpString=".docx") returned 5 [0056.710] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0056.710] lstrlenW (lpString=".pdf") returned 4 [0056.710] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.710] lstrlenW (lpString=".xls") returned 4 [0056.710] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.710] lstrlenW (lpString=".xlsx") returned 5 [0056.710] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0056.710] lstrlenW (lpString=".ppt") returned 4 [0056.710] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.710] lstrlenW (lpString=".zip") returned 4 [0056.710] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.710] lstrlenW (lpString=".rar") returned 4 [0056.710] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.710] lstrlenW (lpString=".bz2") returned 4 [0056.710] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.710] lstrlenW (lpString=".7z") returned 3 [0056.710] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.710] lstrlenW (lpString=".dbf") returned 4 [0056.710] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.710] lstrlenW (lpString=".1cd") returned 4 [0056.710] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.711] lstrlenW (lpString=".jpg") returned 4 [0056.711] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.711] lstrlenW (lpString=".doc") returned 4 [0056.711] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.711] lstrlenW (lpString=".docx") returned 5 [0056.711] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0056.711] lstrlenW (lpString=".pdf") returned 4 [0056.711] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.711] lstrlenW (lpString=".xls") returned 4 [0056.711] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.711] lstrlenW (lpString=".xlsx") returned 5 [0056.711] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0056.711] lstrlenW (lpString=".ppt") returned 4 [0056.711] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.711] lstrlenW (lpString=".zip") returned 4 [0056.711] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.711] lstrlenW (lpString=".rar") returned 4 [0056.711] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.711] lstrlenW (lpString=".bz2") returned 4 [0056.711] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.711] lstrlenW (lpString=".7z") returned 3 [0056.711] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.711] lstrlenW (lpString=".dbf") returned 4 [0056.711] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.711] lstrlenW (lpString=".1cd") returned 4 [0056.711] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0056.711] lstrlenW (lpString=".jpg") returned 4 [0056.712] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.712] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0056.712] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0056.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.712] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4587) returned 1 [0056.712] CloseHandle (hObject=0x214) returned 1 [0056.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0056.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.712] lstrlenW (lpString=".doc") returned 4 [0056.712] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.712] lstrlenW (lpString=".docx") returned 5 [0056.712] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0056.712] lstrlenW (lpString=".pdf") returned 4 [0056.713] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.713] lstrlenW (lpString=".xls") returned 4 [0056.713] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.713] lstrlenW (lpString=".xlsx") returned 5 [0056.713] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0056.713] lstrlenW (lpString=".ppt") returned 4 [0056.713] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.713] lstrlenW (lpString=".zip") returned 4 [0056.713] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.713] lstrlenW (lpString=".rar") returned 4 [0056.713] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.713] lstrlenW (lpString=".bz2") returned 4 [0056.713] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.713] lstrlenW (lpString=".7z") returned 3 [0056.713] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.713] lstrlenW (lpString=".dbf") returned 4 [0056.713] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.713] lstrlenW (lpString=".1cd") returned 4 [0056.713] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.713] lstrlenW (lpString=".jpg") returned 4 [0056.713] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.713] lstrlenW (lpString=".doc") returned 4 [0056.713] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.713] lstrlenW (lpString=".docx") returned 5 [0056.713] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0056.713] lstrlenW (lpString=".pdf") returned 4 [0056.713] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.714] lstrlenW (lpString=".xls") returned 4 [0056.714] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.714] lstrlenW (lpString=".xlsx") returned 5 [0056.714] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0056.714] lstrlenW (lpString=".ppt") returned 4 [0056.714] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.714] lstrlenW (lpString=".zip") returned 4 [0056.714] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.714] lstrlenW (lpString=".rar") returned 4 [0056.714] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.714] lstrlenW (lpString=".bz2") returned 4 [0056.714] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.714] lstrlenW (lpString=".7z") returned 3 [0056.714] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.714] lstrlenW (lpString=".dbf") returned 4 [0056.714] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.714] lstrlenW (lpString=".1cd") returned 4 [0056.714] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0056.714] lstrlenW (lpString=".jpg") returned 4 [0056.714] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.714] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0056.714] lstrlenW (lpString="Connectivity.gif") returned 16 [0056.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.715] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2319) returned 1 [0056.715] CloseHandle (hObject=0x214) returned 1 [0056.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0056.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.715] lstrlenW (lpString=".doc") returned 4 [0056.715] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.715] lstrlenW (lpString=".docx") returned 5 [0056.715] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0056.715] lstrlenW (lpString=".pdf") returned 4 [0056.715] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.715] lstrlenW (lpString=".xls") returned 4 [0056.715] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.715] lstrlenW (lpString=".xlsx") returned 5 [0056.715] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0056.715] lstrlenW (lpString=".ppt") returned 4 [0056.715] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.715] lstrlenW (lpString=".zip") returned 4 [0056.715] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.715] lstrlenW (lpString=".rar") returned 4 [0056.715] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.716] lstrlenW (lpString=".bz2") returned 4 [0056.716] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.716] lstrlenW (lpString=".7z") returned 3 [0056.716] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.716] lstrlenW (lpString=".dbf") returned 4 [0056.716] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.716] lstrlenW (lpString=".1cd") returned 4 [0056.716] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.716] lstrlenW (lpString=".jpg") returned 4 [0056.716] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.716] lstrlenW (lpString=".doc") returned 4 [0056.716] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0056.716] lstrlenW (lpString=".docx") returned 5 [0056.716] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0056.716] lstrlenW (lpString=".pdf") returned 4 [0056.716] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0056.716] lstrlenW (lpString=".xls") returned 4 [0056.716] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0056.716] lstrlenW (lpString=".xlsx") returned 5 [0056.717] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0056.717] lstrlenW (lpString=".ppt") returned 4 [0056.717] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0056.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.717] lstrlenW (lpString=".zip") returned 4 [0056.717] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0056.717] lstrlenW (lpString=".rar") returned 4 [0056.717] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0056.717] lstrlenW (lpString=".bz2") returned 4 [0056.717] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0056.717] lstrlenW (lpString=".7z") returned 3 [0056.717] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0056.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.717] lstrlenW (lpString=".dbf") returned 4 [0056.717] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0056.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.717] lstrlenW (lpString=".1cd") returned 4 [0056.717] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0056.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0056.717] lstrlenW (lpString=".jpg") returned 4 [0056.717] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0056.717] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0056.717] lstrlenW (lpString="Desktop.ini") returned 11 [0056.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.718] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=645) returned 1 [0056.718] CloseHandle (hObject=0x214) returned 1 [0056.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0056.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.718] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.718] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0056.719] GetLastError () returned 0x0 [0056.719] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x285, lpOverlapped=0x0) returned 1 [0056.720] WriteFile (in: hFile=0x1f8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x290, lpOverlapped=0x0) returned 1 [0056.720] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.721] WriteFile (in: hFile=0x1f8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.721] SetEndOfFile (hFile=0x1f8) returned 1 [0056.721] CloseHandle (hObject=0x1f8) returned 1 [0056.721] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.721] SetEndOfFile (hFile=0x214) returned 1 [0056.722] CloseHandle (hObject=0x214) returned 1 [0056.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x26) returned 1 [0056.722] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0056.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.722] lstrlenW (lpString=".doc") returned 4 [0056.722] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0056.722] lstrlenW (lpString=".docx") returned 5 [0056.722] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0056.722] lstrlenW (lpString=".pdf") returned 4 [0056.722] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0056.722] lstrlenW (lpString=".xls") returned 4 [0056.722] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0056.722] lstrlenW (lpString=".xlsx") returned 5 [0056.722] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0056.723] lstrlenW (lpString=".ppt") returned 4 [0056.723] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.723] lstrlenW (lpString=".zip") returned 4 [0056.723] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0056.723] lstrlenW (lpString=".rar") returned 4 [0056.723] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0056.723] lstrlenW (lpString=".bz2") returned 4 [0056.723] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0056.723] lstrlenW (lpString=".7z") returned 3 [0056.723] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.723] lstrlenW (lpString=".dbf") returned 4 [0056.723] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.723] lstrlenW (lpString=".1cd") returned 4 [0056.723] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.723] lstrlenW (lpString=".jpg") returned 4 [0056.723] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0056.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.723] lstrlenW (lpString=".doc") returned 4 [0056.723] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0056.723] lstrlenW (lpString=".docx") returned 5 [0056.723] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0056.723] lstrlenW (lpString=".pdf") returned 4 [0056.723] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0056.723] lstrlenW (lpString=".xls") returned 4 [0056.724] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0056.724] lstrlenW (lpString=".xlsx") returned 5 [0056.724] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0056.724] lstrlenW (lpString=".ppt") returned 4 [0056.724] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0056.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.724] lstrlenW (lpString=".zip") returned 4 [0056.724] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0056.724] lstrlenW (lpString=".rar") returned 4 [0056.724] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0056.724] lstrlenW (lpString=".bz2") returned 4 [0056.724] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0056.724] lstrlenW (lpString=".7z") returned 3 [0056.724] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0056.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.724] lstrlenW (lpString=".dbf") returned 4 [0056.724] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0056.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.724] lstrlenW (lpString=".1cd") returned 4 [0056.724] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0056.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0056.724] lstrlenW (lpString=".jpg") returned 4 [0056.724] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0056.724] lstrcmpiW (lpString1=".emf", lpString2=".wiki") returned -1 [0056.724] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0056.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.725] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3792) returned 1 [0056.725] CloseHandle (hObject=0x214) returned 1 [0056.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0056.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.725] lstrlenW (lpString=".doc") returned 4 [0056.725] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.725] lstrlenW (lpString=".docx") returned 5 [0056.725] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0056.725] lstrlenW (lpString=".pdf") returned 4 [0056.725] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.725] lstrlenW (lpString=".xls") returned 4 [0056.725] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.725] lstrlenW (lpString=".xlsx") returned 5 [0056.726] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0056.726] lstrlenW (lpString=".ppt") returned 4 [0056.726] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.726] lstrlenW (lpString=".zip") returned 4 [0056.726] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.726] lstrlenW (lpString=".rar") returned 4 [0056.726] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.726] lstrlenW (lpString=".bz2") returned 4 [0056.726] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.726] lstrlenW (lpString=".7z") returned 3 [0056.726] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.726] lstrlenW (lpString=".dbf") returned 4 [0056.726] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.726] lstrlenW (lpString=".1cd") returned 4 [0056.726] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.726] lstrlenW (lpString=".jpg") returned 4 [0056.726] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.726] lstrlenW (lpString=".doc") returned 4 [0056.726] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.726] lstrlenW (lpString=".docx") returned 5 [0056.726] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0056.726] lstrlenW (lpString=".pdf") returned 4 [0056.726] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.726] lstrlenW (lpString=".xls") returned 4 [0056.726] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.726] lstrlenW (lpString=".xlsx") returned 5 [0056.727] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0056.727] lstrlenW (lpString=".ppt") returned 4 [0056.727] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.727] lstrlenW (lpString=".zip") returned 4 [0056.727] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.727] lstrlenW (lpString=".rar") returned 4 [0056.727] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.727] lstrlenW (lpString=".bz2") returned 4 [0056.727] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.727] lstrlenW (lpString=".7z") returned 3 [0056.727] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.727] lstrlenW (lpString=".dbf") returned 4 [0056.727] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.727] lstrlenW (lpString=".1cd") returned 4 [0056.727] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0056.727] lstrlenW (lpString=".jpg") returned 4 [0056.727] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.727] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0056.727] lstrlenW (lpString="Garden.htm") returned 10 [0056.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0056.728] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=231) returned 1 [0056.728] CloseHandle (hObject=0x214) returned 1 [0056.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0056.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0056.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0056.728] lstrlenW (lpString=".doc") returned 4 [0056.728] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.728] lstrlenW (lpString=".docx") returned 5 [0056.728] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0056.728] lstrlenW (lpString=".pdf") returned 4 [0056.728] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.728] lstrlenW (lpString=".xls") returned 4 [0056.728] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.728] lstrlenW (lpString=".xlsx") returned 5 [0056.728] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0056.728] lstrlenW (lpString=".ppt") returned 4 [0056.728] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0056.728] lstrlenW (lpString=".zip") returned 4 [0056.728] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.728] lstrlenW (lpString=".rar") returned 4 [0056.728] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.728] lstrlenW (lpString=".bz2") returned 4 [0056.728] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.729] lstrlenW (lpString=".7z") returned 3 [0056.729] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0056.729] lstrlenW (lpString=".dbf") returned 4 [0056.729] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0056.729] lstrlenW (lpString=".1cd") returned 4 [0056.729] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0056.729] lstrlenW (lpString=".jpg") returned 4 [0056.729] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0056.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0056.729] lstrlenW (lpString=".doc") returned 4 [0056.729] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.729] lstrlenW (lpString=".docx") returned 5 [0056.729] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0056.729] lstrlenW (lpString=".pdf") returned 4 [0057.095] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0057.095] lstrlenW (lpString=".xls") returned 4 [0057.095] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0057.095] lstrlenW (lpString=".xlsx") returned 5 [0057.095] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0057.095] lstrlenW (lpString=".ppt") returned 4 [0057.095] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0057.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0057.095] lstrlenW (lpString=".zip") returned 4 [0057.095] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0057.095] lstrlenW (lpString=".rar") returned 4 [0057.095] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0057.095] lstrlenW (lpString=".bz2") returned 4 [0057.095] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0057.095] lstrlenW (lpString=".7z") returned 3 [0057.095] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0057.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0057.096] lstrlenW (lpString=".dbf") returned 4 [0057.096] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0057.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0057.096] lstrlenW (lpString=".1cd") returned 4 [0057.096] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0057.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0057.096] lstrlenW (lpString=".jpg") returned 4 [0057.096] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0057.096] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0057.096] lstrlenW (lpString="Stucco.gif") returned 10 [0057.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0058.226] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1864) returned 1 [0058.234] CloseHandle (hObject=0x180) returned 1 [0058.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif")) returned 0x20 [0058.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.242] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\stucco.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0058.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.242] lstrlenW (lpString=".doc") returned 4 [0058.242] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0058.242] lstrlenW (lpString=".docx") returned 5 [0058.242] lstrcmpiW (lpString1=".docx", lpString2="o.gif") returned -1 [0058.242] lstrlenW (lpString=".pdf") returned 4 [0058.242] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0058.242] lstrlenW (lpString=".xls") returned 4 [0058.242] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0058.242] lstrlenW (lpString=".xlsx") returned 5 [0058.242] lstrcmpiW (lpString1=".xlsx", lpString2="o.gif") returned -1 [0058.242] lstrlenW (lpString=".ppt") returned 4 [0058.242] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0058.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.242] lstrlenW (lpString=".zip") returned 4 [0058.242] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0058.242] lstrlenW (lpString=".rar") returned 4 [0058.242] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0058.242] lstrlenW (lpString=".bz2") returned 4 [0058.242] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0058.242] lstrlenW (lpString=".7z") returned 3 [0058.242] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0058.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.242] lstrlenW (lpString=".dbf") returned 4 [0058.242] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0058.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.243] lstrlenW (lpString=".1cd") returned 4 [0058.243] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0058.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.243] lstrlenW (lpString=".jpg") returned 4 [0058.243] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0058.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.243] lstrlenW (lpString=".doc") returned 4 [0058.243] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0058.243] lstrlenW (lpString=".docx") returned 5 [0058.243] lstrcmpiW (lpString1=".docx", lpString2="o.gif") returned -1 [0058.243] lstrlenW (lpString=".pdf") returned 4 [0058.243] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0058.243] lstrlenW (lpString=".xls") returned 4 [0058.243] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0058.243] lstrlenW (lpString=".xlsx") returned 5 [0058.243] lstrcmpiW (lpString1=".xlsx", lpString2="o.gif") returned -1 [0058.243] lstrlenW (lpString=".ppt") returned 4 [0058.243] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0058.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.243] lstrlenW (lpString=".zip") returned 4 [0058.243] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0058.243] lstrlenW (lpString=".rar") returned 4 [0058.243] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0058.243] lstrlenW (lpString=".bz2") returned 4 [0058.243] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0058.243] lstrlenW (lpString=".7z") returned 3 [0058.243] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0058.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.243] lstrlenW (lpString=".dbf") returned 4 [0058.243] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0058.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.244] lstrlenW (lpString=".1cd") returned 4 [0058.244] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0058.244] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Stucco.gif") returned 68 [0058.244] lstrlenW (lpString=".jpg") returned 4 [0058.244] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0058.244] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0058.244] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.700] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=19780) returned 1 [0058.700] CloseHandle (hObject=0x210) returned 1 [0058.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0058.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.700] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.700] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.701] GetLastError () returned 0x0 [0058.701] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x4d44, lpOverlapped=0x0) returned 1 [0058.703] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0058.704] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.704] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.704] SetEndOfFile (hFile=0x204) returned 1 [0058.704] CloseHandle (hObject=0x204) returned 1 [0058.704] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.704] SetEndOfFile (hFile=0x210) returned 1 [0058.705] CloseHandle (hObject=0x210) returned 1 [0058.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.706] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0058.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.706] lstrlenW (lpString=".doc") returned 4 [0058.706] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.706] lstrlenW (lpString=".docx") returned 5 [0058.706] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.706] lstrlenW (lpString=".pdf") returned 4 [0058.706] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.706] lstrlenW (lpString=".xls") returned 4 [0058.706] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.706] lstrlenW (lpString=".xlsx") returned 5 [0058.706] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.706] lstrlenW (lpString=".ppt") returned 4 [0058.706] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.706] lstrlenW (lpString=".zip") returned 4 [0058.706] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.706] lstrlenW (lpString=".rar") returned 4 [0058.706] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.706] lstrlenW (lpString=".bz2") returned 4 [0058.706] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.706] lstrlenW (lpString=".7z") returned 3 [0058.706] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.707] lstrlenW (lpString=".dbf") returned 4 [0058.707] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.707] lstrlenW (lpString=".1cd") returned 4 [0058.707] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.707] lstrlenW (lpString=".jpg") returned 4 [0058.707] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.707] lstrlenW (lpString=".doc") returned 4 [0058.707] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.707] lstrlenW (lpString=".docx") returned 5 [0058.707] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.707] lstrlenW (lpString=".pdf") returned 4 [0058.707] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.707] lstrlenW (lpString=".xls") returned 4 [0058.707] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.707] lstrlenW (lpString=".xlsx") returned 5 [0058.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.707] lstrlenW (lpString=".ppt") returned 4 [0058.707] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.707] lstrlenW (lpString=".zip") returned 4 [0058.707] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.707] lstrlenW (lpString=".rar") returned 4 [0058.707] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.707] lstrlenW (lpString=".bz2") returned 4 [0058.707] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.707] lstrlenW (lpString=".7z") returned 3 [0058.707] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.708] lstrlenW (lpString=".dbf") returned 4 [0058.708] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.708] lstrlenW (lpString=".1cd") returned 4 [0058.708] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0058.708] lstrlenW (lpString=".jpg") returned 4 [0058.708] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.708] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0058.708] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.709] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2181) returned 1 [0058.709] CloseHandle (hObject=0x210) returned 1 [0058.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0058.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.709] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.709] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.712] GetLastError () returned 0x0 [0058.712] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x885, lpOverlapped=0x0) returned 1 [0058.714] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x890, lpOverlapped=0x0) returned 1 [0058.715] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.715] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.715] SetEndOfFile (hFile=0x204) returned 1 [0058.715] CloseHandle (hObject=0x204) returned 1 [0058.715] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.715] SetEndOfFile (hFile=0x210) returned 1 [0058.716] CloseHandle (hObject=0x210) returned 1 [0058.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.716] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0058.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.717] lstrlenW (lpString=".doc") returned 4 [0058.717] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.717] lstrlenW (lpString=".docx") returned 5 [0058.717] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.717] lstrlenW (lpString=".pdf") returned 4 [0058.717] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.717] lstrlenW (lpString=".xls") returned 4 [0058.717] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.717] lstrlenW (lpString=".xlsx") returned 5 [0058.717] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.717] lstrlenW (lpString=".ppt") returned 4 [0058.717] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.717] lstrlenW (lpString=".zip") returned 4 [0058.717] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.717] lstrlenW (lpString=".rar") returned 4 [0058.717] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.717] lstrlenW (lpString=".bz2") returned 4 [0058.717] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.717] lstrlenW (lpString=".7z") returned 3 [0058.717] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.717] lstrlenW (lpString=".dbf") returned 4 [0058.717] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.717] lstrlenW (lpString=".1cd") returned 4 [0058.717] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.717] lstrlenW (lpString=".jpg") returned 4 [0058.717] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.718] lstrlenW (lpString=".doc") returned 4 [0058.718] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.718] lstrlenW (lpString=".docx") returned 5 [0058.718] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.718] lstrlenW (lpString=".pdf") returned 4 [0058.718] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.718] lstrlenW (lpString=".xls") returned 4 [0058.718] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.718] lstrlenW (lpString=".xlsx") returned 5 [0058.718] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.718] lstrlenW (lpString=".ppt") returned 4 [0058.718] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.718] lstrlenW (lpString=".zip") returned 4 [0058.718] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.718] lstrlenW (lpString=".rar") returned 4 [0058.718] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.718] lstrlenW (lpString=".bz2") returned 4 [0058.718] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.718] lstrlenW (lpString=".7z") returned 3 [0058.718] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.718] lstrlenW (lpString=".dbf") returned 4 [0058.718] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.718] lstrlenW (lpString=".1cd") returned 4 [0058.718] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0058.718] lstrlenW (lpString=".jpg") returned 4 [0058.718] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.719] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0058.719] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.719] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=20627) returned 1 [0058.719] CloseHandle (hObject=0x210) returned 1 [0058.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0058.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.719] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.719] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.720] GetLastError () returned 0x0 [0058.720] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x5093, lpOverlapped=0x0) returned 1 [0058.722] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0058.723] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.723] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0058.723] SetEndOfFile (hFile=0x204) returned 1 [0058.723] CloseHandle (hObject=0x204) returned 1 [0058.723] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.724] SetEndOfFile (hFile=0x210) returned 1 [0058.724] CloseHandle (hObject=0x210) returned 1 [0058.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.725] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.725] lstrlenW (lpString=".doc") returned 4 [0058.725] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.725] lstrlenW (lpString=".docx") returned 5 [0058.725] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.725] lstrlenW (lpString=".pdf") returned 4 [0058.725] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.725] lstrlenW (lpString=".xls") returned 4 [0058.725] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.725] lstrlenW (lpString=".xlsx") returned 5 [0058.725] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.725] lstrlenW (lpString=".ppt") returned 4 [0058.725] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.725] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.725] lstrlenW (lpString=".zip") returned 4 [0058.725] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.725] lstrlenW (lpString=".rar") returned 4 [0058.725] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.725] lstrlenW (lpString=".bz2") returned 4 [0058.725] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.725] lstrlenW (lpString=".7z") returned 3 [0058.725] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.726] lstrlenW (lpString=".dbf") returned 4 [0058.726] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.726] lstrlenW (lpString=".1cd") returned 4 [0058.726] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.726] lstrlenW (lpString=".jpg") returned 4 [0058.726] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.726] lstrlenW (lpString=".doc") returned 4 [0058.726] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0058.726] lstrlenW (lpString=".docx") returned 5 [0058.726] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0058.726] lstrlenW (lpString=".pdf") returned 4 [0058.726] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0058.726] lstrlenW (lpString=".xls") returned 4 [0058.726] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0058.726] lstrlenW (lpString=".xlsx") returned 5 [0058.726] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0058.726] lstrlenW (lpString=".ppt") returned 4 [0058.726] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0058.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.726] lstrlenW (lpString=".zip") returned 4 [0058.726] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0058.726] lstrlenW (lpString=".rar") returned 4 [0058.727] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0058.727] lstrlenW (lpString=".bz2") returned 4 [0058.727] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0058.727] lstrlenW (lpString=".7z") returned 3 [0058.727] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0058.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.727] lstrlenW (lpString=".dbf") returned 4 [0058.727] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0058.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.727] lstrlenW (lpString=".1cd") returned 4 [0058.727] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0058.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0058.727] lstrlenW (lpString=".jpg") returned 4 [0058.727] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0058.727] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0058.727] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0058.727] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.727] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1560) returned 1 [0058.727] CloseHandle (hObject=0x210) returned 1 [0058.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0058.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.728] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.728] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.729] GetLastError () returned 0x0 [0058.729] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x618, lpOverlapped=0x0) returned 1 [0058.731] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x620, lpOverlapped=0x0) returned 1 [0058.732] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0058.732] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.732] SetEndOfFile (hFile=0x204) returned 1 [0058.732] CloseHandle (hObject=0x204) returned 1 [0058.733] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.733] SetEndOfFile (hFile=0x210) returned 1 [0058.733] CloseHandle (hObject=0x210) returned 1 [0058.733] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0058.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0058.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.734] lstrlenW (lpString=".doc") returned 4 [0058.734] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.734] lstrlenW (lpString=".docx") returned 5 [0058.734] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.734] lstrlenW (lpString=".pdf") returned 4 [0058.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.734] lstrlenW (lpString=".xls") returned 4 [0058.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.734] lstrlenW (lpString=".xlsx") returned 5 [0058.734] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.734] lstrlenW (lpString=".ppt") returned 4 [0058.734] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.734] lstrlenW (lpString=".zip") returned 4 [0058.734] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.734] lstrlenW (lpString=".rar") returned 4 [0058.734] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.734] lstrlenW (lpString=".bz2") returned 4 [0058.734] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.734] lstrlenW (lpString=".7z") returned 3 [0058.735] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.735] lstrlenW (lpString=".dbf") returned 4 [0058.735] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.735] lstrlenW (lpString=".1cd") returned 4 [0058.735] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.735] lstrlenW (lpString=".jpg") returned 4 [0058.735] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.735] lstrlenW (lpString=".doc") returned 4 [0058.735] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0058.735] lstrlenW (lpString=".docx") returned 5 [0058.735] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0058.735] lstrlenW (lpString=".pdf") returned 4 [0058.735] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0058.735] lstrlenW (lpString=".xls") returned 4 [0058.735] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0058.735] lstrlenW (lpString=".xlsx") returned 5 [0058.735] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0058.735] lstrlenW (lpString=".ppt") returned 4 [0058.735] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0058.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.735] lstrlenW (lpString=".zip") returned 4 [0058.735] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0058.735] lstrlenW (lpString=".rar") returned 4 [0058.735] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0058.735] lstrlenW (lpString=".bz2") returned 4 [0058.735] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0058.735] lstrlenW (lpString=".7z") returned 3 [0058.735] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0058.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.736] lstrlenW (lpString=".dbf") returned 4 [0058.736] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0058.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.736] lstrlenW (lpString=".1cd") returned 4 [0058.736] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0058.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0058.736] lstrlenW (lpString=".jpg") returned 4 [0058.736] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0058.736] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0058.736] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0058.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.736] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=33009) returned 1 [0058.736] CloseHandle (hObject=0x210) returned 1 [0058.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0058.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0058.737] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.737] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0058.737] GetLastError () returned 0x0 [0058.737] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0059.103] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0059.183] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.183] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.183] SetEndOfFile (hFile=0x204) returned 1 [0059.183] CloseHandle (hObject=0x204) returned 1 [0059.184] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.184] SetEndOfFile (hFile=0x210) returned 1 [0059.185] CloseHandle (hObject=0x210) returned 1 [0059.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.185] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0059.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.185] lstrlenW (lpString=".doc") returned 4 [0059.185] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.185] lstrlenW (lpString=".docx") returned 5 [0059.185] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.185] lstrlenW (lpString=".pdf") returned 4 [0059.185] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.185] lstrlenW (lpString=".xls") returned 4 [0059.185] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.185] lstrlenW (lpString=".xlsx") returned 5 [0059.185] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.185] lstrlenW (lpString=".ppt") returned 4 [0059.185] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.185] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.185] lstrlenW (lpString=".zip") returned 4 [0059.185] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.186] lstrlenW (lpString=".rar") returned 4 [0059.186] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.186] lstrlenW (lpString=".bz2") returned 4 [0059.186] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.186] lstrlenW (lpString=".7z") returned 3 [0059.186] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.186] lstrlenW (lpString=".dbf") returned 4 [0059.186] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.186] lstrlenW (lpString=".1cd") returned 4 [0059.186] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.186] lstrlenW (lpString=".jpg") returned 4 [0059.186] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.186] lstrlenW (lpString=".doc") returned 4 [0059.186] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.186] lstrlenW (lpString=".docx") returned 5 [0059.186] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.186] lstrlenW (lpString=".pdf") returned 4 [0059.186] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.186] lstrlenW (lpString=".xls") returned 4 [0059.186] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.186] lstrlenW (lpString=".xlsx") returned 5 [0059.186] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.186] lstrlenW (lpString=".ppt") returned 4 [0059.186] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.186] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.186] lstrlenW (lpString=".zip") returned 4 [0059.187] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.187] lstrlenW (lpString=".rar") returned 4 [0059.187] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.187] lstrlenW (lpString=".bz2") returned 4 [0059.187] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.187] lstrlenW (lpString=".7z") returned 3 [0059.187] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.187] lstrlenW (lpString=".dbf") returned 4 [0059.187] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.187] lstrlenW (lpString=".1cd") returned 4 [0059.187] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.187] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0059.187] lstrlenW (lpString=".jpg") returned 4 [0059.187] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.187] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.187] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.187] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.326] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2044) returned 1 [0059.326] CloseHandle (hObject=0x180) returned 1 [0059.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0059.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.326] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.327] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.327] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.327] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0059.669] GetLastError () returned 0x0 [0059.669] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7fc, lpOverlapped=0x0) returned 1 [0059.671] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x800, lpOverlapped=0x0) returned 1 [0059.671] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.672] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.672] SetEndOfFile (hFile=0x1e8) returned 1 [0059.672] CloseHandle (hObject=0x1e8) returned 1 [0059.672] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.672] SetEndOfFile (hFile=0x180) returned 1 [0059.673] CloseHandle (hObject=0x180) returned 1 [0059.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.673] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0059.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.673] lstrlenW (lpString=".doc") returned 4 [0059.673] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.673] lstrlenW (lpString=".docx") returned 5 [0059.673] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.673] lstrlenW (lpString=".pdf") returned 4 [0059.673] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.673] lstrlenW (lpString=".xls") returned 4 [0059.673] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.673] lstrlenW (lpString=".xlsx") returned 5 [0059.674] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.674] lstrlenW (lpString=".ppt") returned 4 [0059.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.674] lstrlenW (lpString=".zip") returned 4 [0059.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.674] lstrlenW (lpString=".rar") returned 4 [0059.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.674] lstrlenW (lpString=".bz2") returned 4 [0059.674] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.674] lstrlenW (lpString=".7z") returned 3 [0059.674] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.674] lstrlenW (lpString=".dbf") returned 4 [0059.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.674] lstrlenW (lpString=".1cd") returned 4 [0059.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.674] lstrlenW (lpString=".jpg") returned 4 [0059.674] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.674] lstrlenW (lpString=".doc") returned 4 [0059.674] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.674] lstrlenW (lpString=".docx") returned 5 [0059.674] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.674] lstrlenW (lpString=".pdf") returned 4 [0059.674] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.674] lstrlenW (lpString=".xls") returned 4 [0059.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.674] lstrlenW (lpString=".xlsx") returned 5 [0059.675] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.675] lstrlenW (lpString=".ppt") returned 4 [0059.675] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.675] lstrlenW (lpString=".zip") returned 4 [0059.675] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.675] lstrlenW (lpString=".rar") returned 4 [0059.675] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.675] lstrlenW (lpString=".bz2") returned 4 [0059.675] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.675] lstrlenW (lpString=".7z") returned 3 [0059.675] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.675] lstrlenW (lpString=".dbf") returned 4 [0059.675] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.675] lstrlenW (lpString=".1cd") returned 4 [0059.675] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0059.675] lstrlenW (lpString=".jpg") returned 4 [0059.675] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.675] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.675] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.676] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1354) returned 1 [0059.676] CloseHandle (hObject=0x180) returned 1 [0059.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0059.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.676] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.676] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0059.678] GetLastError () returned 0x0 [0059.678] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x54a, lpOverlapped=0x0) returned 1 [0059.680] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x550, lpOverlapped=0x0) returned 1 [0059.681] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.681] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.681] SetEndOfFile (hFile=0x1e8) returned 1 [0059.681] CloseHandle (hObject=0x1e8) returned 1 [0059.681] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.681] SetEndOfFile (hFile=0x180) returned 1 [0059.682] CloseHandle (hObject=0x180) returned 1 [0059.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.682] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0059.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.682] lstrlenW (lpString=".doc") returned 4 [0059.682] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.682] lstrlenW (lpString=".docx") returned 5 [0059.682] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.682] lstrlenW (lpString=".pdf") returned 4 [0059.682] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.682] lstrlenW (lpString=".xls") returned 4 [0059.682] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.683] lstrlenW (lpString=".xlsx") returned 5 [0059.683] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.683] lstrlenW (lpString=".ppt") returned 4 [0059.683] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.683] lstrlenW (lpString=".zip") returned 4 [0059.683] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.683] lstrlenW (lpString=".rar") returned 4 [0059.683] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.683] lstrlenW (lpString=".bz2") returned 4 [0059.683] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.683] lstrlenW (lpString=".7z") returned 3 [0059.683] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.683] lstrlenW (lpString=".dbf") returned 4 [0059.683] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.683] lstrlenW (lpString=".1cd") returned 4 [0059.683] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.683] lstrlenW (lpString=".jpg") returned 4 [0059.683] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.683] lstrlenW (lpString=".doc") returned 4 [0059.683] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.683] lstrlenW (lpString=".docx") returned 5 [0059.683] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.683] lstrlenW (lpString=".pdf") returned 4 [0059.683] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.683] lstrlenW (lpString=".xls") returned 4 [0059.683] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.684] lstrlenW (lpString=".xlsx") returned 5 [0059.684] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.684] lstrlenW (lpString=".ppt") returned 4 [0059.684] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.684] lstrlenW (lpString=".zip") returned 4 [0059.684] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.684] lstrlenW (lpString=".rar") returned 4 [0059.684] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.684] lstrlenW (lpString=".bz2") returned 4 [0059.684] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.684] lstrlenW (lpString=".7z") returned 3 [0059.684] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.684] lstrlenW (lpString=".dbf") returned 4 [0059.684] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.684] lstrlenW (lpString=".1cd") returned 4 [0059.684] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0059.684] lstrlenW (lpString=".jpg") returned 4 [0059.684] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.684] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.684] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.685] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=32433) returned 1 [0059.685] CloseHandle (hObject=0x180) returned 1 [0059.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0059.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.685] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.685] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0059.685] GetLastError () returned 0x0 [0059.685] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0059.687] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0059.689] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.689] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.689] SetEndOfFile (hFile=0x1e8) returned 1 [0059.689] CloseHandle (hObject=0x1e8) returned 1 [0059.689] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.689] SetEndOfFile (hFile=0x180) returned 1 [0059.690] CloseHandle (hObject=0x180) returned 1 [0059.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.690] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0059.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.691] lstrlenW (lpString=".doc") returned 4 [0059.691] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.691] lstrlenW (lpString=".docx") returned 5 [0059.691] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.691] lstrlenW (lpString=".pdf") returned 4 [0059.691] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.691] lstrlenW (lpString=".xls") returned 4 [0059.691] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.691] lstrlenW (lpString=".xlsx") returned 5 [0059.691] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.691] lstrlenW (lpString=".ppt") returned 4 [0059.691] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.691] lstrlenW (lpString=".zip") returned 4 [0059.691] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.691] lstrlenW (lpString=".rar") returned 4 [0059.691] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.691] lstrlenW (lpString=".bz2") returned 4 [0059.691] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.691] lstrlenW (lpString=".7z") returned 3 [0059.691] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.691] lstrlenW (lpString=".dbf") returned 4 [0059.691] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.691] lstrlenW (lpString=".1cd") returned 4 [0059.691] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.692] lstrlenW (lpString=".jpg") returned 4 [0059.692] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.692] lstrlenW (lpString=".doc") returned 4 [0059.692] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.692] lstrlenW (lpString=".docx") returned 5 [0059.692] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.692] lstrlenW (lpString=".pdf") returned 4 [0059.692] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.692] lstrlenW (lpString=".xls") returned 4 [0059.692] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.692] lstrlenW (lpString=".xlsx") returned 5 [0059.692] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.692] lstrlenW (lpString=".ppt") returned 4 [0059.692] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.692] lstrlenW (lpString=".zip") returned 4 [0059.692] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.692] lstrlenW (lpString=".rar") returned 4 [0059.692] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.692] lstrlenW (lpString=".bz2") returned 4 [0059.692] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.692] lstrlenW (lpString=".7z") returned 3 [0059.692] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.692] lstrlenW (lpString=".dbf") returned 4 [0059.692] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.692] lstrlenW (lpString=".1cd") returned 4 [0059.692] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0059.692] lstrlenW (lpString=".jpg") returned 4 [0059.693] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.693] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.693] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.693] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5120) returned 1 [0059.693] CloseHandle (hObject=0x180) returned 1 [0059.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0059.693] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.693] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0059.694] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.694] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0059.695] GetLastError () returned 0x0 [0059.695] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1400, lpOverlapped=0x0) returned 1 [0059.697] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0059.698] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.698] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.698] SetEndOfFile (hFile=0x1e8) returned 1 [0059.698] CloseHandle (hObject=0x1e8) returned 1 [0059.698] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.699] SetEndOfFile (hFile=0x180) returned 1 [0059.699] CloseHandle (hObject=0x180) returned 1 [0059.699] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.700] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0059.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.700] lstrlenW (lpString=".doc") returned 4 [0059.700] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.700] lstrlenW (lpString=".docx") returned 5 [0059.700] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.700] lstrlenW (lpString=".pdf") returned 4 [0059.700] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.700] lstrlenW (lpString=".xls") returned 4 [0059.700] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.700] lstrlenW (lpString=".xlsx") returned 5 [0059.700] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.700] lstrlenW (lpString=".ppt") returned 4 [0059.700] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.700] lstrlenW (lpString=".zip") returned 4 [0059.700] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.700] lstrlenW (lpString=".rar") returned 4 [0059.700] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.700] lstrlenW (lpString=".bz2") returned 4 [0059.700] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.700] lstrlenW (lpString=".7z") returned 3 [0059.700] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.700] lstrlenW (lpString=".dbf") returned 4 [0059.700] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.701] lstrlenW (lpString=".1cd") returned 4 [0059.701] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.701] lstrlenW (lpString=".jpg") returned 4 [0059.701] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.701] lstrlenW (lpString=".doc") returned 4 [0059.701] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.701] lstrlenW (lpString=".docx") returned 5 [0059.701] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.701] lstrlenW (lpString=".pdf") returned 4 [0059.701] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.701] lstrlenW (lpString=".xls") returned 4 [0059.701] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.701] lstrlenW (lpString=".xlsx") returned 5 [0059.701] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.701] lstrlenW (lpString=".ppt") returned 4 [0059.701] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.701] lstrlenW (lpString=".zip") returned 4 [0059.701] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.701] lstrlenW (lpString=".rar") returned 4 [0059.701] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.701] lstrlenW (lpString=".bz2") returned 4 [0059.701] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.701] lstrlenW (lpString=".7z") returned 3 [0059.701] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.701] lstrlenW (lpString=".dbf") returned 4 [0059.701] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.702] lstrlenW (lpString=".1cd") returned 4 [0059.702] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0059.702] lstrlenW (lpString=".jpg") returned 4 [0059.702] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.702] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.702] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.888] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=60724) returned 1 [0059.888] CloseHandle (hObject=0x200) returned 1 [0059.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0059.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0059.888] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.888] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.889] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x160 [0059.889] GetLastError () returned 0x0 [0059.889] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xed34, lpOverlapped=0x0) returned 1 [0059.925] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0059.927] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.927] WriteFile (in: hFile=0x160, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.927] SetEndOfFile (hFile=0x160) returned 1 [0059.927] CloseHandle (hObject=0x160) returned 1 [0059.927] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.927] SetEndOfFile (hFile=0x200) returned 1 [0059.928] CloseHandle (hObject=0x200) returned 1 [0059.928] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.929] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0059.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.929] lstrlenW (lpString=".doc") returned 4 [0059.929] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.929] lstrlenW (lpString=".docx") returned 5 [0059.929] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.929] lstrlenW (lpString=".pdf") returned 4 [0059.929] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.929] lstrlenW (lpString=".xls") returned 4 [0059.929] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.929] lstrlenW (lpString=".xlsx") returned 5 [0059.929] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.929] lstrlenW (lpString=".ppt") returned 4 [0059.929] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.929] lstrlenW (lpString=".zip") returned 4 [0059.929] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.929] lstrlenW (lpString=".rar") returned 4 [0059.929] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.930] lstrlenW (lpString=".bz2") returned 4 [0059.930] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.930] lstrlenW (lpString=".7z") returned 3 [0059.930] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.930] lstrlenW (lpString=".dbf") returned 4 [0059.930] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.930] lstrlenW (lpString=".1cd") returned 4 [0059.930] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.930] lstrlenW (lpString=".jpg") returned 4 [0059.930] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.930] lstrlenW (lpString=".doc") returned 4 [0059.930] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.930] lstrlenW (lpString=".docx") returned 5 [0059.930] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.930] lstrlenW (lpString=".pdf") returned 4 [0059.930] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.930] lstrlenW (lpString=".xls") returned 4 [0059.930] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.930] lstrlenW (lpString=".xlsx") returned 5 [0059.930] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.930] lstrlenW (lpString=".ppt") returned 4 [0059.930] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.930] lstrlenW (lpString=".zip") returned 4 [0059.930] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.930] lstrlenW (lpString=".rar") returned 4 [0059.930] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.931] lstrlenW (lpString=".bz2") returned 4 [0059.931] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.931] lstrlenW (lpString=".7z") returned 3 [0059.931] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.931] lstrlenW (lpString=".dbf") returned 4 [0059.931] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.931] lstrlenW (lpString=".1cd") returned 4 [0059.931] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0059.931] lstrlenW (lpString=".jpg") returned 4 [0059.931] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.931] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.931] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0060.179] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=33559) returned 1 [0060.179] CloseHandle (hObject=0x174) returned 1 [0060.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0060.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0060.179] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.179] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.179] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0060.180] GetLastError () returned 0x0 [0060.180] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x8317, lpOverlapped=0x0) returned 1 [0060.221] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0060.223] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.223] WriteFile (in: hFile=0x1ec, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.223] SetEndOfFile (hFile=0x1ec) returned 1 [0060.223] CloseHandle (hObject=0x1ec) returned 1 [0060.223] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.223] SetEndOfFile (hFile=0x174) returned 1 [0060.224] CloseHandle (hObject=0x174) returned 1 [0060.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.225] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0060.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.225] lstrlenW (lpString=".doc") returned 4 [0060.225] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.225] lstrlenW (lpString=".docx") returned 5 [0060.225] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.225] lstrlenW (lpString=".pdf") returned 4 [0060.225] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.225] lstrlenW (lpString=".xls") returned 4 [0060.225] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.225] lstrlenW (lpString=".xlsx") returned 5 [0060.225] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.225] lstrlenW (lpString=".ppt") returned 4 [0060.225] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.225] lstrlenW (lpString=".zip") returned 4 [0060.225] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.225] lstrlenW (lpString=".rar") returned 4 [0060.225] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.225] lstrlenW (lpString=".bz2") returned 4 [0060.225] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.225] lstrlenW (lpString=".7z") returned 3 [0060.225] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.225] lstrlenW (lpString=".dbf") returned 4 [0060.226] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.226] lstrlenW (lpString=".1cd") returned 4 [0060.226] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.226] lstrlenW (lpString=".jpg") returned 4 [0060.226] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.226] lstrlenW (lpString=".doc") returned 4 [0060.226] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.226] lstrlenW (lpString=".docx") returned 5 [0060.226] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.226] lstrlenW (lpString=".pdf") returned 4 [0060.226] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.226] lstrlenW (lpString=".xls") returned 4 [0060.226] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.226] lstrlenW (lpString=".xlsx") returned 5 [0060.226] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.226] lstrlenW (lpString=".ppt") returned 4 [0060.226] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.226] lstrlenW (lpString=".zip") returned 4 [0060.226] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.226] lstrlenW (lpString=".rar") returned 4 [0060.226] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.226] lstrlenW (lpString=".bz2") returned 4 [0060.226] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.226] lstrlenW (lpString=".7z") returned 3 [0060.226] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.226] lstrlenW (lpString=".dbf") returned 4 [0060.227] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.227] lstrlenW (lpString=".1cd") returned 4 [0060.227] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0060.227] lstrlenW (lpString=".jpg") returned 4 [0060.227] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.227] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.227] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0060.227] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1364) returned 1 [0060.227] CloseHandle (hObject=0x174) returned 1 [0060.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0060.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0060.228] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.228] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.228] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.233] GetLastError () returned 0x0 [0060.233] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x554, lpOverlapped=0x0) returned 1 [0060.262] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x560, lpOverlapped=0x0) returned 1 [0060.263] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.263] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.263] SetEndOfFile (hFile=0x1e4) returned 1 [0060.263] CloseHandle (hObject=0x1e4) returned 1 [0060.263] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.263] SetEndOfFile (hFile=0x174) returned 1 [0060.264] CloseHandle (hObject=0x174) returned 1 [0060.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.264] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0060.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.265] lstrlenW (lpString=".doc") returned 4 [0060.265] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.265] lstrlenW (lpString=".docx") returned 5 [0060.265] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.265] lstrlenW (lpString=".pdf") returned 4 [0060.265] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.265] lstrlenW (lpString=".xls") returned 4 [0060.265] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.265] lstrlenW (lpString=".xlsx") returned 5 [0060.265] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.265] lstrlenW (lpString=".ppt") returned 4 [0060.265] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.265] lstrlenW (lpString=".zip") returned 4 [0060.265] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.265] lstrlenW (lpString=".rar") returned 4 [0060.265] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.265] lstrlenW (lpString=".bz2") returned 4 [0060.265] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.265] lstrlenW (lpString=".7z") returned 3 [0060.265] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.265] lstrlenW (lpString=".dbf") returned 4 [0060.265] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.265] lstrlenW (lpString=".1cd") returned 4 [0060.265] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.265] lstrlenW (lpString=".jpg") returned 4 [0060.266] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.266] lstrlenW (lpString=".doc") returned 4 [0060.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.266] lstrlenW (lpString=".docx") returned 5 [0060.266] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.266] lstrlenW (lpString=".pdf") returned 4 [0060.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.266] lstrlenW (lpString=".xls") returned 4 [0060.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.266] lstrlenW (lpString=".xlsx") returned 5 [0060.266] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.266] lstrlenW (lpString=".ppt") returned 4 [0060.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.266] lstrlenW (lpString=".zip") returned 4 [0060.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.266] lstrlenW (lpString=".rar") returned 4 [0060.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.266] lstrlenW (lpString=".bz2") returned 4 [0060.266] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.266] lstrlenW (lpString=".7z") returned 3 [0060.266] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.266] lstrlenW (lpString=".dbf") returned 4 [0060.266] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.266] lstrlenW (lpString=".1cd") returned 4 [0060.266] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0060.267] lstrlenW (lpString=".jpg") returned 4 [0060.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.267] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.267] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0060.267] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1593) returned 1 [0060.267] CloseHandle (hObject=0x174) returned 1 [0060.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0060.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0060.268] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.268] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.279] GetLastError () returned 0x0 [0060.279] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x639, lpOverlapped=0x0) returned 1 [0060.290] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x640, lpOverlapped=0x0) returned 1 [0060.297] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.297] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.297] SetEndOfFile (hFile=0x20c) returned 1 [0060.297] CloseHandle (hObject=0x20c) returned 1 [0060.298] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.298] SetEndOfFile (hFile=0x174) returned 1 [0060.298] CloseHandle (hObject=0x174) returned 1 [0060.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.299] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0060.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.299] lstrlenW (lpString=".doc") returned 4 [0060.299] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.299] lstrlenW (lpString=".docx") returned 5 [0060.299] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.299] lstrlenW (lpString=".pdf") returned 4 [0060.299] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.299] lstrlenW (lpString=".xls") returned 4 [0060.299] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.299] lstrlenW (lpString=".xlsx") returned 5 [0060.299] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.299] lstrlenW (lpString=".ppt") returned 4 [0060.299] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.299] lstrlenW (lpString=".zip") returned 4 [0060.299] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.299] lstrlenW (lpString=".rar") returned 4 [0060.299] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.299] lstrlenW (lpString=".bz2") returned 4 [0060.299] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.300] lstrlenW (lpString=".7z") returned 3 [0060.300] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.300] lstrlenW (lpString=".dbf") returned 4 [0060.300] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.300] lstrlenW (lpString=".1cd") returned 4 [0060.300] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.300] lstrlenW (lpString=".jpg") returned 4 [0060.300] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.300] lstrlenW (lpString=".doc") returned 4 [0060.300] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.300] lstrlenW (lpString=".docx") returned 5 [0060.300] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.300] lstrlenW (lpString=".pdf") returned 4 [0060.300] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.300] lstrlenW (lpString=".xls") returned 4 [0060.300] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.300] lstrlenW (lpString=".xlsx") returned 5 [0060.300] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.300] lstrlenW (lpString=".ppt") returned 4 [0060.300] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.300] lstrlenW (lpString=".zip") returned 4 [0060.300] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.300] lstrlenW (lpString=".rar") returned 4 [0060.300] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.300] lstrlenW (lpString=".bz2") returned 4 [0060.300] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.301] lstrlenW (lpString=".7z") returned 3 [0060.301] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.301] lstrlenW (lpString=".dbf") returned 4 [0060.301] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.301] lstrlenW (lpString=".1cd") returned 4 [0060.301] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0060.301] lstrlenW (lpString=".jpg") returned 4 [0060.301] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.301] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.301] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0060.301] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1439) returned 1 [0060.301] CloseHandle (hObject=0x174) returned 1 [0060.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0060.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0060.302] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.302] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.304] GetLastError () returned 0x0 [0060.304] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x59f, lpOverlapped=0x0) returned 1 [0060.307] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0060.308] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.308] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.308] SetEndOfFile (hFile=0x20c) returned 1 [0060.308] CloseHandle (hObject=0x20c) returned 1 [0060.308] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.308] SetEndOfFile (hFile=0x174) returned 1 [0060.309] CloseHandle (hObject=0x174) returned 1 [0060.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.309] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0060.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.310] lstrlenW (lpString=".doc") returned 4 [0060.310] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.310] lstrlenW (lpString=".docx") returned 5 [0060.310] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.310] lstrlenW (lpString=".pdf") returned 4 [0060.310] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.310] lstrlenW (lpString=".xls") returned 4 [0060.310] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.310] lstrlenW (lpString=".xlsx") returned 5 [0060.310] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.310] lstrlenW (lpString=".ppt") returned 4 [0060.310] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.310] lstrlenW (lpString=".zip") returned 4 [0060.310] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.310] lstrlenW (lpString=".rar") returned 4 [0060.310] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.310] lstrlenW (lpString=".bz2") returned 4 [0060.310] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.310] lstrlenW (lpString=".7z") returned 3 [0060.310] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.310] lstrlenW (lpString=".dbf") returned 4 [0060.310] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.310] lstrlenW (lpString=".1cd") returned 4 [0060.310] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.311] lstrlenW (lpString=".jpg") returned 4 [0060.311] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.311] lstrlenW (lpString=".doc") returned 4 [0060.311] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.311] lstrlenW (lpString=".docx") returned 5 [0060.311] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.311] lstrlenW (lpString=".pdf") returned 4 [0060.311] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.311] lstrlenW (lpString=".xls") returned 4 [0060.311] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.311] lstrlenW (lpString=".xlsx") returned 5 [0060.311] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.311] lstrlenW (lpString=".ppt") returned 4 [0060.311] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.311] lstrlenW (lpString=".zip") returned 4 [0060.311] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.311] lstrlenW (lpString=".rar") returned 4 [0060.311] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.311] lstrlenW (lpString=".bz2") returned 4 [0060.311] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.311] lstrlenW (lpString=".7z") returned 3 [0060.311] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.311] lstrlenW (lpString=".dbf") returned 4 [0060.311] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.311] lstrlenW (lpString=".1cd") returned 4 [0060.311] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0060.312] lstrlenW (lpString=".jpg") returned 4 [0060.312] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.312] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.312] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0060.312] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=37112) returned 1 [0060.312] CloseHandle (hObject=0x174) returned 1 [0060.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0060.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0060.312] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.313] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.313] GetLastError () returned 0x0 [0060.313] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0060.456] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0060.460] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.460] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.460] SetEndOfFile (hFile=0x20c) returned 1 [0060.460] CloseHandle (hObject=0x20c) returned 1 [0060.460] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.460] SetEndOfFile (hFile=0x174) returned 1 [0060.461] CloseHandle (hObject=0x174) returned 1 [0060.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.462] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0060.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.462] lstrlenW (lpString=".doc") returned 4 [0060.462] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.462] lstrlenW (lpString=".docx") returned 5 [0060.462] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.462] lstrlenW (lpString=".pdf") returned 4 [0060.462] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.462] lstrlenW (lpString=".xls") returned 4 [0060.462] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.462] lstrlenW (lpString=".xlsx") returned 5 [0060.462] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.462] lstrlenW (lpString=".ppt") returned 4 [0060.462] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.462] lstrlenW (lpString=".zip") returned 4 [0060.462] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.462] lstrlenW (lpString=".rar") returned 4 [0060.462] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.462] lstrlenW (lpString=".bz2") returned 4 [0060.462] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.463] lstrlenW (lpString=".7z") returned 3 [0060.463] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.463] lstrlenW (lpString=".dbf") returned 4 [0060.463] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.463] lstrlenW (lpString=".1cd") returned 4 [0060.463] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.463] lstrlenW (lpString=".jpg") returned 4 [0060.463] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.463] lstrlenW (lpString=".doc") returned 4 [0060.463] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.463] lstrlenW (lpString=".docx") returned 5 [0060.463] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.463] lstrlenW (lpString=".pdf") returned 4 [0060.463] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.463] lstrlenW (lpString=".xls") returned 4 [0060.463] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.463] lstrlenW (lpString=".xlsx") returned 5 [0060.463] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.463] lstrlenW (lpString=".ppt") returned 4 [0060.463] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.463] lstrlenW (lpString=".zip") returned 4 [0060.463] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.463] lstrlenW (lpString=".rar") returned 4 [0060.463] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.463] lstrlenW (lpString=".bz2") returned 4 [0060.463] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.464] lstrlenW (lpString=".7z") returned 3 [0060.464] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.464] lstrlenW (lpString=".dbf") returned 4 [0060.464] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.464] lstrlenW (lpString=".1cd") returned 4 [0060.464] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0060.464] lstrlenW (lpString=".jpg") returned 4 [0060.464] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.464] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.464] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.756] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=19563) returned 1 [0060.757] CloseHandle (hObject=0x210) returned 1 [0060.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0060.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.757] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.757] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.757] GetLastError () returned 0x0 [0060.757] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0060.763] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0060.765] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.765] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.766] SetEndOfFile (hFile=0x204) returned 1 [0060.766] CloseHandle (hObject=0x204) returned 1 [0060.766] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.766] SetEndOfFile (hFile=0x210) returned 1 [0060.767] CloseHandle (hObject=0x210) returned 1 [0060.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.767] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0060.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.767] lstrlenW (lpString=".doc") returned 4 [0060.767] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.767] lstrlenW (lpString=".docx") returned 5 [0060.767] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.767] lstrlenW (lpString=".pdf") returned 4 [0060.767] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.768] lstrlenW (lpString=".xls") returned 4 [0060.768] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.768] lstrlenW (lpString=".xlsx") returned 5 [0060.768] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.768] lstrlenW (lpString=".ppt") returned 4 [0060.768] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.768] lstrlenW (lpString=".zip") returned 4 [0060.768] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.768] lstrlenW (lpString=".rar") returned 4 [0060.768] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.768] lstrlenW (lpString=".bz2") returned 4 [0060.768] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.768] lstrlenW (lpString=".7z") returned 3 [0060.768] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.768] lstrlenW (lpString=".dbf") returned 4 [0060.768] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.768] lstrlenW (lpString=".1cd") returned 4 [0060.768] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.768] lstrlenW (lpString=".jpg") returned 4 [0060.768] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.768] lstrlenW (lpString=".doc") returned 4 [0060.768] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.768] lstrlenW (lpString=".docx") returned 5 [0060.768] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.768] lstrlenW (lpString=".pdf") returned 4 [0060.768] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.769] lstrlenW (lpString=".xls") returned 4 [0060.769] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.769] lstrlenW (lpString=".xlsx") returned 5 [0060.769] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.769] lstrlenW (lpString=".ppt") returned 4 [0060.769] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.769] lstrlenW (lpString=".zip") returned 4 [0060.769] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.769] lstrlenW (lpString=".rar") returned 4 [0060.769] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.769] lstrlenW (lpString=".bz2") returned 4 [0060.769] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.769] lstrlenW (lpString=".7z") returned 3 [0060.769] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.769] lstrlenW (lpString=".dbf") returned 4 [0060.769] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.769] lstrlenW (lpString=".1cd") returned 4 [0060.769] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0060.769] lstrlenW (lpString=".jpg") returned 4 [0060.769] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.769] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.769] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.770] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=47962) returned 1 [0060.770] CloseHandle (hObject=0x210) returned 1 [0060.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0060.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0060.770] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.770] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.771] GetLastError () returned 0x0 [0060.771] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0060.828] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0060.830] ReadFile (in: hFile=0x210, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.830] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.830] SetEndOfFile (hFile=0x204) returned 1 [0060.830] CloseHandle (hObject=0x204) returned 1 [0060.831] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.831] SetEndOfFile (hFile=0x210) returned 1 [0060.832] CloseHandle (hObject=0x210) returned 1 [0060.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.832] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0060.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.833] lstrlenW (lpString=".doc") returned 4 [0060.833] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.833] lstrlenW (lpString=".docx") returned 5 [0060.833] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.833] lstrlenW (lpString=".pdf") returned 4 [0060.833] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.833] lstrlenW (lpString=".xls") returned 4 [0060.833] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.833] lstrlenW (lpString=".xlsx") returned 5 [0060.833] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.833] lstrlenW (lpString=".ppt") returned 4 [0060.833] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.833] lstrlenW (lpString=".zip") returned 4 [0060.833] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.833] lstrlenW (lpString=".rar") returned 4 [0060.833] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.833] lstrlenW (lpString=".bz2") returned 4 [0060.833] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.833] lstrlenW (lpString=".7z") returned 3 [0060.833] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.833] lstrlenW (lpString=".dbf") returned 4 [0060.833] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.834] lstrlenW (lpString=".1cd") returned 4 [0060.834] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.834] lstrlenW (lpString=".jpg") returned 4 [0060.834] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.834] lstrlenW (lpString=".doc") returned 4 [0060.834] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.834] lstrlenW (lpString=".docx") returned 5 [0060.834] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.834] lstrlenW (lpString=".pdf") returned 4 [0060.834] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.834] lstrlenW (lpString=".xls") returned 4 [0060.834] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.834] lstrlenW (lpString=".xlsx") returned 5 [0060.834] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.834] lstrlenW (lpString=".ppt") returned 4 [0060.834] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.834] lstrlenW (lpString=".zip") returned 4 [0060.834] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.834] lstrlenW (lpString=".rar") returned 4 [0060.834] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.834] lstrlenW (lpString=".bz2") returned 4 [0060.834] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.834] lstrlenW (lpString=".7z") returned 3 [0060.834] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.834] lstrlenW (lpString=".dbf") returned 4 [0060.834] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.835] lstrlenW (lpString=".1cd") returned 4 [0060.835] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0060.835] lstrlenW (lpString=".jpg") returned 4 [0060.835] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.835] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.835] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.854] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=29305) returned 1 [0060.854] CloseHandle (hObject=0x1f0) returned 1 [0060.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0060.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.854] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.855] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.855] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.855] GetLastError () returned 0x0 [0060.855] ReadFile (in: hFile=0x1f0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x7279, lpOverlapped=0x0) returned 1 [0060.860] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0060.861] ReadFile (in: hFile=0x1f0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.862] WriteFile (in: hFile=0x20c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.862] SetEndOfFile (hFile=0x20c) returned 1 [0060.862] CloseHandle (hObject=0x20c) returned 1 [0060.862] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.862] SetEndOfFile (hFile=0x1f0) returned 1 [0060.863] CloseHandle (hObject=0x1f0) returned 1 [0060.863] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.864] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0060.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.864] lstrlenW (lpString=".doc") returned 4 [0060.864] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.864] lstrlenW (lpString=".docx") returned 5 [0060.864] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.864] lstrlenW (lpString=".pdf") returned 4 [0060.864] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.864] lstrlenW (lpString=".xls") returned 4 [0060.864] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.864] lstrlenW (lpString=".xlsx") returned 5 [0060.864] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.864] lstrlenW (lpString=".ppt") returned 4 [0060.864] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.864] lstrlenW (lpString=".zip") returned 4 [0060.864] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.864] lstrlenW (lpString=".rar") returned 4 [0060.864] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.864] lstrlenW (lpString=".bz2") returned 4 [0060.864] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.864] lstrlenW (lpString=".7z") returned 3 [0060.865] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.865] lstrlenW (lpString=".dbf") returned 4 [0060.865] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.865] lstrlenW (lpString=".1cd") returned 4 [0060.865] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.865] lstrlenW (lpString=".jpg") returned 4 [0060.865] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.865] lstrlenW (lpString=".doc") returned 4 [0060.865] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.865] lstrlenW (lpString=".docx") returned 5 [0060.865] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.865] lstrlenW (lpString=".pdf") returned 4 [0060.865] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.865] lstrlenW (lpString=".xls") returned 4 [0060.865] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.865] lstrlenW (lpString=".xlsx") returned 5 [0060.865] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.865] lstrlenW (lpString=".ppt") returned 4 [0060.865] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.865] lstrlenW (lpString=".zip") returned 4 [0060.865] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.865] lstrlenW (lpString=".rar") returned 4 [0060.865] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.865] lstrlenW (lpString=".bz2") returned 4 [0060.865] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.865] lstrlenW (lpString=".7z") returned 3 [0060.866] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.866] lstrlenW (lpString=".dbf") returned 4 [0060.866] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.866] lstrlenW (lpString=".1cd") returned 4 [0060.866] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0060.866] lstrlenW (lpString=".jpg") returned 4 [0060.866] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.866] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.866] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.871] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=27177) returned 1 [0060.871] CloseHandle (hObject=0x20c) returned 1 [0060.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0060.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.871] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.871] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.871] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.878] GetLastError () returned 0x0 [0060.881] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0060.923] WriteFile (in: hFile=0x21c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0060.924] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.924] WriteFile (in: hFile=0x21c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.924] SetEndOfFile (hFile=0x21c) returned 1 [0060.924] CloseHandle (hObject=0x21c) returned 1 [0060.925] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.925] SetEndOfFile (hFile=0x20c) returned 1 [0060.926] CloseHandle (hObject=0x20c) returned 1 [0060.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.926] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0060.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.926] lstrlenW (lpString=".doc") returned 4 [0060.926] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.926] lstrlenW (lpString=".docx") returned 5 [0060.926] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.926] lstrlenW (lpString=".pdf") returned 4 [0060.926] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.926] lstrlenW (lpString=".xls") returned 4 [0060.926] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.926] lstrlenW (lpString=".xlsx") returned 5 [0060.927] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.927] lstrlenW (lpString=".ppt") returned 4 [0060.927] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.927] lstrlenW (lpString=".zip") returned 4 [0060.927] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.927] lstrlenW (lpString=".rar") returned 4 [0060.927] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.927] lstrlenW (lpString=".bz2") returned 4 [0060.927] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.927] lstrlenW (lpString=".7z") returned 3 [0060.927] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.927] lstrlenW (lpString=".dbf") returned 4 [0060.927] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.927] lstrlenW (lpString=".1cd") returned 4 [0060.927] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.927] lstrlenW (lpString=".jpg") returned 4 [0060.927] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.927] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.927] lstrlenW (lpString=".doc") returned 4 [0060.927] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.927] lstrlenW (lpString=".docx") returned 5 [0060.927] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.927] lstrlenW (lpString=".pdf") returned 4 [0060.927] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.927] lstrlenW (lpString=".xls") returned 4 [0060.927] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.927] lstrlenW (lpString=".xlsx") returned 5 [0060.928] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.928] lstrlenW (lpString=".ppt") returned 4 [0060.928] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.928] lstrlenW (lpString=".zip") returned 4 [0060.928] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.928] lstrlenW (lpString=".rar") returned 4 [0060.928] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.928] lstrlenW (lpString=".bz2") returned 4 [0060.928] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.928] lstrlenW (lpString=".7z") returned 3 [0060.928] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.928] lstrlenW (lpString=".dbf") returned 4 [0060.928] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.928] lstrlenW (lpString=".1cd") returned 4 [0060.928] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0060.928] lstrlenW (lpString=".jpg") returned 4 [0060.928] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.928] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.928] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.929] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2527) returned 1 [0060.929] CloseHandle (hObject=0x20c) returned 1 [0060.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0060.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.929] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.929] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.931] GetLastError () returned 0x0 [0060.931] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x9df, lpOverlapped=0x0) returned 1 [0060.935] WriteFile (in: hFile=0x21c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0060.936] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.936] WriteFile (in: hFile=0x21c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.936] SetEndOfFile (hFile=0x21c) returned 1 [0060.936] CloseHandle (hObject=0x21c) returned 1 [0060.936] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.936] SetEndOfFile (hFile=0x20c) returned 1 [0060.937] CloseHandle (hObject=0x20c) returned 1 [0060.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.937] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0060.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.938] lstrlenW (lpString=".doc") returned 4 [0060.938] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.938] lstrlenW (lpString=".docx") returned 5 [0060.938] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.938] lstrlenW (lpString=".pdf") returned 4 [0060.938] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.938] lstrlenW (lpString=".xls") returned 4 [0060.938] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.938] lstrlenW (lpString=".xlsx") returned 5 [0060.938] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.938] lstrlenW (lpString=".ppt") returned 4 [0060.938] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.938] lstrlenW (lpString=".zip") returned 4 [0060.938] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.938] lstrlenW (lpString=".rar") returned 4 [0060.938] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.938] lstrlenW (lpString=".bz2") returned 4 [0060.938] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.938] lstrlenW (lpString=".7z") returned 3 [0060.938] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.938] lstrlenW (lpString=".dbf") returned 4 [0060.938] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.938] lstrlenW (lpString=".1cd") returned 4 [0060.938] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.938] lstrlenW (lpString=".jpg") returned 4 [0060.938] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.939] lstrlenW (lpString=".doc") returned 4 [0060.939] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.939] lstrlenW (lpString=".docx") returned 5 [0060.939] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.939] lstrlenW (lpString=".pdf") returned 4 [0060.939] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.939] lstrlenW (lpString=".xls") returned 4 [0060.939] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.939] lstrlenW (lpString=".xlsx") returned 5 [0060.939] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.939] lstrlenW (lpString=".ppt") returned 4 [0060.939] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.939] lstrlenW (lpString=".zip") returned 4 [0060.939] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.939] lstrlenW (lpString=".rar") returned 4 [0060.939] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.939] lstrlenW (lpString=".bz2") returned 4 [0060.939] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.939] lstrlenW (lpString=".7z") returned 3 [0060.939] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.939] lstrlenW (lpString=".dbf") returned 4 [0060.939] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.939] lstrlenW (lpString=".1cd") returned 4 [0060.939] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0060.939] lstrlenW (lpString=".jpg") returned 4 [0060.939] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.940] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.940] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.941] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=19525) returned 1 [0060.941] CloseHandle (hObject=0x20c) returned 1 [0060.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0060.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.941] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.941] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.941] GetLastError () returned 0x0 [0060.941] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x4c45, lpOverlapped=0x0) returned 1 [0060.944] WriteFile (in: hFile=0x21c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0060.945] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.945] WriteFile (in: hFile=0x21c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.945] SetEndOfFile (hFile=0x21c) returned 1 [0060.945] CloseHandle (hObject=0x21c) returned 1 [0060.945] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.945] SetEndOfFile (hFile=0x20c) returned 1 [0060.946] CloseHandle (hObject=0x20c) returned 1 [0060.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.947] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0060.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.947] lstrlenW (lpString=".doc") returned 4 [0060.947] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.947] lstrlenW (lpString=".docx") returned 5 [0060.947] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.947] lstrlenW (lpString=".pdf") returned 4 [0060.947] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.947] lstrlenW (lpString=".xls") returned 4 [0060.947] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.947] lstrlenW (lpString=".xlsx") returned 5 [0060.947] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.947] lstrlenW (lpString=".ppt") returned 4 [0060.947] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.947] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.947] lstrlenW (lpString=".zip") returned 4 [0060.947] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.947] lstrlenW (lpString=".rar") returned 4 [0060.947] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.948] lstrlenW (lpString=".bz2") returned 4 [0060.948] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.948] lstrlenW (lpString=".7z") returned 3 [0060.948] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.948] lstrlenW (lpString=".dbf") returned 4 [0060.948] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.948] lstrlenW (lpString=".1cd") returned 4 [0060.948] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.948] lstrlenW (lpString=".jpg") returned 4 [0060.948] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.948] lstrlenW (lpString=".doc") returned 4 [0060.948] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.948] lstrlenW (lpString=".docx") returned 5 [0060.948] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.948] lstrlenW (lpString=".pdf") returned 4 [0060.948] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.948] lstrlenW (lpString=".xls") returned 4 [0060.948] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.948] lstrlenW (lpString=".xlsx") returned 5 [0060.948] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.948] lstrlenW (lpString=".ppt") returned 4 [0060.948] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.948] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.948] lstrlenW (lpString=".zip") returned 4 [0060.948] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.948] lstrlenW (lpString=".rar") returned 4 [0060.948] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.949] lstrlenW (lpString=".bz2") returned 4 [0060.949] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.949] lstrlenW (lpString=".7z") returned 3 [0060.949] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.949] lstrlenW (lpString=".dbf") returned 4 [0060.949] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.949] lstrlenW (lpString=".1cd") returned 4 [0060.949] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.949] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0060.949] lstrlenW (lpString=".jpg") returned 4 [0060.949] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.949] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.949] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.949] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.949] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1737) returned 1 [0060.949] CloseHandle (hObject=0x20c) returned 1 [0060.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0060.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.950] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.950] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.950] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.952] GetLastError () returned 0x0 [0060.952] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0060.954] WriteFile (in: hFile=0x21c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0060.955] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.955] WriteFile (in: hFile=0x21c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.955] SetEndOfFile (hFile=0x21c) returned 1 [0060.955] CloseHandle (hObject=0x21c) returned 1 [0060.955] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.955] SetEndOfFile (hFile=0x20c) returned 1 [0060.956] CloseHandle (hObject=0x20c) returned 1 [0060.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.957] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0060.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.957] lstrlenW (lpString=".doc") returned 4 [0060.957] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.957] lstrlenW (lpString=".docx") returned 5 [0060.957] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.957] lstrlenW (lpString=".pdf") returned 4 [0060.957] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.957] lstrlenW (lpString=".xls") returned 4 [0060.957] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.957] lstrlenW (lpString=".xlsx") returned 5 [0060.957] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.957] lstrlenW (lpString=".ppt") returned 4 [0060.957] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.957] lstrlenW (lpString=".zip") returned 4 [0060.957] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.957] lstrlenW (lpString=".rar") returned 4 [0060.957] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.957] lstrlenW (lpString=".bz2") returned 4 [0060.957] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.957] lstrlenW (lpString=".7z") returned 3 [0060.957] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.957] lstrlenW (lpString=".dbf") returned 4 [0060.957] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.958] lstrlenW (lpString=".1cd") returned 4 [0060.958] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.958] lstrlenW (lpString=".jpg") returned 4 [0060.958] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.958] lstrlenW (lpString=".doc") returned 4 [0060.958] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.958] lstrlenW (lpString=".docx") returned 5 [0060.958] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.958] lstrlenW (lpString=".pdf") returned 4 [0060.958] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.958] lstrlenW (lpString=".xls") returned 4 [0060.958] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.958] lstrlenW (lpString=".xlsx") returned 5 [0060.958] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.958] lstrlenW (lpString=".ppt") returned 4 [0060.958] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.958] lstrlenW (lpString=".zip") returned 4 [0060.958] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.958] lstrlenW (lpString=".rar") returned 4 [0060.958] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.958] lstrlenW (lpString=".bz2") returned 4 [0060.958] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.958] lstrlenW (lpString=".7z") returned 3 [0060.958] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.958] lstrlenW (lpString=".dbf") returned 4 [0060.959] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.959] lstrlenW (lpString=".1cd") returned 4 [0060.959] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0060.959] lstrlenW (lpString=".jpg") returned 4 [0060.959] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.959] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.959] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.959] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.959] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=33479) returned 1 [0060.959] CloseHandle (hObject=0x20c) returned 1 [0060.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0060.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.960] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.960] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0060.960] GetLastError () returned 0x0 [0060.960] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0061.125] WriteFile (in: hFile=0x21c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0061.127] ReadFile (in: hFile=0x20c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.127] WriteFile (in: hFile=0x21c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.127] SetEndOfFile (hFile=0x21c) returned 1 [0061.127] CloseHandle (hObject=0x21c) returned 1 [0061.127] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.127] SetEndOfFile (hFile=0x20c) returned 1 [0061.128] CloseHandle (hObject=0x20c) returned 1 [0061.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.129] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0061.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.129] lstrlenW (lpString=".doc") returned 4 [0061.129] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.129] lstrlenW (lpString=".docx") returned 5 [0061.129] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.129] lstrlenW (lpString=".pdf") returned 4 [0061.129] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.129] lstrlenW (lpString=".xls") returned 4 [0061.129] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.129] lstrlenW (lpString=".xlsx") returned 5 [0061.129] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.129] lstrlenW (lpString=".ppt") returned 4 [0061.129] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.129] lstrlenW (lpString=".zip") returned 4 [0061.129] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.129] lstrlenW (lpString=".rar") returned 4 [0061.129] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.129] lstrlenW (lpString=".bz2") returned 4 [0061.129] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.129] lstrlenW (lpString=".7z") returned 3 [0061.129] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.129] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.129] lstrlenW (lpString=".dbf") returned 4 [0061.130] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.130] lstrlenW (lpString=".1cd") returned 4 [0061.130] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.130] lstrlenW (lpString=".jpg") returned 4 [0061.130] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.130] lstrlenW (lpString=".doc") returned 4 [0061.130] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.130] lstrlenW (lpString=".docx") returned 5 [0061.130] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.130] lstrlenW (lpString=".pdf") returned 4 [0061.130] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.130] lstrlenW (lpString=".xls") returned 4 [0061.130] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.130] lstrlenW (lpString=".xlsx") returned 5 [0061.130] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.130] lstrlenW (lpString=".ppt") returned 4 [0061.130] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.130] lstrlenW (lpString=".zip") returned 4 [0061.130] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.130] lstrlenW (lpString=".rar") returned 4 [0061.130] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.130] lstrlenW (lpString=".bz2") returned 4 [0061.130] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.130] lstrlenW (lpString=".7z") returned 3 [0061.130] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.130] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.130] lstrlenW (lpString=".dbf") returned 4 [0061.131] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.131] lstrlenW (lpString=".1cd") returned 4 [0061.131] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.131] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0061.131] lstrlenW (lpString=".jpg") returned 4 [0061.131] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.131] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0061.131] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0061.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.339] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=44302) returned 1 [0061.339] CloseHandle (hObject=0x180) returned 1 [0061.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0061.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.339] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.339] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0061.340] GetLastError () returned 0x0 [0061.340] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0061.342] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0061.343] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.344] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.344] SetEndOfFile (hFile=0x1e8) returned 1 [0061.344] CloseHandle (hObject=0x1e8) returned 1 [0061.344] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.344] SetEndOfFile (hFile=0x180) returned 1 [0061.345] CloseHandle (hObject=0x180) returned 1 [0061.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.345] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0061.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.348] lstrlenW (lpString=".doc") returned 4 [0061.348] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.348] lstrlenW (lpString=".docx") returned 5 [0061.348] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.348] lstrlenW (lpString=".pdf") returned 4 [0061.348] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.348] lstrlenW (lpString=".xls") returned 4 [0061.348] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.348] lstrlenW (lpString=".xlsx") returned 5 [0061.348] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.348] lstrlenW (lpString=".ppt") returned 4 [0061.348] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.348] lstrlenW (lpString=".zip") returned 4 [0061.348] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.348] lstrlenW (lpString=".rar") returned 4 [0061.348] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.348] lstrlenW (lpString=".bz2") returned 4 [0061.349] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.349] lstrlenW (lpString=".7z") returned 3 [0061.349] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.349] lstrlenW (lpString=".dbf") returned 4 [0061.349] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.349] lstrlenW (lpString=".1cd") returned 4 [0061.349] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.349] lstrlenW (lpString=".jpg") returned 4 [0061.349] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.349] lstrlenW (lpString=".doc") returned 4 [0061.349] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.349] lstrlenW (lpString=".docx") returned 5 [0061.349] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.349] lstrlenW (lpString=".pdf") returned 4 [0061.349] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.349] lstrlenW (lpString=".xls") returned 4 [0061.349] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.349] lstrlenW (lpString=".xlsx") returned 5 [0061.349] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.349] lstrlenW (lpString=".ppt") returned 4 [0061.349] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.350] lstrlenW (lpString=".zip") returned 4 [0061.350] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.350] lstrlenW (lpString=".rar") returned 4 [0061.350] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.350] lstrlenW (lpString=".bz2") returned 4 [0061.350] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.350] lstrlenW (lpString=".7z") returned 3 [0061.350] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.350] lstrlenW (lpString=".dbf") returned 4 [0061.350] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.350] lstrlenW (lpString=".1cd") returned 4 [0061.350] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0061.350] lstrlenW (lpString=".jpg") returned 4 [0061.350] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.351] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0061.351] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0061.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.351] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2668) returned 1 [0061.351] CloseHandle (hObject=0x180) returned 1 [0061.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0061.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.351] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.352] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.352] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.371] GetLastError () returned 0x0 [0061.371] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0061.392] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0061.393] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.393] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.393] SetEndOfFile (hFile=0x204) returned 1 [0061.393] CloseHandle (hObject=0x204) returned 1 [0061.394] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.394] SetEndOfFile (hFile=0x180) returned 1 [0061.395] CloseHandle (hObject=0x180) returned 1 [0061.395] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.395] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0061.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.395] lstrlenW (lpString=".doc") returned 4 [0061.395] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.395] lstrlenW (lpString=".docx") returned 5 [0061.395] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.395] lstrlenW (lpString=".pdf") returned 4 [0061.395] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.395] lstrlenW (lpString=".xls") returned 4 [0061.395] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.395] lstrlenW (lpString=".xlsx") returned 5 [0061.395] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.395] lstrlenW (lpString=".ppt") returned 4 [0061.395] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.395] lstrlenW (lpString=".zip") returned 4 [0061.396] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.396] lstrlenW (lpString=".rar") returned 4 [0061.396] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.396] lstrlenW (lpString=".bz2") returned 4 [0061.396] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.396] lstrlenW (lpString=".7z") returned 3 [0061.396] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.396] lstrlenW (lpString=".dbf") returned 4 [0061.396] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.396] lstrlenW (lpString=".1cd") returned 4 [0061.396] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.396] lstrlenW (lpString=".jpg") returned 4 [0061.396] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.396] lstrlenW (lpString=".doc") returned 4 [0061.396] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.396] lstrlenW (lpString=".docx") returned 5 [0061.396] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.396] lstrlenW (lpString=".pdf") returned 4 [0061.396] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.396] lstrlenW (lpString=".xls") returned 4 [0061.396] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.396] lstrlenW (lpString=".xlsx") returned 5 [0061.396] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.396] lstrlenW (lpString=".ppt") returned 4 [0061.396] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.396] lstrlenW (lpString=".zip") returned 4 [0061.396] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.397] lstrlenW (lpString=".rar") returned 4 [0061.397] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.397] lstrlenW (lpString=".bz2") returned 4 [0061.397] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.397] lstrlenW (lpString=".7z") returned 3 [0061.397] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.397] lstrlenW (lpString=".dbf") returned 4 [0061.397] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.397] lstrlenW (lpString=".1cd") returned 4 [0061.397] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0061.397] lstrlenW (lpString=".jpg") returned 4 [0061.397] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.397] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0061.397] lstrlenW (lpString="VBCN6.CHM") returned 9 [0061.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.397] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=109718) returned 1 [0061.397] CloseHandle (hObject=0x180) returned 1 [0061.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0061.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.398] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.398] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.398] GetLastError () returned 0x0 [0061.398] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0061.407] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0061.410] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.410] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.410] SetEndOfFile (hFile=0x204) returned 1 [0061.411] CloseHandle (hObject=0x204) returned 1 [0061.411] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.411] SetEndOfFile (hFile=0x180) returned 1 [0061.412] CloseHandle (hObject=0x180) returned 1 [0061.412] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.412] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0061.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.414] lstrlenW (lpString=".doc") returned 4 [0061.414] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0061.414] lstrlenW (lpString=".docx") returned 5 [0061.414] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0061.414] lstrlenW (lpString=".pdf") returned 4 [0061.414] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0061.414] lstrlenW (lpString=".xls") returned 4 [0061.414] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0061.414] lstrlenW (lpString=".xlsx") returned 5 [0061.414] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0061.414] lstrlenW (lpString=".ppt") returned 4 [0061.414] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0061.414] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.414] lstrlenW (lpString=".zip") returned 4 [0061.414] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0061.414] lstrlenW (lpString=".rar") returned 4 [0061.414] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0061.414] lstrlenW (lpString=".bz2") returned 4 [0061.415] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0061.415] lstrlenW (lpString=".7z") returned 3 [0061.415] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0061.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.415] lstrlenW (lpString=".dbf") returned 4 [0061.415] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0061.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.415] lstrlenW (lpString=".1cd") returned 4 [0061.415] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0061.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.415] lstrlenW (lpString=".jpg") returned 4 [0061.415] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0061.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.415] lstrlenW (lpString=".doc") returned 4 [0061.415] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0061.415] lstrlenW (lpString=".docx") returned 5 [0061.415] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0061.415] lstrlenW (lpString=".pdf") returned 4 [0061.415] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0061.415] lstrlenW (lpString=".xls") returned 4 [0061.415] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0061.415] lstrlenW (lpString=".xlsx") returned 5 [0061.415] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0061.415] lstrlenW (lpString=".ppt") returned 4 [0061.415] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0061.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.415] lstrlenW (lpString=".zip") returned 4 [0061.415] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0061.415] lstrlenW (lpString=".rar") returned 4 [0061.415] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0061.416] lstrlenW (lpString=".bz2") returned 4 [0061.416] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0061.416] lstrlenW (lpString=".7z") returned 3 [0061.416] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0061.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.416] lstrlenW (lpString=".dbf") returned 4 [0061.416] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0061.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.416] lstrlenW (lpString=".1cd") returned 4 [0061.416] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0061.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0061.416] lstrlenW (lpString=".jpg") returned 4 [0061.416] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0061.416] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0061.416] lstrlenW (lpString="VBHW6.CHM") returned 9 [0061.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.417] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=58026) returned 1 [0061.417] CloseHandle (hObject=0x180) returned 1 [0061.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0061.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.417] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.417] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.418] GetLastError () returned 0x0 [0061.418] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0061.442] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0061.444] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.444] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.444] SetEndOfFile (hFile=0x204) returned 1 [0061.444] CloseHandle (hObject=0x204) returned 1 [0061.444] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.444] SetEndOfFile (hFile=0x180) returned 1 [0061.445] CloseHandle (hObject=0x180) returned 1 [0061.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.446] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0061.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.446] lstrlenW (lpString=".doc") returned 4 [0061.446] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0061.446] lstrlenW (lpString=".docx") returned 5 [0061.446] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0061.446] lstrlenW (lpString=".pdf") returned 4 [0061.446] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0061.446] lstrlenW (lpString=".xls") returned 4 [0061.446] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0061.446] lstrlenW (lpString=".xlsx") returned 5 [0061.446] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0061.446] lstrlenW (lpString=".ppt") returned 4 [0061.446] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0061.446] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.446] lstrlenW (lpString=".zip") returned 4 [0061.446] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0061.446] lstrlenW (lpString=".rar") returned 4 [0061.446] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0061.446] lstrlenW (lpString=".bz2") returned 4 [0061.446] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0061.446] lstrlenW (lpString=".7z") returned 3 [0061.447] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0061.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.447] lstrlenW (lpString=".dbf") returned 4 [0061.447] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0061.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.447] lstrlenW (lpString=".1cd") returned 4 [0061.447] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0061.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.447] lstrlenW (lpString=".jpg") returned 4 [0061.447] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0061.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.447] lstrlenW (lpString=".doc") returned 4 [0061.447] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0061.447] lstrlenW (lpString=".docx") returned 5 [0061.447] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0061.447] lstrlenW (lpString=".pdf") returned 4 [0061.447] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0061.447] lstrlenW (lpString=".xls") returned 4 [0061.447] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0061.447] lstrlenW (lpString=".xlsx") returned 5 [0061.447] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0061.447] lstrlenW (lpString=".ppt") returned 4 [0061.447] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0061.447] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.447] lstrlenW (lpString=".zip") returned 4 [0061.447] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0061.447] lstrlenW (lpString=".rar") returned 4 [0061.447] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0061.447] lstrlenW (lpString=".bz2") returned 4 [0061.448] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0061.448] lstrlenW (lpString=".7z") returned 3 [0061.448] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0061.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.448] lstrlenW (lpString=".dbf") returned 4 [0061.448] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0061.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.448] lstrlenW (lpString=".1cd") returned 4 [0061.448] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0061.448] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0061.448] lstrlenW (lpString=".jpg") returned 4 [0061.448] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0061.448] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0061.448] lstrlenW (lpString="VBOB6.CHM") returned 9 [0061.448] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.448] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=123956) returned 1 [0061.448] CloseHandle (hObject=0x180) returned 1 [0061.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0061.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.449] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.449] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.449] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.449] GetLastError () returned 0x0 [0061.449] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1e434, lpOverlapped=0x0) returned 1 [0061.454] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0061.546] ReadFile (in: hFile=0x180, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.546] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0061.546] SetEndOfFile (hFile=0x204) returned 1 [0061.546] CloseHandle (hObject=0x204) returned 1 [0061.546] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.546] SetEndOfFile (hFile=0x180) returned 1 [0061.548] CloseHandle (hObject=0x180) returned 1 [0061.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.548] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0061.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.548] lstrlenW (lpString=".doc") returned 4 [0061.548] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0061.548] lstrlenW (lpString=".docx") returned 5 [0061.548] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0061.548] lstrlenW (lpString=".pdf") returned 4 [0061.548] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0061.549] lstrlenW (lpString=".xls") returned 4 [0061.549] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0061.549] lstrlenW (lpString=".xlsx") returned 5 [0061.549] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0061.549] lstrlenW (lpString=".ppt") returned 4 [0061.549] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0061.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.549] lstrlenW (lpString=".zip") returned 4 [0061.549] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0061.549] lstrlenW (lpString=".rar") returned 4 [0061.549] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0061.549] lstrlenW (lpString=".bz2") returned 4 [0061.549] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0061.549] lstrlenW (lpString=".7z") returned 3 [0061.549] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0061.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.549] lstrlenW (lpString=".dbf") returned 4 [0061.549] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0061.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.549] lstrlenW (lpString=".1cd") returned 4 [0061.549] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0061.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.549] lstrlenW (lpString=".jpg") returned 4 [0061.549] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0061.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.549] lstrlenW (lpString=".doc") returned 4 [0061.549] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0061.549] lstrlenW (lpString=".docx") returned 5 [0061.549] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0061.550] lstrlenW (lpString=".pdf") returned 4 [0061.550] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0061.550] lstrlenW (lpString=".xls") returned 4 [0061.550] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0061.550] lstrlenW (lpString=".xlsx") returned 5 [0061.550] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0061.550] lstrlenW (lpString=".ppt") returned 4 [0061.550] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0061.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.550] lstrlenW (lpString=".zip") returned 4 [0061.550] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0061.550] lstrlenW (lpString=".rar") returned 4 [0061.550] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0061.550] lstrlenW (lpString=".bz2") returned 4 [0061.550] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0061.550] lstrlenW (lpString=".7z") returned 3 [0061.550] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0061.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.550] lstrlenW (lpString=".dbf") returned 4 [0061.550] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0061.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.550] lstrlenW (lpString=".1cd") returned 4 [0061.550] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0061.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0061.550] lstrlenW (lpString=".jpg") returned 4 [0061.551] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0061.551] lstrcmpiW (lpString1=".config", lpString2=".wiki") returned -1 [0061.551] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0061.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.034] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=716) returned 1 [0062.034] CloseHandle (hObject=0x204) returned 1 [0062.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0062.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.034] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.034] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.034] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0062.035] GetLastError () returned 0x0 [0062.035] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0062.057] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0062.058] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.058] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0062.058] SetEndOfFile (hFile=0x210) returned 1 [0062.058] CloseHandle (hObject=0x210) returned 1 [0062.059] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.059] SetEndOfFile (hFile=0x204) returned 1 [0062.060] CloseHandle (hObject=0x204) returned 1 [0062.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0062.060] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0062.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.060] lstrlenW (lpString=".doc") returned 4 [0062.060] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0062.060] lstrlenW (lpString=".docx") returned 5 [0062.060] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0062.060] lstrlenW (lpString=".pdf") returned 4 [0062.060] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0062.060] lstrlenW (lpString=".xls") returned 4 [0062.060] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0062.060] lstrlenW (lpString=".xlsx") returned 5 [0062.060] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0062.060] lstrlenW (lpString=".ppt") returned 4 [0062.060] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0062.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.061] lstrlenW (lpString=".zip") returned 4 [0062.061] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0062.061] lstrlenW (lpString=".rar") returned 4 [0062.061] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0062.061] lstrlenW (lpString=".bz2") returned 4 [0062.061] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0062.061] lstrlenW (lpString=".7z") returned 3 [0062.061] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0062.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.061] lstrlenW (lpString=".dbf") returned 4 [0062.061] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0062.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.061] lstrlenW (lpString=".1cd") returned 4 [0062.061] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0062.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.061] lstrlenW (lpString=".jpg") returned 4 [0062.061] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0062.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.061] lstrlenW (lpString=".doc") returned 4 [0062.061] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0062.061] lstrlenW (lpString=".docx") returned 5 [0062.061] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0062.061] lstrlenW (lpString=".pdf") returned 4 [0062.061] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0062.061] lstrlenW (lpString=".xls") returned 4 [0062.061] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0062.061] lstrlenW (lpString=".xlsx") returned 5 [0062.061] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0062.061] lstrlenW (lpString=".ppt") returned 4 [0062.061] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0062.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.062] lstrlenW (lpString=".zip") returned 4 [0062.062] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0062.062] lstrlenW (lpString=".rar") returned 4 [0062.062] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0062.062] lstrlenW (lpString=".bz2") returned 4 [0062.062] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0062.062] lstrlenW (lpString=".7z") returned 3 [0062.062] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0062.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.062] lstrlenW (lpString=".dbf") returned 4 [0062.062] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0062.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.062] lstrlenW (lpString=".1cd") returned 4 [0062.062] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0062.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0062.062] lstrlenW (lpString=".jpg") returned 4 [0062.062] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0062.062] lstrcmpiW (lpString1=".bmp", lpString2=".wiki") returned -1 [0062.062] lstrlenW (lpString="verisign.bmp") returned 12 [0062.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.067] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=2702) returned 1 [0062.067] CloseHandle (hObject=0x204) returned 1 [0062.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0062.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.067] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.068] lstrlenW (lpString=".doc") returned 4 [0062.068] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0062.068] lstrlenW (lpString=".docx") returned 5 [0062.068] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0062.068] lstrlenW (lpString=".pdf") returned 4 [0062.068] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0062.068] lstrlenW (lpString=".xls") returned 4 [0062.068] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0062.068] lstrlenW (lpString=".xlsx") returned 5 [0062.068] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0062.068] lstrlenW (lpString=".ppt") returned 4 [0062.068] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0062.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.068] lstrlenW (lpString=".zip") returned 4 [0062.068] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0062.068] lstrlenW (lpString=".rar") returned 4 [0062.068] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0062.068] lstrlenW (lpString=".bz2") returned 4 [0062.068] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0062.068] lstrlenW (lpString=".7z") returned 3 [0062.068] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0062.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.068] lstrlenW (lpString=".dbf") returned 4 [0062.068] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0062.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.068] lstrlenW (lpString=".1cd") returned 4 [0062.068] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0062.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.068] lstrlenW (lpString=".jpg") returned 4 [0062.068] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0062.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.069] lstrlenW (lpString=".doc") returned 4 [0062.069] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0062.069] lstrlenW (lpString=".docx") returned 5 [0062.069] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0062.069] lstrlenW (lpString=".pdf") returned 4 [0062.069] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0062.069] lstrlenW (lpString=".xls") returned 4 [0062.069] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0062.069] lstrlenW (lpString=".xlsx") returned 5 [0062.069] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0062.069] lstrlenW (lpString=".ppt") returned 4 [0062.069] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0062.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.069] lstrlenW (lpString=".zip") returned 4 [0062.069] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0062.069] lstrlenW (lpString=".rar") returned 4 [0062.069] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0062.069] lstrlenW (lpString=".bz2") returned 4 [0062.069] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0062.069] lstrlenW (lpString=".7z") returned 3 [0062.069] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0062.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.069] lstrlenW (lpString=".dbf") returned 4 [0062.069] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0062.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.069] lstrlenW (lpString=".1cd") returned 4 [0062.069] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0062.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0062.069] lstrlenW (lpString=".jpg") returned 4 [0062.069] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0062.070] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0062.070] lstrlenW (lpString="adojavas.inc") returned 12 [0062.070] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.075] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14610) returned 1 [0062.076] CloseHandle (hObject=0x204) returned 1 [0062.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0062.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.076] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.076] lstrlenW (lpString=".doc") returned 4 [0062.076] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.076] lstrlenW (lpString=".docx") returned 5 [0062.076] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.076] lstrlenW (lpString=".pdf") returned 4 [0062.076] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.076] lstrlenW (lpString=".xls") returned 4 [0062.076] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.076] lstrlenW (lpString=".xlsx") returned 5 [0062.076] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.076] lstrlenW (lpString=".ppt") returned 4 [0062.076] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.076] lstrlenW (lpString=".zip") returned 4 [0062.076] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.076] lstrlenW (lpString=".rar") returned 4 [0062.076] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.076] lstrlenW (lpString=".bz2") returned 4 [0062.076] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.076] lstrlenW (lpString=".7z") returned 3 [0062.076] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.077] lstrlenW (lpString=".dbf") returned 4 [0062.077] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0062.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.077] lstrlenW (lpString=".1cd") returned 4 [0062.077] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0062.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.077] lstrlenW (lpString=".jpg") returned 4 [0062.077] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0062.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.077] lstrlenW (lpString=".doc") returned 4 [0062.077] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.077] lstrlenW (lpString=".docx") returned 5 [0062.077] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.077] lstrlenW (lpString=".pdf") returned 4 [0062.077] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.077] lstrlenW (lpString=".xls") returned 4 [0062.077] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.077] lstrlenW (lpString=".xlsx") returned 5 [0062.077] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.077] lstrlenW (lpString=".ppt") returned 4 [0062.077] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.077] lstrlenW (lpString=".zip") returned 4 [0062.077] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.077] lstrlenW (lpString=".rar") returned 4 [0062.077] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.077] lstrlenW (lpString=".bz2") returned 4 [0062.077] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.077] lstrlenW (lpString=".7z") returned 3 [0062.077] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.078] lstrlenW (lpString=".dbf") returned 4 [0062.078] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0062.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.078] lstrlenW (lpString=".1cd") returned 4 [0062.078] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0062.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0062.078] lstrlenW (lpString=".jpg") returned 4 [0062.078] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0062.078] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0062.078] lstrlenW (lpString="adovbs.inc") returned 10 [0062.078] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.078] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=14951) returned 1 [0062.078] CloseHandle (hObject=0x204) returned 1 [0062.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0062.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.079] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.079] lstrlenW (lpString=".doc") returned 4 [0062.079] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.079] lstrlenW (lpString=".docx") returned 5 [0062.079] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.079] lstrlenW (lpString=".pdf") returned 4 [0062.079] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.079] lstrlenW (lpString=".xls") returned 4 [0062.079] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.079] lstrlenW (lpString=".xlsx") returned 5 [0062.079] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.079] lstrlenW (lpString=".ppt") returned 4 [0062.079] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.079] lstrlenW (lpString=".zip") returned 4 [0062.079] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.079] lstrlenW (lpString=".rar") returned 4 [0062.079] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.079] lstrlenW (lpString=".bz2") returned 4 [0062.079] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.079] lstrlenW (lpString=".7z") returned 3 [0062.079] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.079] lstrlenW (lpString=".dbf") returned 4 [0062.079] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0062.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.079] lstrlenW (lpString=".1cd") returned 4 [0062.079] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0062.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.080] lstrlenW (lpString=".jpg") returned 4 [0062.080] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0062.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.080] lstrlenW (lpString=".doc") returned 4 [0062.080] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.080] lstrlenW (lpString=".docx") returned 5 [0062.080] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.080] lstrlenW (lpString=".pdf") returned 4 [0062.080] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.080] lstrlenW (lpString=".xls") returned 4 [0062.080] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.080] lstrlenW (lpString=".xlsx") returned 5 [0062.080] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.080] lstrlenW (lpString=".ppt") returned 4 [0062.080] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.080] lstrlenW (lpString=".zip") returned 4 [0062.080] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.080] lstrlenW (lpString=".rar") returned 4 [0062.080] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.080] lstrlenW (lpString=".bz2") returned 4 [0062.080] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.080] lstrlenW (lpString=".7z") returned 3 [0062.080] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.081] lstrlenW (lpString=".dbf") returned 4 [0062.081] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0062.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.081] lstrlenW (lpString=".1cd") returned 4 [0062.081] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0062.081] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0062.081] lstrlenW (lpString=".jpg") returned 4 [0062.081] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0062.081] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0062.081] lstrlenW (lpString="adcjavas.inc") returned 12 [0062.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.082] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=630) returned 1 [0062.082] CloseHandle (hObject=0x204) returned 1 [0062.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0062.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.082] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.082] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.082] lstrlenW (lpString=".doc") returned 4 [0062.082] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.082] lstrlenW (lpString=".docx") returned 5 [0062.082] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.082] lstrlenW (lpString=".pdf") returned 4 [0062.082] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.082] lstrlenW (lpString=".xls") returned 4 [0062.082] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.082] lstrlenW (lpString=".xlsx") returned 5 [0062.083] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.083] lstrlenW (lpString=".ppt") returned 4 [0062.083] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.083] lstrlenW (lpString=".zip") returned 4 [0062.083] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.083] lstrlenW (lpString=".rar") returned 4 [0062.083] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.083] lstrlenW (lpString=".bz2") returned 4 [0062.083] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.083] lstrlenW (lpString=".7z") returned 3 [0062.083] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.083] lstrlenW (lpString=".dbf") returned 4 [0062.083] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0062.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.083] lstrlenW (lpString=".1cd") returned 4 [0062.083] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0062.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.083] lstrlenW (lpString=".jpg") returned 4 [0062.083] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0062.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.083] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.083] lstrlenW (lpString=".doc") returned 4 [0062.083] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.083] lstrlenW (lpString=".docx") returned 5 [0062.083] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.083] lstrlenW (lpString=".pdf") returned 4 [0062.083] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.083] lstrlenW (lpString=".xls") returned 4 [0062.083] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.083] lstrlenW (lpString=".xlsx") returned 5 [0062.084] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.084] lstrlenW (lpString=".ppt") returned 4 [0062.084] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.084] lstrlenW (lpString=".zip") returned 4 [0062.084] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.084] lstrlenW (lpString=".rar") returned 4 [0062.084] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.084] lstrlenW (lpString=".bz2") returned 4 [0062.084] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.084] lstrlenW (lpString=".7z") returned 3 [0062.084] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.084] lstrlenW (lpString=".dbf") returned 4 [0062.084] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0062.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.084] lstrlenW (lpString=".1cd") returned 4 [0062.084] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0062.084] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0062.084] lstrlenW (lpString=".jpg") returned 4 [0062.084] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0062.084] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0062.084] lstrlenW (lpString="adcvbs.inc") returned 10 [0062.084] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0062.085] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=623) returned 1 [0062.085] CloseHandle (hObject=0x204) returned 1 [0062.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0062.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.085] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.085] lstrlenW (lpString=".doc") returned 4 [0062.085] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.085] lstrlenW (lpString=".docx") returned 5 [0062.085] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.085] lstrlenW (lpString=".pdf") returned 4 [0062.085] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.085] lstrlenW (lpString=".xls") returned 4 [0062.085] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.085] lstrlenW (lpString=".xlsx") returned 5 [0062.085] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.085] lstrlenW (lpString=".ppt") returned 4 [0062.085] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.085] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.085] lstrlenW (lpString=".zip") returned 4 [0062.085] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.085] lstrlenW (lpString=".rar") returned 4 [0062.085] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.085] lstrlenW (lpString=".bz2") returned 4 [0062.085] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.086] lstrlenW (lpString=".7z") returned 3 [0062.086] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.086] lstrlenW (lpString=".dbf") returned 4 [0062.086] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0062.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.086] lstrlenW (lpString=".1cd") returned 4 [0062.086] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0062.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.086] lstrlenW (lpString=".jpg") returned 4 [0062.086] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0062.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.086] lstrlenW (lpString=".doc") returned 4 [0062.086] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.086] lstrlenW (lpString=".docx") returned 5 [0062.086] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.086] lstrlenW (lpString=".pdf") returned 4 [0062.086] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.086] lstrlenW (lpString=".xls") returned 4 [0062.086] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.086] lstrlenW (lpString=".xlsx") returned 5 [0062.086] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.086] lstrlenW (lpString=".ppt") returned 4 [0062.086] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.086] lstrlenW (lpString=".zip") returned 4 [0062.086] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.086] lstrlenW (lpString=".rar") returned 4 [0062.086] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.086] lstrlenW (lpString=".bz2") returned 4 [0062.087] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.087] lstrlenW (lpString=".7z") returned 3 [0062.087] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.087] lstrlenW (lpString=".dbf") returned 4 [0062.087] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0062.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.087] lstrlenW (lpString=".1cd") returned 4 [0062.087] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0062.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0062.087] lstrlenW (lpString=".jpg") returned 4 [0062.087] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0062.087] lstrcmpiW (lpString1=".inc", lpString2=".wiki") returned -1 [0062.087] lstrlenW (lpString="oledbjvs.inc") returned 12 [0062.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0062.301] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9804) returned 1 [0062.301] CloseHandle (hObject=0x218) returned 1 [0062.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0062.301] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.301] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0062.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0062.302] lstrlenW (lpString=".doc") returned 4 [0062.302] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0062.302] lstrlenW (lpString=".docx") returned 5 [0062.302] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0062.302] lstrlenW (lpString=".pdf") returned 4 [0062.302] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0062.302] lstrlenW (lpString=".xls") returned 4 [0062.302] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0062.302] lstrlenW (lpString=".xlsx") returned 5 [0062.302] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0062.302] lstrlenW (lpString=".ppt") returned 4 [0062.302] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0062.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0062.302] lstrlenW (lpString=".zip") returned 4 [0062.302] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0062.302] lstrlenW (lpString=".rar") returned 4 [0062.302] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0062.302] lstrlenW (lpString=".bz2") returned 4 [0062.302] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0062.302] lstrlenW (lpString=".7z") returned 3 [0062.302] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0062.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0062.302] lstrlenW (lpString=".dbf") returned 4 [0062.302] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0064.576] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.362] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.362] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0065.362] GetLastError () returned 0x0 [0065.362] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x712e, lpOverlapped=0x0) returned 1 [0065.480] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7130, lpOverlapped=0x0) returned 1 [0065.492] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.492] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0065.492] SetEndOfFile (hFile=0x204) returned 1 [0065.492] CloseHandle (hObject=0x204) returned 1 [0065.492] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.492] SetEndOfFile (hFile=0x208) returned 1 [0065.493] CloseHandle (hObject=0x208) returned 1 [0065.493] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.494] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0065.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.494] lstrlenW (lpString=".doc") returned 4 [0065.494] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.494] lstrlenW (lpString=".docx") returned 5 [0065.494] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0065.494] lstrlenW (lpString=".pdf") returned 4 [0065.494] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.494] lstrlenW (lpString=".xls") returned 4 [0065.494] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.494] lstrlenW (lpString=".xlsx") returned 5 [0065.494] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0065.494] lstrlenW (lpString=".ppt") returned 4 [0065.494] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.494] lstrlenW (lpString=".zip") returned 4 [0065.494] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.494] lstrlenW (lpString=".rar") returned 4 [0065.495] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.495] lstrlenW (lpString=".bz2") returned 4 [0065.495] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.495] lstrlenW (lpString=".7z") returned 3 [0065.495] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.495] lstrlenW (lpString=".dbf") returned 4 [0065.495] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.495] lstrlenW (lpString=".1cd") returned 4 [0065.495] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.495] lstrlenW (lpString=".jpg") returned 4 [0065.495] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.495] lstrlenW (lpString=".doc") returned 4 [0065.495] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.495] lstrlenW (lpString=".docx") returned 5 [0065.495] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0065.495] lstrlenW (lpString=".pdf") returned 4 [0065.495] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.495] lstrlenW (lpString=".xls") returned 4 [0065.495] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.495] lstrlenW (lpString=".xlsx") returned 5 [0065.495] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0065.495] lstrlenW (lpString=".ppt") returned 4 [0065.495] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.496] lstrlenW (lpString=".zip") returned 4 [0065.496] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.496] lstrlenW (lpString=".rar") returned 4 [0065.496] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.496] lstrlenW (lpString=".bz2") returned 4 [0065.496] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.496] lstrlenW (lpString=".7z") returned 3 [0065.496] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.496] lstrlenW (lpString=".dbf") returned 4 [0065.496] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.496] lstrlenW (lpString=".1cd") returned 4 [0065.496] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0065.496] lstrlenW (lpString=".jpg") returned 4 [0065.496] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.496] lstrcmpiW (lpString1=".xsl", lpString2=".wiki") returned 1 [0065.496] lstrlenW (lpString="Sybase.xsl") returned 10 [0065.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.497] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=29790) returned 1 [0065.497] CloseHandle (hObject=0x208) returned 1 [0065.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0065.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0065.498] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.498] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0065.498] GetLastError () returned 0x0 [0065.498] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x745e, lpOverlapped=0x0) returned 1 [0065.500] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x7460, lpOverlapped=0x0) returned 1 [0065.502] ReadFile (in: hFile=0x208, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.502] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0065.502] SetEndOfFile (hFile=0x204) returned 1 [0065.502] CloseHandle (hObject=0x204) returned 1 [0065.502] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.502] SetEndOfFile (hFile=0x208) returned 1 [0065.503] CloseHandle (hObject=0x208) returned 1 [0065.503] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.503] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0065.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.504] lstrlenW (lpString=".doc") returned 4 [0065.504] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.504] lstrlenW (lpString=".docx") returned 5 [0065.504] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0065.504] lstrlenW (lpString=".pdf") returned 4 [0065.504] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.504] lstrlenW (lpString=".xls") returned 4 [0065.504] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.504] lstrlenW (lpString=".xlsx") returned 5 [0065.504] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0065.504] lstrlenW (lpString=".ppt") returned 4 [0065.504] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.504] lstrlenW (lpString=".zip") returned 4 [0065.504] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.504] lstrlenW (lpString=".rar") returned 4 [0065.504] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.504] lstrlenW (lpString=".bz2") returned 4 [0065.504] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.504] lstrlenW (lpString=".7z") returned 3 [0065.504] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.504] lstrlenW (lpString=".dbf") returned 4 [0065.505] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.505] lstrlenW (lpString=".1cd") returned 4 [0065.505] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.505] lstrlenW (lpString=".jpg") returned 4 [0065.505] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.505] lstrlenW (lpString=".doc") returned 4 [0065.505] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.505] lstrlenW (lpString=".docx") returned 5 [0065.505] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0065.505] lstrlenW (lpString=".pdf") returned 4 [0065.505] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.505] lstrlenW (lpString=".xls") returned 4 [0065.505] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.505] lstrlenW (lpString=".xlsx") returned 5 [0065.505] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0065.505] lstrlenW (lpString=".ppt") returned 4 [0065.505] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.505] lstrlenW (lpString=".zip") returned 4 [0065.505] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.505] lstrlenW (lpString=".rar") returned 4 [0065.505] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.505] lstrlenW (lpString=".bz2") returned 4 [0065.505] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.505] lstrlenW (lpString=".7z") returned 3 [0065.506] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.506] lstrlenW (lpString=".dbf") returned 4 [0065.506] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.506] lstrlenW (lpString=".1cd") returned 4 [0065.506] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0065.506] lstrlenW (lpString=".jpg") returned 4 [0065.506] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.506] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0065.506] lstrlenW (lpString="AG00011_.GIF") returned 12 [0065.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.260] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7216) returned 1 [0066.260] CloseHandle (hObject=0x21c) returned 1 [0066.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0066.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.260] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.260] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0066.261] GetLastError () returned 0x0 [0066.261] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1c30, lpOverlapped=0x0) returned 1 [0066.263] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0066.264] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.264] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.264] SetEndOfFile (hFile=0x180) returned 1 [0066.265] CloseHandle (hObject=0x180) returned 1 [0066.265] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.265] SetEndOfFile (hFile=0x21c) returned 1 [0066.266] CloseHandle (hObject=0x21c) returned 1 [0066.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0066.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.266] lstrlenW (lpString=".doc") returned 4 [0066.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.266] lstrlenW (lpString=".docx") returned 5 [0066.266] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.266] lstrlenW (lpString=".pdf") returned 4 [0066.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.266] lstrlenW (lpString=".xls") returned 4 [0066.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.266] lstrlenW (lpString=".xlsx") returned 5 [0066.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.266] lstrlenW (lpString=".ppt") returned 4 [0066.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.267] lstrlenW (lpString=".zip") returned 4 [0066.267] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.267] lstrlenW (lpString=".rar") returned 4 [0066.267] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.267] lstrlenW (lpString=".bz2") returned 4 [0066.267] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.267] lstrlenW (lpString=".7z") returned 3 [0066.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.267] lstrlenW (lpString=".dbf") returned 4 [0066.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.267] lstrlenW (lpString=".1cd") returned 4 [0066.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.267] lstrlenW (lpString=".jpg") returned 4 [0066.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.267] lstrlenW (lpString=".doc") returned 4 [0066.267] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.267] lstrlenW (lpString=".docx") returned 5 [0066.267] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.267] lstrlenW (lpString=".pdf") returned 4 [0066.267] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.267] lstrlenW (lpString=".xls") returned 4 [0066.267] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.267] lstrlenW (lpString=".xlsx") returned 5 [0066.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.267] lstrlenW (lpString=".ppt") returned 4 [0066.267] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.268] lstrlenW (lpString=".zip") returned 4 [0066.268] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.268] lstrlenW (lpString=".rar") returned 4 [0066.268] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.268] lstrlenW (lpString=".bz2") returned 4 [0066.268] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.268] lstrlenW (lpString=".7z") returned 3 [0066.268] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.268] lstrlenW (lpString=".dbf") returned 4 [0066.268] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.268] lstrlenW (lpString=".1cd") returned 4 [0066.268] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0066.268] lstrlenW (lpString=".jpg") returned 4 [0066.268] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.268] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.268] lstrlenW (lpString="AG00038_.GIF") returned 12 [0066.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.270] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3251) returned 1 [0066.270] CloseHandle (hObject=0x21c) returned 1 [0066.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0066.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.270] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.270] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0066.270] GetLastError () returned 0x0 [0066.270] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0066.272] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0066.274] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.274] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.274] SetEndOfFile (hFile=0x180) returned 1 [0066.274] CloseHandle (hObject=0x180) returned 1 [0066.274] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.274] SetEndOfFile (hFile=0x21c) returned 1 [0066.275] CloseHandle (hObject=0x21c) returned 1 [0066.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0066.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.276] lstrlenW (lpString=".doc") returned 4 [0066.276] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.276] lstrlenW (lpString=".docx") returned 5 [0066.276] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.276] lstrlenW (lpString=".pdf") returned 4 [0066.276] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.276] lstrlenW (lpString=".xls") returned 4 [0066.276] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.276] lstrlenW (lpString=".xlsx") returned 5 [0066.276] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.276] lstrlenW (lpString=".ppt") returned 4 [0066.276] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.276] lstrlenW (lpString=".zip") returned 4 [0066.276] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.276] lstrlenW (lpString=".rar") returned 4 [0066.276] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.276] lstrlenW (lpString=".bz2") returned 4 [0066.276] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.276] lstrlenW (lpString=".7z") returned 3 [0066.276] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.276] lstrlenW (lpString=".dbf") returned 4 [0066.276] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.276] lstrlenW (lpString=".1cd") returned 4 [0066.276] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.277] lstrlenW (lpString=".jpg") returned 4 [0066.277] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.277] lstrlenW (lpString=".doc") returned 4 [0066.277] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.277] lstrlenW (lpString=".docx") returned 5 [0066.277] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.277] lstrlenW (lpString=".pdf") returned 4 [0066.277] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.277] lstrlenW (lpString=".xls") returned 4 [0066.277] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.277] lstrlenW (lpString=".xlsx") returned 5 [0066.277] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.277] lstrlenW (lpString=".ppt") returned 4 [0066.277] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.277] lstrlenW (lpString=".zip") returned 4 [0066.277] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.277] lstrlenW (lpString=".rar") returned 4 [0066.277] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.277] lstrlenW (lpString=".bz2") returned 4 [0066.277] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.277] lstrlenW (lpString=".7z") returned 3 [0066.277] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.277] lstrlenW (lpString=".dbf") returned 4 [0066.277] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.277] lstrlenW (lpString=".1cd") returned 4 [0066.277] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0066.278] lstrlenW (lpString=".jpg") returned 4 [0066.278] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.278] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.278] lstrlenW (lpString="AG00040_.GIF") returned 12 [0066.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.278] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8097) returned 1 [0066.278] CloseHandle (hObject=0x21c) returned 1 [0066.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0066.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.278] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.279] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0066.280] GetLastError () returned 0x0 [0066.280] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0066.281] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0066.282] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.282] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.283] SetEndOfFile (hFile=0x180) returned 1 [0066.283] CloseHandle (hObject=0x180) returned 1 [0066.283] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.283] SetEndOfFile (hFile=0x21c) returned 1 [0066.284] CloseHandle (hObject=0x21c) returned 1 [0066.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0066.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.284] lstrlenW (lpString=".doc") returned 4 [0066.284] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.284] lstrlenW (lpString=".docx") returned 5 [0066.284] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.284] lstrlenW (lpString=".pdf") returned 4 [0066.284] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.284] lstrlenW (lpString=".xls") returned 4 [0066.285] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.285] lstrlenW (lpString=".xlsx") returned 5 [0066.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.285] lstrlenW (lpString=".ppt") returned 4 [0066.285] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.285] lstrlenW (lpString=".zip") returned 4 [0066.285] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.285] lstrlenW (lpString=".rar") returned 4 [0066.285] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.285] lstrlenW (lpString=".bz2") returned 4 [0066.285] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.285] lstrlenW (lpString=".7z") returned 3 [0066.285] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.285] lstrlenW (lpString=".dbf") returned 4 [0066.285] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.285] lstrlenW (lpString=".1cd") returned 4 [0066.285] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.285] lstrlenW (lpString=".jpg") returned 4 [0066.285] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.285] lstrlenW (lpString=".doc") returned 4 [0066.285] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.285] lstrlenW (lpString=".docx") returned 5 [0066.285] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.285] lstrlenW (lpString=".pdf") returned 4 [0066.285] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.285] lstrlenW (lpString=".xls") returned 4 [0066.285] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.286] lstrlenW (lpString=".xlsx") returned 5 [0066.286] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.286] lstrlenW (lpString=".ppt") returned 4 [0066.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.286] lstrlenW (lpString=".zip") returned 4 [0066.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.286] lstrlenW (lpString=".rar") returned 4 [0066.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.286] lstrlenW (lpString=".bz2") returned 4 [0066.286] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.286] lstrlenW (lpString=".7z") returned 3 [0066.286] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.286] lstrlenW (lpString=".dbf") returned 4 [0066.286] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.286] lstrlenW (lpString=".1cd") returned 4 [0066.286] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0066.286] lstrlenW (lpString=".jpg") returned 4 [0066.286] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.286] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.286] lstrlenW (lpString="AG00052_.GIF") returned 12 [0066.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.287] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7686) returned 1 [0066.287] CloseHandle (hObject=0x21c) returned 1 [0066.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0066.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.287] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.287] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0066.288] GetLastError () returned 0x0 [0066.288] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0066.289] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0066.290] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.290] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.291] SetEndOfFile (hFile=0x180) returned 1 [0066.291] CloseHandle (hObject=0x180) returned 1 [0066.291] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.291] SetEndOfFile (hFile=0x21c) returned 1 [0066.292] CloseHandle (hObject=0x21c) returned 1 [0066.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0066.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.292] lstrlenW (lpString=".doc") returned 4 [0066.292] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.292] lstrlenW (lpString=".docx") returned 5 [0066.292] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.292] lstrlenW (lpString=".pdf") returned 4 [0066.292] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.293] lstrlenW (lpString=".xls") returned 4 [0066.293] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.293] lstrlenW (lpString=".xlsx") returned 5 [0066.293] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.293] lstrlenW (lpString=".ppt") returned 4 [0066.293] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.293] lstrlenW (lpString=".zip") returned 4 [0066.293] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.293] lstrlenW (lpString=".rar") returned 4 [0066.293] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.293] lstrlenW (lpString=".bz2") returned 4 [0066.293] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.293] lstrlenW (lpString=".7z") returned 3 [0066.293] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.293] lstrlenW (lpString=".dbf") returned 4 [0066.293] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.293] lstrlenW (lpString=".1cd") returned 4 [0066.293] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.293] lstrlenW (lpString=".jpg") returned 4 [0066.293] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.293] lstrlenW (lpString=".doc") returned 4 [0066.293] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.293] lstrlenW (lpString=".docx") returned 5 [0066.293] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.293] lstrlenW (lpString=".pdf") returned 4 [0066.293] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.294] lstrlenW (lpString=".xls") returned 4 [0066.294] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.294] lstrlenW (lpString=".xlsx") returned 5 [0066.294] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.294] lstrlenW (lpString=".ppt") returned 4 [0066.294] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.294] lstrlenW (lpString=".zip") returned 4 [0066.294] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.294] lstrlenW (lpString=".rar") returned 4 [0066.294] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.294] lstrlenW (lpString=".bz2") returned 4 [0066.294] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.294] lstrlenW (lpString=".7z") returned 3 [0066.294] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.294] lstrlenW (lpString=".dbf") returned 4 [0066.294] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.294] lstrlenW (lpString=".1cd") returned 4 [0066.294] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0066.294] lstrlenW (lpString=".jpg") returned 4 [0066.294] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.294] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.294] lstrlenW (lpString="AG00057_.GIF") returned 12 [0066.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.295] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=11891) returned 1 [0066.295] CloseHandle (hObject=0x21c) returned 1 [0066.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0066.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0066.295] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.295] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.295] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0066.295] GetLastError () returned 0x0 [0066.295] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2e73, lpOverlapped=0x0) returned 1 [0066.770] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0066.771] ReadFile (in: hFile=0x21c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.771] WriteFile (in: hFile=0x180, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.771] SetEndOfFile (hFile=0x180) returned 1 [0066.771] CloseHandle (hObject=0x180) returned 1 [0066.771] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.771] SetEndOfFile (hFile=0x21c) returned 1 [0066.772] CloseHandle (hObject=0x21c) returned 1 [0066.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0066.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.773] lstrlenW (lpString=".doc") returned 4 [0066.773] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.773] lstrlenW (lpString=".docx") returned 5 [0066.773] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.773] lstrlenW (lpString=".pdf") returned 4 [0066.773] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.773] lstrlenW (lpString=".xls") returned 4 [0066.773] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.773] lstrlenW (lpString=".xlsx") returned 5 [0066.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.773] lstrlenW (lpString=".ppt") returned 4 [0066.773] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.773] lstrlenW (lpString=".zip") returned 4 [0066.773] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.773] lstrlenW (lpString=".rar") returned 4 [0066.773] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.773] lstrlenW (lpString=".bz2") returned 4 [0066.773] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.773] lstrlenW (lpString=".7z") returned 3 [0066.773] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.773] lstrlenW (lpString=".dbf") returned 4 [0066.773] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.774] lstrlenW (lpString=".1cd") returned 4 [0066.774] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.774] lstrlenW (lpString=".jpg") returned 4 [0066.774] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.774] lstrlenW (lpString=".doc") returned 4 [0066.774] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.774] lstrlenW (lpString=".docx") returned 5 [0066.774] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.774] lstrlenW (lpString=".pdf") returned 4 [0066.774] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.774] lstrlenW (lpString=".xls") returned 4 [0066.774] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.774] lstrlenW (lpString=".xlsx") returned 5 [0066.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.774] lstrlenW (lpString=".ppt") returned 4 [0066.774] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.774] lstrlenW (lpString=".zip") returned 4 [0066.774] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.774] lstrlenW (lpString=".rar") returned 4 [0066.774] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.774] lstrlenW (lpString=".bz2") returned 4 [0066.774] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.774] lstrlenW (lpString=".7z") returned 3 [0066.774] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.774] lstrlenW (lpString=".dbf") returned 4 [0066.774] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.775] lstrlenW (lpString=".1cd") returned 4 [0066.775] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0066.775] lstrlenW (lpString=".jpg") returned 4 [0066.775] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.775] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.775] lstrlenW (lpString="AG00165_.GIF") returned 12 [0066.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0068.078] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8582) returned 1 [0068.078] CloseHandle (hObject=0x200) returned 1 [0068.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0068.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0068.079] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.079] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0068.079] GetLastError () returned 0x0 [0068.079] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2186, lpOverlapped=0x0) returned 1 [0068.081] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0068.082] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.082] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.082] SetEndOfFile (hFile=0x210) returned 1 [0068.082] CloseHandle (hObject=0x210) returned 1 [0068.083] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.083] SetEndOfFile (hFile=0x200) returned 1 [0068.083] CloseHandle (hObject=0x200) returned 1 [0068.084] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.084] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0068.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.084] lstrlenW (lpString=".doc") returned 4 [0068.084] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.084] lstrlenW (lpString=".docx") returned 5 [0068.084] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.084] lstrlenW (lpString=".pdf") returned 4 [0068.084] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.084] lstrlenW (lpString=".xls") returned 4 [0068.084] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.084] lstrlenW (lpString=".xlsx") returned 5 [0068.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.084] lstrlenW (lpString=".ppt") returned 4 [0068.084] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.084] lstrlenW (lpString=".zip") returned 4 [0068.084] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.084] lstrlenW (lpString=".rar") returned 4 [0068.084] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.084] lstrlenW (lpString=".bz2") returned 4 [0068.085] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.085] lstrlenW (lpString=".7z") returned 3 [0068.085] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.085] lstrlenW (lpString=".dbf") returned 4 [0068.085] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.085] lstrlenW (lpString=".1cd") returned 4 [0068.085] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.085] lstrlenW (lpString=".jpg") returned 4 [0068.085] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.085] lstrlenW (lpString=".doc") returned 4 [0068.085] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.085] lstrlenW (lpString=".docx") returned 5 [0068.085] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.085] lstrlenW (lpString=".pdf") returned 4 [0068.085] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.085] lstrlenW (lpString=".xls") returned 4 [0068.085] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.085] lstrlenW (lpString=".xlsx") returned 5 [0068.085] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.085] lstrlenW (lpString=".ppt") returned 4 [0068.085] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.085] lstrlenW (lpString=".zip") returned 4 [0068.085] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.085] lstrlenW (lpString=".rar") returned 4 [0068.085] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.085] lstrlenW (lpString=".bz2") returned 4 [0068.085] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.086] lstrlenW (lpString=".7z") returned 3 [0068.086] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.086] lstrlenW (lpString=".dbf") returned 4 [0068.086] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.086] lstrlenW (lpString=".1cd") returned 4 [0068.086] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0068.086] lstrlenW (lpString=".jpg") returned 4 [0068.086] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.086] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0068.086] lstrlenW (lpString="AG00171_.GIF") returned 12 [0068.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0068.086] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5016) returned 1 [0068.087] CloseHandle (hObject=0x200) returned 1 [0068.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0068.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0068.087] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.087] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0068.087] GetLastError () returned 0x0 [0068.087] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1398, lpOverlapped=0x0) returned 1 [0068.089] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0068.090] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.090] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.090] SetEndOfFile (hFile=0x210) returned 1 [0068.090] CloseHandle (hObject=0x210) returned 1 [0068.090] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.090] SetEndOfFile (hFile=0x200) returned 1 [0068.091] CloseHandle (hObject=0x200) returned 1 [0068.091] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0068.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.092] lstrlenW (lpString=".doc") returned 4 [0068.092] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.092] lstrlenW (lpString=".docx") returned 5 [0068.092] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.092] lstrlenW (lpString=".pdf") returned 4 [0068.092] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.092] lstrlenW (lpString=".xls") returned 4 [0068.092] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.092] lstrlenW (lpString=".xlsx") returned 5 [0068.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.092] lstrlenW (lpString=".ppt") returned 4 [0068.092] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.092] lstrlenW (lpString=".zip") returned 4 [0068.092] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.092] lstrlenW (lpString=".rar") returned 4 [0068.092] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.092] lstrlenW (lpString=".bz2") returned 4 [0068.092] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.092] lstrlenW (lpString=".7z") returned 3 [0068.092] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.092] lstrlenW (lpString=".dbf") returned 4 [0068.092] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.092] lstrlenW (lpString=".1cd") returned 4 [0068.092] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.093] lstrlenW (lpString=".jpg") returned 4 [0068.093] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.093] lstrlenW (lpString=".doc") returned 4 [0068.093] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.093] lstrlenW (lpString=".docx") returned 5 [0068.093] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.093] lstrlenW (lpString=".pdf") returned 4 [0068.093] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.093] lstrlenW (lpString=".xls") returned 4 [0068.093] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.093] lstrlenW (lpString=".xlsx") returned 5 [0068.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.093] lstrlenW (lpString=".ppt") returned 4 [0068.093] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.093] lstrlenW (lpString=".zip") returned 4 [0068.093] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.093] lstrlenW (lpString=".rar") returned 4 [0068.093] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.093] lstrlenW (lpString=".bz2") returned 4 [0068.093] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.093] lstrlenW (lpString=".7z") returned 3 [0068.093] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.093] lstrlenW (lpString=".dbf") returned 4 [0068.093] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.093] lstrlenW (lpString=".1cd") returned 4 [0068.093] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0068.094] lstrlenW (lpString=".jpg") returned 4 [0068.094] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.094] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0068.094] lstrlenW (lpString="AG00172_.GIF") returned 12 [0068.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.149] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4390) returned 1 [0068.149] CloseHandle (hObject=0x218) returned 1 [0068.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0068.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.150] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.150] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.150] GetLastError () returned 0x0 [0068.150] ReadFile (in: hFile=0x218, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1126, lpOverlapped=0x0) returned 1 [0068.152] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0068.153] ReadFile (in: hFile=0x218, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.153] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.153] SetEndOfFile (hFile=0x1f0) returned 1 [0068.153] CloseHandle (hObject=0x1f0) returned 1 [0068.153] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.153] SetEndOfFile (hFile=0x218) returned 1 [0068.154] CloseHandle (hObject=0x218) returned 1 [0068.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0068.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.157] lstrlenW (lpString=".doc") returned 4 [0068.157] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.157] lstrlenW (lpString=".docx") returned 5 [0068.157] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.157] lstrlenW (lpString=".pdf") returned 4 [0068.157] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.157] lstrlenW (lpString=".xls") returned 4 [0068.157] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.157] lstrlenW (lpString=".xlsx") returned 5 [0068.157] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.157] lstrlenW (lpString=".ppt") returned 4 [0068.157] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.157] lstrlenW (lpString=".zip") returned 4 [0068.157] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.157] lstrlenW (lpString=".rar") returned 4 [0068.157] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.157] lstrlenW (lpString=".bz2") returned 4 [0068.157] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.157] lstrlenW (lpString=".7z") returned 3 [0068.157] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.157] lstrlenW (lpString=".dbf") returned 4 [0068.157] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.157] lstrlenW (lpString=".1cd") returned 4 [0068.158] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.158] lstrlenW (lpString=".jpg") returned 4 [0068.158] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.158] lstrlenW (lpString=".doc") returned 4 [0068.158] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.158] lstrlenW (lpString=".docx") returned 5 [0068.158] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.158] lstrlenW (lpString=".pdf") returned 4 [0068.158] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.158] lstrlenW (lpString=".xls") returned 4 [0068.158] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.158] lstrlenW (lpString=".xlsx") returned 5 [0068.158] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.158] lstrlenW (lpString=".ppt") returned 4 [0068.158] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.158] lstrlenW (lpString=".zip") returned 4 [0068.158] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.158] lstrlenW (lpString=".rar") returned 4 [0068.158] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.158] lstrlenW (lpString=".bz2") returned 4 [0068.158] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.158] lstrlenW (lpString=".7z") returned 3 [0068.158] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.158] lstrlenW (lpString=".dbf") returned 4 [0068.158] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.158] lstrlenW (lpString=".1cd") returned 4 [0068.158] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0068.159] lstrlenW (lpString=".jpg") returned 4 [0068.159] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.159] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0068.159] lstrlenW (lpString="AG00174_.GIF") returned 12 [0068.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.159] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3966) returned 1 [0068.159] CloseHandle (hObject=0x218) returned 1 [0068.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0068.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.159] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.159] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.160] GetLastError () returned 0x0 [0068.160] ReadFile (in: hFile=0x218, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xf7e, lpOverlapped=0x0) returned 1 [0068.162] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0068.162] ReadFile (in: hFile=0x218, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.162] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.163] SetEndOfFile (hFile=0x1f0) returned 1 [0068.163] CloseHandle (hObject=0x1f0) returned 1 [0068.163] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.163] SetEndOfFile (hFile=0x218) returned 1 [0068.164] CloseHandle (hObject=0x218) returned 1 [0068.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0068.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.164] lstrlenW (lpString=".doc") returned 4 [0068.164] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.164] lstrlenW (lpString=".docx") returned 5 [0068.164] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.164] lstrlenW (lpString=".pdf") returned 4 [0068.164] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.164] lstrlenW (lpString=".xls") returned 4 [0068.165] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString=".xlsx") returned 5 [0068.165] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.165] lstrlenW (lpString=".ppt") returned 4 [0068.165] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.165] lstrlenW (lpString=".zip") returned 4 [0068.165] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString=".rar") returned 4 [0068.165] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString=".bz2") returned 4 [0068.165] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.165] lstrlenW (lpString=".7z") returned 3 [0068.165] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.165] lstrlenW (lpString=".dbf") returned 4 [0068.165] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.165] lstrlenW (lpString=".1cd") returned 4 [0068.165] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.165] lstrlenW (lpString=".jpg") returned 4 [0068.165] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.165] lstrlenW (lpString=".doc") returned 4 [0068.165] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.165] lstrlenW (lpString=".docx") returned 5 [0068.165] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.165] lstrlenW (lpString=".pdf") returned 4 [0068.165] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.165] lstrlenW (lpString=".xls") returned 4 [0068.165] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.166] lstrlenW (lpString=".xlsx") returned 5 [0068.166] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.166] lstrlenW (lpString=".ppt") returned 4 [0068.166] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.166] lstrlenW (lpString=".zip") returned 4 [0068.166] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.166] lstrlenW (lpString=".rar") returned 4 [0068.166] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.166] lstrlenW (lpString=".bz2") returned 4 [0068.166] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.166] lstrlenW (lpString=".7z") returned 3 [0068.166] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.166] lstrlenW (lpString=".dbf") returned 4 [0068.166] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.166] lstrlenW (lpString=".1cd") returned 4 [0068.166] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0068.166] lstrlenW (lpString=".jpg") returned 4 [0068.166] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.166] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0068.166] lstrlenW (lpString="AG00175_.GIF") returned 12 [0068.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.167] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3378) returned 1 [0068.167] CloseHandle (hObject=0x218) returned 1 [0068.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0068.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.167] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.167] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0068.167] GetLastError () returned 0x0 [0068.167] ReadFile (in: hFile=0x218, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xd32, lpOverlapped=0x0) returned 1 [0069.173] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0069.194] ReadFile (in: hFile=0x218, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.194] WriteFile (in: hFile=0x1f0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.194] SetEndOfFile (hFile=0x1f0) returned 1 [0069.194] CloseHandle (hObject=0x1f0) returned 1 [0069.194] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.194] SetEndOfFile (hFile=0x218) returned 1 [0069.195] CloseHandle (hObject=0x218) returned 1 [0069.195] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0069.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.195] lstrlenW (lpString=".doc") returned 4 [0069.195] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.195] lstrlenW (lpString=".docx") returned 5 [0069.196] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0069.196] lstrlenW (lpString=".pdf") returned 4 [0069.196] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.196] lstrlenW (lpString=".xls") returned 4 [0069.196] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.196] lstrlenW (lpString=".xlsx") returned 5 [0069.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0069.196] lstrlenW (lpString=".ppt") returned 4 [0069.196] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.196] lstrlenW (lpString=".zip") returned 4 [0069.196] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.196] lstrlenW (lpString=".rar") returned 4 [0069.196] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.196] lstrlenW (lpString=".bz2") returned 4 [0069.196] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.196] lstrlenW (lpString=".7z") returned 3 [0069.196] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.196] lstrlenW (lpString=".dbf") returned 4 [0069.196] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.196] lstrlenW (lpString=".1cd") returned 4 [0069.196] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.196] lstrlenW (lpString=".jpg") returned 4 [0069.196] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.196] lstrlenW (lpString=".doc") returned 4 [0069.196] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0069.196] lstrlenW (lpString=".docx") returned 5 [0069.196] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0069.197] lstrlenW (lpString=".pdf") returned 4 [0069.197] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0069.197] lstrlenW (lpString=".xls") returned 4 [0069.197] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0069.197] lstrlenW (lpString=".xlsx") returned 5 [0069.197] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0069.197] lstrlenW (lpString=".ppt") returned 4 [0069.197] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0069.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.197] lstrlenW (lpString=".zip") returned 4 [0069.197] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0069.197] lstrlenW (lpString=".rar") returned 4 [0069.197] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0069.197] lstrlenW (lpString=".bz2") returned 4 [0069.197] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0069.197] lstrlenW (lpString=".7z") returned 3 [0069.197] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0069.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.197] lstrlenW (lpString=".dbf") returned 4 [0069.197] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0069.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.197] lstrlenW (lpString=".1cd") returned 4 [0069.197] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0069.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0069.197] lstrlenW (lpString=".jpg") returned 4 [0069.197] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0069.197] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.197] lstrlenW (lpString="AN01173_.WMF") returned 12 [0069.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.657] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=26332) returned 1 [0069.657] CloseHandle (hObject=0x1fc) returned 1 [0069.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0069.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.657] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.657] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.657] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0069.657] GetLastError () returned 0x0 [0069.657] ReadFile (in: hFile=0x1fc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0069.661] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0069.662] ReadFile (in: hFile=0x1fc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.662] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.662] SetEndOfFile (hFile=0x214) returned 1 [0069.663] CloseHandle (hObject=0x214) returned 1 [0069.663] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.663] SetEndOfFile (hFile=0x1fc) returned 1 [0069.664] CloseHandle (hObject=0x1fc) returned 1 [0069.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0069.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.664] lstrlenW (lpString=".doc") returned 4 [0069.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.664] lstrlenW (lpString=".docx") returned 5 [0069.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.664] lstrlenW (lpString=".pdf") returned 4 [0069.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.664] lstrlenW (lpString=".xls") returned 4 [0069.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.665] lstrlenW (lpString=".xlsx") returned 5 [0069.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.665] lstrlenW (lpString=".ppt") returned 4 [0069.665] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.665] lstrlenW (lpString=".zip") returned 4 [0069.665] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.665] lstrlenW (lpString=".rar") returned 4 [0069.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.665] lstrlenW (lpString=".bz2") returned 4 [0069.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.665] lstrlenW (lpString=".7z") returned 3 [0069.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.665] lstrlenW (lpString=".dbf") returned 4 [0069.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.665] lstrlenW (lpString=".1cd") returned 4 [0069.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.665] lstrlenW (lpString=".jpg") returned 4 [0069.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.665] lstrlenW (lpString=".doc") returned 4 [0069.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.665] lstrlenW (lpString=".docx") returned 5 [0069.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.665] lstrlenW (lpString=".pdf") returned 4 [0069.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.665] lstrlenW (lpString=".xls") returned 4 [0069.665] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.666] lstrlenW (lpString=".xlsx") returned 5 [0069.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.666] lstrlenW (lpString=".ppt") returned 4 [0069.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.666] lstrlenW (lpString=".zip") returned 4 [0069.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.666] lstrlenW (lpString=".rar") returned 4 [0069.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.666] lstrlenW (lpString=".bz2") returned 4 [0069.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.666] lstrlenW (lpString=".7z") returned 3 [0069.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.666] lstrlenW (lpString=".dbf") returned 4 [0069.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.666] lstrlenW (lpString=".1cd") returned 4 [0069.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0069.666] lstrlenW (lpString=".jpg") returned 4 [0069.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.666] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.666] lstrlenW (lpString="AN04195_.WMF") returned 12 [0069.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.667] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4612) returned 1 [0069.667] CloseHandle (hObject=0x1fc) returned 1 [0069.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0069.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.667] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.667] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0069.667] GetLastError () returned 0x0 [0069.668] ReadFile (in: hFile=0x1fc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1204, lpOverlapped=0x0) returned 1 [0069.669] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0069.670] ReadFile (in: hFile=0x1fc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.670] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.670] SetEndOfFile (hFile=0x214) returned 1 [0069.670] CloseHandle (hObject=0x214) returned 1 [0069.671] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.671] SetEndOfFile (hFile=0x1fc) returned 1 [0069.671] CloseHandle (hObject=0x1fc) returned 1 [0069.671] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0069.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.673] lstrlenW (lpString=".doc") returned 4 [0069.673] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.673] lstrlenW (lpString=".docx") returned 5 [0069.673] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.673] lstrlenW (lpString=".pdf") returned 4 [0069.673] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.673] lstrlenW (lpString=".xls") returned 4 [0069.673] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.673] lstrlenW (lpString=".xlsx") returned 5 [0069.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.673] lstrlenW (lpString=".ppt") returned 4 [0069.673] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.673] lstrlenW (lpString=".zip") returned 4 [0069.673] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.673] lstrlenW (lpString=".rar") returned 4 [0069.673] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.673] lstrlenW (lpString=".bz2") returned 4 [0069.673] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.673] lstrlenW (lpString=".7z") returned 3 [0069.673] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.673] lstrlenW (lpString=".dbf") returned 4 [0069.673] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.673] lstrlenW (lpString=".1cd") returned 4 [0069.673] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.674] lstrlenW (lpString=".jpg") returned 4 [0069.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.674] lstrlenW (lpString=".doc") returned 4 [0069.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.674] lstrlenW (lpString=".docx") returned 5 [0069.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.674] lstrlenW (lpString=".pdf") returned 4 [0069.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.674] lstrlenW (lpString=".xls") returned 4 [0069.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.674] lstrlenW (lpString=".xlsx") returned 5 [0069.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.674] lstrlenW (lpString=".ppt") returned 4 [0069.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.674] lstrlenW (lpString=".zip") returned 4 [0069.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.674] lstrlenW (lpString=".rar") returned 4 [0069.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.674] lstrlenW (lpString=".bz2") returned 4 [0069.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.674] lstrlenW (lpString=".7z") returned 3 [0069.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.674] lstrlenW (lpString=".dbf") returned 4 [0069.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.674] lstrlenW (lpString=".1cd") returned 4 [0069.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0069.675] lstrlenW (lpString=".jpg") returned 4 [0069.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.675] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.675] lstrlenW (lpString="AN04196_.WMF") returned 12 [0069.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.675] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3144) returned 1 [0069.675] CloseHandle (hObject=0x1fc) returned 1 [0069.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0069.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.675] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.675] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0069.676] GetLastError () returned 0x0 [0069.676] ReadFile (in: hFile=0x1fc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xc48, lpOverlapped=0x0) returned 1 [0069.688] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0069.689] ReadFile (in: hFile=0x1fc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.689] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.689] SetEndOfFile (hFile=0x214) returned 1 [0069.689] CloseHandle (hObject=0x214) returned 1 [0069.689] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.689] SetEndOfFile (hFile=0x1fc) returned 1 [0069.690] CloseHandle (hObject=0x1fc) returned 1 [0069.690] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0069.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.691] lstrlenW (lpString=".doc") returned 4 [0069.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.691] lstrlenW (lpString=".docx") returned 5 [0069.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.691] lstrlenW (lpString=".pdf") returned 4 [0069.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.691] lstrlenW (lpString=".xls") returned 4 [0069.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.691] lstrlenW (lpString=".xlsx") returned 5 [0069.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.691] lstrlenW (lpString=".ppt") returned 4 [0069.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.691] lstrlenW (lpString=".zip") returned 4 [0069.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.691] lstrlenW (lpString=".rar") returned 4 [0069.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.691] lstrlenW (lpString=".bz2") returned 4 [0069.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.691] lstrlenW (lpString=".7z") returned 3 [0069.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.691] lstrlenW (lpString=".dbf") returned 4 [0069.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.691] lstrlenW (lpString=".1cd") returned 4 [0069.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.691] lstrlenW (lpString=".jpg") returned 4 [0069.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.692] lstrlenW (lpString=".doc") returned 4 [0069.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.692] lstrlenW (lpString=".docx") returned 5 [0069.692] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.692] lstrlenW (lpString=".pdf") returned 4 [0069.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.692] lstrlenW (lpString=".xls") returned 4 [0069.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.692] lstrlenW (lpString=".xlsx") returned 5 [0069.692] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.692] lstrlenW (lpString=".ppt") returned 4 [0069.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.692] lstrlenW (lpString=".zip") returned 4 [0069.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.692] lstrlenW (lpString=".rar") returned 4 [0069.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.692] lstrlenW (lpString=".bz2") returned 4 [0069.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.692] lstrlenW (lpString=".7z") returned 3 [0069.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.692] lstrlenW (lpString=".dbf") returned 4 [0069.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.692] lstrlenW (lpString=".1cd") returned 4 [0069.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0069.692] lstrlenW (lpString=".jpg") returned 4 [0069.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.693] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.693] lstrlenW (lpString="AN04206_.WMF") returned 12 [0069.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.699] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=7668) returned 1 [0069.699] CloseHandle (hObject=0x1fc) returned 1 [0069.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0069.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.699] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.699] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0069.699] GetLastError () returned 0x0 [0069.699] ReadFile (in: hFile=0x1fc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0069.701] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0069.702] ReadFile (in: hFile=0x1fc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.702] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.702] SetEndOfFile (hFile=0x214) returned 1 [0069.703] CloseHandle (hObject=0x214) returned 1 [0069.703] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.703] SetEndOfFile (hFile=0x1fc) returned 1 [0069.704] CloseHandle (hObject=0x1fc) returned 1 [0069.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.704] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0069.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.704] lstrlenW (lpString=".doc") returned 4 [0069.704] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.704] lstrlenW (lpString=".docx") returned 5 [0069.704] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.704] lstrlenW (lpString=".pdf") returned 4 [0069.704] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.704] lstrlenW (lpString=".xls") returned 4 [0069.704] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.704] lstrlenW (lpString=".xlsx") returned 5 [0069.704] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.704] lstrlenW (lpString=".ppt") returned 4 [0069.704] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.705] lstrlenW (lpString=".zip") returned 4 [0069.705] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.705] lstrlenW (lpString=".rar") returned 4 [0069.705] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.705] lstrlenW (lpString=".bz2") returned 4 [0069.705] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.705] lstrlenW (lpString=".7z") returned 3 [0069.705] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.705] lstrlenW (lpString=".dbf") returned 4 [0069.705] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.705] lstrlenW (lpString=".1cd") returned 4 [0069.705] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.705] lstrlenW (lpString=".jpg") returned 4 [0069.705] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.705] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.705] lstrlenW (lpString=".doc") returned 4 [0069.705] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.705] lstrlenW (lpString=".docx") returned 5 [0069.705] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.705] lstrlenW (lpString=".pdf") returned 4 [0069.705] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.705] lstrlenW (lpString=".xls") returned 4 [0069.705] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.705] lstrlenW (lpString=".xlsx") returned 5 [0069.705] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.705] lstrlenW (lpString=".ppt") returned 4 [0069.705] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.706] lstrlenW (lpString=".zip") returned 4 [0069.706] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.706] lstrlenW (lpString=".rar") returned 4 [0069.706] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.706] lstrlenW (lpString=".bz2") returned 4 [0069.706] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.706] lstrlenW (lpString=".7z") returned 3 [0069.706] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.706] lstrlenW (lpString=".dbf") returned 4 [0069.706] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.706] lstrlenW (lpString=".1cd") returned 4 [0069.706] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0069.706] lstrlenW (lpString=".jpg") returned 4 [0069.706] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.706] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.706] lstrlenW (lpString="AN04225_.WMF") returned 12 [0069.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.707] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8492) returned 1 [0069.707] CloseHandle (hObject=0x1fc) returned 1 [0069.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0069.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0069.707] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.707] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0069.707] GetLastError () returned 0x0 [0069.707] ReadFile (in: hFile=0x1fc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x212c, lpOverlapped=0x0) returned 1 [0070.059] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0070.060] ReadFile (in: hFile=0x1fc, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.060] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.061] SetEndOfFile (hFile=0x214) returned 1 [0070.061] CloseHandle (hObject=0x214) returned 1 [0070.061] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.061] SetEndOfFile (hFile=0x1fc) returned 1 [0070.062] CloseHandle (hObject=0x1fc) returned 1 [0070.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0070.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0070.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.062] lstrlenW (lpString=".doc") returned 4 [0070.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.062] lstrlenW (lpString=".docx") returned 5 [0070.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.063] lstrlenW (lpString=".pdf") returned 4 [0070.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.063] lstrlenW (lpString=".xls") returned 4 [0070.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.063] lstrlenW (lpString=".xlsx") returned 5 [0070.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.063] lstrlenW (lpString=".ppt") returned 4 [0070.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.063] lstrlenW (lpString=".zip") returned 4 [0070.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.063] lstrlenW (lpString=".rar") returned 4 [0070.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.063] lstrlenW (lpString=".bz2") returned 4 [0070.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.063] lstrlenW (lpString=".7z") returned 3 [0070.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.063] lstrlenW (lpString=".dbf") returned 4 [0070.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.063] lstrlenW (lpString=".1cd") returned 4 [0070.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.063] lstrlenW (lpString=".jpg") returned 4 [0070.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.063] lstrlenW (lpString=".doc") returned 4 [0070.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString=".docx") returned 5 [0070.064] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0070.064] lstrlenW (lpString=".pdf") returned 4 [0070.064] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString=".xls") returned 4 [0070.064] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0070.064] lstrlenW (lpString=".xlsx") returned 5 [0070.064] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0070.064] lstrlenW (lpString=".ppt") returned 4 [0070.064] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.064] lstrlenW (lpString=".zip") returned 4 [0070.064] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0070.064] lstrlenW (lpString=".rar") returned 4 [0070.064] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString=".bz2") returned 4 [0070.064] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString=".7z") returned 3 [0070.064] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0070.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.064] lstrlenW (lpString=".dbf") returned 4 [0070.064] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.064] lstrlenW (lpString=".1cd") returned 4 [0070.064] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0070.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0070.064] lstrlenW (lpString=".jpg") returned 4 [0070.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0070.064] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0070.065] lstrlenW (lpString="BD00160_.WMF") returned 12 [0070.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.562] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=22516) returned 1 [0071.562] CloseHandle (hObject=0x16c) returned 1 [0071.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0071.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.563] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.563] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0071.563] GetLastError () returned 0x0 [0071.563] ReadFile (in: hFile=0x16c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x57f4, lpOverlapped=0x0) returned 1 [0071.592] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5800, lpOverlapped=0x0) returned 1 [0071.593] ReadFile (in: hFile=0x16c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.593] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.593] SetEndOfFile (hFile=0x1e0) returned 1 [0071.594] CloseHandle (hObject=0x1e0) returned 1 [0071.594] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.594] SetEndOfFile (hFile=0x16c) returned 1 [0071.595] CloseHandle (hObject=0x16c) returned 1 [0071.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0071.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.595] lstrlenW (lpString=".doc") returned 4 [0071.595] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.595] lstrlenW (lpString=".docx") returned 5 [0071.595] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.595] lstrlenW (lpString=".pdf") returned 4 [0071.596] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.596] lstrlenW (lpString=".xls") returned 4 [0071.596] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.596] lstrlenW (lpString=".xlsx") returned 5 [0071.596] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.596] lstrlenW (lpString=".ppt") returned 4 [0071.596] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.596] lstrlenW (lpString=".zip") returned 4 [0071.596] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.596] lstrlenW (lpString=".rar") returned 4 [0071.596] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.596] lstrlenW (lpString=".bz2") returned 4 [0071.596] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.596] lstrlenW (lpString=".7z") returned 3 [0071.596] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.596] lstrlenW (lpString=".dbf") returned 4 [0071.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.597] lstrlenW (lpString=".1cd") returned 4 [0071.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.597] lstrlenW (lpString=".jpg") returned 4 [0071.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.597] lstrlenW (lpString=".doc") returned 4 [0071.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.597] lstrlenW (lpString=".docx") returned 5 [0071.597] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.597] lstrlenW (lpString=".pdf") returned 4 [0071.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.597] lstrlenW (lpString=".xls") returned 4 [0071.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.597] lstrlenW (lpString=".xlsx") returned 5 [0071.597] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.597] lstrlenW (lpString=".ppt") returned 4 [0071.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.597] lstrlenW (lpString=".zip") returned 4 [0071.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.597] lstrlenW (lpString=".rar") returned 4 [0071.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.597] lstrlenW (lpString=".bz2") returned 4 [0071.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.597] lstrlenW (lpString=".7z") returned 3 [0071.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.597] lstrlenW (lpString=".dbf") returned 4 [0071.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.598] lstrlenW (lpString=".1cd") returned 4 [0071.598] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0071.598] lstrlenW (lpString=".jpg") returned 4 [0071.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.598] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0071.598] lstrlenW (lpString="BD07761_.WMF") returned 12 [0071.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.598] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=26748) returned 1 [0071.598] CloseHandle (hObject=0x16c) returned 1 [0071.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0071.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.599] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.599] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0071.599] GetLastError () returned 0x0 [0071.599] ReadFile (in: hFile=0x16c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x687c, lpOverlapped=0x0) returned 1 [0071.602] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x6880, lpOverlapped=0x0) returned 1 [0071.603] ReadFile (in: hFile=0x16c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.603] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.603] SetEndOfFile (hFile=0x1e0) returned 1 [0071.604] CloseHandle (hObject=0x1e0) returned 1 [0071.604] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.604] SetEndOfFile (hFile=0x16c) returned 1 [0071.605] CloseHandle (hObject=0x16c) returned 1 [0071.605] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0071.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.605] lstrlenW (lpString=".doc") returned 4 [0071.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.605] lstrlenW (lpString=".docx") returned 5 [0071.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.605] lstrlenW (lpString=".pdf") returned 4 [0071.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.605] lstrlenW (lpString=".xls") returned 4 [0071.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.605] lstrlenW (lpString=".xlsx") returned 5 [0071.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.605] lstrlenW (lpString=".ppt") returned 4 [0071.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.606] lstrlenW (lpString=".zip") returned 4 [0071.606] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.606] lstrlenW (lpString=".rar") returned 4 [0071.606] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.606] lstrlenW (lpString=".bz2") returned 4 [0071.606] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.606] lstrlenW (lpString=".7z") returned 3 [0071.606] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.606] lstrlenW (lpString=".dbf") returned 4 [0071.606] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.606] lstrlenW (lpString=".1cd") returned 4 [0071.606] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.606] lstrlenW (lpString=".jpg") returned 4 [0071.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.606] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.606] lstrlenW (lpString=".doc") returned 4 [0071.606] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.606] lstrlenW (lpString=".docx") returned 5 [0071.606] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.606] lstrlenW (lpString=".pdf") returned 4 [0071.606] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.606] lstrlenW (lpString=".xls") returned 4 [0071.606] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.606] lstrlenW (lpString=".xlsx") returned 5 [0071.606] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.606] lstrlenW (lpString=".ppt") returned 4 [0071.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.607] lstrlenW (lpString=".zip") returned 4 [0071.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.607] lstrlenW (lpString=".rar") returned 4 [0071.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.607] lstrlenW (lpString=".bz2") returned 4 [0071.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.607] lstrlenW (lpString=".7z") returned 3 [0071.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.607] lstrlenW (lpString=".dbf") returned 4 [0071.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.607] lstrlenW (lpString=".1cd") returned 4 [0071.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0071.607] lstrlenW (lpString=".jpg") returned 4 [0071.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.607] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0071.607] lstrlenW (lpString="BD07804_.WMF") returned 12 [0071.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.608] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4924) returned 1 [0071.608] CloseHandle (hObject=0x16c) returned 1 [0071.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0071.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.608] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.608] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0071.608] GetLastError () returned 0x0 [0071.608] ReadFile (in: hFile=0x16c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x133c, lpOverlapped=0x0) returned 1 [0071.624] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0071.624] ReadFile (in: hFile=0x16c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.624] WriteFile (in: hFile=0x1e0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.625] SetEndOfFile (hFile=0x1e0) returned 1 [0071.721] CloseHandle (hObject=0x1e0) returned 1 [0071.721] SetFilePointerEx (in: hFile=0x16c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.721] SetEndOfFile (hFile=0x16c) returned 1 [0071.722] CloseHandle (hObject=0x16c) returned 1 [0071.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0071.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.877] lstrlenW (lpString=".doc") returned 4 [0071.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.877] lstrlenW (lpString=".docx") returned 5 [0071.877] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.878] lstrlenW (lpString=".pdf") returned 4 [0071.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.878] lstrlenW (lpString=".xls") returned 4 [0071.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.878] lstrlenW (lpString=".xlsx") returned 5 [0071.878] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.878] lstrlenW (lpString=".ppt") returned 4 [0071.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.878] lstrlenW (lpString=".zip") returned 4 [0071.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.878] lstrlenW (lpString=".rar") returned 4 [0071.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.878] lstrlenW (lpString=".bz2") returned 4 [0071.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.878] lstrlenW (lpString=".7z") returned 3 [0071.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.878] lstrlenW (lpString=".dbf") returned 4 [0071.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.878] lstrlenW (lpString=".1cd") returned 4 [0071.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.878] lstrlenW (lpString=".jpg") returned 4 [0071.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.878] lstrlenW (lpString=".doc") returned 4 [0071.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.878] lstrlenW (lpString=".docx") returned 5 [0071.879] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.879] lstrlenW (lpString=".pdf") returned 4 [0071.879] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.879] lstrlenW (lpString=".xls") returned 4 [0071.879] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.879] lstrlenW (lpString=".xlsx") returned 5 [0071.879] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.879] lstrlenW (lpString=".ppt") returned 4 [0071.879] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.879] lstrlenW (lpString=".zip") returned 4 [0071.879] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.879] lstrlenW (lpString=".rar") returned 4 [0071.879] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.879] lstrlenW (lpString=".bz2") returned 4 [0071.879] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.879] lstrlenW (lpString=".7z") returned 3 [0071.879] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.879] lstrlenW (lpString=".dbf") returned 4 [0071.879] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.879] lstrlenW (lpString=".1cd") returned 4 [0071.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0071.879] lstrlenW (lpString=".jpg") returned 4 [0071.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.879] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0071.880] lstrlenW (lpString="BD08808_.WMF") returned 12 [0071.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0072.920] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=47996) returned 1 [0072.924] CloseHandle (hObject=0x174) returned 1 [0072.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0072.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0072.939] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.942] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0072.947] GetLastError () returned 0x0 [0072.947] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0073.058] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0073.071] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.071] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.071] SetEndOfFile (hFile=0x204) returned 1 [0073.071] CloseHandle (hObject=0x204) returned 1 [0073.072] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.072] SetEndOfFile (hFile=0x174) returned 1 [0073.073] CloseHandle (hObject=0x174) returned 1 [0073.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0073.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.073] lstrlenW (lpString=".doc") returned 4 [0073.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.073] lstrlenW (lpString=".docx") returned 5 [0073.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.073] lstrlenW (lpString=".pdf") returned 4 [0073.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.074] lstrlenW (lpString=".xls") returned 4 [0073.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.074] lstrlenW (lpString=".xlsx") returned 5 [0073.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.074] lstrlenW (lpString=".ppt") returned 4 [0073.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.074] lstrlenW (lpString=".zip") returned 4 [0073.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.074] lstrlenW (lpString=".rar") returned 4 [0073.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.074] lstrlenW (lpString=".bz2") returned 4 [0073.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.074] lstrlenW (lpString=".7z") returned 3 [0073.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.074] lstrlenW (lpString=".dbf") returned 4 [0073.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.074] lstrlenW (lpString=".1cd") returned 4 [0073.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.074] lstrlenW (lpString=".jpg") returned 4 [0073.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.074] lstrlenW (lpString=".doc") returned 4 [0073.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.074] lstrlenW (lpString=".docx") returned 5 [0073.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.074] lstrlenW (lpString=".pdf") returned 4 [0073.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.075] lstrlenW (lpString=".xls") returned 4 [0073.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.075] lstrlenW (lpString=".xlsx") returned 5 [0073.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.075] lstrlenW (lpString=".ppt") returned 4 [0073.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.075] lstrlenW (lpString=".zip") returned 4 [0073.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.075] lstrlenW (lpString=".rar") returned 4 [0073.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.075] lstrlenW (lpString=".bz2") returned 4 [0073.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.075] lstrlenW (lpString=".7z") returned 3 [0073.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.075] lstrlenW (lpString=".dbf") returned 4 [0073.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.075] lstrlenW (lpString=".1cd") returned 4 [0073.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0073.075] lstrlenW (lpString=".jpg") returned 4 [0073.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.075] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0073.075] lstrlenW (lpString="BD09662_.WMF") returned 12 [0073.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0073.076] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=20554) returned 1 [0073.076] CloseHandle (hObject=0x174) returned 1 [0073.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0073.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0073.076] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.076] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.077] GetLastError () returned 0x0 [0073.077] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x504a, lpOverlapped=0x0) returned 1 [0073.185] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x5050, lpOverlapped=0x0) returned 1 [0073.186] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.186] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.186] SetEndOfFile (hFile=0x204) returned 1 [0073.186] CloseHandle (hObject=0x204) returned 1 [0073.187] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.187] SetEndOfFile (hFile=0x174) returned 1 [0073.190] CloseHandle (hObject=0x174) returned 1 [0073.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.190] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0073.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.190] lstrlenW (lpString=".doc") returned 4 [0073.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.191] lstrlenW (lpString=".docx") returned 5 [0073.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.191] lstrlenW (lpString=".pdf") returned 4 [0073.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.191] lstrlenW (lpString=".xls") returned 4 [0073.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.191] lstrlenW (lpString=".xlsx") returned 5 [0073.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.191] lstrlenW (lpString=".ppt") returned 4 [0073.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.191] lstrlenW (lpString=".zip") returned 4 [0073.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.191] lstrlenW (lpString=".rar") returned 4 [0073.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.191] lstrlenW (lpString=".bz2") returned 4 [0073.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.191] lstrlenW (lpString=".7z") returned 3 [0073.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.191] lstrlenW (lpString=".dbf") returned 4 [0073.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.191] lstrlenW (lpString=".1cd") returned 4 [0073.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.191] lstrlenW (lpString=".jpg") returned 4 [0073.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.191] lstrlenW (lpString=".doc") returned 4 [0073.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.191] lstrlenW (lpString=".docx") returned 5 [0073.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.192] lstrlenW (lpString=".pdf") returned 4 [0073.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.192] lstrlenW (lpString=".xls") returned 4 [0073.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.192] lstrlenW (lpString=".xlsx") returned 5 [0073.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.192] lstrlenW (lpString=".ppt") returned 4 [0073.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.192] lstrlenW (lpString=".zip") returned 4 [0073.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.192] lstrlenW (lpString=".rar") returned 4 [0073.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.192] lstrlenW (lpString=".bz2") returned 4 [0073.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.192] lstrlenW (lpString=".7z") returned 3 [0073.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.192] lstrlenW (lpString=".dbf") returned 4 [0073.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.192] lstrlenW (lpString=".1cd") returned 4 [0073.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0073.192] lstrlenW (lpString=".jpg") returned 4 [0073.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.192] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0073.193] lstrlenW (lpString="BD19695_.WMF") returned 12 [0073.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0073.193] GetFileSizeEx (in: hFile=0x174, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=12982) returned 1 [0073.193] CloseHandle (hObject=0x174) returned 1 [0073.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0073.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0073.193] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.193] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0073.194] GetLastError () returned 0x0 [0073.194] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0073.724] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0073.725] ReadFile (in: hFile=0x174, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.725] WriteFile (in: hFile=0x204, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.726] SetEndOfFile (hFile=0x204) returned 1 [0074.288] CloseHandle (hObject=0x204) returned 1 [0074.288] SetFilePointerEx (in: hFile=0x174, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.288] SetEndOfFile (hFile=0x174) returned 1 [0074.289] CloseHandle (hObject=0x174) returned 1 [0074.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0074.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0074.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.546] lstrlenW (lpString=".doc") returned 4 [0074.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.547] lstrlenW (lpString=".docx") returned 5 [0074.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.547] lstrlenW (lpString=".pdf") returned 4 [0074.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.547] lstrlenW (lpString=".xls") returned 4 [0074.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.547] lstrlenW (lpString=".xlsx") returned 5 [0074.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.547] lstrlenW (lpString=".ppt") returned 4 [0074.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.547] lstrlenW (lpString=".zip") returned 4 [0074.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.547] lstrlenW (lpString=".rar") returned 4 [0074.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.547] lstrlenW (lpString=".bz2") returned 4 [0074.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.547] lstrlenW (lpString=".7z") returned 3 [0074.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.547] lstrlenW (lpString=".dbf") returned 4 [0074.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.547] lstrlenW (lpString=".1cd") returned 4 [0074.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.547] lstrlenW (lpString=".jpg") returned 4 [0074.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.547] lstrlenW (lpString=".doc") returned 4 [0074.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.547] lstrlenW (lpString=".docx") returned 5 [0074.548] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.548] lstrlenW (lpString=".pdf") returned 4 [0074.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString=".xls") returned 4 [0074.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.548] lstrlenW (lpString=".xlsx") returned 5 [0074.548] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.548] lstrlenW (lpString=".ppt") returned 4 [0074.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.548] lstrlenW (lpString=".zip") returned 4 [0074.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.548] lstrlenW (lpString=".rar") returned 4 [0074.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString=".bz2") returned 4 [0074.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString=".7z") returned 3 [0074.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.548] lstrlenW (lpString=".dbf") returned 4 [0074.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.548] lstrlenW (lpString=".1cd") returned 4 [0074.548] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0074.548] lstrlenW (lpString=".jpg") returned 4 [0074.548] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.548] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0074.548] lstrlenW (lpString="BL00098_.WMF") returned 12 [0074.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.805] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=1012) returned 1 [0075.805] CloseHandle (hObject=0x1ec) returned 1 [0075.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0075.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.806] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.806] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0075.807] GetLastError () returned 0x0 [0075.807] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x3f4, lpOverlapped=0x0) returned 1 [0075.825] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x400, lpOverlapped=0x0) returned 1 [0075.840] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.840] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.840] SetEndOfFile (hFile=0x174) returned 1 [0075.840] CloseHandle (hObject=0x174) returned 1 [0075.840] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.840] SetEndOfFile (hFile=0x1ec) returned 1 [0075.841] CloseHandle (hObject=0x1ec) returned 1 [0075.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0075.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.842] lstrlenW (lpString=".doc") returned 4 [0075.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.842] lstrlenW (lpString=".docx") returned 5 [0075.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.842] lstrlenW (lpString=".pdf") returned 4 [0075.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.842] lstrlenW (lpString=".xls") returned 4 [0075.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.842] lstrlenW (lpString=".xlsx") returned 5 [0075.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.842] lstrlenW (lpString=".ppt") returned 4 [0075.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.842] lstrlenW (lpString=".zip") returned 4 [0075.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.842] lstrlenW (lpString=".rar") returned 4 [0075.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.842] lstrlenW (lpString=".bz2") returned 4 [0075.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.842] lstrlenW (lpString=".7z") returned 3 [0075.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.842] lstrlenW (lpString=".dbf") returned 4 [0075.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.842] lstrlenW (lpString=".1cd") returned 4 [0075.842] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.842] lstrlenW (lpString=".jpg") returned 4 [0075.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.843] lstrlenW (lpString=".doc") returned 4 [0075.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.843] lstrlenW (lpString=".docx") returned 5 [0075.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.843] lstrlenW (lpString=".pdf") returned 4 [0075.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.843] lstrlenW (lpString=".xls") returned 4 [0075.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.843] lstrlenW (lpString=".xlsx") returned 5 [0075.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.843] lstrlenW (lpString=".ppt") returned 4 [0075.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.843] lstrlenW (lpString=".zip") returned 4 [0075.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.843] lstrlenW (lpString=".rar") returned 4 [0075.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.843] lstrlenW (lpString=".bz2") returned 4 [0075.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.843] lstrlenW (lpString=".7z") returned 3 [0075.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.843] lstrlenW (lpString=".dbf") returned 4 [0075.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.843] lstrlenW (lpString=".1cd") returned 4 [0075.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0075.843] lstrlenW (lpString=".jpg") returned 4 [0075.844] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.844] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0075.844] lstrlenW (lpString="BL00194_.WMF") returned 12 [0075.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.844] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3986) returned 1 [0075.844] CloseHandle (hObject=0x1ec) returned 1 [0075.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0075.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.844] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.844] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0075.845] GetLastError () returned 0x0 [0075.845] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xf92, lpOverlapped=0x0) returned 1 [0075.846] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0075.847] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.847] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.847] SetEndOfFile (hFile=0x174) returned 1 [0075.848] CloseHandle (hObject=0x174) returned 1 [0075.848] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.848] SetEndOfFile (hFile=0x1ec) returned 1 [0075.848] CloseHandle (hObject=0x1ec) returned 1 [0075.848] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0075.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.849] lstrlenW (lpString=".doc") returned 4 [0075.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.849] lstrlenW (lpString=".docx") returned 5 [0075.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.849] lstrlenW (lpString=".pdf") returned 4 [0075.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.849] lstrlenW (lpString=".xls") returned 4 [0075.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.849] lstrlenW (lpString=".xlsx") returned 5 [0075.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.849] lstrlenW (lpString=".ppt") returned 4 [0075.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.849] lstrlenW (lpString=".zip") returned 4 [0075.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.849] lstrlenW (lpString=".rar") returned 4 [0075.849] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.849] lstrlenW (lpString=".bz2") returned 4 [0075.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.849] lstrlenW (lpString=".7z") returned 3 [0075.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.850] lstrlenW (lpString=".dbf") returned 4 [0075.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.850] lstrlenW (lpString=".1cd") returned 4 [0075.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.850] lstrlenW (lpString=".jpg") returned 4 [0075.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.850] lstrlenW (lpString=".doc") returned 4 [0075.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.850] lstrlenW (lpString=".docx") returned 5 [0075.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.850] lstrlenW (lpString=".pdf") returned 4 [0075.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.850] lstrlenW (lpString=".xls") returned 4 [0075.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.850] lstrlenW (lpString=".xlsx") returned 5 [0075.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.850] lstrlenW (lpString=".ppt") returned 4 [0075.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.850] lstrlenW (lpString=".zip") returned 4 [0075.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.850] lstrlenW (lpString=".rar") returned 4 [0075.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.850] lstrlenW (lpString=".bz2") returned 4 [0075.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.850] lstrlenW (lpString=".7z") returned 3 [0075.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.851] lstrlenW (lpString=".dbf") returned 4 [0075.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.851] lstrlenW (lpString=".1cd") returned 4 [0075.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0075.851] lstrlenW (lpString=".jpg") returned 4 [0075.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.851] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0075.851] lstrlenW (lpString="BL00195_.WMF") returned 12 [0075.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.852] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=8070) returned 1 [0075.852] CloseHandle (hObject=0x1ec) returned 1 [0075.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0075.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.852] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.852] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0075.853] GetLastError () returned 0x0 [0075.853] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1f86, lpOverlapped=0x0) returned 1 [0075.862] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0075.863] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.863] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.863] SetEndOfFile (hFile=0x174) returned 1 [0075.864] CloseHandle (hObject=0x174) returned 1 [0075.864] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.864] SetEndOfFile (hFile=0x1ec) returned 1 [0075.865] CloseHandle (hObject=0x1ec) returned 1 [0075.865] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0075.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.865] lstrlenW (lpString=".doc") returned 4 [0075.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.865] lstrlenW (lpString=".docx") returned 5 [0075.865] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.865] lstrlenW (lpString=".pdf") returned 4 [0075.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.865] lstrlenW (lpString=".xls") returned 4 [0075.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.865] lstrlenW (lpString=".xlsx") returned 5 [0075.865] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.865] lstrlenW (lpString=".ppt") returned 4 [0075.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.866] lstrlenW (lpString=".zip") returned 4 [0075.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.866] lstrlenW (lpString=".rar") returned 4 [0075.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.866] lstrlenW (lpString=".bz2") returned 4 [0075.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.866] lstrlenW (lpString=".7z") returned 3 [0075.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.866] lstrlenW (lpString=".dbf") returned 4 [0075.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.866] lstrlenW (lpString=".1cd") returned 4 [0075.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.866] lstrlenW (lpString=".jpg") returned 4 [0075.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.866] lstrlenW (lpString=".doc") returned 4 [0075.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.866] lstrlenW (lpString=".docx") returned 5 [0075.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.866] lstrlenW (lpString=".pdf") returned 4 [0075.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.866] lstrlenW (lpString=".xls") returned 4 [0075.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.866] lstrlenW (lpString=".xlsx") returned 5 [0075.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.866] lstrlenW (lpString=".ppt") returned 4 [0075.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.867] lstrlenW (lpString=".zip") returned 4 [0075.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.867] lstrlenW (lpString=".rar") returned 4 [0075.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.867] lstrlenW (lpString=".bz2") returned 4 [0075.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.867] lstrlenW (lpString=".7z") returned 3 [0075.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.867] lstrlenW (lpString=".dbf") returned 4 [0075.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.867] lstrlenW (lpString=".1cd") returned 4 [0075.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0075.867] lstrlenW (lpString=".jpg") returned 4 [0075.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.867] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0075.867] lstrlenW (lpString="BL00234_.WMF") returned 12 [0075.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.868] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=9304) returned 1 [0075.868] CloseHandle (hObject=0x1ec) returned 1 [0075.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0075.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0075.868] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.868] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0075.868] GetLastError () returned 0x0 [0075.868] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x2458, lpOverlapped=0x0) returned 1 [0075.870] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0076.058] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.058] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.058] SetEndOfFile (hFile=0x174) returned 1 [0076.058] CloseHandle (hObject=0x174) returned 1 [0076.059] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.059] SetEndOfFile (hFile=0x1ec) returned 1 [0076.059] CloseHandle (hObject=0x1ec) returned 1 [0076.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0076.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.060] lstrlenW (lpString=".doc") returned 4 [0076.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.060] lstrlenW (lpString=".docx") returned 5 [0076.060] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.060] lstrlenW (lpString=".pdf") returned 4 [0076.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.060] lstrlenW (lpString=".xls") returned 4 [0076.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.060] lstrlenW (lpString=".xlsx") returned 5 [0076.060] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.060] lstrlenW (lpString=".ppt") returned 4 [0076.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.060] lstrlenW (lpString=".zip") returned 4 [0076.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.060] lstrlenW (lpString=".rar") returned 4 [0076.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.061] lstrlenW (lpString=".bz2") returned 4 [0076.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.061] lstrlenW (lpString=".7z") returned 3 [0076.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.061] lstrlenW (lpString=".dbf") returned 4 [0076.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.061] lstrlenW (lpString=".1cd") returned 4 [0076.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.061] lstrlenW (lpString=".jpg") returned 4 [0076.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.061] lstrlenW (lpString=".doc") returned 4 [0076.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.061] lstrlenW (lpString=".docx") returned 5 [0076.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.061] lstrlenW (lpString=".pdf") returned 4 [0076.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.061] lstrlenW (lpString=".xls") returned 4 [0076.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.061] lstrlenW (lpString=".xlsx") returned 5 [0076.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.061] lstrlenW (lpString=".ppt") returned 4 [0076.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.061] lstrlenW (lpString=".zip") returned 4 [0076.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.061] lstrlenW (lpString=".rar") returned 4 [0076.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.062] lstrlenW (lpString=".bz2") returned 4 [0076.062] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.062] lstrlenW (lpString=".7z") returned 3 [0076.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.062] lstrlenW (lpString=".dbf") returned 4 [0076.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.062] lstrlenW (lpString=".1cd") returned 4 [0076.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0076.062] lstrlenW (lpString=".jpg") returned 4 [0076.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.062] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.062] lstrlenW (lpString="BL00269_.WMF") returned 12 [0076.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.062] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=5272) returned 1 [0076.062] CloseHandle (hObject=0x1ec) returned 1 [0076.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0076.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.063] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.063] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0076.063] GetLastError () returned 0x0 [0076.063] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1498, lpOverlapped=0x0) returned 1 [0076.065] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0076.066] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.066] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.066] SetEndOfFile (hFile=0x174) returned 1 [0076.066] CloseHandle (hObject=0x174) returned 1 [0076.067] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.067] SetEndOfFile (hFile=0x1ec) returned 1 [0076.074] CloseHandle (hObject=0x1ec) returned 1 [0076.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0076.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.074] lstrlenW (lpString=".doc") returned 4 [0076.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.074] lstrlenW (lpString=".docx") returned 5 [0076.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.074] lstrlenW (lpString=".pdf") returned 4 [0076.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.074] lstrlenW (lpString=".xls") returned 4 [0076.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.075] lstrlenW (lpString=".xlsx") returned 5 [0076.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.075] lstrlenW (lpString=".ppt") returned 4 [0076.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.075] lstrlenW (lpString=".zip") returned 4 [0076.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.075] lstrlenW (lpString=".rar") returned 4 [0076.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.075] lstrlenW (lpString=".bz2") returned 4 [0076.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.075] lstrlenW (lpString=".7z") returned 3 [0076.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.075] lstrlenW (lpString=".dbf") returned 4 [0076.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.075] lstrlenW (lpString=".1cd") returned 4 [0076.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.075] lstrlenW (lpString=".jpg") returned 4 [0076.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.075] lstrlenW (lpString=".doc") returned 4 [0076.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.075] lstrlenW (lpString=".docx") returned 5 [0076.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.075] lstrlenW (lpString=".pdf") returned 4 [0076.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.075] lstrlenW (lpString=".xls") returned 4 [0076.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.076] lstrlenW (lpString=".xlsx") returned 5 [0076.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.076] lstrlenW (lpString=".ppt") returned 4 [0076.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.076] lstrlenW (lpString=".zip") returned 4 [0076.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.076] lstrlenW (lpString=".rar") returned 4 [0076.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.076] lstrlenW (lpString=".bz2") returned 4 [0076.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.076] lstrlenW (lpString=".7z") returned 3 [0076.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.076] lstrlenW (lpString=".dbf") returned 4 [0076.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.076] lstrlenW (lpString=".1cd") returned 4 [0076.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0076.076] lstrlenW (lpString=".jpg") returned 4 [0076.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.076] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.076] lstrlenW (lpString="BL00270_.WMF") returned 12 [0076.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.078] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3016) returned 1 [0076.078] CloseHandle (hObject=0x1ec) returned 1 [0076.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0076.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.078] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.078] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0076.078] GetLastError () returned 0x0 [0076.079] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0076.080] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0076.081] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.081] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.081] SetEndOfFile (hFile=0x174) returned 1 [0076.081] CloseHandle (hObject=0x174) returned 1 [0076.081] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.082] SetEndOfFile (hFile=0x1ec) returned 1 [0076.082] CloseHandle (hObject=0x1ec) returned 1 [0076.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.083] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0076.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.083] lstrlenW (lpString=".doc") returned 4 [0076.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.083] lstrlenW (lpString=".docx") returned 5 [0076.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.083] lstrlenW (lpString=".pdf") returned 4 [0076.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.083] lstrlenW (lpString=".xls") returned 4 [0076.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.083] lstrlenW (lpString=".xlsx") returned 5 [0076.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.083] lstrlenW (lpString=".ppt") returned 4 [0076.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.083] lstrlenW (lpString=".zip") returned 4 [0076.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.083] lstrlenW (lpString=".rar") returned 4 [0076.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.083] lstrlenW (lpString=".bz2") returned 4 [0076.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.083] lstrlenW (lpString=".7z") returned 3 [0076.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.083] lstrlenW (lpString=".dbf") returned 4 [0076.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.084] lstrlenW (lpString=".1cd") returned 4 [0076.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.084] lstrlenW (lpString=".jpg") returned 4 [0076.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.084] lstrlenW (lpString=".doc") returned 4 [0076.084] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.084] lstrlenW (lpString=".docx") returned 5 [0076.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.084] lstrlenW (lpString=".pdf") returned 4 [0076.084] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.084] lstrlenW (lpString=".xls") returned 4 [0076.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.084] lstrlenW (lpString=".xlsx") returned 5 [0076.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.084] lstrlenW (lpString=".ppt") returned 4 [0076.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.084] lstrlenW (lpString=".zip") returned 4 [0076.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.084] lstrlenW (lpString=".rar") returned 4 [0076.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.084] lstrlenW (lpString=".bz2") returned 4 [0076.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.084] lstrlenW (lpString=".7z") returned 3 [0076.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.084] lstrlenW (lpString=".dbf") returned 4 [0076.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.085] lstrlenW (lpString=".1cd") returned 4 [0076.085] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0076.085] lstrlenW (lpString=".jpg") returned 4 [0076.085] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.085] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.085] lstrlenW (lpString="BL00273_.WMF") returned 12 [0076.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.085] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=3780) returned 1 [0076.085] CloseHandle (hObject=0x1ec) returned 1 [0076.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0076.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.086] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.086] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0076.086] GetLastError () returned 0x0 [0076.086] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0xec4, lpOverlapped=0x0) returned 1 [0076.090] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xed0, lpOverlapped=0x0) returned 1 [0076.092] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.092] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.092] SetEndOfFile (hFile=0x174) returned 1 [0076.092] CloseHandle (hObject=0x174) returned 1 [0076.093] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.093] SetEndOfFile (hFile=0x1ec) returned 1 [0076.093] CloseHandle (hObject=0x1ec) returned 1 [0076.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0076.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.094] lstrlenW (lpString=".doc") returned 4 [0076.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.094] lstrlenW (lpString=".docx") returned 5 [0076.094] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.094] lstrlenW (lpString=".pdf") returned 4 [0076.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.094] lstrlenW (lpString=".xls") returned 4 [0076.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.094] lstrlenW (lpString=".xlsx") returned 5 [0076.094] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.094] lstrlenW (lpString=".ppt") returned 4 [0076.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.094] lstrlenW (lpString=".zip") returned 4 [0076.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.094] lstrlenW (lpString=".rar") returned 4 [0076.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.094] lstrlenW (lpString=".bz2") returned 4 [0076.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.095] lstrlenW (lpString=".7z") returned 3 [0076.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.095] lstrlenW (lpString=".dbf") returned 4 [0076.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.095] lstrlenW (lpString=".1cd") returned 4 [0076.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.095] lstrlenW (lpString=".jpg") returned 4 [0076.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.095] lstrlenW (lpString=".doc") returned 4 [0076.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.095] lstrlenW (lpString=".docx") returned 5 [0076.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.095] lstrlenW (lpString=".pdf") returned 4 [0076.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.095] lstrlenW (lpString=".xls") returned 4 [0076.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.095] lstrlenW (lpString=".xlsx") returned 5 [0076.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.095] lstrlenW (lpString=".ppt") returned 4 [0076.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.095] lstrlenW (lpString=".zip") returned 4 [0076.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.095] lstrlenW (lpString=".rar") returned 4 [0076.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.095] lstrlenW (lpString=".bz2") returned 4 [0076.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString=".7z") returned 3 [0076.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.096] lstrlenW (lpString=".dbf") returned 4 [0076.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.096] lstrlenW (lpString=".1cd") returned 4 [0076.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0076.096] lstrlenW (lpString=".jpg") returned 4 [0076.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.096] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.096] lstrlenW (lpString="BL00274_.WMF") returned 12 [0076.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.096] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x2f1ff1c | out: lpFileSize=0x2f1ff1c*=4164) returned 1 [0076.096] CloseHandle (hObject=0x1ec) returned 1 [0076.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0076.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0076.097] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.097] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0076.097] GetLastError () returned 0x0 [0076.097] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x1044, lpOverlapped=0x0) returned 1 [0076.339] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0x1050, lpOverlapped=0x0) returned 1 [0076.341] ReadFile (in: hFile=0x1ec, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2f1fed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2f1fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.344] WriteFile (in: hFile=0x174, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2f1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2f1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.344] SetEndOfFile (hFile=0x174) returned 1 [0076.344] CloseHandle (hObject=0x174) returned 1 [0076.344] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2f1fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.344] SetEndOfFile (hFile=0x1ec) returned 1 [0076.345] CloseHandle (hObject=0x1ec) returned 1 [0076.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.345] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) Thread: id = 19 os_tid = 0xab0 [0047.025] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x3780480 [0047.025] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x3790488 [0047.027] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920420 [0047.027] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x6) returned 0x923180 [0047.027] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920438 [0047.027] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x3a70020 [0047.027] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920450 [0047.027] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920450, Size=0x20) returned 0x905cc0 [0047.027] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920450 [0047.027] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920450, Size=0x20) returned 0x905ce8 [0047.028] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.028] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.028] Wow64DisableWow64FsRedirection (in: OldValue=0x305ff58 | out: OldValue=0x305ff58*=0x0) returned 1 [0047.028] lstrlenW (lpString="kernel32.dll") returned 12 [0047.028] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905cc0 | out: hHeap=0x8d0000) returned 1 [0047.028] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.028] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905ce8 | out: hHeap=0x8d0000) returned 1 [0047.028] Sleep (dwMilliseconds=0x64) [0047.239] Sleep (dwMilliseconds=0x64) [0047.479] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.479] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.479] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0047.480] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=89168) returned 1 [0047.480] CloseHandle (hObject=0x16c) returned 1 [0047.480] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0047.480] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.480] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.480] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.480] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.480] lstrlenW (lpString=".doc") returned 4 [0047.480] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.480] lstrlenW (lpString=".docx") returned 5 [0047.480] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.480] lstrlenW (lpString=".pdf") returned 4 [0047.480] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.480] lstrlenW (lpString=".xls") returned 4 [0047.480] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.480] lstrlenW (lpString=".xlsx") returned 5 [0047.480] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.480] lstrlenW (lpString=".ppt") returned 4 [0047.480] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.480] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.480] lstrlenW (lpString=".zip") returned 4 [0047.480] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.480] lstrlenW (lpString=".rar") returned 4 [0047.480] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.480] lstrlenW (lpString=".bz2") returned 4 [0047.480] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.481] lstrlenW (lpString=".7z") returned 3 [0047.481] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.481] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.481] lstrlenW (lpString=".dbf") returned 4 [0047.481] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.481] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.481] lstrlenW (lpString=".1cd") returned 4 [0047.481] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.481] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.481] lstrlenW (lpString=".jpg") returned 4 [0047.481] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.481] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.481] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.481] lstrlenW (lpString=".doc") returned 4 [0047.481] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.481] lstrlenW (lpString=".docx") returned 5 [0047.481] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.481] lstrlenW (lpString=".pdf") returned 4 [0047.481] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.481] lstrlenW (lpString=".xls") returned 4 [0047.481] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.481] lstrlenW (lpString=".xlsx") returned 5 [0047.481] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.481] lstrlenW (lpString=".ppt") returned 4 [0047.481] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.481] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.481] lstrlenW (lpString=".zip") returned 4 [0047.481] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.481] lstrlenW (lpString=".rar") returned 4 [0047.481] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.481] lstrlenW (lpString=".bz2") returned 4 [0047.482] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.482] lstrlenW (lpString=".7z") returned 3 [0047.482] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.482] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.482] lstrlenW (lpString=".dbf") returned 4 [0047.482] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.482] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.482] lstrlenW (lpString=".1cd") returned 4 [0047.482] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.482] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0047.482] lstrlenW (lpString=".jpg") returned 4 [0047.482] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.482] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.482] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.482] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0047.482] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=87616) returned 1 [0047.482] CloseHandle (hObject=0x16c) returned 1 [0047.482] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0047.483] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.483] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.483] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.483] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.483] lstrlenW (lpString=".doc") returned 4 [0047.483] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.483] lstrlenW (lpString=".docx") returned 5 [0047.483] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.483] lstrlenW (lpString=".pdf") returned 4 [0047.483] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.483] lstrlenW (lpString=".xls") returned 4 [0047.483] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.483] lstrlenW (lpString=".xlsx") returned 5 [0047.483] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.483] lstrlenW (lpString=".ppt") returned 4 [0047.483] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.483] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.483] lstrlenW (lpString=".zip") returned 4 [0047.483] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.483] lstrlenW (lpString=".rar") returned 4 [0047.483] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.483] lstrlenW (lpString=".bz2") returned 4 [0047.483] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.483] lstrlenW (lpString=".7z") returned 3 [0047.483] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.483] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.483] lstrlenW (lpString=".dbf") returned 4 [0047.483] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.483] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.483] lstrlenW (lpString=".1cd") returned 4 [0047.483] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.484] lstrlenW (lpString=".jpg") returned 4 [0047.484] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.484] lstrlenW (lpString=".doc") returned 4 [0047.484] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.484] lstrlenW (lpString=".docx") returned 5 [0047.484] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.484] lstrlenW (lpString=".pdf") returned 4 [0047.484] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.484] lstrlenW (lpString=".xls") returned 4 [0047.484] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.484] lstrlenW (lpString=".xlsx") returned 5 [0047.484] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.484] lstrlenW (lpString=".ppt") returned 4 [0047.484] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.484] lstrlenW (lpString=".zip") returned 4 [0047.484] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.484] lstrlenW (lpString=".rar") returned 4 [0047.484] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.484] lstrlenW (lpString=".bz2") returned 4 [0047.484] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.484] lstrlenW (lpString=".7z") returned 3 [0047.484] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.484] lstrlenW (lpString=".dbf") returned 4 [0047.484] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.484] lstrlenW (lpString=".1cd") returned 4 [0047.484] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.484] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0047.485] lstrlenW (lpString=".jpg") returned 4 [0047.485] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.485] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.485] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.485] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0047.485] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=91712) returned 1 [0047.485] CloseHandle (hObject=0x16c) returned 1 [0047.485] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0047.485] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.485] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.485] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.485] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.485] lstrlenW (lpString=".doc") returned 4 [0047.485] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.485] lstrlenW (lpString=".docx") returned 5 [0047.485] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.485] lstrlenW (lpString=".pdf") returned 4 [0047.486] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.486] lstrlenW (lpString=".xls") returned 4 [0047.486] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.486] lstrlenW (lpString=".xlsx") returned 5 [0047.486] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.486] lstrlenW (lpString=".ppt") returned 4 [0047.486] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.486] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.486] lstrlenW (lpString=".zip") returned 4 [0047.486] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.486] lstrlenW (lpString=".rar") returned 4 [0047.486] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.486] lstrlenW (lpString=".bz2") returned 4 [0047.486] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.486] lstrlenW (lpString=".7z") returned 3 [0047.486] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.486] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.486] lstrlenW (lpString=".dbf") returned 4 [0047.486] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.486] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.486] lstrlenW (lpString=".1cd") returned 4 [0047.486] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.486] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.486] lstrlenW (lpString=".jpg") returned 4 [0047.486] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.486] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.486] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.486] lstrlenW (lpString=".doc") returned 4 [0047.486] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.486] lstrlenW (lpString=".docx") returned 5 [0047.486] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.487] lstrlenW (lpString=".pdf") returned 4 [0047.487] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.487] lstrlenW (lpString=".xls") returned 4 [0047.487] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.487] lstrlenW (lpString=".xlsx") returned 5 [0047.487] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.487] lstrlenW (lpString=".ppt") returned 4 [0047.487] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.487] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.487] lstrlenW (lpString=".zip") returned 4 [0047.487] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.487] lstrlenW (lpString=".rar") returned 4 [0047.487] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.487] lstrlenW (lpString=".bz2") returned 4 [0047.487] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.487] lstrlenW (lpString=".7z") returned 3 [0047.487] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.487] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.487] lstrlenW (lpString=".dbf") returned 4 [0047.487] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.487] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.487] lstrlenW (lpString=".1cd") returned 4 [0047.487] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.487] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0047.487] lstrlenW (lpString=".jpg") returned 4 [0047.487] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.487] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0047.488] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.488] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0047.488] GetFileSizeEx (in: hFile=0x16c, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=94800) returned 1 [0047.488] CloseHandle (hObject=0x16c) returned 1 [0047.488] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0047.488] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0047.488] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.488] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.488] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.488] lstrlenW (lpString=".doc") returned 4 [0047.488] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.488] lstrlenW (lpString=".docx") returned 5 [0047.488] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.488] lstrlenW (lpString=".pdf") returned 4 [0047.488] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.488] lstrlenW (lpString=".xls") returned 4 [0047.488] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.488] lstrlenW (lpString=".xlsx") returned 5 [0047.488] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.489] lstrlenW (lpString=".ppt") returned 4 [0047.489] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.489] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.489] lstrlenW (lpString=".zip") returned 4 [0047.489] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.489] lstrlenW (lpString=".rar") returned 4 [0047.489] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.489] lstrlenW (lpString=".bz2") returned 4 [0047.489] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.489] lstrlenW (lpString=".7z") returned 3 [0047.489] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.489] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.489] lstrlenW (lpString=".dbf") returned 4 [0047.489] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.489] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.489] lstrlenW (lpString=".1cd") returned 4 [0047.489] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.489] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.489] lstrlenW (lpString=".jpg") returned 4 [0047.489] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.489] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.489] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.489] lstrlenW (lpString=".doc") returned 4 [0047.489] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.489] lstrlenW (lpString=".docx") returned 5 [0047.489] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.489] lstrlenW (lpString=".pdf") returned 4 [0047.489] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.489] lstrlenW (lpString=".xls") returned 4 [0047.489] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0047.489] lstrlenW (lpString=".xlsx") returned 5 [0047.489] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0047.490] lstrlenW (lpString=".ppt") returned 4 [0047.490] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.490] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.490] lstrlenW (lpString=".zip") returned 4 [0047.490] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0047.490] lstrlenW (lpString=".rar") returned 4 [0047.490] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0047.490] lstrlenW (lpString=".bz2") returned 4 [0047.490] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.490] lstrlenW (lpString=".7z") returned 3 [0047.490] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.490] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.490] lstrlenW (lpString=".dbf") returned 4 [0047.490] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.490] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.490] lstrlenW (lpString=".1cd") returned 4 [0047.490] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.490] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0047.490] lstrlenW (lpString=".jpg") returned 4 [0047.490] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.490] Sleep (dwMilliseconds=0x64) [0047.648] lstrcmpiW (lpString1=".sys", lpString2=".wiki") returned -1 [0047.648] lstrlenW (lpString="hiberfil.sys") returned 12 [0047.648] CreateFileW (lpFileName="C:\\hiberfil.sys" (normalized: "c:\\hiberfil.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0047.648] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.648] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.648] lstrlenW (lpString=".doc") returned 4 [0047.648] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0047.648] lstrlenW (lpString=".docx") returned 5 [0047.648] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0047.648] lstrlenW (lpString=".pdf") returned 4 [0047.648] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0047.648] lstrlenW (lpString=".xls") returned 4 [0047.648] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0047.648] lstrlenW (lpString=".xlsx") returned 5 [0047.648] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0047.648] lstrlenW (lpString=".ppt") returned 4 [0047.648] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0047.648] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.648] lstrlenW (lpString=".zip") returned 4 [0047.648] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0047.648] lstrlenW (lpString=".rar") returned 4 [0047.648] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0047.648] lstrlenW (lpString=".bz2") returned 4 [0047.649] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0047.649] lstrlenW (lpString=".7z") returned 3 [0047.649] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0047.649] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.649] lstrlenW (lpString=".dbf") returned 4 [0047.649] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0047.649] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.649] lstrlenW (lpString=".1cd") returned 4 [0047.649] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0047.649] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.649] lstrlenW (lpString=".jpg") returned 4 [0047.649] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0047.649] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.649] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.649] lstrlenW (lpString=".doc") returned 4 [0047.649] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0047.649] lstrlenW (lpString=".docx") returned 5 [0047.649] lstrcmpiW (lpString1=".docx", lpString2="l.sys") returned -1 [0047.649] lstrlenW (lpString=".pdf") returned 4 [0047.649] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0047.649] lstrlenW (lpString=".xls") returned 4 [0047.649] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0047.649] lstrlenW (lpString=".xlsx") returned 5 [0047.649] lstrcmpiW (lpString1=".xlsx", lpString2="l.sys") returned -1 [0047.649] lstrlenW (lpString=".ppt") returned 4 [0047.649] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0047.649] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.649] lstrlenW (lpString=".zip") returned 4 [0047.649] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0047.649] lstrlenW (lpString=".rar") returned 4 [0047.649] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0047.649] lstrlenW (lpString=".bz2") returned 4 [0047.649] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0047.650] lstrlenW (lpString=".7z") returned 3 [0047.650] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0047.650] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.650] lstrlenW (lpString=".dbf") returned 4 [0047.650] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0047.650] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.650] lstrlenW (lpString=".1cd") returned 4 [0047.650] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0047.650] lstrlenW (lpString="C:\\hiberfil.sys") returned 15 [0047.650] lstrlenW (lpString=".jpg") returned 4 [0047.650] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0047.650] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0047.650] lstrlenW (lpString="ExcelLR.cab") returned 11 [0047.650] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0048.092] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=16972987) returned 1 [0048.092] CloseHandle (hObject=0x198) returned 1 [0048.092] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0048.093] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.093] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0048.557] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0048.557] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1 [0048.557] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.557] ReadFile (in: hFile=0x198, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.565] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.565] ReadFile (in: hFile=0x198, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.571] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.571] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0048.571] ReadFile (in: hFile=0x198, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.591] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.591] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0048.887] SetEndOfFile (hFile=0x198) returned 1 [0048.887] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3fc54b8 [0048.891] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.891] WriteFile (in: hFile=0x198, lpBuffer=0x3fc54b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc54b8*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.892] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.892] WriteFile (in: hFile=0x198, lpBuffer=0x3fc54b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc54b8*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.893] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0048.893] WriteFile (in: hFile=0x198, lpBuffer=0x3fc54b8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fc54b8*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.894] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fc54b8 | out: hHeap=0x8d0000) returned 1 [0048.894] CloseHandle (hObject=0x198) returned 1 [0050.833] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.833] lstrlenW (lpString=".doc") returned 4 [0050.833] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.833] lstrlenW (lpString=".docx") returned 5 [0050.834] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0050.834] lstrlenW (lpString=".pdf") returned 4 [0050.834] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.834] lstrlenW (lpString=".xls") returned 4 [0050.834] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.834] lstrlenW (lpString=".xlsx") returned 5 [0050.834] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0050.834] lstrlenW (lpString=".ppt") returned 4 [0050.834] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.834] lstrlenW (lpString=".zip") returned 4 [0050.834] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.834] lstrlenW (lpString=".rar") returned 4 [0050.834] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.834] lstrlenW (lpString=".bz2") returned 4 [0050.834] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.834] lstrlenW (lpString=".7z") returned 3 [0050.834] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.834] lstrlenW (lpString=".dbf") returned 4 [0050.834] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.834] lstrlenW (lpString=".1cd") returned 4 [0050.834] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.834] lstrlenW (lpString=".jpg") returned 4 [0050.834] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.834] lstrlenW (lpString=".doc") returned 4 [0050.835] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0050.835] lstrlenW (lpString=".docx") returned 5 [0050.835] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0050.835] lstrlenW (lpString=".pdf") returned 4 [0050.835] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0050.835] lstrlenW (lpString=".xls") returned 4 [0050.835] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0050.835] lstrlenW (lpString=".xlsx") returned 5 [0050.835] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0050.835] lstrlenW (lpString=".ppt") returned 4 [0050.835] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0050.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.835] lstrlenW (lpString=".zip") returned 4 [0050.835] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0050.835] lstrlenW (lpString=".rar") returned 4 [0050.835] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0050.835] lstrlenW (lpString=".bz2") returned 4 [0050.835] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0050.835] lstrlenW (lpString=".7z") returned 3 [0050.835] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0050.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.835] lstrlenW (lpString=".dbf") returned 4 [0050.835] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0050.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.835] lstrlenW (lpString=".1cd") returned 4 [0050.835] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0050.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0050.835] lstrlenW (lpString=".jpg") returned 4 [0050.835] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0050.836] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0050.836] lstrlenW (lpString="WordLR.cab") returned 10 [0050.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0050.836] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=43806141) returned 1 [0050.836] CloseHandle (hObject=0x198) returned 1 [0050.836] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0050.836] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.836] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0050.837] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0050.837] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1 [0050.837] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.837] ReadFile (in: hFile=0x198, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.946] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.946] ReadFile (in: hFile=0x198, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.997] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.998] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0050.998] ReadFile (in: hFile=0x198, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.162] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.162] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0051.180] SetEndOfFile (hFile=0x198) returned 1 [0051.180] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f13470 [0051.886] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.886] WriteFile (in: hFile=0x198, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.887] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.887] WriteFile (in: hFile=0x198, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.889] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0051.889] WriteFile (in: hFile=0x198, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0051.891] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0051.891] CloseHandle (hObject=0x198) returned 1 [0054.186] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.187] lstrlenW (lpString=".doc") returned 4 [0054.187] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.187] lstrlenW (lpString=".docx") returned 5 [0054.187] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.187] lstrlenW (lpString=".pdf") returned 4 [0054.187] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.187] lstrlenW (lpString=".xls") returned 4 [0054.187] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.187] lstrlenW (lpString=".xlsx") returned 5 [0054.187] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.187] lstrlenW (lpString=".ppt") returned 4 [0054.187] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.187] lstrlenW (lpString=".zip") returned 4 [0054.187] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.187] lstrlenW (lpString=".rar") returned 4 [0054.187] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.187] lstrlenW (lpString=".bz2") returned 4 [0054.187] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.187] lstrlenW (lpString=".7z") returned 3 [0054.187] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.187] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.188] lstrlenW (lpString=".dbf") returned 4 [0054.188] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.188] lstrlenW (lpString=".1cd") returned 4 [0054.188] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.188] lstrlenW (lpString=".jpg") returned 4 [0054.188] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.188] lstrlenW (lpString=".doc") returned 4 [0054.188] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.188] lstrlenW (lpString=".docx") returned 5 [0054.188] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0054.188] lstrlenW (lpString=".pdf") returned 4 [0054.188] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.188] lstrlenW (lpString=".xls") returned 4 [0054.188] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.188] lstrlenW (lpString=".xlsx") returned 5 [0054.188] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0054.188] lstrlenW (lpString=".ppt") returned 4 [0054.188] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.188] lstrlenW (lpString=".zip") returned 4 [0054.188] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.188] lstrlenW (lpString=".rar") returned 4 [0054.188] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.188] lstrlenW (lpString=".bz2") returned 4 [0054.188] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.188] lstrlenW (lpString=".7z") returned 3 [0054.188] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.188] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.188] lstrlenW (lpString=".dbf") returned 4 [0054.189] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.189] lstrlenW (lpString=".1cd") returned 4 [0054.189] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.189] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0054.189] lstrlenW (lpString=".jpg") returned 4 [0054.189] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.189] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0054.189] lstrlenW (lpString="Proof.cab") returned 9 [0054.189] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.189] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=21064532) returned 1 [0054.189] CloseHandle (hObject=0x200) returned 1 [0054.189] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0054.189] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.190] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0054.316] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0054.316] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1 [0054.316] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.316] ReadFile (in: hFile=0x200, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.319] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.319] ReadFile (in: hFile=0x200, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.321] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0054.322] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0054.322] ReadFile (in: hFile=0x200, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0054.340] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.340] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0054.353] SetEndOfFile (hFile=0x200) returned 1 [0054.353] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f854b0 [0054.353] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.353] WriteFile (in: hFile=0x200, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.354] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.354] WriteFile (in: hFile=0x200, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.355] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0054.355] WriteFile (in: hFile=0x200, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0054.357] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b0 | out: hHeap=0x8d0000) returned 1 [0054.357] CloseHandle (hObject=0x200) returned 1 [0056.457] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0056.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.458] lstrlenW (lpString=".doc") returned 4 [0056.458] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.458] lstrlenW (lpString=".docx") returned 5 [0056.458] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0056.458] lstrlenW (lpString=".pdf") returned 4 [0056.458] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.458] lstrlenW (lpString=".xls") returned 4 [0056.458] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.458] lstrlenW (lpString=".xlsx") returned 5 [0056.458] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0056.458] lstrlenW (lpString=".ppt") returned 4 [0056.458] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.458] lstrlenW (lpString=".zip") returned 4 [0056.458] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.458] lstrlenW (lpString=".rar") returned 4 [0056.458] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.458] lstrlenW (lpString=".bz2") returned 4 [0056.458] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.458] lstrlenW (lpString=".7z") returned 3 [0056.458] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.458] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.458] lstrlenW (lpString=".dbf") returned 4 [0056.458] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.459] lstrlenW (lpString=".1cd") returned 4 [0056.459] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.459] lstrlenW (lpString=".jpg") returned 4 [0056.459] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.459] lstrlenW (lpString=".doc") returned 4 [0056.459] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0056.459] lstrlenW (lpString=".docx") returned 5 [0056.459] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0056.459] lstrlenW (lpString=".pdf") returned 4 [0056.459] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0056.459] lstrlenW (lpString=".xls") returned 4 [0056.459] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0056.459] lstrlenW (lpString=".xlsx") returned 5 [0056.459] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0056.459] lstrlenW (lpString=".ppt") returned 4 [0056.459] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0056.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.459] lstrlenW (lpString=".zip") returned 4 [0056.459] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0056.459] lstrlenW (lpString=".rar") returned 4 [0056.459] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0056.459] lstrlenW (lpString=".bz2") returned 4 [0056.459] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0056.459] lstrlenW (lpString=".7z") returned 3 [0056.459] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0056.459] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.459] lstrlenW (lpString=".dbf") returned 4 [0056.459] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0056.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.460] lstrlenW (lpString=".1cd") returned 4 [0056.460] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0056.460] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0056.460] lstrlenW (lpString=".jpg") returned 4 [0056.460] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0056.460] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0056.460] lstrlenW (lpString="VisioMUI.msi") returned 12 [0056.460] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.460] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2797568) returned 1 [0056.460] CloseHandle (hObject=0x200) returned 1 [0056.460] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0056.460] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.461] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0056.461] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0056.461] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1 [0056.461] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.461] ReadFile (in: hFile=0x200, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.537] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.537] ReadFile (in: hFile=0x200, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.607] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.607] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0056.607] ReadFile (in: hFile=0x200, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.622] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.622] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0056.907] SetEndOfFile (hFile=0x200) returned 1 [0056.907] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x401b510 [0056.911] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.912] WriteFile (in: hFile=0x200, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.913] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.913] WriteFile (in: hFile=0x200, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.918] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0056.918] WriteFile (in: hFile=0x200, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.920] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401b510 | out: hHeap=0x8d0000) returned 1 [0056.920] CloseHandle (hObject=0x200) returned 1 [0056.921] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0056.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.921] lstrlenW (lpString=".doc") returned 4 [0056.921] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.921] lstrlenW (lpString=".docx") returned 5 [0056.921] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0056.921] lstrlenW (lpString=".pdf") returned 4 [0056.921] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.921] lstrlenW (lpString=".xls") returned 4 [0056.921] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.921] lstrlenW (lpString=".xlsx") returned 5 [0056.921] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0056.921] lstrlenW (lpString=".ppt") returned 4 [0056.921] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.921] lstrlenW (lpString=".zip") returned 4 [0056.921] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.921] lstrlenW (lpString=".rar") returned 4 [0056.921] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.922] lstrlenW (lpString=".bz2") returned 4 [0056.922] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.922] lstrlenW (lpString=".7z") returned 3 [0056.922] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.922] lstrlenW (lpString=".dbf") returned 4 [0056.922] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.922] lstrlenW (lpString=".1cd") returned 4 [0056.922] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.922] lstrlenW (lpString=".jpg") returned 4 [0056.922] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.922] lstrlenW (lpString=".doc") returned 4 [0056.922] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.922] lstrlenW (lpString=".docx") returned 5 [0056.922] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0056.922] lstrlenW (lpString=".pdf") returned 4 [0056.922] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.922] lstrlenW (lpString=".xls") returned 4 [0056.922] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.922] lstrlenW (lpString=".xlsx") returned 5 [0056.922] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0056.922] lstrlenW (lpString=".ppt") returned 4 [0056.922] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.922] lstrlenW (lpString=".zip") returned 4 [0056.922] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.922] lstrlenW (lpString=".rar") returned 4 [0056.922] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.923] lstrlenW (lpString=".bz2") returned 4 [0056.923] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.923] lstrlenW (lpString=".7z") returned 3 [0056.923] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.923] lstrlenW (lpString=".dbf") returned 4 [0056.923] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.923] lstrlenW (lpString=".1cd") returned 4 [0056.923] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.923] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0056.923] lstrlenW (lpString=".jpg") returned 4 [0056.923] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.923] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0056.923] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0056.923] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0057.531] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=2511872) returned 1 [0057.531] CloseHandle (hObject=0x198) returned 1 [0057.531] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0057.531] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.532] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0057.535] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0057.535] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1 [0057.535] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.535] ReadFile (in: hFile=0x198, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.539] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.539] ReadFile (in: hFile=0x198, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.548] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.548] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0057.548] ReadFile (in: hFile=0x198, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.564] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.564] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0057.759] SetEndOfFile (hFile=0x198) returned 1 [0057.759] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x400b508 [0057.759] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.759] WriteFile (in: hFile=0x198, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.761] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.761] WriteFile (in: hFile=0x198, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.767] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0057.767] WriteFile (in: hFile=0x198, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0057.770] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0057.770] CloseHandle (hObject=0x198) returned 1 [0057.770] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0057.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.770] lstrlenW (lpString=".doc") returned 4 [0057.770] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0057.770] lstrlenW (lpString=".docx") returned 5 [0057.770] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0057.770] lstrlenW (lpString=".pdf") returned 4 [0057.770] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0057.770] lstrlenW (lpString=".xls") returned 4 [0057.770] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0057.770] lstrlenW (lpString=".xlsx") returned 5 [0057.770] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0057.770] lstrlenW (lpString=".ppt") returned 4 [0057.770] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0057.770] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.771] lstrlenW (lpString=".zip") returned 4 [0057.771] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0057.771] lstrlenW (lpString=".rar") returned 4 [0057.771] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0057.771] lstrlenW (lpString=".bz2") returned 4 [0057.771] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0057.771] lstrlenW (lpString=".7z") returned 3 [0057.771] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0057.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.771] lstrlenW (lpString=".dbf") returned 4 [0057.771] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0057.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.771] lstrlenW (lpString=".1cd") returned 4 [0057.771] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0057.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.771] lstrlenW (lpString=".jpg") returned 4 [0057.771] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0057.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.771] lstrlenW (lpString=".doc") returned 4 [0057.771] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0057.771] lstrlenW (lpString=".docx") returned 5 [0057.771] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0057.771] lstrlenW (lpString=".pdf") returned 4 [0057.771] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0057.771] lstrlenW (lpString=".xls") returned 4 [0057.771] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0057.771] lstrlenW (lpString=".xlsx") returned 5 [0057.771] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0057.771] lstrlenW (lpString=".ppt") returned 4 [0057.771] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0057.771] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.771] lstrlenW (lpString=".zip") returned 4 [0057.772] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0057.772] lstrlenW (lpString=".rar") returned 4 [0057.772] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0057.772] lstrlenW (lpString=".bz2") returned 4 [0057.772] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0057.772] lstrlenW (lpString=".7z") returned 3 [0057.772] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0057.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.772] lstrlenW (lpString=".dbf") returned 4 [0057.772] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0057.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.772] lstrlenW (lpString=".1cd") returned 4 [0057.772] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0057.772] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0057.772] lstrlenW (lpString=".jpg") returned 4 [0057.772] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0057.772] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0057.772] lstrlenW (lpString="dwdcw20.dll") returned 11 [0057.772] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0057.776] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=526176) returned 1 [0057.776] CloseHandle (hObject=0x198) returned 1 [0057.777] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0057.777] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0057.777] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.777] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.777] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0057.777] GetLastError () returned 0x0 [0057.777] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x80760, lpOverlapped=0x0) returned 1 [0057.791] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0057.802] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.802] WriteFile (in: hFile=0x1f0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0057.802] SetEndOfFile (hFile=0x1f0) returned 1 [0057.803] CloseHandle (hObject=0x1f0) returned 1 [0057.803] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.803] SetEndOfFile (hFile=0x198) returned 1 [0058.367] CloseHandle (hObject=0x198) returned 1 [0058.367] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.368] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0058.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.368] lstrlenW (lpString=".doc") returned 4 [0058.368] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.368] lstrlenW (lpString=".docx") returned 5 [0058.368] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0058.368] lstrlenW (lpString=".pdf") returned 4 [0058.368] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.368] lstrlenW (lpString=".xls") returned 4 [0058.368] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.368] lstrlenW (lpString=".xlsx") returned 5 [0058.368] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0058.368] lstrlenW (lpString=".ppt") returned 4 [0058.368] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.368] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.368] lstrlenW (lpString=".zip") returned 4 [0058.368] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.368] lstrlenW (lpString=".rar") returned 4 [0058.368] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.368] lstrlenW (lpString=".bz2") returned 4 [0058.369] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.369] lstrlenW (lpString=".7z") returned 3 [0058.369] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.369] lstrlenW (lpString=".dbf") returned 4 [0058.369] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.369] lstrlenW (lpString=".1cd") returned 4 [0058.369] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.369] lstrlenW (lpString=".jpg") returned 4 [0058.369] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.369] lstrlenW (lpString=".doc") returned 4 [0058.369] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.369] lstrlenW (lpString=".docx") returned 5 [0058.369] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0058.369] lstrlenW (lpString=".pdf") returned 4 [0058.369] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.369] lstrlenW (lpString=".xls") returned 4 [0058.369] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.369] lstrlenW (lpString=".xlsx") returned 5 [0058.369] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0058.369] lstrlenW (lpString=".ppt") returned 4 [0058.369] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.369] lstrlenW (lpString=".zip") returned 4 [0058.369] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.369] lstrlenW (lpString=".rar") returned 4 [0058.369] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.369] lstrlenW (lpString=".bz2") returned 4 [0058.369] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.370] lstrlenW (lpString=".7z") returned 3 [0058.370] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.370] lstrlenW (lpString=".dbf") returned 4 [0058.370] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.370] lstrlenW (lpString=".1cd") returned 4 [0058.370] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0058.370] lstrlenW (lpString=".jpg") returned 4 [0058.370] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.370] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0058.370] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0058.370] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0058.370] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=3702272) returned 1 [0058.370] CloseHandle (hObject=0x198) returned 1 [0058.370] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0058.371] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.371] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0058.371] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0058.371] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1 [0058.371] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.371] ReadFile (in: hFile=0x198, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.376] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.376] ReadFile (in: hFile=0x198, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.383] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.383] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0058.383] ReadFile (in: hFile=0x198, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.398] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.398] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0058.774] SetEndOfFile (hFile=0x198) returned 1 [0058.774] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x400b508 [0058.774] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.774] WriteFile (in: hFile=0x198, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.776] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.776] WriteFile (in: hFile=0x198, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.780] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0058.780] WriteFile (in: hFile=0x198, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.782] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0058.782] CloseHandle (hObject=0x198) returned 1 [0058.782] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.782] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.782] lstrlenW (lpString=".doc") returned 4 [0058.782] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.782] lstrlenW (lpString=".docx") returned 5 [0058.782] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0058.782] lstrlenW (lpString=".pdf") returned 4 [0058.782] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.782] lstrlenW (lpString=".xls") returned 4 [0058.782] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.783] lstrlenW (lpString=".xlsx") returned 5 [0058.783] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0058.783] lstrlenW (lpString=".ppt") returned 4 [0058.783] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.783] lstrlenW (lpString=".zip") returned 4 [0058.783] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.783] lstrlenW (lpString=".rar") returned 4 [0058.783] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.783] lstrlenW (lpString=".bz2") returned 4 [0058.783] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.783] lstrlenW (lpString=".7z") returned 3 [0058.783] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.783] lstrlenW (lpString=".dbf") returned 4 [0058.783] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.783] lstrlenW (lpString=".1cd") returned 4 [0058.783] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.783] lstrlenW (lpString=".jpg") returned 4 [0058.783] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.783] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.783] lstrlenW (lpString=".doc") returned 4 [0058.783] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0058.783] lstrlenW (lpString=".docx") returned 5 [0058.783] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0058.783] lstrlenW (lpString=".pdf") returned 4 [0058.783] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0058.783] lstrlenW (lpString=".xls") returned 4 [0058.783] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0058.783] lstrlenW (lpString=".xlsx") returned 5 [0058.784] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0058.784] lstrlenW (lpString=".ppt") returned 4 [0058.784] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0058.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.784] lstrlenW (lpString=".zip") returned 4 [0058.784] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0058.784] lstrlenW (lpString=".rar") returned 4 [0058.784] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0058.784] lstrlenW (lpString=".bz2") returned 4 [0058.784] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0058.784] lstrlenW (lpString=".7z") returned 3 [0058.784] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0058.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.784] lstrlenW (lpString=".dbf") returned 4 [0058.784] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0058.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.784] lstrlenW (lpString=".1cd") returned 4 [0058.784] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0058.784] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0058.784] lstrlenW (lpString=".jpg") returned 4 [0058.784] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0058.784] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0058.784] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0058.784] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0058.785] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=868864) returned 1 [0058.785] CloseHandle (hObject=0x198) returned 1 [0058.785] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0058.785] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.785] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0058.785] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.785] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.785] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0058.785] GetLastError () returned 0x0 [0058.785] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0058.851] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0059.157] ReadFile (in: hFile=0x198, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.157] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0059.157] SetEndOfFile (hFile=0x214) returned 1 [0059.157] CloseHandle (hObject=0x214) returned 1 [0059.157] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.157] SetEndOfFile (hFile=0x198) returned 1 [0059.165] CloseHandle (hObject=0x198) returned 1 [0059.165] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0059.165] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0059.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.165] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.166] lstrlenW (lpString=".doc") returned 4 [0059.166] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.166] lstrlenW (lpString=".docx") returned 5 [0059.166] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0059.166] lstrlenW (lpString=".pdf") returned 4 [0059.166] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.166] lstrlenW (lpString=".xls") returned 4 [0059.166] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.166] lstrlenW (lpString=".xlsx") returned 5 [0059.166] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0059.166] lstrlenW (lpString=".ppt") returned 4 [0059.166] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.166] lstrlenW (lpString=".zip") returned 4 [0059.166] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.166] lstrlenW (lpString=".rar") returned 4 [0059.166] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.166] lstrlenW (lpString=".bz2") returned 4 [0059.166] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.166] lstrlenW (lpString=".7z") returned 3 [0059.166] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.166] lstrlenW (lpString=".dbf") returned 4 [0059.166] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.166] lstrlenW (lpString=".1cd") returned 4 [0059.166] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.166] lstrlenW (lpString=".jpg") returned 4 [0059.166] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.166] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.167] lstrlenW (lpString=".doc") returned 4 [0059.167] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.167] lstrlenW (lpString=".docx") returned 5 [0059.167] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0059.167] lstrlenW (lpString=".pdf") returned 4 [0059.167] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.167] lstrlenW (lpString=".xls") returned 4 [0059.167] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.167] lstrlenW (lpString=".xlsx") returned 5 [0059.167] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0059.167] lstrlenW (lpString=".ppt") returned 4 [0059.167] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.167] lstrlenW (lpString=".zip") returned 4 [0059.167] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.167] lstrlenW (lpString=".rar") returned 4 [0059.167] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.167] lstrlenW (lpString=".bz2") returned 4 [0059.167] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.167] lstrlenW (lpString=".7z") returned 3 [0059.167] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.167] lstrlenW (lpString=".dbf") returned 4 [0059.167] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.167] lstrlenW (lpString=".1cd") returned 4 [0059.167] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.167] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0059.167] lstrlenW (lpString=".jpg") returned 4 [0059.167] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.168] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0059.168] lstrlenW (lpString="osetup.dll") returned 10 [0059.168] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.168] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=7378792) returned 1 [0059.168] CloseHandle (hObject=0x198) returned 1 [0059.168] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0059.168] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.168] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0059.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.169] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1 [0059.169] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.169] ReadFile (in: hFile=0x198, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.286] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.286] ReadFile (in: hFile=0x198, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.290] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.290] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.290] ReadFile (in: hFile=0x198, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.314] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.314] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0059.642] SetEndOfFile (hFile=0x198) returned 1 [0059.642] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f754b0 [0059.647] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.647] WriteFile (in: hFile=0x198, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.648] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.648] WriteFile (in: hFile=0x198, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.650] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0059.650] WriteFile (in: hFile=0x198, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.652] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f754b0 | out: hHeap=0x8d0000) returned 1 [0059.652] CloseHandle (hObject=0x198) returned 1 [0059.652] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0059.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.652] lstrlenW (lpString=".doc") returned 4 [0059.652] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.652] lstrlenW (lpString=".docx") returned 5 [0059.652] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0059.652] lstrlenW (lpString=".pdf") returned 4 [0059.652] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.652] lstrlenW (lpString=".xls") returned 4 [0059.652] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.652] lstrlenW (lpString=".xlsx") returned 5 [0059.652] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0059.653] lstrlenW (lpString=".ppt") returned 4 [0059.653] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.653] lstrlenW (lpString=".zip") returned 4 [0059.653] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.653] lstrlenW (lpString=".rar") returned 4 [0059.653] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.653] lstrlenW (lpString=".bz2") returned 4 [0059.653] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.653] lstrlenW (lpString=".7z") returned 3 [0059.653] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.653] lstrlenW (lpString=".dbf") returned 4 [0059.653] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.653] lstrlenW (lpString=".1cd") returned 4 [0059.653] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.653] lstrlenW (lpString=".jpg") returned 4 [0059.653] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.653] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.653] lstrlenW (lpString=".doc") returned 4 [0059.653] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0059.653] lstrlenW (lpString=".docx") returned 5 [0059.653] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0059.653] lstrlenW (lpString=".pdf") returned 4 [0059.653] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0059.653] lstrlenW (lpString=".xls") returned 4 [0059.653] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0059.653] lstrlenW (lpString=".xlsx") returned 5 [0059.654] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0059.654] lstrlenW (lpString=".ppt") returned 4 [0059.654] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0059.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.654] lstrlenW (lpString=".zip") returned 4 [0059.654] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0059.654] lstrlenW (lpString=".rar") returned 4 [0059.654] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0059.654] lstrlenW (lpString=".bz2") returned 4 [0059.654] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0059.654] lstrlenW (lpString=".7z") returned 3 [0059.654] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0059.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.654] lstrlenW (lpString=".dbf") returned 4 [0059.654] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0059.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.654] lstrlenW (lpString=".1cd") returned 4 [0059.654] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0059.654] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0059.654] lstrlenW (lpString=".jpg") returned 4 [0059.654] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0059.654] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0059.654] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0059.654] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.655] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=27532288) returned 1 [0059.655] CloseHandle (hObject=0x198) returned 1 [0059.655] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0059.655] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.655] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0059.656] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0059.656] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1 [0059.656] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.656] ReadFile (in: hFile=0x198, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.660] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.660] ReadFile (in: hFile=0x198, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.667] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0059.667] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0059.667] ReadFile (in: hFile=0x198, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.871] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.871] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0059.887] SetEndOfFile (hFile=0x198) returned 1 [0060.181] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f554a0 [0060.333] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.333] WriteFile (in: hFile=0x198, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.334] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.334] WriteFile (in: hFile=0x198, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.337] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0060.337] WriteFile (in: hFile=0x198, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.339] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0060.339] CloseHandle (hObject=0x198) returned 1 [0060.361] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0060.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.361] lstrlenW (lpString=".doc") returned 4 [0060.361] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.361] lstrlenW (lpString=".docx") returned 5 [0060.362] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0060.362] lstrlenW (lpString=".pdf") returned 4 [0060.362] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.362] lstrlenW (lpString=".xls") returned 4 [0060.362] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.362] lstrlenW (lpString=".xlsx") returned 5 [0060.362] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0060.362] lstrlenW (lpString=".ppt") returned 4 [0060.362] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.362] lstrlenW (lpString=".zip") returned 4 [0060.362] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.362] lstrlenW (lpString=".rar") returned 4 [0060.362] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.362] lstrlenW (lpString=".bz2") returned 4 [0060.362] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.362] lstrlenW (lpString=".7z") returned 3 [0060.362] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.362] lstrlenW (lpString=".dbf") returned 4 [0060.362] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.362] lstrlenW (lpString=".1cd") returned 4 [0060.362] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.362] lstrlenW (lpString=".jpg") returned 4 [0060.362] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.362] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.362] lstrlenW (lpString=".doc") returned 4 [0060.362] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0060.363] lstrlenW (lpString=".docx") returned 5 [0060.363] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0060.363] lstrlenW (lpString=".pdf") returned 4 [0060.363] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0060.363] lstrlenW (lpString=".xls") returned 4 [0060.363] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0060.363] lstrlenW (lpString=".xlsx") returned 5 [0060.363] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0060.363] lstrlenW (lpString=".ppt") returned 4 [0060.363] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0060.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.363] lstrlenW (lpString=".zip") returned 4 [0060.363] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0060.363] lstrlenW (lpString=".rar") returned 4 [0060.363] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0060.363] lstrlenW (lpString=".bz2") returned 4 [0060.363] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0060.363] lstrlenW (lpString=".7z") returned 3 [0060.363] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0060.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.363] lstrlenW (lpString=".dbf") returned 4 [0060.363] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0060.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.363] lstrlenW (lpString=".1cd") returned 4 [0060.363] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0060.363] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0060.363] lstrlenW (lpString=".jpg") returned 4 [0060.363] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0060.363] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0060.364] lstrlenW (lpString="setup.exe") returned 9 [0060.364] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0060.364] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1377656) returned 1 [0060.364] CloseHandle (hObject=0x170) returned 1 [0060.364] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0060.364] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.364] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0060.364] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.364] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.365] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0060.365] GetLastError () returned 0x0 [0060.365] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0060.388] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0060.561] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x50588, lpOverlapped=0x0) returned 1 [0060.573] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0060.682] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.682] WriteFile (in: hFile=0x198, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0060.683] SetEndOfFile (hFile=0x198) returned 1 [0061.156] CloseHandle (hObject=0x198) returned 1 [0061.156] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.156] SetEndOfFile (hFile=0x170) returned 1 [0061.161] CloseHandle (hObject=0x170) returned 1 [0061.161] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0061.161] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0061.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.161] lstrlenW (lpString=".doc") returned 4 [0061.161] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0061.161] lstrlenW (lpString=".docx") returned 5 [0061.161] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0061.161] lstrlenW (lpString=".pdf") returned 4 [0061.161] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0061.161] lstrlenW (lpString=".xls") returned 4 [0061.161] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0061.161] lstrlenW (lpString=".xlsx") returned 5 [0061.161] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0061.162] lstrlenW (lpString=".ppt") returned 4 [0061.162] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0061.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.162] lstrlenW (lpString=".zip") returned 4 [0061.162] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0061.162] lstrlenW (lpString=".rar") returned 4 [0061.162] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0061.162] lstrlenW (lpString=".bz2") returned 4 [0061.162] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0061.162] lstrlenW (lpString=".7z") returned 3 [0061.162] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.162] lstrlenW (lpString=".dbf") returned 4 [0061.162] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0061.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.162] lstrlenW (lpString=".1cd") returned 4 [0061.162] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0061.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.162] lstrlenW (lpString=".jpg") returned 4 [0061.162] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0061.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.162] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.162] lstrlenW (lpString=".doc") returned 4 [0061.162] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0061.162] lstrlenW (lpString=".docx") returned 5 [0061.162] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0061.162] lstrlenW (lpString=".pdf") returned 4 [0061.162] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0061.162] lstrlenW (lpString=".xls") returned 4 [0061.162] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0061.163] lstrlenW (lpString=".xlsx") returned 5 [0061.163] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0061.163] lstrlenW (lpString=".ppt") returned 4 [0061.163] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0061.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.163] lstrlenW (lpString=".zip") returned 4 [0061.163] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0061.163] lstrlenW (lpString=".rar") returned 4 [0061.163] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0061.163] lstrlenW (lpString=".bz2") returned 4 [0061.163] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0061.163] lstrlenW (lpString=".7z") returned 3 [0061.163] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0061.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.163] lstrlenW (lpString=".dbf") returned 4 [0061.163] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0061.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.163] lstrlenW (lpString=".1cd") returned 4 [0061.163] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0061.163] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0061.163] lstrlenW (lpString=".jpg") returned 4 [0061.163] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0061.163] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0061.163] lstrlenW (lpString="PidGenX.dll") returned 11 [0061.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0061.206] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=1463568) returned 1 [0061.206] CloseHandle (hObject=0x1e4) returned 1 [0061.206] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0061.206] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0061.457] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.457] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.457] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0062.494] GetLastError () returned 0x0 [0062.494] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0063.248] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0063.496] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x65520, lpOverlapped=0x0) returned 1 [0063.786] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0063.797] ReadFile (in: hFile=0x1f0, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0063.798] WriteFile (in: hFile=0x1d8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0063.798] SetEndOfFile (hFile=0x1d8) returned 1 [0063.798] CloseHandle (hObject=0x1d8) returned 1 [0063.798] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0063.798] SetEndOfFile (hFile=0x1f0) returned 1 [0063.802] CloseHandle (hObject=0x1f0) returned 1 [0063.802] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0063.802] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0063.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.803] lstrlenW (lpString=".doc") returned 4 [0063.803] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.803] lstrlenW (lpString=".docx") returned 5 [0063.803] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0063.803] lstrlenW (lpString=".pdf") returned 4 [0063.803] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.803] lstrlenW (lpString=".xls") returned 4 [0063.803] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.803] lstrlenW (lpString=".xlsx") returned 5 [0063.803] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0063.803] lstrlenW (lpString=".ppt") returned 4 [0063.803] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.803] lstrlenW (lpString=".zip") returned 4 [0063.803] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.803] lstrlenW (lpString=".rar") returned 4 [0063.803] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.803] lstrlenW (lpString=".bz2") returned 4 [0063.803] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.803] lstrlenW (lpString=".7z") returned 3 [0063.803] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.803] lstrlenW (lpString=".dbf") returned 4 [0063.803] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.803] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.803] lstrlenW (lpString=".1cd") returned 4 [0063.803] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.804] lstrlenW (lpString=".jpg") returned 4 [0063.804] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.804] lstrlenW (lpString=".doc") returned 4 [0063.804] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0063.804] lstrlenW (lpString=".docx") returned 5 [0063.804] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0063.804] lstrlenW (lpString=".pdf") returned 4 [0063.804] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0063.804] lstrlenW (lpString=".xls") returned 4 [0063.804] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0063.804] lstrlenW (lpString=".xlsx") returned 5 [0063.804] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0063.804] lstrlenW (lpString=".ppt") returned 4 [0063.804] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0063.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.804] lstrlenW (lpString=".zip") returned 4 [0063.804] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0063.804] lstrlenW (lpString=".rar") returned 4 [0063.804] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0063.804] lstrlenW (lpString=".bz2") returned 4 [0063.804] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0063.804] lstrlenW (lpString=".7z") returned 3 [0063.804] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0063.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.804] lstrlenW (lpString=".dbf") returned 4 [0063.804] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0063.804] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.804] lstrlenW (lpString=".1cd") returned 4 [0063.804] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0063.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0063.805] lstrlenW (lpString=".jpg") returned 4 [0063.805] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0063.805] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0063.805] lstrlenW (lpString="osetup.dll") returned 10 [0063.805] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0064.077] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=7378792) returned 1 [0064.077] CloseHandle (hObject=0x170) returned 1 [0064.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0064.077] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.077] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0064.078] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0064.078] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0x0) returned 1 [0064.078] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.078] ReadFile (in: hFile=0x170, lpBuffer=0x3a70058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3a70058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.081] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.081] ReadFile (in: hFile=0x170, lpBuffer=0x3ab0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ab0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.085] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x305fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0064.085] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x305fc2c | out: lpNewFilePointer=0x0) returned 1 [0064.085] ReadFile (in: hFile=0x170, lpBuffer=0x3af0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x305fc38, lpOverlapped=0x0 | out: lpBuffer=0x3af0058*, lpNumberOfBytesRead=0x305fc38*=0x40000, lpOverlapped=0x0) returned 1 [0064.385] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.385] WriteFile (in: hFile=0x170, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x305fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0064.400] SetEndOfFile (hFile=0x170) returned 1 [0064.400] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f554a0 [0064.404] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.404] WriteFile (in: hFile=0x170, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.490] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.490] WriteFile (in: hFile=0x170, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.492] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x305fc7c | out: lpNewFilePointer=0x0) returned 1 [0064.492] WriteFile (in: hFile=0x170, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x305fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x305fc88*=0x40000, lpOverlapped=0x0) returned 1 [0064.493] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0064.493] CloseHandle (hObject=0x170) returned 1 [0064.578] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0064.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.685] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.685] lstrlenW (lpString=".doc") returned 4 [0064.685] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.686] lstrlenW (lpString=".docx") returned 5 [0064.686] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0064.686] lstrlenW (lpString=".pdf") returned 4 [0064.686] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.686] lstrlenW (lpString=".xls") returned 4 [0064.686] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.686] lstrlenW (lpString=".xlsx") returned 5 [0064.686] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0064.686] lstrlenW (lpString=".ppt") returned 4 [0064.686] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.686] lstrlenW (lpString=".zip") returned 4 [0064.686] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.686] lstrlenW (lpString=".rar") returned 4 [0064.686] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.686] lstrlenW (lpString=".bz2") returned 4 [0064.686] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.686] lstrlenW (lpString=".7z") returned 3 [0064.686] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.686] lstrlenW (lpString=".dbf") returned 4 [0064.686] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.686] lstrlenW (lpString=".1cd") returned 4 [0064.686] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.686] lstrlenW (lpString=".jpg") returned 4 [0064.686] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.686] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.687] lstrlenW (lpString=".doc") returned 4 [0064.687] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.687] lstrlenW (lpString=".docx") returned 5 [0064.687] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0064.687] lstrlenW (lpString=".pdf") returned 4 [0064.687] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.687] lstrlenW (lpString=".xls") returned 4 [0064.687] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.687] lstrlenW (lpString=".xlsx") returned 5 [0064.687] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0064.687] lstrlenW (lpString=".ppt") returned 4 [0064.687] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.687] lstrlenW (lpString=".zip") returned 4 [0064.687] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.687] lstrlenW (lpString=".rar") returned 4 [0064.687] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.687] lstrlenW (lpString=".bz2") returned 4 [0064.687] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.687] lstrlenW (lpString=".7z") returned 3 [0064.687] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.687] lstrlenW (lpString=".dbf") returned 4 [0064.687] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.687] lstrlenW (lpString=".1cd") returned 4 [0064.687] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.687] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0064.687] lstrlenW (lpString=".jpg") returned 4 [0064.687] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.688] lstrcmpiW (lpString1=".sys", lpString2=".wiki") returned -1 [0064.688] lstrlenW (lpString="pagefile.sys") returned 12 [0064.688] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0064.688] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.688] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.688] lstrlenW (lpString=".doc") returned 4 [0064.688] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0064.688] lstrlenW (lpString=".docx") returned 5 [0064.688] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0064.688] lstrlenW (lpString=".pdf") returned 4 [0064.688] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0064.688] lstrlenW (lpString=".xls") returned 4 [0064.688] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0064.688] lstrlenW (lpString=".xlsx") returned 5 [0064.688] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0064.688] lstrlenW (lpString=".ppt") returned 4 [0064.688] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0064.688] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.688] lstrlenW (lpString=".zip") returned 4 [0064.688] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0064.688] lstrlenW (lpString=".rar") returned 4 [0064.688] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0064.689] lstrlenW (lpString=".bz2") returned 4 [0064.689] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0064.689] lstrlenW (lpString=".7z") returned 3 [0064.689] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0064.689] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.689] lstrlenW (lpString=".dbf") returned 4 [0064.689] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0064.689] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.689] lstrlenW (lpString=".1cd") returned 4 [0064.689] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0064.689] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.689] lstrlenW (lpString=".jpg") returned 4 [0064.689] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0064.689] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.689] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.689] lstrlenW (lpString=".doc") returned 4 [0064.689] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0064.689] lstrlenW (lpString=".docx") returned 5 [0064.689] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0064.689] lstrlenW (lpString=".pdf") returned 4 [0064.689] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0064.689] lstrlenW (lpString=".xls") returned 4 [0064.689] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0064.689] lstrlenW (lpString=".xlsx") returned 5 [0064.689] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0064.689] lstrlenW (lpString=".ppt") returned 4 [0064.689] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0064.689] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.689] lstrlenW (lpString=".zip") returned 4 [0064.689] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0064.689] lstrlenW (lpString=".rar") returned 4 [0064.690] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0064.690] lstrlenW (lpString=".bz2") returned 4 [0064.690] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0064.690] lstrlenW (lpString=".7z") returned 3 [0064.690] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0064.690] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.690] lstrlenW (lpString=".dbf") returned 4 [0064.690] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0064.690] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.690] lstrlenW (lpString=".1cd") returned 4 [0064.690] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0064.690] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0064.690] lstrlenW (lpString=".jpg") returned 4 [0064.690] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0064.690] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0064.690] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0064.690] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0064.928] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=99136) returned 1 [0064.928] CloseHandle (hObject=0x1d8) returned 1 [0064.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0064.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0064.929] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.929] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0064.930] GetLastError () returned 0x0 [0064.930] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x18340, lpOverlapped=0x0) returned 1 [0064.932] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x18350, lpOverlapped=0x0) returned 1 [0064.935] ReadFile (in: hFile=0x1d8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0064.935] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0064.935] SetEndOfFile (hFile=0x21c) returned 1 [0064.935] CloseHandle (hObject=0x21c) returned 1 [0064.935] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0064.935] SetEndOfFile (hFile=0x1d8) returned 1 [0064.937] CloseHandle (hObject=0x1d8) returned 1 [0064.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0064.937] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0064.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.937] lstrlenW (lpString=".doc") returned 4 [0064.937] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0064.937] lstrlenW (lpString=".docx") returned 5 [0064.937] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0064.937] lstrlenW (lpString=".pdf") returned 4 [0064.937] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0064.937] lstrlenW (lpString=".xls") returned 4 [0064.938] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0064.938] lstrlenW (lpString=".xlsx") returned 5 [0064.938] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0064.938] lstrlenW (lpString=".ppt") returned 4 [0064.938] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0064.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.938] lstrlenW (lpString=".zip") returned 4 [0064.938] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0064.938] lstrlenW (lpString=".rar") returned 4 [0064.938] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0064.938] lstrlenW (lpString=".bz2") returned 4 [0064.938] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0064.938] lstrlenW (lpString=".7z") returned 3 [0064.938] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0064.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.938] lstrlenW (lpString=".dbf") returned 4 [0064.938] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0064.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.938] lstrlenW (lpString=".1cd") returned 4 [0064.938] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0064.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.938] lstrlenW (lpString=".jpg") returned 4 [0064.938] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0064.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.938] lstrlenW (lpString=".doc") returned 4 [0064.938] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0064.938] lstrlenW (lpString=".docx") returned 5 [0064.938] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0064.938] lstrlenW (lpString=".pdf") returned 4 [0064.939] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0064.939] lstrlenW (lpString=".xls") returned 4 [0064.939] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0064.939] lstrlenW (lpString=".xlsx") returned 5 [0064.939] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0064.939] lstrlenW (lpString=".ppt") returned 4 [0064.939] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0064.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.939] lstrlenW (lpString=".zip") returned 4 [0064.939] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0064.939] lstrlenW (lpString=".rar") returned 4 [0064.939] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0064.939] lstrlenW (lpString=".bz2") returned 4 [0064.939] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0064.939] lstrlenW (lpString=".7z") returned 3 [0064.939] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0064.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.939] lstrlenW (lpString=".dbf") returned 4 [0064.939] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0064.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.939] lstrlenW (lpString=".1cd") returned 4 [0064.939] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0064.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0064.939] lstrlenW (lpString=".jpg") returned 4 [0064.939] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0064.939] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0064.940] lstrlenW (lpString="DW20.EXE") returned 8 [0064.940] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0065.345] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=994184) returned 1 [0065.345] CloseHandle (hObject=0x170) returned 1 [0065.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0065.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0065.345] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.345] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.345] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0066.618] GetLastError () returned 0x0 [0066.618] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0066.638] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0067.282] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.282] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0067.282] SetEndOfFile (hFile=0x1ec) returned 1 [0067.282] CloseHandle (hObject=0x1ec) returned 1 [0067.282] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.282] SetEndOfFile (hFile=0x170) returned 1 [0067.294] CloseHandle (hObject=0x170) returned 1 [0067.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.294] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0067.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.295] lstrlenW (lpString=".doc") returned 4 [0067.295] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0067.295] lstrlenW (lpString=".docx") returned 5 [0067.295] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0067.295] lstrlenW (lpString=".pdf") returned 4 [0067.295] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0067.295] lstrlenW (lpString=".xls") returned 4 [0067.295] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0067.295] lstrlenW (lpString=".xlsx") returned 5 [0067.295] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0067.295] lstrlenW (lpString=".ppt") returned 4 [0067.295] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0067.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.295] lstrlenW (lpString=".zip") returned 4 [0067.295] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0067.295] lstrlenW (lpString=".rar") returned 4 [0067.295] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0067.295] lstrlenW (lpString=".bz2") returned 4 [0067.295] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0067.295] lstrlenW (lpString=".7z") returned 3 [0067.295] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0067.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.295] lstrlenW (lpString=".dbf") returned 4 [0067.295] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0067.295] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.296] lstrlenW (lpString=".1cd") returned 4 [0067.296] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0067.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.296] lstrlenW (lpString=".jpg") returned 4 [0067.296] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0067.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.296] lstrlenW (lpString=".doc") returned 4 [0067.296] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0067.296] lstrlenW (lpString=".docx") returned 5 [0067.296] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0067.296] lstrlenW (lpString=".pdf") returned 4 [0067.296] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0067.296] lstrlenW (lpString=".xls") returned 4 [0067.296] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0067.296] lstrlenW (lpString=".xlsx") returned 5 [0067.296] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0067.296] lstrlenW (lpString=".ppt") returned 4 [0067.296] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0067.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.296] lstrlenW (lpString=".zip") returned 4 [0067.296] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0067.296] lstrlenW (lpString=".rar") returned 4 [0067.296] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0067.296] lstrlenW (lpString=".bz2") returned 4 [0067.296] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0067.296] lstrlenW (lpString=".7z") returned 3 [0067.296] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0067.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.296] lstrlenW (lpString=".dbf") returned 4 [0067.296] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0067.296] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.297] lstrlenW (lpString=".1cd") returned 4 [0067.297] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0067.297] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0067.297] lstrlenW (lpString=".jpg") returned 4 [0067.297] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0067.297] lstrcmpiW (lpString1=".CFG", lpString2=".wiki") returned -1 [0067.297] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0067.297] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0067.297] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=6811) returned 1 [0067.298] CloseHandle (hObject=0x170) returned 1 [0067.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0067.298] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0067.298] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.298] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.298] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0067.298] GetLastError () returned 0x0 [0067.298] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0067.300] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0067.301] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.301] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.301] SetEndOfFile (hFile=0x1ec) returned 1 [0067.301] CloseHandle (hObject=0x1ec) returned 1 [0067.301] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.301] SetEndOfFile (hFile=0x170) returned 1 [0067.302] CloseHandle (hObject=0x170) returned 1 [0067.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.302] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0067.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.303] lstrlenW (lpString=".doc") returned 4 [0067.303] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0067.303] lstrlenW (lpString=".docx") returned 5 [0067.303] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0067.303] lstrlenW (lpString=".pdf") returned 4 [0067.303] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0067.303] lstrlenW (lpString=".xls") returned 4 [0067.303] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0067.303] lstrlenW (lpString=".xlsx") returned 5 [0067.303] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0067.303] lstrlenW (lpString=".ppt") returned 4 [0067.303] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0067.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.303] lstrlenW (lpString=".zip") returned 4 [0067.303] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0067.303] lstrlenW (lpString=".rar") returned 4 [0067.303] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0067.303] lstrlenW (lpString=".bz2") returned 4 [0067.303] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0067.303] lstrlenW (lpString=".7z") returned 3 [0067.303] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0067.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.303] lstrlenW (lpString=".dbf") returned 4 [0067.303] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0067.303] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.303] lstrlenW (lpString=".1cd") returned 4 [0067.304] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0067.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.304] lstrlenW (lpString=".jpg") returned 4 [0067.304] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0067.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.304] lstrlenW (lpString=".doc") returned 4 [0067.304] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0067.304] lstrlenW (lpString=".docx") returned 5 [0067.304] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0067.304] lstrlenW (lpString=".pdf") returned 4 [0067.304] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0067.304] lstrlenW (lpString=".xls") returned 4 [0067.304] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0067.304] lstrlenW (lpString=".xlsx") returned 5 [0067.304] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0067.304] lstrlenW (lpString=".ppt") returned 4 [0067.304] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0067.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.304] lstrlenW (lpString=".zip") returned 4 [0067.304] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0067.304] lstrlenW (lpString=".rar") returned 4 [0067.304] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0067.304] lstrlenW (lpString=".bz2") returned 4 [0067.304] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0067.304] lstrlenW (lpString=".7z") returned 3 [0067.304] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0067.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.304] lstrlenW (lpString=".dbf") returned 4 [0067.304] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0067.304] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.304] lstrlenW (lpString=".1cd") returned 4 [0067.305] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0067.305] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0067.305] lstrlenW (lpString=".jpg") returned 4 [0067.305] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0067.305] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0067.305] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0067.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0067.306] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=323936) returned 1 [0067.306] CloseHandle (hObject=0x170) returned 1 [0067.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0067.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0067.306] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.306] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0067.307] GetLastError () returned 0x0 [0067.307] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x4f160, lpOverlapped=0x0) returned 1 [0067.313] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0067.319] ReadFile (in: hFile=0x170, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.319] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.319] SetEndOfFile (hFile=0x1ec) returned 1 [0067.319] CloseHandle (hObject=0x1ec) returned 1 [0067.319] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.319] SetEndOfFile (hFile=0x170) returned 1 [0067.437] CloseHandle (hObject=0x170) returned 1 [0067.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.437] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0067.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.438] lstrlenW (lpString=".doc") returned 4 [0067.438] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.438] lstrlenW (lpString=".docx") returned 5 [0067.439] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.439] lstrlenW (lpString=".pdf") returned 4 [0067.439] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.439] lstrlenW (lpString=".xls") returned 4 [0067.439] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.439] lstrlenW (lpString=".xlsx") returned 5 [0067.439] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.439] lstrlenW (lpString=".ppt") returned 4 [0067.439] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.439] lstrlenW (lpString=".zip") returned 4 [0067.439] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.439] lstrlenW (lpString=".rar") returned 4 [0067.439] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.439] lstrlenW (lpString=".bz2") returned 4 [0067.439] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.439] lstrlenW (lpString=".7z") returned 3 [0067.439] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.439] lstrlenW (lpString=".dbf") returned 4 [0067.439] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.439] lstrlenW (lpString=".1cd") returned 4 [0067.439] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.439] lstrlenW (lpString=".jpg") returned 4 [0067.439] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.439] lstrlenW (lpString=".doc") returned 4 [0067.439] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.439] lstrlenW (lpString=".docx") returned 5 [0067.439] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.440] lstrlenW (lpString=".pdf") returned 4 [0067.440] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.440] lstrlenW (lpString=".xls") returned 4 [0067.440] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.440] lstrlenW (lpString=".xlsx") returned 5 [0067.440] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.440] lstrlenW (lpString=".ppt") returned 4 [0067.440] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.440] lstrlenW (lpString=".zip") returned 4 [0067.440] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.440] lstrlenW (lpString=".rar") returned 4 [0067.440] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.440] lstrlenW (lpString=".bz2") returned 4 [0067.440] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.440] lstrlenW (lpString=".7z") returned 3 [0067.440] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.440] lstrlenW (lpString=".dbf") returned 4 [0067.440] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.440] lstrlenW (lpString=".1cd") returned 4 [0067.440] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0067.440] lstrlenW (lpString=".jpg") returned 4 [0067.440] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.440] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0067.440] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0067.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0067.441] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=712592) returned 1 [0067.441] CloseHandle (hObject=0x1dc) returned 1 [0067.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0067.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0067.441] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.441] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.441] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.442] GetLastError () returned 0x0 [0067.442] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xadf90, lpOverlapped=0x0) returned 1 [0067.455] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0067.466] ReadFile (in: hFile=0x1dc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.467] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.467] SetEndOfFile (hFile=0x1f4) returned 1 [0067.467] CloseHandle (hObject=0x1f4) returned 1 [0067.467] SetFilePointerEx (in: hFile=0x1dc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.467] SetEndOfFile (hFile=0x1dc) returned 1 [0067.473] CloseHandle (hObject=0x1dc) returned 1 [0067.473] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.473] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0067.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.474] lstrlenW (lpString=".doc") returned 4 [0067.474] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.474] lstrlenW (lpString=".docx") returned 5 [0067.474] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.474] lstrlenW (lpString=".pdf") returned 4 [0067.474] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.474] lstrlenW (lpString=".xls") returned 4 [0067.474] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.474] lstrlenW (lpString=".xlsx") returned 5 [0067.474] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.474] lstrlenW (lpString=".ppt") returned 4 [0067.474] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.474] lstrlenW (lpString=".zip") returned 4 [0067.474] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.474] lstrlenW (lpString=".rar") returned 4 [0067.474] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.474] lstrlenW (lpString=".bz2") returned 4 [0067.474] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.474] lstrlenW (lpString=".7z") returned 3 [0067.474] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.474] lstrlenW (lpString=".dbf") returned 4 [0067.474] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.474] lstrlenW (lpString=".1cd") returned 4 [0067.474] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.474] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.475] lstrlenW (lpString=".jpg") returned 4 [0067.475] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.475] lstrlenW (lpString=".doc") returned 4 [0067.475] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.475] lstrlenW (lpString=".docx") returned 5 [0067.475] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.475] lstrlenW (lpString=".pdf") returned 4 [0067.475] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.475] lstrlenW (lpString=".xls") returned 4 [0067.475] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.475] lstrlenW (lpString=".xlsx") returned 5 [0067.475] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.475] lstrlenW (lpString=".ppt") returned 4 [0067.475] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.475] lstrlenW (lpString=".zip") returned 4 [0067.475] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.475] lstrlenW (lpString=".rar") returned 4 [0067.475] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.475] lstrlenW (lpString=".bz2") returned 4 [0067.475] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.475] lstrlenW (lpString=".7z") returned 3 [0067.475] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.475] lstrlenW (lpString=".dbf") returned 4 [0067.475] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.475] lstrlenW (lpString=".1cd") returned 4 [0067.475] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0067.476] lstrlenW (lpString=".jpg") returned 4 [0067.476] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.476] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0067.476] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0067.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.764] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=320384) returned 1 [0067.765] CloseHandle (hObject=0x1f4) returned 1 [0067.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0067.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.765] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.765] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0067.766] GetLastError () returned 0x0 [0067.766] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0067.773] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0067.779] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.779] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.779] SetEndOfFile (hFile=0x184) returned 1 [0067.779] CloseHandle (hObject=0x184) returned 1 [0067.779] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.779] SetEndOfFile (hFile=0x1f4) returned 1 [0067.782] CloseHandle (hObject=0x1f4) returned 1 [0067.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.783] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.783] lstrlenW (lpString=".doc") returned 4 [0067.783] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.783] lstrlenW (lpString=".docx") returned 5 [0067.783] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.783] lstrlenW (lpString=".pdf") returned 4 [0067.783] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.783] lstrlenW (lpString=".xls") returned 4 [0067.783] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.783] lstrlenW (lpString=".xlsx") returned 5 [0067.783] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.783] lstrlenW (lpString=".ppt") returned 4 [0067.783] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.783] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.783] lstrlenW (lpString=".zip") returned 4 [0067.783] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.783] lstrlenW (lpString=".rar") returned 4 [0067.783] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.783] lstrlenW (lpString=".bz2") returned 4 [0067.783] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.783] lstrlenW (lpString=".7z") returned 3 [0067.784] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.784] lstrlenW (lpString=".dbf") returned 4 [0067.784] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.784] lstrlenW (lpString=".1cd") returned 4 [0067.784] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.784] lstrlenW (lpString=".jpg") returned 4 [0067.784] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.784] lstrlenW (lpString=".doc") returned 4 [0067.784] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.784] lstrlenW (lpString=".docx") returned 5 [0067.784] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.784] lstrlenW (lpString=".pdf") returned 4 [0067.784] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.784] lstrlenW (lpString=".xls") returned 4 [0067.784] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.784] lstrlenW (lpString=".xlsx") returned 5 [0067.784] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.784] lstrlenW (lpString=".ppt") returned 4 [0067.784] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.784] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.784] lstrlenW (lpString=".zip") returned 4 [0067.784] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.784] lstrlenW (lpString=".rar") returned 4 [0067.784] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.784] lstrlenW (lpString=".bz2") returned 4 [0067.784] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.784] lstrlenW (lpString=".7z") returned 3 [0067.785] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.785] lstrlenW (lpString=".dbf") returned 4 [0067.785] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.785] lstrlenW (lpString=".1cd") returned 4 [0067.785] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.785] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0067.785] lstrlenW (lpString=".jpg") returned 4 [0067.785] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.785] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0067.785] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0067.785] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0067.935] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=280448) returned 1 [0067.935] CloseHandle (hObject=0x200) returned 1 [0067.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0067.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0067.935] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.936] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.936] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0067.936] GetLastError () returned 0x0 [0067.936] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x44780, lpOverlapped=0x0) returned 1 [0067.972] WriteFile (in: hFile=0x210, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x44790, lpOverlapped=0x0) returned 1 [0068.069] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.069] WriteFile (in: hFile=0x210, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.069] SetEndOfFile (hFile=0x210) returned 1 [0068.069] CloseHandle (hObject=0x210) returned 1 [0068.070] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.070] SetEndOfFile (hFile=0x200) returned 1 [0068.073] CloseHandle (hObject=0x200) returned 1 [0068.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.075] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0068.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.075] lstrlenW (lpString=".doc") returned 4 [0068.075] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0068.075] lstrlenW (lpString=".docx") returned 5 [0068.075] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0068.075] lstrlenW (lpString=".pdf") returned 4 [0068.076] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0068.076] lstrlenW (lpString=".xls") returned 4 [0068.076] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0068.076] lstrlenW (lpString=".xlsx") returned 5 [0068.076] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0068.076] lstrlenW (lpString=".ppt") returned 4 [0068.076] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0068.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.076] lstrlenW (lpString=".zip") returned 4 [0068.076] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0068.076] lstrlenW (lpString=".rar") returned 4 [0068.076] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0068.076] lstrlenW (lpString=".bz2") returned 4 [0068.076] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0068.076] lstrlenW (lpString=".7z") returned 3 [0068.076] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0068.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.076] lstrlenW (lpString=".dbf") returned 4 [0068.076] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0068.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.076] lstrlenW (lpString=".1cd") returned 4 [0068.076] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0068.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.076] lstrlenW (lpString=".jpg") returned 4 [0068.076] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0068.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.076] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.076] lstrlenW (lpString=".doc") returned 4 [0068.076] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0068.076] lstrlenW (lpString=".docx") returned 5 [0068.076] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0068.076] lstrlenW (lpString=".pdf") returned 4 [0068.077] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0068.077] lstrlenW (lpString=".xls") returned 4 [0068.077] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0068.077] lstrlenW (lpString=".xlsx") returned 5 [0068.077] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0068.077] lstrlenW (lpString=".ppt") returned 4 [0068.077] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0068.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.077] lstrlenW (lpString=".zip") returned 4 [0068.077] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0068.077] lstrlenW (lpString=".rar") returned 4 [0068.077] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0068.077] lstrlenW (lpString=".bz2") returned 4 [0068.077] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0068.077] lstrlenW (lpString=".7z") returned 3 [0068.077] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0068.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.077] lstrlenW (lpString=".dbf") returned 4 [0068.077] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0068.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.077] lstrlenW (lpString=".1cd") returned 4 [0068.077] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0068.077] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0068.077] lstrlenW (lpString=".jpg") returned 4 [0068.077] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0068.077] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0068.077] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0068.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.134] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=3584) returned 1 [0068.134] CloseHandle (hObject=0x218) returned 1 [0068.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0068.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.134] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.134] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.134] lstrlenW (lpString=".doc") returned 4 [0068.134] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.134] lstrlenW (lpString=".docx") returned 5 [0068.134] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.134] lstrlenW (lpString=".pdf") returned 4 [0068.134] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.134] lstrlenW (lpString=".xls") returned 4 [0068.134] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.134] lstrlenW (lpString=".xlsx") returned 5 [0068.134] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.134] lstrlenW (lpString=".ppt") returned 4 [0068.135] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.135] lstrlenW (lpString=".zip") returned 4 [0068.135] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.135] lstrlenW (lpString=".rar") returned 4 [0068.135] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.135] lstrlenW (lpString=".bz2") returned 4 [0068.135] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.135] lstrlenW (lpString=".7z") returned 3 [0068.135] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.135] lstrlenW (lpString=".dbf") returned 4 [0068.135] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.135] lstrlenW (lpString=".1cd") returned 4 [0068.135] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.135] lstrlenW (lpString=".jpg") returned 4 [0068.135] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.135] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.135] lstrlenW (lpString=".doc") returned 4 [0068.135] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.135] lstrlenW (lpString=".docx") returned 5 [0068.135] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.135] lstrlenW (lpString=".pdf") returned 4 [0068.135] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.135] lstrlenW (lpString=".xls") returned 4 [0068.135] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.135] lstrlenW (lpString=".xlsx") returned 5 [0068.135] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.135] lstrlenW (lpString=".ppt") returned 4 [0068.135] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.136] lstrlenW (lpString=".zip") returned 4 [0068.136] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.136] lstrlenW (lpString=".rar") returned 4 [0068.136] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.136] lstrlenW (lpString=".bz2") returned 4 [0068.136] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.136] lstrlenW (lpString=".7z") returned 3 [0068.136] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.136] lstrlenW (lpString=".dbf") returned 4 [0068.136] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.136] lstrlenW (lpString=".1cd") returned 4 [0068.136] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.136] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0068.136] lstrlenW (lpString=".jpg") returned 4 [0068.136] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.136] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0068.136] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0068.136] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.137] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=4096) returned 1 [0068.137] CloseHandle (hObject=0x218) returned 1 [0068.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0068.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.137] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.137] lstrlenW (lpString=".doc") returned 4 [0068.137] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.137] lstrlenW (lpString=".docx") returned 5 [0068.137] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.137] lstrlenW (lpString=".pdf") returned 4 [0068.137] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.137] lstrlenW (lpString=".xls") returned 4 [0068.137] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.137] lstrlenW (lpString=".xlsx") returned 5 [0068.137] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.137] lstrlenW (lpString=".ppt") returned 4 [0068.137] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.137] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.138] lstrlenW (lpString=".zip") returned 4 [0068.138] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.138] lstrlenW (lpString=".rar") returned 4 [0068.138] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.138] lstrlenW (lpString=".bz2") returned 4 [0068.138] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.138] lstrlenW (lpString=".7z") returned 3 [0068.138] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.138] lstrlenW (lpString=".dbf") returned 4 [0068.138] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.138] lstrlenW (lpString=".1cd") returned 4 [0068.138] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.138] lstrlenW (lpString=".jpg") returned 4 [0068.138] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.138] lstrlenW (lpString=".doc") returned 4 [0068.138] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.138] lstrlenW (lpString=".docx") returned 5 [0068.138] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.138] lstrlenW (lpString=".pdf") returned 4 [0068.138] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.138] lstrlenW (lpString=".xls") returned 4 [0068.138] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.138] lstrlenW (lpString=".xlsx") returned 5 [0068.138] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.138] lstrlenW (lpString=".ppt") returned 4 [0068.138] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.138] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.138] lstrlenW (lpString=".zip") returned 4 [0068.139] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.139] lstrlenW (lpString=".rar") returned 4 [0068.139] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.139] lstrlenW (lpString=".bz2") returned 4 [0068.139] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.139] lstrlenW (lpString=".7z") returned 3 [0068.139] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.139] lstrlenW (lpString=".dbf") returned 4 [0068.139] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.139] lstrlenW (lpString=".1cd") returned 4 [0068.139] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.139] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0068.139] lstrlenW (lpString=".jpg") returned 4 [0068.139] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.139] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0068.139] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0068.139] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.140] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=193024) returned 1 [0068.140] CloseHandle (hObject=0x218) returned 1 [0068.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0068.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.140] lstrlenW (lpString=".doc") returned 4 [0068.140] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0068.140] lstrlenW (lpString=".docx") returned 5 [0068.140] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0068.140] lstrlenW (lpString=".pdf") returned 4 [0068.140] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0068.140] lstrlenW (lpString=".xls") returned 4 [0068.140] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0068.140] lstrlenW (lpString=".xlsx") returned 5 [0068.140] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0068.140] lstrlenW (lpString=".ppt") returned 4 [0068.140] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0068.140] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.140] lstrlenW (lpString=".zip") returned 4 [0068.140] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0068.140] lstrlenW (lpString=".rar") returned 4 [0068.140] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0068.141] lstrlenW (lpString=".bz2") returned 4 [0068.141] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0068.141] lstrlenW (lpString=".7z") returned 3 [0068.141] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0068.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.141] lstrlenW (lpString=".dbf") returned 4 [0068.141] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0068.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.141] lstrlenW (lpString=".1cd") returned 4 [0068.141] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0068.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.141] lstrlenW (lpString=".jpg") returned 4 [0068.141] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0068.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.141] lstrlenW (lpString=".doc") returned 4 [0068.141] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0068.141] lstrlenW (lpString=".docx") returned 5 [0068.141] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0068.141] lstrlenW (lpString=".pdf") returned 4 [0068.141] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0068.141] lstrlenW (lpString=".xls") returned 4 [0068.141] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0068.141] lstrlenW (lpString=".xlsx") returned 5 [0068.141] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0068.141] lstrlenW (lpString=".ppt") returned 4 [0068.141] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0068.141] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.141] lstrlenW (lpString=".zip") returned 4 [0068.141] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0068.141] lstrlenW (lpString=".rar") returned 4 [0068.141] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0068.142] lstrlenW (lpString=".bz2") returned 4 [0068.142] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0068.142] lstrlenW (lpString=".7z") returned 3 [0068.142] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0068.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.142] lstrlenW (lpString=".dbf") returned 4 [0068.142] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0068.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.142] lstrlenW (lpString=".1cd") returned 4 [0068.142] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0068.142] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0068.142] lstrlenW (lpString=".jpg") returned 4 [0068.142] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0068.142] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0068.142] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0068.142] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.143] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=3584) returned 1 [0068.143] CloseHandle (hObject=0x218) returned 1 [0068.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0068.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.143] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.143] lstrlenW (lpString=".doc") returned 4 [0068.143] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.143] lstrlenW (lpString=".docx") returned 5 [0068.143] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.143] lstrlenW (lpString=".pdf") returned 4 [0068.143] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.143] lstrlenW (lpString=".xls") returned 4 [0068.143] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.143] lstrlenW (lpString=".xlsx") returned 5 [0068.143] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.143] lstrlenW (lpString=".ppt") returned 4 [0068.143] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.143] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.143] lstrlenW (lpString=".zip") returned 4 [0068.143] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.143] lstrlenW (lpString=".rar") returned 4 [0068.143] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.143] lstrlenW (lpString=".bz2") returned 4 [0068.143] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.143] lstrlenW (lpString=".7z") returned 3 [0068.143] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.144] lstrlenW (lpString=".dbf") returned 4 [0068.144] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.144] lstrlenW (lpString=".1cd") returned 4 [0068.144] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.144] lstrlenW (lpString=".jpg") returned 4 [0068.144] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.144] lstrlenW (lpString=".doc") returned 4 [0068.144] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.144] lstrlenW (lpString=".docx") returned 5 [0068.144] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.144] lstrlenW (lpString=".pdf") returned 4 [0068.144] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.144] lstrlenW (lpString=".xls") returned 4 [0068.144] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.144] lstrlenW (lpString=".xlsx") returned 5 [0068.144] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.144] lstrlenW (lpString=".ppt") returned 4 [0068.144] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.144] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.144] lstrlenW (lpString=".zip") returned 4 [0068.144] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.144] lstrlenW (lpString=".rar") returned 4 [0068.144] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.144] lstrlenW (lpString=".bz2") returned 4 [0068.144] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.144] lstrlenW (lpString=".7z") returned 3 [0068.144] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.145] lstrlenW (lpString=".dbf") returned 4 [0068.145] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.145] lstrlenW (lpString=".1cd") returned 4 [0068.145] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.145] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0068.145] lstrlenW (lpString=".jpg") returned 4 [0068.145] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.145] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0068.145] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0068.145] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0068.145] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=3584) returned 1 [0068.145] CloseHandle (hObject=0x218) returned 1 [0068.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0068.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.146] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.146] lstrlenW (lpString=".doc") returned 4 [0068.146] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.146] lstrlenW (lpString=".docx") returned 5 [0068.146] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.146] lstrlenW (lpString=".pdf") returned 4 [0068.146] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.146] lstrlenW (lpString=".xls") returned 4 [0068.146] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.146] lstrlenW (lpString=".xlsx") returned 5 [0068.146] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.146] lstrlenW (lpString=".ppt") returned 4 [0068.146] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.146] lstrlenW (lpString=".zip") returned 4 [0068.146] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.146] lstrlenW (lpString=".rar") returned 4 [0068.146] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.146] lstrlenW (lpString=".bz2") returned 4 [0068.146] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.146] lstrlenW (lpString=".7z") returned 3 [0068.146] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.146] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.146] lstrlenW (lpString=".dbf") returned 4 [0068.146] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.147] lstrlenW (lpString=".1cd") returned 4 [0068.147] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.147] lstrlenW (lpString=".jpg") returned 4 [0068.147] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.147] lstrlenW (lpString=".doc") returned 4 [0068.147] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.147] lstrlenW (lpString=".docx") returned 5 [0068.147] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.147] lstrlenW (lpString=".pdf") returned 4 [0068.147] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.147] lstrlenW (lpString=".xls") returned 4 [0068.147] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.147] lstrlenW (lpString=".xlsx") returned 5 [0068.147] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.147] lstrlenW (lpString=".ppt") returned 4 [0068.147] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.147] lstrlenW (lpString=".zip") returned 4 [0068.147] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.147] lstrlenW (lpString=".rar") returned 4 [0068.147] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.147] lstrlenW (lpString=".bz2") returned 4 [0068.147] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.147] lstrlenW (lpString=".7z") returned 3 [0068.147] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.147] lstrlenW (lpString=".dbf") returned 4 [0068.147] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0068.147] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.148] lstrlenW (lpString=".1cd") returned 4 [0068.148] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0068.148] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0068.148] lstrlenW (lpString=".jpg") returned 4 [0068.148] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0068.148] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0068.148] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0068.148] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0068.779] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=4096) returned 1 [0068.779] CloseHandle (hObject=0x200) returned 1 [0068.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0068.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0068.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0068.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0068.780] lstrlenW (lpString=".doc") returned 4 [0068.780] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0068.780] lstrlenW (lpString=".docx") returned 5 [0068.780] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0068.780] lstrlenW (lpString=".pdf") returned 4 [0068.780] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0068.780] lstrlenW (lpString=".xls") returned 4 [0068.780] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0068.780] lstrlenW (lpString=".xlsx") returned 5 [0068.780] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0068.780] lstrlenW (lpString=".ppt") returned 4 [0068.780] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0068.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0068.780] lstrlenW (lpString=".zip") returned 4 [0068.780] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0068.780] lstrlenW (lpString=".rar") returned 4 [0068.780] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0068.780] lstrlenW (lpString=".bz2") returned 4 [0068.780] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0068.780] lstrlenW (lpString=".7z") returned 3 [0068.780] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0068.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0068.780] lstrlenW (lpString=".dbf") returned 4 [0068.780] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.815] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.815] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0069.815] GetLastError () returned 0x0 [0069.815] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xd2990, lpOverlapped=0x0) returned 1 [0069.834] WriteFile (in: hFile=0x208, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0070.072] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.072] WriteFile (in: hFile=0x208, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0070.072] SetEndOfFile (hFile=0x208) returned 1 [0070.073] CloseHandle (hObject=0x208) returned 1 [0070.073] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0070.073] SetEndOfFile (hFile=0x1e4) returned 1 [0070.080] CloseHandle (hObject=0x1e4) returned 1 [0070.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0070.081] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0070.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.379] lstrlenW (lpString=".doc") returned 4 [0070.379] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0070.379] lstrlenW (lpString=".docx") returned 5 [0070.379] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0070.379] lstrlenW (lpString=".pdf") returned 4 [0070.379] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0070.379] lstrlenW (lpString=".xls") returned 4 [0070.379] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0070.379] lstrlenW (lpString=".xlsx") returned 5 [0070.379] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0070.379] lstrlenW (lpString=".ppt") returned 4 [0070.379] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0070.379] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.379] lstrlenW (lpString=".zip") returned 4 [0070.379] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0070.379] lstrlenW (lpString=".rar") returned 4 [0070.379] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0070.379] lstrlenW (lpString=".bz2") returned 4 [0070.379] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0070.379] lstrlenW (lpString=".7z") returned 3 [0070.379] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0070.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.380] lstrlenW (lpString=".dbf") returned 4 [0070.380] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0070.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.380] lstrlenW (lpString=".1cd") returned 4 [0070.380] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0070.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.380] lstrlenW (lpString=".jpg") returned 4 [0070.380] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0070.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.380] lstrlenW (lpString=".doc") returned 4 [0070.380] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0070.380] lstrlenW (lpString=".docx") returned 5 [0070.380] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0070.380] lstrlenW (lpString=".pdf") returned 4 [0070.380] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0070.380] lstrlenW (lpString=".xls") returned 4 [0070.380] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0070.380] lstrlenW (lpString=".xlsx") returned 5 [0070.380] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0070.380] lstrlenW (lpString=".ppt") returned 4 [0070.380] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0070.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.380] lstrlenW (lpString=".zip") returned 4 [0070.380] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0070.380] lstrlenW (lpString=".rar") returned 4 [0070.380] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0070.380] lstrlenW (lpString=".bz2") returned 4 [0070.380] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0070.380] lstrlenW (lpString=".7z") returned 3 [0070.380] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0070.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.381] lstrlenW (lpString=".dbf") returned 4 [0070.381] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0070.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.381] lstrlenW (lpString=".1cd") returned 4 [0070.381] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0070.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0070.381] lstrlenW (lpString=".jpg") returned 4 [0070.381] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0070.381] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0070.381] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0070.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.319] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=105344) returned 1 [0071.319] CloseHandle (hObject=0x200) returned 1 [0071.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0071.319] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.319] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.319] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.319] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.320] GetLastError () returned 0x0 [0071.320] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x19b80, lpOverlapped=0x0) returned 1 [0071.323] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x19b90, lpOverlapped=0x0) returned 1 [0071.325] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.326] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xee, lpOverlapped=0x0) returned 1 [0071.326] SetEndOfFile (hFile=0x1ec) returned 1 [0071.326] CloseHandle (hObject=0x1ec) returned 1 [0071.326] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.326] SetEndOfFile (hFile=0x200) returned 1 [0071.327] CloseHandle (hObject=0x200) returned 1 [0071.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.328] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0071.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.328] lstrlenW (lpString=".doc") returned 4 [0071.328] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.328] lstrlenW (lpString=".docx") returned 5 [0071.328] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0071.328] lstrlenW (lpString=".pdf") returned 4 [0071.328] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.328] lstrlenW (lpString=".xls") returned 4 [0071.328] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.328] lstrlenW (lpString=".xlsx") returned 5 [0071.328] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0071.328] lstrlenW (lpString=".ppt") returned 4 [0071.328] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.328] lstrlenW (lpString=".zip") returned 4 [0071.328] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.328] lstrlenW (lpString=".rar") returned 4 [0071.328] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.328] lstrlenW (lpString=".bz2") returned 4 [0071.328] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.328] lstrlenW (lpString=".7z") returned 3 [0071.329] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.329] lstrlenW (lpString=".dbf") returned 4 [0071.329] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.329] lstrlenW (lpString=".1cd") returned 4 [0071.329] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.329] lstrlenW (lpString=".jpg") returned 4 [0071.329] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.329] lstrlenW (lpString=".doc") returned 4 [0071.329] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0071.329] lstrlenW (lpString=".docx") returned 5 [0071.329] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0071.329] lstrlenW (lpString=".pdf") returned 4 [0071.329] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0071.329] lstrlenW (lpString=".xls") returned 4 [0071.329] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0071.329] lstrlenW (lpString=".xlsx") returned 5 [0071.329] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0071.329] lstrlenW (lpString=".ppt") returned 4 [0071.329] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0071.329] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.329] lstrlenW (lpString=".zip") returned 4 [0071.329] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0071.329] lstrlenW (lpString=".rar") returned 4 [0071.329] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0071.329] lstrlenW (lpString=".bz2") returned 4 [0071.329] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0071.329] lstrlenW (lpString=".7z") returned 3 [0071.329] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0071.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.330] lstrlenW (lpString=".dbf") returned 4 [0071.330] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0071.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.330] lstrlenW (lpString=".1cd") returned 4 [0071.330] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0071.330] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0071.330] lstrlenW (lpString=".jpg") returned 4 [0071.330] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0071.330] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0071.330] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0071.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.330] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=744888) returned 1 [0071.330] CloseHandle (hObject=0x200) returned 1 [0071.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0071.331] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.331] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0071.332] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.332] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.332] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0071.332] GetLastError () returned 0x0 [0071.332] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0071.348] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xb5dc0, lpOverlapped=0x0) returned 1 [0071.460] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.460] WriteFile (in: hFile=0x1ec, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0071.460] SetEndOfFile (hFile=0x1ec) returned 1 [0071.720] CloseHandle (hObject=0x1ec) returned 1 [0071.982] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.982] SetEndOfFile (hFile=0x200) returned 1 [0072.024] CloseHandle (hObject=0x200) returned 1 [0072.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.024] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0072.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.025] lstrlenW (lpString=".doc") returned 4 [0072.025] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.025] lstrlenW (lpString=".docx") returned 5 [0072.025] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0072.025] lstrlenW (lpString=".pdf") returned 4 [0072.025] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.025] lstrlenW (lpString=".xls") returned 4 [0072.025] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.025] lstrlenW (lpString=".xlsx") returned 5 [0072.025] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0072.025] lstrlenW (lpString=".ppt") returned 4 [0072.025] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.025] lstrlenW (lpString=".zip") returned 4 [0072.025] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.025] lstrlenW (lpString=".rar") returned 4 [0072.025] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.025] lstrlenW (lpString=".bz2") returned 4 [0072.025] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.025] lstrlenW (lpString=".7z") returned 3 [0072.025] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.025] lstrlenW (lpString=".dbf") returned 4 [0072.025] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.025] lstrlenW (lpString=".1cd") returned 4 [0072.025] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.025] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.025] lstrlenW (lpString=".jpg") returned 4 [0072.025] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.026] lstrlenW (lpString=".doc") returned 4 [0072.026] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.026] lstrlenW (lpString=".docx") returned 5 [0072.026] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0072.026] lstrlenW (lpString=".pdf") returned 4 [0072.026] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.026] lstrlenW (lpString=".xls") returned 4 [0072.026] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.026] lstrlenW (lpString=".xlsx") returned 5 [0072.026] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0072.026] lstrlenW (lpString=".ppt") returned 4 [0072.026] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.026] lstrlenW (lpString=".zip") returned 4 [0072.026] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.026] lstrlenW (lpString=".rar") returned 4 [0072.026] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.026] lstrlenW (lpString=".bz2") returned 4 [0072.026] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.026] lstrlenW (lpString=".7z") returned 3 [0072.026] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.026] lstrlenW (lpString=".dbf") returned 4 [0072.026] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.026] lstrlenW (lpString=".1cd") returned 4 [0072.026] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.026] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0072.026] lstrlenW (lpString=".jpg") returned 4 [0072.026] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.027] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0072.027] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0072.027] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0072.027] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=342960) returned 1 [0072.027] CloseHandle (hObject=0x200) returned 1 [0072.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0072.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0072.028] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.028] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.028] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0072.029] GetLastError () returned 0x0 [0072.029] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x53bb0, lpOverlapped=0x0) returned 1 [0072.036] WriteFile (in: hFile=0x218, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x53bc0, lpOverlapped=0x0) returned 1 [0072.042] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.042] WriteFile (in: hFile=0x218, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0072.042] SetEndOfFile (hFile=0x218) returned 1 [0072.042] CloseHandle (hObject=0x218) returned 1 [0072.042] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.042] SetEndOfFile (hFile=0x200) returned 1 [0072.045] CloseHandle (hObject=0x200) returned 1 [0072.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.046] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1 [0072.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.046] lstrlenW (lpString=".doc") returned 4 [0072.046] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.046] lstrlenW (lpString=".docx") returned 5 [0072.046] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0072.046] lstrlenW (lpString=".pdf") returned 4 [0072.046] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.046] lstrlenW (lpString=".xls") returned 4 [0072.046] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.046] lstrlenW (lpString=".xlsx") returned 5 [0072.046] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0072.046] lstrlenW (lpString=".ppt") returned 4 [0072.046] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.046] lstrlenW (lpString=".zip") returned 4 [0072.046] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.046] lstrlenW (lpString=".rar") returned 4 [0072.046] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.047] lstrlenW (lpString=".bz2") returned 4 [0072.047] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.047] lstrlenW (lpString=".7z") returned 3 [0072.047] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.047] lstrlenW (lpString=".dbf") returned 4 [0072.047] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.047] lstrlenW (lpString=".1cd") returned 4 [0072.047] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.047] lstrlenW (lpString=".jpg") returned 4 [0072.047] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.047] lstrlenW (lpString=".doc") returned 4 [0072.047] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.047] lstrlenW (lpString=".docx") returned 5 [0072.047] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0072.047] lstrlenW (lpString=".pdf") returned 4 [0072.047] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.047] lstrlenW (lpString=".xls") returned 4 [0072.047] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.047] lstrlenW (lpString=".xlsx") returned 5 [0072.047] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0072.047] lstrlenW (lpString=".ppt") returned 4 [0072.047] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.047] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.047] lstrlenW (lpString=".zip") returned 4 [0072.047] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.047] lstrlenW (lpString=".rar") returned 4 [0072.047] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.047] lstrlenW (lpString=".bz2") returned 4 [0072.048] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.048] lstrlenW (lpString=".7z") returned 3 [0072.048] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.048] lstrlenW (lpString=".dbf") returned 4 [0072.048] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.048] lstrlenW (lpString=".1cd") returned 4 [0072.048] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.048] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0072.048] lstrlenW (lpString=".jpg") returned 4 [0072.048] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.048] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0072.048] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0072.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0072.049] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=15800) returned 1 [0072.049] CloseHandle (hObject=0x200) returned 1 [0072.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0072.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0072.050] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.050] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0072.050] GetLastError () returned 0x0 [0072.050] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0072.330] WriteFile (in: hFile=0x218, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0072.331] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.331] WriteFile (in: hFile=0x218, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.331] SetEndOfFile (hFile=0x218) returned 1 [0072.331] CloseHandle (hObject=0x218) returned 1 [0072.331] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.331] SetEndOfFile (hFile=0x200) returned 1 [0072.332] CloseHandle (hObject=0x200) returned 1 [0072.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.332] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0072.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.332] lstrlenW (lpString=".doc") returned 4 [0072.333] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.333] lstrlenW (lpString=".docx") returned 5 [0072.333] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0072.333] lstrlenW (lpString=".pdf") returned 4 [0072.333] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.333] lstrlenW (lpString=".xls") returned 4 [0072.333] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.333] lstrlenW (lpString=".xlsx") returned 5 [0072.333] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0072.333] lstrlenW (lpString=".ppt") returned 4 [0072.333] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.333] lstrlenW (lpString=".zip") returned 4 [0072.333] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.333] lstrlenW (lpString=".rar") returned 4 [0072.333] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.333] lstrlenW (lpString=".bz2") returned 4 [0072.333] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.333] lstrlenW (lpString=".7z") returned 3 [0072.333] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.333] lstrlenW (lpString=".dbf") returned 4 [0072.333] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.333] lstrlenW (lpString=".1cd") returned 4 [0072.333] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.333] lstrlenW (lpString=".jpg") returned 4 [0072.333] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.333] lstrlenW (lpString=".doc") returned 4 [0072.334] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0072.334] lstrlenW (lpString=".docx") returned 5 [0072.334] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0072.334] lstrlenW (lpString=".pdf") returned 4 [0072.334] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0072.334] lstrlenW (lpString=".xls") returned 4 [0072.334] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0072.334] lstrlenW (lpString=".xlsx") returned 5 [0072.334] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0072.334] lstrlenW (lpString=".ppt") returned 4 [0072.334] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0072.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.334] lstrlenW (lpString=".zip") returned 4 [0072.334] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0072.334] lstrlenW (lpString=".rar") returned 4 [0072.334] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0072.334] lstrlenW (lpString=".bz2") returned 4 [0072.334] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0072.334] lstrlenW (lpString=".7z") returned 3 [0072.334] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0072.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.334] lstrlenW (lpString=".dbf") returned 4 [0072.334] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0072.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.334] lstrlenW (lpString=".1cd") returned 4 [0072.334] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0072.334] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0072.334] lstrlenW (lpString=".jpg") returned 4 [0072.334] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0072.334] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0072.335] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0072.335] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.376] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=15800) returned 1 [0072.376] CloseHandle (hObject=0x1f4) returned 1 [0072.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0072.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.377] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0072.378] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.378] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.378] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0073.726] GetLastError () returned 0x0 [0073.726] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0073.728] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0073.729] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.729] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.729] SetEndOfFile (hFile=0x1e0) returned 1 [0073.729] CloseHandle (hObject=0x1e0) returned 1 [0073.730] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.730] SetEndOfFile (hFile=0x1f4) returned 1 [0073.730] CloseHandle (hObject=0x1f4) returned 1 [0073.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.731] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0073.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.731] lstrlenW (lpString=".doc") returned 4 [0073.731] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.731] lstrlenW (lpString=".docx") returned 5 [0073.731] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0073.731] lstrlenW (lpString=".pdf") returned 4 [0073.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.731] lstrlenW (lpString=".xls") returned 4 [0073.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.731] lstrlenW (lpString=".xlsx") returned 5 [0073.731] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0073.731] lstrlenW (lpString=".ppt") returned 4 [0073.731] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.731] lstrlenW (lpString=".zip") returned 4 [0073.731] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.731] lstrlenW (lpString=".rar") returned 4 [0073.731] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.731] lstrlenW (lpString=".bz2") returned 4 [0073.732] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.732] lstrlenW (lpString=".7z") returned 3 [0073.732] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.732] lstrlenW (lpString=".dbf") returned 4 [0073.732] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.732] lstrlenW (lpString=".1cd") returned 4 [0073.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.732] lstrlenW (lpString=".jpg") returned 4 [0073.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.732] lstrlenW (lpString=".doc") returned 4 [0073.732] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.732] lstrlenW (lpString=".docx") returned 5 [0073.732] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0073.732] lstrlenW (lpString=".pdf") returned 4 [0073.732] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.732] lstrlenW (lpString=".xls") returned 4 [0073.732] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.732] lstrlenW (lpString=".xlsx") returned 5 [0073.732] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0073.732] lstrlenW (lpString=".ppt") returned 4 [0073.732] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.732] lstrlenW (lpString=".zip") returned 4 [0073.732] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.732] lstrlenW (lpString=".rar") returned 4 [0073.732] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.732] lstrlenW (lpString=".bz2") returned 4 [0073.733] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.733] lstrlenW (lpString=".7z") returned 3 [0073.733] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.733] lstrlenW (lpString=".dbf") returned 4 [0073.733] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.733] lstrlenW (lpString=".1cd") returned 4 [0073.733] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0073.733] lstrlenW (lpString=".jpg") returned 4 [0073.733] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.733] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0073.733] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0073.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.734] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=55744) returned 1 [0073.734] CloseHandle (hObject=0x1f4) returned 1 [0073.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0073.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.735] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.735] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.735] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0073.735] GetLastError () returned 0x0 [0073.735] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xd9c0, lpOverlapped=0x0) returned 1 [0073.737] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xd9d0, lpOverlapped=0x0) returned 1 [0073.739] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.739] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0073.739] SetEndOfFile (hFile=0x1e0) returned 1 [0073.739] CloseHandle (hObject=0x1e0) returned 1 [0073.740] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.740] SetEndOfFile (hFile=0x1f4) returned 1 [0073.741] CloseHandle (hObject=0x1f4) returned 1 [0073.741] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.741] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1 [0073.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.741] lstrlenW (lpString=".doc") returned 4 [0073.741] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.741] lstrlenW (lpString=".docx") returned 5 [0073.741] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0073.741] lstrlenW (lpString=".pdf") returned 4 [0073.741] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.741] lstrlenW (lpString=".xls") returned 4 [0073.741] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.742] lstrlenW (lpString=".xlsx") returned 5 [0073.742] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0073.742] lstrlenW (lpString=".ppt") returned 4 [0073.742] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.742] lstrlenW (lpString=".zip") returned 4 [0073.742] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.742] lstrlenW (lpString=".rar") returned 4 [0073.742] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.742] lstrlenW (lpString=".bz2") returned 4 [0073.742] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.742] lstrlenW (lpString=".7z") returned 3 [0073.742] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.742] lstrlenW (lpString=".dbf") returned 4 [0073.742] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.742] lstrlenW (lpString=".1cd") returned 4 [0073.742] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.742] lstrlenW (lpString=".jpg") returned 4 [0073.742] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.742] lstrlenW (lpString=".doc") returned 4 [0073.742] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.742] lstrlenW (lpString=".docx") returned 5 [0073.742] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0073.742] lstrlenW (lpString=".pdf") returned 4 [0073.742] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.742] lstrlenW (lpString=".xls") returned 4 [0073.742] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.743] lstrlenW (lpString=".xlsx") returned 5 [0073.743] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0073.743] lstrlenW (lpString=".ppt") returned 4 [0073.743] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.743] lstrlenW (lpString=".zip") returned 4 [0073.743] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.743] lstrlenW (lpString=".rar") returned 4 [0073.743] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.743] lstrlenW (lpString=".bz2") returned 4 [0073.743] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.743] lstrlenW (lpString=".7z") returned 3 [0073.743] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.743] lstrlenW (lpString=".dbf") returned 4 [0073.743] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.743] lstrlenW (lpString=".1cd") returned 4 [0073.743] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.743] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0073.743] lstrlenW (lpString=".jpg") returned 4 [0073.743] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.743] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0073.743] lstrlenW (lpString="ACEREP.DLL") returned 10 [0073.743] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.744] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=691616) returned 1 [0073.744] CloseHandle (hObject=0x1f4) returned 1 [0073.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0073.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0073.744] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.744] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.744] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0073.745] GetLastError () returned 0x0 [0073.745] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0xa8da0, lpOverlapped=0x0) returned 1 [0073.759] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xa8db0, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xa8db0, lpOverlapped=0x0) returned 1 [0074.031] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0074.031] WriteFile (in: hFile=0x1e0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0074.031] SetEndOfFile (hFile=0x1e0) returned 1 [0074.031] CloseHandle (hObject=0x1e0) returned 1 [0074.032] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.032] SetEndOfFile (hFile=0x1f4) returned 1 [0074.037] CloseHandle (hObject=0x1f4) returned 1 [0074.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0074.038] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1 [0074.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.439] lstrlenW (lpString=".doc") returned 4 [0074.439] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.439] lstrlenW (lpString=".docx") returned 5 [0074.439] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0074.439] lstrlenW (lpString=".pdf") returned 4 [0074.439] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.439] lstrlenW (lpString=".xls") returned 4 [0074.439] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.439] lstrlenW (lpString=".xlsx") returned 5 [0074.439] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0074.439] lstrlenW (lpString=".ppt") returned 4 [0074.440] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.440] lstrlenW (lpString=".zip") returned 4 [0074.440] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.440] lstrlenW (lpString=".rar") returned 4 [0074.440] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.440] lstrlenW (lpString=".bz2") returned 4 [0074.440] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.440] lstrlenW (lpString=".7z") returned 3 [0074.440] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.440] lstrlenW (lpString=".dbf") returned 4 [0074.440] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.440] lstrlenW (lpString=".1cd") returned 4 [0074.440] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.440] lstrlenW (lpString=".jpg") returned 4 [0074.440] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.441] lstrlenW (lpString=".doc") returned 4 [0074.441] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.441] lstrlenW (lpString=".docx") returned 5 [0074.441] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0074.441] lstrlenW (lpString=".pdf") returned 4 [0074.441] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.441] lstrlenW (lpString=".xls") returned 4 [0074.441] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.441] lstrlenW (lpString=".xlsx") returned 5 [0074.441] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0074.441] lstrlenW (lpString=".ppt") returned 4 [0074.441] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.441] lstrlenW (lpString=".zip") returned 4 [0074.441] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.441] lstrlenW (lpString=".rar") returned 4 [0074.441] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.441] lstrlenW (lpString=".bz2") returned 4 [0074.441] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.441] lstrlenW (lpString=".7z") returned 3 [0074.441] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.441] lstrlenW (lpString=".dbf") returned 4 [0074.441] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.441] lstrlenW (lpString=".1cd") returned 4 [0074.441] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.441] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0074.441] lstrlenW (lpString=".jpg") returned 4 [0074.441] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.442] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0074.442] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0074.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.678] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x305ff1c | out: lpFileSize=0x305ff1c*=385368) returned 1 [0074.678] CloseHandle (hObject=0x1f4) returned 1 [0074.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0074.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0074.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0074.678] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.678] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0074.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0074.990] GetLastError () returned 0x0 [0074.990] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x5e158, lpOverlapped=0x0) returned 1 [0075.006] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0x5e160, lpOverlapped=0x0) returned 1 [0075.014] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x305fed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x305fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.014] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x305fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x305fc9c*=0xea, lpOverlapped=0x0) returned 1 [0075.014] SetEndOfFile (hFile=0x200) returned 1 [0075.014] CloseHandle (hObject=0x200) returned 1 [0075.014] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x305fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.014] SetEndOfFile (hFile=0x1f4) returned 1 [0075.020] CloseHandle (hObject=0x1f4) returned 1 [0075.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.020] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 1 [0075.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.021] lstrlenW (lpString=".doc") returned 4 [0075.021] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0075.021] lstrlenW (lpString=".docx") returned 5 [0075.021] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0075.021] lstrlenW (lpString=".pdf") returned 4 [0075.021] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0075.021] lstrlenW (lpString=".xls") returned 4 [0075.021] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0075.021] lstrlenW (lpString=".xlsx") returned 5 [0075.021] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0075.021] lstrlenW (lpString=".ppt") returned 4 [0075.021] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0075.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.021] lstrlenW (lpString=".zip") returned 4 [0075.021] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0075.021] lstrlenW (lpString=".rar") returned 4 [0075.021] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0075.021] lstrlenW (lpString=".bz2") returned 4 [0075.021] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0075.021] lstrlenW (lpString=".7z") returned 3 [0075.021] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0075.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.021] lstrlenW (lpString=".dbf") returned 4 [0075.021] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0075.021] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.021] lstrlenW (lpString=".1cd") returned 4 [0075.021] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0075.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.022] lstrlenW (lpString=".jpg") returned 4 [0075.022] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0075.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.022] lstrlenW (lpString=".doc") returned 4 [0075.022] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0075.022] lstrlenW (lpString=".docx") returned 5 [0075.022] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0075.022] lstrlenW (lpString=".pdf") returned 4 [0075.022] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0075.022] lstrlenW (lpString=".xls") returned 4 [0075.022] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0075.022] lstrlenW (lpString=".xlsx") returned 5 [0075.022] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0075.022] lstrlenW (lpString=".ppt") returned 4 [0075.022] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0075.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.022] lstrlenW (lpString=".zip") returned 4 [0075.022] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0075.022] lstrlenW (lpString=".rar") returned 4 [0075.022] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0075.022] lstrlenW (lpString=".bz2") returned 4 [0075.022] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0075.022] lstrlenW (lpString=".7z") returned 3 [0075.022] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0075.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.022] lstrlenW (lpString=".dbf") returned 4 [0075.022] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0075.022] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.022] lstrlenW (lpString=".1cd") returned 4 [0075.022] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0075.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0075.023] lstrlenW (lpString=".jpg") returned 4 [0075.023] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0075.023] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0075.023] lstrlenW (lpString="EXP_PDF.DLL") returned 11 [0075.023] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 20 os_tid = 0xab4 [0047.028] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x37a06a0 [0047.029] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x37b06a8 [0047.029] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920450 [0047.029] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x6) returned 0x923190 [0047.029] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920468 [0047.029] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x3b80020 [0047.030] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920480 [0047.030] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920480, Size=0x20) returned 0x905ce8 [0047.030] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920480 [0047.030] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x920480, Size=0x20) returned 0x905cc0 [0047.030] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.030] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.030] Wow64DisableWow64FsRedirection (in: OldValue=0x319ff58 | out: OldValue=0x319ff58*=0x0) returned 1 [0047.030] lstrlenW (lpString="kernel32.dll") returned 12 [0047.030] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905ce8 | out: hHeap=0x8d0000) returned 1 [0047.030] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.030] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905cc0 | out: hHeap=0x8d0000) returned 1 [0047.030] Sleep (dwMilliseconds=0x64) [0047.239] Sleep (dwMilliseconds=0x64) [0047.490] Sleep (dwMilliseconds=0x64) [0047.651] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0047.651] lstrlenW (lpString="Setup.xml") returned 9 [0047.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.122] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2296) returned 1 [0048.122] CloseHandle (hObject=0x1a0) returned 1 [0048.122] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.123] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.123] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.123] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.123] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.123] GetLastError () returned 0x0 [0048.123] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0048.137] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x900, lpOverlapped=0x0) returned 1 [0048.138] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.138] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.138] SetEndOfFile (hFile=0x19c) returned 1 [0048.138] CloseHandle (hObject=0x19c) returned 1 [0048.139] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.139] SetEndOfFile (hFile=0x1a0) returned 1 [0048.140] CloseHandle (hObject=0x1a0) returned 1 [0048.140] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.140] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.140] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.140] lstrlenW (lpString=".doc") returned 4 [0048.140] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.140] lstrlenW (lpString=".docx") returned 5 [0048.140] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.140] lstrlenW (lpString=".pdf") returned 4 [0048.140] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.140] lstrlenW (lpString=".xls") returned 4 [0048.140] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.140] lstrlenW (lpString=".xlsx") returned 5 [0048.141] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.141] lstrlenW (lpString=".ppt") returned 4 [0048.141] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.141] lstrlenW (lpString=".zip") returned 4 [0048.141] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.141] lstrlenW (lpString=".rar") returned 4 [0048.141] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.141] lstrlenW (lpString=".bz2") returned 4 [0048.141] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.141] lstrlenW (lpString=".7z") returned 3 [0048.141] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.141] lstrlenW (lpString=".dbf") returned 4 [0048.141] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.141] lstrlenW (lpString=".1cd") returned 4 [0048.141] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.141] lstrlenW (lpString=".jpg") returned 4 [0048.141] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.141] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.141] lstrlenW (lpString=".doc") returned 4 [0048.141] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.141] lstrlenW (lpString=".docx") returned 5 [0048.141] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.141] lstrlenW (lpString=".pdf") returned 4 [0048.141] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.141] lstrlenW (lpString=".xls") returned 4 [0048.141] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.142] lstrlenW (lpString=".xlsx") returned 5 [0048.142] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.142] lstrlenW (lpString=".ppt") returned 4 [0048.142] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.142] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.142] lstrlenW (lpString=".zip") returned 4 [0048.142] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.142] lstrlenW (lpString=".rar") returned 4 [0048.142] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.142] lstrlenW (lpString=".bz2") returned 4 [0048.142] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.142] lstrlenW (lpString=".7z") returned 3 [0048.142] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.142] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.142] lstrlenW (lpString=".dbf") returned 4 [0048.142] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.142] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.142] lstrlenW (lpString=".1cd") returned 4 [0048.142] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.142] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.142] lstrlenW (lpString=".jpg") returned 4 [0048.142] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.142] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.142] lstrlenW (lpString="Proof.xml") returned 9 [0048.142] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.143] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1347) returned 1 [0048.143] CloseHandle (hObject=0x1a0) returned 1 [0048.143] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0048.143] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.143] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.143] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.144] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.144] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.144] GetLastError () returned 0x0 [0048.144] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x543, lpOverlapped=0x0) returned 1 [0048.145] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x550, lpOverlapped=0x0) returned 1 [0048.146] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.146] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.146] SetEndOfFile (hFile=0x19c) returned 1 [0048.146] CloseHandle (hObject=0x19c) returned 1 [0048.147] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.147] SetEndOfFile (hFile=0x1a0) returned 1 [0048.148] CloseHandle (hObject=0x1a0) returned 1 [0048.148] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.148] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0048.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.148] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.148] lstrlenW (lpString=".doc") returned 4 [0048.148] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.148] lstrlenW (lpString=".docx") returned 5 [0048.148] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0048.148] lstrlenW (lpString=".pdf") returned 4 [0048.149] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.149] lstrlenW (lpString=".xls") returned 4 [0048.149] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.149] lstrlenW (lpString=".xlsx") returned 5 [0048.149] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0048.149] lstrlenW (lpString=".ppt") returned 4 [0048.149] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.149] lstrlenW (lpString=".zip") returned 4 [0048.149] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.149] lstrlenW (lpString=".rar") returned 4 [0048.149] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.149] lstrlenW (lpString=".bz2") returned 4 [0048.149] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.149] lstrlenW (lpString=".7z") returned 3 [0048.149] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.149] lstrlenW (lpString=".dbf") returned 4 [0048.149] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.149] lstrlenW (lpString=".1cd") returned 4 [0048.149] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.149] lstrlenW (lpString=".jpg") returned 4 [0048.149] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.149] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.149] lstrlenW (lpString=".doc") returned 4 [0048.149] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.149] lstrlenW (lpString=".docx") returned 5 [0048.149] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0048.149] lstrlenW (lpString=".pdf") returned 4 [0048.150] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.150] lstrlenW (lpString=".xls") returned 4 [0048.150] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.150] lstrlenW (lpString=".xlsx") returned 5 [0048.150] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0048.150] lstrlenW (lpString=".ppt") returned 4 [0048.150] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.150] lstrlenW (lpString=".zip") returned 4 [0048.150] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.150] lstrlenW (lpString=".rar") returned 4 [0048.150] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.150] lstrlenW (lpString=".bz2") returned 4 [0048.150] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.150] lstrlenW (lpString=".7z") returned 3 [0048.150] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.150] lstrlenW (lpString=".dbf") returned 4 [0048.150] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.150] lstrlenW (lpString=".1cd") returned 4 [0048.150] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0048.150] lstrlenW (lpString=".jpg") returned 4 [0048.150] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.150] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.150] lstrlenW (lpString="Proof.xml") returned 9 [0048.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.151] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1457) returned 1 [0048.151] CloseHandle (hObject=0x1a0) returned 1 [0048.151] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0048.151] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.151] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.151] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.151] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.151] GetLastError () returned 0x0 [0048.151] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0048.154] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0048.155] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.155] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.155] SetEndOfFile (hFile=0x19c) returned 1 [0048.155] CloseHandle (hObject=0x19c) returned 1 [0048.156] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.156] SetEndOfFile (hFile=0x1a0) returned 1 [0048.157] CloseHandle (hObject=0x1a0) returned 1 [0048.157] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.157] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0048.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.157] lstrlenW (lpString=".doc") returned 4 [0048.157] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.157] lstrlenW (lpString=".docx") returned 5 [0048.157] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0048.157] lstrlenW (lpString=".pdf") returned 4 [0048.158] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.158] lstrlenW (lpString=".xls") returned 4 [0048.158] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.158] lstrlenW (lpString=".xlsx") returned 5 [0048.158] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0048.158] lstrlenW (lpString=".ppt") returned 4 [0048.158] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.158] lstrlenW (lpString=".zip") returned 4 [0048.158] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.158] lstrlenW (lpString=".rar") returned 4 [0048.158] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.158] lstrlenW (lpString=".bz2") returned 4 [0048.158] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.158] lstrlenW (lpString=".7z") returned 3 [0048.158] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.158] lstrlenW (lpString=".dbf") returned 4 [0048.158] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.158] lstrlenW (lpString=".1cd") returned 4 [0048.158] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.158] lstrlenW (lpString=".jpg") returned 4 [0048.158] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.158] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.158] lstrlenW (lpString=".doc") returned 4 [0048.158] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.158] lstrlenW (lpString=".docx") returned 5 [0048.158] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0048.158] lstrlenW (lpString=".pdf") returned 4 [0048.159] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.159] lstrlenW (lpString=".xls") returned 4 [0048.159] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.159] lstrlenW (lpString=".xlsx") returned 5 [0048.159] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0048.159] lstrlenW (lpString=".ppt") returned 4 [0048.159] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.159] lstrlenW (lpString=".zip") returned 4 [0048.159] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.159] lstrlenW (lpString=".rar") returned 4 [0048.159] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.159] lstrlenW (lpString=".bz2") returned 4 [0048.159] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.159] lstrlenW (lpString=".7z") returned 3 [0048.159] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.159] lstrlenW (lpString=".dbf") returned 4 [0048.159] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.159] lstrlenW (lpString=".1cd") returned 4 [0048.159] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.159] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0048.159] lstrlenW (lpString=".jpg") returned 4 [0048.159] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.159] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.159] lstrlenW (lpString="Proof.xml") returned 9 [0048.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.160] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1458) returned 1 [0048.160] CloseHandle (hObject=0x1a0) returned 1 [0048.160] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0048.160] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.160] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0048.160] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.160] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.160] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.160] GetLastError () returned 0x0 [0048.160] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0048.357] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0048.603] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.603] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.603] SetEndOfFile (hFile=0x19c) returned 1 [0048.603] CloseHandle (hObject=0x19c) returned 1 [0048.604] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.604] SetEndOfFile (hFile=0x1a0) returned 1 [0048.605] CloseHandle (hObject=0x1a0) returned 1 [0048.605] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.605] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0048.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.606] lstrlenW (lpString=".doc") returned 4 [0048.606] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.606] lstrlenW (lpString=".docx") returned 5 [0048.606] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0048.606] lstrlenW (lpString=".pdf") returned 4 [0048.606] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.606] lstrlenW (lpString=".xls") returned 4 [0048.606] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.606] lstrlenW (lpString=".xlsx") returned 5 [0048.606] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0048.606] lstrlenW (lpString=".ppt") returned 4 [0048.606] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.606] lstrlenW (lpString=".zip") returned 4 [0048.606] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.606] lstrlenW (lpString=".rar") returned 4 [0048.606] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.606] lstrlenW (lpString=".bz2") returned 4 [0048.606] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.606] lstrlenW (lpString=".7z") returned 3 [0048.606] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.606] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.606] lstrlenW (lpString=".dbf") returned 4 [0048.606] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.607] lstrlenW (lpString=".1cd") returned 4 [0048.607] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.607] lstrlenW (lpString=".jpg") returned 4 [0048.607] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.607] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.607] lstrlenW (lpString=".doc") returned 4 [0048.607] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.607] lstrlenW (lpString=".docx") returned 5 [0048.607] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0048.607] lstrlenW (lpString=".pdf") returned 4 [0048.607] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.607] lstrlenW (lpString=".xls") returned 4 [0048.607] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.609] lstrlenW (lpString=".xlsx") returned 5 [0048.609] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0048.609] lstrlenW (lpString=".ppt") returned 4 [0048.609] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.609] lstrlenW (lpString=".zip") returned 4 [0048.609] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.609] lstrlenW (lpString=".rar") returned 4 [0048.609] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.609] lstrlenW (lpString=".bz2") returned 4 [0048.609] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.609] lstrlenW (lpString=".7z") returned 3 [0048.609] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.609] lstrlenW (lpString=".dbf") returned 4 [0048.609] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.609] lstrlenW (lpString=".1cd") returned 4 [0048.609] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.609] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0048.609] lstrlenW (lpString=".jpg") returned 4 [0048.609] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.610] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.610] lstrlenW (lpString="Setup.xml") returned 9 [0048.610] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.821] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1872) returned 1 [0048.821] CloseHandle (hObject=0x17c) returned 1 [0048.821] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0048.821] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.821] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.821] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.821] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.822] GetLastError () returned 0x0 [0048.822] ReadFile (in: hFile=0x17c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x750, lpOverlapped=0x0) returned 1 [0048.823] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x760, lpOverlapped=0x0) returned 1 [0048.824] ReadFile (in: hFile=0x17c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.824] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0048.824] SetEndOfFile (hFile=0x1ac) returned 1 [0048.824] CloseHandle (hObject=0x1ac) returned 1 [0048.826] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.826] SetEndOfFile (hFile=0x17c) returned 1 [0048.827] CloseHandle (hObject=0x17c) returned 1 [0048.827] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.827] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.828] lstrlenW (lpString=".doc") returned 4 [0048.828] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.828] lstrlenW (lpString=".docx") returned 5 [0048.828] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.828] lstrlenW (lpString=".pdf") returned 4 [0048.828] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.828] lstrlenW (lpString=".xls") returned 4 [0048.828] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.828] lstrlenW (lpString=".xlsx") returned 5 [0048.828] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.828] lstrlenW (lpString=".ppt") returned 4 [0048.828] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.828] lstrlenW (lpString=".zip") returned 4 [0048.828] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.828] lstrlenW (lpString=".rar") returned 4 [0048.828] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.828] lstrlenW (lpString=".bz2") returned 4 [0048.828] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.828] lstrlenW (lpString=".7z") returned 3 [0048.828] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.828] lstrlenW (lpString=".dbf") returned 4 [0048.828] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.828] lstrlenW (lpString=".1cd") returned 4 [0048.828] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.828] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.828] lstrlenW (lpString=".jpg") returned 4 [0048.828] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.829] lstrlenW (lpString=".doc") returned 4 [0048.829] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.829] lstrlenW (lpString=".docx") returned 5 [0048.829] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0048.829] lstrlenW (lpString=".pdf") returned 4 [0048.829] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.829] lstrlenW (lpString=".xls") returned 4 [0048.829] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.829] lstrlenW (lpString=".xlsx") returned 5 [0048.829] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0048.829] lstrlenW (lpString=".ppt") returned 4 [0048.829] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.829] lstrlenW (lpString=".zip") returned 4 [0048.829] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.829] lstrlenW (lpString=".rar") returned 4 [0048.829] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.829] lstrlenW (lpString=".bz2") returned 4 [0048.829] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.829] lstrlenW (lpString=".7z") returned 3 [0048.829] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.829] lstrlenW (lpString=".dbf") returned 4 [0048.829] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.829] lstrlenW (lpString=".1cd") returned 4 [0048.829] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0048.829] lstrlenW (lpString=".jpg") returned 4 [0048.829] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.830] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.830] lstrlenW (lpString="branding.xml") returned 12 [0048.830] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.831] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=596341) returned 1 [0048.831] CloseHandle (hObject=0x17c) returned 1 [0048.831] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0048.831] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.831] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0048.831] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.831] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.831] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0048.831] GetLastError () returned 0x0 [0048.831] ReadFile (in: hFile=0x17c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x91975, lpOverlapped=0x0) returned 1 [0048.843] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0048.853] ReadFile (in: hFile=0x17c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.853] WriteFile (in: hFile=0x1ac, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.853] SetEndOfFile (hFile=0x1ac) returned 1 [0048.853] CloseHandle (hObject=0x1ac) returned 1 [0048.858] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.858] SetEndOfFile (hFile=0x17c) returned 1 [0048.864] CloseHandle (hObject=0x17c) returned 1 [0048.864] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0048.864] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0048.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.864] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.864] lstrlenW (lpString=".doc") returned 4 [0048.864] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.864] lstrlenW (lpString=".docx") returned 5 [0048.864] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0048.865] lstrlenW (lpString=".pdf") returned 4 [0048.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.865] lstrlenW (lpString=".xls") returned 4 [0048.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.865] lstrlenW (lpString=".xlsx") returned 5 [0048.865] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0048.865] lstrlenW (lpString=".ppt") returned 4 [0048.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.865] lstrlenW (lpString=".zip") returned 4 [0048.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.865] lstrlenW (lpString=".rar") returned 4 [0048.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.865] lstrlenW (lpString=".bz2") returned 4 [0048.865] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.865] lstrlenW (lpString=".7z") returned 3 [0048.865] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.865] lstrlenW (lpString=".dbf") returned 4 [0048.865] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.865] lstrlenW (lpString=".1cd") returned 4 [0048.865] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.865] lstrlenW (lpString=".jpg") returned 4 [0048.865] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.865] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.865] lstrlenW (lpString=".doc") returned 4 [0048.865] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0048.865] lstrlenW (lpString=".docx") returned 5 [0048.865] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0048.866] lstrlenW (lpString=".pdf") returned 4 [0048.866] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0048.866] lstrlenW (lpString=".xls") returned 4 [0048.866] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0048.866] lstrlenW (lpString=".xlsx") returned 5 [0048.866] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0048.866] lstrlenW (lpString=".ppt") returned 4 [0048.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0048.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.866] lstrlenW (lpString=".zip") returned 4 [0048.866] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0048.866] lstrlenW (lpString=".rar") returned 4 [0048.866] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0048.866] lstrlenW (lpString=".bz2") returned 4 [0048.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0048.866] lstrlenW (lpString=".7z") returned 3 [0048.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0048.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.866] lstrlenW (lpString=".dbf") returned 4 [0048.866] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0048.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.866] lstrlenW (lpString=".1cd") returned 4 [0048.866] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0048.866] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0048.866] lstrlenW (lpString=".jpg") returned 4 [0048.866] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0048.866] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0048.866] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0048.867] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.018] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5557) returned 1 [0049.018] CloseHandle (hObject=0x1ac) returned 1 [0049.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0049.019] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0049.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0049.019] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.019] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.019] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0049.491] GetLastError () returned 0x0 [0049.491] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0049.493] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0049.494] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.494] WriteFile (in: hFile=0x1b8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xee, lpOverlapped=0x0) returned 1 [0049.494] SetEndOfFile (hFile=0x1b8) returned 1 [0049.494] CloseHandle (hObject=0x1b8) returned 1 [0049.733] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.733] SetEndOfFile (hFile=0x1ac) returned 1 [0049.906] CloseHandle (hObject=0x1ac) returned 1 [0049.906] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0049.906] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0049.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.906] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.906] lstrlenW (lpString=".doc") returned 4 [0049.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString=".docx") returned 5 [0049.906] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0049.906] lstrlenW (lpString=".pdf") returned 4 [0049.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.906] lstrlenW (lpString=".xls") returned 4 [0049.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString=".xlsx") returned 5 [0049.907] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0049.907] lstrlenW (lpString=".ppt") returned 4 [0049.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.907] lstrlenW (lpString=".zip") returned 4 [0049.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.907] lstrlenW (lpString=".rar") returned 4 [0049.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString=".bz2") returned 4 [0049.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString=".7z") returned 3 [0049.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.907] lstrlenW (lpString=".dbf") returned 4 [0049.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.907] lstrlenW (lpString=".1cd") returned 4 [0049.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.907] lstrlenW (lpString=".jpg") returned 4 [0049.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.907] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.907] lstrlenW (lpString=".doc") returned 4 [0049.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0049.907] lstrlenW (lpString=".docx") returned 5 [0049.907] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0049.908] lstrlenW (lpString=".pdf") returned 4 [0049.908] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0049.908] lstrlenW (lpString=".xls") returned 4 [0049.908] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0049.908] lstrlenW (lpString=".xlsx") returned 5 [0049.908] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0049.908] lstrlenW (lpString=".ppt") returned 4 [0049.908] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0049.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.908] lstrlenW (lpString=".zip") returned 4 [0049.908] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0049.908] lstrlenW (lpString=".rar") returned 4 [0049.908] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0049.908] lstrlenW (lpString=".bz2") returned 4 [0049.908] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0049.908] lstrlenW (lpString=".7z") returned 3 [0049.908] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0049.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.908] lstrlenW (lpString=".dbf") returned 4 [0049.908] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0049.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.908] lstrlenW (lpString=".1cd") returned 4 [0049.908] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0049.908] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0049.908] lstrlenW (lpString=".jpg") returned 4 [0049.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0049.909] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0049.909] lstrlenW (lpString="AccessMUI.xml") returned 13 [0049.909] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.115] GetFileSizeEx (in: hFile=0x1ac, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1349) returned 1 [0050.115] CloseHandle (hObject=0x1ac) returned 1 [0050.115] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0050.115] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0050.116] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.116] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.116] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0050.116] GetLastError () returned 0x0 [0050.116] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x545, lpOverlapped=0x0) returned 1 [0050.131] WriteFile (in: hFile=0x180, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x550, lpOverlapped=0x0) returned 1 [0050.132] ReadFile (in: hFile=0x1ac, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.132] WriteFile (in: hFile=0x180, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xee, lpOverlapped=0x0) returned 1 [0050.132] SetEndOfFile (hFile=0x180) returned 1 [0050.132] CloseHandle (hObject=0x180) returned 1 [0050.133] SetFilePointerEx (in: hFile=0x1ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.133] SetEndOfFile (hFile=0x1ac) returned 1 [0050.134] CloseHandle (hObject=0x1ac) returned 1 [0050.134] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.136] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0050.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.136] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.136] lstrlenW (lpString=".doc") returned 4 [0050.136] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.137] lstrlenW (lpString=".docx") returned 5 [0050.137] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0050.137] lstrlenW (lpString=".pdf") returned 4 [0050.137] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.137] lstrlenW (lpString=".xls") returned 4 [0050.137] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.137] lstrlenW (lpString=".xlsx") returned 5 [0050.137] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0050.137] lstrlenW (lpString=".ppt") returned 4 [0050.137] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.137] lstrlenW (lpString=".zip") returned 4 [0050.137] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.137] lstrlenW (lpString=".rar") returned 4 [0050.137] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.137] lstrlenW (lpString=".bz2") returned 4 [0050.137] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.137] lstrlenW (lpString=".7z") returned 3 [0050.137] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.137] lstrlenW (lpString=".dbf") returned 4 [0050.137] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.137] lstrlenW (lpString=".1cd") returned 4 [0050.137] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.137] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.137] lstrlenW (lpString=".jpg") returned 4 [0050.137] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.360] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.360] lstrlenW (lpString=".doc") returned 4 [0050.360] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".docx") returned 5 [0050.360] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0050.360] lstrlenW (lpString=".pdf") returned 4 [0050.360] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0050.360] lstrlenW (lpString=".xls") returned 4 [0050.360] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".xlsx") returned 5 [0050.361] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0050.361] lstrlenW (lpString=".ppt") returned 4 [0050.361] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.361] lstrlenW (lpString=".zip") returned 4 [0050.361] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0050.361] lstrlenW (lpString=".rar") returned 4 [0050.361] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".bz2") returned 4 [0050.361] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString=".7z") returned 3 [0050.361] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0050.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.361] lstrlenW (lpString=".dbf") returned 4 [0050.361] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.361] lstrlenW (lpString=".1cd") returned 4 [0050.361] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0050.361] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0050.361] lstrlenW (lpString=".jpg") returned 4 [0050.361] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0050.361] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0050.361] lstrlenW (lpString="Setup.xml") returned 9 [0050.361] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0050.902] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=31094) returned 1 [0050.902] CloseHandle (hObject=0x1b4) returned 1 [0050.902] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0050.902] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0050.902] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.902] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.902] GetLastError () returned 0x0 [0050.902] ReadFile (in: hFile=0x1b4, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x7976, lpOverlapped=0x0) returned 1 [0051.108] WriteFile (in: hFile=0x178, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0051.109] ReadFile (in: hFile=0x1b4, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.110] WriteFile (in: hFile=0x178, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0051.110] SetEndOfFile (hFile=0x178) returned 1 [0051.110] CloseHandle (hObject=0x178) returned 1 [0051.111] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.111] SetEndOfFile (hFile=0x1b4) returned 1 [0051.112] CloseHandle (hObject=0x1b4) returned 1 [0051.112] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0051.112] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0051.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.112] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.112] lstrlenW (lpString=".doc") returned 4 [0051.112] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.112] lstrlenW (lpString=".docx") returned 5 [0051.112] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0051.112] lstrlenW (lpString=".pdf") returned 4 [0051.112] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.113] lstrlenW (lpString=".xls") returned 4 [0051.113] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.113] lstrlenW (lpString=".xlsx") returned 5 [0051.113] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0051.113] lstrlenW (lpString=".ppt") returned 4 [0051.113] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.113] lstrlenW (lpString=".zip") returned 4 [0051.113] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.113] lstrlenW (lpString=".rar") returned 4 [0051.113] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.113] lstrlenW (lpString=".bz2") returned 4 [0051.113] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.113] lstrlenW (lpString=".7z") returned 3 [0051.113] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.113] lstrlenW (lpString=".dbf") returned 4 [0051.113] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.113] lstrlenW (lpString=".1cd") returned 4 [0051.113] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.113] lstrlenW (lpString=".jpg") returned 4 [0051.113] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.113] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.114] lstrlenW (lpString=".doc") returned 4 [0051.114] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.114] lstrlenW (lpString=".docx") returned 5 [0051.114] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0051.114] lstrlenW (lpString=".pdf") returned 4 [0051.114] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.114] lstrlenW (lpString=".xls") returned 4 [0051.114] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.114] lstrlenW (lpString=".xlsx") returned 5 [0051.114] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0051.114] lstrlenW (lpString=".ppt") returned 4 [0051.114] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.114] lstrlenW (lpString=".zip") returned 4 [0051.114] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.114] lstrlenW (lpString=".rar") returned 4 [0051.114] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.114] lstrlenW (lpString=".bz2") returned 4 [0051.114] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.114] lstrlenW (lpString=".7z") returned 3 [0051.114] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.114] lstrlenW (lpString=".dbf") returned 4 [0051.114] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.114] lstrlenW (lpString=".1cd") returned 4 [0051.114] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.114] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0051.114] lstrlenW (lpString=".jpg") returned 4 [0051.114] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.115] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.115] lstrlenW (lpString="Content.xml") returned 11 [0051.115] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0051.290] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=27045) returned 1 [0051.297] CloseHandle (hObject=0x1b4) returned 1 [0051.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0051.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.299] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.299] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.299] lstrlenW (lpString=".doc") returned 4 [0051.299] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.299] lstrlenW (lpString=".docx") returned 5 [0051.299] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0051.299] lstrlenW (lpString=".pdf") returned 4 [0051.299] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.299] lstrlenW (lpString=".xls") returned 4 [0051.299] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.299] lstrlenW (lpString=".xlsx") returned 5 [0051.299] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0051.299] lstrlenW (lpString=".ppt") returned 4 [0051.299] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.300] lstrlenW (lpString=".zip") returned 4 [0051.300] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.300] lstrlenW (lpString=".rar") returned 4 [0051.300] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.300] lstrlenW (lpString=".bz2") returned 4 [0051.300] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.300] lstrlenW (lpString=".7z") returned 3 [0051.300] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.300] lstrlenW (lpString=".dbf") returned 4 [0051.300] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.300] lstrlenW (lpString=".1cd") returned 4 [0051.300] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.300] lstrlenW (lpString=".jpg") returned 4 [0051.300] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.300] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.300] lstrlenW (lpString=".doc") returned 4 [0051.300] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.300] lstrlenW (lpString=".docx") returned 5 [0051.300] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0051.300] lstrlenW (lpString=".pdf") returned 4 [0051.301] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.301] lstrlenW (lpString=".xls") returned 4 [0051.301] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.301] lstrlenW (lpString=".xlsx") returned 5 [0051.301] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0051.301] lstrlenW (lpString=".ppt") returned 4 [0051.301] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.301] lstrlenW (lpString=".zip") returned 4 [0051.301] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.301] lstrlenW (lpString=".rar") returned 4 [0051.301] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.301] lstrlenW (lpString=".bz2") returned 4 [0051.301] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.301] lstrlenW (lpString=".7z") returned 3 [0051.301] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.301] lstrlenW (lpString=".dbf") returned 4 [0051.301] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.301] lstrlenW (lpString=".1cd") returned 4 [0051.301] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0051.301] lstrlenW (lpString=".jpg") returned 4 [0051.301] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.301] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.301] lstrlenW (lpString="oskmenubase.xml") returned 15 [0051.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.801] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=471) returned 1 [0051.801] CloseHandle (hObject=0x1a0) returned 1 [0051.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml")) returned 0x20 [0051.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.802] lstrlenW (lpString=".doc") returned 4 [0051.802] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.802] lstrlenW (lpString=".docx") returned 5 [0051.802] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.802] lstrlenW (lpString=".pdf") returned 4 [0051.802] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.802] lstrlenW (lpString=".xls") returned 4 [0051.802] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.802] lstrlenW (lpString=".xlsx") returned 5 [0051.802] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.802] lstrlenW (lpString=".ppt") returned 4 [0051.802] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.802] lstrlenW (lpString=".zip") returned 4 [0051.802] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.802] lstrlenW (lpString=".rar") returned 4 [0051.802] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.803] lstrlenW (lpString=".bz2") returned 4 [0051.803] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.803] lstrlenW (lpString=".7z") returned 3 [0051.803] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.803] lstrlenW (lpString=".dbf") returned 4 [0051.803] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.803] lstrlenW (lpString=".1cd") returned 4 [0051.803] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.803] lstrlenW (lpString=".jpg") returned 4 [0051.803] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.803] lstrlenW (lpString=".doc") returned 4 [0051.803] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.803] lstrlenW (lpString=".docx") returned 5 [0051.803] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.803] lstrlenW (lpString=".pdf") returned 4 [0051.803] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.803] lstrlenW (lpString=".xls") returned 4 [0051.803] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.803] lstrlenW (lpString=".xlsx") returned 5 [0051.803] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.804] lstrlenW (lpString=".ppt") returned 4 [0051.804] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.804] lstrlenW (lpString=".zip") returned 4 [0051.804] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.804] lstrlenW (lpString=".rar") returned 4 [0051.804] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.804] lstrlenW (lpString=".bz2") returned 4 [0051.804] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.804] lstrlenW (lpString=".7z") returned 3 [0051.804] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.804] lstrlenW (lpString=".dbf") returned 4 [0051.804] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.804] lstrlenW (lpString=".1cd") returned 4 [0051.804] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskmenu\\oskmenubase.xml") returned 88 [0051.804] lstrlenW (lpString=".jpg") returned 4 [0051.804] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.804] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.805] lstrlenW (lpString="osknumpadbase.xml") returned 17 [0051.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.805] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1437) returned 1 [0051.805] CloseHandle (hObject=0x1a0) returned 1 [0051.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml")) returned 0x20 [0051.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0051.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0051.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.805] lstrlenW (lpString=".doc") returned 4 [0051.805] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.805] lstrlenW (lpString=".docx") returned 5 [0051.806] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.806] lstrlenW (lpString=".pdf") returned 4 [0051.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.806] lstrlenW (lpString=".xls") returned 4 [0051.806] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.806] lstrlenW (lpString=".xlsx") returned 5 [0051.806] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.806] lstrlenW (lpString=".ppt") returned 4 [0051.806] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.806] lstrlenW (lpString=".zip") returned 4 [0051.806] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.806] lstrlenW (lpString=".rar") returned 4 [0051.806] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.806] lstrlenW (lpString=".bz2") returned 4 [0051.806] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.806] lstrlenW (lpString=".7z") returned 3 [0051.806] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.806] lstrlenW (lpString=".dbf") returned 4 [0051.806] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.806] lstrlenW (lpString=".1cd") returned 4 [0051.806] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.807] lstrlenW (lpString=".jpg") returned 4 [0051.807] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.807] lstrlenW (lpString=".doc") returned 4 [0051.807] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0051.807] lstrlenW (lpString=".docx") returned 5 [0051.807] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0051.807] lstrlenW (lpString=".pdf") returned 4 [0051.807] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0051.807] lstrlenW (lpString=".xls") returned 4 [0051.807] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0051.807] lstrlenW (lpString=".xlsx") returned 5 [0051.807] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0051.807] lstrlenW (lpString=".ppt") returned 4 [0051.807] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0051.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.807] lstrlenW (lpString=".zip") returned 4 [0051.807] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0051.807] lstrlenW (lpString=".rar") returned 4 [0051.807] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0051.807] lstrlenW (lpString=".bz2") returned 4 [0051.807] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0051.807] lstrlenW (lpString=".7z") returned 3 [0051.807] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.808] lstrlenW (lpString=".dbf") returned 4 [0051.808] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.808] lstrlenW (lpString=".1cd") returned 4 [0051.808] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0051.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad\\osknumpadbase.xml") returned 92 [0051.808] lstrlenW (lpString=".jpg") returned 4 [0051.808] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0051.808] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0051.808] lstrlenW (lpString="osknumpad.xml") returned 13 [0051.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0052.122] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=219) returned 1 [0052.122] CloseHandle (hObject=0x1d8) returned 1 [0052.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml")) returned 0x20 [0052.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.123] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\osknumpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.123] lstrlenW (lpString=".doc") returned 4 [0052.123] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.123] lstrlenW (lpString=".docx") returned 5 [0052.123] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0052.123] lstrlenW (lpString=".pdf") returned 4 [0052.123] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.123] lstrlenW (lpString=".xls") returned 4 [0052.123] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.123] lstrlenW (lpString=".xlsx") returned 5 [0052.123] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0052.123] lstrlenW (lpString=".ppt") returned 4 [0052.123] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.123] lstrlenW (lpString=".zip") returned 4 [0052.123] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.123] lstrlenW (lpString=".rar") returned 4 [0052.123] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.123] lstrlenW (lpString=".bz2") returned 4 [0052.123] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.123] lstrlenW (lpString=".7z") returned 3 [0052.123] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.123] lstrlenW (lpString=".dbf") returned 4 [0052.123] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.123] lstrlenW (lpString=".1cd") returned 4 [0052.123] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.123] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.124] lstrlenW (lpString=".jpg") returned 4 [0052.124] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.124] lstrlenW (lpString=".doc") returned 4 [0052.124] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.124] lstrlenW (lpString=".docx") returned 5 [0052.124] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0052.124] lstrlenW (lpString=".pdf") returned 4 [0052.124] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.124] lstrlenW (lpString=".xls") returned 4 [0052.124] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.124] lstrlenW (lpString=".xlsx") returned 5 [0052.124] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0052.124] lstrlenW (lpString=".ppt") returned 4 [0052.124] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.124] lstrlenW (lpString=".zip") returned 4 [0052.124] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.124] lstrlenW (lpString=".rar") returned 4 [0052.124] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.124] lstrlenW (lpString=".bz2") returned 4 [0052.124] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.124] lstrlenW (lpString=".7z") returned 3 [0052.124] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.124] lstrlenW (lpString=".dbf") returned 4 [0052.124] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.124] lstrlenW (lpString=".1cd") returned 4 [0052.124] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.124] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\osknumpad.xml") returned 78 [0052.125] lstrlenW (lpString=".jpg") returned 4 [0052.125] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.125] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0052.125] lstrlenW (lpString="oskpred.xml") returned 11 [0052.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0052.125] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=215) returned 1 [0052.125] CloseHandle (hObject=0x1d8) returned 1 [0052.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml")) returned 0x20 [0052.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.125] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\oskpred.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.125] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.125] lstrlenW (lpString=".doc") returned 4 [0052.125] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.125] lstrlenW (lpString=".docx") returned 5 [0052.125] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0052.126] lstrlenW (lpString=".pdf") returned 4 [0052.126] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.126] lstrlenW (lpString=".xls") returned 4 [0052.126] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.126] lstrlenW (lpString=".xlsx") returned 5 [0052.126] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0052.126] lstrlenW (lpString=".ppt") returned 4 [0052.126] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.126] lstrlenW (lpString=".zip") returned 4 [0052.126] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.126] lstrlenW (lpString=".rar") returned 4 [0052.126] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.126] lstrlenW (lpString=".bz2") returned 4 [0052.126] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.126] lstrlenW (lpString=".7z") returned 3 [0052.126] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.126] lstrlenW (lpString=".dbf") returned 4 [0052.126] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.126] lstrlenW (lpString=".1cd") returned 4 [0052.126] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.126] lstrlenW (lpString=".jpg") returned 4 [0052.126] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.126] lstrlenW (lpString=".doc") returned 4 [0052.126] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.126] lstrlenW (lpString=".docx") returned 5 [0052.126] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0052.127] lstrlenW (lpString=".pdf") returned 4 [0052.127] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.127] lstrlenW (lpString=".xls") returned 4 [0052.127] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.127] lstrlenW (lpString=".xlsx") returned 5 [0052.127] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0052.127] lstrlenW (lpString=".ppt") returned 4 [0052.127] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.127] lstrlenW (lpString=".zip") returned 4 [0052.127] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.127] lstrlenW (lpString=".rar") returned 4 [0052.127] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.127] lstrlenW (lpString=".bz2") returned 4 [0052.127] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.127] lstrlenW (lpString=".7z") returned 3 [0052.127] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.127] lstrlenW (lpString=".dbf") returned 4 [0052.159] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.159] lstrlenW (lpString=".1cd") returned 4 [0052.159] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\oskpred.xml") returned 76 [0052.159] lstrlenW (lpString=".jpg") returned 4 [0052.159] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.159] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0052.159] lstrlenW (lpString="ea-sym.xml") returned 10 [0052.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0052.160] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=749) returned 1 [0052.160] CloseHandle (hObject=0x1d8) returned 1 [0052.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml")) returned 0x20 [0052.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.160] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.160] lstrlenW (lpString=".doc") returned 4 [0052.160] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.160] lstrlenW (lpString=".docx") returned 5 [0052.160] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0052.160] lstrlenW (lpString=".pdf") returned 4 [0052.161] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.161] lstrlenW (lpString=".xls") returned 4 [0052.161] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.161] lstrlenW (lpString=".xlsx") returned 5 [0052.161] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0052.161] lstrlenW (lpString=".ppt") returned 4 [0052.161] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.161] lstrlenW (lpString=".zip") returned 4 [0052.161] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.161] lstrlenW (lpString=".rar") returned 4 [0052.161] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.161] lstrlenW (lpString=".bz2") returned 4 [0052.161] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.161] lstrlenW (lpString=".7z") returned 3 [0052.161] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.161] lstrlenW (lpString=".dbf") returned 4 [0052.161] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.161] lstrlenW (lpString=".1cd") returned 4 [0052.161] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.161] lstrlenW (lpString=".jpg") returned 4 [0052.161] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.161] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.161] lstrlenW (lpString=".doc") returned 4 [0052.161] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.161] lstrlenW (lpString=".docx") returned 5 [0052.161] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0052.161] lstrlenW (lpString=".pdf") returned 4 [0052.161] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.162] lstrlenW (lpString=".xls") returned 4 [0052.162] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.162] lstrlenW (lpString=".xlsx") returned 5 [0052.162] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0052.162] lstrlenW (lpString=".ppt") returned 4 [0052.162] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.162] lstrlenW (lpString=".zip") returned 4 [0052.162] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.162] lstrlenW (lpString=".rar") returned 4 [0052.162] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.162] lstrlenW (lpString=".bz2") returned 4 [0052.162] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.162] lstrlenW (lpString=".7z") returned 3 [0052.162] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.162] lstrlenW (lpString=".dbf") returned 4 [0052.162] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.162] lstrlenW (lpString=".1cd") returned 4 [0052.162] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ea-sym.xml") returned 83 [0052.162] lstrlenW (lpString=".jpg") returned 4 [0052.162] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.162] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0052.162] lstrlenW (lpString="ja-jp-sym.xml") returned 13 [0052.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0052.163] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=749) returned 1 [0052.163] CloseHandle (hObject=0x1d8) returned 1 [0052.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml")) returned 0x20 [0052.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.164] lstrlenW (lpString=".doc") returned 4 [0052.164] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.164] lstrlenW (lpString=".docx") returned 5 [0052.164] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0052.164] lstrlenW (lpString=".pdf") returned 4 [0052.164] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.164] lstrlenW (lpString=".xls") returned 4 [0052.164] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.164] lstrlenW (lpString=".xlsx") returned 5 [0052.164] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0052.164] lstrlenW (lpString=".ppt") returned 4 [0052.164] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.164] lstrlenW (lpString=".zip") returned 4 [0052.164] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.164] lstrlenW (lpString=".rar") returned 4 [0052.164] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.164] lstrlenW (lpString=".bz2") returned 4 [0052.164] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.164] lstrlenW (lpString=".7z") returned 3 [0052.164] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.164] lstrlenW (lpString=".dbf") returned 4 [0052.164] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.165] lstrlenW (lpString=".1cd") returned 4 [0052.165] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.165] lstrlenW (lpString=".jpg") returned 4 [0052.165] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.165] lstrlenW (lpString=".doc") returned 4 [0052.165] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.165] lstrlenW (lpString=".docx") returned 5 [0052.165] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0052.165] lstrlenW (lpString=".pdf") returned 4 [0052.165] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.165] lstrlenW (lpString=".xls") returned 4 [0052.165] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.165] lstrlenW (lpString=".xlsx") returned 5 [0052.165] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0052.165] lstrlenW (lpString=".ppt") returned 4 [0052.165] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.165] lstrlenW (lpString=".zip") returned 4 [0052.165] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.165] lstrlenW (lpString=".rar") returned 4 [0052.165] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.165] lstrlenW (lpString=".bz2") returned 4 [0052.165] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.165] lstrlenW (lpString=".7z") returned 3 [0052.165] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.165] lstrlenW (lpString=".dbf") returned 4 [0052.165] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.166] lstrlenW (lpString=".1cd") returned 4 [0052.166] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\ja-jp-sym.xml") returned 86 [0052.166] lstrlenW (lpString=".jpg") returned 4 [0052.166] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.166] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0052.166] lstrlenW (lpString="symbase.xml") returned 11 [0052.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0052.166] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2764) returned 1 [0052.166] CloseHandle (hObject=0x1d8) returned 1 [0052.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml")) returned 0x20 [0052.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols\\symbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.166] lstrlenW (lpString=".doc") returned 4 [0052.167] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.167] lstrlenW (lpString=".docx") returned 5 [0052.167] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0052.167] lstrlenW (lpString=".pdf") returned 4 [0052.167] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.167] lstrlenW (lpString=".xls") returned 4 [0052.167] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.167] lstrlenW (lpString=".xlsx") returned 5 [0052.167] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0052.167] lstrlenW (lpString=".ppt") returned 4 [0052.167] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.167] lstrlenW (lpString=".zip") returned 4 [0052.167] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.167] lstrlenW (lpString=".rar") returned 4 [0052.167] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.167] lstrlenW (lpString=".bz2") returned 4 [0052.167] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.167] lstrlenW (lpString=".7z") returned 3 [0052.167] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.167] lstrlenW (lpString=".dbf") returned 4 [0052.167] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.167] lstrlenW (lpString=".1cd") returned 4 [0052.167] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.167] lstrlenW (lpString=".jpg") returned 4 [0052.167] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.167] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.167] lstrlenW (lpString=".doc") returned 4 [0052.167] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.168] lstrlenW (lpString=".docx") returned 5 [0052.168] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0052.168] lstrlenW (lpString=".pdf") returned 4 [0052.168] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.168] lstrlenW (lpString=".xls") returned 4 [0052.168] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.168] lstrlenW (lpString=".xlsx") returned 5 [0052.168] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0052.168] lstrlenW (lpString=".ppt") returned 4 [0052.168] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.168] lstrlenW (lpString=".zip") returned 4 [0052.168] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.168] lstrlenW (lpString=".rar") returned 4 [0052.168] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.168] lstrlenW (lpString=".bz2") returned 4 [0052.168] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.168] lstrlenW (lpString=".7z") returned 3 [0052.168] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.168] lstrlenW (lpString=".dbf") returned 4 [0052.168] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.168] lstrlenW (lpString=".1cd") returned 4 [0052.168] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.168] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols\\symbase.xml") returned 84 [0052.168] lstrlenW (lpString=".jpg") returned 4 [0052.168] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.168] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0052.169] lstrlenW (lpString="symbols.xml") returned 11 [0052.169] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0052.169] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=591) returned 1 [0052.169] CloseHandle (hObject=0x1d8) returned 1 [0052.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml")) returned 0x20 [0052.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.170] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\symbols.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.170] lstrlenW (lpString=".doc") returned 4 [0052.170] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.170] lstrlenW (lpString=".docx") returned 5 [0052.170] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0052.170] lstrlenW (lpString=".pdf") returned 4 [0052.170] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.170] lstrlenW (lpString=".xls") returned 4 [0052.170] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.170] lstrlenW (lpString=".xlsx") returned 5 [0052.170] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0052.170] lstrlenW (lpString=".ppt") returned 4 [0052.170] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.170] lstrlenW (lpString=".zip") returned 4 [0052.170] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.170] lstrlenW (lpString=".rar") returned 4 [0052.170] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.170] lstrlenW (lpString=".bz2") returned 4 [0052.170] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.170] lstrlenW (lpString=".7z") returned 3 [0052.170] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.170] lstrlenW (lpString=".dbf") returned 4 [0052.170] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.170] lstrlenW (lpString=".1cd") returned 4 [0052.170] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.170] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.171] lstrlenW (lpString=".jpg") returned 4 [0052.171] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.171] lstrlenW (lpString=".doc") returned 4 [0052.171] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.171] lstrlenW (lpString=".docx") returned 5 [0052.171] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0052.171] lstrlenW (lpString=".pdf") returned 4 [0052.171] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.171] lstrlenW (lpString=".xls") returned 4 [0052.171] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.171] lstrlenW (lpString=".xlsx") returned 5 [0052.171] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0052.171] lstrlenW (lpString=".ppt") returned 4 [0052.171] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.171] lstrlenW (lpString=".zip") returned 4 [0052.171] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.171] lstrlenW (lpString=".rar") returned 4 [0052.171] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.171] lstrlenW (lpString=".bz2") returned 4 [0052.171] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.171] lstrlenW (lpString=".7z") returned 3 [0052.171] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.171] lstrlenW (lpString=".dbf") returned 4 [0052.171] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.171] lstrlenW (lpString=".1cd") returned 4 [0052.171] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0052.171] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\symbols.xml") returned 76 [0052.172] lstrlenW (lpString=".jpg") returned 4 [0052.172] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0052.172] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0052.172] lstrlenW (lpString="webbase.xml") returned 11 [0052.172] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0052.173] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1166) returned 1 [0052.173] CloseHandle (hObject=0x1d8) returned 1 [0052.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml")) returned 0x20 [0052.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0052.173] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\web\\webbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0052.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0052.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0052.173] lstrlenW (lpString=".doc") returned 4 [0052.173] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0052.173] lstrlenW (lpString=".docx") returned 5 [0052.173] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0052.173] lstrlenW (lpString=".pdf") returned 4 [0052.173] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0052.173] lstrlenW (lpString=".xls") returned 4 [0052.173] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0052.173] lstrlenW (lpString=".xlsx") returned 5 [0052.173] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0052.173] lstrlenW (lpString=".ppt") returned 4 [0052.173] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0052.173] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0052.173] lstrlenW (lpString=".zip") returned 4 [0052.173] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0052.173] lstrlenW (lpString=".rar") returned 4 [0052.173] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0052.173] lstrlenW (lpString=".bz2") returned 4 [0052.174] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0052.174] lstrlenW (lpString=".7z") returned 3 [0052.174] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0052.174] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\web\\webbase.xml") returned 80 [0052.174] lstrlenW (lpString=".dbf") returned 4 [0052.174] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0053.408] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0053.691] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.691] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.691] GetLastError () returned 0x0 [0053.691] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x61d, lpOverlapped=0x0) returned 1 [0053.693] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x620, lpOverlapped=0x0) returned 1 [0053.694] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.694] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.694] SetEndOfFile (hFile=0x1f0) returned 1 [0053.694] CloseHandle (hObject=0x1f0) returned 1 [0053.695] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.695] SetEndOfFile (hFile=0x1ec) returned 1 [0053.696] CloseHandle (hObject=0x1ec) returned 1 [0053.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.696] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0053.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.696] lstrlenW (lpString=".doc") returned 4 [0053.696] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.696] lstrlenW (lpString=".docx") returned 5 [0053.697] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0053.697] lstrlenW (lpString=".pdf") returned 4 [0053.697] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.697] lstrlenW (lpString=".xls") returned 4 [0053.697] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.697] lstrlenW (lpString=".xlsx") returned 5 [0053.697] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0053.697] lstrlenW (lpString=".ppt") returned 4 [0053.697] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.697] lstrlenW (lpString=".zip") returned 4 [0053.697] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.697] lstrlenW (lpString=".rar") returned 4 [0053.697] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.697] lstrlenW (lpString=".bz2") returned 4 [0053.697] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.697] lstrlenW (lpString=".7z") returned 3 [0053.697] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.697] lstrlenW (lpString=".dbf") returned 4 [0053.697] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.697] lstrlenW (lpString=".1cd") returned 4 [0053.697] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.697] lstrlenW (lpString=".jpg") returned 4 [0053.697] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.697] lstrlenW (lpString=".doc") returned 4 [0053.697] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.697] lstrlenW (lpString=".docx") returned 5 [0053.698] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0053.698] lstrlenW (lpString=".pdf") returned 4 [0053.698] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.698] lstrlenW (lpString=".xls") returned 4 [0053.698] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.698] lstrlenW (lpString=".xlsx") returned 5 [0053.698] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0053.698] lstrlenW (lpString=".ppt") returned 4 [0053.698] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.698] lstrlenW (lpString=".zip") returned 4 [0053.698] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.698] lstrlenW (lpString=".rar") returned 4 [0053.698] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.698] lstrlenW (lpString=".bz2") returned 4 [0053.698] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.698] lstrlenW (lpString=".7z") returned 3 [0053.698] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.698] lstrlenW (lpString=".dbf") returned 4 [0053.698] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.698] lstrlenW (lpString=".1cd") returned 4 [0053.698] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0053.698] lstrlenW (lpString=".jpg") returned 4 [0053.698] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.698] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0053.699] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0053.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.699] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=913) returned 1 [0053.699] CloseHandle (hObject=0x1ec) returned 1 [0053.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0053.699] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.699] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.699] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.701] GetLastError () returned 0x0 [0053.701] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x391, lpOverlapped=0x0) returned 1 [0053.703] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0053.706] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.706] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xee, lpOverlapped=0x0) returned 1 [0053.706] SetEndOfFile (hFile=0x1f0) returned 1 [0053.707] CloseHandle (hObject=0x1f0) returned 1 [0053.707] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.707] SetEndOfFile (hFile=0x1ec) returned 1 [0053.708] CloseHandle (hObject=0x1ec) returned 1 [0053.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.708] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0053.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.709] lstrlenW (lpString=".doc") returned 4 [0053.709] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.709] lstrlenW (lpString=".docx") returned 5 [0053.709] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0053.709] lstrlenW (lpString=".pdf") returned 4 [0053.709] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.709] lstrlenW (lpString=".xls") returned 4 [0053.709] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.709] lstrlenW (lpString=".xlsx") returned 5 [0053.709] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0053.709] lstrlenW (lpString=".ppt") returned 4 [0053.709] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.709] lstrlenW (lpString=".zip") returned 4 [0053.709] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.709] lstrlenW (lpString=".rar") returned 4 [0053.709] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.709] lstrlenW (lpString=".bz2") returned 4 [0053.709] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.709] lstrlenW (lpString=".7z") returned 3 [0053.709] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.709] lstrlenW (lpString=".dbf") returned 4 [0053.709] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.709] lstrlenW (lpString=".1cd") returned 4 [0053.709] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.710] lstrlenW (lpString=".jpg") returned 4 [0053.710] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.710] lstrlenW (lpString=".doc") returned 4 [0053.710] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.710] lstrlenW (lpString=".docx") returned 5 [0053.710] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0053.710] lstrlenW (lpString=".pdf") returned 4 [0053.710] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.710] lstrlenW (lpString=".xls") returned 4 [0053.710] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.710] lstrlenW (lpString=".xlsx") returned 5 [0053.710] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0053.710] lstrlenW (lpString=".ppt") returned 4 [0053.710] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.710] lstrlenW (lpString=".zip") returned 4 [0053.710] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.710] lstrlenW (lpString=".rar") returned 4 [0053.710] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.710] lstrlenW (lpString=".bz2") returned 4 [0053.710] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.710] lstrlenW (lpString=".7z") returned 3 [0053.710] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.710] lstrlenW (lpString=".dbf") returned 4 [0053.710] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.710] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.710] lstrlenW (lpString=".1cd") returned 4 [0053.711] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0053.711] lstrlenW (lpString=".jpg") returned 4 [0053.711] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.711] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0053.711] lstrlenW (lpString="SETUP.XML") returned 9 [0053.711] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.712] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1452) returned 1 [0053.712] CloseHandle (hObject=0x1ec) returned 1 [0053.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0053.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.712] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.712] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0053.712] GetLastError () returned 0x0 [0053.712] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0053.714] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0053.715] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.715] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0053.715] SetEndOfFile (hFile=0x1f0) returned 1 [0053.715] CloseHandle (hObject=0x1f0) returned 1 [0053.716] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.716] SetEndOfFile (hFile=0x1ec) returned 1 [0053.717] CloseHandle (hObject=0x1ec) returned 1 [0053.717] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0053.717] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0053.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.717] lstrlenW (lpString=".doc") returned 4 [0053.717] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.717] lstrlenW (lpString=".docx") returned 5 [0053.717] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0053.717] lstrlenW (lpString=".pdf") returned 4 [0053.717] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.717] lstrlenW (lpString=".xls") returned 4 [0053.717] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.717] lstrlenW (lpString=".xlsx") returned 5 [0053.717] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0053.718] lstrlenW (lpString=".ppt") returned 4 [0053.718] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.718] lstrlenW (lpString=".zip") returned 4 [0053.718] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.718] lstrlenW (lpString=".rar") returned 4 [0053.718] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.718] lstrlenW (lpString=".bz2") returned 4 [0053.718] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.718] lstrlenW (lpString=".7z") returned 3 [0053.718] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.718] lstrlenW (lpString=".dbf") returned 4 [0053.718] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.718] lstrlenW (lpString=".1cd") returned 4 [0053.718] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.718] lstrlenW (lpString=".jpg") returned 4 [0053.718] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.718] lstrlenW (lpString=".doc") returned 4 [0053.719] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0053.719] lstrlenW (lpString=".docx") returned 5 [0053.719] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0053.719] lstrlenW (lpString=".pdf") returned 4 [0053.719] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0053.719] lstrlenW (lpString=".xls") returned 4 [0053.719] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0053.719] lstrlenW (lpString=".xlsx") returned 5 [0053.719] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0053.719] lstrlenW (lpString=".ppt") returned 4 [0053.719] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0053.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.719] lstrlenW (lpString=".zip") returned 4 [0053.719] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0053.719] lstrlenW (lpString=".rar") returned 4 [0053.719] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0053.719] lstrlenW (lpString=".bz2") returned 4 [0053.719] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0053.719] lstrlenW (lpString=".7z") returned 3 [0053.719] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0053.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.719] lstrlenW (lpString=".dbf") returned 4 [0053.719] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0053.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.719] lstrlenW (lpString=".1cd") returned 4 [0053.719] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0053.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0053.719] lstrlenW (lpString=".jpg") returned 4 [0053.719] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0053.720] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0053.720] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0053.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.720] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1231) returned 1 [0053.720] CloseHandle (hObject=0x1ec) returned 1 [0053.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0053.720] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.720] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0053.720] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.720] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0054.197] GetLastError () returned 0x0 [0054.197] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0054.198] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0054.765] ReadFile (in: hFile=0x1ec, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.765] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0054.765] SetEndOfFile (hFile=0x204) returned 1 [0054.765] CloseHandle (hObject=0x204) returned 1 [0054.766] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.766] SetEndOfFile (hFile=0x1ec) returned 1 [0054.767] CloseHandle (hObject=0x1ec) returned 1 [0054.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.767] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.768] lstrlenW (lpString=".doc") returned 4 [0054.768] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.768] lstrlenW (lpString=".docx") returned 5 [0054.768] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.768] lstrlenW (lpString=".pdf") returned 4 [0054.768] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.768] lstrlenW (lpString=".xls") returned 4 [0054.768] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.768] lstrlenW (lpString=".xlsx") returned 5 [0054.768] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.768] lstrlenW (lpString=".ppt") returned 4 [0054.768] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.768] lstrlenW (lpString=".zip") returned 4 [0054.768] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.768] lstrlenW (lpString=".rar") returned 4 [0054.768] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.768] lstrlenW (lpString=".bz2") returned 4 [0054.768] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.768] lstrlenW (lpString=".7z") returned 3 [0054.768] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.768] lstrlenW (lpString=".dbf") returned 4 [0054.768] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.768] lstrlenW (lpString=".1cd") returned 4 [0054.768] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.768] lstrlenW (lpString=".jpg") returned 4 [0054.768] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.769] lstrlenW (lpString=".doc") returned 4 [0054.769] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.769] lstrlenW (lpString=".docx") returned 5 [0054.769] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.769] lstrlenW (lpString=".pdf") returned 4 [0054.769] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.769] lstrlenW (lpString=".xls") returned 4 [0054.769] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.769] lstrlenW (lpString=".xlsx") returned 5 [0054.769] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.769] lstrlenW (lpString=".ppt") returned 4 [0054.769] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.769] lstrlenW (lpString=".zip") returned 4 [0054.769] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.769] lstrlenW (lpString=".rar") returned 4 [0054.769] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.769] lstrlenW (lpString=".bz2") returned 4 [0054.769] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.769] lstrlenW (lpString=".7z") returned 3 [0054.769] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.769] lstrlenW (lpString=".dbf") returned 4 [0054.769] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.769] lstrlenW (lpString=".1cd") returned 4 [0054.769] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0054.769] lstrlenW (lpString=".jpg") returned 4 [0054.769] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.770] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.770] lstrlenW (lpString="SETUP.XML") returned 9 [0054.770] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.781] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=9352) returned 1 [0054.781] CloseHandle (hObject=0x1e8) returned 1 [0054.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0054.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.782] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.782] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.782] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.782] GetLastError () returned 0x0 [0054.782] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x2488, lpOverlapped=0x0) returned 1 [0054.793] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0054.794] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.794] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0054.795] SetEndOfFile (hFile=0x1ec) returned 1 [0054.796] CloseHandle (hObject=0x1ec) returned 1 [0054.797] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.797] SetEndOfFile (hFile=0x1e8) returned 1 [0054.798] CloseHandle (hObject=0x1e8) returned 1 [0054.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.798] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0054.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.798] lstrlenW (lpString=".doc") returned 4 [0054.798] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.798] lstrlenW (lpString=".docx") returned 5 [0054.798] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.799] lstrlenW (lpString=".pdf") returned 4 [0054.799] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.799] lstrlenW (lpString=".xls") returned 4 [0054.799] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.799] lstrlenW (lpString=".xlsx") returned 5 [0054.799] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.799] lstrlenW (lpString=".ppt") returned 4 [0054.799] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.799] lstrlenW (lpString=".zip") returned 4 [0054.799] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.799] lstrlenW (lpString=".rar") returned 4 [0054.799] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.799] lstrlenW (lpString=".bz2") returned 4 [0054.799] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.799] lstrlenW (lpString=".7z") returned 3 [0054.799] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.799] lstrlenW (lpString=".dbf") returned 4 [0054.799] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.799] lstrlenW (lpString=".1cd") returned 4 [0054.799] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.799] lstrlenW (lpString=".jpg") returned 4 [0054.799] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.799] lstrlenW (lpString=".doc") returned 4 [0054.799] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.799] lstrlenW (lpString=".docx") returned 5 [0054.799] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0054.799] lstrlenW (lpString=".pdf") returned 4 [0054.800] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.800] lstrlenW (lpString=".xls") returned 4 [0054.800] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.800] lstrlenW (lpString=".xlsx") returned 5 [0054.800] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0054.800] lstrlenW (lpString=".ppt") returned 4 [0054.800] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.800] lstrlenW (lpString=".zip") returned 4 [0054.800] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.800] lstrlenW (lpString=".rar") returned 4 [0054.800] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.800] lstrlenW (lpString=".bz2") returned 4 [0054.800] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.800] lstrlenW (lpString=".7z") returned 3 [0054.800] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.800] lstrlenW (lpString=".dbf") returned 4 [0054.800] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.800] lstrlenW (lpString=".1cd") returned 4 [0054.800] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0054.800] lstrlenW (lpString=".jpg") returned 4 [0054.800] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.800] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0054.800] lstrlenW (lpString="Office32MUI.XML") returned 15 [0054.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.801] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1383) returned 1 [0054.801] CloseHandle (hObject=0x1e8) returned 1 [0054.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0054.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0054.802] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.802] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0054.804] GetLastError () returned 0x0 [0054.804] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x567, lpOverlapped=0x0) returned 1 [0054.805] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x570, lpOverlapped=0x0) returned 1 [0054.806] ReadFile (in: hFile=0x1e8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0054.806] WriteFile (in: hFile=0x1ec, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0054.806] SetEndOfFile (hFile=0x1ec) returned 1 [0054.806] CloseHandle (hObject=0x1ec) returned 1 [0054.807] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.807] SetEndOfFile (hFile=0x1e8) returned 1 [0054.808] CloseHandle (hObject=0x1e8) returned 1 [0054.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0054.808] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0054.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0054.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0054.809] lstrlenW (lpString=".doc") returned 4 [0054.809] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.809] lstrlenW (lpString=".docx") returned 5 [0054.809] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.809] lstrlenW (lpString=".pdf") returned 4 [0054.809] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.809] lstrlenW (lpString=".xls") returned 4 [0054.809] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.809] lstrlenW (lpString=".xlsx") returned 5 [0054.809] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.809] lstrlenW (lpString=".ppt") returned 4 [0054.809] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0054.809] lstrlenW (lpString=".zip") returned 4 [0054.809] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.809] lstrlenW (lpString=".rar") returned 4 [0054.809] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.809] lstrlenW (lpString=".bz2") returned 4 [0054.809] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.809] lstrlenW (lpString=".7z") returned 3 [0054.809] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0054.809] lstrlenW (lpString=".dbf") returned 4 [0054.809] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0054.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0054.809] lstrlenW (lpString=".1cd") returned 4 [0054.809] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0054.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0054.809] lstrlenW (lpString=".jpg") returned 4 [0054.809] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0054.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0054.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0054.810] lstrlenW (lpString=".doc") returned 4 [0054.810] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0054.810] lstrlenW (lpString=".docx") returned 5 [0054.810] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0054.810] lstrlenW (lpString=".pdf") returned 4 [0054.810] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0054.810] lstrlenW (lpString=".xls") returned 4 [0054.810] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0054.810] lstrlenW (lpString=".xlsx") returned 5 [0054.810] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0054.810] lstrlenW (lpString=".ppt") returned 4 [0054.810] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0054.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0054.810] lstrlenW (lpString=".zip") returned 4 [0054.810] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0054.810] lstrlenW (lpString=".rar") returned 4 [0054.810] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0054.810] lstrlenW (lpString=".bz2") returned 4 [0054.810] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0054.810] lstrlenW (lpString=".7z") returned 3 [0054.810] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0054.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0055.250] lstrlenW (lpString=".dbf") returned 4 [0055.250] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0055.250] lstrlenW (lpString=".1cd") returned 4 [0055.250] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0055.250] lstrlenW (lpString=".jpg") returned 4 [0055.250] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.250] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.250] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0055.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.251] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1452) returned 1 [0055.251] CloseHandle (hObject=0x1fc) returned 1 [0055.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0055.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.251] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.251] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0055.277] GetLastError () returned 0x0 [0055.277] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0055.525] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0055.526] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.526] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0055.526] SetEndOfFile (hFile=0x1d8) returned 1 [0055.526] CloseHandle (hObject=0x1d8) returned 1 [0055.527] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.527] SetEndOfFile (hFile=0x1fc) returned 1 [0055.529] CloseHandle (hObject=0x1fc) returned 1 [0055.529] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.529] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0055.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.529] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.529] lstrlenW (lpString=".doc") returned 4 [0055.529] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.529] lstrlenW (lpString=".docx") returned 5 [0055.529] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0055.529] lstrlenW (lpString=".pdf") returned 4 [0055.529] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.529] lstrlenW (lpString=".xls") returned 4 [0055.529] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.529] lstrlenW (lpString=".xlsx") returned 5 [0055.530] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0055.530] lstrlenW (lpString=".ppt") returned 4 [0055.530] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.530] lstrlenW (lpString=".zip") returned 4 [0055.530] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.530] lstrlenW (lpString=".rar") returned 4 [0055.530] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.530] lstrlenW (lpString=".bz2") returned 4 [0055.530] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.530] lstrlenW (lpString=".7z") returned 3 [0055.530] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.530] lstrlenW (lpString=".dbf") returned 4 [0055.530] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.530] lstrlenW (lpString=".1cd") returned 4 [0055.530] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.530] lstrlenW (lpString=".jpg") returned 4 [0055.530] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.530] lstrlenW (lpString=".doc") returned 4 [0055.530] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.530] lstrlenW (lpString=".docx") returned 5 [0055.530] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0055.530] lstrlenW (lpString=".pdf") returned 4 [0055.530] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.530] lstrlenW (lpString=".xls") returned 4 [0055.530] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.530] lstrlenW (lpString=".xlsx") returned 5 [0055.530] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0055.531] lstrlenW (lpString=".ppt") returned 4 [0055.531] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.531] lstrlenW (lpString=".zip") returned 4 [0055.531] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.531] lstrlenW (lpString=".rar") returned 4 [0055.531] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.531] lstrlenW (lpString=".bz2") returned 4 [0055.531] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.531] lstrlenW (lpString=".7z") returned 3 [0055.531] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.531] lstrlenW (lpString=".dbf") returned 4 [0055.531] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.531] lstrlenW (lpString=".1cd") returned 4 [0055.531] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0055.531] lstrlenW (lpString=".jpg") returned 4 [0055.531] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.531] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.531] lstrlenW (lpString="Proof.XML") returned 9 [0055.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.532] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1347) returned 1 [0055.532] CloseHandle (hObject=0x1fc) returned 1 [0055.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0055.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.532] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.532] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.532] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0055.533] GetLastError () returned 0x0 [0055.533] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x543, lpOverlapped=0x0) returned 1 [0055.725] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x550, lpOverlapped=0x0) returned 1 [0055.726] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.726] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0055.726] SetEndOfFile (hFile=0x1d8) returned 1 [0055.726] CloseHandle (hObject=0x1d8) returned 1 [0055.727] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.727] SetEndOfFile (hFile=0x1fc) returned 1 [0055.728] CloseHandle (hObject=0x1fc) returned 1 [0055.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0055.728] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0055.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.728] lstrlenW (lpString=".doc") returned 4 [0055.728] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.728] lstrlenW (lpString=".docx") returned 5 [0055.728] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0055.728] lstrlenW (lpString=".pdf") returned 4 [0055.728] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.728] lstrlenW (lpString=".xls") returned 4 [0055.729] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.729] lstrlenW (lpString=".xlsx") returned 5 [0055.729] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0055.729] lstrlenW (lpString=".ppt") returned 4 [0055.729] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.729] lstrlenW (lpString=".zip") returned 4 [0055.729] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.729] lstrlenW (lpString=".rar") returned 4 [0055.729] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.729] lstrlenW (lpString=".bz2") returned 4 [0055.729] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.729] lstrlenW (lpString=".7z") returned 3 [0055.729] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.729] lstrlenW (lpString=".dbf") returned 4 [0055.729] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.729] lstrlenW (lpString=".1cd") returned 4 [0055.729] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.729] lstrlenW (lpString=".jpg") returned 4 [0055.729] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.729] lstrlenW (lpString=".doc") returned 4 [0055.729] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0055.729] lstrlenW (lpString=".docx") returned 5 [0055.729] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0055.729] lstrlenW (lpString=".pdf") returned 4 [0055.729] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0055.729] lstrlenW (lpString=".xls") returned 4 [0055.729] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0055.730] lstrlenW (lpString=".xlsx") returned 5 [0055.730] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0055.730] lstrlenW (lpString=".ppt") returned 4 [0055.730] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.730] lstrlenW (lpString=".zip") returned 4 [0055.730] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0055.730] lstrlenW (lpString=".rar") returned 4 [0055.730] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0055.730] lstrlenW (lpString=".bz2") returned 4 [0055.730] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0055.730] lstrlenW (lpString=".7z") returned 3 [0055.730] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.730] lstrlenW (lpString=".dbf") returned 4 [0055.730] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.730] lstrlenW (lpString=".1cd") returned 4 [0055.730] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0055.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0055.730] lstrlenW (lpString=".jpg") returned 4 [0055.730] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0055.730] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0055.730] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0055.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.731] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=16852) returned 1 [0055.731] CloseHandle (hObject=0x1fc) returned 1 [0055.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0055.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0055.732] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.732] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.732] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0055.732] GetLastError () returned 0x0 [0055.732] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0055.924] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0055.925] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.925] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0055.925] SetEndOfFile (hFile=0x1d8) returned 1 [0056.004] CloseHandle (hObject=0x1d8) returned 1 [0056.013] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.013] SetEndOfFile (hFile=0x1fc) returned 1 [0056.036] CloseHandle (hObject=0x1fc) returned 1 [0056.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.037] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0056.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.037] lstrlenW (lpString=".doc") returned 4 [0056.037] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.037] lstrlenW (lpString=".docx") returned 5 [0056.037] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0056.037] lstrlenW (lpString=".pdf") returned 4 [0056.037] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.037] lstrlenW (lpString=".xls") returned 4 [0056.037] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.037] lstrlenW (lpString=".xlsx") returned 5 [0056.037] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0056.037] lstrlenW (lpString=".ppt") returned 4 [0056.037] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.037] lstrlenW (lpString=".zip") returned 4 [0056.037] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.037] lstrlenW (lpString=".rar") returned 4 [0056.037] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.037] lstrlenW (lpString=".bz2") returned 4 [0056.037] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.037] lstrlenW (lpString=".7z") returned 3 [0056.037] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.037] lstrlenW (lpString=".dbf") returned 4 [0056.037] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.038] lstrlenW (lpString=".1cd") returned 4 [0056.038] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.038] lstrlenW (lpString=".jpg") returned 4 [0056.038] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.038] lstrlenW (lpString=".doc") returned 4 [0056.038] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.038] lstrlenW (lpString=".docx") returned 5 [0056.038] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0056.038] lstrlenW (lpString=".pdf") returned 4 [0056.038] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.038] lstrlenW (lpString=".xls") returned 4 [0056.038] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.038] lstrlenW (lpString=".xlsx") returned 5 [0056.038] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0056.038] lstrlenW (lpString=".ppt") returned 4 [0056.038] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.038] lstrlenW (lpString=".zip") returned 4 [0056.038] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.038] lstrlenW (lpString=".rar") returned 4 [0056.038] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.038] lstrlenW (lpString=".bz2") returned 4 [0056.038] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.038] lstrlenW (lpString=".7z") returned 3 [0056.038] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.038] lstrlenW (lpString=".dbf") returned 4 [0056.038] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.039] lstrlenW (lpString=".1cd") returned 4 [0056.039] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0056.039] lstrlenW (lpString=".jpg") returned 4 [0056.039] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.039] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.039] lstrlenW (lpString="SETUP.XML") returned 9 [0056.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.054] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=20577) returned 1 [0056.054] CloseHandle (hObject=0x1fc) returned 1 [0056.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0056.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.054] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.055] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.055] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0056.055] GetLastError () returned 0x0 [0056.055] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5061, lpOverlapped=0x0) returned 1 [0056.058] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0056.059] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.059] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.059] SetEndOfFile (hFile=0x1d8) returned 1 [0056.059] CloseHandle (hObject=0x1d8) returned 1 [0056.060] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.060] SetEndOfFile (hFile=0x1fc) returned 1 [0056.061] CloseHandle (hObject=0x1fc) returned 1 [0056.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.061] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0056.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.062] lstrlenW (lpString=".doc") returned 4 [0056.062] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString=".docx") returned 5 [0056.062] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.062] lstrlenW (lpString=".pdf") returned 4 [0056.062] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString=".xls") returned 4 [0056.062] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString=".xlsx") returned 5 [0056.062] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.062] lstrlenW (lpString=".ppt") returned 4 [0056.062] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.062] lstrlenW (lpString=".zip") returned 4 [0056.062] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.062] lstrlenW (lpString=".rar") returned 4 [0056.062] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString=".bz2") returned 4 [0056.062] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString=".7z") returned 3 [0056.062] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.062] lstrlenW (lpString=".dbf") returned 4 [0056.062] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.063] lstrlenW (lpString=".1cd") returned 4 [0056.063] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.063] lstrlenW (lpString=".jpg") returned 4 [0056.063] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.063] lstrlenW (lpString=".doc") returned 4 [0056.063] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString=".docx") returned 5 [0056.063] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.063] lstrlenW (lpString=".pdf") returned 4 [0056.063] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString=".xls") returned 4 [0056.063] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString=".xlsx") returned 5 [0056.063] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.063] lstrlenW (lpString=".ppt") returned 4 [0056.063] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.063] lstrlenW (lpString=".zip") returned 4 [0056.063] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.063] lstrlenW (lpString=".rar") returned 4 [0056.063] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString=".bz2") returned 4 [0056.063] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString=".7z") returned 3 [0056.063] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.063] lstrlenW (lpString=".dbf") returned 4 [0056.063] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.063] lstrlenW (lpString=".1cd") returned 4 [0056.064] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0056.064] lstrlenW (lpString=".jpg") returned 4 [0056.064] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.064] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.064] lstrlenW (lpString="VisiorWW.XML") returned 12 [0056.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.064] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=8723) returned 1 [0056.064] CloseHandle (hObject=0x1fc) returned 1 [0056.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0056.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0056.065] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.065] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0056.079] GetLastError () returned 0x0 [0056.079] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x2213, lpOverlapped=0x0) returned 1 [0056.252] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0056.253] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.253] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.253] SetEndOfFile (hFile=0x1d8) returned 1 [0056.253] CloseHandle (hObject=0x1d8) returned 1 [0056.254] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.254] SetEndOfFile (hFile=0x1fc) returned 1 [0056.255] CloseHandle (hObject=0x1fc) returned 1 [0056.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.255] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0056.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.255] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.256] lstrlenW (lpString=".doc") returned 4 [0056.256] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.256] lstrlenW (lpString=".docx") returned 5 [0056.256] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0056.256] lstrlenW (lpString=".pdf") returned 4 [0056.256] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.256] lstrlenW (lpString=".xls") returned 4 [0056.256] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.256] lstrlenW (lpString=".xlsx") returned 5 [0056.256] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0056.256] lstrlenW (lpString=".ppt") returned 4 [0056.256] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.256] lstrlenW (lpString=".zip") returned 4 [0056.256] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.256] lstrlenW (lpString=".rar") returned 4 [0056.256] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.256] lstrlenW (lpString=".bz2") returned 4 [0056.256] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.256] lstrlenW (lpString=".7z") returned 3 [0056.256] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.256] lstrlenW (lpString=".dbf") returned 4 [0056.256] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.256] lstrlenW (lpString=".1cd") returned 4 [0056.256] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.256] lstrlenW (lpString=".jpg") returned 4 [0056.256] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.256] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.256] lstrlenW (lpString=".doc") returned 4 [0056.257] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.257] lstrlenW (lpString=".docx") returned 5 [0056.257] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0056.257] lstrlenW (lpString=".pdf") returned 4 [0056.257] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.257] lstrlenW (lpString=".xls") returned 4 [0056.257] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.257] lstrlenW (lpString=".xlsx") returned 5 [0056.257] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0056.257] lstrlenW (lpString=".ppt") returned 4 [0056.257] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.257] lstrlenW (lpString=".zip") returned 4 [0056.257] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.257] lstrlenW (lpString=".rar") returned 4 [0056.257] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.257] lstrlenW (lpString=".bz2") returned 4 [0056.257] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.257] lstrlenW (lpString=".7z") returned 3 [0056.257] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.257] lstrlenW (lpString=".dbf") returned 4 [0056.257] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.257] lstrlenW (lpString=".1cd") returned 4 [0056.257] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.257] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0056.257] lstrlenW (lpString=".jpg") returned 4 [0056.257] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.258] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0056.258] lstrlenW (lpString="SETUP.XML") returned 9 [0056.258] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.464] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2424) returned 1 [0056.464] CloseHandle (hObject=0x180) returned 1 [0056.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0056.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.465] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.465] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0056.825] GetLastError () returned 0x0 [0056.825] ReadFile (in: hFile=0x180, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x978, lpOverlapped=0x0) returned 1 [0056.827] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x980, lpOverlapped=0x0) returned 1 [0056.828] ReadFile (in: hFile=0x180, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.828] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.828] SetEndOfFile (hFile=0x1e8) returned 1 [0056.828] CloseHandle (hObject=0x1e8) returned 1 [0056.828] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.829] SetEndOfFile (hFile=0x180) returned 1 [0056.829] CloseHandle (hObject=0x180) returned 1 [0056.829] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0056.830] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0056.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.830] lstrlenW (lpString=".doc") returned 4 [0056.830] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.830] lstrlenW (lpString=".docx") returned 5 [0056.830] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.830] lstrlenW (lpString=".pdf") returned 4 [0056.830] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.830] lstrlenW (lpString=".xls") returned 4 [0056.830] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.830] lstrlenW (lpString=".xlsx") returned 5 [0056.830] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.830] lstrlenW (lpString=".ppt") returned 4 [0056.830] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.830] lstrlenW (lpString=".zip") returned 4 [0056.830] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.830] lstrlenW (lpString=".rar") returned 4 [0056.830] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.830] lstrlenW (lpString=".bz2") returned 4 [0056.830] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.830] lstrlenW (lpString=".7z") returned 3 [0056.830] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.831] lstrlenW (lpString=".dbf") returned 4 [0056.831] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.831] lstrlenW (lpString=".1cd") returned 4 [0056.831] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.831] lstrlenW (lpString=".jpg") returned 4 [0056.831] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.831] lstrlenW (lpString=".doc") returned 4 [0056.831] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0056.831] lstrlenW (lpString=".docx") returned 5 [0056.831] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0056.831] lstrlenW (lpString=".pdf") returned 4 [0056.831] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0056.831] lstrlenW (lpString=".xls") returned 4 [0056.831] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0056.831] lstrlenW (lpString=".xlsx") returned 5 [0056.831] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0056.831] lstrlenW (lpString=".ppt") returned 4 [0056.831] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0056.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.831] lstrlenW (lpString=".zip") returned 4 [0056.831] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0056.831] lstrlenW (lpString=".rar") returned 4 [0056.831] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0056.831] lstrlenW (lpString=".bz2") returned 4 [0056.831] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0056.831] lstrlenW (lpString=".7z") returned 3 [0056.831] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0056.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.832] lstrlenW (lpString=".dbf") returned 4 [0056.832] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0056.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.832] lstrlenW (lpString=".1cd") returned 4 [0056.832] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0056.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0056.832] lstrlenW (lpString=".jpg") returned 4 [0056.832] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0056.832] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0056.832] lstrlenW (lpString="Garden.jpg") returned 10 [0056.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.832] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=23871) returned 1 [0056.832] CloseHandle (hObject=0x180) returned 1 [0056.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0056.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.833] lstrlenW (lpString=".doc") returned 4 [0056.833] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.833] lstrlenW (lpString=".docx") returned 5 [0056.833] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0056.833] lstrlenW (lpString=".pdf") returned 4 [0056.833] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.833] lstrlenW (lpString=".xls") returned 4 [0056.833] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.833] lstrlenW (lpString=".xlsx") returned 5 [0056.833] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0056.833] lstrlenW (lpString=".ppt") returned 4 [0056.833] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.833] lstrlenW (lpString=".zip") returned 4 [0056.833] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.833] lstrlenW (lpString=".rar") returned 4 [0056.833] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.833] lstrlenW (lpString=".bz2") returned 4 [0056.833] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.833] lstrlenW (lpString=".7z") returned 3 [0056.833] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.833] lstrlenW (lpString=".dbf") returned 4 [0056.833] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0056.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.833] lstrlenW (lpString=".1cd") returned 4 [0056.834] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0056.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.834] lstrlenW (lpString=".jpg") returned 4 [0056.834] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0056.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.834] lstrlenW (lpString=".doc") returned 4 [0056.834] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.834] lstrlenW (lpString=".docx") returned 5 [0056.834] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0056.834] lstrlenW (lpString=".pdf") returned 4 [0056.834] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.834] lstrlenW (lpString=".xls") returned 4 [0056.834] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.834] lstrlenW (lpString=".xlsx") returned 5 [0056.834] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0056.834] lstrlenW (lpString=".ppt") returned 4 [0056.834] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.834] lstrlenW (lpString=".zip") returned 4 [0056.834] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.834] lstrlenW (lpString=".rar") returned 4 [0056.834] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.834] lstrlenW (lpString=".bz2") returned 4 [0056.834] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.834] lstrlenW (lpString=".7z") returned 3 [0056.834] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.834] lstrlenW (lpString=".dbf") returned 4 [0056.834] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0056.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.834] lstrlenW (lpString=".1cd") returned 4 [0056.835] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0056.835] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0056.835] lstrlenW (lpString=".jpg") returned 4 [0056.835] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0056.835] lstrcmpiW (lpString1=".emf", lpString2=".wiki") returned -1 [0056.835] lstrlenW (lpString="Genko_1.emf") returned 11 [0056.835] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.836] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5524) returned 1 [0056.836] CloseHandle (hObject=0x180) returned 1 [0056.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0056.836] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.836] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.836] lstrlenW (lpString=".doc") returned 4 [0056.836] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.836] lstrlenW (lpString=".docx") returned 5 [0056.836] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0056.836] lstrlenW (lpString=".pdf") returned 4 [0056.836] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.836] lstrlenW (lpString=".xls") returned 4 [0056.836] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.836] lstrlenW (lpString=".xlsx") returned 5 [0056.836] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0056.836] lstrlenW (lpString=".ppt") returned 4 [0056.836] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.836] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.836] lstrlenW (lpString=".zip") returned 4 [0056.836] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.836] lstrlenW (lpString=".rar") returned 4 [0056.836] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.837] lstrlenW (lpString=".bz2") returned 4 [0056.837] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.837] lstrlenW (lpString=".7z") returned 3 [0056.837] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.837] lstrlenW (lpString=".dbf") returned 4 [0056.837] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.837] lstrlenW (lpString=".1cd") returned 4 [0056.837] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.837] lstrlenW (lpString=".jpg") returned 4 [0056.837] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.837] lstrlenW (lpString=".doc") returned 4 [0056.837] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.837] lstrlenW (lpString=".docx") returned 5 [0056.837] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0056.837] lstrlenW (lpString=".pdf") returned 4 [0056.837] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.837] lstrlenW (lpString=".xls") returned 4 [0056.837] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.837] lstrlenW (lpString=".xlsx") returned 5 [0056.837] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0056.837] lstrlenW (lpString=".ppt") returned 4 [0056.837] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.837] lstrlenW (lpString=".zip") returned 4 [0056.837] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.837] lstrlenW (lpString=".rar") returned 4 [0056.837] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.837] lstrlenW (lpString=".bz2") returned 4 [0056.838] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.838] lstrlenW (lpString=".7z") returned 3 [0056.838] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.838] lstrlenW (lpString=".dbf") returned 4 [0056.838] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.838] lstrlenW (lpString=".1cd") returned 4 [0056.838] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0056.838] lstrlenW (lpString=".jpg") returned 4 [0056.838] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.838] lstrcmpiW (lpString1=".emf", lpString2=".wiki") returned -1 [0056.838] lstrlenW (lpString="Genko_2.emf") returned 11 [0056.838] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.838] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=10340) returned 1 [0056.839] CloseHandle (hObject=0x180) returned 1 [0056.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0056.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.839] lstrlenW (lpString=".doc") returned 4 [0056.839] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.839] lstrlenW (lpString=".docx") returned 5 [0056.839] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0056.839] lstrlenW (lpString=".pdf") returned 4 [0056.839] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.839] lstrlenW (lpString=".xls") returned 4 [0056.839] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.839] lstrlenW (lpString=".xlsx") returned 5 [0056.839] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0056.839] lstrlenW (lpString=".ppt") returned 4 [0056.839] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.839] lstrlenW (lpString=".zip") returned 4 [0056.839] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.839] lstrlenW (lpString=".rar") returned 4 [0056.839] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.839] lstrlenW (lpString=".bz2") returned 4 [0056.839] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.839] lstrlenW (lpString=".7z") returned 3 [0056.839] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.840] lstrlenW (lpString=".dbf") returned 4 [0056.840] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.840] lstrlenW (lpString=".1cd") returned 4 [0056.840] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.840] lstrlenW (lpString=".jpg") returned 4 [0056.840] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.840] lstrlenW (lpString=".doc") returned 4 [0056.840] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.840] lstrlenW (lpString=".docx") returned 5 [0056.840] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0056.840] lstrlenW (lpString=".pdf") returned 4 [0056.840] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.840] lstrlenW (lpString=".xls") returned 4 [0056.840] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.840] lstrlenW (lpString=".xlsx") returned 5 [0056.840] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0056.840] lstrlenW (lpString=".ppt") returned 4 [0056.840] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.840] lstrlenW (lpString=".zip") returned 4 [0056.840] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.840] lstrlenW (lpString=".rar") returned 4 [0056.840] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.840] lstrlenW (lpString=".bz2") returned 4 [0056.840] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.840] lstrlenW (lpString=".7z") returned 3 [0056.840] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.841] lstrlenW (lpString=".dbf") returned 4 [0056.841] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.841] lstrlenW (lpString=".1cd") returned 4 [0056.841] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0056.841] lstrlenW (lpString=".jpg") returned 4 [0056.841] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.841] lstrcmpiW (lpString1=".emf", lpString2=".wiki") returned -1 [0056.841] lstrlenW (lpString="Graph.emf") returned 9 [0056.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.842] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=116724) returned 1 [0056.842] CloseHandle (hObject=0x180) returned 1 [0056.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0056.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.842] lstrlenW (lpString=".doc") returned 4 [0056.842] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.842] lstrlenW (lpString=".docx") returned 5 [0056.842] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0056.842] lstrlenW (lpString=".pdf") returned 4 [0056.842] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.842] lstrlenW (lpString=".xls") returned 4 [0056.842] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.842] lstrlenW (lpString=".xlsx") returned 5 [0056.843] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0056.843] lstrlenW (lpString=".ppt") returned 4 [0056.843] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.843] lstrlenW (lpString=".zip") returned 4 [0056.843] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.843] lstrlenW (lpString=".rar") returned 4 [0056.843] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.843] lstrlenW (lpString=".bz2") returned 4 [0056.843] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.843] lstrlenW (lpString=".7z") returned 3 [0056.843] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.843] lstrlenW (lpString=".dbf") returned 4 [0056.843] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.843] lstrlenW (lpString=".1cd") returned 4 [0056.843] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.843] lstrlenW (lpString=".jpg") returned 4 [0056.843] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.843] lstrlenW (lpString=".doc") returned 4 [0056.843] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0056.843] lstrlenW (lpString=".docx") returned 5 [0056.843] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0056.843] lstrlenW (lpString=".pdf") returned 4 [0056.843] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0056.843] lstrlenW (lpString=".xls") returned 4 [0056.843] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0056.843] lstrlenW (lpString=".xlsx") returned 5 [0056.843] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0056.844] lstrlenW (lpString=".ppt") returned 4 [0056.844] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.844] lstrlenW (lpString=".zip") returned 4 [0056.844] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0056.844] lstrlenW (lpString=".rar") returned 4 [0056.844] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0056.844] lstrlenW (lpString=".bz2") returned 4 [0056.844] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0056.844] lstrlenW (lpString=".7z") returned 3 [0056.844] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.844] lstrlenW (lpString=".dbf") returned 4 [0056.844] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.844] lstrlenW (lpString=".1cd") returned 4 [0056.844] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0056.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0056.844] lstrlenW (lpString=".jpg") returned 4 [0056.844] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0056.844] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0056.844] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0056.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.845] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=237) returned 1 [0056.845] CloseHandle (hObject=0x180) returned 1 [0056.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0056.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.846] lstrlenW (lpString=".doc") returned 4 [0056.846] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.846] lstrlenW (lpString=".docx") returned 5 [0056.846] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0056.846] lstrlenW (lpString=".pdf") returned 4 [0056.846] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.846] lstrlenW (lpString=".xls") returned 4 [0056.846] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.846] lstrlenW (lpString=".xlsx") returned 5 [0056.846] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0056.846] lstrlenW (lpString=".ppt") returned 4 [0056.846] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.846] lstrlenW (lpString=".zip") returned 4 [0056.846] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.846] lstrlenW (lpString=".rar") returned 4 [0056.846] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.846] lstrlenW (lpString=".bz2") returned 4 [0056.846] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.846] lstrlenW (lpString=".7z") returned 3 [0056.846] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.846] lstrlenW (lpString=".dbf") returned 4 [0056.846] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.846] lstrlenW (lpString=".1cd") returned 4 [0056.846] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.846] lstrlenW (lpString=".jpg") returned 4 [0056.846] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.847] lstrlenW (lpString=".doc") returned 4 [0056.847] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0056.847] lstrlenW (lpString=".docx") returned 5 [0056.847] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0056.847] lstrlenW (lpString=".pdf") returned 4 [0056.847] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0056.847] lstrlenW (lpString=".xls") returned 4 [0056.847] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0056.847] lstrlenW (lpString=".xlsx") returned 5 [0056.847] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0056.847] lstrlenW (lpString=".ppt") returned 4 [0056.847] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0056.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.847] lstrlenW (lpString=".zip") returned 4 [0056.847] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0056.847] lstrlenW (lpString=".rar") returned 4 [0056.847] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0056.847] lstrlenW (lpString=".bz2") returned 4 [0056.847] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0056.847] lstrlenW (lpString=".7z") returned 3 [0056.847] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0056.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.847] lstrlenW (lpString=".dbf") returned 4 [0056.847] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0056.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.847] lstrlenW (lpString=".1cd") returned 4 [0056.847] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0056.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0056.847] lstrlenW (lpString=".jpg") returned 4 [0056.847] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0056.848] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0056.848] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0056.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0056.848] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=6406) returned 1 [0056.848] CloseHandle (hObject=0x180) returned 1 [0056.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0056.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.848] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0056.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.848] lstrlenW (lpString=".doc") returned 4 [0056.848] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0056.848] lstrlenW (lpString=".docx") returned 5 [0056.848] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0056.848] lstrlenW (lpString=".pdf") returned 4 [0056.848] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0056.848] lstrlenW (lpString=".xls") returned 4 [0056.848] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0056.849] lstrlenW (lpString=".xlsx") returned 5 [0056.849] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0056.849] lstrlenW (lpString=".ppt") returned 4 [0056.849] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.849] lstrlenW (lpString=".zip") returned 4 [0056.849] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0056.849] lstrlenW (lpString=".rar") returned 4 [0056.849] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0056.849] lstrlenW (lpString=".bz2") returned 4 [0056.849] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0056.849] lstrlenW (lpString=".7z") returned 3 [0056.849] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0056.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0056.849] lstrlenW (lpString=".dbf") returned 4 [0056.849] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0058.649] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.649] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0058.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0059.063] GetLastError () returned 0x0 [0059.063] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xb20, lpOverlapped=0x0) returned 1 [0059.204] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0059.206] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.206] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.206] SetEndOfFile (hFile=0x20c) returned 1 [0059.206] CloseHandle (hObject=0x20c) returned 1 [0059.206] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.206] SetEndOfFile (hFile=0x1e0) returned 1 [0059.207] CloseHandle (hObject=0x1e0) returned 1 [0059.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.208] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0059.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.208] lstrlenW (lpString=".doc") returned 4 [0059.208] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.208] lstrlenW (lpString=".docx") returned 5 [0059.208] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.208] lstrlenW (lpString=".pdf") returned 4 [0059.208] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.208] lstrlenW (lpString=".xls") returned 4 [0059.208] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.208] lstrlenW (lpString=".xlsx") returned 5 [0059.208] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.208] lstrlenW (lpString=".ppt") returned 4 [0059.208] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.208] lstrlenW (lpString=".zip") returned 4 [0059.208] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.208] lstrlenW (lpString=".rar") returned 4 [0059.208] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.208] lstrlenW (lpString=".bz2") returned 4 [0059.208] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.209] lstrlenW (lpString=".7z") returned 3 [0059.209] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.209] lstrlenW (lpString=".dbf") returned 4 [0059.209] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.209] lstrlenW (lpString=".1cd") returned 4 [0059.209] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.209] lstrlenW (lpString=".jpg") returned 4 [0059.209] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.209] lstrlenW (lpString=".doc") returned 4 [0059.209] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.209] lstrlenW (lpString=".docx") returned 5 [0059.209] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.209] lstrlenW (lpString=".pdf") returned 4 [0059.209] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.209] lstrlenW (lpString=".xls") returned 4 [0059.209] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.209] lstrlenW (lpString=".xlsx") returned 5 [0059.209] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.209] lstrlenW (lpString=".ppt") returned 4 [0059.209] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.209] lstrlenW (lpString=".zip") returned 4 [0059.209] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.209] lstrlenW (lpString=".rar") returned 4 [0059.209] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.210] lstrlenW (lpString=".bz2") returned 4 [0059.210] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.210] lstrlenW (lpString=".7z") returned 3 [0059.210] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.210] lstrlenW (lpString=".dbf") returned 4 [0059.210] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.210] lstrlenW (lpString=".1cd") returned 4 [0059.210] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0059.210] lstrlenW (lpString=".jpg") returned 4 [0059.210] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.210] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.210] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.329] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=29925) returned 1 [0059.329] CloseHandle (hObject=0x1d8) returned 1 [0059.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0059.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.330] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.330] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.330] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0059.330] GetLastError () returned 0x0 [0059.330] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0059.332] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0059.333] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.334] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.334] SetEndOfFile (hFile=0x218) returned 1 [0059.334] CloseHandle (hObject=0x218) returned 1 [0059.334] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.334] SetEndOfFile (hFile=0x1d8) returned 1 [0059.335] CloseHandle (hObject=0x1d8) returned 1 [0059.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.335] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0059.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.335] lstrlenW (lpString=".doc") returned 4 [0059.336] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.336] lstrlenW (lpString=".docx") returned 5 [0059.336] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.336] lstrlenW (lpString=".pdf") returned 4 [0059.336] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.336] lstrlenW (lpString=".xls") returned 4 [0059.336] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.336] lstrlenW (lpString=".xlsx") returned 5 [0059.336] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.336] lstrlenW (lpString=".ppt") returned 4 [0059.336] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.336] lstrlenW (lpString=".zip") returned 4 [0059.336] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.336] lstrlenW (lpString=".rar") returned 4 [0059.336] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.336] lstrlenW (lpString=".bz2") returned 4 [0059.336] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.336] lstrlenW (lpString=".7z") returned 3 [0059.336] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.336] lstrlenW (lpString=".dbf") returned 4 [0059.336] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.336] lstrlenW (lpString=".1cd") returned 4 [0059.336] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.336] lstrlenW (lpString=".jpg") returned 4 [0059.336] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.337] lstrlenW (lpString=".doc") returned 4 [0059.337] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.337] lstrlenW (lpString=".docx") returned 5 [0059.337] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.337] lstrlenW (lpString=".pdf") returned 4 [0059.337] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.337] lstrlenW (lpString=".xls") returned 4 [0059.337] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.337] lstrlenW (lpString=".xlsx") returned 5 [0059.337] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.337] lstrlenW (lpString=".ppt") returned 4 [0059.337] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.337] lstrlenW (lpString=".zip") returned 4 [0059.337] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.337] lstrlenW (lpString=".rar") returned 4 [0059.337] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.337] lstrlenW (lpString=".bz2") returned 4 [0059.337] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.337] lstrlenW (lpString=".7z") returned 3 [0059.337] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.337] lstrlenW (lpString=".dbf") returned 4 [0059.337] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.337] lstrlenW (lpString=".1cd") returned 4 [0059.337] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.337] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0059.337] lstrlenW (lpString=".jpg") returned 4 [0059.337] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.338] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.338] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.367] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=20371) returned 1 [0059.367] CloseHandle (hObject=0x1d8) returned 1 [0059.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0059.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.367] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.367] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0059.368] GetLastError () returned 0x0 [0059.368] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0059.370] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0059.371] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.371] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.371] SetEndOfFile (hFile=0x218) returned 1 [0059.371] CloseHandle (hObject=0x218) returned 1 [0059.372] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.372] SetEndOfFile (hFile=0x1d8) returned 1 [0059.372] CloseHandle (hObject=0x1d8) returned 1 [0059.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.373] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0059.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.373] lstrlenW (lpString=".doc") returned 4 [0059.373] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.373] lstrlenW (lpString=".docx") returned 5 [0059.373] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.373] lstrlenW (lpString=".pdf") returned 4 [0059.373] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.373] lstrlenW (lpString=".xls") returned 4 [0059.373] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.373] lstrlenW (lpString=".xlsx") returned 5 [0059.373] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.373] lstrlenW (lpString=".ppt") returned 4 [0059.373] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.373] lstrlenW (lpString=".zip") returned 4 [0059.373] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.373] lstrlenW (lpString=".rar") returned 4 [0059.373] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.374] lstrlenW (lpString=".bz2") returned 4 [0059.374] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.374] lstrlenW (lpString=".7z") returned 3 [0059.374] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.374] lstrlenW (lpString=".dbf") returned 4 [0059.374] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.374] lstrlenW (lpString=".1cd") returned 4 [0059.374] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.374] lstrlenW (lpString=".jpg") returned 4 [0059.374] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.374] lstrlenW (lpString=".doc") returned 4 [0059.374] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.374] lstrlenW (lpString=".docx") returned 5 [0059.374] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.374] lstrlenW (lpString=".pdf") returned 4 [0059.374] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.374] lstrlenW (lpString=".xls") returned 4 [0059.374] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.374] lstrlenW (lpString=".xlsx") returned 5 [0059.374] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.374] lstrlenW (lpString=".ppt") returned 4 [0059.374] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.374] lstrlenW (lpString=".zip") returned 4 [0059.374] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.374] lstrlenW (lpString=".rar") returned 4 [0059.375] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.375] lstrlenW (lpString=".bz2") returned 4 [0059.375] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.375] lstrlenW (lpString=".7z") returned 3 [0059.375] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.375] lstrlenW (lpString=".dbf") returned 4 [0059.375] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.375] lstrlenW (lpString=".1cd") returned 4 [0059.375] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0059.375] lstrlenW (lpString=".jpg") returned 4 [0059.375] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.375] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.375] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.375] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1293) returned 1 [0059.376] CloseHandle (hObject=0x1d8) returned 1 [0059.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0059.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.376] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.376] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0059.378] GetLastError () returned 0x0 [0059.378] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x50d, lpOverlapped=0x0) returned 1 [0059.379] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x510, lpOverlapped=0x0) returned 1 [0059.380] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.380] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1 [0059.380] SetEndOfFile (hFile=0x218) returned 1 [0059.381] CloseHandle (hObject=0x218) returned 1 [0059.381] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.381] SetEndOfFile (hFile=0x1d8) returned 1 [0059.382] CloseHandle (hObject=0x1d8) returned 1 [0059.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.382] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0059.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.382] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.382] lstrlenW (lpString=".doc") returned 4 [0059.382] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.382] lstrlenW (lpString=".docx") returned 5 [0059.382] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.382] lstrlenW (lpString=".pdf") returned 4 [0059.382] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.382] lstrlenW (lpString=".xls") returned 4 [0059.382] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.382] lstrlenW (lpString=".xlsx") returned 5 [0059.382] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.383] lstrlenW (lpString=".ppt") returned 4 [0059.383] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.383] lstrlenW (lpString=".zip") returned 4 [0059.383] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.383] lstrlenW (lpString=".rar") returned 4 [0059.383] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.383] lstrlenW (lpString=".bz2") returned 4 [0059.383] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.383] lstrlenW (lpString=".7z") returned 3 [0059.383] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.383] lstrlenW (lpString=".dbf") returned 4 [0059.383] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.383] lstrlenW (lpString=".1cd") returned 4 [0059.383] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.383] lstrlenW (lpString=".jpg") returned 4 [0059.383] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.383] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.383] lstrlenW (lpString=".doc") returned 4 [0059.383] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0059.383] lstrlenW (lpString=".docx") returned 5 [0059.383] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0059.383] lstrlenW (lpString=".pdf") returned 4 [0059.383] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0059.383] lstrlenW (lpString=".xls") returned 4 [0059.383] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0059.383] lstrlenW (lpString=".xlsx") returned 5 [0059.384] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0059.384] lstrlenW (lpString=".ppt") returned 4 [0059.384] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0059.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.384] lstrlenW (lpString=".zip") returned 4 [0059.384] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0059.384] lstrlenW (lpString=".rar") returned 4 [0059.384] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0059.384] lstrlenW (lpString=".bz2") returned 4 [0059.384] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0059.384] lstrlenW (lpString=".7z") returned 3 [0059.384] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0059.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.384] lstrlenW (lpString=".dbf") returned 4 [0059.384] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0059.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.384] lstrlenW (lpString=".1cd") returned 4 [0059.384] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0059.384] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0059.384] lstrlenW (lpString=".jpg") returned 4 [0059.384] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0059.384] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0059.384] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0059.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.385] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=20575) returned 1 [0059.385] CloseHandle (hObject=0x1d8) returned 1 [0059.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0059.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.385] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.385] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.385] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0059.385] GetLastError () returned 0x0 [0059.386] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x505f, lpOverlapped=0x0) returned 1 [0059.719] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5060, lpOverlapped=0x0) returned 1 [0059.720] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0059.720] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0059.720] SetEndOfFile (hFile=0x218) returned 1 [0059.720] CloseHandle (hObject=0x218) returned 1 [0059.721] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.721] SetEndOfFile (hFile=0x1d8) returned 1 [0059.722] CloseHandle (hObject=0x1d8) returned 1 [0059.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0059.722] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0059.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.722] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.722] lstrlenW (lpString=".doc") returned 4 [0059.722] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.722] lstrlenW (lpString=".docx") returned 5 [0059.722] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.722] lstrlenW (lpString=".pdf") returned 4 [0059.722] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.722] lstrlenW (lpString=".xls") returned 4 [0059.722] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.722] lstrlenW (lpString=".xlsx") returned 5 [0059.722] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.723] lstrlenW (lpString=".ppt") returned 4 [0059.723] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.723] lstrlenW (lpString=".zip") returned 4 [0059.723] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.723] lstrlenW (lpString=".rar") returned 4 [0059.723] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.723] lstrlenW (lpString=".bz2") returned 4 [0059.723] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.723] lstrlenW (lpString=".7z") returned 3 [0059.723] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.723] lstrlenW (lpString=".dbf") returned 4 [0059.723] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.723] lstrlenW (lpString=".1cd") returned 4 [0059.723] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.723] lstrlenW (lpString=".jpg") returned 4 [0059.723] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.723] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.723] lstrlenW (lpString=".doc") returned 4 [0059.723] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0059.723] lstrlenW (lpString=".docx") returned 5 [0059.723] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0059.723] lstrlenW (lpString=".pdf") returned 4 [0059.723] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0059.723] lstrlenW (lpString=".xls") returned 4 [0059.723] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0059.723] lstrlenW (lpString=".xlsx") returned 5 [0059.723] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0059.724] lstrlenW (lpString=".ppt") returned 4 [0059.724] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0059.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.724] lstrlenW (lpString=".zip") returned 4 [0059.724] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0059.724] lstrlenW (lpString=".rar") returned 4 [0059.724] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0059.724] lstrlenW (lpString=".bz2") returned 4 [0059.724] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0059.724] lstrlenW (lpString=".7z") returned 3 [0059.724] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0059.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.724] lstrlenW (lpString=".dbf") returned 4 [0059.724] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0059.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.724] lstrlenW (lpString=".1cd") returned 4 [0059.724] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0059.724] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0059.724] lstrlenW (lpString=".jpg") returned 4 [0059.724] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0059.724] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0059.724] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0059.724] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.725] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2552) returned 1 [0059.725] CloseHandle (hObject=0x1d8) returned 1 [0059.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0059.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0059.725] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.725] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0059.725] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.035] GetLastError () returned 0x0 [0060.035] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0060.037] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0060.038] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.038] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.038] SetEndOfFile (hFile=0x208) returned 1 [0060.038] CloseHandle (hObject=0x208) returned 1 [0060.038] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.038] SetEndOfFile (hFile=0x1d8) returned 1 [0060.039] CloseHandle (hObject=0x1d8) returned 1 [0060.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.039] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0060.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.040] lstrlenW (lpString=".doc") returned 4 [0060.040] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.040] lstrlenW (lpString=".docx") returned 5 [0060.040] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.040] lstrlenW (lpString=".pdf") returned 4 [0060.040] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.040] lstrlenW (lpString=".xls") returned 4 [0060.040] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.040] lstrlenW (lpString=".xlsx") returned 5 [0060.040] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.040] lstrlenW (lpString=".ppt") returned 4 [0060.040] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.040] lstrlenW (lpString=".zip") returned 4 [0060.040] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.040] lstrlenW (lpString=".rar") returned 4 [0060.040] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.040] lstrlenW (lpString=".bz2") returned 4 [0060.040] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.040] lstrlenW (lpString=".7z") returned 3 [0060.040] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.040] lstrlenW (lpString=".dbf") returned 4 [0060.040] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.040] lstrlenW (lpString=".1cd") returned 4 [0060.040] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.040] lstrlenW (lpString=".jpg") returned 4 [0060.040] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.041] lstrlenW (lpString=".doc") returned 4 [0060.041] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.041] lstrlenW (lpString=".docx") returned 5 [0060.041] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.041] lstrlenW (lpString=".pdf") returned 4 [0060.041] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.041] lstrlenW (lpString=".xls") returned 4 [0060.041] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.041] lstrlenW (lpString=".xlsx") returned 5 [0060.041] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.041] lstrlenW (lpString=".ppt") returned 4 [0060.041] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.041] lstrlenW (lpString=".zip") returned 4 [0060.041] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.041] lstrlenW (lpString=".rar") returned 4 [0060.041] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.041] lstrlenW (lpString=".bz2") returned 4 [0060.041] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.041] lstrlenW (lpString=".7z") returned 3 [0060.041] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.041] lstrlenW (lpString=".dbf") returned 4 [0060.041] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.041] lstrlenW (lpString=".1cd") returned 4 [0060.041] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0060.041] lstrlenW (lpString=".jpg") returned 4 [0060.041] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.042] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.042] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.042] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2476) returned 1 [0060.042] CloseHandle (hObject=0x1d8) returned 1 [0060.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0060.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.042] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.042] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.044] GetLastError () returned 0x0 [0060.044] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0060.047] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0060.048] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.048] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.048] SetEndOfFile (hFile=0x208) returned 1 [0060.048] CloseHandle (hObject=0x208) returned 1 [0060.048] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.048] SetEndOfFile (hFile=0x1d8) returned 1 [0060.049] CloseHandle (hObject=0x1d8) returned 1 [0060.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.049] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0060.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.050] lstrlenW (lpString=".doc") returned 4 [0060.050] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.050] lstrlenW (lpString=".docx") returned 5 [0060.050] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.050] lstrlenW (lpString=".pdf") returned 4 [0060.050] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.050] lstrlenW (lpString=".xls") returned 4 [0060.050] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.050] lstrlenW (lpString=".xlsx") returned 5 [0060.050] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.050] lstrlenW (lpString=".ppt") returned 4 [0060.050] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.050] lstrlenW (lpString=".zip") returned 4 [0060.050] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.050] lstrlenW (lpString=".rar") returned 4 [0060.050] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.050] lstrlenW (lpString=".bz2") returned 4 [0060.050] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.050] lstrlenW (lpString=".7z") returned 3 [0060.050] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.050] lstrlenW (lpString=".dbf") returned 4 [0060.050] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.050] lstrlenW (lpString=".1cd") returned 4 [0060.050] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.051] lstrlenW (lpString=".jpg") returned 4 [0060.051] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.051] lstrlenW (lpString=".doc") returned 4 [0060.051] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.051] lstrlenW (lpString=".docx") returned 5 [0060.051] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.051] lstrlenW (lpString=".pdf") returned 4 [0060.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.051] lstrlenW (lpString=".xls") returned 4 [0060.051] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.051] lstrlenW (lpString=".xlsx") returned 5 [0060.051] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.051] lstrlenW (lpString=".ppt") returned 4 [0060.051] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.051] lstrlenW (lpString=".zip") returned 4 [0060.051] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.051] lstrlenW (lpString=".rar") returned 4 [0060.051] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.051] lstrlenW (lpString=".bz2") returned 4 [0060.051] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.051] lstrlenW (lpString=".7z") returned 3 [0060.051] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.051] lstrlenW (lpString=".dbf") returned 4 [0060.051] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.052] lstrlenW (lpString=".1cd") returned 4 [0060.052] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0060.052] lstrlenW (lpString=".jpg") returned 4 [0060.052] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.052] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.052] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.052] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=19485) returned 1 [0060.052] CloseHandle (hObject=0x1d8) returned 1 [0060.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0060.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.053] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.053] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0060.053] GetLastError () returned 0x0 [0060.053] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0060.055] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0060.056] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.056] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.056] SetEndOfFile (hFile=0x208) returned 1 [0060.056] CloseHandle (hObject=0x208) returned 1 [0060.056] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.056] SetEndOfFile (hFile=0x1d8) returned 1 [0060.057] CloseHandle (hObject=0x1d8) returned 1 [0060.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.057] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0060.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.058] lstrlenW (lpString=".doc") returned 4 [0060.058] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.058] lstrlenW (lpString=".docx") returned 5 [0060.058] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.058] lstrlenW (lpString=".pdf") returned 4 [0060.058] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.058] lstrlenW (lpString=".xls") returned 4 [0060.058] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.058] lstrlenW (lpString=".xlsx") returned 5 [0060.058] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.058] lstrlenW (lpString=".ppt") returned 4 [0060.058] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.058] lstrlenW (lpString=".zip") returned 4 [0060.058] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.058] lstrlenW (lpString=".rar") returned 4 [0060.058] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.058] lstrlenW (lpString=".bz2") returned 4 [0060.058] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.058] lstrlenW (lpString=".7z") returned 3 [0060.058] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.058] lstrlenW (lpString=".dbf") returned 4 [0060.058] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.058] lstrlenW (lpString=".1cd") returned 4 [0060.058] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.058] lstrlenW (lpString=".jpg") returned 4 [0060.058] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.059] lstrlenW (lpString=".doc") returned 4 [0060.059] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.059] lstrlenW (lpString=".docx") returned 5 [0060.059] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.059] lstrlenW (lpString=".pdf") returned 4 [0060.059] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.059] lstrlenW (lpString=".xls") returned 4 [0060.059] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.059] lstrlenW (lpString=".xlsx") returned 5 [0060.059] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.059] lstrlenW (lpString=".ppt") returned 4 [0060.059] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.059] lstrlenW (lpString=".zip") returned 4 [0060.059] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.059] lstrlenW (lpString=".rar") returned 4 [0060.059] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.059] lstrlenW (lpString=".bz2") returned 4 [0060.059] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.059] lstrlenW (lpString=".7z") returned 3 [0060.059] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.059] lstrlenW (lpString=".dbf") returned 4 [0060.059] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.059] lstrlenW (lpString=".1cd") returned 4 [0060.059] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0060.059] lstrlenW (lpString=".jpg") returned 4 [0060.059] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.060] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.060] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.060] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1232) returned 1 [0060.060] CloseHandle (hObject=0x1d8) returned 1 [0060.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0060.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.060] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.060] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.061] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.062] GetLastError () returned 0x0 [0060.062] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0060.064] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0060.064] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.065] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.065] SetEndOfFile (hFile=0x1e4) returned 1 [0060.065] CloseHandle (hObject=0x1e4) returned 1 [0060.065] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.065] SetEndOfFile (hFile=0x1d8) returned 1 [0060.066] CloseHandle (hObject=0x1d8) returned 1 [0060.066] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.066] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0060.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.066] lstrlenW (lpString=".doc") returned 4 [0060.066] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.066] lstrlenW (lpString=".docx") returned 5 [0060.066] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.066] lstrlenW (lpString=".pdf") returned 4 [0060.066] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.066] lstrlenW (lpString=".xls") returned 4 [0060.066] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString=".xlsx") returned 5 [0060.067] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.067] lstrlenW (lpString=".ppt") returned 4 [0060.067] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.067] lstrlenW (lpString=".zip") returned 4 [0060.067] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString=".rar") returned 4 [0060.067] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString=".bz2") returned 4 [0060.067] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.067] lstrlenW (lpString=".7z") returned 3 [0060.067] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.067] lstrlenW (lpString=".dbf") returned 4 [0060.067] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.067] lstrlenW (lpString=".1cd") returned 4 [0060.067] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.067] lstrlenW (lpString=".jpg") returned 4 [0060.067] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.067] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.067] lstrlenW (lpString=".doc") returned 4 [0060.067] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.067] lstrlenW (lpString=".docx") returned 5 [0060.067] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.067] lstrlenW (lpString=".pdf") returned 4 [0060.067] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.067] lstrlenW (lpString=".xls") returned 4 [0060.068] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.068] lstrlenW (lpString=".xlsx") returned 5 [0060.068] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.068] lstrlenW (lpString=".ppt") returned 4 [0060.068] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.068] lstrlenW (lpString=".zip") returned 4 [0060.068] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.068] lstrlenW (lpString=".rar") returned 4 [0060.068] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.068] lstrlenW (lpString=".bz2") returned 4 [0060.068] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.068] lstrlenW (lpString=".7z") returned 3 [0060.068] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.068] lstrlenW (lpString=".dbf") returned 4 [0060.068] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.068] lstrlenW (lpString=".1cd") returned 4 [0060.068] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0060.068] lstrlenW (lpString=".jpg") returned 4 [0060.068] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.068] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.069] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.069] GetFileSizeEx (in: hFile=0x1d8, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=18413) returned 1 [0060.069] CloseHandle (hObject=0x1d8) returned 1 [0060.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0060.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.069] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.069] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.070] GetLastError () returned 0x0 [0060.070] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0060.189] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0060.190] ReadFile (in: hFile=0x1d8, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.190] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.190] SetEndOfFile (hFile=0x1e4) returned 1 [0060.190] CloseHandle (hObject=0x1e4) returned 1 [0060.190] SetFilePointerEx (in: hFile=0x1d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.191] SetEndOfFile (hFile=0x1d8) returned 1 [0060.191] CloseHandle (hObject=0x1d8) returned 1 [0060.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.192] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0060.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.192] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.192] lstrlenW (lpString=".doc") returned 4 [0060.192] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.192] lstrlenW (lpString=".docx") returned 5 [0060.192] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.192] lstrlenW (lpString=".pdf") returned 4 [0060.192] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.192] lstrlenW (lpString=".xls") returned 4 [0060.192] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.192] lstrlenW (lpString=".xlsx") returned 5 [0060.192] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.192] lstrlenW (lpString=".ppt") returned 4 [0060.193] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.193] lstrlenW (lpString=".zip") returned 4 [0060.193] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.193] lstrlenW (lpString=".rar") returned 4 [0060.193] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.193] lstrlenW (lpString=".bz2") returned 4 [0060.193] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.193] lstrlenW (lpString=".7z") returned 3 [0060.193] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.193] lstrlenW (lpString=".dbf") returned 4 [0060.193] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.193] lstrlenW (lpString=".1cd") returned 4 [0060.193] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.193] lstrlenW (lpString=".jpg") returned 4 [0060.193] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.193] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.193] lstrlenW (lpString=".doc") returned 4 [0060.193] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.193] lstrlenW (lpString=".docx") returned 5 [0060.193] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.193] lstrlenW (lpString=".pdf") returned 4 [0060.193] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.193] lstrlenW (lpString=".xls") returned 4 [0060.193] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.194] lstrlenW (lpString=".xlsx") returned 5 [0060.194] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.194] lstrlenW (lpString=".ppt") returned 4 [0060.194] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.194] lstrlenW (lpString=".zip") returned 4 [0060.194] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.194] lstrlenW (lpString=".rar") returned 4 [0060.194] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.194] lstrlenW (lpString=".bz2") returned 4 [0060.194] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.194] lstrlenW (lpString=".7z") returned 3 [0060.194] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.194] lstrlenW (lpString=".dbf") returned 4 [0060.194] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.194] lstrlenW (lpString=".1cd") returned 4 [0060.194] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0060.194] lstrlenW (lpString=".jpg") returned 4 [0060.194] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.194] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.194] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.194] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.206] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=44850) returned 1 [0060.206] CloseHandle (hObject=0x20c) returned 1 [0060.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0060.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.209] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.209] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.209] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d8 [0060.209] GetLastError () returned 0x0 [0060.209] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xaf32, lpOverlapped=0x0) returned 1 [0060.254] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0060.256] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.256] WriteFile (in: hFile=0x1d8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.256] SetEndOfFile (hFile=0x1d8) returned 1 [0060.256] CloseHandle (hObject=0x1d8) returned 1 [0060.256] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.256] SetEndOfFile (hFile=0x20c) returned 1 [0060.257] CloseHandle (hObject=0x20c) returned 1 [0060.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.258] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0060.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.259] lstrlenW (lpString=".doc") returned 4 [0060.259] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.259] lstrlenW (lpString=".docx") returned 5 [0060.259] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.260] lstrlenW (lpString=".pdf") returned 4 [0060.260] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.260] lstrlenW (lpString=".xls") returned 4 [0060.260] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.260] lstrlenW (lpString=".xlsx") returned 5 [0060.260] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.260] lstrlenW (lpString=".ppt") returned 4 [0060.260] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.260] lstrlenW (lpString=".zip") returned 4 [0060.260] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.260] lstrlenW (lpString=".rar") returned 4 [0060.260] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.260] lstrlenW (lpString=".bz2") returned 4 [0060.260] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.260] lstrlenW (lpString=".7z") returned 3 [0060.260] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.260] lstrlenW (lpString=".dbf") returned 4 [0060.260] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.260] lstrlenW (lpString=".1cd") returned 4 [0060.260] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.260] lstrlenW (lpString=".jpg") returned 4 [0060.260] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.260] lstrlenW (lpString=".doc") returned 4 [0060.260] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.260] lstrlenW (lpString=".docx") returned 5 [0060.260] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.261] lstrlenW (lpString=".pdf") returned 4 [0060.261] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.261] lstrlenW (lpString=".xls") returned 4 [0060.261] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.261] lstrlenW (lpString=".xlsx") returned 5 [0060.261] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.261] lstrlenW (lpString=".ppt") returned 4 [0060.261] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.261] lstrlenW (lpString=".zip") returned 4 [0060.261] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.261] lstrlenW (lpString=".rar") returned 4 [0060.261] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.261] lstrlenW (lpString=".bz2") returned 4 [0060.261] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.261] lstrlenW (lpString=".7z") returned 3 [0060.261] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.261] lstrlenW (lpString=".dbf") returned 4 [0060.261] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.261] lstrlenW (lpString=".1cd") returned 4 [0060.261] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0060.261] lstrlenW (lpString=".jpg") returned 4 [0060.261] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.261] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.261] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.276] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=37440) returned 1 [0060.276] CloseHandle (hObject=0x1f0) returned 1 [0060.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0060.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.276] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.276] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.276] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.277] GetLastError () returned 0x0 [0060.277] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x9240, lpOverlapped=0x0) returned 1 [0060.283] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0060.285] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.285] WriteFile (in: hFile=0x1e4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.285] SetEndOfFile (hFile=0x1e4) returned 1 [0060.285] CloseHandle (hObject=0x1e4) returned 1 [0060.285] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.285] SetEndOfFile (hFile=0x1f0) returned 1 [0060.286] CloseHandle (hObject=0x1f0) returned 1 [0060.287] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.287] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0060.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.287] lstrlenW (lpString=".doc") returned 4 [0060.287] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.287] lstrlenW (lpString=".docx") returned 5 [0060.287] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.287] lstrlenW (lpString=".pdf") returned 4 [0060.287] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.287] lstrlenW (lpString=".xls") returned 4 [0060.287] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.287] lstrlenW (lpString=".xlsx") returned 5 [0060.287] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.287] lstrlenW (lpString=".ppt") returned 4 [0060.287] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.287] lstrlenW (lpString=".zip") returned 4 [0060.287] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.287] lstrlenW (lpString=".rar") returned 4 [0060.287] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.288] lstrlenW (lpString=".bz2") returned 4 [0060.288] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.288] lstrlenW (lpString=".7z") returned 3 [0060.288] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.288] lstrlenW (lpString=".dbf") returned 4 [0060.288] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.288] lstrlenW (lpString=".1cd") returned 4 [0060.288] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.288] lstrlenW (lpString=".jpg") returned 4 [0060.288] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.288] lstrlenW (lpString=".doc") returned 4 [0060.288] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.288] lstrlenW (lpString=".docx") returned 5 [0060.288] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.288] lstrlenW (lpString=".pdf") returned 4 [0060.288] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.288] lstrlenW (lpString=".xls") returned 4 [0060.288] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.288] lstrlenW (lpString=".xlsx") returned 5 [0060.288] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.288] lstrlenW (lpString=".ppt") returned 4 [0060.288] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.288] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.288] lstrlenW (lpString=".zip") returned 4 [0060.288] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.288] lstrlenW (lpString=".rar") returned 4 [0060.288] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.289] lstrlenW (lpString=".bz2") returned 4 [0060.289] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.289] lstrlenW (lpString=".7z") returned 3 [0060.289] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.289] lstrlenW (lpString=".dbf") returned 4 [0060.289] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.289] lstrlenW (lpString=".1cd") returned 4 [0060.289] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.289] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0060.289] lstrlenW (lpString=".jpg") returned 4 [0060.289] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.289] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.289] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.289] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.289] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1339) returned 1 [0060.290] CloseHandle (hObject=0x1f0) returned 1 [0060.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0060.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.290] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.290] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.290] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.546] GetLastError () returned 0x0 [0060.546] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x53b, lpOverlapped=0x0) returned 1 [0060.629] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x540, lpOverlapped=0x0) returned 1 [0060.630] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.631] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.631] SetEndOfFile (hFile=0x20c) returned 1 [0060.631] CloseHandle (hObject=0x20c) returned 1 [0060.631] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.631] SetEndOfFile (hFile=0x1f0) returned 1 [0060.632] CloseHandle (hObject=0x1f0) returned 1 [0060.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.632] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0060.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.632] lstrlenW (lpString=".doc") returned 4 [0060.632] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.632] lstrlenW (lpString=".docx") returned 5 [0060.633] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.633] lstrlenW (lpString=".pdf") returned 4 [0060.633] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.633] lstrlenW (lpString=".xls") returned 4 [0060.633] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.633] lstrlenW (lpString=".xlsx") returned 5 [0060.633] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.633] lstrlenW (lpString=".ppt") returned 4 [0060.633] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.633] lstrlenW (lpString=".zip") returned 4 [0060.633] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.633] lstrlenW (lpString=".rar") returned 4 [0060.633] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.633] lstrlenW (lpString=".bz2") returned 4 [0060.633] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.633] lstrlenW (lpString=".7z") returned 3 [0060.633] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.633] lstrlenW (lpString=".dbf") returned 4 [0060.633] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.633] lstrlenW (lpString=".1cd") returned 4 [0060.633] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.633] lstrlenW (lpString=".jpg") returned 4 [0060.633] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.633] lstrlenW (lpString=".doc") returned 4 [0060.633] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.633] lstrlenW (lpString=".docx") returned 5 [0060.634] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.634] lstrlenW (lpString=".pdf") returned 4 [0060.634] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.634] lstrlenW (lpString=".xls") returned 4 [0060.634] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.634] lstrlenW (lpString=".xlsx") returned 5 [0060.634] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.634] lstrlenW (lpString=".ppt") returned 4 [0060.634] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.634] lstrlenW (lpString=".zip") returned 4 [0060.634] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.634] lstrlenW (lpString=".rar") returned 4 [0060.634] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.634] lstrlenW (lpString=".bz2") returned 4 [0060.634] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.634] lstrlenW (lpString=".7z") returned 3 [0060.634] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.634] lstrlenW (lpString=".dbf") returned 4 [0060.634] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.635] lstrlenW (lpString=".1cd") returned 4 [0060.635] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.636] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0060.636] lstrlenW (lpString=".jpg") returned 4 [0060.636] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.636] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.636] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.636] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=15737) returned 1 [0060.636] CloseHandle (hObject=0x1f0) returned 1 [0060.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0060.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.637] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.637] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.637] GetLastError () returned 0x0 [0060.637] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0060.641] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0060.645] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.645] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.645] SetEndOfFile (hFile=0x20c) returned 1 [0060.645] CloseHandle (hObject=0x20c) returned 1 [0060.646] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.646] SetEndOfFile (hFile=0x1f0) returned 1 [0060.647] CloseHandle (hObject=0x1f0) returned 1 [0060.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.647] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0060.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.647] lstrlenW (lpString=".doc") returned 4 [0060.647] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.648] lstrlenW (lpString=".docx") returned 5 [0060.648] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.648] lstrlenW (lpString=".pdf") returned 4 [0060.648] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.648] lstrlenW (lpString=".xls") returned 4 [0060.648] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.648] lstrlenW (lpString=".xlsx") returned 5 [0060.648] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.648] lstrlenW (lpString=".ppt") returned 4 [0060.648] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.648] lstrlenW (lpString=".zip") returned 4 [0060.648] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.648] lstrlenW (lpString=".rar") returned 4 [0060.648] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.648] lstrlenW (lpString=".bz2") returned 4 [0060.648] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.648] lstrlenW (lpString=".7z") returned 3 [0060.648] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.648] lstrlenW (lpString=".dbf") returned 4 [0060.648] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.648] lstrlenW (lpString=".1cd") returned 4 [0060.648] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.648] lstrlenW (lpString=".jpg") returned 4 [0060.648] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.649] lstrlenW (lpString=".doc") returned 4 [0060.649] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.649] lstrlenW (lpString=".docx") returned 5 [0060.649] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.649] lstrlenW (lpString=".pdf") returned 4 [0060.649] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.649] lstrlenW (lpString=".xls") returned 4 [0060.649] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.649] lstrlenW (lpString=".xlsx") returned 5 [0060.649] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.649] lstrlenW (lpString=".ppt") returned 4 [0060.649] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.649] lstrlenW (lpString=".zip") returned 4 [0060.649] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.649] lstrlenW (lpString=".rar") returned 4 [0060.649] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.649] lstrlenW (lpString=".bz2") returned 4 [0060.649] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.649] lstrlenW (lpString=".7z") returned 3 [0060.649] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.649] lstrlenW (lpString=".dbf") returned 4 [0060.649] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.650] lstrlenW (lpString=".1cd") returned 4 [0060.650] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0060.650] lstrlenW (lpString=".jpg") returned 4 [0060.650] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.650] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.650] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.651] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3970) returned 1 [0060.651] CloseHandle (hObject=0x1f0) returned 1 [0060.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0060.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.651] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.652] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.653] GetLastError () returned 0x0 [0060.653] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xf82, lpOverlapped=0x0) returned 1 [0060.729] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0060.730] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.730] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.730] SetEndOfFile (hFile=0x20c) returned 1 [0060.730] CloseHandle (hObject=0x20c) returned 1 [0060.733] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.733] SetEndOfFile (hFile=0x1f0) returned 1 [0060.734] CloseHandle (hObject=0x1f0) returned 1 [0060.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.734] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0060.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.734] lstrlenW (lpString=".doc") returned 4 [0060.734] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.734] lstrlenW (lpString=".docx") returned 5 [0060.734] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.734] lstrlenW (lpString=".pdf") returned 4 [0060.734] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.734] lstrlenW (lpString=".xls") returned 4 [0060.734] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.734] lstrlenW (lpString=".xlsx") returned 5 [0060.735] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.735] lstrlenW (lpString=".ppt") returned 4 [0060.735] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.735] lstrlenW (lpString=".zip") returned 4 [0060.735] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.735] lstrlenW (lpString=".rar") returned 4 [0060.735] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.735] lstrlenW (lpString=".bz2") returned 4 [0060.735] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.735] lstrlenW (lpString=".7z") returned 3 [0060.735] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.735] lstrlenW (lpString=".dbf") returned 4 [0060.735] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.735] lstrlenW (lpString=".1cd") returned 4 [0060.735] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.735] lstrlenW (lpString=".jpg") returned 4 [0060.735] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.735] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.735] lstrlenW (lpString=".doc") returned 4 [0060.735] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.735] lstrlenW (lpString=".docx") returned 5 [0060.735] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.735] lstrlenW (lpString=".pdf") returned 4 [0060.735] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.735] lstrlenW (lpString=".xls") returned 4 [0060.735] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.735] lstrlenW (lpString=".xlsx") returned 5 [0060.736] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.736] lstrlenW (lpString=".ppt") returned 4 [0060.736] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.736] lstrlenW (lpString=".zip") returned 4 [0060.736] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.736] lstrlenW (lpString=".rar") returned 4 [0060.736] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.736] lstrlenW (lpString=".bz2") returned 4 [0060.736] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.736] lstrlenW (lpString=".7z") returned 3 [0060.736] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.736] lstrlenW (lpString=".dbf") returned 4 [0060.736] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.736] lstrlenW (lpString=".1cd") returned 4 [0060.736] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0060.736] lstrlenW (lpString=".jpg") returned 4 [0060.736] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.736] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.736] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.746] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=31975) returned 1 [0060.746] CloseHandle (hObject=0x1f0) returned 1 [0060.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0060.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.746] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.746] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.746] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.746] GetLastError () returned 0x0 [0060.746] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0060.786] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0060.787] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.787] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.787] SetEndOfFile (hFile=0x20c) returned 1 [0060.788] CloseHandle (hObject=0x20c) returned 1 [0060.788] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.788] SetEndOfFile (hFile=0x1f0) returned 1 [0060.789] CloseHandle (hObject=0x1f0) returned 1 [0060.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.789] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0060.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.789] lstrlenW (lpString=".doc") returned 4 [0060.789] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.789] lstrlenW (lpString=".docx") returned 5 [0060.789] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.789] lstrlenW (lpString=".pdf") returned 4 [0060.789] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.789] lstrlenW (lpString=".xls") returned 4 [0060.789] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.789] lstrlenW (lpString=".xlsx") returned 5 [0060.789] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.790] lstrlenW (lpString=".ppt") returned 4 [0060.790] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.790] lstrlenW (lpString=".zip") returned 4 [0060.790] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.790] lstrlenW (lpString=".rar") returned 4 [0060.790] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.790] lstrlenW (lpString=".bz2") returned 4 [0060.790] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.790] lstrlenW (lpString=".7z") returned 3 [0060.790] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.790] lstrlenW (lpString=".dbf") returned 4 [0060.790] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.790] lstrlenW (lpString=".1cd") returned 4 [0060.790] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.790] lstrlenW (lpString=".jpg") returned 4 [0060.790] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.790] lstrlenW (lpString=".doc") returned 4 [0060.790] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.790] lstrlenW (lpString=".docx") returned 5 [0060.790] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.790] lstrlenW (lpString=".pdf") returned 4 [0060.790] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.790] lstrlenW (lpString=".xls") returned 4 [0060.790] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.791] lstrlenW (lpString=".xlsx") returned 5 [0060.791] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.791] lstrlenW (lpString=".ppt") returned 4 [0060.791] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.791] lstrlenW (lpString=".zip") returned 4 [0060.791] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.791] lstrlenW (lpString=".rar") returned 4 [0060.791] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.791] lstrlenW (lpString=".bz2") returned 4 [0060.791] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.791] lstrlenW (lpString=".7z") returned 3 [0060.791] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.791] lstrlenW (lpString=".dbf") returned 4 [0060.791] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.791] lstrlenW (lpString=".1cd") returned 4 [0060.791] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0060.791] lstrlenW (lpString=".jpg") returned 4 [0060.791] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.791] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.791] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.791] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.792] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=34163) returned 1 [0060.792] CloseHandle (hObject=0x1f0) returned 1 [0060.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0060.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.792] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.792] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0060.792] GetLastError () returned 0x0 [0060.792] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x8573, lpOverlapped=0x0) returned 1 [0060.838] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0060.840] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.840] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0060.840] SetEndOfFile (hFile=0x20c) returned 1 [0060.840] CloseHandle (hObject=0x20c) returned 1 [0060.840] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.840] SetEndOfFile (hFile=0x1f0) returned 1 [0060.841] CloseHandle (hObject=0x1f0) returned 1 [0060.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.841] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.842] lstrlenW (lpString=".doc") returned 4 [0060.842] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.842] lstrlenW (lpString=".docx") returned 5 [0060.842] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.842] lstrlenW (lpString=".pdf") returned 4 [0060.842] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.842] lstrlenW (lpString=".xls") returned 4 [0060.842] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.842] lstrlenW (lpString=".xlsx") returned 5 [0060.842] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.842] lstrlenW (lpString=".ppt") returned 4 [0060.842] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.842] lstrlenW (lpString=".zip") returned 4 [0060.842] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.842] lstrlenW (lpString=".rar") returned 4 [0060.842] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.842] lstrlenW (lpString=".bz2") returned 4 [0060.842] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.842] lstrlenW (lpString=".7z") returned 3 [0060.842] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.842] lstrlenW (lpString=".dbf") returned 4 [0060.842] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.842] lstrlenW (lpString=".1cd") returned 4 [0060.842] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.842] lstrlenW (lpString=".jpg") returned 4 [0060.843] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.843] lstrlenW (lpString=".doc") returned 4 [0060.843] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0060.843] lstrlenW (lpString=".docx") returned 5 [0060.843] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0060.843] lstrlenW (lpString=".pdf") returned 4 [0060.843] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0060.843] lstrlenW (lpString=".xls") returned 4 [0060.843] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0060.843] lstrlenW (lpString=".xlsx") returned 5 [0060.843] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0060.843] lstrlenW (lpString=".ppt") returned 4 [0060.843] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.843] lstrlenW (lpString=".zip") returned 4 [0060.843] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0060.843] lstrlenW (lpString=".rar") returned 4 [0060.843] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0060.843] lstrlenW (lpString=".bz2") returned 4 [0060.843] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0060.843] lstrlenW (lpString=".7z") returned 3 [0060.843] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.843] lstrlenW (lpString=".dbf") returned 4 [0060.843] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.843] lstrlenW (lpString=".1cd") returned 4 [0060.843] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0060.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0060.843] lstrlenW (lpString=".jpg") returned 4 [0060.844] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0060.844] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.844] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.844] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.858] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1009) returned 1 [0060.858] CloseHandle (hObject=0x204) returned 1 [0060.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0060.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.859] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.859] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.859] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.870] GetLastError () returned 0x0 [0060.870] ReadFile (in: hFile=0x204, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0060.872] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x400, lpOverlapped=0x0) returned 1 [0060.873] ReadFile (in: hFile=0x204, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.873] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.873] SetEndOfFile (hFile=0x1f0) returned 1 [0060.873] CloseHandle (hObject=0x1f0) returned 1 [0060.874] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.874] SetEndOfFile (hFile=0x204) returned 1 [0060.874] CloseHandle (hObject=0x204) returned 1 [0060.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.875] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0060.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.875] lstrlenW (lpString=".doc") returned 4 [0060.875] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.875] lstrlenW (lpString=".docx") returned 5 [0060.875] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.875] lstrlenW (lpString=".pdf") returned 4 [0060.875] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.875] lstrlenW (lpString=".xls") returned 4 [0060.875] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.875] lstrlenW (lpString=".xlsx") returned 5 [0060.875] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.875] lstrlenW (lpString=".ppt") returned 4 [0060.875] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.875] lstrlenW (lpString=".zip") returned 4 [0060.875] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.875] lstrlenW (lpString=".rar") returned 4 [0060.875] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.875] lstrlenW (lpString=".bz2") returned 4 [0060.875] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.876] lstrlenW (lpString=".7z") returned 3 [0060.876] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.876] lstrlenW (lpString=".dbf") returned 4 [0060.876] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.876] lstrlenW (lpString=".1cd") returned 4 [0060.876] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.876] lstrlenW (lpString=".jpg") returned 4 [0060.876] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.876] lstrlenW (lpString=".doc") returned 4 [0060.876] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.876] lstrlenW (lpString=".docx") returned 5 [0060.876] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.876] lstrlenW (lpString=".pdf") returned 4 [0060.876] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.876] lstrlenW (lpString=".xls") returned 4 [0060.876] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.876] lstrlenW (lpString=".xlsx") returned 5 [0060.876] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.876] lstrlenW (lpString=".ppt") returned 4 [0060.876] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.876] lstrlenW (lpString=".zip") returned 4 [0060.876] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.876] lstrlenW (lpString=".rar") returned 4 [0060.876] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.876] lstrlenW (lpString=".bz2") returned 4 [0060.877] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.877] lstrlenW (lpString=".7z") returned 3 [0060.877] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.877] lstrlenW (lpString=".dbf") returned 4 [0060.877] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.877] lstrlenW (lpString=".1cd") returned 4 [0060.877] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0060.877] lstrlenW (lpString=".jpg") returned 4 [0060.877] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.877] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0060.877] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0060.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.877] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2209) returned 1 [0060.878] CloseHandle (hObject=0x204) returned 1 [0060.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0060.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.878] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.878] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.880] GetLastError () returned 0x0 [0060.880] ReadFile (in: hFile=0x204, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0060.882] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0060.883] ReadFile (in: hFile=0x204, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0060.883] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1 [0060.883] SetEndOfFile (hFile=0x1f0) returned 1 [0060.883] CloseHandle (hObject=0x1f0) returned 1 [0060.883] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.883] SetEndOfFile (hFile=0x204) returned 1 [0060.884] CloseHandle (hObject=0x204) returned 1 [0060.884] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0060.884] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0060.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.885] lstrlenW (lpString=".doc") returned 4 [0060.885] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.885] lstrlenW (lpString=".docx") returned 5 [0060.885] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.885] lstrlenW (lpString=".pdf") returned 4 [0060.885] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.885] lstrlenW (lpString=".xls") returned 4 [0060.885] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.885] lstrlenW (lpString=".xlsx") returned 5 [0060.885] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.885] lstrlenW (lpString=".ppt") returned 4 [0060.885] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.885] lstrlenW (lpString=".zip") returned 4 [0060.885] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.885] lstrlenW (lpString=".rar") returned 4 [0060.885] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.885] lstrlenW (lpString=".bz2") returned 4 [0060.885] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.885] lstrlenW (lpString=".7z") returned 3 [0060.885] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.885] lstrlenW (lpString=".dbf") returned 4 [0060.885] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.885] lstrlenW (lpString=".1cd") returned 4 [0060.885] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.886] lstrlenW (lpString=".jpg") returned 4 [0060.886] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.886] lstrlenW (lpString=".doc") returned 4 [0060.886] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0060.886] lstrlenW (lpString=".docx") returned 5 [0060.886] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0060.886] lstrlenW (lpString=".pdf") returned 4 [0060.886] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0060.886] lstrlenW (lpString=".xls") returned 4 [0060.886] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0060.886] lstrlenW (lpString=".xlsx") returned 5 [0060.886] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0060.886] lstrlenW (lpString=".ppt") returned 4 [0060.886] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0060.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.886] lstrlenW (lpString=".zip") returned 4 [0060.886] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0060.886] lstrlenW (lpString=".rar") returned 4 [0060.886] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0060.886] lstrlenW (lpString=".bz2") returned 4 [0060.886] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0060.886] lstrlenW (lpString=".7z") returned 3 [0060.886] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0060.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.886] lstrlenW (lpString=".dbf") returned 4 [0060.886] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0060.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.886] lstrlenW (lpString=".1cd") returned 4 [0060.887] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0060.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0060.887] lstrlenW (lpString=".jpg") returned 4 [0060.887] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0060.887] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0060.887] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0060.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.887] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=21812) returned 1 [0060.887] CloseHandle (hObject=0x204) returned 1 [0060.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0060.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0060.887] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.888] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0060.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0060.888] GetLastError () returned 0x0 [0060.888] ReadFile (in: hFile=0x204, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x5534, lpOverlapped=0x0) returned 1 [0061.067] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x5540, lpOverlapped=0x0) returned 1 [0061.068] ReadFile (in: hFile=0x204, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.068] WriteFile (in: hFile=0x1f0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.068] SetEndOfFile (hFile=0x1f0) returned 1 [0061.068] CloseHandle (hObject=0x1f0) returned 1 [0061.069] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.069] SetEndOfFile (hFile=0x204) returned 1 [0061.070] CloseHandle (hObject=0x204) returned 1 [0061.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.070] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0061.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.070] lstrlenW (lpString=".doc") returned 4 [0061.070] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.070] lstrlenW (lpString=".docx") returned 5 [0061.070] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.070] lstrlenW (lpString=".pdf") returned 4 [0061.070] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.070] lstrlenW (lpString=".xls") returned 4 [0061.070] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.070] lstrlenW (lpString=".xlsx") returned 5 [0061.070] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.070] lstrlenW (lpString=".ppt") returned 4 [0061.070] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.070] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.071] lstrlenW (lpString=".zip") returned 4 [0061.071] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.071] lstrlenW (lpString=".rar") returned 4 [0061.071] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.071] lstrlenW (lpString=".bz2") returned 4 [0061.071] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.071] lstrlenW (lpString=".7z") returned 3 [0061.071] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.071] lstrlenW (lpString=".dbf") returned 4 [0061.071] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.071] lstrlenW (lpString=".1cd") returned 4 [0061.071] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.071] lstrlenW (lpString=".jpg") returned 4 [0061.071] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.071] lstrlenW (lpString=".doc") returned 4 [0061.071] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.071] lstrlenW (lpString=".docx") returned 5 [0061.071] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.071] lstrlenW (lpString=".pdf") returned 4 [0061.071] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.071] lstrlenW (lpString=".xls") returned 4 [0061.071] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.071] lstrlenW (lpString=".xlsx") returned 5 [0061.071] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.071] lstrlenW (lpString=".ppt") returned 4 [0061.071] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.072] lstrlenW (lpString=".zip") returned 4 [0061.072] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.072] lstrlenW (lpString=".rar") returned 4 [0061.072] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.072] lstrlenW (lpString=".bz2") returned 4 [0061.072] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.072] lstrlenW (lpString=".7z") returned 3 [0061.072] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.072] lstrlenW (lpString=".dbf") returned 4 [0061.072] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.072] lstrlenW (lpString=".1cd") returned 4 [0061.072] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0061.072] lstrlenW (lpString=".jpg") returned 4 [0061.072] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.072] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0061.072] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0061.072] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.073] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4991) returned 1 [0061.073] CloseHandle (hObject=0x204) returned 1 [0061.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0061.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0061.073] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.073] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0061.297] GetLastError () returned 0x0 [0061.297] ReadFile (in: hFile=0x204, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x137f, lpOverlapped=0x0) returned 1 [0061.364] WriteFile (in: hFile=0x198, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0061.365] ReadFile (in: hFile=0x204, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.365] WriteFile (in: hFile=0x198, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xea, lpOverlapped=0x0) returned 1 [0061.365] SetEndOfFile (hFile=0x198) returned 1 [0061.365] CloseHandle (hObject=0x198) returned 1 [0061.365] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.365] SetEndOfFile (hFile=0x204) returned 1 [0061.366] CloseHandle (hObject=0x204) returned 1 [0061.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.366] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0061.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.367] lstrlenW (lpString=".doc") returned 4 [0061.367] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.367] lstrlenW (lpString=".docx") returned 5 [0061.367] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.367] lstrlenW (lpString=".pdf") returned 4 [0061.367] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.367] lstrlenW (lpString=".xls") returned 4 [0061.367] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.367] lstrlenW (lpString=".xlsx") returned 5 [0061.367] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.367] lstrlenW (lpString=".ppt") returned 4 [0061.367] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.367] lstrlenW (lpString=".zip") returned 4 [0061.367] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.367] lstrlenW (lpString=".rar") returned 4 [0061.367] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.367] lstrlenW (lpString=".bz2") returned 4 [0061.367] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.367] lstrlenW (lpString=".7z") returned 3 [0061.367] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.367] lstrlenW (lpString=".dbf") returned 4 [0061.367] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.367] lstrlenW (lpString=".1cd") returned 4 [0061.367] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.367] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.367] lstrlenW (lpString=".jpg") returned 4 [0061.368] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.368] lstrlenW (lpString=".doc") returned 4 [0061.368] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0061.368] lstrlenW (lpString=".docx") returned 5 [0061.368] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0061.368] lstrlenW (lpString=".pdf") returned 4 [0061.368] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0061.368] lstrlenW (lpString=".xls") returned 4 [0061.368] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0061.368] lstrlenW (lpString=".xlsx") returned 5 [0061.368] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0061.368] lstrlenW (lpString=".ppt") returned 4 [0061.368] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0061.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.368] lstrlenW (lpString=".zip") returned 4 [0061.368] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0061.368] lstrlenW (lpString=".rar") returned 4 [0061.368] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0061.368] lstrlenW (lpString=".bz2") returned 4 [0061.368] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0061.368] lstrlenW (lpString=".7z") returned 3 [0061.368] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0061.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.368] lstrlenW (lpString=".dbf") returned 4 [0061.368] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0061.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.368] lstrlenW (lpString=".1cd") returned 4 [0061.368] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0061.368] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0061.368] lstrlenW (lpString=".jpg") returned 4 [0061.369] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0061.369] lstrcmpiW (lpString1=".PNG", lpString2=".wiki") returned -1 [0061.369] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0061.369] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0061.375] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=30170) returned 1 [0061.375] CloseHandle (hObject=0x218) returned 1 [0061.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0061.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0061.380] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.380] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0061.380] GetLastError () returned 0x0 [0061.380] ReadFile (in: hFile=0x218, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x75da, lpOverlapped=0x0) returned 1 [0061.383] WriteFile (in: hFile=0x170, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0061.385] ReadFile (in: hFile=0x218, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.385] WriteFile (in: hFile=0x170, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0061.385] SetEndOfFile (hFile=0x170) returned 1 [0061.385] CloseHandle (hObject=0x170) returned 1 [0061.385] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.385] SetEndOfFile (hFile=0x218) returned 1 [0061.386] CloseHandle (hObject=0x218) returned 1 [0061.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.386] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0061.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.387] lstrlenW (lpString=".doc") returned 4 [0061.387] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.387] lstrlenW (lpString=".docx") returned 5 [0061.387] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.387] lstrlenW (lpString=".pdf") returned 4 [0061.387] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.387] lstrlenW (lpString=".xls") returned 4 [0061.387] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.387] lstrlenW (lpString=".xlsx") returned 5 [0061.387] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.387] lstrlenW (lpString=".ppt") returned 4 [0061.387] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.387] lstrlenW (lpString=".zip") returned 4 [0061.387] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.387] lstrlenW (lpString=".rar") returned 4 [0061.387] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.387] lstrlenW (lpString=".bz2") returned 4 [0061.387] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.387] lstrlenW (lpString=".7z") returned 3 [0061.387] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.387] lstrlenW (lpString=".dbf") returned 4 [0061.387] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.387] lstrlenW (lpString=".1cd") returned 4 [0061.387] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.388] lstrlenW (lpString=".jpg") returned 4 [0061.388] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.388] lstrlenW (lpString=".doc") returned 4 [0061.388] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0061.388] lstrlenW (lpString=".docx") returned 5 [0061.388] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0061.388] lstrlenW (lpString=".pdf") returned 4 [0061.388] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0061.388] lstrlenW (lpString=".xls") returned 4 [0061.388] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0061.388] lstrlenW (lpString=".xlsx") returned 5 [0061.388] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0061.388] lstrlenW (lpString=".ppt") returned 4 [0061.388] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0061.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.388] lstrlenW (lpString=".zip") returned 4 [0061.388] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0061.388] lstrlenW (lpString=".rar") returned 4 [0061.388] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0061.388] lstrlenW (lpString=".bz2") returned 4 [0061.388] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0061.388] lstrlenW (lpString=".7z") returned 3 [0061.388] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0061.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.388] lstrlenW (lpString=".dbf") returned 4 [0061.388] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0061.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.388] lstrlenW (lpString=".1cd") returned 4 [0061.388] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0061.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0061.388] lstrlenW (lpString=".jpg") returned 4 [0061.389] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0061.389] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0061.389] lstrlenW (lpString="FM20.CHM") returned 8 [0061.389] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0061.390] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=334427) returned 1 [0061.390] CloseHandle (hObject=0x218) returned 1 [0061.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0061.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0061.390] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.390] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0061.391] GetLastError () returned 0x0 [0061.391] ReadFile (in: hFile=0x218, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0061.425] WriteFile (in: hFile=0x170, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0061.432] ReadFile (in: hFile=0x218, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0061.432] WriteFile (in: hFile=0x170, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0061.433] SetEndOfFile (hFile=0x170) returned 1 [0061.433] CloseHandle (hObject=0x170) returned 1 [0061.433] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.433] SetEndOfFile (hFile=0x218) returned 1 [0061.436] CloseHandle (hObject=0x218) returned 1 [0061.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0061.437] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0061.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.437] lstrlenW (lpString=".doc") returned 4 [0061.437] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0061.437] lstrlenW (lpString=".docx") returned 5 [0061.437] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0061.437] lstrlenW (lpString=".pdf") returned 4 [0061.437] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0061.437] lstrlenW (lpString=".xls") returned 4 [0061.437] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0061.437] lstrlenW (lpString=".xlsx") returned 5 [0061.437] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0061.437] lstrlenW (lpString=".ppt") returned 4 [0061.437] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0061.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.437] lstrlenW (lpString=".zip") returned 4 [0061.437] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0061.437] lstrlenW (lpString=".rar") returned 4 [0061.437] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0061.437] lstrlenW (lpString=".bz2") returned 4 [0061.437] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0061.437] lstrlenW (lpString=".7z") returned 3 [0061.438] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0061.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.438] lstrlenW (lpString=".dbf") returned 4 [0061.438] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0061.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.438] lstrlenW (lpString=".1cd") returned 4 [0061.438] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0061.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.438] lstrlenW (lpString=".jpg") returned 4 [0061.438] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0061.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.438] lstrlenW (lpString=".doc") returned 4 [0061.438] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0061.438] lstrlenW (lpString=".docx") returned 5 [0061.438] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0061.438] lstrlenW (lpString=".pdf") returned 4 [0061.438] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0061.438] lstrlenW (lpString=".xls") returned 4 [0061.438] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0061.438] lstrlenW (lpString=".xlsx") returned 5 [0061.438] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0061.438] lstrlenW (lpString=".ppt") returned 4 [0061.438] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0061.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.438] lstrlenW (lpString=".zip") returned 4 [0061.438] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0061.438] lstrlenW (lpString=".rar") returned 4 [0061.438] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0061.438] lstrlenW (lpString=".bz2") returned 4 [0061.439] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0061.439] lstrlenW (lpString=".7z") returned 3 [0061.439] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0061.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.439] lstrlenW (lpString=".dbf") returned 4 [0061.439] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0061.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.439] lstrlenW (lpString=".1cd") returned 4 [0061.439] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0061.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0061.439] lstrlenW (lpString=".jpg") returned 4 [0061.439] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0061.439] lstrcmpiW (lpString1=".CHM", lpString2=".wiki") returned -1 [0061.439] lstrlenW (lpString="VBLR6.CHM") returned 9 [0061.439] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0061.440] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=944994) returned 1 [0061.440] CloseHandle (hObject=0x218) returned 1 [0061.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0061.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0061.440] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.440] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0061.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0061.540] GetLastError () returned 0x0 [0061.540] ReadFile (in: hFile=0x218, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0062.020] WriteFile (in: hFile=0x170, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0062.281] ReadFile (in: hFile=0x218, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0062.282] WriteFile (in: hFile=0x170, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0062.282] SetEndOfFile (hFile=0x170) returned 1 [0062.282] CloseHandle (hObject=0x170) returned 1 [0062.282] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0062.282] SetEndOfFile (hFile=0x218) returned 1 [0062.290] CloseHandle (hObject=0x218) returned 1 [0062.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0062.290] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0062.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.291] lstrlenW (lpString=".doc") returned 4 [0062.291] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.291] lstrlenW (lpString=".docx") returned 5 [0062.291] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0062.291] lstrlenW (lpString=".pdf") returned 4 [0062.291] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.291] lstrlenW (lpString=".xls") returned 4 [0062.291] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.291] lstrlenW (lpString=".xlsx") returned 5 [0062.291] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0062.291] lstrlenW (lpString=".ppt") returned 4 [0062.291] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.291] lstrlenW (lpString=".zip") returned 4 [0062.291] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.291] lstrlenW (lpString=".rar") returned 4 [0062.291] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.291] lstrlenW (lpString=".bz2") returned 4 [0062.291] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.291] lstrlenW (lpString=".7z") returned 3 [0062.291] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.291] lstrlenW (lpString=".dbf") returned 4 [0062.291] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.291] lstrlenW (lpString=".1cd") returned 4 [0062.292] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.292] lstrlenW (lpString=".jpg") returned 4 [0062.292] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.292] lstrlenW (lpString=".doc") returned 4 [0062.292] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0062.292] lstrlenW (lpString=".docx") returned 5 [0062.292] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0062.292] lstrlenW (lpString=".pdf") returned 4 [0062.292] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0062.292] lstrlenW (lpString=".xls") returned 4 [0062.292] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0062.292] lstrlenW (lpString=".xlsx") returned 5 [0062.292] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0062.292] lstrlenW (lpString=".ppt") returned 4 [0062.292] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0062.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.292] lstrlenW (lpString=".zip") returned 4 [0062.292] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0062.292] lstrlenW (lpString=".rar") returned 4 [0062.292] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0062.292] lstrlenW (lpString=".bz2") returned 4 [0062.292] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0062.292] lstrlenW (lpString=".7z") returned 3 [0062.292] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0062.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.292] lstrlenW (lpString=".dbf") returned 4 [0062.292] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0062.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.293] lstrlenW (lpString=".1cd") returned 4 [0062.293] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0062.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0062.293] lstrlenW (lpString=".jpg") returned 4 [0062.293] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0062.293] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0062.293] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0062.293] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.451] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=11861) returned 1 [0062.451] CloseHandle (hObject=0x214) returned 1 [0062.451] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0062.451] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.451] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.451] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.451] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.451] lstrlenW (lpString=".doc") returned 4 [0062.451] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.451] lstrlenW (lpString=".docx") returned 5 [0062.452] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0062.452] lstrlenW (lpString=".pdf") returned 4 [0062.452] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.452] lstrlenW (lpString=".xls") returned 4 [0062.452] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.452] lstrlenW (lpString=".xlsx") returned 5 [0062.452] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0062.452] lstrlenW (lpString=".ppt") returned 4 [0062.452] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.452] lstrlenW (lpString=".zip") returned 4 [0062.452] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.452] lstrlenW (lpString=".rar") returned 4 [0062.452] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.452] lstrlenW (lpString=".bz2") returned 4 [0062.452] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.452] lstrlenW (lpString=".7z") returned 3 [0062.452] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.452] lstrlenW (lpString=".dbf") returned 4 [0062.452] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.452] lstrlenW (lpString=".1cd") returned 4 [0062.452] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.452] lstrlenW (lpString=".jpg") returned 4 [0062.452] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.452] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.452] lstrlenW (lpString=".doc") returned 4 [0062.452] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.452] lstrlenW (lpString=".docx") returned 5 [0062.453] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0062.453] lstrlenW (lpString=".pdf") returned 4 [0062.453] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.453] lstrlenW (lpString=".xls") returned 4 [0062.453] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.453] lstrlenW (lpString=".xlsx") returned 5 [0062.453] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0062.453] lstrlenW (lpString=".ppt") returned 4 [0062.453] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.453] lstrlenW (lpString=".zip") returned 4 [0062.453] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.453] lstrlenW (lpString=".rar") returned 4 [0062.453] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.453] lstrlenW (lpString=".bz2") returned 4 [0062.453] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.453] lstrlenW (lpString=".7z") returned 3 [0062.453] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.453] lstrlenW (lpString=".dbf") returned 4 [0062.453] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.453] lstrlenW (lpString=".1cd") returned 4 [0062.453] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.453] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0062.453] lstrlenW (lpString=".jpg") returned 4 [0062.453] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.453] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0062.454] lstrlenW (lpString="babyblue.png") returned 12 [0062.454] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.456] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=12349) returned 1 [0062.456] CloseHandle (hObject=0x214) returned 1 [0062.456] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png")) returned 0x20 [0062.456] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.456] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyblue.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.456] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.456] lstrlenW (lpString=".doc") returned 4 [0062.456] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.456] lstrlenW (lpString=".docx") returned 5 [0062.456] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0062.456] lstrlenW (lpString=".pdf") returned 4 [0062.456] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.456] lstrlenW (lpString=".xls") returned 4 [0062.456] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.457] lstrlenW (lpString=".xlsx") returned 5 [0062.457] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0062.457] lstrlenW (lpString=".ppt") returned 4 [0062.457] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.457] lstrlenW (lpString=".zip") returned 4 [0062.457] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.457] lstrlenW (lpString=".rar") returned 4 [0062.457] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.457] lstrlenW (lpString=".bz2") returned 4 [0062.457] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.457] lstrlenW (lpString=".7z") returned 3 [0062.457] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.457] lstrlenW (lpString=".dbf") returned 4 [0062.457] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.457] lstrlenW (lpString=".1cd") returned 4 [0062.457] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.457] lstrlenW (lpString=".jpg") returned 4 [0062.457] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.457] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.457] lstrlenW (lpString=".doc") returned 4 [0062.457] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0062.457] lstrlenW (lpString=".docx") returned 5 [0062.457] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0062.457] lstrlenW (lpString=".pdf") returned 4 [0062.457] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0062.457] lstrlenW (lpString=".xls") returned 4 [0062.457] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0062.458] lstrlenW (lpString=".xlsx") returned 5 [0062.458] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0062.458] lstrlenW (lpString=".ppt") returned 4 [0062.458] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0062.458] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.458] lstrlenW (lpString=".zip") returned 4 [0062.458] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0062.458] lstrlenW (lpString=".rar") returned 4 [0062.458] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0062.458] lstrlenW (lpString=".bz2") returned 4 [0062.458] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0062.458] lstrlenW (lpString=".7z") returned 3 [0062.458] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0062.458] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.458] lstrlenW (lpString=".dbf") returned 4 [0062.458] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0062.458] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.458] lstrlenW (lpString=".1cd") returned 4 [0062.458] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0062.458] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\babyblue.png") returned 64 [0062.458] lstrlenW (lpString=".jpg") returned 4 [0062.458] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0062.458] lstrcmpiW (lpString1=".wmv", lpString2=".wiki") returned 1 [0062.458] lstrlenW (lpString="BabyBoyMainBackground.wmv") returned 25 [0062.458] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.459] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=341322) returned 1 [0062.459] CloseHandle (hObject=0x214) returned 1 [0062.459] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv")) returned 0x20 [0062.459] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.459] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.460] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.460] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.460] lstrlenW (lpString=".doc") returned 4 [0062.460] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0062.460] lstrlenW (lpString=".docx") returned 5 [0062.460] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0062.460] lstrlenW (lpString=".pdf") returned 4 [0062.460] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0062.460] lstrlenW (lpString=".xls") returned 4 [0062.460] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0062.460] lstrlenW (lpString=".xlsx") returned 5 [0062.460] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0062.460] lstrlenW (lpString=".ppt") returned 4 [0062.460] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0062.460] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.460] lstrlenW (lpString=".zip") returned 4 [0062.460] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0062.460] lstrlenW (lpString=".rar") returned 4 [0062.460] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0062.460] lstrlenW (lpString=".bz2") returned 4 [0062.460] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0062.460] lstrlenW (lpString=".7z") returned 3 [0062.460] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0062.460] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.460] lstrlenW (lpString=".dbf") returned 4 [0062.460] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0062.460] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.460] lstrlenW (lpString=".1cd") returned 4 [0062.460] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0062.460] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.460] lstrlenW (lpString=".jpg") returned 4 [0062.460] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0062.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.461] lstrlenW (lpString=".doc") returned 4 [0062.461] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0062.461] lstrlenW (lpString=".docx") returned 5 [0062.461] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0062.461] lstrlenW (lpString=".pdf") returned 4 [0062.461] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0062.461] lstrlenW (lpString=".xls") returned 4 [0062.461] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0062.461] lstrlenW (lpString=".xlsx") returned 5 [0062.461] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0062.461] lstrlenW (lpString=".ppt") returned 4 [0062.461] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0062.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.461] lstrlenW (lpString=".zip") returned 4 [0062.461] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0062.461] lstrlenW (lpString=".rar") returned 4 [0062.461] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0062.461] lstrlenW (lpString=".bz2") returned 4 [0062.461] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0062.461] lstrlenW (lpString=".7z") returned 3 [0062.461] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0062.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.461] lstrlenW (lpString=".dbf") returned 4 [0062.461] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0062.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.461] lstrlenW (lpString=".1cd") returned 4 [0062.461] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0062.461] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground.wmv") returned 77 [0062.461] lstrlenW (lpString=".jpg") returned 4 [0062.461] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0062.462] lstrcmpiW (lpString1=".wmv", lpString2=".wiki") returned 1 [0062.462] lstrlenW (lpString="BabyBoyMainBackground_PAL.wmv") returned 29 [0062.462] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.462] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=325322) returned 1 [0062.462] CloseHandle (hObject=0x214) returned 1 [0062.464] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv")) returned 0x20 [0062.464] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.464] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymainbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.464] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.464] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.464] lstrlenW (lpString=".doc") returned 4 [0062.464] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0062.464] lstrlenW (lpString=".docx") returned 5 [0062.464] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0062.464] lstrlenW (lpString=".pdf") returned 4 [0062.464] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0062.464] lstrlenW (lpString=".xls") returned 4 [0062.464] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0062.464] lstrlenW (lpString=".xlsx") returned 5 [0062.464] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0062.464] lstrlenW (lpString=".ppt") returned 4 [0062.464] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0062.464] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.464] lstrlenW (lpString=".zip") returned 4 [0062.464] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0062.464] lstrlenW (lpString=".rar") returned 4 [0062.464] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0062.464] lstrlenW (lpString=".bz2") returned 4 [0062.465] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0062.465] lstrlenW (lpString=".7z") returned 3 [0062.465] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0062.465] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.465] lstrlenW (lpString=".dbf") returned 4 [0062.465] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0062.465] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.465] lstrlenW (lpString=".1cd") returned 4 [0062.465] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0062.465] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.465] lstrlenW (lpString=".jpg") returned 4 [0062.465] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0062.465] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.465] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.465] lstrlenW (lpString=".doc") returned 4 [0062.465] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0062.465] lstrlenW (lpString=".docx") returned 5 [0062.465] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0062.465] lstrlenW (lpString=".pdf") returned 4 [0062.465] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0062.465] lstrlenW (lpString=".xls") returned 4 [0062.465] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0062.465] lstrlenW (lpString=".xlsx") returned 5 [0062.465] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0062.465] lstrlenW (lpString=".ppt") returned 4 [0062.465] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0062.465] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.465] lstrlenW (lpString=".zip") returned 4 [0062.465] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0062.465] lstrlenW (lpString=".rar") returned 4 [0062.465] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0062.465] lstrlenW (lpString=".bz2") returned 4 [0062.466] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0062.466] lstrlenW (lpString=".7z") returned 3 [0062.466] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0062.466] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.466] lstrlenW (lpString=".dbf") returned 4 [0062.466] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0062.466] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.466] lstrlenW (lpString=".1cd") returned 4 [0062.466] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0062.466] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainBackground_PAL.wmv") returned 81 [0062.466] lstrlenW (lpString=".jpg") returned 4 [0062.466] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0062.466] lstrcmpiW (lpString1=".wmv", lpString2=".wiki") returned 1 [0062.466] lstrlenW (lpString="BabyBoyMainToNotesBackground.wmv") returned 32 [0062.466] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.466] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=141214) returned 1 [0062.466] CloseHandle (hObject=0x214) returned 1 [0062.466] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv")) returned 0x20 [0062.467] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.467] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.467] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.467] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.467] lstrlenW (lpString=".doc") returned 4 [0062.467] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0062.467] lstrlenW (lpString=".docx") returned 5 [0062.467] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0062.467] lstrlenW (lpString=".pdf") returned 4 [0062.467] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0062.467] lstrlenW (lpString=".xls") returned 4 [0062.467] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0062.467] lstrlenW (lpString=".xlsx") returned 5 [0062.467] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0062.467] lstrlenW (lpString=".ppt") returned 4 [0062.467] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0062.467] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.467] lstrlenW (lpString=".zip") returned 4 [0062.467] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0062.467] lstrlenW (lpString=".rar") returned 4 [0062.467] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0062.467] lstrlenW (lpString=".bz2") returned 4 [0062.467] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0062.467] lstrlenW (lpString=".7z") returned 3 [0062.467] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0062.467] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.467] lstrlenW (lpString=".dbf") returned 4 [0062.467] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0062.468] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.468] lstrlenW (lpString=".1cd") returned 4 [0062.468] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0062.468] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.468] lstrlenW (lpString=".jpg") returned 4 [0062.468] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0062.468] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.468] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.468] lstrlenW (lpString=".doc") returned 4 [0062.468] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0062.468] lstrlenW (lpString=".docx") returned 5 [0062.468] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0062.468] lstrlenW (lpString=".pdf") returned 4 [0062.468] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0062.468] lstrlenW (lpString=".xls") returned 4 [0062.468] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0062.468] lstrlenW (lpString=".xlsx") returned 5 [0062.468] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0062.468] lstrlenW (lpString=".ppt") returned 4 [0062.468] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0062.468] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.468] lstrlenW (lpString=".zip") returned 4 [0062.468] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0062.468] lstrlenW (lpString=".rar") returned 4 [0062.468] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0062.468] lstrlenW (lpString=".bz2") returned 4 [0062.468] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0062.468] lstrlenW (lpString=".7z") returned 3 [0062.468] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0062.468] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.468] lstrlenW (lpString=".dbf") returned 4 [0062.468] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0062.469] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.469] lstrlenW (lpString=".1cd") returned 4 [0062.469] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0062.469] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground.wmv") returned 84 [0062.469] lstrlenW (lpString=".jpg") returned 4 [0062.469] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0062.469] lstrcmpiW (lpString1=".wmv", lpString2=".wiki") returned 1 [0062.469] lstrlenW (lpString="BabyBoyMainToNotesBackground_PAL.wmv") returned 36 [0062.469] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0062.469] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=157214) returned 1 [0062.469] CloseHandle (hObject=0x214) returned 1 [0062.469] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0062.469] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0062.469] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0062.469] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0062.470] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0062.470] lstrlenW (lpString=".doc") returned 4 [0062.470] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0062.470] lstrlenW (lpString=".docx") returned 5 [0062.470] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0062.470] lstrlenW (lpString=".pdf") returned 4 [0062.470] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0062.470] lstrlenW (lpString=".xls") returned 4 [0062.470] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0062.470] lstrlenW (lpString=".xlsx") returned 5 [0062.470] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0062.470] lstrlenW (lpString=".ppt") returned 4 [0062.470] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0062.470] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0062.470] lstrlenW (lpString=".zip") returned 4 [0062.470] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0062.470] lstrlenW (lpString=".rar") returned 4 [0062.470] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0062.470] lstrlenW (lpString=".bz2") returned 4 [0062.470] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0062.470] lstrlenW (lpString=".7z") returned 3 [0062.470] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0062.470] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0062.470] lstrlenW (lpString=".dbf") returned 4 [0062.470] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0064.530] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.240] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.241] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0065.257] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.257] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0065.258] GetLastError () returned 0x0 [0065.258] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4360, lpOverlapped=0x0) returned 1 [0065.267] WriteFile (in: hFile=0x174, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4370, lpOverlapped=0x0) returned 1 [0065.268] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.268] WriteFile (in: hFile=0x174, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0065.268] SetEndOfFile (hFile=0x174) returned 1 [0065.268] CloseHandle (hObject=0x174) returned 1 [0065.269] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.269] SetEndOfFile (hFile=0x1fc) returned 1 [0065.269] CloseHandle (hObject=0x1fc) returned 1 [0065.270] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0065.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.270] lstrlenW (lpString=".doc") returned 4 [0065.270] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.270] lstrlenW (lpString=".docx") returned 5 [0065.270] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.270] lstrlenW (lpString=".pdf") returned 4 [0065.270] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.271] lstrlenW (lpString=".xls") returned 4 [0065.271] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.271] lstrlenW (lpString=".xlsx") returned 5 [0065.271] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.271] lstrlenW (lpString=".ppt") returned 4 [0065.271] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.271] lstrlenW (lpString=".zip") returned 4 [0065.271] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.271] lstrlenW (lpString=".rar") returned 4 [0065.271] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.271] lstrlenW (lpString=".bz2") returned 4 [0065.271] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.271] lstrlenW (lpString=".7z") returned 3 [0065.271] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.271] lstrlenW (lpString=".dbf") returned 4 [0065.271] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.271] lstrlenW (lpString=".1cd") returned 4 [0065.271] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.271] lstrlenW (lpString=".jpg") returned 4 [0065.271] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.271] lstrlenW (lpString=".doc") returned 4 [0065.271] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.271] lstrlenW (lpString=".docx") returned 5 [0065.271] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.272] lstrlenW (lpString=".pdf") returned 4 [0065.272] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.272] lstrlenW (lpString=".xls") returned 4 [0065.272] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.272] lstrlenW (lpString=".xlsx") returned 5 [0065.272] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.272] lstrlenW (lpString=".ppt") returned 4 [0065.272] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.272] lstrlenW (lpString=".zip") returned 4 [0065.272] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.272] lstrlenW (lpString=".rar") returned 4 [0065.272] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.272] lstrlenW (lpString=".bz2") returned 4 [0065.272] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.272] lstrlenW (lpString=".7z") returned 3 [0065.272] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.272] lstrlenW (lpString=".dbf") returned 4 [0065.272] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.272] lstrlenW (lpString=".1cd") returned 4 [0065.272] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0065.272] lstrlenW (lpString=".jpg") returned 4 [0065.272] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.272] lstrcmpiW (lpString1=".xsl", lpString2=".wiki") returned 1 [0065.273] lstrlenW (lpString="as90.xsl") returned 8 [0065.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0065.274] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=18738) returned 1 [0065.274] CloseHandle (hObject=0x1fc) returned 1 [0065.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 0x20 [0065.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0065.274] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.274] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x174 [0065.274] GetLastError () returned 0x0 [0065.274] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4932, lpOverlapped=0x0) returned 1 [0065.509] WriteFile (in: hFile=0x174, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0065.511] ReadFile (in: hFile=0x1fc, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0065.511] WriteFile (in: hFile=0x174, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0065.512] SetEndOfFile (hFile=0x174) returned 1 [0065.512] CloseHandle (hObject=0x174) returned 1 [0065.524] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0065.524] SetEndOfFile (hFile=0x1fc) returned 1 [0065.525] CloseHandle (hObject=0x1fc) returned 1 [0065.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.526] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0065.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.526] lstrlenW (lpString=".doc") returned 4 [0065.526] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.526] lstrlenW (lpString=".docx") returned 5 [0065.526] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.526] lstrlenW (lpString=".pdf") returned 4 [0065.526] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.526] lstrlenW (lpString=".xls") returned 4 [0065.526] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.526] lstrlenW (lpString=".xlsx") returned 5 [0065.526] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.526] lstrlenW (lpString=".ppt") returned 4 [0065.526] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.526] lstrlenW (lpString=".zip") returned 4 [0065.526] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.527] lstrlenW (lpString=".rar") returned 4 [0065.527] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.527] lstrlenW (lpString=".bz2") returned 4 [0065.527] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.527] lstrlenW (lpString=".7z") returned 3 [0065.527] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.527] lstrlenW (lpString=".dbf") returned 4 [0065.527] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.527] lstrlenW (lpString=".1cd") returned 4 [0065.527] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.527] lstrlenW (lpString=".jpg") returned 4 [0065.527] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.527] lstrlenW (lpString=".doc") returned 4 [0065.527] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0065.527] lstrlenW (lpString=".docx") returned 5 [0065.527] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0065.527] lstrlenW (lpString=".pdf") returned 4 [0065.527] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0065.527] lstrlenW (lpString=".xls") returned 4 [0065.527] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0065.527] lstrlenW (lpString=".xlsx") returned 5 [0065.527] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0065.527] lstrlenW (lpString=".ppt") returned 4 [0065.527] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0065.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.528] lstrlenW (lpString=".zip") returned 4 [0065.528] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0065.528] lstrlenW (lpString=".rar") returned 4 [0065.528] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0065.528] lstrlenW (lpString=".bz2") returned 4 [0065.528] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0065.528] lstrlenW (lpString=".7z") returned 3 [0065.528] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0065.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.528] lstrlenW (lpString=".dbf") returned 4 [0065.528] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0065.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.528] lstrlenW (lpString=".1cd") returned 4 [0065.528] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0065.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0065.529] lstrlenW (lpString=".jpg") returned 4 [0065.529] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0065.529] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0065.529] lstrlenW (lpString="AG00021_.GIF") returned 12 [0065.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.589] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=14873) returned 1 [0066.589] CloseHandle (hObject=0x210) returned 1 [0066.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0066.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.612] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.612] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.651] GetLastError () returned 0x0 [0066.651] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0066.653] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0066.654] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.655] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.655] SetEndOfFile (hFile=0x1e8) returned 1 [0066.655] CloseHandle (hObject=0x1e8) returned 1 [0066.655] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.655] SetEndOfFile (hFile=0x210) returned 1 [0066.656] CloseHandle (hObject=0x210) returned 1 [0066.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0066.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.656] lstrlenW (lpString=".doc") returned 4 [0066.656] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.656] lstrlenW (lpString=".docx") returned 5 [0066.656] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.657] lstrlenW (lpString=".pdf") returned 4 [0066.657] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.657] lstrlenW (lpString=".xls") returned 4 [0066.657] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.657] lstrlenW (lpString=".xlsx") returned 5 [0066.657] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.657] lstrlenW (lpString=".ppt") returned 4 [0066.657] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.657] lstrlenW (lpString=".zip") returned 4 [0066.657] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.657] lstrlenW (lpString=".rar") returned 4 [0066.657] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.657] lstrlenW (lpString=".bz2") returned 4 [0066.657] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.657] lstrlenW (lpString=".7z") returned 3 [0066.657] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.657] lstrlenW (lpString=".dbf") returned 4 [0066.657] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.657] lstrlenW (lpString=".1cd") returned 4 [0066.657] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.657] lstrlenW (lpString=".jpg") returned 4 [0066.657] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.657] lstrlenW (lpString=".doc") returned 4 [0066.657] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.657] lstrlenW (lpString=".docx") returned 5 [0066.658] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.658] lstrlenW (lpString=".pdf") returned 4 [0066.658] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.658] lstrlenW (lpString=".xls") returned 4 [0066.658] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.658] lstrlenW (lpString=".xlsx") returned 5 [0066.658] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.658] lstrlenW (lpString=".ppt") returned 4 [0066.658] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.658] lstrlenW (lpString=".zip") returned 4 [0066.658] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.658] lstrlenW (lpString=".rar") returned 4 [0066.658] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.658] lstrlenW (lpString=".bz2") returned 4 [0066.658] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.658] lstrlenW (lpString=".7z") returned 3 [0066.658] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.658] lstrlenW (lpString=".dbf") returned 4 [0066.658] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.658] lstrlenW (lpString=".1cd") returned 4 [0066.658] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0066.658] lstrlenW (lpString=".jpg") returned 4 [0066.658] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.658] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.658] lstrlenW (lpString="AG00139_.GIF") returned 12 [0066.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.659] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=10607) returned 1 [0066.659] CloseHandle (hObject=0x210) returned 1 [0066.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0066.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.660] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.660] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.660] GetLastError () returned 0x0 [0066.660] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x296f, lpOverlapped=0x0) returned 1 [0066.662] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x2970, lpOverlapped=0x0) returned 1 [0066.663] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.663] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.663] SetEndOfFile (hFile=0x1e8) returned 1 [0066.663] CloseHandle (hObject=0x1e8) returned 1 [0066.663] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.663] SetEndOfFile (hFile=0x210) returned 1 [0066.664] CloseHandle (hObject=0x210) returned 1 [0066.664] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0066.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.665] lstrlenW (lpString=".doc") returned 4 [0066.665] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.665] lstrlenW (lpString=".docx") returned 5 [0066.665] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.665] lstrlenW (lpString=".pdf") returned 4 [0066.665] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.665] lstrlenW (lpString=".xls") returned 4 [0066.665] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.665] lstrlenW (lpString=".xlsx") returned 5 [0066.665] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.665] lstrlenW (lpString=".ppt") returned 4 [0066.665] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.665] lstrlenW (lpString=".zip") returned 4 [0066.665] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.665] lstrlenW (lpString=".rar") returned 4 [0066.665] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.665] lstrlenW (lpString=".bz2") returned 4 [0066.665] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.665] lstrlenW (lpString=".7z") returned 3 [0066.665] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.665] lstrlenW (lpString=".dbf") returned 4 [0066.665] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.665] lstrlenW (lpString=".1cd") returned 4 [0066.665] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.665] lstrlenW (lpString=".jpg") returned 4 [0066.665] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.666] lstrlenW (lpString=".doc") returned 4 [0066.666] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.666] lstrlenW (lpString=".docx") returned 5 [0066.666] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.666] lstrlenW (lpString=".pdf") returned 4 [0066.666] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.666] lstrlenW (lpString=".xls") returned 4 [0066.666] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.666] lstrlenW (lpString=".xlsx") returned 5 [0066.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.666] lstrlenW (lpString=".ppt") returned 4 [0066.666] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.666] lstrlenW (lpString=".zip") returned 4 [0066.666] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.666] lstrlenW (lpString=".rar") returned 4 [0066.666] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.666] lstrlenW (lpString=".bz2") returned 4 [0066.666] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.666] lstrlenW (lpString=".7z") returned 3 [0066.666] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.666] lstrlenW (lpString=".dbf") returned 4 [0066.666] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.667] lstrlenW (lpString=".1cd") returned 4 [0066.667] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0066.667] lstrlenW (lpString=".jpg") returned 4 [0066.667] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.667] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.667] lstrlenW (lpString="AG00142_.GIF") returned 12 [0066.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.667] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=15308) returned 1 [0066.667] CloseHandle (hObject=0x210) returned 1 [0066.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0066.667] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.667] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.668] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.668] GetLastError () returned 0x0 [0066.668] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0066.670] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0066.671] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.671] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.671] SetEndOfFile (hFile=0x1e8) returned 1 [0066.671] CloseHandle (hObject=0x1e8) returned 1 [0066.671] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.671] SetEndOfFile (hFile=0x210) returned 1 [0066.672] CloseHandle (hObject=0x210) returned 1 [0066.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0066.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.673] lstrlenW (lpString=".doc") returned 4 [0066.673] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.673] lstrlenW (lpString=".docx") returned 5 [0066.673] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.673] lstrlenW (lpString=".pdf") returned 4 [0066.673] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.673] lstrlenW (lpString=".xls") returned 4 [0066.673] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.673] lstrlenW (lpString=".xlsx") returned 5 [0066.673] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.673] lstrlenW (lpString=".ppt") returned 4 [0066.673] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.673] lstrlenW (lpString=".zip") returned 4 [0066.673] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.673] lstrlenW (lpString=".rar") returned 4 [0066.673] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.673] lstrlenW (lpString=".bz2") returned 4 [0066.673] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.673] lstrlenW (lpString=".7z") returned 3 [0066.673] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.673] lstrlenW (lpString=".dbf") returned 4 [0066.673] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.673] lstrlenW (lpString=".1cd") returned 4 [0066.673] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.673] lstrlenW (lpString=".jpg") returned 4 [0066.673] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.674] lstrlenW (lpString=".doc") returned 4 [0066.674] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.674] lstrlenW (lpString=".docx") returned 5 [0066.674] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.674] lstrlenW (lpString=".pdf") returned 4 [0066.674] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.674] lstrlenW (lpString=".xls") returned 4 [0066.674] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.674] lstrlenW (lpString=".xlsx") returned 5 [0066.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.674] lstrlenW (lpString=".ppt") returned 4 [0066.674] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.674] lstrlenW (lpString=".zip") returned 4 [0066.674] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.674] lstrlenW (lpString=".rar") returned 4 [0066.674] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.674] lstrlenW (lpString=".bz2") returned 4 [0066.674] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.674] lstrlenW (lpString=".7z") returned 3 [0066.674] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.674] lstrlenW (lpString=".dbf") returned 4 [0066.674] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.674] lstrlenW (lpString=".1cd") returned 4 [0066.674] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0066.674] lstrlenW (lpString=".jpg") returned 4 [0066.674] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.675] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.675] lstrlenW (lpString="AG00154_.GIF") returned 12 [0066.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.675] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5315) returned 1 [0066.675] CloseHandle (hObject=0x210) returned 1 [0066.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0066.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.675] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.675] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.676] GetLastError () returned 0x0 [0066.676] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x14c3, lpOverlapped=0x0) returned 1 [0066.678] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0066.679] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.679] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.679] SetEndOfFile (hFile=0x1e8) returned 1 [0066.679] CloseHandle (hObject=0x1e8) returned 1 [0066.679] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.679] SetEndOfFile (hFile=0x210) returned 1 [0066.680] CloseHandle (hObject=0x210) returned 1 [0066.680] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.680] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0066.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.680] lstrlenW (lpString=".doc") returned 4 [0066.680] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.681] lstrlenW (lpString=".docx") returned 5 [0066.681] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.681] lstrlenW (lpString=".pdf") returned 4 [0066.681] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.681] lstrlenW (lpString=".xls") returned 4 [0066.681] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.681] lstrlenW (lpString=".xlsx") returned 5 [0066.681] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.681] lstrlenW (lpString=".ppt") returned 4 [0066.681] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.681] lstrlenW (lpString=".zip") returned 4 [0066.681] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.681] lstrlenW (lpString=".rar") returned 4 [0066.681] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.681] lstrlenW (lpString=".bz2") returned 4 [0066.681] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.681] lstrlenW (lpString=".7z") returned 3 [0066.681] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.681] lstrlenW (lpString=".dbf") returned 4 [0066.681] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.681] lstrlenW (lpString=".1cd") returned 4 [0066.681] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.681] lstrlenW (lpString=".jpg") returned 4 [0066.681] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.681] lstrlenW (lpString=".doc") returned 4 [0066.681] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.682] lstrlenW (lpString=".docx") returned 5 [0066.682] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.682] lstrlenW (lpString=".pdf") returned 4 [0066.682] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.682] lstrlenW (lpString=".xls") returned 4 [0066.682] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.682] lstrlenW (lpString=".xlsx") returned 5 [0066.682] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.682] lstrlenW (lpString=".ppt") returned 4 [0066.682] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.682] lstrlenW (lpString=".zip") returned 4 [0066.682] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.682] lstrlenW (lpString=".rar") returned 4 [0066.682] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.682] lstrlenW (lpString=".bz2") returned 4 [0066.682] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.682] lstrlenW (lpString=".7z") returned 3 [0066.682] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.682] lstrlenW (lpString=".dbf") returned 4 [0066.682] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.682] lstrlenW (lpString=".1cd") returned 4 [0066.682] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0066.682] lstrlenW (lpString=".jpg") returned 4 [0066.682] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.683] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.683] lstrlenW (lpString="AG00157_.GIF") returned 12 [0066.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.683] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4955) returned 1 [0066.683] CloseHandle (hObject=0x210) returned 1 [0066.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0066.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.683] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.683] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.684] GetLastError () returned 0x0 [0066.684] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x135b, lpOverlapped=0x0) returned 1 [0066.686] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0066.688] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0066.688] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0066.688] SetEndOfFile (hFile=0x1e8) returned 1 [0066.688] CloseHandle (hObject=0x1e8) returned 1 [0066.688] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.688] SetEndOfFile (hFile=0x210) returned 1 [0066.689] CloseHandle (hObject=0x210) returned 1 [0066.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.689] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0066.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.689] lstrlenW (lpString=".doc") returned 4 [0066.689] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.690] lstrlenW (lpString=".docx") returned 5 [0066.690] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.690] lstrlenW (lpString=".pdf") returned 4 [0066.690] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.690] lstrlenW (lpString=".xls") returned 4 [0066.690] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.690] lstrlenW (lpString=".xlsx") returned 5 [0066.690] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.690] lstrlenW (lpString=".ppt") returned 4 [0066.690] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.690] lstrlenW (lpString=".zip") returned 4 [0066.690] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.690] lstrlenW (lpString=".rar") returned 4 [0066.690] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.690] lstrlenW (lpString=".bz2") returned 4 [0066.690] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.690] lstrlenW (lpString=".7z") returned 3 [0066.690] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.690] lstrlenW (lpString=".dbf") returned 4 [0066.690] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.690] lstrlenW (lpString=".1cd") returned 4 [0066.690] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.690] lstrlenW (lpString=".jpg") returned 4 [0066.690] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.690] lstrlenW (lpString=".doc") returned 4 [0066.691] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0066.691] lstrlenW (lpString=".docx") returned 5 [0066.691] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0066.691] lstrlenW (lpString=".pdf") returned 4 [0066.691] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0066.691] lstrlenW (lpString=".xls") returned 4 [0066.691] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0066.691] lstrlenW (lpString=".xlsx") returned 5 [0066.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0066.691] lstrlenW (lpString=".ppt") returned 4 [0066.691] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0066.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.691] lstrlenW (lpString=".zip") returned 4 [0066.691] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0066.691] lstrlenW (lpString=".rar") returned 4 [0066.691] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0066.691] lstrlenW (lpString=".bz2") returned 4 [0066.691] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0066.691] lstrlenW (lpString=".7z") returned 3 [0066.691] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0066.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.691] lstrlenW (lpString=".dbf") returned 4 [0066.691] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0066.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.691] lstrlenW (lpString=".1cd") returned 4 [0066.691] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0066.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0066.691] lstrlenW (lpString=".jpg") returned 4 [0066.691] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0066.692] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0066.692] lstrlenW (lpString="AG00158_.GIF") returned 12 [0066.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.692] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5030) returned 1 [0066.692] CloseHandle (hObject=0x210) returned 1 [0066.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0066.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0066.692] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.692] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0066.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0066.693] GetLastError () returned 0x0 [0066.693] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x13a6, lpOverlapped=0x0) returned 1 [0067.322] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0067.323] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0067.323] WriteFile (in: hFile=0x1e8, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.323] SetEndOfFile (hFile=0x1e8) returned 1 [0067.477] CloseHandle (hObject=0x1e8) returned 1 [0067.477] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0067.477] SetEndOfFile (hFile=0x210) returned 1 [0067.478] CloseHandle (hObject=0x210) returned 1 [0067.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0067.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.638] lstrlenW (lpString=".doc") returned 4 [0067.638] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0067.638] lstrlenW (lpString=".docx") returned 5 [0067.638] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0067.638] lstrlenW (lpString=".pdf") returned 4 [0067.638] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0067.638] lstrlenW (lpString=".xls") returned 4 [0067.638] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0067.638] lstrlenW (lpString=".xlsx") returned 5 [0067.638] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0067.638] lstrlenW (lpString=".ppt") returned 4 [0067.638] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0067.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.638] lstrlenW (lpString=".zip") returned 4 [0067.638] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0067.638] lstrlenW (lpString=".rar") returned 4 [0067.638] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0067.638] lstrlenW (lpString=".bz2") returned 4 [0067.638] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0067.638] lstrlenW (lpString=".7z") returned 3 [0067.638] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0067.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.639] lstrlenW (lpString=".dbf") returned 4 [0067.639] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0067.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.639] lstrlenW (lpString=".1cd") returned 4 [0067.639] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0067.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.639] lstrlenW (lpString=".jpg") returned 4 [0067.639] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0067.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.639] lstrlenW (lpString=".doc") returned 4 [0067.639] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0067.639] lstrlenW (lpString=".docx") returned 5 [0067.639] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0067.639] lstrlenW (lpString=".pdf") returned 4 [0067.639] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0067.639] lstrlenW (lpString=".xls") returned 4 [0067.639] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0067.639] lstrlenW (lpString=".xlsx") returned 5 [0067.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0067.639] lstrlenW (lpString=".ppt") returned 4 [0067.639] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0067.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.639] lstrlenW (lpString=".zip") returned 4 [0067.639] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0067.639] lstrlenW (lpString=".rar") returned 4 [0067.639] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0067.639] lstrlenW (lpString=".bz2") returned 4 [0067.639] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0067.639] lstrlenW (lpString=".7z") returned 3 [0067.639] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0067.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.639] lstrlenW (lpString=".dbf") returned 4 [0067.640] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0067.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.640] lstrlenW (lpString=".1cd") returned 4 [0067.640] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0067.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0067.640] lstrlenW (lpString=".jpg") returned 4 [0067.640] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0067.640] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0067.640] lstrlenW (lpString="AG00169_.GIF") returned 12 [0067.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.151] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5375) returned 1 [0068.151] CloseHandle (hObject=0x20c) returned 1 [0068.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0068.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.169] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.169] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.169] GetLastError () returned 0x0 [0068.169] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0068.171] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0068.172] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.172] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.172] SetEndOfFile (hFile=0x1fc) returned 1 [0068.172] CloseHandle (hObject=0x1fc) returned 1 [0068.172] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.172] SetEndOfFile (hFile=0x20c) returned 1 [0068.173] CloseHandle (hObject=0x20c) returned 1 [0068.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0068.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.173] lstrlenW (lpString=".doc") returned 4 [0068.173] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.174] lstrlenW (lpString=".docx") returned 5 [0068.174] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.174] lstrlenW (lpString=".pdf") returned 4 [0068.174] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.174] lstrlenW (lpString=".xls") returned 4 [0068.174] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.174] lstrlenW (lpString=".xlsx") returned 5 [0068.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.174] lstrlenW (lpString=".ppt") returned 4 [0068.174] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.174] lstrlenW (lpString=".zip") returned 4 [0068.174] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.174] lstrlenW (lpString=".rar") returned 4 [0068.174] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.174] lstrlenW (lpString=".bz2") returned 4 [0068.174] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.174] lstrlenW (lpString=".7z") returned 3 [0068.174] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.174] lstrlenW (lpString=".dbf") returned 4 [0068.174] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.174] lstrlenW (lpString=".1cd") returned 4 [0068.174] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.174] lstrlenW (lpString=".jpg") returned 4 [0068.174] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.174] lstrlenW (lpString=".doc") returned 4 [0068.174] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.175] lstrlenW (lpString=".docx") returned 5 [0068.175] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.175] lstrlenW (lpString=".pdf") returned 4 [0068.175] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.175] lstrlenW (lpString=".xls") returned 4 [0068.175] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.175] lstrlenW (lpString=".xlsx") returned 5 [0068.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.175] lstrlenW (lpString=".ppt") returned 4 [0068.175] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.175] lstrlenW (lpString=".zip") returned 4 [0068.175] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.175] lstrlenW (lpString=".rar") returned 4 [0068.175] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.175] lstrlenW (lpString=".bz2") returned 4 [0068.175] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.175] lstrlenW (lpString=".7z") returned 3 [0068.175] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.175] lstrlenW (lpString=".dbf") returned 4 [0068.175] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.175] lstrlenW (lpString=".1cd") returned 4 [0068.175] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0068.175] lstrlenW (lpString=".jpg") returned 4 [0068.175] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.175] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0068.176] lstrlenW (lpString="AG00176_.GIF") returned 12 [0068.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.176] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3120) returned 1 [0068.176] CloseHandle (hObject=0x20c) returned 1 [0068.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0068.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.176] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.176] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.176] GetLastError () returned 0x0 [0068.176] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xc30, lpOverlapped=0x0) returned 1 [0068.178] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0068.179] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.179] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.179] SetEndOfFile (hFile=0x1fc) returned 1 [0068.179] CloseHandle (hObject=0x1fc) returned 1 [0068.179] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.179] SetEndOfFile (hFile=0x20c) returned 1 [0068.180] CloseHandle (hObject=0x20c) returned 1 [0068.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.181] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.181] lstrlenW (lpString=".doc") returned 4 [0068.181] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.181] lstrlenW (lpString=".docx") returned 5 [0068.181] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.181] lstrlenW (lpString=".pdf") returned 4 [0068.181] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString=".xls") returned 4 [0068.181] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString=".xlsx") returned 5 [0068.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.181] lstrlenW (lpString=".ppt") returned 4 [0068.181] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.181] lstrlenW (lpString=".zip") returned 4 [0068.181] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString=".rar") returned 4 [0068.181] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.181] lstrlenW (lpString=".bz2") returned 4 [0068.181] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.181] lstrlenW (lpString=".7z") returned 3 [0068.181] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.182] lstrlenW (lpString=".dbf") returned 4 [0068.182] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.182] lstrlenW (lpString=".1cd") returned 4 [0068.182] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.182] lstrlenW (lpString=".jpg") returned 4 [0068.182] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.182] lstrlenW (lpString=".doc") returned 4 [0068.182] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0068.182] lstrlenW (lpString=".docx") returned 5 [0068.182] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0068.182] lstrlenW (lpString=".pdf") returned 4 [0068.182] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0068.182] lstrlenW (lpString=".xls") returned 4 [0068.182] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0068.182] lstrlenW (lpString=".xlsx") returned 5 [0068.182] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0068.182] lstrlenW (lpString=".ppt") returned 4 [0068.182] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0068.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.182] lstrlenW (lpString=".zip") returned 4 [0068.182] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0068.182] lstrlenW (lpString=".rar") returned 4 [0068.182] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0068.182] lstrlenW (lpString=".bz2") returned 4 [0068.182] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0068.182] lstrlenW (lpString=".7z") returned 3 [0068.182] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0068.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.183] lstrlenW (lpString=".dbf") returned 4 [0068.183] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0068.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.183] lstrlenW (lpString=".1cd") returned 4 [0068.183] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0068.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0068.183] lstrlenW (lpString=".jpg") returned 4 [0068.183] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0068.183] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0068.183] lstrlenW (lpString="AN00010_.WMF") returned 12 [0068.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.184] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3026) returned 1 [0068.184] CloseHandle (hObject=0x20c) returned 1 [0068.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0068.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.186] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.186] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.186] GetLastError () returned 0x0 [0068.186] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xbd2, lpOverlapped=0x0) returned 1 [0068.190] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0068.191] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.191] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.191] SetEndOfFile (hFile=0x1fc) returned 1 [0068.191] CloseHandle (hObject=0x1fc) returned 1 [0068.191] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.192] SetEndOfFile (hFile=0x20c) returned 1 [0068.192] CloseHandle (hObject=0x20c) returned 1 [0068.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.193] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0068.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.193] lstrlenW (lpString=".doc") returned 4 [0068.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.193] lstrlenW (lpString=".docx") returned 5 [0068.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.193] lstrlenW (lpString=".pdf") returned 4 [0068.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.193] lstrlenW (lpString=".xls") returned 4 [0068.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.193] lstrlenW (lpString=".xlsx") returned 5 [0068.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.193] lstrlenW (lpString=".ppt") returned 4 [0068.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.193] lstrlenW (lpString=".zip") returned 4 [0068.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.193] lstrlenW (lpString=".rar") returned 4 [0068.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.193] lstrlenW (lpString=".bz2") returned 4 [0068.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.193] lstrlenW (lpString=".7z") returned 3 [0068.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.193] lstrlenW (lpString=".dbf") returned 4 [0068.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.194] lstrlenW (lpString=".1cd") returned 4 [0068.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.194] lstrlenW (lpString=".jpg") returned 4 [0068.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.194] lstrlenW (lpString=".doc") returned 4 [0068.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.194] lstrlenW (lpString=".docx") returned 5 [0068.194] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.194] lstrlenW (lpString=".pdf") returned 4 [0068.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.194] lstrlenW (lpString=".xls") returned 4 [0068.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.194] lstrlenW (lpString=".xlsx") returned 5 [0068.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.194] lstrlenW (lpString=".ppt") returned 4 [0068.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.194] lstrlenW (lpString=".zip") returned 4 [0068.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.194] lstrlenW (lpString=".rar") returned 4 [0068.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.195] lstrlenW (lpString=".bz2") returned 4 [0068.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.195] lstrlenW (lpString=".7z") returned 3 [0068.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.195] lstrlenW (lpString=".dbf") returned 4 [0068.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.195] lstrlenW (lpString=".1cd") returned 4 [0068.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0068.195] lstrlenW (lpString=".jpg") returned 4 [0068.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.195] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0068.195] lstrlenW (lpString="AN00015_.WMF") returned 12 [0068.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.196] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4734) returned 1 [0068.196] CloseHandle (hObject=0x20c) returned 1 [0068.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0068.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.196] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.196] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.196] GetLastError () returned 0x0 [0068.196] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x127e, lpOverlapped=0x0) returned 1 [0068.201] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1280, lpOverlapped=0x0) returned 1 [0068.202] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0068.202] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0068.202] SetEndOfFile (hFile=0x1fc) returned 1 [0068.202] CloseHandle (hObject=0x1fc) returned 1 [0068.202] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.202] SetEndOfFile (hFile=0x20c) returned 1 [0068.203] CloseHandle (hObject=0x20c) returned 1 [0068.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0068.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0068.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.203] lstrlenW (lpString=".doc") returned 4 [0068.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.204] lstrlenW (lpString=".docx") returned 5 [0068.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.204] lstrlenW (lpString=".pdf") returned 4 [0068.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.204] lstrlenW (lpString=".xls") returned 4 [0068.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.204] lstrlenW (lpString=".xlsx") returned 5 [0068.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.204] lstrlenW (lpString=".ppt") returned 4 [0068.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.204] lstrlenW (lpString=".zip") returned 4 [0068.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.204] lstrlenW (lpString=".rar") returned 4 [0068.204] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.204] lstrlenW (lpString=".bz2") returned 4 [0068.204] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.204] lstrlenW (lpString=".7z") returned 3 [0068.204] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.204] lstrlenW (lpString=".dbf") returned 4 [0068.204] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.204] lstrlenW (lpString=".1cd") returned 4 [0068.204] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.204] lstrlenW (lpString=".jpg") returned 4 [0068.204] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.204] lstrlenW (lpString=".doc") returned 4 [0068.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0068.205] lstrlenW (lpString=".docx") returned 5 [0068.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0068.205] lstrlenW (lpString=".pdf") returned 4 [0068.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0068.205] lstrlenW (lpString=".xls") returned 4 [0068.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0068.205] lstrlenW (lpString=".xlsx") returned 5 [0068.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0068.205] lstrlenW (lpString=".ppt") returned 4 [0068.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0068.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.205] lstrlenW (lpString=".zip") returned 4 [0068.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0068.205] lstrlenW (lpString=".rar") returned 4 [0068.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0068.205] lstrlenW (lpString=".bz2") returned 4 [0068.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0068.205] lstrlenW (lpString=".7z") returned 3 [0068.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0068.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.205] lstrlenW (lpString=".dbf") returned 4 [0068.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0068.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.205] lstrlenW (lpString=".1cd") returned 4 [0068.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0068.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0068.205] lstrlenW (lpString=".jpg") returned 4 [0068.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0068.205] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0068.205] lstrlenW (lpString="AN00790_.WMF") returned 12 [0068.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.207] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5684) returned 1 [0068.207] CloseHandle (hObject=0x20c) returned 1 [0068.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0068.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0068.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0068.207] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.207] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0068.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0068.207] GetLastError () returned 0x0 [0068.207] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x1634, lpOverlapped=0x0) returned 1 [0069.198] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1640, lpOverlapped=0x0) returned 1 [0069.199] ReadFile (in: hFile=0x20c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.199] WriteFile (in: hFile=0x1fc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.199] SetEndOfFile (hFile=0x1fc) returned 1 [0069.199] CloseHandle (hObject=0x1fc) returned 1 [0069.200] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.200] SetEndOfFile (hFile=0x20c) returned 1 [0069.200] CloseHandle (hObject=0x20c) returned 1 [0069.200] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.201] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0069.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.435] lstrlenW (lpString=".doc") returned 4 [0069.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.435] lstrlenW (lpString=".docx") returned 5 [0069.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.435] lstrlenW (lpString=".pdf") returned 4 [0069.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.435] lstrlenW (lpString=".xls") returned 4 [0069.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.444] lstrlenW (lpString=".xlsx") returned 5 [0069.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.444] lstrlenW (lpString=".ppt") returned 4 [0069.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.451] lstrlenW (lpString=".zip") returned 4 [0069.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.451] lstrlenW (lpString=".rar") returned 4 [0069.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.451] lstrlenW (lpString=".bz2") returned 4 [0069.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.451] lstrlenW (lpString=".7z") returned 3 [0069.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.451] lstrlenW (lpString=".dbf") returned 4 [0069.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.451] lstrlenW (lpString=".1cd") returned 4 [0069.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.452] lstrlenW (lpString=".jpg") returned 4 [0069.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.452] lstrlenW (lpString=".doc") returned 4 [0069.452] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.452] lstrlenW (lpString=".docx") returned 5 [0069.452] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.452] lstrlenW (lpString=".pdf") returned 4 [0069.452] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.452] lstrlenW (lpString=".xls") returned 4 [0069.452] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.452] lstrlenW (lpString=".xlsx") returned 5 [0069.452] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.452] lstrlenW (lpString=".ppt") returned 4 [0069.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.452] lstrlenW (lpString=".zip") returned 4 [0069.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.452] lstrlenW (lpString=".rar") returned 4 [0069.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.452] lstrlenW (lpString=".bz2") returned 4 [0069.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.452] lstrlenW (lpString=".7z") returned 3 [0069.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.452] lstrlenW (lpString=".dbf") returned 4 [0069.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.452] lstrlenW (lpString=".1cd") returned 4 [0069.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0069.453] lstrlenW (lpString=".jpg") returned 4 [0069.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.453] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.453] lstrlenW (lpString="AN04108_.WMF") returned 12 [0069.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.453] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2344) returned 1 [0069.453] CloseHandle (hObject=0x1f0) returned 1 [0069.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0069.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.453] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.453] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.454] GetLastError () returned 0x0 [0069.454] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x928, lpOverlapped=0x0) returned 1 [0069.456] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x930, lpOverlapped=0x0) returned 1 [0069.456] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.457] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.457] SetEndOfFile (hFile=0x200) returned 1 [0069.457] CloseHandle (hObject=0x200) returned 1 [0069.457] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.457] SetEndOfFile (hFile=0x1f0) returned 1 [0069.458] CloseHandle (hObject=0x1f0) returned 1 [0069.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.458] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0069.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.458] lstrlenW (lpString=".doc") returned 4 [0069.458] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.458] lstrlenW (lpString=".docx") returned 5 [0069.458] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.458] lstrlenW (lpString=".pdf") returned 4 [0069.458] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.458] lstrlenW (lpString=".xls") returned 4 [0069.458] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.458] lstrlenW (lpString=".xlsx") returned 5 [0069.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.459] lstrlenW (lpString=".ppt") returned 4 [0069.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.459] lstrlenW (lpString=".zip") returned 4 [0069.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.459] lstrlenW (lpString=".rar") returned 4 [0069.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.459] lstrlenW (lpString=".bz2") returned 4 [0069.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.459] lstrlenW (lpString=".7z") returned 3 [0069.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.459] lstrlenW (lpString=".dbf") returned 4 [0069.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.459] lstrlenW (lpString=".1cd") returned 4 [0069.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.459] lstrlenW (lpString=".jpg") returned 4 [0069.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.459] lstrlenW (lpString=".doc") returned 4 [0069.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.459] lstrlenW (lpString=".docx") returned 5 [0069.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.460] lstrlenW (lpString=".pdf") returned 4 [0069.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.460] lstrlenW (lpString=".xls") returned 4 [0069.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.460] lstrlenW (lpString=".xlsx") returned 5 [0069.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.460] lstrlenW (lpString=".ppt") returned 4 [0069.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.460] lstrlenW (lpString=".zip") returned 4 [0069.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.460] lstrlenW (lpString=".rar") returned 4 [0069.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.460] lstrlenW (lpString=".bz2") returned 4 [0069.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.460] lstrlenW (lpString=".7z") returned 3 [0069.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.460] lstrlenW (lpString=".dbf") returned 4 [0069.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.460] lstrlenW (lpString=".1cd") returned 4 [0069.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0069.460] lstrlenW (lpString=".jpg") returned 4 [0069.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.460] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.460] lstrlenW (lpString="AN04117_.WMF") returned 12 [0069.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.461] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=6060) returned 1 [0069.461] CloseHandle (hObject=0x1f0) returned 1 [0069.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0069.461] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.461] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.461] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.462] GetLastError () returned 0x0 [0069.462] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x17ac, lpOverlapped=0x0) returned 1 [0069.463] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0069.464] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.464] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.464] SetEndOfFile (hFile=0x200) returned 1 [0069.464] CloseHandle (hObject=0x200) returned 1 [0069.465] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.465] SetEndOfFile (hFile=0x1f0) returned 1 [0069.465] CloseHandle (hObject=0x1f0) returned 1 [0069.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.466] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0069.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.466] lstrlenW (lpString=".doc") returned 4 [0069.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.466] lstrlenW (lpString=".docx") returned 5 [0069.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.466] lstrlenW (lpString=".pdf") returned 4 [0069.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.466] lstrlenW (lpString=".xls") returned 4 [0069.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.466] lstrlenW (lpString=".xlsx") returned 5 [0069.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.466] lstrlenW (lpString=".ppt") returned 4 [0069.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.466] lstrlenW (lpString=".zip") returned 4 [0069.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.466] lstrlenW (lpString=".rar") returned 4 [0069.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.466] lstrlenW (lpString=".bz2") returned 4 [0069.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.466] lstrlenW (lpString=".7z") returned 3 [0069.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.467] lstrlenW (lpString=".dbf") returned 4 [0069.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.467] lstrlenW (lpString=".1cd") returned 4 [0069.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.467] lstrlenW (lpString=".jpg") returned 4 [0069.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.467] lstrlenW (lpString=".doc") returned 4 [0069.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.467] lstrlenW (lpString=".docx") returned 5 [0069.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.467] lstrlenW (lpString=".pdf") returned 4 [0069.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.467] lstrlenW (lpString=".xls") returned 4 [0069.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.467] lstrlenW (lpString=".xlsx") returned 5 [0069.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.467] lstrlenW (lpString=".ppt") returned 4 [0069.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.467] lstrlenW (lpString=".zip") returned 4 [0069.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.467] lstrlenW (lpString=".rar") returned 4 [0069.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.467] lstrlenW (lpString=".bz2") returned 4 [0069.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.467] lstrlenW (lpString=".7z") returned 3 [0069.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.468] lstrlenW (lpString=".dbf") returned 4 [0069.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.468] lstrlenW (lpString=".1cd") returned 4 [0069.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0069.468] lstrlenW (lpString=".jpg") returned 4 [0069.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.468] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.468] lstrlenW (lpString="AN04134_.WMF") returned 12 [0069.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.468] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=3416) returned 1 [0069.468] CloseHandle (hObject=0x1f0) returned 1 [0069.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0069.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.469] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.469] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.469] GetLastError () returned 0x0 [0069.469] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xd58, lpOverlapped=0x0) returned 1 [0069.473] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0069.474] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.474] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.475] SetEndOfFile (hFile=0x200) returned 1 [0069.475] CloseHandle (hObject=0x200) returned 1 [0069.475] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.475] SetEndOfFile (hFile=0x1f0) returned 1 [0069.476] CloseHandle (hObject=0x1f0) returned 1 [0069.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0069.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.476] lstrlenW (lpString=".doc") returned 4 [0069.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.476] lstrlenW (lpString=".docx") returned 5 [0069.476] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.476] lstrlenW (lpString=".pdf") returned 4 [0069.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.476] lstrlenW (lpString=".xls") returned 4 [0069.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.476] lstrlenW (lpString=".xlsx") returned 5 [0069.476] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.476] lstrlenW (lpString=".ppt") returned 4 [0069.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.477] lstrlenW (lpString=".zip") returned 4 [0069.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.477] lstrlenW (lpString=".rar") returned 4 [0069.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.477] lstrlenW (lpString=".bz2") returned 4 [0069.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.477] lstrlenW (lpString=".7z") returned 3 [0069.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.477] lstrlenW (lpString=".dbf") returned 4 [0069.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.477] lstrlenW (lpString=".1cd") returned 4 [0069.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.477] lstrlenW (lpString=".jpg") returned 4 [0069.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.477] lstrlenW (lpString=".doc") returned 4 [0069.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.477] lstrlenW (lpString=".docx") returned 5 [0069.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.477] lstrlenW (lpString=".pdf") returned 4 [0069.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.477] lstrlenW (lpString=".xls") returned 4 [0069.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.477] lstrlenW (lpString=".xlsx") returned 5 [0069.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.477] lstrlenW (lpString=".ppt") returned 4 [0069.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.478] lstrlenW (lpString=".zip") returned 4 [0069.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.478] lstrlenW (lpString=".rar") returned 4 [0069.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.478] lstrlenW (lpString=".bz2") returned 4 [0069.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.478] lstrlenW (lpString=".7z") returned 3 [0069.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.478] lstrlenW (lpString=".dbf") returned 4 [0069.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.478] lstrlenW (lpString=".1cd") returned 4 [0069.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0069.478] lstrlenW (lpString=".jpg") returned 4 [0069.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.478] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.478] lstrlenW (lpString="AN04174_.WMF") returned 12 [0069.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.479] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2636) returned 1 [0069.479] CloseHandle (hObject=0x1f0) returned 1 [0069.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0069.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.479] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.480] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.480] GetLastError () returned 0x0 [0069.480] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0069.481] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0069.482] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.482] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.483] SetEndOfFile (hFile=0x200) returned 1 [0069.483] CloseHandle (hObject=0x200) returned 1 [0069.483] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.483] SetEndOfFile (hFile=0x1f0) returned 1 [0069.484] CloseHandle (hObject=0x1f0) returned 1 [0069.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.484] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0069.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.484] lstrlenW (lpString=".doc") returned 4 [0069.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.484] lstrlenW (lpString=".docx") returned 5 [0069.484] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.484] lstrlenW (lpString=".pdf") returned 4 [0069.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.484] lstrlenW (lpString=".xls") returned 4 [0069.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.484] lstrlenW (lpString=".xlsx") returned 5 [0069.484] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.484] lstrlenW (lpString=".ppt") returned 4 [0069.484] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.485] lstrlenW (lpString=".zip") returned 4 [0069.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.485] lstrlenW (lpString=".rar") returned 4 [0069.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.485] lstrlenW (lpString=".bz2") returned 4 [0069.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.485] lstrlenW (lpString=".7z") returned 3 [0069.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.485] lstrlenW (lpString=".dbf") returned 4 [0069.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.485] lstrlenW (lpString=".1cd") returned 4 [0069.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.485] lstrlenW (lpString=".jpg") returned 4 [0069.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.485] lstrlenW (lpString=".doc") returned 4 [0069.485] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.485] lstrlenW (lpString=".docx") returned 5 [0069.485] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.485] lstrlenW (lpString=".pdf") returned 4 [0069.485] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.485] lstrlenW (lpString=".xls") returned 4 [0069.485] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.485] lstrlenW (lpString=".xlsx") returned 5 [0069.485] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.485] lstrlenW (lpString=".ppt") returned 4 [0069.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.486] lstrlenW (lpString=".zip") returned 4 [0069.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.486] lstrlenW (lpString=".rar") returned 4 [0069.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.486] lstrlenW (lpString=".bz2") returned 4 [0069.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.486] lstrlenW (lpString=".7z") returned 3 [0069.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.486] lstrlenW (lpString=".dbf") returned 4 [0069.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.486] lstrlenW (lpString=".1cd") returned 4 [0069.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0069.486] lstrlenW (lpString=".jpg") returned 4 [0069.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.486] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.486] lstrlenW (lpString="AN04191_.WMF") returned 12 [0069.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.487] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=6636) returned 1 [0069.487] CloseHandle (hObject=0x1f0) returned 1 [0069.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0069.487] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.487] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.487] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.487] GetLastError () returned 0x0 [0069.487] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x19ec, lpOverlapped=0x0) returned 1 [0069.882] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0069.897] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.897] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.897] SetEndOfFile (hFile=0x200) returned 1 [0069.897] CloseHandle (hObject=0x200) returned 1 [0069.897] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.897] SetEndOfFile (hFile=0x1f0) returned 1 [0069.898] CloseHandle (hObject=0x1f0) returned 1 [0069.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0069.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.898] lstrlenW (lpString=".doc") returned 4 [0069.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.899] lstrlenW (lpString=".docx") returned 5 [0069.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.899] lstrlenW (lpString=".pdf") returned 4 [0069.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.899] lstrlenW (lpString=".xls") returned 4 [0069.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.899] lstrlenW (lpString=".xlsx") returned 5 [0069.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.899] lstrlenW (lpString=".ppt") returned 4 [0069.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.899] lstrlenW (lpString=".zip") returned 4 [0069.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.899] lstrlenW (lpString=".rar") returned 4 [0069.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.899] lstrlenW (lpString=".bz2") returned 4 [0069.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.899] lstrlenW (lpString=".7z") returned 3 [0069.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.899] lstrlenW (lpString=".dbf") returned 4 [0069.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.899] lstrlenW (lpString=".1cd") returned 4 [0069.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.899] lstrlenW (lpString=".jpg") returned 4 [0069.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.899] lstrlenW (lpString=".doc") returned 4 [0069.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.900] lstrlenW (lpString=".docx") returned 5 [0069.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.900] lstrlenW (lpString=".pdf") returned 4 [0069.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.900] lstrlenW (lpString=".xls") returned 4 [0069.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.900] lstrlenW (lpString=".xlsx") returned 5 [0069.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.900] lstrlenW (lpString=".ppt") returned 4 [0069.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.900] lstrlenW (lpString=".zip") returned 4 [0069.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.900] lstrlenW (lpString=".rar") returned 4 [0069.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.900] lstrlenW (lpString=".bz2") returned 4 [0069.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.900] lstrlenW (lpString=".7z") returned 3 [0069.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.900] lstrlenW (lpString=".dbf") returned 4 [0069.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.900] lstrlenW (lpString=".1cd") returned 4 [0069.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0069.900] lstrlenW (lpString=".jpg") returned 4 [0069.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.901] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.901] lstrlenW (lpString="AN04385_.WMF") returned 12 [0069.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.901] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5004) returned 1 [0069.901] CloseHandle (hObject=0x1f0) returned 1 [0069.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0069.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.901] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.901] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.902] GetLastError () returned 0x0 [0069.902] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x138c, lpOverlapped=0x0) returned 1 [0069.904] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0069.905] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.905] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.905] SetEndOfFile (hFile=0x200) returned 1 [0069.905] CloseHandle (hObject=0x200) returned 1 [0069.905] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.905] SetEndOfFile (hFile=0x1f0) returned 1 [0069.906] CloseHandle (hObject=0x1f0) returned 1 [0069.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0069.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.907] lstrlenW (lpString=".doc") returned 4 [0069.907] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.907] lstrlenW (lpString=".docx") returned 5 [0069.907] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.907] lstrlenW (lpString=".pdf") returned 4 [0069.907] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.907] lstrlenW (lpString=".xls") returned 4 [0069.907] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.907] lstrlenW (lpString=".xlsx") returned 5 [0069.907] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.907] lstrlenW (lpString=".ppt") returned 4 [0069.907] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.907] lstrlenW (lpString=".zip") returned 4 [0069.907] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.907] lstrlenW (lpString=".rar") returned 4 [0069.907] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.907] lstrlenW (lpString=".bz2") returned 4 [0069.907] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.907] lstrlenW (lpString=".7z") returned 3 [0069.907] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.907] lstrlenW (lpString=".dbf") returned 4 [0069.907] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.907] lstrlenW (lpString=".1cd") returned 4 [0069.907] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.907] lstrlenW (lpString=".jpg") returned 4 [0069.907] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.908] lstrlenW (lpString=".doc") returned 4 [0069.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.908] lstrlenW (lpString=".docx") returned 5 [0069.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.908] lstrlenW (lpString=".pdf") returned 4 [0069.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.908] lstrlenW (lpString=".xls") returned 4 [0069.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.908] lstrlenW (lpString=".xlsx") returned 5 [0069.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.908] lstrlenW (lpString=".ppt") returned 4 [0069.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.908] lstrlenW (lpString=".zip") returned 4 [0069.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.908] lstrlenW (lpString=".rar") returned 4 [0069.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.908] lstrlenW (lpString=".bz2") returned 4 [0069.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.908] lstrlenW (lpString=".7z") returned 3 [0069.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.908] lstrlenW (lpString=".dbf") returned 4 [0069.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.908] lstrlenW (lpString=".1cd") returned 4 [0069.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0069.908] lstrlenW (lpString=".jpg") returned 4 [0069.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.909] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.909] lstrlenW (lpString="BD00116_.WMF") returned 12 [0069.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.909] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4870) returned 1 [0069.909] CloseHandle (hObject=0x1f0) returned 1 [0069.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0069.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.910] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.910] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.910] GetLastError () returned 0x0 [0069.910] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x1306, lpOverlapped=0x0) returned 1 [0069.912] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1310, lpOverlapped=0x0) returned 1 [0069.913] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.913] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.913] SetEndOfFile (hFile=0x200) returned 1 [0069.913] CloseHandle (hObject=0x200) returned 1 [0069.913] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.914] SetEndOfFile (hFile=0x1f0) returned 1 [0069.914] CloseHandle (hObject=0x1f0) returned 1 [0069.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.915] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0069.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.915] lstrlenW (lpString=".doc") returned 4 [0069.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.915] lstrlenW (lpString=".docx") returned 5 [0069.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.915] lstrlenW (lpString=".pdf") returned 4 [0069.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.915] lstrlenW (lpString=".xls") returned 4 [0069.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.915] lstrlenW (lpString=".xlsx") returned 5 [0069.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.915] lstrlenW (lpString=".ppt") returned 4 [0069.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.915] lstrlenW (lpString=".zip") returned 4 [0069.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.915] lstrlenW (lpString=".rar") returned 4 [0069.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.915] lstrlenW (lpString=".bz2") returned 4 [0069.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.916] lstrlenW (lpString=".7z") returned 3 [0069.916] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.916] lstrlenW (lpString=".dbf") returned 4 [0069.916] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.916] lstrlenW (lpString=".1cd") returned 4 [0069.916] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.916] lstrlenW (lpString=".jpg") returned 4 [0069.916] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.916] lstrlenW (lpString=".doc") returned 4 [0069.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.916] lstrlenW (lpString=".docx") returned 5 [0069.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.916] lstrlenW (lpString=".pdf") returned 4 [0069.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.916] lstrlenW (lpString=".xls") returned 4 [0069.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.916] lstrlenW (lpString=".xlsx") returned 5 [0069.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.916] lstrlenW (lpString=".ppt") returned 4 [0069.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.916] lstrlenW (lpString=".zip") returned 4 [0069.916] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.916] lstrlenW (lpString=".rar") returned 4 [0069.916] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.916] lstrlenW (lpString=".bz2") returned 4 [0069.916] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.917] lstrlenW (lpString=".7z") returned 3 [0069.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.917] lstrlenW (lpString=".dbf") returned 4 [0069.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.917] lstrlenW (lpString=".1cd") returned 4 [0069.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0069.917] lstrlenW (lpString=".jpg") returned 4 [0069.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.917] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.917] lstrlenW (lpString="BD00141_.WMF") returned 12 [0069.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.917] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=26886) returned 1 [0069.917] CloseHandle (hObject=0x1f0) returned 1 [0069.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0069.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.918] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.918] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.918] GetLastError () returned 0x0 [0069.918] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x6906, lpOverlapped=0x0) returned 1 [0069.922] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x6910, lpOverlapped=0x0) returned 1 [0069.924] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.924] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.924] SetEndOfFile (hFile=0x200) returned 1 [0069.924] CloseHandle (hObject=0x200) returned 1 [0069.924] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.924] SetEndOfFile (hFile=0x1f0) returned 1 [0069.925] CloseHandle (hObject=0x1f0) returned 1 [0069.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0069.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.926] lstrlenW (lpString=".doc") returned 4 [0069.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.926] lstrlenW (lpString=".docx") returned 5 [0069.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.926] lstrlenW (lpString=".pdf") returned 4 [0069.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.926] lstrlenW (lpString=".xls") returned 4 [0069.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.926] lstrlenW (lpString=".xlsx") returned 5 [0069.926] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.926] lstrlenW (lpString=".ppt") returned 4 [0069.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.926] lstrlenW (lpString=".zip") returned 4 [0069.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.926] lstrlenW (lpString=".rar") returned 4 [0069.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.926] lstrlenW (lpString=".bz2") returned 4 [0069.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.926] lstrlenW (lpString=".7z") returned 3 [0069.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.926] lstrlenW (lpString=".dbf") returned 4 [0069.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.926] lstrlenW (lpString=".1cd") returned 4 [0069.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.926] lstrlenW (lpString=".jpg") returned 4 [0069.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.927] lstrlenW (lpString=".doc") returned 4 [0069.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.927] lstrlenW (lpString=".docx") returned 5 [0069.927] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.927] lstrlenW (lpString=".pdf") returned 4 [0069.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.927] lstrlenW (lpString=".xls") returned 4 [0069.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.927] lstrlenW (lpString=".xlsx") returned 5 [0069.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.927] lstrlenW (lpString=".ppt") returned 4 [0069.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.927] lstrlenW (lpString=".zip") returned 4 [0069.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.927] lstrlenW (lpString=".rar") returned 4 [0069.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.927] lstrlenW (lpString=".bz2") returned 4 [0069.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.927] lstrlenW (lpString=".7z") returned 3 [0069.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.927] lstrlenW (lpString=".dbf") returned 4 [0069.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.928] lstrlenW (lpString=".1cd") returned 4 [0069.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0069.928] lstrlenW (lpString=".jpg") returned 4 [0069.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.928] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.928] lstrlenW (lpString="BD00146_.WMF") returned 12 [0069.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.928] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=28948) returned 1 [0069.928] CloseHandle (hObject=0x1f0) returned 1 [0069.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0069.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.929] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.929] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.929] GetLastError () returned 0x0 [0069.929] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x7114, lpOverlapped=0x0) returned 1 [0069.931] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x7120, lpOverlapped=0x0) returned 1 [0069.933] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0069.933] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.933] SetEndOfFile (hFile=0x200) returned 1 [0069.933] CloseHandle (hObject=0x200) returned 1 [0069.933] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.933] SetEndOfFile (hFile=0x1f0) returned 1 [0069.934] CloseHandle (hObject=0x1f0) returned 1 [0069.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0069.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.935] lstrlenW (lpString=".doc") returned 4 [0069.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.935] lstrlenW (lpString=".docx") returned 5 [0069.935] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.935] lstrlenW (lpString=".pdf") returned 4 [0069.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.935] lstrlenW (lpString=".xls") returned 4 [0069.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.935] lstrlenW (lpString=".xlsx") returned 5 [0069.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.935] lstrlenW (lpString=".ppt") returned 4 [0069.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.935] lstrlenW (lpString=".zip") returned 4 [0069.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.935] lstrlenW (lpString=".rar") returned 4 [0069.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.935] lstrlenW (lpString=".bz2") returned 4 [0069.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.935] lstrlenW (lpString=".7z") returned 3 [0069.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.935] lstrlenW (lpString=".dbf") returned 4 [0069.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.935] lstrlenW (lpString=".1cd") returned 4 [0069.936] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.936] lstrlenW (lpString=".jpg") returned 4 [0069.936] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.936] lstrlenW (lpString=".doc") returned 4 [0069.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0069.936] lstrlenW (lpString=".docx") returned 5 [0069.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0069.936] lstrlenW (lpString=".pdf") returned 4 [0069.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0069.936] lstrlenW (lpString=".xls") returned 4 [0069.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0069.936] lstrlenW (lpString=".xlsx") returned 5 [0069.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0069.936] lstrlenW (lpString=".ppt") returned 4 [0069.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0069.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.936] lstrlenW (lpString=".zip") returned 4 [0069.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0069.936] lstrlenW (lpString=".rar") returned 4 [0069.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0069.936] lstrlenW (lpString=".bz2") returned 4 [0069.936] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0069.936] lstrlenW (lpString=".7z") returned 3 [0069.936] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0069.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.936] lstrlenW (lpString=".dbf") returned 4 [0069.936] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0069.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.936] lstrlenW (lpString=".1cd") returned 4 [0069.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0069.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0069.937] lstrlenW (lpString=".jpg") returned 4 [0069.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0069.937] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0069.937] lstrlenW (lpString="BD00155_.WMF") returned 12 [0069.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.937] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=11636) returned 1 [0069.937] CloseHandle (hObject=0x1f0) returned 1 [0069.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0069.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0069.937] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.938] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0069.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0069.938] GetLastError () returned 0x0 [0069.938] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x2d74, lpOverlapped=0x0) returned 1 [0070.155] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0070.156] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0070.156] WriteFile (in: hFile=0x200, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0070.156] SetEndOfFile (hFile=0x200) returned 1 [0071.318] CloseHandle (hObject=0x200) returned 1 [0071.564] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.564] SetEndOfFile (hFile=0x1f0) returned 1 [0071.566] CloseHandle (hObject=0x1f0) returned 1 [0071.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0071.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.567] lstrlenW (lpString=".doc") returned 4 [0071.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.567] lstrlenW (lpString=".docx") returned 5 [0071.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.567] lstrlenW (lpString=".pdf") returned 4 [0071.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.567] lstrlenW (lpString=".xls") returned 4 [0071.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.567] lstrlenW (lpString=".xlsx") returned 5 [0071.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.567] lstrlenW (lpString=".ppt") returned 4 [0071.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.567] lstrlenW (lpString=".zip") returned 4 [0071.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.567] lstrlenW (lpString=".rar") returned 4 [0071.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.567] lstrlenW (lpString=".bz2") returned 4 [0071.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.567] lstrlenW (lpString=".7z") returned 3 [0071.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.567] lstrlenW (lpString=".dbf") returned 4 [0071.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.567] lstrlenW (lpString=".1cd") returned 4 [0071.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.567] lstrlenW (lpString=".jpg") returned 4 [0071.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.568] lstrlenW (lpString=".doc") returned 4 [0071.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.568] lstrlenW (lpString=".docx") returned 5 [0071.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.568] lstrlenW (lpString=".pdf") returned 4 [0071.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.568] lstrlenW (lpString=".xls") returned 4 [0071.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.568] lstrlenW (lpString=".xlsx") returned 5 [0071.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.568] lstrlenW (lpString=".ppt") returned 4 [0071.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.568] lstrlenW (lpString=".zip") returned 4 [0071.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.568] lstrlenW (lpString=".rar") returned 4 [0071.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.568] lstrlenW (lpString=".bz2") returned 4 [0071.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.568] lstrlenW (lpString=".7z") returned 3 [0071.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.568] lstrlenW (lpString=".dbf") returned 4 [0071.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.568] lstrlenW (lpString=".1cd") returned 4 [0071.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0071.568] lstrlenW (lpString=".jpg") returned 4 [0071.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.569] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0071.569] lstrlenW (lpString="BD05119_.WMF") returned 12 [0071.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0071.569] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=17236) returned 1 [0071.569] CloseHandle (hObject=0x1f0) returned 1 [0071.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0071.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0071.569] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.569] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0071.570] GetLastError () returned 0x0 [0071.570] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4354, lpOverlapped=0x0) returned 1 [0071.572] WriteFile (in: hFile=0x21c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0071.573] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.573] WriteFile (in: hFile=0x21c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.573] SetEndOfFile (hFile=0x21c) returned 1 [0071.574] CloseHandle (hObject=0x21c) returned 1 [0071.574] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.574] SetEndOfFile (hFile=0x1f0) returned 1 [0071.575] CloseHandle (hObject=0x1f0) returned 1 [0071.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0071.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.575] lstrlenW (lpString=".doc") returned 4 [0071.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.575] lstrlenW (lpString=".docx") returned 5 [0071.575] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.575] lstrlenW (lpString=".pdf") returned 4 [0071.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.575] lstrlenW (lpString=".xls") returned 4 [0071.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.575] lstrlenW (lpString=".xlsx") returned 5 [0071.575] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.575] lstrlenW (lpString=".ppt") returned 4 [0071.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.576] lstrlenW (lpString=".zip") returned 4 [0071.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.576] lstrlenW (lpString=".rar") returned 4 [0071.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.576] lstrlenW (lpString=".bz2") returned 4 [0071.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.576] lstrlenW (lpString=".7z") returned 3 [0071.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.576] lstrlenW (lpString=".dbf") returned 4 [0071.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.576] lstrlenW (lpString=".1cd") returned 4 [0071.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.576] lstrlenW (lpString=".jpg") returned 4 [0071.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.576] lstrlenW (lpString=".doc") returned 4 [0071.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.576] lstrlenW (lpString=".docx") returned 5 [0071.576] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.576] lstrlenW (lpString=".pdf") returned 4 [0071.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.576] lstrlenW (lpString=".xls") returned 4 [0071.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.576] lstrlenW (lpString=".xlsx") returned 5 [0071.576] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.577] lstrlenW (lpString=".ppt") returned 4 [0071.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.577] lstrlenW (lpString=".zip") returned 4 [0071.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.577] lstrlenW (lpString=".rar") returned 4 [0071.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.577] lstrlenW (lpString=".bz2") returned 4 [0071.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.577] lstrlenW (lpString=".7z") returned 3 [0071.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.577] lstrlenW (lpString=".dbf") returned 4 [0071.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.577] lstrlenW (lpString=".1cd") returned 4 [0071.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0071.577] lstrlenW (lpString=".jpg") returned 4 [0071.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.577] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0071.577] lstrlenW (lpString="BD06102_.WMF") returned 12 [0071.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0071.578] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=16112) returned 1 [0071.578] CloseHandle (hObject=0x1f0) returned 1 [0071.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0071.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0071.578] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.578] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0071.578] GetLastError () returned 0x0 [0071.579] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0071.583] WriteFile (in: hFile=0x21c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0071.584] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.584] WriteFile (in: hFile=0x21c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.584] SetEndOfFile (hFile=0x21c) returned 1 [0071.584] CloseHandle (hObject=0x21c) returned 1 [0071.584] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.584] SetEndOfFile (hFile=0x1f0) returned 1 [0071.585] CloseHandle (hObject=0x1f0) returned 1 [0071.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0071.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.586] lstrlenW (lpString=".doc") returned 4 [0071.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString=".docx") returned 5 [0071.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.586] lstrlenW (lpString=".pdf") returned 4 [0071.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString=".xls") returned 4 [0071.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.586] lstrlenW (lpString=".xlsx") returned 5 [0071.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.586] lstrlenW (lpString=".ppt") returned 4 [0071.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.586] lstrlenW (lpString=".zip") returned 4 [0071.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.586] lstrlenW (lpString=".rar") returned 4 [0071.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString=".bz2") returned 4 [0071.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString=".7z") returned 3 [0071.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.586] lstrlenW (lpString=".dbf") returned 4 [0071.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.587] lstrlenW (lpString=".1cd") returned 4 [0071.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.587] lstrlenW (lpString=".jpg") returned 4 [0071.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.587] lstrlenW (lpString=".doc") returned 4 [0071.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.587] lstrlenW (lpString=".docx") returned 5 [0071.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.587] lstrlenW (lpString=".pdf") returned 4 [0071.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.587] lstrlenW (lpString=".xls") returned 4 [0071.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.587] lstrlenW (lpString=".xlsx") returned 5 [0071.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.587] lstrlenW (lpString=".ppt") returned 4 [0071.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.587] lstrlenW (lpString=".zip") returned 4 [0071.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.587] lstrlenW (lpString=".rar") returned 4 [0071.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.587] lstrlenW (lpString=".bz2") returned 4 [0071.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.587] lstrlenW (lpString=".7z") returned 3 [0071.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.587] lstrlenW (lpString=".dbf") returned 4 [0071.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.588] lstrlenW (lpString=".1cd") returned 4 [0071.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0071.588] lstrlenW (lpString=".jpg") returned 4 [0071.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.588] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0071.588] lstrlenW (lpString="BD06200_.WMF") returned 12 [0071.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0071.589] GetFileSizeEx (in: hFile=0x1f0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=16676) returned 1 [0071.589] CloseHandle (hObject=0x1f0) returned 1 [0071.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0071.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0071.589] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.589] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0071.590] GetLastError () returned 0x0 [0071.590] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4124, lpOverlapped=0x0) returned 1 [0071.611] WriteFile (in: hFile=0x21c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0071.613] ReadFile (in: hFile=0x1f0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.613] WriteFile (in: hFile=0x21c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.613] SetEndOfFile (hFile=0x21c) returned 1 [0071.616] CloseHandle (hObject=0x21c) returned 1 [0071.616] SetFilePointerEx (in: hFile=0x1f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.616] SetEndOfFile (hFile=0x1f0) returned 1 [0071.617] CloseHandle (hObject=0x1f0) returned 1 [0071.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0071.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.617] lstrlenW (lpString=".doc") returned 4 [0071.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString=".docx") returned 5 [0071.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.618] lstrlenW (lpString=".pdf") returned 4 [0071.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString=".xls") returned 4 [0071.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.618] lstrlenW (lpString=".xlsx") returned 5 [0071.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.618] lstrlenW (lpString=".ppt") returned 4 [0071.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.618] lstrlenW (lpString=".zip") returned 4 [0071.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.618] lstrlenW (lpString=".rar") returned 4 [0071.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString=".bz2") returned 4 [0071.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString=".7z") returned 3 [0071.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.618] lstrlenW (lpString=".dbf") returned 4 [0071.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.618] lstrlenW (lpString=".1cd") returned 4 [0071.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.618] lstrlenW (lpString=".jpg") returned 4 [0071.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.618] lstrlenW (lpString=".doc") returned 4 [0071.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0071.619] lstrlenW (lpString=".docx") returned 5 [0071.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0071.619] lstrlenW (lpString=".pdf") returned 4 [0071.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0071.619] lstrlenW (lpString=".xls") returned 4 [0071.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0071.619] lstrlenW (lpString=".xlsx") returned 5 [0071.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0071.619] lstrlenW (lpString=".ppt") returned 4 [0071.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0071.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.619] lstrlenW (lpString=".zip") returned 4 [0071.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0071.619] lstrlenW (lpString=".rar") returned 4 [0071.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0071.619] lstrlenW (lpString=".bz2") returned 4 [0071.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0071.619] lstrlenW (lpString=".7z") returned 3 [0071.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0071.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.619] lstrlenW (lpString=".dbf") returned 4 [0071.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0071.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.619] lstrlenW (lpString=".1cd") returned 4 [0071.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0071.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0071.619] lstrlenW (lpString=".jpg") returned 4 [0071.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0071.619] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0071.620] lstrlenW (lpString="BD07831_.WMF") returned 12 [0071.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0071.821] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4066) returned 1 [0071.821] CloseHandle (hObject=0x1e0) returned 1 [0071.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0071.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0071.822] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.822] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0071.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x16c [0071.822] GetLastError () returned 0x0 [0071.822] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xfe2, lpOverlapped=0x0) returned 1 [0071.824] WriteFile (in: hFile=0x16c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0071.979] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0071.979] WriteFile (in: hFile=0x16c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.979] SetEndOfFile (hFile=0x16c) returned 1 [0072.288] CloseHandle (hObject=0x16c) returned 1 [0072.288] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.288] SetEndOfFile (hFile=0x1e0) returned 1 [0072.343] CloseHandle (hObject=0x1e0) returned 1 [0072.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0072.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.344] lstrlenW (lpString=".doc") returned 4 [0072.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.344] lstrlenW (lpString=".docx") returned 5 [0072.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.344] lstrlenW (lpString=".pdf") returned 4 [0072.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.344] lstrlenW (lpString=".xls") returned 4 [0072.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.344] lstrlenW (lpString=".xlsx") returned 5 [0072.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.345] lstrlenW (lpString=".ppt") returned 4 [0072.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.345] lstrlenW (lpString=".zip") returned 4 [0072.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.345] lstrlenW (lpString=".rar") returned 4 [0072.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.345] lstrlenW (lpString=".bz2") returned 4 [0072.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.345] lstrlenW (lpString=".7z") returned 3 [0072.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.345] lstrlenW (lpString=".dbf") returned 4 [0072.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.345] lstrlenW (lpString=".1cd") returned 4 [0072.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.345] lstrlenW (lpString=".jpg") returned 4 [0072.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.345] lstrlenW (lpString=".doc") returned 4 [0072.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.345] lstrlenW (lpString=".docx") returned 5 [0072.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.345] lstrlenW (lpString=".pdf") returned 4 [0072.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.345] lstrlenW (lpString=".xls") returned 4 [0072.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.346] lstrlenW (lpString=".xlsx") returned 5 [0072.346] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.346] lstrlenW (lpString=".ppt") returned 4 [0072.346] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.346] lstrlenW (lpString=".zip") returned 4 [0072.346] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.346] lstrlenW (lpString=".rar") returned 4 [0072.346] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.346] lstrlenW (lpString=".bz2") returned 4 [0072.346] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.346] lstrlenW (lpString=".7z") returned 3 [0072.346] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.346] lstrlenW (lpString=".dbf") returned 4 [0072.346] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.346] lstrlenW (lpString=".1cd") returned 4 [0072.346] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.346] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0072.346] lstrlenW (lpString=".jpg") returned 4 [0072.346] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.346] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0072.346] lstrlenW (lpString="BD08868_.WMF") returned 12 [0072.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0072.347] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=40206) returned 1 [0072.347] CloseHandle (hObject=0x1e0) returned 1 [0072.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0072.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0072.347] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.347] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0072.347] GetLastError () returned 0x0 [0072.348] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0072.444] WriteFile (in: hFile=0x240, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0072.445] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0072.445] WriteFile (in: hFile=0x240, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0072.445] SetEndOfFile (hFile=0x240) returned 1 [0072.446] CloseHandle (hObject=0x240) returned 1 [0072.446] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.446] SetEndOfFile (hFile=0x1e0) returned 1 [0072.447] CloseHandle (hObject=0x1e0) returned 1 [0072.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0072.447] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0072.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.448] lstrlenW (lpString=".doc") returned 4 [0072.448] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.448] lstrlenW (lpString=".docx") returned 5 [0072.448] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.448] lstrlenW (lpString=".pdf") returned 4 [0072.448] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.448] lstrlenW (lpString=".xls") returned 4 [0072.448] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.448] lstrlenW (lpString=".xlsx") returned 5 [0072.448] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.448] lstrlenW (lpString=".ppt") returned 4 [0072.448] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.448] lstrlenW (lpString=".zip") returned 4 [0072.448] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.448] lstrlenW (lpString=".rar") returned 4 [0072.448] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.448] lstrlenW (lpString=".bz2") returned 4 [0072.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.448] lstrlenW (lpString=".7z") returned 3 [0072.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.448] lstrlenW (lpString=".dbf") returned 4 [0072.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.448] lstrlenW (lpString=".1cd") returned 4 [0072.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.448] lstrlenW (lpString=".jpg") returned 4 [0072.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.449] lstrlenW (lpString=".doc") returned 4 [0072.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0072.449] lstrlenW (lpString=".docx") returned 5 [0072.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0072.449] lstrlenW (lpString=".pdf") returned 4 [0072.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0072.449] lstrlenW (lpString=".xls") returned 4 [0072.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0072.449] lstrlenW (lpString=".xlsx") returned 5 [0072.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0072.449] lstrlenW (lpString=".ppt") returned 4 [0072.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0072.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.449] lstrlenW (lpString=".zip") returned 4 [0072.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0072.449] lstrlenW (lpString=".rar") returned 4 [0072.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0072.449] lstrlenW (lpString=".bz2") returned 4 [0072.449] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0072.449] lstrlenW (lpString=".7z") returned 3 [0072.449] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0072.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.449] lstrlenW (lpString=".dbf") returned 4 [0072.449] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0072.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.449] lstrlenW (lpString=".1cd") returned 4 [0072.449] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0072.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0072.449] lstrlenW (lpString=".jpg") returned 4 [0072.449] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0072.450] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0072.450] lstrlenW (lpString="BD09194_.WMF") returned 12 [0072.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0072.450] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=14540) returned 1 [0072.450] CloseHandle (hObject=0x1e0) returned 1 [0072.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0072.450] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0072.450] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.450] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0072.450] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0073.084] GetLastError () returned 0x0 [0073.084] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0073.164] WriteFile (in: hFile=0x234, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0073.165] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.165] WriteFile (in: hFile=0x234, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.165] SetEndOfFile (hFile=0x234) returned 1 [0073.165] CloseHandle (hObject=0x234) returned 1 [0073.166] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.166] SetEndOfFile (hFile=0x1e0) returned 1 [0073.167] CloseHandle (hObject=0x1e0) returned 1 [0073.167] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.167] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0073.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.167] lstrlenW (lpString=".doc") returned 4 [0073.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.167] lstrlenW (lpString=".docx") returned 5 [0073.167] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.167] lstrlenW (lpString=".pdf") returned 4 [0073.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.167] lstrlenW (lpString=".xls") returned 4 [0073.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.167] lstrlenW (lpString=".xlsx") returned 5 [0073.167] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.167] lstrlenW (lpString=".ppt") returned 4 [0073.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.167] lstrlenW (lpString=".zip") returned 4 [0073.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.168] lstrlenW (lpString=".rar") returned 4 [0073.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.168] lstrlenW (lpString=".bz2") returned 4 [0073.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.168] lstrlenW (lpString=".7z") returned 3 [0073.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.168] lstrlenW (lpString=".dbf") returned 4 [0073.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.168] lstrlenW (lpString=".1cd") returned 4 [0073.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.168] lstrlenW (lpString=".jpg") returned 4 [0073.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.168] lstrlenW (lpString=".doc") returned 4 [0073.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.168] lstrlenW (lpString=".docx") returned 5 [0073.168] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.168] lstrlenW (lpString=".pdf") returned 4 [0073.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.168] lstrlenW (lpString=".xls") returned 4 [0073.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.168] lstrlenW (lpString=".xlsx") returned 5 [0073.168] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.168] lstrlenW (lpString=".ppt") returned 4 [0073.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.168] lstrlenW (lpString=".zip") returned 4 [0073.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.169] lstrlenW (lpString=".rar") returned 4 [0073.169] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.169] lstrlenW (lpString=".bz2") returned 4 [0073.169] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.169] lstrlenW (lpString=".7z") returned 3 [0073.169] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.169] lstrlenW (lpString=".dbf") returned 4 [0073.169] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.169] lstrlenW (lpString=".1cd") returned 4 [0073.169] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0073.169] lstrlenW (lpString=".jpg") returned 4 [0073.169] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.169] lstrcmpiW (lpString1=".GIF", lpString2=".wiki") returned -1 [0073.169] lstrlenW (lpString="BD10972_.GIF") returned 12 [0073.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0073.178] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=20189) returned 1 [0073.178] CloseHandle (hObject=0x1e0) returned 1 [0073.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0073.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0073.178] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.178] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0073.178] GetLastError () returned 0x0 [0073.178] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4edd, lpOverlapped=0x0) returned 1 [0073.646] WriteFile (in: hFile=0x234, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0073.647] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.647] WriteFile (in: hFile=0x234, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.647] SetEndOfFile (hFile=0x234) returned 1 [0073.647] CloseHandle (hObject=0x234) returned 1 [0073.648] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.648] SetEndOfFile (hFile=0x1e0) returned 1 [0073.649] CloseHandle (hObject=0x1e0) returned 1 [0073.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0073.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.649] lstrlenW (lpString=".doc") returned 4 [0073.649] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.649] lstrlenW (lpString=".docx") returned 5 [0073.649] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.649] lstrlenW (lpString=".pdf") returned 4 [0073.649] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.649] lstrlenW (lpString=".xls") returned 4 [0073.649] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.649] lstrlenW (lpString=".xlsx") returned 5 [0073.649] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.649] lstrlenW (lpString=".ppt") returned 4 [0073.649] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.649] lstrlenW (lpString=".zip") returned 4 [0073.649] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.649] lstrlenW (lpString=".rar") returned 4 [0073.650] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.650] lstrlenW (lpString=".bz2") returned 4 [0073.650] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.650] lstrlenW (lpString=".7z") returned 3 [0073.650] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.650] lstrlenW (lpString=".dbf") returned 4 [0073.650] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.650] lstrlenW (lpString=".1cd") returned 4 [0073.650] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.650] lstrlenW (lpString=".jpg") returned 4 [0073.650] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.650] lstrlenW (lpString=".doc") returned 4 [0073.650] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0073.650] lstrlenW (lpString=".docx") returned 5 [0073.650] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0073.650] lstrlenW (lpString=".pdf") returned 4 [0073.650] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0073.650] lstrlenW (lpString=".xls") returned 4 [0073.650] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0073.650] lstrlenW (lpString=".xlsx") returned 5 [0073.650] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0073.650] lstrlenW (lpString=".ppt") returned 4 [0073.650] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0073.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.650] lstrlenW (lpString=".zip") returned 4 [0073.650] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0073.650] lstrlenW (lpString=".rar") returned 4 [0073.651] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0073.651] lstrlenW (lpString=".bz2") returned 4 [0073.651] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0073.651] lstrlenW (lpString=".7z") returned 3 [0073.651] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0073.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.651] lstrlenW (lpString=".dbf") returned 4 [0073.651] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0073.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.651] lstrlenW (lpString=".1cd") returned 4 [0073.651] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0073.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0073.651] lstrlenW (lpString=".jpg") returned 4 [0073.651] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0073.651] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0073.651] lstrlenW (lpString="BD19988_.WMF") returned 12 [0073.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0073.651] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=18304) returned 1 [0073.651] CloseHandle (hObject=0x1e0) returned 1 [0073.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0073.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0073.652] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.652] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0073.652] GetLastError () returned 0x0 [0073.652] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x4780, lpOverlapped=0x0) returned 1 [0073.662] WriteFile (in: hFile=0x234, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x4790, lpOverlapped=0x0) returned 1 [0073.663] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.664] WriteFile (in: hFile=0x234, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.664] SetEndOfFile (hFile=0x234) returned 1 [0073.664] CloseHandle (hObject=0x234) returned 1 [0073.664] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.664] SetEndOfFile (hFile=0x1e0) returned 1 [0073.665] CloseHandle (hObject=0x1e0) returned 1 [0073.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0073.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.665] lstrlenW (lpString=".doc") returned 4 [0073.665] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.665] lstrlenW (lpString=".docx") returned 5 [0073.665] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.665] lstrlenW (lpString=".pdf") returned 4 [0073.665] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString=".xls") returned 4 [0073.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.666] lstrlenW (lpString=".xlsx") returned 5 [0073.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.666] lstrlenW (lpString=".ppt") returned 4 [0073.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.666] lstrlenW (lpString=".zip") returned 4 [0073.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.666] lstrlenW (lpString=".rar") returned 4 [0073.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString=".bz2") returned 4 [0073.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString=".7z") returned 3 [0073.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.666] lstrlenW (lpString=".dbf") returned 4 [0073.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.666] lstrlenW (lpString=".1cd") returned 4 [0073.666] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.666] lstrlenW (lpString=".jpg") returned 4 [0073.666] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.666] lstrlenW (lpString=".doc") returned 4 [0073.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString=".docx") returned 5 [0073.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0073.666] lstrlenW (lpString=".pdf") returned 4 [0073.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0073.666] lstrlenW (lpString=".xls") returned 4 [0073.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0073.667] lstrlenW (lpString=".xlsx") returned 5 [0073.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0073.667] lstrlenW (lpString=".ppt") returned 4 [0073.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.667] lstrlenW (lpString=".zip") returned 4 [0073.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0073.667] lstrlenW (lpString=".rar") returned 4 [0073.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0073.667] lstrlenW (lpString=".bz2") returned 4 [0073.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0073.667] lstrlenW (lpString=".7z") returned 3 [0073.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.667] lstrlenW (lpString=".dbf") returned 4 [0073.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.667] lstrlenW (lpString=".1cd") returned 4 [0073.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0073.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0073.667] lstrlenW (lpString=".jpg") returned 4 [0073.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0073.667] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0073.667] lstrlenW (lpString="BL00008_.WMF") returned 12 [0073.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0073.671] GetFileSizeEx (in: hFile=0x1e0, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=12520) returned 1 [0073.672] CloseHandle (hObject=0x1e0) returned 1 [0073.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0073.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e0 [0073.672] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.672] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0073.672] GetLastError () returned 0x0 [0073.672] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x30e8, lpOverlapped=0x0) returned 1 [0073.679] WriteFile (in: hFile=0x234, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0073.681] ReadFile (in: hFile=0x1e0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0073.681] WriteFile (in: hFile=0x234, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0073.681] SetEndOfFile (hFile=0x234) returned 1 [0073.681] CloseHandle (hObject=0x234) returned 1 [0073.681] SetFilePointerEx (in: hFile=0x1e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0073.681] SetEndOfFile (hFile=0x1e0) returned 1 [0073.682] CloseHandle (hObject=0x1e0) returned 1 [0073.682] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.682] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0074.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.290] lstrlenW (lpString=".doc") returned 4 [0074.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.290] lstrlenW (lpString=".docx") returned 5 [0074.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.290] lstrlenW (lpString=".pdf") returned 4 [0074.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.290] lstrlenW (lpString=".xls") returned 4 [0074.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.290] lstrlenW (lpString=".xlsx") returned 5 [0074.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.290] lstrlenW (lpString=".ppt") returned 4 [0074.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.290] lstrlenW (lpString=".zip") returned 4 [0074.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.290] lstrlenW (lpString=".rar") returned 4 [0074.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.290] lstrlenW (lpString=".bz2") returned 4 [0074.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.290] lstrlenW (lpString=".7z") returned 3 [0074.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.290] lstrlenW (lpString=".dbf") returned 4 [0074.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.290] lstrlenW (lpString=".1cd") returned 4 [0074.290] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.290] lstrlenW (lpString=".jpg") returned 4 [0074.290] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.291] lstrlenW (lpString=".doc") returned 4 [0074.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0074.291] lstrlenW (lpString=".docx") returned 5 [0074.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0074.291] lstrlenW (lpString=".pdf") returned 4 [0074.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0074.291] lstrlenW (lpString=".xls") returned 4 [0074.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0074.291] lstrlenW (lpString=".xlsx") returned 5 [0074.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0074.291] lstrlenW (lpString=".ppt") returned 4 [0074.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0074.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.291] lstrlenW (lpString=".zip") returned 4 [0074.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0074.291] lstrlenW (lpString=".rar") returned 4 [0074.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0074.291] lstrlenW (lpString=".bz2") returned 4 [0074.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0074.291] lstrlenW (lpString=".7z") returned 3 [0074.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0074.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.291] lstrlenW (lpString=".dbf") returned 4 [0074.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0074.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.291] lstrlenW (lpString=".1cd") returned 4 [0074.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0074.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0074.291] lstrlenW (lpString=".jpg") returned 4 [0074.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0074.292] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0074.292] lstrlenW (lpString="BL00045_.WMF") returned 12 [0074.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0075.983] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=7862) returned 1 [0075.983] CloseHandle (hObject=0x200) returned 1 [0075.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0075.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0075.983] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.983] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0075.984] GetLastError () returned 0x0 [0075.984] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0075.985] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0075.987] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0075.987] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0075.987] SetEndOfFile (hFile=0x218) returned 1 [0075.987] CloseHandle (hObject=0x218) returned 1 [0075.988] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.988] SetEndOfFile (hFile=0x200) returned 1 [0075.988] CloseHandle (hObject=0x200) returned 1 [0075.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0075.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.989] lstrlenW (lpString=".doc") returned 4 [0075.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString=".docx") returned 5 [0075.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.989] lstrlenW (lpString=".pdf") returned 4 [0075.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString=".xls") returned 4 [0075.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.989] lstrlenW (lpString=".xlsx") returned 5 [0075.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.989] lstrlenW (lpString=".ppt") returned 4 [0075.989] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.989] lstrlenW (lpString=".zip") returned 4 [0075.989] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.989] lstrlenW (lpString=".rar") returned 4 [0075.989] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.989] lstrlenW (lpString=".bz2") returned 4 [0075.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString=".7z") returned 3 [0075.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.990] lstrlenW (lpString=".dbf") returned 4 [0075.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.990] lstrlenW (lpString=".1cd") returned 4 [0075.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.990] lstrlenW (lpString=".jpg") returned 4 [0075.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.990] lstrlenW (lpString=".doc") returned 4 [0075.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString=".docx") returned 5 [0075.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0075.990] lstrlenW (lpString=".pdf") returned 4 [0075.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString=".xls") returned 4 [0075.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0075.990] lstrlenW (lpString=".xlsx") returned 5 [0075.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0075.990] lstrlenW (lpString=".ppt") returned 4 [0075.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.990] lstrlenW (lpString=".zip") returned 4 [0075.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0075.990] lstrlenW (lpString=".rar") returned 4 [0075.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0075.990] lstrlenW (lpString=".bz2") returned 4 [0075.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString=".7z") returned 3 [0075.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.991] lstrlenW (lpString=".dbf") returned 4 [0075.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.991] lstrlenW (lpString=".1cd") returned 4 [0075.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0075.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0075.991] lstrlenW (lpString=".jpg") returned 4 [0075.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0075.991] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0075.991] lstrlenW (lpString="BL00242_.WMF") returned 12 [0075.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0075.991] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=4024) returned 1 [0075.991] CloseHandle (hObject=0x200) returned 1 [0075.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0075.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0075.992] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.992] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0075.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0075.992] GetLastError () returned 0x0 [0075.992] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xfb8, lpOverlapped=0x0) returned 1 [0076.000] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0076.002] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.002] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.002] SetEndOfFile (hFile=0x218) returned 1 [0076.002] CloseHandle (hObject=0x218) returned 1 [0076.002] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.002] SetEndOfFile (hFile=0x200) returned 1 [0076.003] CloseHandle (hObject=0x200) returned 1 [0076.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0076.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.003] lstrlenW (lpString=".doc") returned 4 [0076.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.003] lstrlenW (lpString=".docx") returned 5 [0076.003] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.003] lstrlenW (lpString=".pdf") returned 4 [0076.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString=".xls") returned 4 [0076.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.004] lstrlenW (lpString=".xlsx") returned 5 [0076.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.004] lstrlenW (lpString=".ppt") returned 4 [0076.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.004] lstrlenW (lpString=".zip") returned 4 [0076.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.004] lstrlenW (lpString=".rar") returned 4 [0076.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString=".bz2") returned 4 [0076.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString=".7z") returned 3 [0076.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.004] lstrlenW (lpString=".dbf") returned 4 [0076.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.004] lstrlenW (lpString=".1cd") returned 4 [0076.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.004] lstrlenW (lpString=".jpg") returned 4 [0076.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.004] lstrlenW (lpString=".doc") returned 4 [0076.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.004] lstrlenW (lpString=".docx") returned 5 [0076.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.004] lstrlenW (lpString=".pdf") returned 4 [0076.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.005] lstrlenW (lpString=".xls") returned 4 [0076.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.005] lstrlenW (lpString=".xlsx") returned 5 [0076.005] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.005] lstrlenW (lpString=".ppt") returned 4 [0076.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.005] lstrlenW (lpString=".zip") returned 4 [0076.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.005] lstrlenW (lpString=".rar") returned 4 [0076.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.005] lstrlenW (lpString=".bz2") returned 4 [0076.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.005] lstrlenW (lpString=".7z") returned 3 [0076.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.005] lstrlenW (lpString=".dbf") returned 4 [0076.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.005] lstrlenW (lpString=".1cd") returned 4 [0076.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0076.005] lstrlenW (lpString=".jpg") returned 4 [0076.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.005] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.005] lstrlenW (lpString="BL00248_.WMF") returned 12 [0076.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0076.006] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1536) returned 1 [0076.006] CloseHandle (hObject=0x200) returned 1 [0076.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0076.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0076.006] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.006] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0076.006] GetLastError () returned 0x0 [0076.006] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x600, lpOverlapped=0x0) returned 1 [0076.015] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x610, lpOverlapped=0x0) returned 1 [0076.016] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.016] WriteFile (in: hFile=0x218, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.016] SetEndOfFile (hFile=0x218) returned 1 [0076.016] CloseHandle (hObject=0x218) returned 1 [0076.016] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.016] SetEndOfFile (hFile=0x200) returned 1 [0076.017] CloseHandle (hObject=0x200) returned 1 [0076.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.018] lstrlenW (lpString=".doc") returned 4 [0076.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".docx") returned 5 [0076.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.018] lstrlenW (lpString=".pdf") returned 4 [0076.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".xls") returned 4 [0076.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.018] lstrlenW (lpString=".xlsx") returned 5 [0076.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.018] lstrlenW (lpString=".ppt") returned 4 [0076.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.018] lstrlenW (lpString=".zip") returned 4 [0076.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.018] lstrlenW (lpString=".rar") returned 4 [0076.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".bz2") returned 4 [0076.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString=".7z") returned 3 [0076.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.018] lstrlenW (lpString=".dbf") returned 4 [0076.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.018] lstrlenW (lpString=".1cd") returned 4 [0076.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.018] lstrlenW (lpString=".jpg") returned 4 [0076.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.019] lstrlenW (lpString=".doc") returned 4 [0076.019] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString=".docx") returned 5 [0076.019] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.019] lstrlenW (lpString=".pdf") returned 4 [0076.019] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString=".xls") returned 4 [0076.019] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.019] lstrlenW (lpString=".xlsx") returned 5 [0076.019] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.019] lstrlenW (lpString=".ppt") returned 4 [0076.019] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.019] lstrlenW (lpString=".zip") returned 4 [0076.019] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.019] lstrlenW (lpString=".rar") returned 4 [0076.019] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString=".bz2") returned 4 [0076.019] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString=".7z") returned 3 [0076.019] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.019] lstrlenW (lpString=".dbf") returned 4 [0076.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.019] lstrlenW (lpString=".1cd") returned 4 [0076.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0076.019] lstrlenW (lpString=".jpg") returned 4 [0076.020] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.020] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.020] lstrlenW (lpString="BL00254_.WMF") returned 12 [0076.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0076.029] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=1736) returned 1 [0076.029] CloseHandle (hObject=0x200) returned 1 [0076.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0076.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.042] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.042] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0076.043] GetLastError () returned 0x0 [0076.043] ReadFile (in: hFile=0x170, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x6c8, lpOverlapped=0x0) returned 1 [0076.044] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0076.045] ReadFile (in: hFile=0x170, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.045] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.045] SetEndOfFile (hFile=0x1dc) returned 1 [0076.045] CloseHandle (hObject=0x1dc) returned 1 [0076.045] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.046] SetEndOfFile (hFile=0x170) returned 1 [0076.046] CloseHandle (hObject=0x170) returned 1 [0076.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0076.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.047] lstrlenW (lpString=".doc") returned 4 [0076.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.047] lstrlenW (lpString=".docx") returned 5 [0076.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.047] lstrlenW (lpString=".pdf") returned 4 [0076.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.047] lstrlenW (lpString=".xls") returned 4 [0076.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.047] lstrlenW (lpString=".xlsx") returned 5 [0076.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.047] lstrlenW (lpString=".ppt") returned 4 [0076.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.047] lstrlenW (lpString=".zip") returned 4 [0076.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.047] lstrlenW (lpString=".rar") returned 4 [0076.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.047] lstrlenW (lpString=".bz2") returned 4 [0076.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.047] lstrlenW (lpString=".7z") returned 3 [0076.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.047] lstrlenW (lpString=".dbf") returned 4 [0076.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.048] lstrlenW (lpString=".1cd") returned 4 [0076.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.048] lstrlenW (lpString=".jpg") returned 4 [0076.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.048] lstrlenW (lpString=".doc") returned 4 [0076.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.048] lstrlenW (lpString=".docx") returned 5 [0076.048] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.048] lstrlenW (lpString=".pdf") returned 4 [0076.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.048] lstrlenW (lpString=".xls") returned 4 [0076.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.048] lstrlenW (lpString=".xlsx") returned 5 [0076.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.048] lstrlenW (lpString=".ppt") returned 4 [0076.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.048] lstrlenW (lpString=".zip") returned 4 [0076.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.048] lstrlenW (lpString=".rar") returned 4 [0076.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.048] lstrlenW (lpString=".bz2") returned 4 [0076.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.048] lstrlenW (lpString=".7z") returned 3 [0076.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.048] lstrlenW (lpString=".dbf") returned 4 [0076.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.048] lstrlenW (lpString=".1cd") returned 4 [0076.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0076.049] lstrlenW (lpString=".jpg") returned 4 [0076.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.049] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.049] lstrlenW (lpString="BL00265_.WMF") returned 12 [0076.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.049] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=5752) returned 1 [0076.049] CloseHandle (hObject=0x170) returned 1 [0076.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0076.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.049] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.050] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0076.050] GetLastError () returned 0x0 [0076.050] ReadFile (in: hFile=0x170, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x1678, lpOverlapped=0x0) returned 1 [0076.051] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0x1680, lpOverlapped=0x0) returned 1 [0076.052] ReadFile (in: hFile=0x170, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.052] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.052] SetEndOfFile (hFile=0x1dc) returned 1 [0076.053] CloseHandle (hObject=0x1dc) returned 1 [0076.053] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.053] SetEndOfFile (hFile=0x170) returned 1 [0076.054] CloseHandle (hObject=0x170) returned 1 [0076.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0076.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.054] lstrlenW (lpString=".doc") returned 4 [0076.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.054] lstrlenW (lpString=".docx") returned 5 [0076.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.054] lstrlenW (lpString=".pdf") returned 4 [0076.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.054] lstrlenW (lpString=".xls") returned 4 [0076.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.054] lstrlenW (lpString=".xlsx") returned 5 [0076.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.054] lstrlenW (lpString=".ppt") returned 4 [0076.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.054] lstrlenW (lpString=".zip") returned 4 [0076.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.054] lstrlenW (lpString=".rar") returned 4 [0076.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.055] lstrlenW (lpString=".bz2") returned 4 [0076.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.055] lstrlenW (lpString=".7z") returned 3 [0076.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.055] lstrlenW (lpString=".dbf") returned 4 [0076.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.055] lstrlenW (lpString=".1cd") returned 4 [0076.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.055] lstrlenW (lpString=".jpg") returned 4 [0076.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.055] lstrlenW (lpString=".doc") returned 4 [0076.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.055] lstrlenW (lpString=".docx") returned 5 [0076.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.055] lstrlenW (lpString=".pdf") returned 4 [0076.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.055] lstrlenW (lpString=".xls") returned 4 [0076.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.055] lstrlenW (lpString=".xlsx") returned 5 [0076.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.055] lstrlenW (lpString=".ppt") returned 4 [0076.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.055] lstrlenW (lpString=".zip") returned 4 [0076.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.055] lstrlenW (lpString=".rar") returned 4 [0076.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.056] lstrlenW (lpString=".bz2") returned 4 [0076.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.056] lstrlenW (lpString=".7z") returned 3 [0076.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.056] lstrlenW (lpString=".dbf") returned 4 [0076.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.056] lstrlenW (lpString=".1cd") returned 4 [0076.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0076.056] lstrlenW (lpString=".jpg") returned 4 [0076.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.056] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.056] lstrlenW (lpString="BL00267_.WMF") returned 12 [0076.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.056] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x319ff1c | out: lpFileSize=0x319ff1c*=2644) returned 1 [0076.056] CloseHandle (hObject=0x170) returned 1 [0076.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0076.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0076.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0076.057] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.057] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0076.057] GetLastError () returned 0x0 [0076.057] ReadFile (in: hFile=0x170, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0xa54, lpOverlapped=0x0) returned 1 [0076.306] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xa60, lpOverlapped=0x0) returned 1 [0076.331] ReadFile (in: hFile=0x170, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x319fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x319fed4*=0x0, lpOverlapped=0x0) returned 1 [0076.334] WriteFile (in: hFile=0x1dc, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x319fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x319fc9c*=0xec, lpOverlapped=0x0) returned 1 [0076.334] SetEndOfFile (hFile=0x1dc) returned 1 [0076.334] CloseHandle (hObject=0x1dc) returned 1 [0076.334] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x319fec8 | out: lpNewFilePointer=0x0) returned 1 [0076.334] SetEndOfFile (hFile=0x170) returned 1 [0076.335] CloseHandle (hObject=0x170) returned 1 [0076.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0076.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0076.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.335] lstrlenW (lpString=".doc") returned 4 [0076.335] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.335] lstrlenW (lpString=".docx") returned 5 [0076.335] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.335] lstrlenW (lpString=".pdf") returned 4 [0076.335] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.336] lstrlenW (lpString=".xls") returned 4 [0076.336] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.336] lstrlenW (lpString=".xlsx") returned 5 [0076.336] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.336] lstrlenW (lpString=".ppt") returned 4 [0076.336] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.336] lstrlenW (lpString=".zip") returned 4 [0076.336] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.336] lstrlenW (lpString=".rar") returned 4 [0076.336] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.336] lstrlenW (lpString=".bz2") returned 4 [0076.336] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.336] lstrlenW (lpString=".7z") returned 3 [0076.336] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.336] lstrlenW (lpString=".dbf") returned 4 [0076.336] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.336] lstrlenW (lpString=".1cd") returned 4 [0076.336] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.336] lstrlenW (lpString=".jpg") returned 4 [0076.336] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.336] lstrlenW (lpString=".doc") returned 4 [0076.336] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0076.336] lstrlenW (lpString=".docx") returned 5 [0076.336] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0076.336] lstrlenW (lpString=".pdf") returned 4 [0076.336] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0076.336] lstrlenW (lpString=".xls") returned 4 [0076.337] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0076.337] lstrlenW (lpString=".xlsx") returned 5 [0076.337] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0076.337] lstrlenW (lpString=".ppt") returned 4 [0076.337] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0076.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.337] lstrlenW (lpString=".zip") returned 4 [0076.337] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0076.337] lstrlenW (lpString=".rar") returned 4 [0076.337] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0076.337] lstrlenW (lpString=".bz2") returned 4 [0076.337] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0076.337] lstrlenW (lpString=".7z") returned 3 [0076.337] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0076.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.337] lstrlenW (lpString=".dbf") returned 4 [0076.337] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0076.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.337] lstrlenW (lpString=".1cd") returned 4 [0076.337] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0076.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0076.337] lstrlenW (lpString=".jpg") returned 4 [0076.337] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0076.337] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0076.337] lstrlenW (lpString="BS00078_.WMF") returned 12 [0076.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 21 os_tid = 0xab8 [0047.031] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x37c06b0 [0047.031] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10000) returned 0x37d06b8 [0047.032] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920480 [0047.032] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x6) returned 0x9231a0 [0047.032] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x920498 [0047.032] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x100000) returned 0x3c90020 [0047.032] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9204b0 [0047.032] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9204b0, Size=0x20) returned 0x905cc0 [0047.032] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x9204b0 [0047.032] RtlReAllocateHeap (Heap=0x8d0000, Flags=0x0, Ptr=0x9204b0, Size=0x20) returned 0x905ce8 [0047.032] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76c20000 [0047.033] GetProcAddress (hModule=0x76c20000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76c4d650 [0047.033] Wow64DisableWow64FsRedirection (in: OldValue=0x32dff58 | out: OldValue=0x32dff58*=0x0) returned 1 [0047.033] lstrlenW (lpString="kernel32.dll") returned 12 [0047.033] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905cc0 | out: hHeap=0x8d0000) returned 1 [0047.033] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0047.033] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x905ce8 | out: hHeap=0x8d0000) returned 1 [0047.033] Sleep (dwMilliseconds=0x64) [0047.239] Sleep (dwMilliseconds=0x64) [0047.491] Sleep (dwMilliseconds=0x64) [0047.651] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0047.652] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0047.652] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.111] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2506240) returned 1 [0048.111] CloseHandle (hObject=0x19c) returned 1 [0048.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0048.111] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0048.162] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0048.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0048.162] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0048.162] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.162] ReadFile (in: hFile=0x184, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.201] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.201] ReadFile (in: hFile=0x184, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.215] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0048.215] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0048.215] ReadFile (in: hFile=0x184, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0048.366] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0048.366] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0048.744] SetEndOfFile (hFile=0x184) returned 1 [0048.744] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f854b0 [0048.748] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.748] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.749] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.749] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0048.755] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0048.755] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.100] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b0 | out: hHeap=0x8d0000) returned 1 [0049.418] CloseHandle (hObject=0x184) returned 1 [0050.035] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0050.035] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.036] lstrlenW (lpString=".doc") returned 4 [0050.036] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.036] lstrlenW (lpString=".docx") returned 5 [0050.036] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0050.036] lstrlenW (lpString=".pdf") returned 4 [0050.036] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.036] lstrlenW (lpString=".xls") returned 4 [0050.036] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.036] lstrlenW (lpString=".xlsx") returned 5 [0050.036] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0050.036] lstrlenW (lpString=".ppt") returned 4 [0050.036] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.036] lstrlenW (lpString=".zip") returned 4 [0050.036] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.036] lstrlenW (lpString=".rar") returned 4 [0050.036] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.036] lstrlenW (lpString=".bz2") returned 4 [0050.036] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.036] lstrlenW (lpString=".7z") returned 3 [0050.036] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.036] lstrlenW (lpString=".dbf") returned 4 [0050.036] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.036] lstrlenW (lpString=".1cd") returned 4 [0050.036] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.036] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.036] lstrlenW (lpString=".jpg") returned 4 [0050.037] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.037] lstrlenW (lpString=".doc") returned 4 [0050.037] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0050.037] lstrlenW (lpString=".docx") returned 5 [0050.037] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0050.037] lstrlenW (lpString=".pdf") returned 4 [0050.037] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0050.037] lstrlenW (lpString=".xls") returned 4 [0050.037] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0050.037] lstrlenW (lpString=".xlsx") returned 5 [0050.037] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0050.037] lstrlenW (lpString=".ppt") returned 4 [0050.037] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0050.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.037] lstrlenW (lpString=".zip") returned 4 [0050.037] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0050.037] lstrlenW (lpString=".rar") returned 4 [0050.037] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0050.037] lstrlenW (lpString=".bz2") returned 4 [0050.037] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0050.037] lstrlenW (lpString=".7z") returned 3 [0050.037] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0050.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.038] lstrlenW (lpString=".dbf") returned 4 [0050.038] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0050.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.038] lstrlenW (lpString=".1cd") returned 4 [0050.038] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0050.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0050.038] lstrlenW (lpString=".jpg") returned 4 [0050.038] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0050.038] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0050.038] lstrlenW (lpString="PubLR.cab") returned 9 [0050.038] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0050.038] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=9958388) returned 1 [0050.038] CloseHandle (hObject=0x184) returned 1 [0050.038] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0050.039] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0050.039] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0050.039] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0050.039] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0050.039] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.039] ReadFile (in: hFile=0x184, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.141] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.141] ReadFile (in: hFile=0x184, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.149] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.149] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0050.149] ReadFile (in: hFile=0x184, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.166] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0050.166] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0050.583] SetEndOfFile (hFile=0x184) returned 1 [0050.583] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f854b0 [0050.587] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.587] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.588] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.588] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.592] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0050.592] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.597] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b0 | out: hHeap=0x8d0000) returned 1 [0050.597] CloseHandle (hObject=0x184) returned 1 [0053.019] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0053.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.019] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.019] lstrlenW (lpString=".doc") returned 4 [0053.019] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.019] lstrlenW (lpString=".docx") returned 5 [0053.019] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.019] lstrlenW (lpString=".pdf") returned 4 [0053.019] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.019] lstrlenW (lpString=".xls") returned 4 [0053.019] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.019] lstrlenW (lpString=".xlsx") returned 5 [0053.020] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.020] lstrlenW (lpString=".ppt") returned 4 [0053.020] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.020] lstrlenW (lpString=".zip") returned 4 [0053.020] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.020] lstrlenW (lpString=".rar") returned 4 [0053.020] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.020] lstrlenW (lpString=".bz2") returned 4 [0053.020] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.020] lstrlenW (lpString=".7z") returned 3 [0053.020] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.020] lstrlenW (lpString=".dbf") returned 4 [0053.020] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.020] lstrlenW (lpString=".1cd") returned 4 [0053.020] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.020] lstrlenW (lpString=".jpg") returned 4 [0053.020] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.020] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.020] lstrlenW (lpString=".doc") returned 4 [0053.020] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0053.020] lstrlenW (lpString=".docx") returned 5 [0053.020] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0053.020] lstrlenW (lpString=".pdf") returned 4 [0053.020] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0053.020] lstrlenW (lpString=".xls") returned 4 [0053.020] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0053.020] lstrlenW (lpString=".xlsx") returned 5 [0053.021] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0053.021] lstrlenW (lpString=".ppt") returned 4 [0053.021] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0053.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.021] lstrlenW (lpString=".zip") returned 4 [0053.021] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0053.021] lstrlenW (lpString=".rar") returned 4 [0053.021] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0053.021] lstrlenW (lpString=".bz2") returned 4 [0053.021] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0053.021] lstrlenW (lpString=".7z") returned 3 [0053.021] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0053.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.021] lstrlenW (lpString=".dbf") returned 4 [0053.021] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0053.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.021] lstrlenW (lpString=".1cd") returned 4 [0053.021] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0053.021] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0053.021] lstrlenW (lpString=".jpg") returned 4 [0053.021] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0053.021] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0053.021] lstrlenW (lpString="Proof.cab") returned 9 [0053.021] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.022] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=11482605) returned 1 [0053.022] CloseHandle (hObject=0x184) returned 1 [0053.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0053.022] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0053.022] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0053.153] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.154] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0053.154] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0053.154] ReadFile (in: hFile=0x184, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.158] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0053.158] ReadFile (in: hFile=0x184, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.162] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0053.162] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0053.162] ReadFile (in: hFile=0x184, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0053.178] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0053.178] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0053.508] SetEndOfFile (hFile=0x184) returned 1 [0053.509] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f854b0 [0053.509] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.509] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.510] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.510] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.512] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0053.512] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.514] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b0 | out: hHeap=0x8d0000) returned 1 [0053.514] CloseHandle (hObject=0x184) returned 1 [0054.982] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0054.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.982] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.983] lstrlenW (lpString=".doc") returned 4 [0054.983] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.983] lstrlenW (lpString=".docx") returned 5 [0054.983] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0054.983] lstrlenW (lpString=".pdf") returned 4 [0054.983] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.983] lstrlenW (lpString=".xls") returned 4 [0054.983] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.983] lstrlenW (lpString=".xlsx") returned 5 [0054.983] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0054.983] lstrlenW (lpString=".ppt") returned 4 [0054.983] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.983] lstrlenW (lpString=".zip") returned 4 [0054.983] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.983] lstrlenW (lpString=".rar") returned 4 [0054.983] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.983] lstrlenW (lpString=".bz2") returned 4 [0054.983] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.983] lstrlenW (lpString=".7z") returned 3 [0054.983] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.983] lstrlenW (lpString=".dbf") returned 4 [0054.983] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.983] lstrlenW (lpString=".1cd") returned 4 [0054.983] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.983] lstrlenW (lpString=".jpg") returned 4 [0054.983] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.983] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.984] lstrlenW (lpString=".doc") returned 4 [0054.984] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0054.984] lstrlenW (lpString=".docx") returned 5 [0054.984] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0054.984] lstrlenW (lpString=".pdf") returned 4 [0054.984] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0054.984] lstrlenW (lpString=".xls") returned 4 [0054.984] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0054.984] lstrlenW (lpString=".xlsx") returned 5 [0054.984] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0054.984] lstrlenW (lpString=".ppt") returned 4 [0054.984] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0054.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.984] lstrlenW (lpString=".zip") returned 4 [0054.984] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0054.984] lstrlenW (lpString=".rar") returned 4 [0054.984] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0054.984] lstrlenW (lpString=".bz2") returned 4 [0054.984] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0054.984] lstrlenW (lpString=".7z") returned 3 [0054.984] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0054.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.984] lstrlenW (lpString=".dbf") returned 4 [0054.984] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0054.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.984] lstrlenW (lpString=".1cd") returned 4 [0054.984] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0054.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0054.984] lstrlenW (lpString=".jpg") returned 4 [0054.984] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0054.984] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0054.985] lstrlenW (lpString="Office32MUI.msi") returned 15 [0054.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.985] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=873984) returned 1 [0054.985] CloseHandle (hObject=0x184) returned 1 [0054.985] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0054.985] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0054.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0054.985] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.985] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0054.985] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0054.986] GetLastError () returned 0x0 [0054.986] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xd5600, lpOverlapped=0x0) returned 1 [0055.008] WriteFile (in: hFile=0x208, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0055.026] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0055.026] WriteFile (in: hFile=0x208, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0055.026] SetEndOfFile (hFile=0x208) returned 1 [0055.026] CloseHandle (hObject=0x208) returned 1 [0055.033] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.033] SetEndOfFile (hFile=0x184) returned 1 [0055.040] CloseHandle (hObject=0x184) returned 1 [0055.041] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.041] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0055.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.041] lstrlenW (lpString=".doc") returned 4 [0055.041] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.041] lstrlenW (lpString=".docx") returned 5 [0055.041] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.041] lstrlenW (lpString=".pdf") returned 4 [0055.041] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.041] lstrlenW (lpString=".xls") returned 4 [0055.041] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.041] lstrlenW (lpString=".xlsx") returned 5 [0055.041] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.041] lstrlenW (lpString=".ppt") returned 4 [0055.041] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.041] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.041] lstrlenW (lpString=".zip") returned 4 [0055.041] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.042] lstrlenW (lpString=".rar") returned 4 [0055.042] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.042] lstrlenW (lpString=".bz2") returned 4 [0055.042] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.042] lstrlenW (lpString=".7z") returned 3 [0055.042] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.042] lstrlenW (lpString=".dbf") returned 4 [0055.042] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.042] lstrlenW (lpString=".1cd") returned 4 [0055.042] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.042] lstrlenW (lpString=".jpg") returned 4 [0055.042] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.042] lstrlenW (lpString=".doc") returned 4 [0055.042] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0055.042] lstrlenW (lpString=".docx") returned 5 [0055.042] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0055.042] lstrlenW (lpString=".pdf") returned 4 [0055.042] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0055.042] lstrlenW (lpString=".xls") returned 4 [0055.042] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0055.042] lstrlenW (lpString=".xlsx") returned 5 [0055.042] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0055.042] lstrlenW (lpString=".ppt") returned 4 [0055.042] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0055.042] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.042] lstrlenW (lpString=".zip") returned 4 [0055.043] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0055.043] lstrlenW (lpString=".rar") returned 4 [0055.043] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0055.043] lstrlenW (lpString=".bz2") returned 4 [0055.043] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0055.043] lstrlenW (lpString=".7z") returned 3 [0055.043] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0055.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.043] lstrlenW (lpString=".dbf") returned 4 [0055.043] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0055.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.043] lstrlenW (lpString=".1cd") returned 4 [0055.043] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0055.043] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0055.043] lstrlenW (lpString=".jpg") returned 4 [0055.043] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0055.043] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0055.043] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0055.043] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0055.044] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2928955) returned 1 [0055.044] CloseHandle (hObject=0x184) returned 1 [0055.044] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0055.044] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.044] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0055.110] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0055.110] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0055.110] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.110] ReadFile (in: hFile=0x184, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.116] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.116] ReadFile (in: hFile=0x184, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.125] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.125] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.125] ReadFile (in: hFile=0x184, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.173] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0055.173] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0055.437] SetEndOfFile (hFile=0x184) returned 1 [0055.437] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f854b0 [0055.441] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.441] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.443] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.443] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.448] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0055.448] WriteFile (in: hFile=0x184, lpBuffer=0x3f854b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f854b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0055.451] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b0 | out: hHeap=0x8d0000) returned 1 [0055.451] CloseHandle (hObject=0x184) returned 1 [0055.984] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0055.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.985] lstrlenW (lpString=".doc") returned 4 [0055.985] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.985] lstrlenW (lpString=".docx") returned 5 [0055.985] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.985] lstrlenW (lpString=".pdf") returned 4 [0055.985] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.985] lstrlenW (lpString=".xls") returned 4 [0055.985] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.985] lstrlenW (lpString=".xlsx") returned 5 [0055.985] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.985] lstrlenW (lpString=".ppt") returned 4 [0055.985] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.985] lstrlenW (lpString=".zip") returned 4 [0055.985] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.985] lstrlenW (lpString=".rar") returned 4 [0055.985] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.985] lstrlenW (lpString=".bz2") returned 4 [0055.985] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.985] lstrlenW (lpString=".7z") returned 3 [0055.985] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.985] lstrlenW (lpString=".dbf") returned 4 [0055.985] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.985] lstrlenW (lpString=".1cd") returned 4 [0055.985] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.985] lstrlenW (lpString=".jpg") returned 4 [0055.985] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.985] lstrlenW (lpString=".doc") returned 4 [0055.986] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0055.986] lstrlenW (lpString=".docx") returned 5 [0055.986] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0055.986] lstrlenW (lpString=".pdf") returned 4 [0055.986] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0055.986] lstrlenW (lpString=".xls") returned 4 [0055.986] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0055.986] lstrlenW (lpString=".xlsx") returned 5 [0055.986] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0055.986] lstrlenW (lpString=".ppt") returned 4 [0055.986] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0055.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.986] lstrlenW (lpString=".zip") returned 4 [0055.986] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0055.986] lstrlenW (lpString=".rar") returned 4 [0055.986] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0055.986] lstrlenW (lpString=".bz2") returned 4 [0055.986] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0055.986] lstrlenW (lpString=".7z") returned 3 [0055.986] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0055.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.986] lstrlenW (lpString=".dbf") returned 4 [0055.986] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0055.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.986] lstrlenW (lpString=".1cd") returned 4 [0055.986] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0055.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0055.986] lstrlenW (lpString=".jpg") returned 4 [0055.986] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0055.987] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0055.987] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0055.987] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0055.987] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3124224) returned 1 [0055.987] CloseHandle (hObject=0x184) returned 1 [0055.987] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0055.987] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0055.987] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0055.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0055.988] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0055.988] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0055.988] ReadFile (in: hFile=0x184, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.044] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.044] ReadFile (in: hFile=0x184, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.052] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.052] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.052] ReadFile (in: hFile=0x184, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.325] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.325] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0056.344] SetEndOfFile (hFile=0x184) returned 1 [0056.344] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f754b0 [0056.344] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.344] WriteFile (in: hFile=0x184, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.346] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.346] WriteFile (in: hFile=0x184, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.351] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.351] WriteFile (in: hFile=0x184, lpBuffer=0x3f754b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f754b0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.353] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f754b0 | out: hHeap=0x8d0000) returned 1 [0056.353] CloseHandle (hObject=0x184) returned 1 [0056.524] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0056.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.524] lstrlenW (lpString=".doc") returned 4 [0056.524] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.524] lstrlenW (lpString=".docx") returned 5 [0056.524] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0056.524] lstrlenW (lpString=".pdf") returned 4 [0056.524] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.524] lstrlenW (lpString=".xls") returned 4 [0056.524] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.524] lstrlenW (lpString=".xlsx") returned 5 [0056.524] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0056.524] lstrlenW (lpString=".ppt") returned 4 [0056.524] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.524] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.525] lstrlenW (lpString=".zip") returned 4 [0056.525] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.525] lstrlenW (lpString=".rar") returned 4 [0056.525] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.525] lstrlenW (lpString=".bz2") returned 4 [0056.525] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.525] lstrlenW (lpString=".7z") returned 3 [0056.525] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.525] lstrlenW (lpString=".dbf") returned 4 [0056.525] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.525] lstrlenW (lpString=".1cd") returned 4 [0056.525] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.525] lstrlenW (lpString=".jpg") returned 4 [0056.525] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.525] lstrlenW (lpString=".doc") returned 4 [0056.525] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.525] lstrlenW (lpString=".docx") returned 5 [0056.525] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0056.525] lstrlenW (lpString=".pdf") returned 4 [0056.525] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.525] lstrlenW (lpString=".xls") returned 4 [0056.525] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.525] lstrlenW (lpString=".xlsx") returned 5 [0056.525] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0056.525] lstrlenW (lpString=".ppt") returned 4 [0056.525] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.525] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.525] lstrlenW (lpString=".zip") returned 4 [0056.526] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.526] lstrlenW (lpString=".rar") returned 4 [0056.526] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.526] lstrlenW (lpString=".bz2") returned 4 [0056.526] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.526] lstrlenW (lpString=".7z") returned 3 [0056.526] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.526] lstrlenW (lpString=".dbf") returned 4 [0056.526] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.526] lstrlenW (lpString=".1cd") returned 4 [0056.526] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.526] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0056.526] lstrlenW (lpString=".jpg") returned 4 [0056.526] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.526] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0056.526] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0056.526] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.527] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2503680) returned 1 [0056.527] CloseHandle (hObject=0x184) returned 1 [0056.527] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0056.527] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0056.527] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0056.527] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0056.528] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0056.528] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.528] ReadFile (in: hFile=0x184, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.583] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.584] ReadFile (in: hFile=0x184, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.594] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0056.594] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0056.594] ReadFile (in: hFile=0x184, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0056.665] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0056.666] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0056.961] SetEndOfFile (hFile=0x184) returned 1 [0056.961] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x401b510 [0056.965] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.965] WriteFile (in: hFile=0x184, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.967] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.967] WriteFile (in: hFile=0x184, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.973] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0056.973] WriteFile (in: hFile=0x184, lpBuffer=0x401b510*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x401b510*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.976] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401b510 | out: hHeap=0x8d0000) returned 1 [0056.976] CloseHandle (hObject=0x184) returned 1 [0056.976] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0056.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.976] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.976] lstrlenW (lpString=".doc") returned 4 [0056.976] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.977] lstrlenW (lpString=".docx") returned 5 [0056.977] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0056.977] lstrlenW (lpString=".pdf") returned 4 [0056.977] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.977] lstrlenW (lpString=".xls") returned 4 [0056.977] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.977] lstrlenW (lpString=".xlsx") returned 5 [0056.977] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0056.977] lstrlenW (lpString=".ppt") returned 4 [0056.977] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.977] lstrlenW (lpString=".zip") returned 4 [0056.977] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.977] lstrlenW (lpString=".rar") returned 4 [0056.977] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.977] lstrlenW (lpString=".bz2") returned 4 [0056.977] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.977] lstrlenW (lpString=".7z") returned 3 [0056.977] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.977] lstrlenW (lpString=".dbf") returned 4 [0056.977] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.977] lstrlenW (lpString=".1cd") returned 4 [0056.977] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.977] lstrlenW (lpString=".jpg") returned 4 [0056.977] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.977] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.977] lstrlenW (lpString=".doc") returned 4 [0056.977] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0056.977] lstrlenW (lpString=".docx") returned 5 [0056.978] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0056.978] lstrlenW (lpString=".pdf") returned 4 [0056.978] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0056.978] lstrlenW (lpString=".xls") returned 4 [0056.978] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0056.978] lstrlenW (lpString=".xlsx") returned 5 [0056.978] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0056.978] lstrlenW (lpString=".ppt") returned 4 [0056.978] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0056.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.978] lstrlenW (lpString=".zip") returned 4 [0056.978] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0056.978] lstrlenW (lpString=".rar") returned 4 [0056.978] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0056.978] lstrlenW (lpString=".bz2") returned 4 [0056.978] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0056.978] lstrlenW (lpString=".7z") returned 3 [0056.978] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0056.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.978] lstrlenW (lpString=".dbf") returned 4 [0056.978] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0056.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.978] lstrlenW (lpString=".1cd") returned 4 [0056.978] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0056.978] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0056.978] lstrlenW (lpString=".jpg") returned 4 [0056.978] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0056.978] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0056.979] lstrlenW (lpString="ProjLR.cab") returned 10 [0056.979] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0057.572] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=8265165) returned 1 [0057.572] CloseHandle (hObject=0x1f8) returned 1 [0057.572] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0057.572] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0057.572] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0057.573] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0057.573] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0057.573] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.573] ReadFile (in: hFile=0x1f8, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.577] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.577] ReadFile (in: hFile=0x1f8, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.580] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0057.580] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0057.580] ReadFile (in: hFile=0x1f8, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0057.596] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0057.596] WriteFile (in: hFile=0x1f8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0058.001] SetEndOfFile (hFile=0x1f8) returned 1 [0058.001] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x400b508 [0058.001] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.001] WriteFile (in: hFile=0x1f8, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.003] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.003] WriteFile (in: hFile=0x1f8, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.005] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0058.005] WriteFile (in: hFile=0x1f8, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0058.007] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0058.007] CloseHandle (hObject=0x1f8) returned 1 [0058.007] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.007] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.007] lstrlenW (lpString=".doc") returned 4 [0058.007] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.007] lstrlenW (lpString=".docx") returned 5 [0058.007] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0058.008] lstrlenW (lpString=".pdf") returned 4 [0058.008] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.008] lstrlenW (lpString=".xls") returned 4 [0058.008] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.008] lstrlenW (lpString=".xlsx") returned 5 [0058.008] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0058.008] lstrlenW (lpString=".ppt") returned 4 [0058.008] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.008] lstrlenW (lpString=".zip") returned 4 [0058.008] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.008] lstrlenW (lpString=".rar") returned 4 [0058.008] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.008] lstrlenW (lpString=".bz2") returned 4 [0058.008] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.008] lstrlenW (lpString=".7z") returned 3 [0058.008] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.008] lstrlenW (lpString=".dbf") returned 4 [0058.008] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.008] lstrlenW (lpString=".1cd") returned 4 [0058.008] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.008] lstrlenW (lpString=".jpg") returned 4 [0058.008] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.008] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.009] lstrlenW (lpString=".doc") returned 4 [0058.009] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0058.009] lstrlenW (lpString=".docx") returned 5 [0058.009] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0058.009] lstrlenW (lpString=".pdf") returned 4 [0058.009] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0058.009] lstrlenW (lpString=".xls") returned 4 [0058.009] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0058.009] lstrlenW (lpString=".xlsx") returned 5 [0058.009] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0058.009] lstrlenW (lpString=".ppt") returned 4 [0058.009] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0058.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.009] lstrlenW (lpString=".zip") returned 4 [0058.009] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0058.009] lstrlenW (lpString=".rar") returned 4 [0058.009] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0058.009] lstrlenW (lpString=".bz2") returned 4 [0058.009] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0058.009] lstrlenW (lpString=".7z") returned 3 [0058.009] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0058.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.009] lstrlenW (lpString=".dbf") returned 4 [0058.009] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0058.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.009] lstrlenW (lpString=".1cd") returned 4 [0058.009] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0058.009] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0058.009] lstrlenW (lpString=".jpg") returned 4 [0058.009] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0058.010] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0058.010] lstrlenW (lpString="msvcr90.dll") returned 11 [0058.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.651] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=655872) returned 1 [0058.651] CloseHandle (hObject=0x1ec) returned 1 [0058.651] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0058.651] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.651] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.651] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.651] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0058.652] GetLastError () returned 0x0 [0058.652] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xa0200, lpOverlapped=0x0) returned 1 [0058.677] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0058.691] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0058.691] WriteFile (in: hFile=0x1f0, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0058.691] SetEndOfFile (hFile=0x1f0) returned 1 [0058.691] CloseHandle (hObject=0x1f0) returned 1 [0058.691] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0058.691] SetEndOfFile (hFile=0x1ec) returned 1 [0058.984] CloseHandle (hObject=0x1ec) returned 1 [0058.984] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0058.984] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0058.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.984] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.984] lstrlenW (lpString=".doc") returned 4 [0058.984] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.984] lstrlenW (lpString=".docx") returned 5 [0058.984] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0058.985] lstrlenW (lpString=".pdf") returned 4 [0058.985] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.985] lstrlenW (lpString=".xls") returned 4 [0058.985] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.985] lstrlenW (lpString=".xlsx") returned 5 [0058.985] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0058.985] lstrlenW (lpString=".ppt") returned 4 [0058.985] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.985] lstrlenW (lpString=".zip") returned 4 [0058.985] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.985] lstrlenW (lpString=".rar") returned 4 [0058.985] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.985] lstrlenW (lpString=".bz2") returned 4 [0058.985] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.985] lstrlenW (lpString=".7z") returned 3 [0058.985] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.985] lstrlenW (lpString=".dbf") returned 4 [0058.985] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.985] lstrlenW (lpString=".1cd") returned 4 [0058.985] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.985] lstrlenW (lpString=".jpg") returned 4 [0058.985] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.985] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.985] lstrlenW (lpString=".doc") returned 4 [0058.985] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0058.985] lstrlenW (lpString=".docx") returned 5 [0058.985] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0058.985] lstrlenW (lpString=".pdf") returned 4 [0058.986] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0058.986] lstrlenW (lpString=".xls") returned 4 [0058.986] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0058.986] lstrlenW (lpString=".xlsx") returned 5 [0058.986] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0058.986] lstrlenW (lpString=".ppt") returned 4 [0058.986] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0058.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.986] lstrlenW (lpString=".zip") returned 4 [0058.986] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0058.986] lstrlenW (lpString=".rar") returned 4 [0058.986] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0058.986] lstrlenW (lpString=".bz2") returned 4 [0058.986] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0058.986] lstrlenW (lpString=".7z") returned 3 [0058.986] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0058.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.986] lstrlenW (lpString=".dbf") returned 4 [0058.986] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0058.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.986] lstrlenW (lpString=".1cd") returned 4 [0058.986] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0058.986] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0058.986] lstrlenW (lpString=".jpg") returned 4 [0058.986] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0058.986] lstrcmpiW (lpString1=".msi", lpString2=".wiki") returned -1 [0058.986] lstrlenW (lpString="Office32WW.msi") returned 14 [0058.986] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.987] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1992192) returned 1 [0058.987] CloseHandle (hObject=0x1ec) returned 1 [0058.987] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0058.987] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0058.987] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0058.988] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0058.988] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0058.988] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.988] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.993] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.993] ReadFile (in: hFile=0x1ec, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0058.997] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0058.997] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0058.997] ReadFile (in: hFile=0x1ec, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0059.012] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.012] WriteFile (in: hFile=0x1ec, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0059.425] SetEndOfFile (hFile=0x1ec) returned 1 [0059.426] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x400b508 [0059.439] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.440] WriteFile (in: hFile=0x1ec, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.441] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.441] WriteFile (in: hFile=0x1ec, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.444] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0059.444] WriteFile (in: hFile=0x1ec, lpBuffer=0x400b508*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x400b508*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0059.446] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x400b508 | out: hHeap=0x8d0000) returned 1 [0059.446] CloseHandle (hObject=0x1ec) returned 1 [0059.446] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0059.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.447] lstrlenW (lpString=".doc") returned 4 [0059.447] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.447] lstrlenW (lpString=".docx") returned 5 [0059.447] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0059.447] lstrlenW (lpString=".pdf") returned 4 [0059.447] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.447] lstrlenW (lpString=".xls") returned 4 [0059.447] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.447] lstrlenW (lpString=".xlsx") returned 5 [0059.447] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0059.447] lstrlenW (lpString=".ppt") returned 4 [0059.447] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.447] lstrlenW (lpString=".zip") returned 4 [0059.447] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.447] lstrlenW (lpString=".rar") returned 4 [0059.447] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.447] lstrlenW (lpString=".bz2") returned 4 [0059.447] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.447] lstrlenW (lpString=".7z") returned 3 [0059.447] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.447] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.447] lstrlenW (lpString=".dbf") returned 4 [0059.447] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.448] lstrlenW (lpString=".1cd") returned 4 [0059.448] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.448] lstrlenW (lpString=".jpg") returned 4 [0059.448] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.448] lstrlenW (lpString=".doc") returned 4 [0059.448] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0059.448] lstrlenW (lpString=".docx") returned 5 [0059.448] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0059.448] lstrlenW (lpString=".pdf") returned 4 [0059.448] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0059.448] lstrlenW (lpString=".xls") returned 4 [0059.448] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0059.448] lstrlenW (lpString=".xlsx") returned 5 [0059.448] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0059.448] lstrlenW (lpString=".ppt") returned 4 [0059.448] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0059.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.448] lstrlenW (lpString=".zip") returned 4 [0059.448] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0059.448] lstrlenW (lpString=".rar") returned 4 [0059.448] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0059.448] lstrlenW (lpString=".bz2") returned 4 [0059.448] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0059.448] lstrlenW (lpString=".7z") returned 3 [0059.448] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0059.448] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.448] lstrlenW (lpString=".dbf") returned 4 [0059.449] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0059.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.449] lstrlenW (lpString=".1cd") returned 4 [0059.449] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0059.449] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0059.449] lstrlenW (lpString=".jpg") returned 4 [0059.449] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0059.449] lstrcmpiW (lpString1=".xrm-ms", lpString2=".wiki") returned 1 [0059.449] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0059.449] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0059.449] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=715834) returned 1 [0059.449] CloseHandle (hObject=0x1ec) returned 1 [0059.449] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0059.450] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0059.450] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0059.450] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.450] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.450] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0059.450] GetLastError () returned 0x0 [0059.450] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0059.739] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0059.753] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0059.753] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x104, lpOverlapped=0x0) returned 1 [0059.753] SetEndOfFile (hFile=0x1fc) returned 1 [0059.753] CloseHandle (hObject=0x1fc) returned 1 [0059.753] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0059.753] SetEndOfFile (hFile=0x1ec) returned 1 [0059.759] CloseHandle (hObject=0x1ec) returned 1 [0059.759] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0059.760] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.033] lstrlenW (lpString=".doc") returned 4 [0060.033] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0060.033] lstrlenW (lpString=".docx") returned 5 [0060.033] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0060.033] lstrlenW (lpString=".pdf") returned 4 [0060.033] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0060.033] lstrlenW (lpString=".xls") returned 4 [0060.033] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0060.033] lstrlenW (lpString=".xlsx") returned 5 [0060.033] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0060.033] lstrlenW (lpString=".ppt") returned 4 [0060.033] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.033] lstrlenW (lpString=".zip") returned 4 [0060.033] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0060.033] lstrlenW (lpString=".rar") returned 4 [0060.033] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0060.033] lstrlenW (lpString=".bz2") returned 4 [0060.033] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0060.033] lstrlenW (lpString=".7z") returned 3 [0060.033] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.033] lstrlenW (lpString=".dbf") returned 4 [0060.033] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.033] lstrlenW (lpString=".1cd") returned 4 [0060.033] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0060.033] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.033] lstrlenW (lpString=".jpg") returned 4 [0060.034] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0060.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.034] lstrlenW (lpString=".doc") returned 4 [0060.034] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0060.034] lstrlenW (lpString=".docx") returned 5 [0060.034] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0060.034] lstrlenW (lpString=".pdf") returned 4 [0060.034] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0060.034] lstrlenW (lpString=".xls") returned 4 [0060.034] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0060.034] lstrlenW (lpString=".xlsx") returned 5 [0060.034] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0060.034] lstrlenW (lpString=".ppt") returned 4 [0060.034] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0060.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.034] lstrlenW (lpString=".zip") returned 4 [0060.034] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0060.034] lstrlenW (lpString=".rar") returned 4 [0060.034] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0060.034] lstrlenW (lpString=".bz2") returned 4 [0060.034] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0060.034] lstrlenW (lpString=".7z") returned 3 [0060.034] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0060.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.034] lstrlenW (lpString=".dbf") returned 4 [0060.034] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0060.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.034] lstrlenW (lpString=".1cd") returned 4 [0060.034] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0060.034] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0060.035] lstrlenW (lpString=".jpg") returned 4 [0060.035] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0060.035] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0060.035] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0060.035] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.395] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=222948913) returned 1 [0060.396] CloseHandle (hObject=0x1e4) returned 1 [0060.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0060.396] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.396] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0060.396] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.396] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0060.396] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.396] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.404] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.404] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.410] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.410] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.410] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.426] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0060.426] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0060.585] SetEndOfFile (hFile=0x1e4) returned 1 [0060.963] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f13470 [0060.963] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.963] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.964] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.964] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.967] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0060.967] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0060.970] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0060.970] CloseHandle (hObject=0x1e4) returned 1 [0060.970] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0060.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.970] lstrlenW (lpString=".doc") returned 4 [0060.970] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.970] lstrlenW (lpString=".docx") returned 5 [0060.970] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0060.970] lstrlenW (lpString=".pdf") returned 4 [0060.970] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.970] lstrlenW (lpString=".xls") returned 4 [0060.970] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.970] lstrlenW (lpString=".xlsx") returned 5 [0060.970] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0060.970] lstrlenW (lpString=".ppt") returned 4 [0060.970] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.970] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.970] lstrlenW (lpString=".zip") returned 4 [0060.971] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.971] lstrlenW (lpString=".rar") returned 4 [0060.971] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.971] lstrlenW (lpString=".bz2") returned 4 [0060.971] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.971] lstrlenW (lpString=".7z") returned 3 [0060.971] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.971] lstrlenW (lpString=".dbf") returned 4 [0060.971] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.971] lstrlenW (lpString=".1cd") returned 4 [0060.971] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.971] lstrlenW (lpString=".jpg") returned 4 [0060.971] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.971] lstrlenW (lpString=".doc") returned 4 [0060.971] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0060.971] lstrlenW (lpString=".docx") returned 5 [0060.971] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0060.971] lstrlenW (lpString=".pdf") returned 4 [0060.971] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0060.971] lstrlenW (lpString=".xls") returned 4 [0060.971] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0060.971] lstrlenW (lpString=".xlsx") returned 5 [0060.971] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0060.971] lstrlenW (lpString=".ppt") returned 4 [0060.971] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0060.971] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.971] lstrlenW (lpString=".zip") returned 4 [0060.971] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0060.972] lstrlenW (lpString=".rar") returned 4 [0060.972] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0060.972] lstrlenW (lpString=".bz2") returned 4 [0060.972] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0060.972] lstrlenW (lpString=".7z") returned 3 [0060.972] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0060.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.972] lstrlenW (lpString=".dbf") returned 4 [0060.972] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0060.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.972] lstrlenW (lpString=".1cd") returned 4 [0060.972] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0060.972] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0060.972] lstrlenW (lpString=".jpg") returned 4 [0060.972] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0060.972] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0060.972] lstrlenW (lpString="osetup.dll") returned 10 [0060.972] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.973] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=7378792) returned 1 [0060.973] CloseHandle (hObject=0x1e4) returned 1 [0060.973] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0060.973] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0060.973] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0060.974] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0060.974] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0060.974] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.974] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.979] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.979] ReadFile (in: hFile=0x1e4, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0060.982] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0060.982] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0060.982] ReadFile (in: hFile=0x1e4, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0061.167] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.167] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0061.179] SetEndOfFile (hFile=0x1e4) returned 1 [0061.180] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f554a0 [0061.184] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.184] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.185] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.185] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.188] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0061.188] WriteFile (in: hFile=0x1e4, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0061.189] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0061.189] CloseHandle (hObject=0x1e4) returned 1 [0061.189] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0061.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.190] lstrlenW (lpString=".doc") returned 4 [0061.190] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.190] lstrlenW (lpString=".docx") returned 5 [0061.190] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0061.190] lstrlenW (lpString=".pdf") returned 4 [0061.190] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.190] lstrlenW (lpString=".xls") returned 4 [0061.190] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.190] lstrlenW (lpString=".xlsx") returned 5 [0061.190] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0061.190] lstrlenW (lpString=".ppt") returned 4 [0061.190] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.190] lstrlenW (lpString=".zip") returned 4 [0061.190] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.190] lstrlenW (lpString=".rar") returned 4 [0061.190] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.190] lstrlenW (lpString=".bz2") returned 4 [0061.190] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.190] lstrlenW (lpString=".7z") returned 3 [0061.190] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.190] lstrlenW (lpString=".dbf") returned 4 [0061.190] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.190] lstrlenW (lpString=".1cd") returned 4 [0061.190] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.190] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.190] lstrlenW (lpString=".jpg") returned 4 [0061.191] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.191] lstrlenW (lpString=".doc") returned 4 [0061.191] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0061.191] lstrlenW (lpString=".docx") returned 5 [0061.191] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0061.191] lstrlenW (lpString=".pdf") returned 4 [0061.191] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0061.191] lstrlenW (lpString=".xls") returned 4 [0061.191] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0061.191] lstrlenW (lpString=".xlsx") returned 5 [0061.191] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0061.191] lstrlenW (lpString=".ppt") returned 4 [0061.191] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0061.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.191] lstrlenW (lpString=".zip") returned 4 [0061.191] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0061.191] lstrlenW (lpString=".rar") returned 4 [0061.191] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0061.191] lstrlenW (lpString=".bz2") returned 4 [0061.191] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0061.191] lstrlenW (lpString=".7z") returned 3 [0061.191] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0061.191] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.191] lstrlenW (lpString=".dbf") returned 4 [0061.192] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0061.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.192] lstrlenW (lpString=".1cd") returned 4 [0061.192] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0061.192] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0061.192] lstrlenW (lpString=".jpg") returned 4 [0061.192] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0061.192] lstrcmpiW (lpString1=".xrm-ms", lpString2=".wiki") returned 1 [0061.192] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0061.192] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0061.238] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=715834) returned 1 [0061.238] CloseHandle (hObject=0x1e4) returned 1 [0061.238] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0061.238] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0061.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0061.552] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.552] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0061.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0063.346] GetLastError () returned 0x0 [0063.346] ReadFile (in: hFile=0x180, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0063.362] WriteFile (in: hFile=0x208, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0063.376] ReadFile (in: hFile=0x180, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0063.376] WriteFile (in: hFile=0x208, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x104, lpOverlapped=0x0) returned 1 [0063.376] SetEndOfFile (hFile=0x208) returned 1 [0063.377] CloseHandle (hObject=0x208) returned 1 [0063.377] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.377] SetEndOfFile (hFile=0x180) returned 1 [0063.383] CloseHandle (hObject=0x180) returned 1 [0063.383] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0063.383] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0063.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.383] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.383] lstrlenW (lpString=".doc") returned 4 [0063.384] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0063.384] lstrlenW (lpString=".docx") returned 5 [0063.384] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0063.384] lstrlenW (lpString=".pdf") returned 4 [0063.384] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0063.384] lstrlenW (lpString=".xls") returned 4 [0063.384] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0063.384] lstrlenW (lpString=".xlsx") returned 5 [0063.384] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0063.384] lstrlenW (lpString=".ppt") returned 4 [0063.384] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0063.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.384] lstrlenW (lpString=".zip") returned 4 [0063.384] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0063.384] lstrlenW (lpString=".rar") returned 4 [0063.384] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0063.384] lstrlenW (lpString=".bz2") returned 4 [0063.384] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0063.384] lstrlenW (lpString=".7z") returned 3 [0063.384] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0063.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.384] lstrlenW (lpString=".dbf") returned 4 [0063.384] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0063.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.384] lstrlenW (lpString=".1cd") returned 4 [0063.384] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0063.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.384] lstrlenW (lpString=".jpg") returned 4 [0063.384] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0063.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.384] lstrlenW (lpString=".doc") returned 4 [0063.384] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0063.385] lstrlenW (lpString=".docx") returned 5 [0063.385] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0063.385] lstrlenW (lpString=".pdf") returned 4 [0063.385] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0063.385] lstrlenW (lpString=".xls") returned 4 [0063.385] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0063.385] lstrlenW (lpString=".xlsx") returned 5 [0063.385] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0063.385] lstrlenW (lpString=".ppt") returned 4 [0063.385] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0063.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.385] lstrlenW (lpString=".zip") returned 4 [0063.385] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0063.385] lstrlenW (lpString=".rar") returned 4 [0063.385] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0063.385] lstrlenW (lpString=".bz2") returned 4 [0063.385] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0063.385] lstrlenW (lpString=".7z") returned 3 [0063.385] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0063.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.385] lstrlenW (lpString=".dbf") returned 4 [0063.385] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0063.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.385] lstrlenW (lpString=".1cd") returned 4 [0063.385] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0063.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0063.385] lstrlenW (lpString=".jpg") returned 4 [0063.385] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0063.385] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0063.386] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0063.386] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0063.386] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=162970271) returned 1 [0063.386] CloseHandle (hObject=0x180) returned 1 [0063.386] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0063.386] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0063.386] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0063.387] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0063.387] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0063.387] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0063.387] ReadFile (in: hFile=0x180, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.392] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0063.394] ReadFile (in: hFile=0x180, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.398] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0063.399] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0063.399] ReadFile (in: hFile=0x180, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0063.414] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0063.414] WriteFile (in: hFile=0x180, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0063.731] SetEndOfFile (hFile=0x180) returned 1 [0063.731] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x404b528 [0063.731] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.731] WriteFile (in: hFile=0x180, lpBuffer=0x404b528*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x404b528*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.732] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.732] WriteFile (in: hFile=0x180, lpBuffer=0x404b528*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x404b528*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.735] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0063.735] WriteFile (in: hFile=0x180, lpBuffer=0x404b528*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x404b528*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0063.737] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x404b528 | out: hHeap=0x8d0000) returned 1 [0063.741] CloseHandle (hObject=0x180) returned 1 [0063.741] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0063.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.741] lstrlenW (lpString=".doc") returned 4 [0063.741] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0063.741] lstrlenW (lpString=".docx") returned 5 [0063.741] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0063.741] lstrlenW (lpString=".pdf") returned 4 [0063.741] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0063.741] lstrlenW (lpString=".xls") returned 4 [0063.741] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0063.741] lstrlenW (lpString=".xlsx") returned 5 [0063.741] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0063.741] lstrlenW (lpString=".ppt") returned 4 [0063.741] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0063.741] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.741] lstrlenW (lpString=".zip") returned 4 [0063.742] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0063.742] lstrlenW (lpString=".rar") returned 4 [0063.742] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0063.742] lstrlenW (lpString=".bz2") returned 4 [0063.742] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0063.742] lstrlenW (lpString=".7z") returned 3 [0063.742] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0063.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.742] lstrlenW (lpString=".dbf") returned 4 [0063.742] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0063.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.742] lstrlenW (lpString=".1cd") returned 4 [0063.742] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0063.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.742] lstrlenW (lpString=".jpg") returned 4 [0063.742] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0063.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.742] lstrlenW (lpString=".doc") returned 4 [0063.742] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0063.742] lstrlenW (lpString=".docx") returned 5 [0063.742] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0063.742] lstrlenW (lpString=".pdf") returned 4 [0063.742] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0063.742] lstrlenW (lpString=".xls") returned 4 [0063.742] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0063.742] lstrlenW (lpString=".xlsx") returned 5 [0063.742] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0063.742] lstrlenW (lpString=".ppt") returned 4 [0063.742] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0063.742] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.742] lstrlenW (lpString=".zip") returned 4 [0063.743] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0063.743] lstrlenW (lpString=".rar") returned 4 [0063.743] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0063.743] lstrlenW (lpString=".bz2") returned 4 [0063.743] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0063.743] lstrlenW (lpString=".7z") returned 3 [0063.743] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0063.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.743] lstrlenW (lpString=".dbf") returned 4 [0063.743] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0063.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.743] lstrlenW (lpString=".1cd") returned 4 [0063.743] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0063.743] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0063.743] lstrlenW (lpString=".jpg") returned 4 [0063.743] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0063.743] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0063.743] lstrlenW (lpString="ose.exe") returned 7 [0063.743] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.031] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=174440) returned 1 [0064.031] CloseHandle (hObject=0x180) returned 1 [0064.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0064.031] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.031] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.031] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.031] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.032] GetLastError () returned 0x0 [0064.032] ReadFile (in: hFile=0x180, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x2a968, lpOverlapped=0x0) returned 1 [0064.037] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0064.041] ReadFile (in: hFile=0x180, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.041] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0064.041] SetEndOfFile (hFile=0x218) returned 1 [0064.041] CloseHandle (hObject=0x218) returned 1 [0064.041] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.041] SetEndOfFile (hFile=0x180) returned 1 [0064.045] CloseHandle (hObject=0x180) returned 1 [0064.045] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0064.046] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0064.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.046] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.046] lstrlenW (lpString=".doc") returned 4 [0064.046] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0064.046] lstrlenW (lpString=".docx") returned 5 [0064.046] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0064.046] lstrlenW (lpString=".pdf") returned 4 [0064.046] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0064.046] lstrlenW (lpString=".xls") returned 4 [0064.046] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0064.046] lstrlenW (lpString=".xlsx") returned 5 [0064.046] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0064.046] lstrlenW (lpString=".ppt") returned 4 [0064.047] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0064.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.047] lstrlenW (lpString=".zip") returned 4 [0064.047] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0064.047] lstrlenW (lpString=".rar") returned 4 [0064.047] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0064.047] lstrlenW (lpString=".bz2") returned 4 [0064.047] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0064.047] lstrlenW (lpString=".7z") returned 3 [0064.047] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0064.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.047] lstrlenW (lpString=".dbf") returned 4 [0064.047] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0064.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.047] lstrlenW (lpString=".1cd") returned 4 [0064.047] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0064.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.047] lstrlenW (lpString=".jpg") returned 4 [0064.047] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0064.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.047] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.047] lstrlenW (lpString=".doc") returned 4 [0064.047] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0064.047] lstrlenW (lpString=".docx") returned 5 [0064.047] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0064.047] lstrlenW (lpString=".pdf") returned 4 [0064.047] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0064.047] lstrlenW (lpString=".xls") returned 4 [0064.047] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0064.047] lstrlenW (lpString=".xlsx") returned 5 [0064.047] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0064.048] lstrlenW (lpString=".ppt") returned 4 [0064.048] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0064.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.048] lstrlenW (lpString=".zip") returned 4 [0064.048] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0064.048] lstrlenW (lpString=".rar") returned 4 [0064.048] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0064.048] lstrlenW (lpString=".bz2") returned 4 [0064.048] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0064.048] lstrlenW (lpString=".7z") returned 3 [0064.048] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0064.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.048] lstrlenW (lpString=".dbf") returned 4 [0064.048] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0064.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.048] lstrlenW (lpString=".1cd") returned 4 [0064.048] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0064.048] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0064.048] lstrlenW (lpString=".jpg") returned 4 [0064.048] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0064.048] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0064.048] lstrlenW (lpString="PidGenX.dll") returned 11 [0064.048] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.049] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1463568) returned 1 [0064.049] CloseHandle (hObject=0x180) returned 1 [0064.049] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0064.049] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.049] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0064.049] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.049] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.049] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0064.050] GetLastError () returned 0x0 [0064.050] ReadFile (in: hFile=0x180, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0064.070] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0064.156] ReadFile (in: hFile=0x180, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x65520, lpOverlapped=0x0) returned 1 [0064.170] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x65530, lpOverlapped=0x0) returned 1 [0064.180] ReadFile (in: hFile=0x180, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.180] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0064.181] SetEndOfFile (hFile=0x218) returned 1 [0064.181] CloseHandle (hObject=0x218) returned 1 [0064.181] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.181] SetEndOfFile (hFile=0x180) returned 1 [0064.185] CloseHandle (hObject=0x180) returned 1 [0064.185] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0064.185] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0064.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.185] lstrlenW (lpString=".doc") returned 4 [0064.185] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.186] lstrlenW (lpString=".docx") returned 5 [0064.186] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0064.186] lstrlenW (lpString=".pdf") returned 4 [0064.186] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.186] lstrlenW (lpString=".xls") returned 4 [0064.186] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.186] lstrlenW (lpString=".xlsx") returned 5 [0064.186] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0064.186] lstrlenW (lpString=".ppt") returned 4 [0064.186] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.186] lstrlenW (lpString=".zip") returned 4 [0064.411] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.411] lstrlenW (lpString=".rar") returned 4 [0064.411] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.411] lstrlenW (lpString=".bz2") returned 4 [0064.411] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.411] lstrlenW (lpString=".7z") returned 3 [0064.411] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.411] lstrlenW (lpString=".dbf") returned 4 [0064.411] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.411] lstrlenW (lpString=".1cd") returned 4 [0064.411] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.411] lstrlenW (lpString=".jpg") returned 4 [0064.411] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.411] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.411] lstrlenW (lpString=".doc") returned 4 [0064.411] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0064.411] lstrlenW (lpString=".docx") returned 5 [0064.411] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0064.411] lstrlenW (lpString=".pdf") returned 4 [0064.411] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0064.411] lstrlenW (lpString=".xls") returned 4 [0064.411] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0064.411] lstrlenW (lpString=".xlsx") returned 5 [0064.411] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0064.412] lstrlenW (lpString=".ppt") returned 4 [0064.412] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0064.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.412] lstrlenW (lpString=".zip") returned 4 [0064.412] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0064.412] lstrlenW (lpString=".rar") returned 4 [0064.412] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0064.412] lstrlenW (lpString=".bz2") returned 4 [0064.412] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0064.412] lstrlenW (lpString=".7z") returned 3 [0064.412] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0064.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.412] lstrlenW (lpString=".dbf") returned 4 [0064.412] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0064.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.412] lstrlenW (lpString=".1cd") returned 4 [0064.412] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0064.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0064.412] lstrlenW (lpString=".jpg") returned 4 [0064.412] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0064.412] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0064.412] lstrlenW (lpString="setup.exe") returned 9 [0064.412] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0064.691] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1377656) returned 1 [0064.691] CloseHandle (hObject=0x170) returned 1 [0064.691] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0064.691] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0064.691] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0064.692] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.692] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.692] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0064.692] GetLastError () returned 0x0 [0064.692] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0064.720] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0064.947] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x50588, lpOverlapped=0x0) returned 1 [0064.960] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x50590, lpOverlapped=0x0) returned 1 [0064.968] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0064.968] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0064.969] SetEndOfFile (hFile=0x200) returned 1 [0064.969] CloseHandle (hObject=0x200) returned 1 [0064.969] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0064.969] SetEndOfFile (hFile=0x170) returned 1 [0064.972] CloseHandle (hObject=0x170) returned 1 [0064.972] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0064.973] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0064.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.973] lstrlenW (lpString=".doc") returned 4 [0064.973] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0064.973] lstrlenW (lpString=".docx") returned 5 [0064.973] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0064.973] lstrlenW (lpString=".pdf") returned 4 [0064.973] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0064.973] lstrlenW (lpString=".xls") returned 4 [0064.973] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0064.973] lstrlenW (lpString=".xlsx") returned 5 [0064.973] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0064.973] lstrlenW (lpString=".ppt") returned 4 [0064.973] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0064.973] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.973] lstrlenW (lpString=".zip") returned 4 [0064.973] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0064.973] lstrlenW (lpString=".rar") returned 4 [0064.973] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0064.973] lstrlenW (lpString=".bz2") returned 4 [0064.973] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0064.973] lstrlenW (lpString=".7z") returned 3 [0064.973] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0064.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.974] lstrlenW (lpString=".dbf") returned 4 [0064.974] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0064.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.974] lstrlenW (lpString=".1cd") returned 4 [0064.974] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0064.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.974] lstrlenW (lpString=".jpg") returned 4 [0064.974] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0064.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.974] lstrlenW (lpString=".doc") returned 4 [0064.974] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0064.974] lstrlenW (lpString=".docx") returned 5 [0064.974] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0064.974] lstrlenW (lpString=".pdf") returned 4 [0064.974] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0064.974] lstrlenW (lpString=".xls") returned 4 [0064.974] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0064.974] lstrlenW (lpString=".xlsx") returned 5 [0064.974] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0064.974] lstrlenW (lpString=".ppt") returned 4 [0064.974] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0064.974] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.974] lstrlenW (lpString=".zip") returned 4 [0064.974] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0064.974] lstrlenW (lpString=".rar") returned 4 [0064.974] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0064.974] lstrlenW (lpString=".bz2") returned 4 [0064.974] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0064.975] lstrlenW (lpString=".7z") returned 3 [0064.975] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0064.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.975] lstrlenW (lpString=".dbf") returned 4 [0064.975] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0064.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.975] lstrlenW (lpString=".1cd") returned 4 [0064.975] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0064.975] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0064.975] lstrlenW (lpString=".jpg") returned 4 [0064.975] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0064.975] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0064.975] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0064.975] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0065.311] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=629664) returned 1 [0065.311] CloseHandle (hObject=0x170) returned 1 [0065.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0065.311] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0065.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0065.311] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.311] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0065.312] GetLastError () returned 0x0 [0065.312] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0065.324] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0065.335] ReadFile (in: hFile=0x170, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0065.335] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0065.335] SetEndOfFile (hFile=0x200) returned 1 [0065.336] CloseHandle (hObject=0x200) returned 1 [0065.336] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0065.336] SetEndOfFile (hFile=0x170) returned 1 [0065.341] CloseHandle (hObject=0x170) returned 1 [0065.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0065.342] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0065.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.342] lstrlenW (lpString=".doc") returned 4 [0065.342] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0065.342] lstrlenW (lpString=".docx") returned 5 [0065.342] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0065.342] lstrlenW (lpString=".pdf") returned 4 [0065.342] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0065.342] lstrlenW (lpString=".xls") returned 4 [0065.342] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0065.342] lstrlenW (lpString=".xlsx") returned 5 [0065.342] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0065.342] lstrlenW (lpString=".ppt") returned 4 [0065.342] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0065.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.342] lstrlenW (lpString=".zip") returned 4 [0065.343] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0065.343] lstrlenW (lpString=".rar") returned 4 [0065.343] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0065.343] lstrlenW (lpString=".bz2") returned 4 [0065.343] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0065.343] lstrlenW (lpString=".7z") returned 3 [0065.343] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0065.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.343] lstrlenW (lpString=".dbf") returned 4 [0065.343] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0065.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.343] lstrlenW (lpString=".1cd") returned 4 [0065.343] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0065.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.343] lstrlenW (lpString=".jpg") returned 4 [0065.343] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0065.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.343] lstrlenW (lpString=".doc") returned 4 [0065.343] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0065.343] lstrlenW (lpString=".docx") returned 5 [0065.343] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0065.343] lstrlenW (lpString=".pdf") returned 4 [0065.343] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0065.343] lstrlenW (lpString=".xls") returned 4 [0065.343] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0065.343] lstrlenW (lpString=".xlsx") returned 5 [0065.343] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0065.343] lstrlenW (lpString=".ppt") returned 4 [0065.343] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0065.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.344] lstrlenW (lpString=".zip") returned 4 [0065.344] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0065.344] lstrlenW (lpString=".rar") returned 4 [0065.344] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0065.344] lstrlenW (lpString=".bz2") returned 4 [0065.344] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0065.344] lstrlenW (lpString=".7z") returned 3 [0065.344] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0065.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.344] lstrlenW (lpString=".dbf") returned 4 [0065.344] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0065.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.344] lstrlenW (lpString=".1cd") returned 4 [0065.344] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0065.344] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0065.344] lstrlenW (lpString=".jpg") returned 4 [0065.344] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0065.344] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0065.344] lstrlenW (lpString="odffilt.dll") returned 11 [0065.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.470] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1312656) returned 1 [0066.470] CloseHandle (hObject=0x198) returned 1 [0066.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0066.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0066.470] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.470] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0066.471] GetLastError () returned 0x0 [0066.471] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xffff0, lpOverlapped=0x0) returned 1 [0066.494] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0066.509] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x407a0, lpOverlapped=0x0) returned 1 [0066.527] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0066.534] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0066.534] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0066.534] SetEndOfFile (hFile=0x200) returned 1 [0066.534] CloseHandle (hObject=0x200) returned 1 [0066.534] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0066.534] SetEndOfFile (hFile=0x198) returned 1 [0066.537] CloseHandle (hObject=0x198) returned 1 [0066.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0066.537] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0066.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.538] lstrlenW (lpString=".doc") returned 4 [0066.538] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.538] lstrlenW (lpString=".docx") returned 5 [0066.538] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0066.538] lstrlenW (lpString=".pdf") returned 4 [0066.538] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.538] lstrlenW (lpString=".xls") returned 4 [0066.538] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.538] lstrlenW (lpString=".xlsx") returned 5 [0066.538] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0066.538] lstrlenW (lpString=".ppt") returned 4 [0066.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.538] lstrlenW (lpString=".zip") returned 4 [0066.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.538] lstrlenW (lpString=".rar") returned 4 [0066.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.538] lstrlenW (lpString=".bz2") returned 4 [0066.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.538] lstrlenW (lpString=".7z") returned 3 [0066.538] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.538] lstrlenW (lpString=".dbf") returned 4 [0066.538] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.538] lstrlenW (lpString=".1cd") returned 4 [0066.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.538] lstrlenW (lpString=".jpg") returned 4 [0066.538] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.539] lstrlenW (lpString=".doc") returned 4 [0066.539] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0066.539] lstrlenW (lpString=".docx") returned 5 [0066.539] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0066.539] lstrlenW (lpString=".pdf") returned 4 [0066.539] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0066.539] lstrlenW (lpString=".xls") returned 4 [0066.539] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0066.539] lstrlenW (lpString=".xlsx") returned 5 [0066.539] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0066.539] lstrlenW (lpString=".ppt") returned 4 [0066.539] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0066.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.539] lstrlenW (lpString=".zip") returned 4 [0066.539] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0066.539] lstrlenW (lpString=".rar") returned 4 [0066.539] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0066.539] lstrlenW (lpString=".bz2") returned 4 [0066.539] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0066.539] lstrlenW (lpString=".7z") returned 3 [0066.539] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0066.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.539] lstrlenW (lpString=".dbf") returned 4 [0066.539] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0066.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.539] lstrlenW (lpString=".1cd") returned 4 [0066.539] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0066.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0066.539] lstrlenW (lpString=".jpg") returned 4 [0066.539] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0066.540] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0066.540] lstrlenW (lpString="VISFILT.DLL") returned 11 [0066.540] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0066.541] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=2124664) returned 1 [0066.541] CloseHandle (hObject=0x200) returned 1 [0066.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0066.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0066.541] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0066.542] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0066.542] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0066.542] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.542] ReadFile (in: hFile=0x200, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.546] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.547] ReadFile (in: hFile=0x200, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0066.550] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0066.550] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0066.550] ReadFile (in: hFile=0x200, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0067.250] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.250] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0067.267] SetEndOfFile (hFile=0x200) returned 1 [0067.267] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f13470 [0067.271] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0067.271] WriteFile (in: hFile=0x200, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.273] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0067.273] WriteFile (in: hFile=0x200, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.275] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0067.275] WriteFile (in: hFile=0x200, lpBuffer=0x3f13470*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f13470*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0067.435] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0067.484] CloseHandle (hObject=0x200) returned 1 [0067.484] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.484] lstrlenW (lpString=".doc") returned 4 [0067.484] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.484] lstrlenW (lpString=".docx") returned 5 [0067.484] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0067.484] lstrlenW (lpString=".pdf") returned 4 [0067.484] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.484] lstrlenW (lpString=".xls") returned 4 [0067.484] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.484] lstrlenW (lpString=".xlsx") returned 5 [0067.484] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0067.484] lstrlenW (lpString=".ppt") returned 4 [0067.484] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.485] lstrlenW (lpString=".zip") returned 4 [0067.485] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.485] lstrlenW (lpString=".rar") returned 4 [0067.485] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.485] lstrlenW (lpString=".bz2") returned 4 [0067.485] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.485] lstrlenW (lpString=".7z") returned 3 [0067.485] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.485] lstrlenW (lpString=".dbf") returned 4 [0067.485] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.485] lstrlenW (lpString=".1cd") returned 4 [0067.485] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.485] lstrlenW (lpString=".jpg") returned 4 [0067.485] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.485] lstrlenW (lpString=".doc") returned 4 [0067.485] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0067.485] lstrlenW (lpString=".docx") returned 5 [0067.485] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0067.485] lstrlenW (lpString=".pdf") returned 4 [0067.485] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0067.485] lstrlenW (lpString=".xls") returned 4 [0067.485] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0067.485] lstrlenW (lpString=".xlsx") returned 5 [0067.485] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0067.485] lstrlenW (lpString=".ppt") returned 4 [0067.485] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0067.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.486] lstrlenW (lpString=".zip") returned 4 [0067.486] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0067.486] lstrlenW (lpString=".rar") returned 4 [0067.486] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0067.486] lstrlenW (lpString=".bz2") returned 4 [0067.486] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0067.486] lstrlenW (lpString=".7z") returned 3 [0067.486] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0067.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.486] lstrlenW (lpString=".dbf") returned 4 [0067.486] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0067.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.486] lstrlenW (lpString=".1cd") returned 4 [0067.486] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0067.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0067.486] lstrlenW (lpString=".jpg") returned 4 [0067.486] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0067.486] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0067.486] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0067.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.694] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=241024) returned 1 [0067.694] CloseHandle (hObject=0x220) returned 1 [0067.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0067.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.694] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.694] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.695] GetLastError () returned 0x0 [0067.695] ReadFile (in: hFile=0x220, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0067.700] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0067.704] ReadFile (in: hFile=0x220, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0067.704] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.704] SetEndOfFile (hFile=0x1f4) returned 1 [0067.704] CloseHandle (hObject=0x1f4) returned 1 [0067.704] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.704] SetEndOfFile (hFile=0x220) returned 1 [0067.706] CloseHandle (hObject=0x220) returned 1 [0067.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.707] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0067.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.707] lstrlenW (lpString=".doc") returned 4 [0067.707] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.707] lstrlenW (lpString=".docx") returned 5 [0067.707] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.707] lstrlenW (lpString=".pdf") returned 4 [0067.707] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.707] lstrlenW (lpString=".xls") returned 4 [0067.707] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.707] lstrlenW (lpString=".xlsx") returned 5 [0067.707] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.707] lstrlenW (lpString=".ppt") returned 4 [0067.707] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.707] lstrlenW (lpString=".zip") returned 4 [0067.707] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.707] lstrlenW (lpString=".rar") returned 4 [0067.707] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.707] lstrlenW (lpString=".bz2") returned 4 [0067.708] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.708] lstrlenW (lpString=".7z") returned 3 [0067.708] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.708] lstrlenW (lpString=".dbf") returned 4 [0067.708] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.708] lstrlenW (lpString=".1cd") returned 4 [0067.708] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.708] lstrlenW (lpString=".jpg") returned 4 [0067.708] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.708] lstrlenW (lpString=".doc") returned 4 [0067.708] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.708] lstrlenW (lpString=".docx") returned 5 [0067.708] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.708] lstrlenW (lpString=".pdf") returned 4 [0067.708] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.708] lstrlenW (lpString=".xls") returned 4 [0067.708] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.708] lstrlenW (lpString=".xlsx") returned 5 [0067.708] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.708] lstrlenW (lpString=".ppt") returned 4 [0067.708] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.708] lstrlenW (lpString=".zip") returned 4 [0067.708] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.708] lstrlenW (lpString=".rar") returned 4 [0067.708] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.708] lstrlenW (lpString=".bz2") returned 4 [0067.709] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.709] lstrlenW (lpString=".7z") returned 3 [0067.709] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.709] lstrlenW (lpString=".dbf") returned 4 [0067.709] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.709] lstrlenW (lpString=".1cd") returned 4 [0067.709] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.709] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0067.709] lstrlenW (lpString=".jpg") returned 4 [0067.709] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.709] lstrcmpiW (lpString1=".WPG", lpString2=".wiki") returned 1 [0067.709] lstrlenW (lpString="MS.WPG") returned 6 [0067.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.709] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1382) returned 1 [0067.710] CloseHandle (hObject=0x220) returned 1 [0067.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0067.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.710] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.710] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.710] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.710] GetLastError () returned 0x0 [0067.710] ReadFile (in: hFile=0x220, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x566, lpOverlapped=0x0) returned 1 [0067.713] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x570, lpOverlapped=0x0) returned 1 [0067.714] ReadFile (in: hFile=0x220, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0067.714] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0067.714] SetEndOfFile (hFile=0x1f4) returned 1 [0067.714] CloseHandle (hObject=0x1f4) returned 1 [0067.714] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.714] SetEndOfFile (hFile=0x220) returned 1 [0067.715] CloseHandle (hObject=0x220) returned 1 [0067.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.715] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0067.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.715] lstrlenW (lpString=".doc") returned 4 [0067.716] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0067.716] lstrlenW (lpString=".docx") returned 5 [0067.716] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0067.716] lstrlenW (lpString=".pdf") returned 4 [0067.716] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0067.716] lstrlenW (lpString=".xls") returned 4 [0067.716] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0067.716] lstrlenW (lpString=".xlsx") returned 5 [0067.716] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0067.716] lstrlenW (lpString=".ppt") returned 4 [0067.716] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0067.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.716] lstrlenW (lpString=".zip") returned 4 [0067.716] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0067.716] lstrlenW (lpString=".rar") returned 4 [0067.716] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0067.716] lstrlenW (lpString=".bz2") returned 4 [0067.716] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0067.716] lstrlenW (lpString=".7z") returned 3 [0067.716] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0067.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.716] lstrlenW (lpString=".dbf") returned 4 [0067.716] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0067.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.716] lstrlenW (lpString=".1cd") returned 4 [0067.716] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0067.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.716] lstrlenW (lpString=".jpg") returned 4 [0067.716] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0067.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.716] lstrlenW (lpString=".doc") returned 4 [0067.717] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0067.717] lstrlenW (lpString=".docx") returned 5 [0067.717] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0067.717] lstrlenW (lpString=".pdf") returned 4 [0067.717] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0067.717] lstrlenW (lpString=".xls") returned 4 [0067.717] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0067.717] lstrlenW (lpString=".xlsx") returned 5 [0067.717] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0067.717] lstrlenW (lpString=".ppt") returned 4 [0067.717] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0067.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.717] lstrlenW (lpString=".zip") returned 4 [0067.717] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0067.717] lstrlenW (lpString=".rar") returned 4 [0067.717] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0067.717] lstrlenW (lpString=".bz2") returned 4 [0067.717] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0067.717] lstrlenW (lpString=".7z") returned 3 [0067.717] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0067.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.717] lstrlenW (lpString=".dbf") returned 4 [0067.717] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0067.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.717] lstrlenW (lpString=".1cd") returned 4 [0067.717] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0067.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0067.717] lstrlenW (lpString=".jpg") returned 4 [0067.717] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0067.717] lstrcmpiW (lpString1=".FLT", lpString2=".wiki") returned -1 [0067.718] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0067.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.718] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=73080) returned 1 [0067.718] CloseHandle (hObject=0x220) returned 1 [0067.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0067.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0067.718] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.718] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.719] GetLastError () returned 0x0 [0067.719] ReadFile (in: hFile=0x220, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x11d78, lpOverlapped=0x0) returned 1 [0067.722] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0067.724] ReadFile (in: hFile=0x220, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0067.724] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0067.724] SetEndOfFile (hFile=0x1f4) returned 1 [0067.724] CloseHandle (hObject=0x1f4) returned 1 [0067.725] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0067.725] SetEndOfFile (hFile=0x220) returned 1 [0067.726] CloseHandle (hObject=0x220) returned 1 [0067.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0067.726] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0067.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.726] lstrlenW (lpString=".doc") returned 4 [0067.726] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.726] lstrlenW (lpString=".docx") returned 5 [0067.726] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.726] lstrlenW (lpString=".pdf") returned 4 [0067.726] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.726] lstrlenW (lpString=".xls") returned 4 [0067.727] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.727] lstrlenW (lpString=".xlsx") returned 5 [0067.727] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.727] lstrlenW (lpString=".ppt") returned 4 [0067.727] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.727] lstrlenW (lpString=".zip") returned 4 [0067.727] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.727] lstrlenW (lpString=".rar") returned 4 [0067.727] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.727] lstrlenW (lpString=".bz2") returned 4 [0067.727] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.727] lstrlenW (lpString=".7z") returned 3 [0067.727] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.727] lstrlenW (lpString=".dbf") returned 4 [0067.727] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.727] lstrlenW (lpString=".1cd") returned 4 [0067.727] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.932] lstrlenW (lpString=".jpg") returned 4 [0067.932] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.932] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.932] lstrlenW (lpString=".doc") returned 4 [0067.932] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0067.933] lstrlenW (lpString=".docx") returned 5 [0067.933] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0067.933] lstrlenW (lpString=".pdf") returned 4 [0067.933] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0067.933] lstrlenW (lpString=".xls") returned 4 [0067.933] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0067.933] lstrlenW (lpString=".xlsx") returned 5 [0067.933] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0067.933] lstrlenW (lpString=".ppt") returned 4 [0067.933] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0067.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.933] lstrlenW (lpString=".zip") returned 4 [0067.933] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0067.933] lstrlenW (lpString=".rar") returned 4 [0067.933] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0067.933] lstrlenW (lpString=".bz2") returned 4 [0067.933] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0067.933] lstrlenW (lpString=".7z") returned 3 [0067.933] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0067.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.933] lstrlenW (lpString=".dbf") returned 4 [0067.933] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0067.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.933] lstrlenW (lpString=".1cd") returned 4 [0067.933] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0067.933] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0067.933] lstrlenW (lpString=".jpg") returned 4 [0067.933] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0067.933] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0067.934] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0067.934] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0067.934] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1831424) returned 1 [0067.934] CloseHandle (hObject=0x1f4) returned 1 [0067.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0067.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0067.934] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0068.313] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0068.313] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0068.313] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0068.313] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.316] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0068.317] ReadFile (in: hFile=0x1f4, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.320] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0068.320] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0068.320] ReadFile (in: hFile=0x1f4, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0068.335] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0068.335] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0069.250] SetEndOfFile (hFile=0x1f4) returned 1 [0069.250] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f554a0 [0069.254] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0069.254] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.256] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0069.256] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.258] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0069.258] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0069.260] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0069.260] CloseHandle (hObject=0x1f4) returned 1 [0069.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.260] lstrlenW (lpString=".doc") returned 4 [0069.260] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.260] lstrlenW (lpString=".docx") returned 5 [0069.260] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0069.261] lstrlenW (lpString=".pdf") returned 4 [0069.261] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.261] lstrlenW (lpString=".xls") returned 4 [0069.261] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.261] lstrlenW (lpString=".xlsx") returned 5 [0069.261] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0069.261] lstrlenW (lpString=".ppt") returned 4 [0069.261] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.261] lstrlenW (lpString=".zip") returned 4 [0069.261] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.261] lstrlenW (lpString=".rar") returned 4 [0069.261] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.261] lstrlenW (lpString=".bz2") returned 4 [0069.261] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.261] lstrlenW (lpString=".7z") returned 3 [0069.261] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.261] lstrlenW (lpString=".dbf") returned 4 [0069.261] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.261] lstrlenW (lpString=".1cd") returned 4 [0069.261] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.261] lstrlenW (lpString=".jpg") returned 4 [0069.261] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.261] lstrlenW (lpString=".doc") returned 4 [0069.261] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.261] lstrlenW (lpString=".docx") returned 5 [0069.261] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0069.261] lstrlenW (lpString=".pdf") returned 4 [0069.262] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.262] lstrlenW (lpString=".xls") returned 4 [0069.262] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.262] lstrlenW (lpString=".xlsx") returned 5 [0069.262] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0069.262] lstrlenW (lpString=".ppt") returned 4 [0069.262] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.262] lstrlenW (lpString=".zip") returned 4 [0069.262] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.262] lstrlenW (lpString=".rar") returned 4 [0069.262] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.262] lstrlenW (lpString=".bz2") returned 4 [0069.262] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.262] lstrlenW (lpString=".7z") returned 3 [0069.262] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.262] lstrlenW (lpString=".dbf") returned 4 [0069.262] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.262] lstrlenW (lpString=".1cd") returned 4 [0069.262] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0069.262] lstrlenW (lpString=".jpg") returned 4 [0069.262] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.262] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0069.262] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0069.262] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0069.349] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3584) returned 1 [0069.349] CloseHandle (hObject=0x20c) returned 1 [0069.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui")) returned 0x20 [0069.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\pt-br\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.349] lstrlenW (lpString=".doc") returned 4 [0069.349] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.349] lstrlenW (lpString=".docx") returned 5 [0069.349] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.349] lstrlenW (lpString=".pdf") returned 4 [0069.349] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.349] lstrlenW (lpString=".xls") returned 4 [0069.349] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.349] lstrlenW (lpString=".xlsx") returned 5 [0069.349] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.349] lstrlenW (lpString=".ppt") returned 4 [0069.349] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.349] lstrlenW (lpString=".zip") returned 4 [0069.350] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.350] lstrlenW (lpString=".rar") returned 4 [0069.350] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.350] lstrlenW (lpString=".bz2") returned 4 [0069.350] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.350] lstrlenW (lpString=".7z") returned 3 [0069.350] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.350] lstrlenW (lpString=".dbf") returned 4 [0069.350] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.350] lstrlenW (lpString=".1cd") returned 4 [0069.350] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.350] lstrlenW (lpString=".jpg") returned 4 [0069.350] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.350] lstrlenW (lpString=".doc") returned 4 [0069.350] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0069.350] lstrlenW (lpString=".docx") returned 5 [0069.350] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0069.350] lstrlenW (lpString=".pdf") returned 4 [0069.350] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0069.350] lstrlenW (lpString=".xls") returned 4 [0069.350] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0069.350] lstrlenW (lpString=".xlsx") returned 5 [0069.350] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0069.350] lstrlenW (lpString=".ppt") returned 4 [0069.350] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0069.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.351] lstrlenW (lpString=".zip") returned 4 [0069.351] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0069.351] lstrlenW (lpString=".rar") returned 4 [0069.351] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0069.351] lstrlenW (lpString=".bz2") returned 4 [0069.351] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0069.351] lstrlenW (lpString=".7z") returned 3 [0069.351] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0069.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.351] lstrlenW (lpString=".dbf") returned 4 [0069.351] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0069.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.351] lstrlenW (lpString=".1cd") returned 4 [0069.351] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0069.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\pt-BR\\tipresx.dll.mui") returned 72 [0069.351] lstrlenW (lpString=".jpg") returned 4 [0069.351] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0069.351] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0069.351] lstrlenW (lpString="ShapeCollector.exe") returned 18 [0069.351] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0069.583] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=695296) returned 1 [0069.583] CloseHandle (hObject=0x198) returned 1 [0069.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe")) returned 0x20 [0069.583] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.583] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\shapecollector.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0069.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.583] lstrlenW (lpString=".doc") returned 4 [0069.583] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0069.583] lstrlenW (lpString=".docx") returned 5 [0069.584] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0069.584] lstrlenW (lpString=".pdf") returned 4 [0069.584] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0069.584] lstrlenW (lpString=".xls") returned 4 [0069.584] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0069.584] lstrlenW (lpString=".xlsx") returned 5 [0069.584] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0069.584] lstrlenW (lpString=".ppt") returned 4 [0069.584] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0069.584] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.584] lstrlenW (lpString=".zip") returned 4 [0069.584] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0069.584] lstrlenW (lpString=".rar") returned 4 [0069.584] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0069.584] lstrlenW (lpString=".bz2") returned 4 [0069.584] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0069.584] lstrlenW (lpString=".7z") returned 3 [0069.584] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0069.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.585] lstrlenW (lpString=".dbf") returned 4 [0069.585] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0069.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.585] lstrlenW (lpString=".1cd") returned 4 [0069.585] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0069.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.585] lstrlenW (lpString=".jpg") returned 4 [0069.585] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.585] lstrlenW (lpString=".doc") returned 4 [0069.585] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0069.585] lstrlenW (lpString=".docx") returned 5 [0069.585] lstrcmpiW (lpString1=".docx", lpString2="r.exe") returned -1 [0069.585] lstrlenW (lpString=".pdf") returned 4 [0069.585] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0069.585] lstrlenW (lpString=".xls") returned 4 [0069.585] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0069.585] lstrlenW (lpString=".xlsx") returned 5 [0069.585] lstrcmpiW (lpString1=".xlsx", lpString2="r.exe") returned -1 [0069.585] lstrlenW (lpString=".ppt") returned 4 [0069.585] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0069.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.585] lstrlenW (lpString=".zip") returned 4 [0069.585] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0069.585] lstrlenW (lpString=".rar") returned 4 [0069.585] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0069.585] lstrlenW (lpString=".bz2") returned 4 [0069.585] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0069.585] lstrlenW (lpString=".7z") returned 3 [0069.585] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0069.585] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.586] lstrlenW (lpString=".dbf") returned 4 [0069.586] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0069.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.586] lstrlenW (lpString=".1cd") returned 4 [0069.586] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0069.586] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ShapeCollector.exe") returned 69 [0069.586] lstrlenW (lpString=".jpg") returned 4 [0069.586] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0069.586] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0069.586] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0069.586] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0069.586] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=52656) returned 1 [0069.586] CloseHandle (hObject=0x198) returned 1 [0069.586] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0069.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0069.587] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.587] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0069.587] GetLastError () returned 0x0 [0069.587] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0069.590] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0069.592] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0069.592] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0069.592] SetEndOfFile (hFile=0x1e8) returned 1 [0069.592] CloseHandle (hObject=0x1e8) returned 1 [0069.592] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.592] SetEndOfFile (hFile=0x198) returned 1 [0069.593] CloseHandle (hObject=0x198) returned 1 [0069.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.594] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0069.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.594] lstrlenW (lpString=".doc") returned 4 [0069.594] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.594] lstrlenW (lpString=".docx") returned 5 [0069.594] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0069.594] lstrlenW (lpString=".pdf") returned 4 [0069.594] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.594] lstrlenW (lpString=".xls") returned 4 [0069.594] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.594] lstrlenW (lpString=".xlsx") returned 5 [0069.594] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0069.594] lstrlenW (lpString=".ppt") returned 4 [0069.594] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.594] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.594] lstrlenW (lpString=".zip") returned 4 [0069.594] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.594] lstrlenW (lpString=".rar") returned 4 [0069.594] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.594] lstrlenW (lpString=".bz2") returned 4 [0069.594] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.594] lstrlenW (lpString=".7z") returned 3 [0069.595] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.595] lstrlenW (lpString=".dbf") returned 4 [0069.595] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.595] lstrlenW (lpString=".1cd") returned 4 [0069.595] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.595] lstrlenW (lpString=".jpg") returned 4 [0069.595] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.595] lstrlenW (lpString=".doc") returned 4 [0069.595] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.595] lstrlenW (lpString=".docx") returned 5 [0069.595] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0069.595] lstrlenW (lpString=".pdf") returned 4 [0069.595] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.595] lstrlenW (lpString=".xls") returned 4 [0069.595] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.595] lstrlenW (lpString=".xlsx") returned 5 [0069.595] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0069.595] lstrlenW (lpString=".ppt") returned 4 [0069.595] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.595] lstrlenW (lpString=".zip") returned 4 [0069.595] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.595] lstrlenW (lpString=".rar") returned 4 [0069.595] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.595] lstrlenW (lpString=".bz2") returned 4 [0069.595] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.595] lstrlenW (lpString=".7z") returned 3 [0069.595] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.596] lstrlenW (lpString=".dbf") returned 4 [0069.596] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.596] lstrlenW (lpString=".1cd") returned 4 [0069.596] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0069.596] lstrlenW (lpString=".jpg") returned 4 [0069.596] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.596] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0069.596] lstrlenW (lpString="ACERECR.DLL") returned 11 [0069.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0069.596] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=20944) returned 1 [0069.596] CloseHandle (hObject=0x198) returned 1 [0069.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0069.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0069.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0069.597] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.597] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0069.597] GetLastError () returned 0x0 [0069.597] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x51d0, lpOverlapped=0x0) returned 1 [0069.990] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0069.991] ReadFile (in: hFile=0x198, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0069.991] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xea, lpOverlapped=0x0) returned 1 [0069.991] SetEndOfFile (hFile=0x1e8) returned 1 [0069.991] CloseHandle (hObject=0x1e8) returned 1 [0069.992] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0069.992] SetEndOfFile (hFile=0x198) returned 1 [0069.992] CloseHandle (hObject=0x198) returned 1 [0069.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0069.993] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0069.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.993] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.993] lstrlenW (lpString=".doc") returned 4 [0069.993] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.993] lstrlenW (lpString=".docx") returned 5 [0069.993] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0069.993] lstrlenW (lpString=".pdf") returned 4 [0069.993] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.993] lstrlenW (lpString=".xls") returned 4 [0069.993] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.993] lstrlenW (lpString=".xlsx") returned 5 [0069.993] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0069.993] lstrlenW (lpString=".ppt") returned 4 [0069.994] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.994] lstrlenW (lpString=".zip") returned 4 [0069.994] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.994] lstrlenW (lpString=".rar") returned 4 [0069.994] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.994] lstrlenW (lpString=".bz2") returned 4 [0069.994] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.994] lstrlenW (lpString=".7z") returned 3 [0069.994] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.994] lstrlenW (lpString=".dbf") returned 4 [0069.994] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.994] lstrlenW (lpString=".1cd") returned 4 [0069.994] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.994] lstrlenW (lpString=".jpg") returned 4 [0069.994] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.994] lstrlenW (lpString=".doc") returned 4 [0069.994] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0069.994] lstrlenW (lpString=".docx") returned 5 [0069.994] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0069.994] lstrlenW (lpString=".pdf") returned 4 [0069.994] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0069.994] lstrlenW (lpString=".xls") returned 4 [0069.994] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0069.994] lstrlenW (lpString=".xlsx") returned 5 [0069.994] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0069.994] lstrlenW (lpString=".ppt") returned 4 [0069.995] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0069.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.995] lstrlenW (lpString=".zip") returned 4 [0069.995] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0069.995] lstrlenW (lpString=".rar") returned 4 [0069.995] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0069.995] lstrlenW (lpString=".bz2") returned 4 [0069.995] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0069.995] lstrlenW (lpString=".7z") returned 3 [0069.995] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0069.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.995] lstrlenW (lpString=".dbf") returned 4 [0069.995] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0069.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.995] lstrlenW (lpString=".1cd") returned 4 [0069.995] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0069.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0069.995] lstrlenW (lpString=".jpg") returned 4 [0069.995] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0069.995] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0069.995] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0069.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.212] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=41864) returned 1 [0071.212] CloseHandle (hObject=0x210) returned 1 [0071.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0071.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.212] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.212] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.212] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0071.214] GetLastError () returned 0x0 [0071.214] ReadFile (in: hFile=0x210, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xa388, lpOverlapped=0x0) returned 1 [0071.216] WriteFile (in: hFile=0x21c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xa390, lpOverlapped=0x0) returned 1 [0071.217] ReadFile (in: hFile=0x210, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0071.217] WriteFile (in: hFile=0x21c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0071.217] SetEndOfFile (hFile=0x21c) returned 1 [0071.217] CloseHandle (hObject=0x21c) returned 1 [0071.217] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.217] SetEndOfFile (hFile=0x210) returned 1 [0071.218] CloseHandle (hObject=0x210) returned 1 [0071.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.219] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0071.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.219] lstrlenW (lpString=".doc") returned 4 [0071.219] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.219] lstrlenW (lpString=".docx") returned 5 [0071.219] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0071.219] lstrlenW (lpString=".pdf") returned 4 [0071.219] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.219] lstrlenW (lpString=".xls") returned 4 [0071.219] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.219] lstrlenW (lpString=".xlsx") returned 5 [0071.219] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0071.219] lstrlenW (lpString=".ppt") returned 4 [0071.219] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.219] lstrlenW (lpString=".zip") returned 4 [0071.219] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.219] lstrlenW (lpString=".rar") returned 4 [0071.220] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.220] lstrlenW (lpString=".bz2") returned 4 [0071.220] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.220] lstrlenW (lpString=".7z") returned 3 [0071.220] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.220] lstrlenW (lpString=".dbf") returned 4 [0071.220] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.220] lstrlenW (lpString=".1cd") returned 4 [0071.220] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.220] lstrlenW (lpString=".jpg") returned 4 [0071.220] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.220] lstrlenW (lpString=".doc") returned 4 [0071.220] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.220] lstrlenW (lpString=".docx") returned 5 [0071.220] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0071.220] lstrlenW (lpString=".pdf") returned 4 [0071.220] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.220] lstrlenW (lpString=".xls") returned 4 [0071.220] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.220] lstrlenW (lpString=".xlsx") returned 5 [0071.220] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0071.220] lstrlenW (lpString=".ppt") returned 4 [0071.220] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.220] lstrlenW (lpString=".zip") returned 4 [0071.220] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.220] lstrlenW (lpString=".rar") returned 4 [0071.220] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.221] lstrlenW (lpString=".bz2") returned 4 [0071.221] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.221] lstrlenW (lpString=".7z") returned 3 [0071.221] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.221] lstrlenW (lpString=".dbf") returned 4 [0071.221] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.221] lstrlenW (lpString=".1cd") returned 4 [0071.221] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0071.221] lstrlenW (lpString=".jpg") returned 4 [0071.221] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.221] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0071.221] lstrlenW (lpString="ACECORE.DLL") returned 11 [0071.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.222] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3213192) returned 1 [0071.222] CloseHandle (hObject=0x210) returned 1 [0071.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0071.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0071.222] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0071.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0071.223] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0071.223] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.223] ReadFile (in: hFile=0x210, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.226] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.226] ReadFile (in: hFile=0x210, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.231] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0071.231] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0071.231] ReadFile (in: hFile=0x210, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0071.250] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0071.250] WriteFile (in: hFile=0x210, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0071.437] SetEndOfFile (hFile=0x210) returned 1 [0071.601] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x407bd40 [0071.627] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.627] WriteFile (in: hFile=0x210, lpBuffer=0x407bd40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x407bd40*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.629] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.629] WriteFile (in: hFile=0x210, lpBuffer=0x407bd40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x407bd40*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.636] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0071.636] WriteFile (in: hFile=0x210, lpBuffer=0x407bd40*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x407bd40*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0071.642] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x407bd40 | out: hHeap=0x8d0000) returned 1 [0071.642] CloseHandle (hObject=0x210) returned 1 [0071.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0071.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.643] lstrlenW (lpString=".doc") returned 4 [0071.643] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.643] lstrlenW (lpString=".docx") returned 5 [0071.643] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0071.643] lstrlenW (lpString=".pdf") returned 4 [0071.643] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.643] lstrlenW (lpString=".xls") returned 4 [0071.643] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.643] lstrlenW (lpString=".xlsx") returned 5 [0071.643] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0071.643] lstrlenW (lpString=".ppt") returned 4 [0071.643] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.643] lstrlenW (lpString=".zip") returned 4 [0071.643] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.644] lstrlenW (lpString=".rar") returned 4 [0071.644] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.644] lstrlenW (lpString=".bz2") returned 4 [0071.644] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.644] lstrlenW (lpString=".7z") returned 3 [0071.644] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.644] lstrlenW (lpString=".dbf") returned 4 [0071.644] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.644] lstrlenW (lpString=".1cd") returned 4 [0071.644] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.644] lstrlenW (lpString=".jpg") returned 4 [0071.644] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.644] lstrlenW (lpString=".doc") returned 4 [0071.644] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0071.644] lstrlenW (lpString=".docx") returned 5 [0071.644] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0071.644] lstrlenW (lpString=".pdf") returned 4 [0071.644] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0071.644] lstrlenW (lpString=".xls") returned 4 [0071.644] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0071.644] lstrlenW (lpString=".xlsx") returned 5 [0071.644] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0071.644] lstrlenW (lpString=".ppt") returned 4 [0071.644] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0071.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.644] lstrlenW (lpString=".zip") returned 4 [0071.644] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0071.644] lstrlenW (lpString=".rar") returned 4 [0071.645] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0071.645] lstrlenW (lpString=".bz2") returned 4 [0071.645] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0071.645] lstrlenW (lpString=".7z") returned 3 [0071.645] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0071.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.645] lstrlenW (lpString=".dbf") returned 4 [0071.645] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0071.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.645] lstrlenW (lpString=".1cd") returned 4 [0071.645] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0071.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0071.645] lstrlenW (lpString=".jpg") returned 4 [0071.645] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0071.645] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0071.645] lstrlenW (lpString="ACEES.DLL") returned 9 [0071.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0072.245] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1012648) returned 1 [0072.245] CloseHandle (hObject=0x244) returned 1 [0072.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0072.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0072.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0072.246] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.246] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0072.246] GetLastError () returned 0x0 [0072.247] ReadFile (in: hFile=0x244, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0xf73a8, lpOverlapped=0x0) returned 1 [0072.265] WriteFile (in: hFile=0x240, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xf73b0, lpOverlapped=0x0) returned 1 [0072.282] ReadFile (in: hFile=0x244, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0072.282] WriteFile (in: hFile=0x240, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0072.282] SetEndOfFile (hFile=0x240) returned 1 [0072.282] CloseHandle (hObject=0x240) returned 1 [0072.282] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0072.282] SetEndOfFile (hFile=0x244) returned 1 [0073.727] CloseHandle (hObject=0x244) returned 1 [0073.736] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.765] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1 [0073.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.765] lstrlenW (lpString=".doc") returned 4 [0073.765] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.765] lstrlenW (lpString=".docx") returned 5 [0073.765] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0073.765] lstrlenW (lpString=".pdf") returned 4 [0073.765] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.765] lstrlenW (lpString=".xls") returned 4 [0073.765] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.765] lstrlenW (lpString=".xlsx") returned 5 [0073.765] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0073.765] lstrlenW (lpString=".ppt") returned 4 [0073.765] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.765] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.765] lstrlenW (lpString=".zip") returned 4 [0073.765] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.765] lstrlenW (lpString=".rar") returned 4 [0073.766] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.766] lstrlenW (lpString=".bz2") returned 4 [0073.766] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.766] lstrlenW (lpString=".7z") returned 3 [0073.766] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.766] lstrlenW (lpString=".dbf") returned 4 [0073.766] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.766] lstrlenW (lpString=".1cd") returned 4 [0073.766] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.766] lstrlenW (lpString=".jpg") returned 4 [0073.766] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.766] lstrlenW (lpString=".doc") returned 4 [0073.766] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.766] lstrlenW (lpString=".docx") returned 5 [0073.766] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0073.766] lstrlenW (lpString=".pdf") returned 4 [0073.766] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.766] lstrlenW (lpString=".xls") returned 4 [0073.766] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.766] lstrlenW (lpString=".xlsx") returned 5 [0073.766] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0073.766] lstrlenW (lpString=".ppt") returned 4 [0073.766] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.766] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.766] lstrlenW (lpString=".zip") returned 4 [0073.766] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.767] lstrlenW (lpString=".rar") returned 4 [0073.767] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.767] lstrlenW (lpString=".bz2") returned 4 [0073.767] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.767] lstrlenW (lpString=".7z") returned 3 [0073.767] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.767] lstrlenW (lpString=".dbf") returned 4 [0073.767] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.767] lstrlenW (lpString=".1cd") returned 4 [0073.767] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0073.767] lstrlenW (lpString=".jpg") returned 4 [0073.767] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.767] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0073.767] lstrlenW (lpString="ACETXT.DLL") returned 10 [0073.767] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0073.768] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=297360) returned 1 [0073.768] CloseHandle (hObject=0x244) returned 1 [0073.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0073.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0073.768] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.768] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.768] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0073.769] GetLastError () returned 0x0 [0073.769] ReadFile (in: hFile=0x244, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x48990, lpOverlapped=0x0) returned 1 [0073.775] WriteFile (in: hFile=0x234, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x489a0, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x489a0, lpOverlapped=0x0) returned 1 [0073.782] ReadFile (in: hFile=0x244, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0073.782] WriteFile (in: hFile=0x234, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0073.782] SetEndOfFile (hFile=0x234) returned 1 [0073.782] CloseHandle (hObject=0x234) returned 1 [0073.782] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0073.782] SetEndOfFile (hFile=0x244) returned 1 [0073.785] CloseHandle (hObject=0x244) returned 1 [0073.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0073.785] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1 [0073.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.786] lstrlenW (lpString=".doc") returned 4 [0073.786] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.786] lstrlenW (lpString=".docx") returned 5 [0073.786] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0073.786] lstrlenW (lpString=".pdf") returned 4 [0073.786] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.786] lstrlenW (lpString=".xls") returned 4 [0073.786] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.786] lstrlenW (lpString=".xlsx") returned 5 [0073.786] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0073.786] lstrlenW (lpString=".ppt") returned 4 [0073.786] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.786] lstrlenW (lpString=".zip") returned 4 [0073.786] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.786] lstrlenW (lpString=".rar") returned 4 [0073.786] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.786] lstrlenW (lpString=".bz2") returned 4 [0073.786] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.786] lstrlenW (lpString=".7z") returned 3 [0073.786] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.786] lstrlenW (lpString=".dbf") returned 4 [0073.786] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.787] lstrlenW (lpString=".1cd") returned 4 [0073.787] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.787] lstrlenW (lpString=".jpg") returned 4 [0073.787] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.787] lstrlenW (lpString=".doc") returned 4 [0073.787] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0073.787] lstrlenW (lpString=".docx") returned 5 [0073.787] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0073.787] lstrlenW (lpString=".pdf") returned 4 [0073.787] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0073.787] lstrlenW (lpString=".xls") returned 4 [0073.787] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0073.787] lstrlenW (lpString=".xlsx") returned 5 [0073.787] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0073.787] lstrlenW (lpString=".ppt") returned 4 [0073.787] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0073.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.787] lstrlenW (lpString=".zip") returned 4 [0073.787] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0073.787] lstrlenW (lpString=".rar") returned 4 [0073.787] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0073.787] lstrlenW (lpString=".bz2") returned 4 [0073.787] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0073.787] lstrlenW (lpString=".7z") returned 3 [0073.787] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0073.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.787] lstrlenW (lpString=".dbf") returned 4 [0073.787] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0073.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.788] lstrlenW (lpString=".1cd") returned 4 [0073.788] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0073.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0073.788] lstrlenW (lpString=".jpg") returned 4 [0073.788] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0073.788] lstrcmpiW (lpString1=".DLL", lpString2=".wiki") returned -1 [0073.788] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0073.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0073.788] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=3050912) returned 1 [0073.788] CloseHandle (hObject=0x244) returned 1 [0073.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0073.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0073.789] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0073.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0073.790] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0073.790] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.790] ReadFile (in: hFile=0x244, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.794] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.794] ReadFile (in: hFile=0x244, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0073.805] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0073.805] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0073.805] ReadFile (in: hFile=0x244, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.047] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0074.047] WriteFile (in: hFile=0x244, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0074.064] SetEndOfFile (hFile=0x244) returned 1 [0074.661] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x402bd18 [0074.666] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0074.666] WriteFile (in: hFile=0x244, lpBuffer=0x402bd18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x402bd18*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.931] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0074.931] WriteFile (in: hFile=0x244, lpBuffer=0x402bd18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x402bd18*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.936] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0074.936] WriteFile (in: hFile=0x244, lpBuffer=0x402bd18*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x402bd18*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0074.938] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0074.940] CloseHandle (hObject=0x244) returned 1 [0074.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0074.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.940] lstrlenW (lpString=".doc") returned 4 [0074.941] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.941] lstrlenW (lpString=".docx") returned 5 [0074.941] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0074.941] lstrlenW (lpString=".pdf") returned 4 [0074.941] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.941] lstrlenW (lpString=".xls") returned 4 [0074.941] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.941] lstrlenW (lpString=".xlsx") returned 5 [0074.941] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0074.941] lstrlenW (lpString=".ppt") returned 4 [0074.941] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.941] lstrlenW (lpString=".zip") returned 4 [0074.941] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.941] lstrlenW (lpString=".rar") returned 4 [0074.941] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.941] lstrlenW (lpString=".bz2") returned 4 [0074.941] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.941] lstrlenW (lpString=".7z") returned 3 [0074.941] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.941] lstrlenW (lpString=".dbf") returned 4 [0074.941] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.941] lstrlenW (lpString=".1cd") returned 4 [0074.941] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.941] lstrlenW (lpString=".jpg") returned 4 [0074.941] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.941] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.941] lstrlenW (lpString=".doc") returned 4 [0074.942] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0074.942] lstrlenW (lpString=".docx") returned 5 [0074.942] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0074.942] lstrlenW (lpString=".pdf") returned 4 [0074.942] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0074.942] lstrlenW (lpString=".xls") returned 4 [0074.942] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0074.942] lstrlenW (lpString=".xlsx") returned 5 [0074.942] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0074.942] lstrlenW (lpString=".ppt") returned 4 [0074.942] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0074.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.942] lstrlenW (lpString=".zip") returned 4 [0074.942] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0074.942] lstrlenW (lpString=".rar") returned 4 [0074.942] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0074.942] lstrlenW (lpString=".bz2") returned 4 [0074.942] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0074.942] lstrlenW (lpString=".7z") returned 3 [0074.942] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0074.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.942] lstrlenW (lpString=".dbf") returned 4 [0074.942] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0074.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.942] lstrlenW (lpString=".1cd") returned 4 [0074.942] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0074.942] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0074.942] lstrlenW (lpString=".jpg") returned 4 [0074.942] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0074.942] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0074.943] lstrlenW (lpString="CsiSoap.dll") returned 11 [0074.943] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0074.943] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=1784192) returned 1 [0074.943] CloseHandle (hObject=0x244) returned 1 [0074.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20 [0074.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0074.943] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0074.944] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0074.944] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0x0) returned 1 [0074.944] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0074.944] ReadFile (in: hFile=0x244, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.949] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0074.949] ReadFile (in: hFile=0x244, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0074.952] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32dfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0074.952] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc2c | out: lpNewFilePointer=0x0) returned 1 [0074.952] ReadFile (in: hFile=0x244, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32dfc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x32dfc38*=0x40000, lpOverlapped=0x0) returned 1 [0075.173] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.173] WriteFile (in: hFile=0x244, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32dfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0075.197] SetEndOfFile (hFile=0x244) returned 1 [0075.197] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x40000) returned 0x3f554a0 [0075.202] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0075.202] WriteFile (in: hFile=0x244, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.203] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0075.203] WriteFile (in: hFile=0x244, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.205] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x32dfc7c | out: lpNewFilePointer=0x0) returned 1 [0075.205] WriteFile (in: hFile=0x244, lpBuffer=0x3f554a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32dfc88, lpOverlapped=0x0 | out: lpBuffer=0x3f554a0*, lpNumberOfBytesWritten=0x32dfc88*=0x40000, lpOverlapped=0x0) returned 1 [0075.207] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0075.207] CloseHandle (hObject=0x244) returned 1 [0075.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0075.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.208] lstrlenW (lpString=".doc") returned 4 [0075.208] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.208] lstrlenW (lpString=".docx") returned 5 [0075.208] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0075.208] lstrlenW (lpString=".pdf") returned 4 [0075.208] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.208] lstrlenW (lpString=".xls") returned 4 [0075.208] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.208] lstrlenW (lpString=".xlsx") returned 5 [0075.208] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0075.208] lstrlenW (lpString=".ppt") returned 4 [0075.208] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.208] lstrlenW (lpString=".zip") returned 4 [0075.208] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.208] lstrlenW (lpString=".rar") returned 4 [0075.208] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.208] lstrlenW (lpString=".bz2") returned 4 [0075.208] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.208] lstrlenW (lpString=".7z") returned 3 [0075.208] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.208] lstrlenW (lpString=".dbf") returned 4 [0075.209] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.209] lstrlenW (lpString=".1cd") returned 4 [0075.209] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.209] lstrlenW (lpString=".jpg") returned 4 [0075.209] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.209] lstrlenW (lpString=".doc") returned 4 [0075.209] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0075.209] lstrlenW (lpString=".docx") returned 5 [0075.209] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0075.209] lstrlenW (lpString=".pdf") returned 4 [0075.209] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0075.209] lstrlenW (lpString=".xls") returned 4 [0075.209] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0075.209] lstrlenW (lpString=".xlsx") returned 5 [0075.209] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0075.209] lstrlenW (lpString=".ppt") returned 4 [0075.209] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0075.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.209] lstrlenW (lpString=".zip") returned 4 [0075.209] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0075.209] lstrlenW (lpString=".rar") returned 4 [0075.209] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0075.209] lstrlenW (lpString=".bz2") returned 4 [0075.209] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0075.209] lstrlenW (lpString=".7z") returned 3 [0075.209] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0075.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.209] lstrlenW (lpString=".dbf") returned 4 [0075.209] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0075.209] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.210] lstrlenW (lpString=".1cd") returned 4 [0075.210] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0075.210] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll") returned 67 [0075.210] lstrlenW (lpString=".jpg") returned 4 [0075.210] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0075.210] lstrcmpiW (lpString1=".EXE", lpString2=".wiki") returned -1 [0075.210] lstrlenW (lpString="FLTLDR.EXE") returned 10 [0075.210] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0075.335] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x32dff1c | out: lpFileSize=0x32dff1c*=157024) returned 1 [0075.347] CloseHandle (hObject=0x1f4) returned 1 [0075.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe")) returned 0x20 [0075.356] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0075.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0075.356] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.356] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32dfec8 | out: lpNewFilePointer=0x0) returned 1 [0075.356] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\FLTLDR.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\fltldr.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0075.357] GetLastError () returned 0x0 [0075.357] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x26560, lpOverlapped=0x0) returned 1 [0075.434] WriteFile (in: hFile=0x204, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x26570, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0x26570, lpOverlapped=0x0) returned 1 [0075.437] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x32dfed4*=0x0, lpOverlapped=0x0) returned 1 [0075.437] WriteFile (in: hFile=0x204, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x32dfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0075.437] SetEndOfFile (hFile=0x204) returned 1 [0076.198] CloseHandle (hObject=0x204) Thread: id = 22 os_tid = 0xac4 [0047.356] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x37e06c0 [0047.356] lstrlenW (lpString="C:") returned 2 [0047.356] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x341fd00 | out: lpFindFileData=0x341fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x9c0db0 [0047.357] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0047.357] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0047.357] lstrlenW (lpString="$Recycle.Bin") returned 12 [0047.357] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0047.357] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x37f06c8 [0047.357] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0047.357] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c0df0 [0047.357] FindNextFileW (in: hFindFile=0x9c0df0, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.358] FindNextFileW (in: hFindFile=0x9c0df0, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0047.358] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0047.358] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0047.358] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0047.358] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0047.358] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x38006d0 [0047.358] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0047.358] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c1e38 [0047.359] FindNextFileW (in: hFindFile=0x9c1e38, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.359] FindNextFileW (in: hFindFile=0x9c1e38, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0047.359] lstrlenW (lpString="desktop.ini") returned 11 [0047.359] lstrlenW (lpString=".1cd") returned 4 [0047.359] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0047.359] lstrlenW (lpString=".3ds") returned 4 [0047.359] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0047.359] lstrlenW (lpString=".3fr") returned 4 [0047.359] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0047.359] lstrlenW (lpString=".3g2") returned 4 [0047.359] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0047.359] lstrlenW (lpString=".3gp") returned 4 [0047.359] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0047.359] lstrlenW (lpString=".7z") returned 3 [0047.359] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0047.359] lstrlenW (lpString=".accda") returned 6 [0047.359] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0047.359] lstrlenW (lpString=".accdb") returned 6 [0047.359] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0047.359] lstrlenW (lpString=".accdc") returned 6 [0047.359] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0047.359] lstrlenW (lpString=".accde") returned 6 [0047.359] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0047.359] lstrlenW (lpString=".accdt") returned 6 [0047.359] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0047.359] lstrlenW (lpString=".accdw") returned 6 [0047.360] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0047.360] lstrlenW (lpString=".adb") returned 4 [0047.360] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".adp") returned 4 [0047.360] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".ai") returned 3 [0047.360] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0047.360] lstrlenW (lpString=".ai3") returned 4 [0047.360] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".ai4") returned 4 [0047.360] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".ai5") returned 4 [0047.360] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".ai6") returned 4 [0047.360] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".ai7") returned 4 [0047.360] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".ai8") returned 4 [0047.360] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".anim") returned 5 [0047.360] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0047.360] lstrlenW (lpString=".arw") returned 4 [0047.360] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".as") returned 3 [0047.360] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0047.360] lstrlenW (lpString=".asa") returned 4 [0047.360] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".asc") returned 4 [0047.360] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0047.360] lstrlenW (lpString=".ascx") returned 5 [0047.360] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0047.360] lstrlenW (lpString=".asm") returned 4 [0047.361] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".asmx") returned 5 [0047.361] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0047.361] lstrlenW (lpString=".asp") returned 4 [0047.361] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".aspx") returned 5 [0047.361] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0047.361] lstrlenW (lpString=".asr") returned 4 [0047.361] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".asx") returned 4 [0047.361] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".avi") returned 4 [0047.361] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".avs") returned 4 [0047.361] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".backup") returned 7 [0047.361] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0047.361] lstrlenW (lpString=".bak") returned 4 [0047.361] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".bay") returned 4 [0047.361] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".bd") returned 3 [0047.361] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0047.361] lstrlenW (lpString=".bin") returned 4 [0047.361] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".bmp") returned 4 [0047.361] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".bz2") returned 4 [0047.361] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0047.361] lstrlenW (lpString=".c") returned 2 [0047.361] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0047.361] lstrlenW (lpString=".cdr") returned 4 [0047.361] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".cer") returned 4 [0047.362] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".cf") returned 3 [0047.362] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0047.362] lstrlenW (lpString=".cfc") returned 4 [0047.362] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".cfm") returned 4 [0047.362] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".cfml") returned 5 [0047.362] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0047.362] lstrlenW (lpString=".cfu") returned 4 [0047.362] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".chm") returned 4 [0047.362] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".cin") returned 4 [0047.362] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".class") returned 6 [0047.362] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0047.362] lstrlenW (lpString=".clx") returned 4 [0047.362] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".config") returned 7 [0047.362] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0047.362] lstrlenW (lpString=".cpp") returned 4 [0047.362] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".cr2") returned 4 [0047.362] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".crt") returned 4 [0047.362] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".crw") returned 4 [0047.362] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0047.362] lstrlenW (lpString=".cs") returned 3 [0047.362] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0047.362] lstrlenW (lpString=".css") returned 4 [0047.363] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".csv") returned 4 [0047.363] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".cub") returned 4 [0047.363] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".dae") returned 4 [0047.363] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".dat") returned 4 [0047.363] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".db") returned 3 [0047.363] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0047.363] lstrlenW (lpString=".dbf") returned 4 [0047.363] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".dbx") returned 4 [0047.363] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".dc3") returned 4 [0047.363] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".dcm") returned 4 [0047.363] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".dcr") returned 4 [0047.363] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".der") returned 4 [0047.363] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".dib") returned 4 [0047.363] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".dic") returned 4 [0047.363] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".dif") returned 4 [0047.363] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0047.363] lstrlenW (lpString=".divx") returned 5 [0047.363] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0047.364] lstrlenW (lpString=".djvu") returned 5 [0047.364] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0047.364] lstrlenW (lpString=".dng") returned 4 [0047.364] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0047.364] lstrlenW (lpString=".doc") returned 4 [0047.364] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0047.364] lstrlenW (lpString=".docm") returned 5 [0047.364] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0047.364] lstrlenW (lpString=".docx") returned 5 [0047.364] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0047.364] lstrlenW (lpString=".dot") returned 4 [0047.364] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0047.364] lstrlenW (lpString=".dotm") returned 5 [0047.364] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0047.364] lstrlenW (lpString=".dotx") returned 5 [0047.364] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0047.364] lstrlenW (lpString=".dpx") returned 4 [0047.364] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0047.364] lstrlenW (lpString=".dqy") returned 4 [0047.364] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0047.364] lstrlenW (lpString=".dsn") returned 4 [0047.364] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0047.364] lstrlenW (lpString=".dt") returned 3 [0047.364] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0047.364] lstrlenW (lpString=".dtd") returned 4 [0047.364] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0047.364] lstrlenW (lpString=".dwg") returned 4 [0047.364] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0047.364] lstrlenW (lpString=".dwt") returned 4 [0047.364] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0047.364] lstrlenW (lpString=".dx") returned 3 [0047.364] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0047.364] lstrlenW (lpString=".dxf") returned 4 [0047.365] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".edml") returned 5 [0047.365] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0047.365] lstrlenW (lpString=".efd") returned 4 [0047.365] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".elf") returned 4 [0047.365] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".emf") returned 4 [0047.365] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".emz") returned 4 [0047.365] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".epf") returned 4 [0047.365] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".eps") returned 4 [0047.365] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".epsf") returned 5 [0047.365] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0047.365] lstrlenW (lpString=".epsp") returned 5 [0047.365] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0047.365] lstrlenW (lpString=".erf") returned 4 [0047.365] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".exr") returned 4 [0047.365] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".f4v") returned 4 [0047.365] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".fido") returned 5 [0047.365] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0047.365] lstrlenW (lpString=".flm") returned 4 [0047.365] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".flv") returned 4 [0047.365] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0047.365] lstrlenW (lpString=".frm") returned 4 [0047.365] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".fxg") returned 4 [0047.366] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".geo") returned 4 [0047.366] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".gif") returned 4 [0047.366] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".grs") returned 4 [0047.366] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".gz") returned 3 [0047.366] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0047.366] lstrlenW (lpString=".h") returned 2 [0047.366] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0047.366] lstrlenW (lpString=".hdr") returned 4 [0047.366] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".hpp") returned 4 [0047.366] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".hta") returned 4 [0047.366] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".htc") returned 4 [0047.366] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".htm") returned 4 [0047.366] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".html") returned 5 [0047.366] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0047.366] lstrlenW (lpString=".icb") returned 4 [0047.366] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".ics") returned 4 [0047.366] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".iff") returned 4 [0047.366] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".inc") returned 4 [0047.366] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0047.366] lstrlenW (lpString=".indd") returned 5 [0047.367] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0047.367] lstrlenW (lpString=".ini") returned 4 [0047.367] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0047.367] FindNextFileW (in: hFindFile=0x9c1e38, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0047.367] FindClose (in: hFindFile=0x9c1e38 | out: hFindFile=0x9c1e38) returned 1 [0047.367] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.367] FindNextFileW (in: hFindFile=0x9c0df0, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0047.367] FindClose (in: hFindFile=0x9c0df0 | out: hFindFile=0x9c0df0) returned 1 [0047.367] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x37f06c8 | out: hHeap=0x8d0000) returned 1 [0047.367] FindNextFileW (in: hFindFile=0x9c0db0, lpFindFileData=0x341fd00 | out: lpFindFileData=0x341fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0047.367] lstrlenW (lpString="C:\\Boot") returned 7 [0047.367] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0047.367] lstrlenW (lpString="Boot") returned 4 [0047.367] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0047.367] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x37f06c8 [0047.367] lstrlenW (lpString="C:\\Boot") returned 7 [0047.367] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c1df8 [0047.367] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.368] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0047.368] lstrlenW (lpString="BCD") returned 3 [0047.368] lstrlenW (lpString=".1cd") returned 4 [0047.368] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".3ds") returned 4 [0047.368] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".3fr") returned 4 [0047.368] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".3g2") returned 4 [0047.368] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".3gp") returned 4 [0047.368] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".7z") returned 3 [0047.368] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0047.368] lstrlenW (lpString=".accda") returned 6 [0047.368] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".accdb") returned 6 [0047.368] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".accdc") returned 6 [0047.368] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".accde") returned 6 [0047.368] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".accdt") returned 6 [0047.368] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".accdw") returned 6 [0047.368] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".adb") returned 4 [0047.368] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0047.368] lstrlenW (lpString=".adp") returned 4 [0047.368] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".ai") returned 3 [0047.369] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0047.369] lstrlenW (lpString=".ai3") returned 4 [0047.369] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".ai4") returned 4 [0047.369] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".ai5") returned 4 [0047.369] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".ai6") returned 4 [0047.369] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".ai7") returned 4 [0047.369] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".ai8") returned 4 [0047.369] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".anim") returned 5 [0047.369] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".arw") returned 4 [0047.369] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".as") returned 3 [0047.369] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0047.369] lstrlenW (lpString=".asa") returned 4 [0047.369] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".asc") returned 4 [0047.369] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".ascx") returned 5 [0047.369] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".asm") returned 4 [0047.369] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0047.369] lstrlenW (lpString=".asmx") returned 5 [0047.369] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".asp") returned 4 [0047.370] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".aspx") returned 5 [0047.370] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".asr") returned 4 [0047.370] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".asx") returned 4 [0047.370] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".avi") returned 4 [0047.370] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".avs") returned 4 [0047.370] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".backup") returned 7 [0047.370] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".bak") returned 4 [0047.370] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".bay") returned 4 [0047.370] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".bd") returned 3 [0047.370] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0047.370] lstrlenW (lpString=".bin") returned 4 [0047.370] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".bmp") returned 4 [0047.370] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".bz2") returned 4 [0047.370] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".c") returned 2 [0047.370] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0047.370] lstrlenW (lpString=".cdr") returned 4 [0047.370] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0047.370] lstrlenW (lpString=".cer") returned 4 [0047.371] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".cf") returned 3 [0047.371] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0047.371] lstrlenW (lpString=".cfc") returned 4 [0047.371] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".cfm") returned 4 [0047.371] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".cfml") returned 5 [0047.371] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".cfu") returned 4 [0047.371] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".chm") returned 4 [0047.371] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".cin") returned 4 [0047.371] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".class") returned 6 [0047.371] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".clx") returned 4 [0047.371] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".config") returned 7 [0047.371] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".cpp") returned 4 [0047.371] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".cr2") returned 4 [0047.371] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".crt") returned 4 [0047.371] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".crw") returned 4 [0047.371] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0047.371] lstrlenW (lpString=".cs") returned 3 [0047.371] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0047.371] lstrlenW (lpString=".css") returned 4 [0047.371] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".csv") returned 4 [0047.372] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".cub") returned 4 [0047.372] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".dae") returned 4 [0047.372] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".dat") returned 4 [0047.372] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".db") returned 3 [0047.372] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0047.372] lstrlenW (lpString=".dbf") returned 4 [0047.372] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".dbx") returned 4 [0047.372] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".dc3") returned 4 [0047.372] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".dcm") returned 4 [0047.372] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".dcr") returned 4 [0047.372] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".der") returned 4 [0047.372] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".dib") returned 4 [0047.372] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".dic") returned 4 [0047.372] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".dif") returned 4 [0047.372] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".divx") returned 5 [0047.372] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".djvu") returned 5 [0047.372] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0047.372] lstrlenW (lpString=".dng") returned 4 [0047.373] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".doc") returned 4 [0047.373] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".docm") returned 5 [0047.373] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".docx") returned 5 [0047.373] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".dot") returned 4 [0047.373] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".dotm") returned 5 [0047.373] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".dotx") returned 5 [0047.373] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".dpx") returned 4 [0047.373] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".dqy") returned 4 [0047.373] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".dsn") returned 4 [0047.373] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".dt") returned 3 [0047.373] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0047.373] lstrlenW (lpString=".dtd") returned 4 [0047.373] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".dwg") returned 4 [0047.373] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".dwt") returned 4 [0047.373] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".dx") returned 3 [0047.373] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0047.373] lstrlenW (lpString=".dxf") returned 4 [0047.373] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0047.373] lstrlenW (lpString=".edml") returned 5 [0047.373] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".efd") returned 4 [0047.374] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".elf") returned 4 [0047.374] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".emf") returned 4 [0047.374] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".emz") returned 4 [0047.374] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".epf") returned 4 [0047.374] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".eps") returned 4 [0047.374] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".epsf") returned 5 [0047.374] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".epsp") returned 5 [0047.374] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".erf") returned 4 [0047.374] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".exr") returned 4 [0047.374] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".f4v") returned 4 [0047.374] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".fido") returned 5 [0047.374] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".flm") returned 4 [0047.374] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".flv") returned 4 [0047.374] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".frm") returned 4 [0047.374] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0047.374] lstrlenW (lpString=".fxg") returned 4 [0047.374] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0047.375] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac2e8a60, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x469b3b00, ftLastWriteTime.dwHighDateTime=0x1d4d596, nFileSizeHigh=0x0, nFileSizeLow=0x5400, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD.LOG", cAlternateFileName="")) returned 1 [0047.375] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.409] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.414] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.415] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.415] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.415] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0047.415] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0047.415] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\da-DK") returned 1 [0047.415] lstrlenW (lpString="da-DK") returned 5 [0047.415] lstrcmpiW (lpString1="C:\\Windows", lpString2="da-DK") returned -1 [0047.415] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x38006d0 [0047.415] lstrlenW (lpString="C:\\Boot\\da-DK") returned 13 [0047.415] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.415] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.415] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.415] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0047.415] lstrlenW (lpString=".1cd") returned 4 [0047.415] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0047.415] lstrlenW (lpString=".3ds") returned 4 [0047.415] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0047.415] lstrlenW (lpString=".3fr") returned 4 [0047.415] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0047.415] lstrlenW (lpString=".3g2") returned 4 [0047.415] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0047.415] lstrlenW (lpString=".3gp") returned 4 [0047.415] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0047.415] lstrlenW (lpString=".7z") returned 3 [0047.416] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0047.416] lstrlenW (lpString=".accda") returned 6 [0047.416] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0047.416] lstrlenW (lpString=".accdb") returned 6 [0047.416] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0047.416] lstrlenW (lpString=".accdc") returned 6 [0047.416] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0047.416] lstrlenW (lpString=".accde") returned 6 [0047.416] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0047.416] lstrlenW (lpString=".accdt") returned 6 [0047.416] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0047.416] lstrlenW (lpString=".accdw") returned 6 [0047.416] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0047.416] lstrlenW (lpString=".adb") returned 4 [0047.416] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0047.416] lstrlenW (lpString=".adp") returned 4 [0047.416] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0047.416] lstrlenW (lpString=".ai") returned 3 [0047.416] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0047.416] lstrlenW (lpString=".ai3") returned 4 [0047.416] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".ai4") returned 4 [0047.417] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".ai5") returned 4 [0047.417] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".ai6") returned 4 [0047.417] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".ai7") returned 4 [0047.417] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".ai8") returned 4 [0047.417] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".anim") returned 5 [0047.417] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0047.417] lstrlenW (lpString=".arw") returned 4 [0047.417] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".as") returned 3 [0047.417] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0047.417] lstrlenW (lpString=".asa") returned 4 [0047.417] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".asc") returned 4 [0047.417] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".ascx") returned 5 [0047.417] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0047.417] lstrlenW (lpString=".asm") returned 4 [0047.417] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".asmx") returned 5 [0047.417] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0047.417] lstrlenW (lpString=".asp") returned 4 [0047.417] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".aspx") returned 5 [0047.417] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0047.417] lstrlenW (lpString=".asr") returned 4 [0047.417] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0047.417] lstrlenW (lpString=".asx") returned 4 [0047.417] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".avi") returned 4 [0047.418] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".avs") returned 4 [0047.418] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".backup") returned 7 [0047.418] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0047.418] lstrlenW (lpString=".bak") returned 4 [0047.418] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".bay") returned 4 [0047.418] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".bd") returned 3 [0047.418] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0047.418] lstrlenW (lpString=".bin") returned 4 [0047.418] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".bmp") returned 4 [0047.418] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".bz2") returned 4 [0047.418] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".c") returned 2 [0047.418] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0047.418] lstrlenW (lpString=".cdr") returned 4 [0047.418] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".cer") returned 4 [0047.418] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".cf") returned 3 [0047.418] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0047.418] lstrlenW (lpString=".cfc") returned 4 [0047.418] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".cfm") returned 4 [0047.418] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0047.418] lstrlenW (lpString=".cfml") returned 5 [0047.418] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0047.418] lstrlenW (lpString=".cfu") returned 4 [0047.418] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".chm") returned 4 [0047.419] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".cin") returned 4 [0047.419] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".class") returned 6 [0047.419] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0047.419] lstrlenW (lpString=".clx") returned 4 [0047.419] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".config") returned 7 [0047.419] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0047.419] lstrlenW (lpString=".cpp") returned 4 [0047.419] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".cr2") returned 4 [0047.419] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".crt") returned 4 [0047.419] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".crw") returned 4 [0047.419] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".cs") returned 3 [0047.419] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0047.419] lstrlenW (lpString=".css") returned 4 [0047.419] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".csv") returned 4 [0047.419] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".cub") returned 4 [0047.419] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".dae") returned 4 [0047.419] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".dat") returned 4 [0047.419] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0047.419] lstrlenW (lpString=".db") returned 3 [0047.419] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0047.419] lstrlenW (lpString=".dbf") returned 4 [0047.419] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".dbx") returned 4 [0047.420] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".dc3") returned 4 [0047.420] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".dcm") returned 4 [0047.420] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".dcr") returned 4 [0047.420] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".der") returned 4 [0047.420] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".dib") returned 4 [0047.420] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".dic") returned 4 [0047.420] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".dif") returned 4 [0047.420] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".divx") returned 5 [0047.420] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0047.420] lstrlenW (lpString=".djvu") returned 5 [0047.420] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0047.420] lstrlenW (lpString=".dng") returned 4 [0047.420] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".doc") returned 4 [0047.420] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".docm") returned 5 [0047.420] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0047.420] lstrlenW (lpString=".docx") returned 5 [0047.420] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0047.420] lstrlenW (lpString=".dot") returned 4 [0047.420] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0047.420] lstrlenW (lpString=".dotm") returned 5 [0047.420] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0047.420] lstrlenW (lpString=".dotx") returned 5 [0047.421] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0047.421] lstrlenW (lpString=".dpx") returned 4 [0047.421] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".dqy") returned 4 [0047.421] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".dsn") returned 4 [0047.421] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".dt") returned 3 [0047.421] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0047.421] lstrlenW (lpString=".dtd") returned 4 [0047.421] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".dwg") returned 4 [0047.421] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".dwt") returned 4 [0047.421] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".dx") returned 3 [0047.421] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0047.421] lstrlenW (lpString=".dxf") returned 4 [0047.421] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".edml") returned 5 [0047.421] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0047.421] lstrlenW (lpString=".efd") returned 4 [0047.421] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".elf") returned 4 [0047.421] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".emf") returned 4 [0047.421] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".emz") returned 4 [0047.421] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".epf") returned 4 [0047.421] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".eps") returned 4 [0047.421] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0047.421] lstrlenW (lpString=".epsf") returned 5 [0047.421] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0047.422] lstrlenW (lpString=".epsp") returned 5 [0047.422] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0047.422] lstrlenW (lpString=".erf") returned 4 [0047.422] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".exr") returned 4 [0047.422] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".f4v") returned 4 [0047.422] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".fido") returned 5 [0047.422] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0047.422] lstrlenW (lpString=".flm") returned 4 [0047.422] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".flv") returned 4 [0047.422] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".frm") returned 4 [0047.422] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".fxg") returned 4 [0047.422] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".geo") returned 4 [0047.422] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".gif") returned 4 [0047.422] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".grs") returned 4 [0047.422] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".gz") returned 3 [0047.422] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0047.422] lstrlenW (lpString=".h") returned 2 [0047.422] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0047.422] lstrlenW (lpString=".hdr") returned 4 [0047.422] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".hpp") returned 4 [0047.422] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0047.422] lstrlenW (lpString=".hta") returned 4 [0047.423] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".htc") returned 4 [0047.423] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".htm") returned 4 [0047.423] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".html") returned 5 [0047.423] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0047.423] lstrlenW (lpString=".icb") returned 4 [0047.423] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".ics") returned 4 [0047.423] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".iff") returned 4 [0047.423] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".inc") returned 4 [0047.423] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".indd") returned 5 [0047.423] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0047.423] lstrlenW (lpString=".ini") returned 4 [0047.423] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".iqy") returned 4 [0047.423] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".j2c") returned 4 [0047.423] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".j2k") returned 4 [0047.423] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".java") returned 5 [0047.423] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0047.423] lstrlenW (lpString=".jp2") returned 4 [0047.423] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".jpc") returned 4 [0047.423] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".jpe") returned 4 [0047.423] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0047.423] lstrlenW (lpString=".jpeg") returned 5 [0047.424] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0047.424] lstrlenW (lpString=".jpf") returned 4 [0047.424] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".jpg") returned 4 [0047.424] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".jpx") returned 4 [0047.424] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".js") returned 3 [0047.424] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0047.424] lstrlenW (lpString=".jsf") returned 4 [0047.424] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".json") returned 5 [0047.424] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0047.424] lstrlenW (lpString=".jsp") returned 4 [0047.424] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".kdc") returned 4 [0047.424] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".kmz") returned 4 [0047.424] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".kwm") returned 4 [0047.424] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".lasso") returned 6 [0047.424] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0047.424] lstrlenW (lpString=".lbi") returned 4 [0047.424] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".lgf") returned 4 [0047.424] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".lgp") returned 4 [0047.424] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".log") returned 4 [0047.424] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".m1v") returned 4 [0047.424] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0047.424] lstrlenW (lpString=".m4a") returned 4 [0047.425] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".m4v") returned 4 [0047.425] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".max") returned 4 [0047.425] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".md") returned 3 [0047.425] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0047.425] lstrlenW (lpString=".mda") returned 4 [0047.425] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mdb") returned 4 [0047.425] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mde") returned 4 [0047.425] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mdf") returned 4 [0047.425] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mdw") returned 4 [0047.425] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mef") returned 4 [0047.425] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mft") returned 4 [0047.425] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mfw") returned 4 [0047.425] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mht") returned 4 [0047.425] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mhtml") returned 6 [0047.425] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0047.425] lstrlenW (lpString=".mka") returned 4 [0047.425] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mkidx") returned 6 [0047.425] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0047.425] lstrlenW (lpString=".mkv") returned 4 [0047.425] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0047.425] lstrlenW (lpString=".mos") returned 4 [0047.426] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0047.426] lstrlenW (lpString=".mov") returned 4 [0047.426] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0047.426] lstrlenW (lpString=".mp3") returned 4 [0047.426] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0047.426] lstrlenW (lpString=".mp4") returned 4 [0047.426] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0047.426] lstrlenW (lpString=".mpeg") returned 5 [0047.426] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0047.426] lstrlenW (lpString=".mpg") returned 4 [0047.426] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0047.426] lstrlenW (lpString=".mpv") returned 4 [0047.426] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0047.426] lstrlenW (lpString=".mrw") returned 4 [0047.426] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0047.426] lstrlenW (lpString=".msg") returned 4 [0047.426] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0047.426] lstrlenW (lpString=".mxl") returned 4 [0047.426] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0047.426] lstrlenW (lpString=".myd") returned 4 [0047.426] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0047.426] lstrlenW (lpString=".myi") returned 4 [0047.426] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0047.426] lstrlenW (lpString=".nef") returned 4 [0047.426] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0047.426] lstrlenW (lpString=".nrw") returned 4 [0047.426] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0047.426] lstrlenW (lpString=".obj") returned 4 [0047.426] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0047.426] lstrlenW (lpString=".odb") returned 4 [0047.426] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0047.426] lstrlenW (lpString=".odc") returned 4 [0047.426] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0047.426] lstrlenW (lpString=".odm") returned 4 [0047.427] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".odp") returned 4 [0047.427] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".ods") returned 4 [0047.427] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".oft") returned 4 [0047.427] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".one") returned 4 [0047.427] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".onepkg") returned 7 [0047.427] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0047.427] lstrlenW (lpString=".onetoc2") returned 8 [0047.427] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0047.427] lstrlenW (lpString=".opt") returned 4 [0047.427] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".oqy") returned 4 [0047.427] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".orf") returned 4 [0047.427] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".p12") returned 4 [0047.427] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".p7b") returned 4 [0047.427] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".p7c") returned 4 [0047.427] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".pam") returned 4 [0047.427] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".pbm") returned 4 [0047.427] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".pct") returned 4 [0047.427] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".pcx") returned 4 [0047.427] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0047.427] lstrlenW (lpString=".pdd") returned 4 [0047.428] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0047.428] lstrlenW (lpString=".pdf") returned 4 [0047.428] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0047.428] lstrlenW (lpString=".pdp") returned 4 [0047.428] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0047.428] lstrlenW (lpString=".pef") returned 4 [0047.428] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0047.428] lstrlenW (lpString=".pem") returned 4 [0047.428] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0047.428] lstrlenW (lpString=".pff") returned 4 [0047.428] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0047.428] lstrlenW (lpString=".pfm") returned 4 [0047.428] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0047.428] lstrlenW (lpString=".pfx") returned 4 [0047.428] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0047.428] lstrlenW (lpString=".pgm") returned 4 [0047.428] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0047.428] lstrlenW (lpString=".php") returned 4 [0047.428] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0047.428] lstrlenW (lpString=".php3") returned 5 [0047.428] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0047.428] lstrlenW (lpString=".php4") returned 5 [0047.428] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0047.428] lstrlenW (lpString=".php5") returned 5 [0047.428] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0047.428] lstrlenW (lpString=".phtml") returned 6 [0047.428] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0047.428] lstrlenW (lpString=".pict") returned 5 [0047.428] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0047.428] lstrlenW (lpString=".pl") returned 3 [0047.428] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0047.428] lstrlenW (lpString=".pls") returned 4 [0047.428] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0047.429] lstrlenW (lpString=".pm") returned 3 [0047.429] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0047.429] lstrlenW (lpString=".png") returned 4 [0047.429] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0047.429] lstrlenW (lpString=".pnm") returned 4 [0047.429] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0047.429] lstrlenW (lpString=".pot") returned 4 [0047.429] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0047.429] lstrlenW (lpString=".potm") returned 5 [0047.429] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0047.429] lstrlenW (lpString=".potx") returned 5 [0047.429] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0047.429] lstrlenW (lpString=".ppa") returned 4 [0047.429] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0047.429] lstrlenW (lpString=".ppam") returned 5 [0047.429] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0047.429] lstrlenW (lpString=".ppm") returned 4 [0047.429] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0047.429] lstrlenW (lpString=".pps") returned 4 [0047.429] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0047.429] lstrlenW (lpString=".ppsm") returned 5 [0047.429] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0047.429] lstrlenW (lpString=".ppt") returned 4 [0047.429] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0047.429] lstrlenW (lpString=".pptm") returned 5 [0047.429] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0047.429] lstrlenW (lpString=".pptx") returned 5 [0047.429] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0047.429] lstrlenW (lpString=".prn") returned 4 [0047.429] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0047.429] lstrlenW (lpString=".ps") returned 3 [0047.429] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0047.429] lstrlenW (lpString=".psb") returned 4 [0047.430] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0047.430] lstrlenW (lpString=".psd") returned 4 [0047.430] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0047.430] lstrlenW (lpString=".pst") returned 4 [0047.430] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0047.430] lstrlenW (lpString=".ptx") returned 4 [0047.430] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0047.430] lstrlenW (lpString=".pub") returned 4 [0047.430] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0047.430] lstrlenW (lpString=".pwm") returned 4 [0047.430] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0047.430] lstrlenW (lpString=".pxr") returned 4 [0047.430] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0047.430] lstrlenW (lpString=".py") returned 3 [0047.430] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0047.430] lstrlenW (lpString=".qt") returned 3 [0047.430] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0047.430] lstrlenW (lpString=".r3d") returned 4 [0047.430] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0047.430] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.430] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.430] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0047.430] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.430] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.431] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.431] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.431] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.431] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0047.431] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.431] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.431] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.431] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.431] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.431] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.431] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.431] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.491] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.491] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.491] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.491] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0047.491] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.491] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.491] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.491] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.492] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.492] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0047.492] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.492] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.492] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.492] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.492] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.492] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0047.492] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.492] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.492] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0047.493] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.493] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.493] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0047.493] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.493] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.493] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.493] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.493] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.493] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0047.493] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.493] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.493] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.494] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.494] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.494] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0047.494] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.494] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.494] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.494] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.494] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.494] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0047.494] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.494] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.494] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.494] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.495] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.495] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0047.495] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.495] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.495] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.495] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.495] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.495] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0047.495] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.495] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.495] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.495] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.496] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.496] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0047.496] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.496] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.496] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.496] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.496] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.496] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0047.496] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.496] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.496] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.496] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.496] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.496] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0047.497] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.497] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.497] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.497] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.497] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.497] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0047.497] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.497] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.497] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.497] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.497] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.497] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0047.498] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.498] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.498] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.498] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.498] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.498] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0047.498] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.498] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.498] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.498] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.498] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.498] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0047.499] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.499] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.499] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.499] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.499] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.499] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0047.499] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.499] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.499] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.499] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.499] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.499] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0047.499] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.523] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.523] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.523] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.523] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.523] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0047.523] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e40 [0047.523] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.524] FindNextFileW (in: hFindFile=0x9c2e40, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.524] FindClose (in: hFindFile=0x9c2e40 | out: hFindFile=0x9c2e40) returned 1 [0047.524] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0047.524] FindNextFileW (in: hFindFile=0x9c1df8, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0047.524] FindClose (in: hFindFile=0x9c1df8 | out: hFindFile=0x9c1df8) returned 1 [0047.524] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x37f06c8 | out: hHeap=0x8d0000) returned 1 [0047.524] FindNextFileW (in: hFindFile=0x9c0db0, lpFindFileData=0x341fd00 | out: lpFindFileData=0x341fd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0047.524] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c6bb0 [0047.524] FindNextFileW (in: hFindFile=0x9c6bb0, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.525] FindNextFileW (in: hFindFile=0x9c6bb0, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0047.525] FindClose (in: hFindFile=0x9c6bb0 | out: hFindFile=0x9c6bb0) returned 1 [0047.525] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x37f06c8 | out: hHeap=0x8d0000) returned 1 [0047.525] FindNextFileW (in: hFindFile=0x9c0db0, lpFindFileData=0x341fd00 | out: lpFindFileData=0x341fd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0047.525] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="倐\x92\x16")) returned 0xffffffff [0047.525] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x37f06c8 | out: hHeap=0x8d0000) returned 1 [0047.525] FindNextFileW (in: hFindFile=0x9c0db0, lpFindFileData=0x341fd00 | out: lpFindFileData=0x341fd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x813b7be0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0047.526] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c6bb0 [0047.526] FindNextFileW (in: hFindFile=0x9c6bb0, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.526] FindNextFileW (in: hFindFile=0x9c6bb0, lpFindFileData=0x341fa84 | out: lpFindFileData=0x341fa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0047.526] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c6bf0 [0047.528] FindNextFileW (in: hFindFile=0x9c6bf0, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.529] FindNextFileW (in: hFindFile=0x9c6bf0, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0047.533] FindNextFileW (in: hFindFile=0x9c2e00, lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.533] FindNextFileW (in: hFindFile=0x9c2e00, lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0047.734] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned 1 [0047.734] lstrlenW (lpString="DW") returned 2 [0047.734] lstrcmpiW (lpString1="C:\\Windows", lpString2="DW") returned -1 [0047.734] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x38006d0 [0047.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned 49 [0047.734] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12208 [0047.735] FindNextFileW (in: hFindFile=0x3f12208, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.735] FindNextFileW (in: hFindFile=0x3f12208, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0047.735] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0047.735] lstrlenW (lpString=".1cd") returned 4 [0047.735] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0047.735] lstrlenW (lpString=".3ds") returned 4 [0047.735] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0047.735] lstrlenW (lpString=".3fr") returned 4 [0047.735] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0047.735] lstrlenW (lpString=".3g2") returned 4 [0047.735] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0047.735] lstrlenW (lpString=".3gp") returned 4 [0047.735] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0047.735] lstrlenW (lpString=".7z") returned 3 [0047.735] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0047.735] lstrlenW (lpString=".accda") returned 6 [0047.735] lstrcmpiW (lpString1=".accda", lpString2="LP.DLL") returned -1 [0047.735] lstrlenW (lpString=".accdb") returned 6 [0047.735] lstrcmpiW (lpString1=".accdb", lpString2="LP.DLL") returned -1 [0047.735] lstrlenW (lpString=".accdc") returned 6 [0047.735] lstrcmpiW (lpString1=".accdc", lpString2="LP.DLL") returned -1 [0047.735] lstrlenW (lpString=".accde") returned 6 [0047.735] lstrcmpiW (lpString1=".accde", lpString2="LP.DLL") returned -1 [0047.735] lstrlenW (lpString=".accdt") returned 6 [0047.735] lstrcmpiW (lpString1=".accdt", lpString2="LP.DLL") returned -1 [0047.736] lstrlenW (lpString=".accdw") returned 6 [0047.736] lstrcmpiW (lpString1=".accdw", lpString2="LP.DLL") returned -1 [0047.736] lstrlenW (lpString=".adb") returned 4 [0047.736] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".adp") returned 4 [0047.736] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".ai") returned 3 [0047.736] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0047.736] lstrlenW (lpString=".ai3") returned 4 [0047.736] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".ai4") returned 4 [0047.736] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".ai5") returned 4 [0047.736] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".ai6") returned 4 [0047.736] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".ai7") returned 4 [0047.736] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".ai8") returned 4 [0047.736] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".anim") returned 5 [0047.736] lstrcmpiW (lpString1=".anim", lpString2="P.DLL") returned -1 [0047.736] lstrlenW (lpString=".arw") returned 4 [0047.736] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".as") returned 3 [0047.736] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0047.736] lstrlenW (lpString=".asa") returned 4 [0047.736] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".asc") returned 4 [0047.736] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".ascx") returned 5 [0047.736] lstrcmpiW (lpString1=".ascx", lpString2="P.DLL") returned -1 [0047.736] lstrlenW (lpString=".asm") returned 4 [0047.736] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0047.736] lstrlenW (lpString=".asmx") returned 5 [0047.737] lstrcmpiW (lpString1=".asmx", lpString2="P.DLL") returned -1 [0047.737] lstrlenW (lpString=".asp") returned 4 [0047.737] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".aspx") returned 5 [0047.737] lstrcmpiW (lpString1=".aspx", lpString2="P.DLL") returned -1 [0047.737] lstrlenW (lpString=".asr") returned 4 [0047.737] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".asx") returned 4 [0047.737] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".avi") returned 4 [0047.737] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".avs") returned 4 [0047.737] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".backup") returned 7 [0047.737] lstrcmpiW (lpString1=".backup", lpString2="ELP.DLL") returned -1 [0047.737] lstrlenW (lpString=".bak") returned 4 [0047.737] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".bay") returned 4 [0047.737] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".bd") returned 3 [0047.737] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0047.737] lstrlenW (lpString=".bin") returned 4 [0047.737] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".bmp") returned 4 [0047.737] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".bz2") returned 4 [0047.737] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".c") returned 2 [0047.737] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0047.737] lstrlenW (lpString=".cdr") returned 4 [0047.737] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".cer") returned 4 [0047.737] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0047.737] lstrlenW (lpString=".cf") returned 3 [0047.737] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0047.738] lstrlenW (lpString=".cfc") returned 4 [0047.738] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".cfm") returned 4 [0047.738] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".cfml") returned 5 [0047.738] lstrcmpiW (lpString1=".cfml", lpString2="P.DLL") returned -1 [0047.738] lstrlenW (lpString=".cfu") returned 4 [0047.738] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".chm") returned 4 [0047.738] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".cin") returned 4 [0047.738] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".class") returned 6 [0047.738] lstrcmpiW (lpString1=".class", lpString2="LP.DLL") returned -1 [0047.738] lstrlenW (lpString=".clx") returned 4 [0047.738] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".config") returned 7 [0047.738] lstrcmpiW (lpString1=".config", lpString2="ELP.DLL") returned -1 [0047.738] lstrlenW (lpString=".cpp") returned 4 [0047.738] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".cr2") returned 4 [0047.738] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".crt") returned 4 [0047.738] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".crw") returned 4 [0047.738] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".cs") returned 3 [0047.738] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0047.738] lstrlenW (lpString=".css") returned 4 [0047.738] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".csv") returned 4 [0047.738] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0047.738] lstrlenW (lpString=".cub") returned 4 [0047.738] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".dae") returned 4 [0047.739] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".dat") returned 4 [0047.739] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".db") returned 3 [0047.739] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0047.739] lstrlenW (lpString=".dbf") returned 4 [0047.739] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".dbx") returned 4 [0047.739] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".dc3") returned 4 [0047.739] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".dcm") returned 4 [0047.739] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".dcr") returned 4 [0047.739] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".der") returned 4 [0047.739] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".dib") returned 4 [0047.739] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".dic") returned 4 [0047.739] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".dif") returned 4 [0047.739] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0047.739] lstrlenW (lpString=".divx") returned 5 [0047.739] lstrcmpiW (lpString1=".divx", lpString2="P.DLL") returned -1 [0047.739] lstrlenW (lpString=".djvu") returned 5 [0047.739] lstrcmpiW (lpString1=".djvu", lpString2="P.DLL") returned -1 [0047.739] lstrlenW (lpString=".dng") returned 4 [0047.739] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0047.739] lstrlenW (lpString=".doc") returned 4 [0047.739] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0047.739] lstrlenW (lpString=".docm") returned 5 [0047.740] lstrcmpiW (lpString1=".docm", lpString2="P.DLL") returned -1 [0047.740] lstrlenW (lpString=".docx") returned 5 [0047.740] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0047.740] lstrlenW (lpString=".dot") returned 4 [0047.740] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0047.740] lstrlenW (lpString=".dotm") returned 5 [0047.740] lstrcmpiW (lpString1=".dotm", lpString2="P.DLL") returned -1 [0047.740] lstrlenW (lpString=".dotx") returned 5 [0047.740] lstrcmpiW (lpString1=".dotx", lpString2="P.DLL") returned -1 [0047.740] lstrlenW (lpString=".dpx") returned 4 [0047.740] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0047.740] lstrlenW (lpString=".dqy") returned 4 [0047.740] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0047.740] lstrlenW (lpString=".dsn") returned 4 [0047.740] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0047.740] lstrlenW (lpString=".dt") returned 3 [0047.740] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0047.740] lstrlenW (lpString=".dtd") returned 4 [0047.740] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0047.740] lstrlenW (lpString=".dwg") returned 4 [0047.740] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0047.740] lstrlenW (lpString=".dwt") returned 4 [0047.740] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0047.740] lstrlenW (lpString=".dx") returned 3 [0047.740] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0047.740] lstrlenW (lpString=".dxf") returned 4 [0047.740] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0047.740] lstrlenW (lpString=".edml") returned 5 [0047.740] lstrcmpiW (lpString1=".edml", lpString2="P.DLL") returned -1 [0047.740] lstrlenW (lpString=".efd") returned 4 [0047.740] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0047.740] lstrlenW (lpString=".elf") returned 4 [0047.740] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0047.740] lstrlenW (lpString=".emf") returned 4 [0047.740] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".emz") returned 4 [0047.741] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".epf") returned 4 [0047.741] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".eps") returned 4 [0047.741] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".epsf") returned 5 [0047.741] lstrcmpiW (lpString1=".epsf", lpString2="P.DLL") returned -1 [0047.741] lstrlenW (lpString=".epsp") returned 5 [0047.741] lstrcmpiW (lpString1=".epsp", lpString2="P.DLL") returned -1 [0047.741] lstrlenW (lpString=".erf") returned 4 [0047.741] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".exr") returned 4 [0047.741] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".f4v") returned 4 [0047.741] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".fido") returned 5 [0047.741] lstrcmpiW (lpString1=".fido", lpString2="P.DLL") returned -1 [0047.741] lstrlenW (lpString=".flm") returned 4 [0047.741] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".flv") returned 4 [0047.741] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".frm") returned 4 [0047.741] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".fxg") returned 4 [0047.741] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".geo") returned 4 [0047.741] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".gif") returned 4 [0047.741] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".grs") returned 4 [0047.741] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0047.741] lstrlenW (lpString=".gz") returned 3 [0047.741] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0047.741] lstrlenW (lpString=".h") returned 2 [0047.742] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0047.742] lstrlenW (lpString=".hdr") returned 4 [0047.742] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".hpp") returned 4 [0047.742] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".hta") returned 4 [0047.742] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".htc") returned 4 [0047.742] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".htm") returned 4 [0047.742] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".html") returned 5 [0047.742] lstrcmpiW (lpString1=".html", lpString2="P.DLL") returned -1 [0047.742] lstrlenW (lpString=".icb") returned 4 [0047.742] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".ics") returned 4 [0047.742] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".iff") returned 4 [0047.742] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".inc") returned 4 [0047.742] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".indd") returned 5 [0047.742] lstrcmpiW (lpString1=".indd", lpString2="P.DLL") returned -1 [0047.742] lstrlenW (lpString=".ini") returned 4 [0047.742] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".iqy") returned 4 [0047.742] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".j2c") returned 4 [0047.742] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".j2k") returned 4 [0047.742] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0047.742] lstrlenW (lpString=".java") returned 5 [0047.742] lstrcmpiW (lpString1=".java", lpString2="P.DLL") returned -1 [0047.742] lstrlenW (lpString=".jp2") returned 4 [0047.742] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".jpc") returned 4 [0047.743] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".jpe") returned 4 [0047.743] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".jpeg") returned 5 [0047.743] lstrcmpiW (lpString1=".jpeg", lpString2="P.DLL") returned -1 [0047.743] lstrlenW (lpString=".jpf") returned 4 [0047.743] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".jpg") returned 4 [0047.743] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".jpx") returned 4 [0047.743] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".js") returned 3 [0047.743] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0047.743] lstrlenW (lpString=".jsf") returned 4 [0047.743] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".json") returned 5 [0047.743] lstrcmpiW (lpString1=".json", lpString2="P.DLL") returned -1 [0047.743] lstrlenW (lpString=".jsp") returned 4 [0047.743] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".kdc") returned 4 [0047.743] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".kmz") returned 4 [0047.743] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".kwm") returned 4 [0047.743] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".lasso") returned 6 [0047.743] lstrcmpiW (lpString1=".lasso", lpString2="LP.DLL") returned -1 [0047.743] lstrlenW (lpString=".lbi") returned 4 [0047.743] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".lgf") returned 4 [0047.743] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0047.743] lstrlenW (lpString=".lgp") returned 4 [0047.743] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0047.744] lstrlenW (lpString=".log") returned 4 [0047.744] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0047.744] lstrlenW (lpString=".m1v") returned 4 [0047.744] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0047.744] lstrlenW (lpString=".m4a") returned 4 [0047.744] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0047.744] lstrlenW (lpString=".m4v") returned 4 [0047.744] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0047.744] lstrlenW (lpString=".max") returned 4 [0047.744] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0047.744] lstrlenW (lpString=".md") returned 3 [0047.744] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0047.744] lstrlenW (lpString=".mda") returned 4 [0047.744] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0047.744] lstrlenW (lpString=".mdb") returned 4 [0047.744] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0047.744] lstrlenW (lpString=".mde") returned 4 [0047.744] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0047.744] lstrlenW (lpString=".mdf") returned 4 [0047.744] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0047.744] lstrlenW (lpString=".mdw") returned 4 [0047.745] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mef") returned 4 [0047.745] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mft") returned 4 [0047.745] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mfw") returned 4 [0047.745] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mht") returned 4 [0047.745] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mhtml") returned 6 [0047.745] lstrcmpiW (lpString1=".mhtml", lpString2="LP.DLL") returned -1 [0047.745] lstrlenW (lpString=".mka") returned 4 [0047.745] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mkidx") returned 6 [0047.745] lstrcmpiW (lpString1=".mkidx", lpString2="LP.DLL") returned -1 [0047.745] lstrlenW (lpString=".mkv") returned 4 [0047.745] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mos") returned 4 [0047.745] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mov") returned 4 [0047.745] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mp3") returned 4 [0047.745] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mp4") returned 4 [0047.745] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mpeg") returned 5 [0047.745] lstrcmpiW (lpString1=".mpeg", lpString2="P.DLL") returned -1 [0047.745] lstrlenW (lpString=".mpg") returned 4 [0047.745] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mpv") returned 4 [0047.745] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".mrw") returned 4 [0047.745] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0047.745] lstrlenW (lpString=".msg") returned 4 [0047.746] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".mxl") returned 4 [0047.746] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".myd") returned 4 [0047.746] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".myi") returned 4 [0047.746] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".nef") returned 4 [0047.746] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".nrw") returned 4 [0047.746] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".obj") returned 4 [0047.746] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".odb") returned 4 [0047.746] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".odc") returned 4 [0047.746] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".odm") returned 4 [0047.746] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".odp") returned 4 [0047.746] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".ods") returned 4 [0047.746] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".oft") returned 4 [0047.746] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".one") returned 4 [0047.746] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".onepkg") returned 7 [0047.746] lstrcmpiW (lpString1=".onepkg", lpString2="ELP.DLL") returned -1 [0047.746] lstrlenW (lpString=".onetoc2") returned 8 [0047.746] lstrcmpiW (lpString1=".onetoc2", lpString2="HELP.DLL") returned -1 [0047.746] lstrlenW (lpString=".opt") returned 4 [0047.746] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0047.746] lstrlenW (lpString=".oqy") returned 4 [0047.746] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".orf") returned 4 [0047.747] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".p12") returned 4 [0047.747] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".p7b") returned 4 [0047.747] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".p7c") returned 4 [0047.747] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pam") returned 4 [0047.747] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pbm") returned 4 [0047.747] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pct") returned 4 [0047.747] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pcx") returned 4 [0047.747] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pdd") returned 4 [0047.747] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pdf") returned 4 [0047.747] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pdp") returned 4 [0047.747] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pef") returned 4 [0047.747] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pem") returned 4 [0047.747] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pff") returned 4 [0047.747] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pfm") returned 4 [0047.747] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pfx") returned 4 [0047.747] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".pgm") returned 4 [0047.747] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0047.747] lstrlenW (lpString=".php") returned 4 [0047.748] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0047.748] lstrlenW (lpString=".php3") returned 5 [0047.748] lstrcmpiW (lpString1=".php3", lpString2="P.DLL") returned -1 [0047.748] lstrlenW (lpString=".php4") returned 5 [0047.748] lstrcmpiW (lpString1=".php4", lpString2="P.DLL") returned -1 [0047.748] lstrlenW (lpString=".php5") returned 5 [0047.748] lstrcmpiW (lpString1=".php5", lpString2="P.DLL") returned -1 [0047.748] lstrlenW (lpString=".phtml") returned 6 [0047.748] lstrcmpiW (lpString1=".phtml", lpString2="LP.DLL") returned -1 [0047.748] lstrlenW (lpString=".pict") returned 5 [0047.748] lstrcmpiW (lpString1=".pict", lpString2="P.DLL") returned -1 [0047.748] lstrlenW (lpString=".pl") returned 3 [0047.748] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0047.748] lstrlenW (lpString=".pls") returned 4 [0047.748] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0047.748] lstrlenW (lpString=".pm") returned 3 [0047.748] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0047.748] lstrlenW (lpString=".png") returned 4 [0047.748] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0047.748] lstrlenW (lpString=".pnm") returned 4 [0047.748] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0047.748] lstrlenW (lpString=".pot") returned 4 [0047.748] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0047.748] lstrlenW (lpString=".potm") returned 5 [0047.748] lstrcmpiW (lpString1=".potm", lpString2="P.DLL") returned -1 [0047.748] lstrlenW (lpString=".potx") returned 5 [0047.748] lstrcmpiW (lpString1=".potx", lpString2="P.DLL") returned -1 [0047.748] lstrlenW (lpString=".ppa") returned 4 [0047.748] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0047.748] lstrlenW (lpString=".ppam") returned 5 [0047.748] lstrcmpiW (lpString1=".ppam", lpString2="P.DLL") returned -1 [0047.748] lstrlenW (lpString=".ppm") returned 4 [0047.748] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0047.748] lstrlenW (lpString=".pps") returned 4 [0047.748] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".ppsm") returned 5 [0047.749] lstrcmpiW (lpString1=".ppsm", lpString2="P.DLL") returned -1 [0047.749] lstrlenW (lpString=".ppt") returned 4 [0047.749] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".pptm") returned 5 [0047.749] lstrcmpiW (lpString1=".pptm", lpString2="P.DLL") returned -1 [0047.749] lstrlenW (lpString=".pptx") returned 5 [0047.749] lstrcmpiW (lpString1=".pptx", lpString2="P.DLL") returned -1 [0047.749] lstrlenW (lpString=".prn") returned 4 [0047.749] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".ps") returned 3 [0047.749] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0047.749] lstrlenW (lpString=".psb") returned 4 [0047.749] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".psd") returned 4 [0047.749] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".pst") returned 4 [0047.749] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".ptx") returned 4 [0047.749] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".pub") returned 4 [0047.749] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".pwm") returned 4 [0047.749] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".pxr") returned 4 [0047.749] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".py") returned 3 [0047.749] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0047.749] lstrlenW (lpString=".qt") returned 3 [0047.749] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0047.749] lstrlenW (lpString=".r3d") returned 4 [0047.749] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0047.749] lstrlenW (lpString=".raf") returned 4 [0047.749] lstrcmpiW (lpString1=".raf", lpString2=".DLL") returned 1 [0047.750] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0048.054] FindNextFileW (in: hFindFile=0x3f12308, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7a0866, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd7c69c0, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd7c69c0, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0048.054] FindNextFileW (in: hFindFile=0x3f12308, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8fdda123, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x8fdda123, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x8fdda123, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x59d, dwReserved0=0x0, dwReserved1=0x0, cFileName="osknumpadbase.xml", cAlternateFileName="")) returned 1 [0053.031] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x992c8400, ftCreationTime.dwHighDateTime=0x1bd5de4, ftLastAccessTime.dwLowDateTime=0xbc847960, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0x992c8400, ftLastWriteTime.dwHighDateTime=0x1bd5de4, nFileSizeHigh=0x0, nFileSizeLow=0x967, dwReserved0=0x0, dwReserved1=0x0, cFileName="BD10253_.GIF", cAlternateFileName="")) returned 1 [0058.207] FindClose (in: hFindFile=0x3f12288 | out: hFindFile=0x3f12288) returned 1 [0058.207] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f00058 | out: hHeap=0x8d0000) returned 1 [0058.208] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x2c5ccd00, ftCreationTime.dwHighDateTime=0x1cacf90, ftLastAccessTime.dwLowDateTime=0x6bf1cb50, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x2c5ccd00, ftLastWriteTime.dwHighDateTime=0x1cacf90, nFileSizeHigh=0x0, nFileSizeLow=0x208560, dwReserved0=0x0, dwReserved1=0x0, cFileName="ONENOTE.EXE", cAlternateFileName="")) returned 1 [0058.208] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0058.209] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.209] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0058.211] FindClose (in: hFindFile=0x3f12288 | out: hFindFile=0x3f12288) returned 1 [0058.212] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f00058 | out: hHeap=0x8d0000) returned 1 [0058.212] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0058.212] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0058.595] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.598] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0058.607] lstrlenW (lpString="PGLBL001.XML") returned 12 [0058.609] lstrlenW (lpString=".1cd") returned 4 [0058.612] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0058.612] lstrlenW (lpString=".3ds") returned 4 [0058.612] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0058.612] lstrlenW (lpString=".3fr") returned 4 [0058.612] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0058.612] lstrlenW (lpString=".3g2") returned 4 [0058.615] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0058.615] lstrlenW (lpString=".3gp") returned 4 [0058.615] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0058.615] lstrlenW (lpString=".7z") returned 3 [0058.615] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0058.615] lstrlenW (lpString=".accda") returned 6 [0058.615] lstrcmpiW (lpString1=".accda", lpString2="01.XML") returned -1 [0058.615] lstrlenW (lpString=".accdb") returned 6 [0058.615] lstrcmpiW (lpString1=".accdb", lpString2="01.XML") returned -1 [0058.615] lstrlenW (lpString=".accdc") returned 6 [0058.615] lstrcmpiW (lpString1=".accdc", lpString2="01.XML") returned -1 [0058.615] lstrlenW (lpString=".accde") returned 6 [0058.615] lstrcmpiW (lpString1=".accde", lpString2="01.XML") returned -1 [0058.615] lstrlenW (lpString=".accdt") returned 6 [0058.615] lstrcmpiW (lpString1=".accdt", lpString2="01.XML") returned -1 [0058.615] lstrlenW (lpString=".accdw") returned 6 [0058.615] lstrcmpiW (lpString1=".accdw", lpString2="01.XML") returned -1 [0058.615] lstrlenW (lpString=".adb") returned 4 [0058.615] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0058.615] lstrlenW (lpString=".adp") returned 4 [0058.615] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0058.615] lstrlenW (lpString=".ai") returned 3 [0058.615] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0058.615] lstrlenW (lpString=".ai3") returned 4 [0058.615] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0058.615] lstrlenW (lpString=".ai4") returned 4 [0058.615] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0058.615] lstrlenW (lpString=".ai5") returned 4 [0058.615] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0058.615] lstrlenW (lpString=".ai6") returned 4 [0058.615] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0058.615] lstrlenW (lpString=".ai7") returned 4 [0058.616] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".ai8") returned 4 [0058.616] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".anim") returned 5 [0058.616] lstrcmpiW (lpString1=".anim", lpString2="1.XML") returned -1 [0058.616] lstrlenW (lpString=".arw") returned 4 [0058.616] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".as") returned 3 [0058.616] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0058.616] lstrlenW (lpString=".asa") returned 4 [0058.616] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".asc") returned 4 [0058.616] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".ascx") returned 5 [0058.616] lstrcmpiW (lpString1=".ascx", lpString2="1.XML") returned -1 [0058.616] lstrlenW (lpString=".asm") returned 4 [0058.616] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".asmx") returned 5 [0058.616] lstrcmpiW (lpString1=".asmx", lpString2="1.XML") returned -1 [0058.616] lstrlenW (lpString=".asp") returned 4 [0058.616] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".aspx") returned 5 [0058.616] lstrcmpiW (lpString1=".aspx", lpString2="1.XML") returned -1 [0058.616] lstrlenW (lpString=".asr") returned 4 [0058.616] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".asx") returned 4 [0058.616] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".avi") returned 4 [0058.616] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".avs") returned 4 [0058.616] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0058.616] lstrlenW (lpString=".backup") returned 7 [0058.616] lstrcmpiW (lpString1=".backup", lpString2="001.XML") returned -1 [0058.616] lstrlenW (lpString=".bak") returned 4 [0058.617] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0058.617] lstrlenW (lpString=".bay") returned 4 [0058.617] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0058.617] lstrlenW (lpString=".bd") returned 3 [0058.617] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0058.617] lstrlenW (lpString=".bin") returned 4 [0058.617] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0058.617] lstrlenW (lpString=".bmp") returned 4 [0058.617] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0058.617] lstrlenW (lpString=".bz2") returned 4 [0058.617] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0058.617] lstrlenW (lpString=".c") returned 2 [0058.617] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0058.617] lstrlenW (lpString=".cdr") returned 4 [0058.617] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0058.617] lstrlenW (lpString=".cer") returned 4 [0058.617] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0058.617] lstrlenW (lpString=".cf") returned 3 [0058.617] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0058.617] lstrlenW (lpString=".cfc") returned 4 [0058.617] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0058.617] lstrlenW (lpString=".cfm") returned 4 [0058.617] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0058.617] lstrlenW (lpString=".cfml") returned 5 [0058.617] lstrcmpiW (lpString1=".cfml", lpString2="1.XML") returned -1 [0058.617] lstrlenW (lpString=".cfu") returned 4 [0058.617] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0058.617] lstrlenW (lpString=".chm") returned 4 [0058.617] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".cin") returned 4 [0058.618] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".class") returned 6 [0058.618] lstrcmpiW (lpString1=".class", lpString2="01.XML") returned -1 [0058.618] lstrlenW (lpString=".clx") returned 4 [0058.618] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".config") returned 7 [0058.618] lstrcmpiW (lpString1=".config", lpString2="001.XML") returned -1 [0058.618] lstrlenW (lpString=".cpp") returned 4 [0058.618] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".cr2") returned 4 [0058.618] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".crt") returned 4 [0058.618] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".crw") returned 4 [0058.618] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".cs") returned 3 [0058.618] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0058.618] lstrlenW (lpString=".css") returned 4 [0058.618] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".csv") returned 4 [0058.618] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".cub") returned 4 [0058.618] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".dae") returned 4 [0058.618] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".dat") returned 4 [0058.618] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".db") returned 3 [0058.618] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0058.618] lstrlenW (lpString=".dbf") returned 4 [0058.618] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0058.618] lstrlenW (lpString=".dbx") returned 4 [0058.618] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".dc3") returned 4 [0058.619] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".dcm") returned 4 [0058.619] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".dcr") returned 4 [0058.619] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".der") returned 4 [0058.619] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".dib") returned 4 [0058.619] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".dic") returned 4 [0058.619] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".dif") returned 4 [0058.619] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".divx") returned 5 [0058.619] lstrcmpiW (lpString1=".divx", lpString2="1.XML") returned -1 [0058.619] lstrlenW (lpString=".djvu") returned 5 [0058.619] lstrcmpiW (lpString1=".djvu", lpString2="1.XML") returned -1 [0058.619] lstrlenW (lpString=".dng") returned 4 [0058.619] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".doc") returned 4 [0058.619] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".docm") returned 5 [0058.619] lstrcmpiW (lpString1=".docm", lpString2="1.XML") returned -1 [0058.619] lstrlenW (lpString=".docx") returned 5 [0058.619] lstrcmpiW (lpString1=".docx", lpString2="1.XML") returned -1 [0058.619] lstrlenW (lpString=".dot") returned 4 [0058.619] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".dotm") returned 5 [0058.619] lstrcmpiW (lpString1=".dotm", lpString2="1.XML") returned -1 [0058.619] lstrlenW (lpString=".dotx") returned 5 [0058.619] lstrcmpiW (lpString1=".dotx", lpString2="1.XML") returned -1 [0058.619] lstrlenW (lpString=".dpx") returned 4 [0058.619] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0058.619] lstrlenW (lpString=".dqy") returned 4 [0058.620] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".dsn") returned 4 [0058.620] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".dt") returned 3 [0058.620] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0058.620] lstrlenW (lpString=".dtd") returned 4 [0058.620] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".dwg") returned 4 [0058.620] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".dwt") returned 4 [0058.620] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".dx") returned 3 [0058.620] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0058.620] lstrlenW (lpString=".dxf") returned 4 [0058.620] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".edml") returned 5 [0058.620] lstrcmpiW (lpString1=".edml", lpString2="1.XML") returned -1 [0058.620] lstrlenW (lpString=".efd") returned 4 [0058.620] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".elf") returned 4 [0058.620] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".emf") returned 4 [0058.620] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".emz") returned 4 [0058.620] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".epf") returned 4 [0058.620] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".eps") returned 4 [0058.620] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0058.620] lstrlenW (lpString=".epsf") returned 5 [0058.620] lstrcmpiW (lpString1=".epsf", lpString2="1.XML") returned -1 [0058.620] lstrlenW (lpString=".epsp") returned 5 [0058.620] lstrcmpiW (lpString1=".epsp", lpString2="1.XML") returned -1 [0058.620] lstrlenW (lpString=".erf") returned 4 [0058.620] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".exr") returned 4 [0058.621] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".f4v") returned 4 [0058.621] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".fido") returned 5 [0058.621] lstrcmpiW (lpString1=".fido", lpString2="1.XML") returned -1 [0058.621] lstrlenW (lpString=".flm") returned 4 [0058.621] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".flv") returned 4 [0058.621] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".frm") returned 4 [0058.621] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".fxg") returned 4 [0058.621] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".geo") returned 4 [0058.621] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".gif") returned 4 [0058.621] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".grs") returned 4 [0058.621] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".gz") returned 3 [0058.621] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0058.621] lstrlenW (lpString=".h") returned 2 [0058.621] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0058.621] lstrlenW (lpString=".hdr") returned 4 [0058.621] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".hpp") returned 4 [0058.621] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".hta") returned 4 [0058.621] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".htc") returned 4 [0058.621] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".htm") returned 4 [0058.621] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0058.621] lstrlenW (lpString=".html") returned 5 [0058.622] lstrcmpiW (lpString1=".html", lpString2="1.XML") returned -1 [0058.622] lstrlenW (lpString=".icb") returned 4 [0058.622] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".ics") returned 4 [0058.622] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".iff") returned 4 [0058.622] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".inc") returned 4 [0058.622] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".indd") returned 5 [0058.622] lstrcmpiW (lpString1=".indd", lpString2="1.XML") returned -1 [0058.622] lstrlenW (lpString=".ini") returned 4 [0058.622] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".iqy") returned 4 [0058.622] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".j2c") returned 4 [0058.622] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".j2k") returned 4 [0058.622] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".java") returned 5 [0058.622] lstrcmpiW (lpString1=".java", lpString2="1.XML") returned -1 [0058.622] lstrlenW (lpString=".jp2") returned 4 [0058.622] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".jpc") returned 4 [0058.622] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".jpe") returned 4 [0058.622] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".jpeg") returned 5 [0058.622] lstrcmpiW (lpString1=".jpeg", lpString2="1.XML") returned -1 [0058.622] lstrlenW (lpString=".jpf") returned 4 [0058.622] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".jpg") returned 4 [0058.622] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0058.622] lstrlenW (lpString=".jpx") returned 4 [0058.623] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".js") returned 3 [0058.623] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0058.623] lstrlenW (lpString=".jsf") returned 4 [0058.623] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".json") returned 5 [0058.623] lstrcmpiW (lpString1=".json", lpString2="1.XML") returned -1 [0058.623] lstrlenW (lpString=".jsp") returned 4 [0058.623] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".kdc") returned 4 [0058.623] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".kmz") returned 4 [0058.623] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".kwm") returned 4 [0058.623] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".lasso") returned 6 [0058.623] lstrcmpiW (lpString1=".lasso", lpString2="01.XML") returned -1 [0058.623] lstrlenW (lpString=".lbi") returned 4 [0058.623] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".lgf") returned 4 [0058.623] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".lgp") returned 4 [0058.623] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".log") returned 4 [0058.623] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".m1v") returned 4 [0058.623] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".m4a") returned 4 [0058.623] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".m4v") returned 4 [0058.623] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".max") returned 4 [0058.623] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0058.623] lstrlenW (lpString=".md") returned 3 [0058.624] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0058.624] lstrlenW (lpString=".mda") returned 4 [0058.624] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mdb") returned 4 [0058.624] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mde") returned 4 [0058.624] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mdf") returned 4 [0058.624] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mdw") returned 4 [0058.624] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mef") returned 4 [0058.624] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mft") returned 4 [0058.624] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mfw") returned 4 [0058.624] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mht") returned 4 [0058.624] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mhtml") returned 6 [0058.624] lstrcmpiW (lpString1=".mhtml", lpString2="01.XML") returned -1 [0058.624] lstrlenW (lpString=".mka") returned 4 [0058.624] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mkidx") returned 6 [0058.624] lstrcmpiW (lpString1=".mkidx", lpString2="01.XML") returned -1 [0058.624] lstrlenW (lpString=".mkv") returned 4 [0058.624] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mos") returned 4 [0058.624] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mov") returned 4 [0058.624] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mp3") returned 4 [0058.624] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0058.624] lstrlenW (lpString=".mp4") returned 4 [0058.625] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".mpeg") returned 5 [0058.625] lstrcmpiW (lpString1=".mpeg", lpString2="1.XML") returned -1 [0058.625] lstrlenW (lpString=".mpg") returned 4 [0058.625] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".mpv") returned 4 [0058.625] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".mrw") returned 4 [0058.625] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".msg") returned 4 [0058.625] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".mxl") returned 4 [0058.625] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".myd") returned 4 [0058.625] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".myi") returned 4 [0058.625] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".nef") returned 4 [0058.625] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".nrw") returned 4 [0058.625] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".obj") returned 4 [0058.625] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".odb") returned 4 [0058.625] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".odc") returned 4 [0058.625] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".odm") returned 4 [0058.625] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".odp") returned 4 [0058.625] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".ods") returned 4 [0058.625] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0058.625] lstrlenW (lpString=".oft") returned 4 [0058.626] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".one") returned 4 [0058.626] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".onepkg") returned 7 [0058.626] lstrcmpiW (lpString1=".onepkg", lpString2="001.XML") returned -1 [0058.626] lstrlenW (lpString=".onetoc2") returned 8 [0058.626] lstrcmpiW (lpString1=".onetoc2", lpString2="L001.XML") returned -1 [0058.626] lstrlenW (lpString=".opt") returned 4 [0058.626] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".oqy") returned 4 [0058.626] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".orf") returned 4 [0058.626] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".p12") returned 4 [0058.626] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".p7b") returned 4 [0058.626] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".p7c") returned 4 [0058.626] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".pam") returned 4 [0058.626] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".pbm") returned 4 [0058.626] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".pct") returned 4 [0058.626] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".pcx") returned 4 [0058.626] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".pdd") returned 4 [0058.626] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".pdf") returned 4 [0058.626] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".pdp") returned 4 [0058.626] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0058.626] lstrlenW (lpString=".pef") returned 4 [0058.627] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0058.627] lstrlenW (lpString=".pem") returned 4 [0058.627] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0058.627] lstrlenW (lpString=".pff") returned 4 [0058.627] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0058.627] lstrlenW (lpString=".pfm") returned 4 [0058.627] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0058.627] lstrlenW (lpString=".pfx") returned 4 [0058.627] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0058.627] lstrlenW (lpString=".pgm") returned 4 [0058.627] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0058.627] lstrlenW (lpString=".php") returned 4 [0058.627] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0058.627] lstrlenW (lpString=".php3") returned 5 [0058.627] lstrcmpiW (lpString1=".php3", lpString2="1.XML") returned -1 [0058.627] lstrlenW (lpString=".php4") returned 5 [0058.627] lstrcmpiW (lpString1=".php4", lpString2="1.XML") returned -1 [0058.627] lstrlenW (lpString=".php5") returned 5 [0058.627] lstrcmpiW (lpString1=".php5", lpString2="1.XML") returned -1 [0058.627] lstrlenW (lpString=".phtml") returned 6 [0058.627] lstrcmpiW (lpString1=".phtml", lpString2="01.XML") returned -1 [0058.627] lstrlenW (lpString=".pict") returned 5 [0058.627] lstrcmpiW (lpString1=".pict", lpString2="1.XML") returned -1 [0058.627] lstrlenW (lpString=".pl") returned 3 [0058.627] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0058.627] lstrlenW (lpString=".pls") returned 4 [0058.627] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0058.627] lstrlenW (lpString=".pm") returned 3 [0058.627] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0058.627] lstrlenW (lpString=".png") returned 4 [0058.627] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0058.627] lstrlenW (lpString=".pnm") returned 4 [0058.627] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0058.627] lstrlenW (lpString=".pot") returned 4 [0058.628] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0058.628] lstrlenW (lpString=".potm") returned 5 [0058.628] lstrcmpiW (lpString1=".potm", lpString2="1.XML") returned -1 [0058.628] lstrlenW (lpString=".potx") returned 5 [0058.628] lstrcmpiW (lpString1=".potx", lpString2="1.XML") returned -1 [0058.628] lstrlenW (lpString=".ppa") returned 4 [0058.628] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0058.628] lstrlenW (lpString=".ppam") returned 5 [0058.628] lstrcmpiW (lpString1=".ppam", lpString2="1.XML") returned -1 [0058.628] lstrlenW (lpString=".ppm") returned 4 [0058.628] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0058.628] lstrlenW (lpString=".pps") returned 4 [0058.628] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0058.628] lstrlenW (lpString=".ppsm") returned 5 [0058.628] lstrcmpiW (lpString1=".ppsm", lpString2="1.XML") returned -1 [0058.628] lstrlenW (lpString=".ppt") returned 4 [0058.628] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0058.628] lstrlenW (lpString=".pptm") returned 5 [0058.628] lstrcmpiW (lpString1=".pptm", lpString2="1.XML") returned -1 [0058.628] lstrlenW (lpString=".pptx") returned 5 [0058.628] lstrcmpiW (lpString1=".pptx", lpString2="1.XML") returned -1 [0058.628] lstrlenW (lpString=".prn") returned 4 [0058.628] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0058.628] lstrlenW (lpString=".ps") returned 3 [0058.628] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0058.628] lstrlenW (lpString=".psb") returned 4 [0058.628] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0058.628] lstrlenW (lpString=".psd") returned 4 [0058.628] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0058.628] lstrlenW (lpString=".pst") returned 4 [0058.628] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0058.628] lstrlenW (lpString=".ptx") returned 4 [0058.628] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0058.628] lstrlenW (lpString=".pub") returned 4 [0058.629] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0058.629] lstrlenW (lpString=".pwm") returned 4 [0058.629] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0058.629] lstrlenW (lpString=".pxr") returned 4 [0058.629] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0058.629] lstrlenW (lpString=".py") returned 3 [0058.629] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0058.629] lstrlenW (lpString=".qt") returned 3 [0058.629] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0058.629] lstrlenW (lpString=".r3d") returned 4 [0058.629] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0058.629] lstrlenW (lpString=".raf") returned 4 [0058.629] lstrcmpiW (lpString1=".raf", lpString2=".XML") returned -1 [0058.629] lstrlenW (lpString=".rar") returned 4 [0058.629] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0058.629] lstrlenW (lpString=".raw") returned 4 [0058.629] lstrcmpiW (lpString1=".raw", lpString2=".XML") returned -1 [0067.487] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\*", lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f122c8 [0067.506] FindNextFileW (in: hFindFile=0x3f122c8, lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.506] FindNextFileW (in: hFindFile=0x3f122c8, lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1 [0067.507] FindClose (in: hFindFile=0x3f122c8 | out: hFindFile=0x3f122c8) returned 1 [0067.507] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x37f06c8 | out: hHeap=0x8d0000) returned 1 [0067.507] FindNextFileW (in: hFindFile=0x3f12388, lpFindFileData=0x341f808 | out: lpFindFileData=0x341f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Gadgets", cAlternateFileName="")) returned 1 [0067.507] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\*", lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f122c8 [0067.508] FindNextFileW (in: hFindFile=0x3f122c8, lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8012b5d2, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8012b5d2, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.508] FindNextFileW (in: hFindFile=0x3f122c8, lpFindFileData=0x341f58c | out: lpFindFileData=0x341f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calendar.Gadget", cAlternateFileName="CALEND~1.GAD")) returned 1 [0067.509] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\*", lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12108 [0067.556] FindNextFileW (in: hFindFile=0x3f12108, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1ea8d4f6, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.556] FindNextFileW (in: hFindFile=0x3f12108, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb90bdeb0, ftCreationTime.dwHighDateTime=0x1ca0404, ftLastAccessTime.dwLowDateTime=0xb90bdeb0, ftLastAccessTime.dwHighDateTime=0x1ca0404, ftLastWriteTime.dwLowDateTime=0xb371d95c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x1a74, dwReserved0=0x0, dwReserved1=0x0, cFileName="drag.png", cAlternateFileName="")) returned 1 [0067.557] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\*", lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f123c8 [0067.557] FindNextFileW (in: hFindFile=0x3f123c8, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a11cd0, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.558] FindNextFileW (in: hFindFile=0x3f123c8, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x4a9e, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.html", cAlternateFileName="")) returned 1 [0067.558] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\css\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12188 [0067.558] FindNextFileW (in: hFindFile=0x3f12188, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.559] FindNextFileW (in: hFindFile=0x3f12188, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x12f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.css", cAlternateFileName="")) returned 1 [0067.559] FindClose (in: hFindFile=0x3f12188 | out: hFindFile=0x3f12188) returned 1 [0067.559] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0067.559] FindNextFileW (in: hFindFile=0x3f123c8, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x3f2, dwReserved0=0x0, dwReserved1=0x0, cFileName="gadget.xml", cAlternateFileName="")) returned 1 [0067.559] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\en-US\\js\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12188 [0067.559] FindNextFileW (in: hFindFile=0x3f12188, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.559] FindNextFileW (in: hFindFile=0x3f12188, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x119103a1, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x119103a1, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xff08, dwReserved0=0x0, dwReserved1=0x0, cFileName="calendar.js", cAlternateFileName="")) returned 1 [0067.559] FindClose (in: hFindFile=0x3f12188 | out: hFindFile=0x3f12188) returned 1 [0067.560] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0067.560] FindNextFileW (in: hFindFile=0x3f123c8, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1ea8d4f6, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x22a37f89, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1ea8d4f6, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="js", cAlternateFileName="")) returned 0 [0067.560] FindClose (in: hFindFile=0x3f123c8 | out: hFindFile=0x3f123c8) returned 1 [0067.560] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38206e0 | out: hHeap=0x8d0000) returned 1 [0067.560] FindNextFileW (in: hFindFile=0x3f12108, lpFindFileData=0x341f310 | out: lpFindFileData=0x341f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3743abc, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb3743abc, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb3769c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0xd13, dwReserved0=0x0, dwReserved1=0x0, cFileName="icon.png", cAlternateFileName="")) returned 1 [0067.560] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\Gadgets\\Calendar.Gadget\\images\\*", lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f123c8 [0067.561] FindNextFileW (in: hFindFile=0x3f123c8, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x8191f35e, ftLastAccessTime.dwHighDateTime=0x1ca0444, ftLastWriteTime.dwLowDateTime=0x8191f35e, ftLastWriteTime.dwHighDateTime=0x1ca0444, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.561] FindNextFileW (in: hFindFile=0x3f123c8, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb3769c1c, ftCreationTime.dwHighDateTime=0x1c9ea13, ftLastAccessTime.dwLowDateTime=0xb3769c1c, ftLastAccessTime.dwHighDateTime=0x1c9ea13, ftLastWriteTime.dwLowDateTime=0xb3769c1c, ftLastWriteTime.dwHighDateTime=0x1c9ea13, nFileSizeHigh=0x0, nFileSizeLow=0x6a6, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg-desk.png", cAlternateFileName="")) returned 1 [0068.131] FindClose (in: hFindFile=0x3f12188 | out: hFindFile=0x3f12188) returned 1 [0068.131] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0068.312] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x8b186991, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x8b186991, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8b186991, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x548, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows Anytime Upgrade.lnk", cAlternateFileName="WINDOW~3.LNK")) returned 1 [0070.262] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.265] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.267] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0070.276] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.284] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.284] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.292] lstrlenW (lpString="messages.json") returned 13 [0070.296] lstrlenW (lpString=".1cd") returned 4 [0070.296] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0070.296] lstrlenW (lpString=".3ds") returned 4 [0070.296] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0070.296] lstrlenW (lpString=".3fr") returned 4 [0070.296] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0070.296] lstrlenW (lpString=".3g2") returned 4 [0070.296] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0070.296] lstrlenW (lpString=".3gp") returned 4 [0070.296] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0070.296] lstrlenW (lpString=".7z") returned 3 [0070.296] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0070.296] lstrlenW (lpString=".accda") returned 6 [0070.296] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0070.296] lstrlenW (lpString=".accdb") returned 6 [0070.296] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0070.296] lstrlenW (lpString=".accdc") returned 6 [0070.296] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0070.296] lstrlenW (lpString=".accde") returned 6 [0070.296] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0070.296] lstrlenW (lpString=".accdt") returned 6 [0070.296] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0070.296] lstrlenW (lpString=".accdw") returned 6 [0070.296] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0070.296] lstrlenW (lpString=".adb") returned 4 [0070.297] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".adp") returned 4 [0070.297] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".ai") returned 3 [0070.297] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0070.297] lstrlenW (lpString=".ai3") returned 4 [0070.297] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".ai4") returned 4 [0070.297] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".ai5") returned 4 [0070.297] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".ai6") returned 4 [0070.297] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".ai7") returned 4 [0070.297] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".ai8") returned 4 [0070.297] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".anim") returned 5 [0070.297] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0070.297] lstrlenW (lpString=".arw") returned 4 [0070.297] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".as") returned 3 [0070.297] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0070.297] lstrlenW (lpString=".asa") returned 4 [0070.297] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".asc") returned 4 [0070.297] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".ascx") returned 5 [0070.297] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0070.297] lstrlenW (lpString=".asm") returned 4 [0070.297] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0070.297] lstrlenW (lpString=".asmx") returned 5 [0070.297] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0070.297] lstrlenW (lpString=".asp") returned 4 [0070.297] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".aspx") returned 5 [0070.298] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0070.298] lstrlenW (lpString=".asr") returned 4 [0070.298] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".asx") returned 4 [0070.298] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".avi") returned 4 [0070.298] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".avs") returned 4 [0070.298] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".backup") returned 7 [0070.298] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0070.298] lstrlenW (lpString=".bak") returned 4 [0070.298] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".bay") returned 4 [0070.298] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".bd") returned 3 [0070.298] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0070.298] lstrlenW (lpString=".bin") returned 4 [0070.298] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".bmp") returned 4 [0070.298] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".bz2") returned 4 [0070.298] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".c") returned 2 [0070.298] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0070.298] lstrlenW (lpString=".cdr") returned 4 [0070.298] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".cer") returned 4 [0070.298] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0070.298] lstrlenW (lpString=".cf") returned 3 [0070.298] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0070.298] lstrlenW (lpString=".cfc") returned 4 [0070.298] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".cfm") returned 4 [0070.299] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".cfml") returned 5 [0070.299] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0070.299] lstrlenW (lpString=".cfu") returned 4 [0070.299] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".chm") returned 4 [0070.299] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".cin") returned 4 [0070.299] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".class") returned 6 [0070.299] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0070.299] lstrlenW (lpString=".clx") returned 4 [0070.299] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".config") returned 7 [0070.299] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0070.299] lstrlenW (lpString=".cpp") returned 4 [0070.299] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".cr2") returned 4 [0070.299] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".crt") returned 4 [0070.299] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".crw") returned 4 [0070.299] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".cs") returned 3 [0070.299] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0070.299] lstrlenW (lpString=".css") returned 4 [0070.299] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".csv") returned 4 [0070.299] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".cub") returned 4 [0070.299] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0070.299] lstrlenW (lpString=".dae") returned 4 [0070.299] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".dat") returned 4 [0070.300] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".db") returned 3 [0070.300] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0070.300] lstrlenW (lpString=".dbf") returned 4 [0070.300] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".dbx") returned 4 [0070.300] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".dc3") returned 4 [0070.300] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".dcm") returned 4 [0070.300] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".dcr") returned 4 [0070.300] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".der") returned 4 [0070.300] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".dib") returned 4 [0070.300] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".dic") returned 4 [0070.300] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".dif") returned 4 [0070.300] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".divx") returned 5 [0070.300] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0070.300] lstrlenW (lpString=".djvu") returned 5 [0070.300] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0070.300] lstrlenW (lpString=".dng") returned 4 [0070.300] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".doc") returned 4 [0070.300] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0070.300] lstrlenW (lpString=".docm") returned 5 [0070.300] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0070.300] lstrlenW (lpString=".docx") returned 5 [0070.300] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0070.300] lstrlenW (lpString=".dot") returned 4 [0070.301] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0070.301] lstrlenW (lpString=".dotm") returned 5 [0070.301] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0070.301] lstrlenW (lpString=".dotx") returned 5 [0070.301] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0070.301] lstrlenW (lpString=".dpx") returned 4 [0070.301] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0070.301] lstrlenW (lpString=".dqy") returned 4 [0070.301] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0070.301] lstrlenW (lpString=".dsn") returned 4 [0070.301] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0070.301] lstrlenW (lpString=".dt") returned 3 [0070.301] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0070.301] lstrlenW (lpString=".dtd") returned 4 [0070.301] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0070.301] lstrlenW (lpString=".dwg") returned 4 [0070.301] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0070.301] lstrlenW (lpString=".dwt") returned 4 [0070.301] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0070.301] lstrlenW (lpString=".dx") returned 3 [0070.301] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0070.301] lstrlenW (lpString=".dxf") returned 4 [0070.301] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0070.301] lstrlenW (lpString=".edml") returned 5 [0070.301] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0070.301] lstrlenW (lpString=".efd") returned 4 [0070.301] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0070.301] lstrlenW (lpString=".elf") returned 4 [0070.301] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".emf") returned 4 [0070.302] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".emz") returned 4 [0070.302] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".epf") returned 4 [0070.302] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".eps") returned 4 [0070.302] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".epsf") returned 5 [0070.302] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0070.302] lstrlenW (lpString=".epsp") returned 5 [0070.302] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0070.302] lstrlenW (lpString=".erf") returned 4 [0070.302] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".exr") returned 4 [0070.302] lstrcmpiW (lpString1=".exr", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".f4v") returned 4 [0070.302] lstrcmpiW (lpString1=".f4v", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".fido") returned 5 [0070.302] lstrcmpiW (lpString1=".fido", lpString2=".json") returned -1 [0070.302] lstrlenW (lpString=".flm") returned 4 [0070.302] lstrcmpiW (lpString1=".flm", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".flv") returned 4 [0070.302] lstrcmpiW (lpString1=".flv", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".frm") returned 4 [0070.302] lstrcmpiW (lpString1=".frm", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".fxg") returned 4 [0070.302] lstrcmpiW (lpString1=".fxg", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".geo") returned 4 [0070.302] lstrcmpiW (lpString1=".geo", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".gif") returned 4 [0070.302] lstrcmpiW (lpString1=".gif", lpString2="json") returned -1 [0070.302] lstrlenW (lpString=".grs") returned 4 [0070.303] lstrcmpiW (lpString1=".grs", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".gz") returned 3 [0070.303] lstrcmpiW (lpString1=".gz", lpString2="son") returned -1 [0070.303] lstrlenW (lpString=".h") returned 2 [0070.303] lstrcmpiW (lpString1=".h", lpString2="on") returned -1 [0070.303] lstrlenW (lpString=".hdr") returned 4 [0070.303] lstrcmpiW (lpString1=".hdr", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".hpp") returned 4 [0070.303] lstrcmpiW (lpString1=".hpp", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".hta") returned 4 [0070.303] lstrcmpiW (lpString1=".hta", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".htc") returned 4 [0070.303] lstrcmpiW (lpString1=".htc", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".htm") returned 4 [0070.303] lstrcmpiW (lpString1=".htm", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".html") returned 5 [0070.303] lstrcmpiW (lpString1=".html", lpString2=".json") returned -1 [0070.303] lstrlenW (lpString=".icb") returned 4 [0070.303] lstrcmpiW (lpString1=".icb", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".ics") returned 4 [0070.303] lstrcmpiW (lpString1=".ics", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".iff") returned 4 [0070.303] lstrcmpiW (lpString1=".iff", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".inc") returned 4 [0070.303] lstrcmpiW (lpString1=".inc", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".indd") returned 5 [0070.303] lstrcmpiW (lpString1=".indd", lpString2=".json") returned -1 [0070.303] lstrlenW (lpString=".ini") returned 4 [0070.303] lstrcmpiW (lpString1=".ini", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".iqy") returned 4 [0070.303] lstrcmpiW (lpString1=".iqy", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".j2c") returned 4 [0070.303] lstrcmpiW (lpString1=".j2c", lpString2="json") returned -1 [0070.303] lstrlenW (lpString=".j2k") returned 4 [0070.303] lstrcmpiW (lpString1=".j2k", lpString2="json") returned -1 [0070.304] lstrlenW (lpString=".java") returned 5 [0070.304] lstrcmpiW (lpString1=".java", lpString2=".json") returned -1 [0070.304] lstrlenW (lpString=".jp2") returned 4 [0070.304] lstrcmpiW (lpString1=".jp2", lpString2="json") returned -1 [0070.304] lstrlenW (lpString=".jpc") returned 4 [0070.304] lstrcmpiW (lpString1=".jpc", lpString2="json") returned -1 [0070.304] lstrlenW (lpString=".jpe") returned 4 [0070.304] lstrcmpiW (lpString1=".jpe", lpString2="json") returned -1 [0070.304] lstrlenW (lpString=".jpeg") returned 5 [0070.304] lstrcmpiW (lpString1=".jpeg", lpString2=".json") returned -1 [0070.304] lstrlenW (lpString=".jpf") returned 4 [0070.304] lstrcmpiW (lpString1=".jpf", lpString2="json") returned -1 [0070.304] lstrlenW (lpString=".jpg") returned 4 [0070.304] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0070.304] lstrlenW (lpString=".jpx") returned 4 [0070.304] lstrcmpiW (lpString1=".jpx", lpString2="json") returned -1 [0070.304] lstrlenW (lpString=".js") returned 3 [0070.304] lstrcmpiW (lpString1=".js", lpString2="son") returned -1 [0070.304] lstrlenW (lpString=".jsf") returned 4 [0070.304] lstrcmpiW (lpString1=".jsf", lpString2="json") returned -1 [0070.304] lstrlenW (lpString=".json") returned 5 [0070.304] lstrcmpiW (lpString1=".json", lpString2=".json") returned 0 [0070.304] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0070.304] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.304] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.304] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0070.304] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419") returned 141 [0070.304] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419") returned 1 [0070.305] lstrlenW (lpString="es_419") returned 6 [0070.305] lstrcmpiW (lpString1="C:\\Windows", lpString2="es_419") returned -1 [0070.305] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x406bd38 [0070.305] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419") returned 141 [0070.305] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.305] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.305] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.305] lstrlenW (lpString="messages.json") returned 13 [0070.305] lstrlenW (lpString=".1cd") returned 4 [0070.305] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0070.305] lstrlenW (lpString=".3ds") returned 4 [0070.305] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0070.305] lstrlenW (lpString=".3fr") returned 4 [0070.305] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0070.305] lstrlenW (lpString=".3g2") returned 4 [0070.305] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0070.305] lstrlenW (lpString=".3gp") returned 4 [0070.305] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0070.305] lstrlenW (lpString=".7z") returned 3 [0070.305] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0070.305] lstrlenW (lpString=".accda") returned 6 [0070.305] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0070.305] lstrlenW (lpString=".accdb") returned 6 [0070.305] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0070.305] lstrlenW (lpString=".accdc") returned 6 [0070.305] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0070.305] lstrlenW (lpString=".accde") returned 6 [0070.305] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0070.306] lstrlenW (lpString=".accdt") returned 6 [0070.306] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0070.306] lstrlenW (lpString=".accdw") returned 6 [0070.306] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0070.306] lstrlenW (lpString=".adb") returned 4 [0070.306] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".adp") returned 4 [0070.306] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".ai") returned 3 [0070.306] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0070.306] lstrlenW (lpString=".ai3") returned 4 [0070.306] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".ai4") returned 4 [0070.306] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".ai5") returned 4 [0070.306] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".ai6") returned 4 [0070.306] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".ai7") returned 4 [0070.306] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".ai8") returned 4 [0070.306] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".anim") returned 5 [0070.306] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0070.306] lstrlenW (lpString=".arw") returned 4 [0070.306] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".as") returned 3 [0070.306] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0070.306] lstrlenW (lpString=".asa") returned 4 [0070.306] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".asc") returned 4 [0070.306] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0070.306] lstrlenW (lpString=".ascx") returned 5 [0070.307] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0070.307] lstrlenW (lpString=".asm") returned 4 [0070.307] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".asmx") returned 5 [0070.307] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0070.307] lstrlenW (lpString=".asp") returned 4 [0070.307] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".aspx") returned 5 [0070.307] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0070.307] lstrlenW (lpString=".asr") returned 4 [0070.307] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".asx") returned 4 [0070.307] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".avi") returned 4 [0070.307] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".avs") returned 4 [0070.307] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".backup") returned 7 [0070.307] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0070.307] lstrlenW (lpString=".bak") returned 4 [0070.307] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".bay") returned 4 [0070.307] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".bd") returned 3 [0070.307] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0070.307] lstrlenW (lpString=".bin") returned 4 [0070.307] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".bmp") returned 4 [0070.307] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".bz2") returned 4 [0070.307] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0070.307] lstrlenW (lpString=".c") returned 2 [0070.307] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0070.307] lstrlenW (lpString=".cdr") returned 4 [0070.308] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".cer") returned 4 [0070.308] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".cf") returned 3 [0070.308] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0070.308] lstrlenW (lpString=".cfc") returned 4 [0070.308] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".cfm") returned 4 [0070.308] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".cfml") returned 5 [0070.308] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0070.308] lstrlenW (lpString=".cfu") returned 4 [0070.308] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".chm") returned 4 [0070.308] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".cin") returned 4 [0070.308] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".class") returned 6 [0070.308] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0070.308] lstrlenW (lpString=".clx") returned 4 [0070.308] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".config") returned 7 [0070.308] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0070.308] lstrlenW (lpString=".cpp") returned 4 [0070.308] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".cr2") returned 4 [0070.308] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".crt") returned 4 [0070.308] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".crw") returned 4 [0070.308] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0070.308] lstrlenW (lpString=".cs") returned 3 [0070.308] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0070.308] lstrlenW (lpString=".css") returned 4 [0070.308] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".csv") returned 4 [0070.309] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".cub") returned 4 [0070.309] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".dae") returned 4 [0070.309] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".dat") returned 4 [0070.309] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".db") returned 3 [0070.309] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0070.309] lstrlenW (lpString=".dbf") returned 4 [0070.309] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".dbx") returned 4 [0070.309] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".dc3") returned 4 [0070.309] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".dcm") returned 4 [0070.309] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".dcr") returned 4 [0070.309] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".der") returned 4 [0070.309] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".dib") returned 4 [0070.309] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".dic") returned 4 [0070.309] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".dif") returned 4 [0070.309] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0070.309] lstrlenW (lpString=".divx") returned 5 [0070.309] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0070.309] lstrlenW (lpString=".djvu") returned 5 [0070.309] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0070.309] lstrlenW (lpString=".dng") returned 4 [0070.309] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0070.310] lstrlenW (lpString=".doc") returned 4 [0070.310] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0070.310] lstrlenW (lpString=".docm") returned 5 [0070.310] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0070.310] lstrlenW (lpString=".docx") returned 5 [0070.310] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0070.310] lstrlenW (lpString=".dot") returned 4 [0070.310] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0070.310] lstrlenW (lpString=".dotm") returned 5 [0070.310] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0070.310] lstrlenW (lpString=".dotx") returned 5 [0070.310] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0070.310] lstrlenW (lpString=".dpx") returned 4 [0070.310] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0070.310] lstrlenW (lpString=".dqy") returned 4 [0070.310] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0070.310] lstrlenW (lpString=".dsn") returned 4 [0070.310] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0070.310] lstrlenW (lpString=".dt") returned 3 [0070.310] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0070.310] lstrlenW (lpString=".dtd") returned 4 [0070.310] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0070.310] lstrlenW (lpString=".dwg") returned 4 [0070.310] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0070.310] lstrlenW (lpString=".dwt") returned 4 [0070.310] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0070.310] lstrlenW (lpString=".dx") returned 3 [0070.310] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0070.310] lstrlenW (lpString=".dxf") returned 4 [0070.310] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0070.310] lstrlenW (lpString=".edml") returned 5 [0070.310] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0070.310] lstrlenW (lpString=".efd") returned 4 [0070.310] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0070.311] lstrlenW (lpString=".elf") returned 4 [0070.311] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0070.311] lstrlenW (lpString=".emf") returned 4 [0070.311] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0070.311] lstrlenW (lpString=".emz") returned 4 [0070.311] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0070.311] lstrlenW (lpString=".epf") returned 4 [0070.311] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0070.311] lstrlenW (lpString=".eps") returned 4 [0070.311] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0070.311] lstrlenW (lpString=".epsf") returned 5 [0070.311] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0070.311] lstrlenW (lpString=".epsp") returned 5 [0070.311] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0070.311] lstrlenW (lpString=".erf") returned 4 [0070.311] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0070.311] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.311] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.311] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0070.311] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.311] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.312] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.312] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.312] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.312] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0070.312] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.312] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.312] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.312] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.312] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.312] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0070.312] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.313] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.313] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.313] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.313] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.313] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0070.313] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.313] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.313] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.313] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.313] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.313] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0070.314] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.314] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.314] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.314] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.314] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.314] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0070.314] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.314] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.314] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.314] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.314] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.315] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0070.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.315] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.315] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.315] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.315] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.315] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0070.315] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.315] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.315] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.315] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.316] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.316] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0070.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.316] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.316] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.316] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.316] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.316] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0070.316] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.316] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.316] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.317] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.317] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.317] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0070.317] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.317] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.317] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.318] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.318] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.318] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0070.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.318] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.318] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.318] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.318] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.318] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0070.318] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.319] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.319] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.319] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.319] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.319] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0070.319] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.319] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.319] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.319] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.319] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.319] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0070.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.320] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.320] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.320] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.320] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.320] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0070.320] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.320] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.320] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.320] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.320] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.320] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0070.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.321] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.321] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.321] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.321] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.321] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0070.321] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.321] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.321] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.321] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.322] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.322] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0070.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.322] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.322] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.322] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.322] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.322] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0070.322] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.322] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.322] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.322] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.323] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.323] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0070.323] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.323] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.323] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.323] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.323] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.323] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0070.323] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.323] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.323] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.324] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.324] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.324] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0070.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.324] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.324] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.324] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.324] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.324] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0070.324] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.324] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.324] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.325] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.325] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.325] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0070.325] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.325] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.325] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.325] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.325] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.325] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0070.325] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.326] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.326] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.326] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.326] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.326] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0070.326] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.326] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.326] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.326] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.326] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.326] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0070.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.327] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.327] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.327] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.327] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.327] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0070.327] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.327] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.327] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.327] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.327] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.327] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0070.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.328] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.328] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.328] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.328] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.328] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0070.328] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.382] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.382] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.382] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.382] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.382] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0070.382] FindClose (in: hFindFile=0x3f12608 | out: hFindFile=0x3f12608) returned 1 [0070.382] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0070.382] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x341e1ac | out: lpFindFileData=0x341e1ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b998f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85d166b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85d166b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0071.425] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.425] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.426] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.426] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.426] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0071.426] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.426] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.426] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.427] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.427] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.427] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0071.427] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.526] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.526] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.527] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.527] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.527] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0071.527] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.527] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.527] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.527] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.527] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.527] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0071.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.528] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.528] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.528] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.528] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.528] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0071.528] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.528] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.528] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.528] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.528] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.528] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0071.529] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.529] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.529] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.529] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.529] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.529] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0071.529] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.529] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.529] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.529] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.530] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.530] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0071.530] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.647] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.647] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.647] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.647] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.647] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0071.647] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.648] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.648] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfe, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.648] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.648] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.648] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0071.648] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.649] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.649] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.649] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.649] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.649] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0071.649] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.650] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.650] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xda, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.650] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.650] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.650] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0071.650] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.651] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.651] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.651] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.651] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.651] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0071.651] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.652] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.652] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.652] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.652] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.652] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0071.652] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.653] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.653] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.653] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.653] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.653] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0071.654] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.654] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.654] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.654] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.654] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.654] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0071.654] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.655] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.655] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57c20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x152, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.655] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.655] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.655] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0071.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.656] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f57450, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f57450, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.656] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f57450, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f7ed20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.656] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.656] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.656] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0071.656] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.657] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.657] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.657] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.657] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.657] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0071.658] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.658] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.658] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.658] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.658] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.658] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0071.659] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.659] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fc9870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fc9870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.660] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fc9870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fca810, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.660] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.660] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.660] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0071.660] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.660] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.660] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x164, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.660] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.661] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.661] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0071.661] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.661] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.662] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.662] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.662] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.662] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0071.662] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.662] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.662] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x161, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.663] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.663] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.663] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0071.663] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.664] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.664] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x117, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.664] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.664] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.664] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0071.664] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.664] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86fef9d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86fef9d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.664] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ff1910, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x111, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.665] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.667] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.667] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0071.667] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.668] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.668] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.668] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.668] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0071.668] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86fef9d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0071.668] FindClose (in: hFindFile=0x3f12708 | out: hFindFile=0x3f12708) returned 1 [0071.668] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.668] FindNextFileW (in: hFindFile=0x3f12608, lpFindFileData=0x341e1ac | out: lpFindFileData=0x341e1ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0071.670] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87015b30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x87015b30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.670] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x87015b30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x87016300, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0x2bd5, dwReserved0=0x0, dwReserved1=0x0, cFileName="verified_contents.json", cAlternateFileName="VERIFI~1.JSO")) returned 1 [0071.944] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.958] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x405bd30 | out: hHeap=0x8d0000) returned 1 [0071.958] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0071.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko") returned 141 [0071.958] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko") returned 1 [0071.958] lstrlenW (lpString="ko") returned 2 [0071.958] lstrcmpiW (lpString1="C:\\Windows", lpString2="ko") returned -1 [0071.958] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x405bd30 [0071.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko") returned 141 [0071.958] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f126c8 [0071.958] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.958] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.959] lstrlenW (lpString="messages.json") returned 13 [0071.959] lstrlenW (lpString=".1cd") returned 4 [0071.959] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0071.959] lstrlenW (lpString=".3ds") returned 4 [0071.959] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0071.959] lstrlenW (lpString=".3fr") returned 4 [0071.959] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0071.959] lstrlenW (lpString=".3g2") returned 4 [0071.959] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0071.959] lstrlenW (lpString=".3gp") returned 4 [0071.959] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0071.959] lstrlenW (lpString=".7z") returned 3 [0071.959] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0071.959] lstrlenW (lpString=".accda") returned 6 [0071.959] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0071.959] lstrlenW (lpString=".accdb") returned 6 [0071.959] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0071.959] lstrlenW (lpString=".accdc") returned 6 [0071.959] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0071.959] lstrlenW (lpString=".accde") returned 6 [0071.959] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0071.959] lstrlenW (lpString=".accdt") returned 6 [0071.959] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0071.959] lstrlenW (lpString=".accdw") returned 6 [0071.959] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0071.959] lstrlenW (lpString=".adb") returned 4 [0071.959] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0071.959] lstrlenW (lpString=".adp") returned 4 [0071.959] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0071.959] lstrlenW (lpString=".ai") returned 3 [0071.959] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0071.959] lstrlenW (lpString=".ai3") returned 4 [0071.959] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".ai4") returned 4 [0071.960] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".ai5") returned 4 [0071.960] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".ai6") returned 4 [0071.960] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".ai7") returned 4 [0071.960] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".ai8") returned 4 [0071.960] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".anim") returned 5 [0071.960] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0071.960] lstrlenW (lpString=".arw") returned 4 [0071.960] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".as") returned 3 [0071.960] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0071.960] lstrlenW (lpString=".asa") returned 4 [0071.960] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".asc") returned 4 [0071.960] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".ascx") returned 5 [0071.960] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0071.960] lstrlenW (lpString=".asm") returned 4 [0071.960] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".asmx") returned 5 [0071.960] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0071.960] lstrlenW (lpString=".asp") returned 4 [0071.960] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".aspx") returned 5 [0071.960] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0071.960] lstrlenW (lpString=".asr") returned 4 [0071.960] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0071.960] lstrlenW (lpString=".asx") returned 4 [0071.960] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".avi") returned 4 [0071.961] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".avs") returned 4 [0071.961] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".backup") returned 7 [0071.961] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0071.961] lstrlenW (lpString=".bak") returned 4 [0071.961] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".bay") returned 4 [0071.961] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".bd") returned 3 [0071.961] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0071.961] lstrlenW (lpString=".bin") returned 4 [0071.961] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".bmp") returned 4 [0071.961] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".bz2") returned 4 [0071.961] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".c") returned 2 [0071.961] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0071.961] lstrlenW (lpString=".cdr") returned 4 [0071.961] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".cer") returned 4 [0071.961] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".cf") returned 3 [0071.961] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0071.961] lstrlenW (lpString=".cfc") returned 4 [0071.961] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".cfm") returned 4 [0071.961] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0071.961] lstrlenW (lpString=".cfml") returned 5 [0071.961] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0071.961] lstrlenW (lpString=".cfu") returned 4 [0071.961] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".chm") returned 4 [0071.962] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".cin") returned 4 [0071.962] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".class") returned 6 [0071.962] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0071.962] lstrlenW (lpString=".clx") returned 4 [0071.962] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".config") returned 7 [0071.962] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0071.962] lstrlenW (lpString=".cpp") returned 4 [0071.962] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".cr2") returned 4 [0071.962] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".crt") returned 4 [0071.962] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".crw") returned 4 [0071.962] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".cs") returned 3 [0071.962] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0071.962] lstrlenW (lpString=".css") returned 4 [0071.962] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".csv") returned 4 [0071.962] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".cub") returned 4 [0071.962] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".dae") returned 4 [0071.962] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".dat") returned 4 [0071.962] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0071.962] lstrlenW (lpString=".db") returned 3 [0071.962] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0071.963] lstrlenW (lpString=".dbf") returned 4 [0071.963] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".dbx") returned 4 [0071.963] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".dc3") returned 4 [0071.963] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".dcm") returned 4 [0071.963] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".dcr") returned 4 [0071.963] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".der") returned 4 [0071.963] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".dib") returned 4 [0071.963] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".dic") returned 4 [0071.963] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".dif") returned 4 [0071.963] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".divx") returned 5 [0071.963] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0071.963] lstrlenW (lpString=".djvu") returned 5 [0071.963] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0071.963] lstrlenW (lpString=".dng") returned 4 [0071.963] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".doc") returned 4 [0071.963] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".docm") returned 5 [0071.963] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0071.963] lstrlenW (lpString=".docx") returned 5 [0071.963] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0071.963] lstrlenW (lpString=".dot") returned 4 [0071.963] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0071.963] lstrlenW (lpString=".dotm") returned 5 [0071.964] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0071.964] lstrlenW (lpString=".dotx") returned 5 [0071.964] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0071.964] lstrlenW (lpString=".dpx") returned 4 [0071.964] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".dqy") returned 4 [0071.964] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".dsn") returned 4 [0071.964] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".dt") returned 3 [0071.964] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0071.964] lstrlenW (lpString=".dtd") returned 4 [0071.964] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".dwg") returned 4 [0071.964] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".dwt") returned 4 [0071.964] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".dx") returned 3 [0071.964] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0071.964] lstrlenW (lpString=".dxf") returned 4 [0071.964] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".edml") returned 5 [0071.964] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0071.964] lstrlenW (lpString=".efd") returned 4 [0071.964] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".elf") returned 4 [0071.964] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".emf") returned 4 [0071.964] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".emz") returned 4 [0071.964] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".epf") returned 4 [0071.964] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0071.964] lstrlenW (lpString=".eps") returned 4 [0071.964] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".epsf") returned 5 [0071.965] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0071.965] lstrlenW (lpString=".epsp") returned 5 [0071.965] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0071.965] lstrlenW (lpString=".erf") returned 4 [0071.965] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".exr") returned 4 [0071.965] lstrcmpiW (lpString1=".exr", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".f4v") returned 4 [0071.965] lstrcmpiW (lpString1=".f4v", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".fido") returned 5 [0071.965] lstrcmpiW (lpString1=".fido", lpString2=".json") returned -1 [0071.965] lstrlenW (lpString=".flm") returned 4 [0071.965] lstrcmpiW (lpString1=".flm", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".flv") returned 4 [0071.965] lstrcmpiW (lpString1=".flv", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".frm") returned 4 [0071.965] lstrcmpiW (lpString1=".frm", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".fxg") returned 4 [0071.965] lstrcmpiW (lpString1=".fxg", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".geo") returned 4 [0071.965] lstrcmpiW (lpString1=".geo", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".gif") returned 4 [0071.965] lstrcmpiW (lpString1=".gif", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".grs") returned 4 [0071.965] lstrcmpiW (lpString1=".grs", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".gz") returned 3 [0071.965] lstrcmpiW (lpString1=".gz", lpString2="son") returned -1 [0071.965] lstrlenW (lpString=".h") returned 2 [0071.965] lstrcmpiW (lpString1=".h", lpString2="on") returned -1 [0071.965] lstrlenW (lpString=".hdr") returned 4 [0071.965] lstrcmpiW (lpString1=".hdr", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".hpp") returned 4 [0071.965] lstrcmpiW (lpString1=".hpp", lpString2="json") returned -1 [0071.965] lstrlenW (lpString=".hta") returned 4 [0071.966] lstrcmpiW (lpString1=".hta", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".htc") returned 4 [0071.966] lstrcmpiW (lpString1=".htc", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".htm") returned 4 [0071.966] lstrcmpiW (lpString1=".htm", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".html") returned 5 [0071.966] lstrcmpiW (lpString1=".html", lpString2=".json") returned -1 [0071.966] lstrlenW (lpString=".icb") returned 4 [0071.966] lstrcmpiW (lpString1=".icb", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".ics") returned 4 [0071.966] lstrcmpiW (lpString1=".ics", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".iff") returned 4 [0071.966] lstrcmpiW (lpString1=".iff", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".inc") returned 4 [0071.966] lstrcmpiW (lpString1=".inc", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".indd") returned 5 [0071.966] lstrcmpiW (lpString1=".indd", lpString2=".json") returned -1 [0071.966] lstrlenW (lpString=".ini") returned 4 [0071.966] lstrcmpiW (lpString1=".ini", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".iqy") returned 4 [0071.966] lstrcmpiW (lpString1=".iqy", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".j2c") returned 4 [0071.966] lstrcmpiW (lpString1=".j2c", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".j2k") returned 4 [0071.966] lstrcmpiW (lpString1=".j2k", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".java") returned 5 [0071.966] lstrcmpiW (lpString1=".java", lpString2=".json") returned -1 [0071.966] lstrlenW (lpString=".jp2") returned 4 [0071.966] lstrcmpiW (lpString1=".jp2", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".jpc") returned 4 [0071.966] lstrcmpiW (lpString1=".jpc", lpString2="json") returned -1 [0071.966] lstrlenW (lpString=".jpe") returned 4 [0071.967] lstrcmpiW (lpString1=".jpe", lpString2="json") returned -1 [0071.967] lstrlenW (lpString=".jpeg") returned 5 [0071.967] lstrcmpiW (lpString1=".jpeg", lpString2=".json") returned -1 [0071.967] lstrlenW (lpString=".jpf") returned 4 [0071.967] lstrcmpiW (lpString1=".jpf", lpString2="json") returned -1 [0071.967] lstrlenW (lpString=".jpg") returned 4 [0071.967] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0071.967] lstrlenW (lpString=".jpx") returned 4 [0071.967] lstrcmpiW (lpString1=".jpx", lpString2="json") returned -1 [0071.967] lstrlenW (lpString=".js") returned 3 [0071.967] lstrcmpiW (lpString1=".js", lpString2="son") returned -1 [0071.967] lstrlenW (lpString=".jsf") returned 4 [0071.967] lstrcmpiW (lpString1=".jsf", lpString2="json") returned -1 [0071.967] lstrlenW (lpString=".json") returned 5 [0071.967] lstrcmpiW (lpString1=".json", lpString2=".json") returned 0 [0071.967] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.967] FindClose (in: hFindFile=0x3f126c8 | out: hFindFile=0x3f126c8) returned 1 [0071.967] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x405bd30 | out: hHeap=0x8d0000) returned 1 [0071.967] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x341df30 | out: lpFindFileData=0x341df30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0071.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt") returned 141 [0071.967] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt") returned 1 [0071.967] lstrlenW (lpString="lt") returned 2 [0071.967] lstrcmpiW (lpString1="C:\\Windows", lpString2="lt") returned -1 [0071.967] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x405bd30 [0071.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt") returned 141 [0071.967] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f126c8 [0071.968] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.968] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x341dcb4 | out: lpFindFileData=0x341dcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.968] lstrlenW (lpString="messages.json") returned 13 [0071.968] lstrlenW (lpString=".1cd") returned 4 [0071.968] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0071.968] lstrlenW (lpString=".3ds") returned 4 [0071.968] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0071.968] lstrlenW (lpString=".3fr") returned 4 [0071.968] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0071.968] lstrlenW (lpString=".3g2") returned 4 [0071.968] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0071.968] lstrlenW (lpString=".3gp") returned 4 [0071.968] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0071.968] lstrlenW (lpString=".7z") returned 3 [0071.968] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0071.968] lstrlenW (lpString=".accda") returned 6 [0071.968] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0071.968] lstrlenW (lpString=".accdb") returned 6 [0071.968] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0071.968] lstrlenW (lpString=".accdc") returned 6 [0071.968] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0071.968] lstrlenW (lpString=".accde") returned 6 [0071.968] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0071.968] lstrlenW (lpString=".accdt") returned 6 [0071.968] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0071.968] lstrlenW (lpString=".accdw") returned 6 [0071.968] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0071.968] lstrlenW (lpString=".adb") returned 4 [0071.968] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0071.968] lstrlenW (lpString=".adp") returned 4 [0071.968] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".ai") returned 3 [0071.969] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0071.969] lstrlenW (lpString=".ai3") returned 4 [0071.969] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".ai4") returned 4 [0071.969] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".ai5") returned 4 [0071.969] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".ai6") returned 4 [0071.969] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".ai7") returned 4 [0071.969] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".ai8") returned 4 [0071.969] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".anim") returned 5 [0071.969] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0071.969] lstrlenW (lpString=".arw") returned 4 [0071.969] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".as") returned 3 [0071.969] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0071.969] lstrlenW (lpString=".asa") returned 4 [0071.969] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".asc") returned 4 [0071.969] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".ascx") returned 5 [0071.969] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0071.969] lstrlenW (lpString=".asm") returned 4 [0071.969] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".asmx") returned 5 [0071.969] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0071.969] lstrlenW (lpString=".asp") returned 4 [0071.969] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0071.969] lstrlenW (lpString=".aspx") returned 5 [0071.969] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0071.970] lstrlenW (lpString=".asr") returned 4 [0071.970] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".asx") returned 4 [0071.970] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".avi") returned 4 [0071.970] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".avs") returned 4 [0071.970] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".backup") returned 7 [0071.970] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0071.970] lstrlenW (lpString=".bak") returned 4 [0071.970] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".bay") returned 4 [0071.970] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".bd") returned 3 [0071.970] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0071.970] lstrlenW (lpString=".bin") returned 4 [0071.970] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".bmp") returned 4 [0071.970] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".bz2") returned 4 [0071.970] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".c") returned 2 [0071.970] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0071.970] lstrlenW (lpString=".cdr") returned 4 [0071.970] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".cer") returned 4 [0071.970] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".cf") returned 3 [0071.970] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0071.970] lstrlenW (lpString=".cfc") returned 4 [0071.970] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0071.970] lstrlenW (lpString=".cfm") returned 4 [0071.971] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0071.971] lstrlenW (lpString=".cfml") returned 5 [0071.971] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0071.971] lstrlenW (lpString=".cfu") returned 4 [0071.971] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0071.971] lstrlenW (lpString=".chm") returned 4 [0071.971] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0071.971] lstrlenW (lpString=".cin") returned 4 [0071.971] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0071.971] lstrlenW (lpString=".class") returned 6 [0071.971] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0071.971] lstrlenW (lpString=".clx") returned 4 [0071.971] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0071.971] lstrlenW (lpString=".config") returned 7 [0071.971] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0071.971] lstrlenW (lpString=".cpp") returned 4 [0071.971] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0071.971] lstrlenW (lpString=".cr2") returned 4 [0071.971] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0071.971] lstrlenW (lpString=".crt") returned 4 [0071.971] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0071.971] lstrlenW (lpString=".crw") returned 4 [0071.971] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0071.972] lstrlenW (lpString=".cs") returned 3 [0071.972] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0071.972] lstrlenW (lpString=".css") returned 4 [0071.972] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0071.972] lstrlenW (lpString=".csv") returned 4 [0071.972] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0071.972] lstrlenW (lpString=".cub") returned 4 [0071.972] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0071.972] lstrlenW (lpString=".dae") returned 4 [0071.972] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0071.972] lstrlenW (lpString=".dat") returned 4 [0071.972] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0071.972] lstrlenW (lpString=".db") returned 3 [0071.972] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0071.972] lstrlenW (lpString=".dbf") returned 4 [0071.972] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0071.972] lstrlenW (lpString=".dbx") returned 4 [0071.972] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0071.972] lstrlenW (lpString=".dc3") returned 4 [0071.972] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0071.972] lstrlenW (lpString=".dcm") returned 4 [0071.972] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0071.972] lstrlenW (lpString=".dcr") returned 4 [0071.972] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".der") returned 4 [0071.973] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".dib") returned 4 [0071.973] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".dic") returned 4 [0071.973] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".dif") returned 4 [0071.973] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".divx") returned 5 [0071.973] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0071.973] lstrlenW (lpString=".djvu") returned 5 [0071.973] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0071.973] lstrlenW (lpString=".dng") returned 4 [0071.973] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".doc") returned 4 [0071.973] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".docm") returned 5 [0071.973] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0071.973] lstrlenW (lpString=".docx") returned 5 [0071.973] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0071.973] lstrlenW (lpString=".dot") returned 4 [0071.973] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".dotm") returned 5 [0071.973] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0071.973] lstrlenW (lpString=".dotx") returned 5 [0071.973] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0071.973] lstrlenW (lpString=".dpx") returned 4 [0071.973] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".dqy") returned 4 [0071.973] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".dsn") returned 4 [0071.973] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0071.973] lstrlenW (lpString=".dt") returned 3 [0071.973] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0071.974] lstrlenW (lpString=".dtd") returned 4 [0071.974] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0071.974] lstrlenW (lpString=".dwg") returned 4 [0071.974] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0071.974] lstrlenW (lpString=".dwt") returned 4 [0071.974] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0071.974] lstrlenW (lpString=".dx") returned 3 [0071.974] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0071.974] lstrlenW (lpString=".dxf") returned 4 [0071.974] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0071.974] lstrlenW (lpString=".edml") returned 5 [0071.974] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0071.974] lstrlenW (lpString=".efd") returned 4 [0071.974] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0071.974] lstrlenW (lpString=".elf") returned 4 [0071.974] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0071.974] lstrlenW (lpString=".emf") returned 4 [0071.974] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0071.974] lstrlenW (lpString=".emz") returned 4 [0071.974] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0071.974] lstrlenW (lpString=".epf") returned 4 [0071.974] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0071.974] lstrlenW (lpString=".eps") returned 4 [0071.974] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0073.988] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Cookies\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12648 [0074.071] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.071] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 [0074.072] FindClose (in: hFindFile=0x3f12648 | out: hFindFile=0x3f12648) returned 1 [0074.072] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0074.072] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc87fb40, ftCreationTime.dwHighDateTime=0x1d4d0c5, ftLastAccessTime.dwLowDateTime=0xbdff8a90, ftLastAccessTime.dwHighDateTime=0x1d4cbe4, ftLastWriteTime.dwLowDateTime=0xbdff8a90, ftLastWriteTime.dwHighDateTime=0x1d4cbe4, nFileSizeHigh=0x0, nFileSizeLow=0x723e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cxln trTpnDpGQeKH.bmp", cAlternateFileName="CXLNTR~1.BMP")) returned 1 [0074.072] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12588 [0074.406] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.417] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0074.845] FindClose (in: hFindFile=0x3f125c8 | out: hFindFile=0x3f125c8) returned 1 [0074.846] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f43488 | out: hHeap=0x8d0000) returned 1 [0074.846] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x2b1e4b40, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2b1e4b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x36031920, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x4c, dwReserved0=0x0, dwReserved1=0x0, cFileName="SYNCHIST", cAlternateFileName="")) returned 1 [0074.846] FindClose (in: hFindFile=0x3f12288 | out: hFindFile=0x3f12288) returned 1 [0074.846] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401bd10 | out: hHeap=0x8d0000) returned 1 [0074.846] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher", cAlternateFileName="PUBLIS~1")) returned 1 [0074.846] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0074.847] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.847] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x43bcc750, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x43bcc750, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x43bcc750, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.847] FindClose (in: hFindFile=0x3f12288 | out: hFindFile=0x3f12288) returned 1 [0074.847] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401bd10 | out: hHeap=0x8d0000) returned 1 [0074.847] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Publisher Building Blocks", cAlternateFileName="PUBLIS~2")) returned 1 [0074.848] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Publisher Building Blocks\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0074.849] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbec39d0, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.849] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x4bb4c1b0, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x4bb4c1b0, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbec39d0, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0xa8, dwReserved0=0x0, dwReserved1=0x0, cFileName="ContentStore.xml", cAlternateFileName="CONTEN~1.XML")) returned 1 [0074.849] FindClose (in: hFindFile=0x3f12288 | out: hFindFile=0x3f12288) returned 1 [0074.850] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401bd10 | out: hHeap=0x8d0000) returned 1 [0074.850] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Speech", cAlternateFileName="")) returned 1 [0074.850] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Speech\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0074.850] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.850] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xcd72eaa0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xcd72eaa0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xcd72eaa0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.850] FindClose (in: hFindFile=0x3f12288 | out: hFindFile=0x3f12288) returned 1 [0074.850] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401bd10 | out: hHeap=0x8d0000) returned 1 [0074.850] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SystemCertificates", cAlternateFileName="SYSTEM~1")) returned 1 [0074.851] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0074.851] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.851] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 1 [0074.851] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\*", lpFindFileData=0x341eb9c | out: lpFindFileData=0x341eb9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f125c8 [0074.851] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x341eb9c | out: lpFindFileData=0x341eb9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.851] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x341eb9c | out: lpFindFileData=0x341eb9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Certificates", cAlternateFileName="CERTIF~1")) returned 1 [0074.851] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\Certificates\\*", lpFindFileData=0x341e920 | out: lpFindFileData=0x341e920*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f121c8 [0074.852] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x341e920 | out: lpFindFileData=0x341e920*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.852] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x341e920 | out: lpFindFileData=0x341e920*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.852] FindClose (in: hFindFile=0x3f121c8 | out: hFindFile=0x3f121c8) returned 1 [0074.852] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x407bd28 | out: hHeap=0x8d0000) returned 1 [0074.852] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x341eb9c | out: lpFindFileData=0x341eb9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CRLs", cAlternateFileName="")) returned 1 [0074.852] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CRLs\\*", lpFindFileData=0x341e920 | out: lpFindFileData=0x341e920*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f121c8 [0074.852] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x341e920 | out: lpFindFileData=0x341e920*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.852] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x341e920 | out: lpFindFileData=0x341e920*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.852] FindClose (in: hFindFile=0x3f121c8 | out: hFindFile=0x3f121c8) returned 1 [0074.852] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x407bd28 | out: hHeap=0x8d0000) returned 1 [0074.852] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x341eb9c | out: lpFindFileData=0x341eb9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 1 [0074.853] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\SystemCertificates\\My\\CTLs\\*", lpFindFileData=0x341e920 | out: lpFindFileData=0x341e920*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f121c8 [0074.853] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x341e920 | out: lpFindFileData=0x341e920*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.853] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x341e920 | out: lpFindFileData=0x341e920*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.853] FindClose (in: hFindFile=0x3f121c8 | out: hFindFile=0x3f121c8) returned 1 [0074.853] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x407bd28 | out: hHeap=0x8d0000) returned 1 [0074.853] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x341eb9c | out: lpFindFileData=0x341eb9c*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CTLs", cAlternateFileName="")) returned 0 [0074.853] FindClose (in: hFindFile=0x3f125c8 | out: hFindFile=0x3f125c8) returned 1 [0074.853] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f43488 | out: hHeap=0x8d0000) returned 1 [0074.853] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2014, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x96779c3, ftLastWriteTime.dwHighDateTime=0x1cb8927, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="My", cAlternateFileName="")) returned 0 [0074.853] FindClose (in: hFindFile=0x3f12288 | out: hFindFile=0x3f12288) returned 1 [0074.853] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401bd10 | out: hHeap=0x8d0000) returned 1 [0074.853] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Templates", cAlternateFileName="TEMPLA~1")) returned 1 [0074.853] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Templates\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0074.863] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x31d42f10, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x2795d470, ftLastAccessTime.dwHighDateTime=0x1d3aaba, ftLastWriteTime.dwLowDateTime=0x2795d470, ftLastWriteTime.dwHighDateTime=0x1d3aaba, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.863] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5db2c650, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0x5db2c650, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0x5db78910, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x509b, dwReserved0=0x0, dwReserved1=0x0, cFileName="Normal.dotm", cAlternateFileName="NORMAL~1.DOT")) returned 1 [0074.863] FindClose (in: hFindFile=0x3f12288 | out: hFindFile=0x3f12288) returned 1 [0074.863] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401bd10 | out: hHeap=0x8d0000) returned 1 [0074.863] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="UProof", cAlternateFileName="")) returned 1 [0074.863] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\UProof\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0074.864] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.864] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xbab2410, ftCreationTime.dwHighDateTime=0x1d2dda4, ftLastAccessTime.dwLowDateTime=0xbab2410, ftLastAccessTime.dwHighDateTime=0x1d2dda4, ftLastWriteTime.dwLowDateTime=0xbab2410, ftLastWriteTime.dwHighDateTime=0x1d2dda4, nFileSizeHigh=0x0, nFileSizeLow=0x2, dwReserved0=0x0, dwReserved1=0x0, cFileName="CUSTOM.DIC", cAlternateFileName="")) returned 1 [0074.864] FindClose (in: hFindFile=0x3f12288 | out: hFindFile=0x3f12288) returned 1 [0074.865] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401bd10 | out: hHeap=0x8d0000) returned 1 [0074.865] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x341f094 | out: lpFindFileData=0x341f094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0074.865] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\*", lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0074.865] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x28cff640, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0xf96b9c4c, ftLastWriteTime.dwHighDateTime=0x1cb8926, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.865] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x341ee18 | out: lpFindFileData=0x341ee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Cookies", cAlternateFileName="")) returned 1 [0074.865] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Cookies\\*", lpFindFileData=0x341eb9c | out: lpFindFileData=0x341eb9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f125c8 [0074.865] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x341eb9c | out: lpFindFileData=0x341eb9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c7870d0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x2c7870d0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.865] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x341eb9c | out: lpFindFileData=0x341eb9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x1c3625f0, ftCreationTime.dwHighDateTime=0x1d35d06, ftLastAccessTime.dwLowDateTime=0x1c3625f0, ftLastAccessTime.dwHighDateTime=0x1d35d06, ftLastWriteTime.dwLowDateTime=0x1c3625f0, ftLastWriteTime.dwHighDateTime=0x1d35d06, nFileSizeHigh=0x0, nFileSizeLow=0x53, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5nrgjn0js_halpmcxz@adobe[1].txt", cAlternateFileName="5P5NRG~1.TXT")) returned 1 [0075.392] FindClose (in: hFindFile=0x3f12408 | out: hFindFile=0x3f12408) returned 1 [0075.431] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f654a8 | out: hHeap=0x8d0000) returned 1 [0075.511] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x341e428 | out: lpFindFileData=0x341e428*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x29958860, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x29a3d0a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x29a3d0a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="CiFiles", cAlternateFileName="")) returned 0 [0075.511] FindClose (in: hFindFile=0x3f121c8 | out: hFindFile=0x3f121c8) returned 1 [0075.511] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0075.519] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x341e6a4 | out: lpFindFileData=0x341e6a4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x27eb7240, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x27edd3a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x27edd3a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="PropMap", cAlternateFileName="")) returned 1 Thread: id = 23 os_tid = 0xac8 [0047.376] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x38106d8 [0047.377] lstrlenW (lpString="C:") returned 2 [0047.377] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3edfd00 | out: lpFindFileData=0x3edfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x9c3278 [0047.377] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0047.377] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0047.377] lstrlenW (lpString="$Recycle.Bin") returned 12 [0047.377] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0047.377] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x38206e0 [0047.378] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0047.378] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c32b8 [0047.378] FindNextFileW (in: hFindFile=0x9c32b8, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.378] FindNextFileW (in: hFindFile=0x9c32b8, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0047.378] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0047.378] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0047.378] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0047.378] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0047.378] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x38306e8 [0047.378] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0047.378] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c4300 [0047.379] FindNextFileW (in: hFindFile=0x9c4300, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.379] FindNextFileW (in: hFindFile=0x9c4300, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0047.379] lstrlenW (lpString="desktop.ini") returned 11 [0047.379] lstrlenW (lpString=".1cd") returned 4 [0047.379] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0047.379] lstrlenW (lpString=".3ds") returned 4 [0047.379] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0047.379] lstrlenW (lpString=".3fr") returned 4 [0047.379] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0047.379] lstrlenW (lpString=".3g2") returned 4 [0047.379] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0047.379] lstrlenW (lpString=".3gp") returned 4 [0047.379] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0047.379] lstrlenW (lpString=".7z") returned 3 [0047.379] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0047.379] lstrlenW (lpString=".accda") returned 6 [0047.379] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0047.379] lstrlenW (lpString=".accdb") returned 6 [0047.379] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0047.379] lstrlenW (lpString=".accdc") returned 6 [0047.379] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0047.379] lstrlenW (lpString=".accde") returned 6 [0047.379] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0047.379] lstrlenW (lpString=".accdt") returned 6 [0047.379] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0047.379] lstrlenW (lpString=".accdw") returned 6 [0047.379] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0047.380] lstrlenW (lpString=".adb") returned 4 [0047.380] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".adp") returned 4 [0047.380] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".ai") returned 3 [0047.380] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0047.380] lstrlenW (lpString=".ai3") returned 4 [0047.380] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".ai4") returned 4 [0047.380] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".ai5") returned 4 [0047.380] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".ai6") returned 4 [0047.380] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".ai7") returned 4 [0047.380] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".ai8") returned 4 [0047.380] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".anim") returned 5 [0047.380] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0047.380] lstrlenW (lpString=".arw") returned 4 [0047.380] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".as") returned 3 [0047.380] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0047.380] lstrlenW (lpString=".asa") returned 4 [0047.380] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".asc") returned 4 [0047.380] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0047.380] lstrlenW (lpString=".ascx") returned 5 [0047.380] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0047.381] lstrlenW (lpString=".asm") returned 4 [0047.381] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".asmx") returned 5 [0047.381] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0047.381] lstrlenW (lpString=".asp") returned 4 [0047.381] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".aspx") returned 5 [0047.381] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0047.381] lstrlenW (lpString=".asr") returned 4 [0047.381] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".asx") returned 4 [0047.381] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".avi") returned 4 [0047.381] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".avs") returned 4 [0047.381] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".backup") returned 7 [0047.381] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0047.381] lstrlenW (lpString=".bak") returned 4 [0047.381] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".bay") returned 4 [0047.381] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".bd") returned 3 [0047.381] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0047.381] lstrlenW (lpString=".bin") returned 4 [0047.381] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".bmp") returned 4 [0047.381] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".bz2") returned 4 [0047.381] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0047.381] lstrlenW (lpString=".c") returned 2 [0047.381] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0047.381] lstrlenW (lpString=".cdr") returned 4 [0047.382] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".cer") returned 4 [0047.382] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".cf") returned 3 [0047.382] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0047.382] lstrlenW (lpString=".cfc") returned 4 [0047.382] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".cfm") returned 4 [0047.382] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".cfml") returned 5 [0047.382] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0047.382] lstrlenW (lpString=".cfu") returned 4 [0047.382] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".chm") returned 4 [0047.382] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".cin") returned 4 [0047.382] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".class") returned 6 [0047.382] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0047.382] lstrlenW (lpString=".clx") returned 4 [0047.382] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".config") returned 7 [0047.382] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0047.382] lstrlenW (lpString=".cpp") returned 4 [0047.382] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".cr2") returned 4 [0047.382] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".crt") returned 4 [0047.382] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".crw") returned 4 [0047.382] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0047.382] lstrlenW (lpString=".cs") returned 3 [0047.382] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0047.382] lstrlenW (lpString=".css") returned 4 [0047.383] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".csv") returned 4 [0047.383] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".cub") returned 4 [0047.383] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".dae") returned 4 [0047.383] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".dat") returned 4 [0047.383] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".db") returned 3 [0047.383] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0047.383] lstrlenW (lpString=".dbf") returned 4 [0047.383] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".dbx") returned 4 [0047.383] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".dc3") returned 4 [0047.383] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".dcm") returned 4 [0047.383] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".dcr") returned 4 [0047.383] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".der") returned 4 [0047.383] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".dib") returned 4 [0047.383] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".dic") returned 4 [0047.383] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".dif") returned 4 [0047.383] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0047.383] lstrlenW (lpString=".divx") returned 5 [0047.383] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0047.383] lstrlenW (lpString=".djvu") returned 5 [0047.383] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0047.384] lstrlenW (lpString=".dng") returned 4 [0047.384] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0047.384] lstrlenW (lpString=".doc") returned 4 [0047.384] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0047.384] lstrlenW (lpString=".docm") returned 5 [0047.384] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0047.384] lstrlenW (lpString=".docx") returned 5 [0047.384] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0047.384] lstrlenW (lpString=".dot") returned 4 [0047.384] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0047.384] lstrlenW (lpString=".dotm") returned 5 [0047.384] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0047.384] lstrlenW (lpString=".dotx") returned 5 [0047.384] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0047.384] lstrlenW (lpString=".dpx") returned 4 [0047.384] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0047.384] lstrlenW (lpString=".dqy") returned 4 [0047.384] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0047.384] lstrlenW (lpString=".dsn") returned 4 [0047.384] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0047.384] lstrlenW (lpString=".dt") returned 3 [0047.384] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0047.384] lstrlenW (lpString=".dtd") returned 4 [0047.384] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0047.384] lstrlenW (lpString=".dwg") returned 4 [0047.384] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0047.384] lstrlenW (lpString=".dwt") returned 4 [0047.384] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0047.384] lstrlenW (lpString=".dx") returned 3 [0047.384] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0047.384] lstrlenW (lpString=".dxf") returned 4 [0047.384] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0047.384] lstrlenW (lpString=".edml") returned 5 [0047.384] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0047.385] lstrlenW (lpString=".efd") returned 4 [0047.385] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0047.385] lstrlenW (lpString=".elf") returned 4 [0047.385] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0047.385] lstrlenW (lpString=".emf") returned 4 [0047.385] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0047.385] lstrlenW (lpString=".emz") returned 4 [0047.385] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0047.385] lstrlenW (lpString=".epf") returned 4 [0047.385] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0047.385] lstrlenW (lpString=".eps") returned 4 [0047.385] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0047.385] lstrlenW (lpString=".epsf") returned 5 [0047.385] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0047.385] lstrlenW (lpString=".epsp") returned 5 [0047.385] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0047.385] lstrlenW (lpString=".erf") returned 4 [0047.385] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0047.385] lstrlenW (lpString=".exr") returned 4 [0047.385] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0047.385] lstrlenW (lpString=".f4v") returned 4 [0047.385] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0047.385] lstrlenW (lpString=".fido") returned 5 [0047.386] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0047.386] lstrlenW (lpString=".flm") returned 4 [0047.386] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".flv") returned 4 [0047.386] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".frm") returned 4 [0047.386] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".fxg") returned 4 [0047.386] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".geo") returned 4 [0047.386] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".gif") returned 4 [0047.386] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".grs") returned 4 [0047.386] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".gz") returned 3 [0047.386] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0047.386] lstrlenW (lpString=".h") returned 2 [0047.386] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0047.386] lstrlenW (lpString=".hdr") returned 4 [0047.386] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".hpp") returned 4 [0047.386] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".hta") returned 4 [0047.386] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".htc") returned 4 [0047.386] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".htm") returned 4 [0047.386] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0047.386] lstrlenW (lpString=".html") returned 5 [0047.386] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0047.386] lstrlenW (lpString=".icb") returned 4 [0047.386] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0047.387] lstrlenW (lpString=".ics") returned 4 [0047.387] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0047.387] lstrlenW (lpString=".iff") returned 4 [0047.387] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0047.387] lstrlenW (lpString=".inc") returned 4 [0047.387] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0047.387] lstrlenW (lpString=".indd") returned 5 [0047.387] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0047.387] lstrlenW (lpString=".ini") returned 4 [0047.387] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0047.387] lstrlenW (lpString="desktop.ini") returned 11 [0047.387] lstrlenW (lpString=".wiki") returned 5 [0047.387] lstrcmpiW (lpString1=".wiki", lpString2="p.ini") returned -1 [0047.387] lstrlenW (lpString="desktop.ini") returned 11 [0047.387] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0047.387] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0047.387] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0047.387] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0047.387] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0047.387] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0047.387] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0047.387] lstrcmpiW (lpString1="1Black.exe", lpString2="desktop.ini") returned -1 [0047.387] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0047.387] FindNextFileW (in: hFindFile=0x9c4300, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0047.387] FindClose (in: hFindFile=0x9c4300 | out: hFindFile=0x9c4300) returned 1 [0047.387] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.387] FindNextFileW (in: hFindFile=0x9c32b8, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0047.388] FindClose (in: hFindFile=0x9c32b8 | out: hFindFile=0x9c32b8) returned 1 [0047.388] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38206e0 | out: hHeap=0x8d0000) returned 1 [0047.388] FindNextFileW (in: hFindFile=0x9c3278, lpFindFileData=0x3edfd00 | out: lpFindFileData=0x3edfd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0047.388] lstrlenW (lpString="C:\\Boot") returned 7 [0047.388] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0047.388] lstrlenW (lpString="Boot") returned 4 [0047.388] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0047.388] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x38206e0 [0047.388] lstrlenW (lpString="C:\\Boot") returned 7 [0047.388] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c42c0 [0047.388] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.388] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x2ebf9340, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2ebf9340, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0047.388] lstrlenW (lpString="BCD") returned 3 [0047.388] lstrlenW (lpString=".1cd") returned 4 [0047.388] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".3ds") returned 4 [0047.389] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".3fr") returned 4 [0047.389] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".3g2") returned 4 [0047.389] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".3gp") returned 4 [0047.389] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".7z") returned 3 [0047.389] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0047.389] lstrlenW (lpString=".accda") returned 6 [0047.389] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".accdb") returned 6 [0047.389] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".accdc") returned 6 [0047.389] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".accde") returned 6 [0047.389] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".accdt") returned 6 [0047.389] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".accdw") returned 6 [0047.389] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".adb") returned 4 [0047.389] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".adp") returned 4 [0047.389] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".ai") returned 3 [0047.389] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0047.389] lstrlenW (lpString=".ai3") returned 4 [0047.389] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".ai4") returned 4 [0047.389] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0047.389] lstrlenW (lpString=".ai5") returned 4 [0047.390] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".ai6") returned 4 [0047.390] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".ai7") returned 4 [0047.390] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".ai8") returned 4 [0047.390] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".anim") returned 5 [0047.390] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".arw") returned 4 [0047.390] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".as") returned 3 [0047.390] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0047.390] lstrlenW (lpString=".asa") returned 4 [0047.390] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".asc") returned 4 [0047.390] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".ascx") returned 5 [0047.390] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".asm") returned 4 [0047.390] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".asmx") returned 5 [0047.390] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".asp") returned 4 [0047.390] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".aspx") returned 5 [0047.390] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".asr") returned 4 [0047.390] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".asx") returned 4 [0047.390] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0047.390] lstrlenW (lpString=".avi") returned 4 [0047.390] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".avs") returned 4 [0047.391] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".backup") returned 7 [0047.391] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".bak") returned 4 [0047.391] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".bay") returned 4 [0047.391] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".bd") returned 3 [0047.391] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0047.391] lstrlenW (lpString=".bin") returned 4 [0047.391] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".bmp") returned 4 [0047.391] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".bz2") returned 4 [0047.391] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".c") returned 2 [0047.391] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0047.391] lstrlenW (lpString=".cdr") returned 4 [0047.391] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".cer") returned 4 [0047.391] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".cf") returned 3 [0047.391] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0047.391] lstrlenW (lpString=".cfc") returned 4 [0047.391] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".cfm") returned 4 [0047.391] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".cfml") returned 5 [0047.391] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".cfu") returned 4 [0047.391] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0047.391] lstrlenW (lpString=".chm") returned 4 [0047.391] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".cin") returned 4 [0047.392] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".class") returned 6 [0047.392] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".clx") returned 4 [0047.392] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".config") returned 7 [0047.392] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".cpp") returned 4 [0047.392] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".cr2") returned 4 [0047.392] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".crt") returned 4 [0047.392] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".crw") returned 4 [0047.392] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".cs") returned 3 [0047.392] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0047.392] lstrlenW (lpString=".css") returned 4 [0047.392] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".csv") returned 4 [0047.392] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".cub") returned 4 [0047.392] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".dae") returned 4 [0047.392] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".dat") returned 4 [0047.392] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".db") returned 3 [0047.392] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0047.392] lstrlenW (lpString=".dbf") returned 4 [0047.392] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0047.392] lstrlenW (lpString=".dbx") returned 4 [0047.393] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".dc3") returned 4 [0047.393] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".dcm") returned 4 [0047.393] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".dcr") returned 4 [0047.393] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".der") returned 4 [0047.393] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".dib") returned 4 [0047.393] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".dic") returned 4 [0047.393] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".dif") returned 4 [0047.393] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".divx") returned 5 [0047.393] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".djvu") returned 5 [0047.393] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".dng") returned 4 [0047.393] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".doc") returned 4 [0047.393] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".docm") returned 5 [0047.393] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".docx") returned 5 [0047.393] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".dot") returned 4 [0047.393] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".dotm") returned 5 [0047.393] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0047.393] lstrlenW (lpString=".dotx") returned 5 [0047.393] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".dpx") returned 4 [0047.394] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".dqy") returned 4 [0047.394] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".dsn") returned 4 [0047.394] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".dt") returned 3 [0047.394] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0047.394] lstrlenW (lpString=".dtd") returned 4 [0047.394] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".dwg") returned 4 [0047.394] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".dwt") returned 4 [0047.394] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".dx") returned 3 [0047.394] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0047.394] lstrlenW (lpString=".dxf") returned 4 [0047.394] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".edml") returned 5 [0047.394] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".efd") returned 4 [0047.394] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".elf") returned 4 [0047.394] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".emf") returned 4 [0047.394] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".emz") returned 4 [0047.394] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".epf") returned 4 [0047.394] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".eps") returned 4 [0047.394] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0047.394] lstrlenW (lpString=".epsf") returned 5 [0047.394] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0047.395] lstrlenW (lpString=".epsp") returned 5 [0047.395] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0047.395] lstrlenW (lpString=".erf") returned 4 [0047.395] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0047.395] lstrlenW (lpString=".exr") returned 4 [0047.395] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0047.395] lstrlenW (lpString=".f4v") returned 4 [0047.395] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0047.395] lstrlenW (lpString=".fido") returned 5 [0047.395] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0047.395] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.395] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.395] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.396] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.396] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.396] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0047.396] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.397] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.397] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.397] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.397] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.397] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0047.397] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.398] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.398] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.398] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.398] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.398] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0047.398] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.399] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.399] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.399] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.399] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.399] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0047.399] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.400] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.400] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.400] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.400] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.400] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0047.400] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.401] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.401] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.401] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.401] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.401] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0047.401] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.402] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.402] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.402] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.402] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.402] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0047.402] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.403] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.403] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0047.403] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.403] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.403] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0047.403] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.404] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.404] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.404] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.404] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.404] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0047.404] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.405] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.405] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.405] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.405] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.405] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0047.405] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.406] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.406] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.406] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.406] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.406] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0047.406] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.406] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.406] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.406] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.407] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.407] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0047.407] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.407] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.407] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.408] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.408] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.408] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0047.408] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c5308 [0047.408] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.408] FindNextFileW (in: hFindFile=0x9c5308, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.408] FindClose (in: hFindFile=0x9c5308 | out: hFindFile=0x9c5308) returned 1 [0047.408] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.408] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0047.408] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e80 [0047.409] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.409] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.410] FindClose (in: hFindFile=0x9c2e80 | out: hFindFile=0x9c2e80) returned 1 [0047.410] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.410] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0047.410] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e80 [0047.410] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.410] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.410] FindClose (in: hFindFile=0x9c2e80 | out: hFindFile=0x9c2e80) returned 1 [0047.410] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.410] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0047.410] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e80 [0047.411] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.411] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.411] FindClose (in: hFindFile=0x9c2e80 | out: hFindFile=0x9c2e80) returned 1 [0047.411] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.411] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0047.412] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e80 [0047.412] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.412] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.412] FindClose (in: hFindFile=0x9c2e80 | out: hFindFile=0x9c2e80) returned 1 [0047.412] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.412] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0047.412] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e80 [0047.413] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.413] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.413] FindClose (in: hFindFile=0x9c2e80 | out: hFindFile=0x9c2e80) returned 1 [0047.413] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.413] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0047.413] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e80 [0047.413] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.414] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.414] FindClose (in: hFindFile=0x9c2e80 | out: hFindFile=0x9c2e80) returned 1 [0047.414] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.414] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0047.414] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e80 [0047.473] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.473] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.474] FindClose (in: hFindFile=0x9c2e80 | out: hFindFile=0x9c2e80) returned 1 [0047.474] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.474] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0047.474] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c2e80 [0047.474] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.474] FindNextFileW (in: hFindFile=0x9c2e80, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0047.474] FindClose (in: hFindFile=0x9c2e80 | out: hFindFile=0x9c2e80) returned 1 [0047.474] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38306e8 | out: hHeap=0x8d0000) returned 1 [0047.474] FindNextFileW (in: hFindFile=0x9c42c0, lpFindFileData=0x3edfa84 | out: lpFindFileData=0x3edfa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0047.474] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x9c3028 [0047.575] FindNextFileW (in: hFindFile=0x9c3028, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0047.575] FindNextFileW (in: hFindFile=0x9c3028, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0058.158] FindNextFileW (in: hFindFile=0x3f12148, lpFindFileData=0x3edf58c | out: lpFindFileData=0x3edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x84eac400, ftCreationTime.dwHighDateTime=0x1cabc89, ftLastAccessTime.dwLowDateTime=0x598fccf0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x84eac400, ftLastWriteTime.dwHighDateTime=0x1cabc89, nFileSizeHigh=0x0, nFileSizeLow=0xc119, dwReserved0=0x0, dwReserved1=0x0, cFileName="OSPP.VBS", cAlternateFileName="")) returned 1 [0058.159] lstrcmpiW (lpString1=".1cd", lpString2=".VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".3ds", lpString2=".VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".3fr", lpString2=".VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".3g2", lpString2=".VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".3gp", lpString2=".VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".7z", lpString2="VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".accda", lpString2="PP.VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".accdb", lpString2="PP.VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".accdc", lpString2="PP.VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".accde", lpString2="PP.VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".accdt", lpString2="PP.VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".accdw", lpString2="PP.VBS") returned -1 [0058.159] lstrcmpiW (lpString1=".adb", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".adp", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".ai", lpString2="VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".ai3", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".ai4", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".ai5", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".ai6", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".ai7", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".ai8", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".anim", lpString2="P.VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".arw", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".as", lpString2="VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".asa", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".asc", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".ascx", lpString2="P.VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".asm", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".asmx", lpString2="P.VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".asp", lpString2=".VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".aspx", lpString2="P.VBS") returned -1 [0058.160] lstrcmpiW (lpString1=".asr", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".asx", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".avi", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".avs", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".backup", lpString2="SPP.VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".bak", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".bay", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".bd", lpString2="VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".bin", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".bmp", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".bz2", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".c", lpString2="BS") returned -1 [0058.161] lstrcmpiW (lpString1=".cdr", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".cer", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".cf", lpString2="VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".cfc", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".cfm", lpString2=".VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".cfml", lpString2="P.VBS") returned -1 [0058.161] lstrcmpiW (lpString1=".cfu", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".chm", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".cin", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".class", lpString2="PP.VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".clx", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".config", lpString2="SPP.VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".cpp", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".cr2", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".crt", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".crw", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".cs", lpString2="VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".css", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".csv", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".cub", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".dae", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".dat", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".db", lpString2="VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".dbf", lpString2=".VBS") returned -1 [0058.162] lstrcmpiW (lpString1=".dbx", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dc3", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dcm", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dcr", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".der", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dib", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dic", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dif", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".divx", lpString2="P.VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".djvu", lpString2="P.VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dng", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".doc", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".docm", lpString2="P.VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".docx", lpString2="P.VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dot", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dotm", lpString2="P.VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dotx", lpString2="P.VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dpx", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dqy", lpString2=".VBS") returned -1 [0058.163] lstrcmpiW (lpString1=".dsn", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".dt", lpString2="VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".dtd", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".dwg", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".dwt", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".dx", lpString2="VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".dxf", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".edml", lpString2="P.VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".efd", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".elf", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".emf", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".emz", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".epf", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".eps", lpString2=".VBS") returned -1 [0058.164] lstrcmpiW (lpString1=".epsf", lpString2="P.VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".epsp", lpString2="P.VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".erf", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".exr", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".f4v", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".fido", lpString2="P.VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".flm", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".flv", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".frm", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".fxg", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".geo", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".gif", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".grs", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".gz", lpString2="VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".h", lpString2="BS") returned -1 [0058.165] lstrcmpiW (lpString1=".hdr", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".hpp", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".hta", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".htc", lpString2=".VBS") returned -1 [0058.165] lstrcmpiW (lpString1=".htm", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".html", lpString2="P.VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".icb", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".ics", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".iff", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".inc", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".indd", lpString2="P.VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".ini", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".iqy", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".j2c", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".j2k", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".java", lpString2="P.VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".jp2", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".jpc", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".jpe", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".jpeg", lpString2="P.VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".jpf", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".jpg", lpString2=".VBS") returned -1 [0058.166] lstrcmpiW (lpString1=".jpx", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".js", lpString2="VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".jsf", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".json", lpString2="P.VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".jsp", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".kdc", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".kmz", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".kwm", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".lasso", lpString2="PP.VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".lbi", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".lgf", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".lgp", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".log", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".m1v", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".m4a", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".m4v", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".max", lpString2=".VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".md", lpString2="VBS") returned -1 [0058.167] lstrcmpiW (lpString1=".mda", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mdb", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mde", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mdf", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mdw", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mef", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mft", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mfw", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mht", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mhtml", lpString2="PP.VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mka", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mkidx", lpString2="PP.VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mkv", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mos", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mov", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mp3", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mp4", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mpeg", lpString2="P.VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mpg", lpString2=".VBS") returned -1 [0058.168] lstrcmpiW (lpString1=".mpv", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".mrw", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".msg", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".mxl", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".myd", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".myi", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".nef", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".nrw", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".obj", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".odb", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".odc", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".odm", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".odp", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".ods", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".oft", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".one", lpString2=".VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".onepkg", lpString2="SPP.VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".onetoc2", lpString2="OSPP.VBS") returned -1 [0058.169] lstrcmpiW (lpString1=".opt", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".oqy", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".orf", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".p12", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".p7b", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".p7c", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pam", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pbm", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pct", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pcx", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pdd", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pdf", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pdp", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pef", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pem", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pff", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pfm", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pfx", lpString2=".VBS") returned -1 [0058.170] lstrcmpiW (lpString1=".pgm", lpString2=".VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".php", lpString2=".VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".php3", lpString2="P.VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".php4", lpString2="P.VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".php5", lpString2="P.VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".phtml", lpString2="PP.VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".pict", lpString2="P.VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".pl", lpString2="VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".pls", lpString2=".VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".pm", lpString2="VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".png", lpString2=".VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".pnm", lpString2=".VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".pot", lpString2=".VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".potm", lpString2="P.VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".potx", lpString2="P.VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".ppa", lpString2=".VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".ppam", lpString2="P.VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".ppm", lpString2=".VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".pps", lpString2=".VBS") returned -1 [0058.171] lstrcmpiW (lpString1=".ppsm", lpString2="P.VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".ppt", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".pptm", lpString2="P.VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".pptx", lpString2="P.VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".prn", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".ps", lpString2="VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".psb", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".psd", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".pst", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".ptx", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".pub", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".pwm", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".pxr", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".py", lpString2="VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".qt", lpString2="VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".r3d", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".raf", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".rar", lpString2=".VBS") returned -1 [0058.172] lstrcmpiW (lpString1=".raw", lpString2=".VBS") returned -1 [0058.173] lstrcmpiW (lpString1=".rdf", lpString2=".VBS") returned -1 [0058.173] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x38006d0 [0058.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover") returned 62 [0058.173] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\OutlookAutoDiscover\\*", lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0058.176] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5133d8d0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x70c9f7b0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x70c9f7b0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.177] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xae54e300, ftCreationTime.dwHighDateTime=0x1c6e74b, ftLastAccessTime.dwLowDateTime=0x5133d8d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xae54e300, ftLastWriteTime.dwHighDateTime=0x1c6e74b, nFileSizeHigh=0x0, nFileSizeLow=0x330, dwReserved0=0x0, dwReserved1=0x0, cFileName="AMERITECH.NET.XML", cAlternateFileName="AMERIT~1.XML")) returned 1 [0058.177] lstrlenW (lpString="AMERITECH.NET.XML") returned 17 [0058.177] lstrlenW (lpString=".1cd") returned 4 [0058.179] FindClose (in: hFindFile=0x3f12288 | out: hFindFile=0x3f12288) returned 1 [0058.180] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x38006d0 | out: hHeap=0x8d0000) returned 1 [0058.181] FindNextFileW (in: hFindFile=0x3f12148, lpFindFileData=0x3edf58c | out: lpFindFileData=0x3edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x34af8800, ftCreationTime.dwHighDateTime=0x1caca25, ftLastAccessTime.dwLowDateTime=0x59a53950, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x34af8800, ftLastWriteTime.dwHighDateTime=0x1caca25, nFileSizeHigh=0x0, nFileSizeLow=0x5f190, dwReserved0=0x0, dwReserved1=0x0, cFileName="OUTLPH.DLL", cAlternateFileName="")) returned 1 [0058.181] lstrlenW (lpString="OUTLPH.DLL") returned 10 [0058.181] lstrlenW (lpString=".1cd") returned 4 [0058.181] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0058.181] lstrlenW (lpString=".3ds") returned 4 [0058.181] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0058.181] lstrlenW (lpString=".3fr") returned 4 [0058.181] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0058.181] lstrlenW (lpString=".3g2") returned 4 [0058.181] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0058.181] lstrlenW (lpString=".3gp") returned 4 [0058.181] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0058.181] lstrlenW (lpString=".7z") returned 3 [0058.181] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0058.181] lstrlenW (lpString=".accda") returned 6 [0058.181] lstrcmpiW (lpString1=".accda", lpString2="PH.DLL") returned -1 [0058.181] lstrlenW (lpString=".accdb") returned 6 [0058.181] lstrcmpiW (lpString1=".accdb", lpString2="PH.DLL") returned -1 [0058.181] lstrlenW (lpString=".accdc") returned 6 [0058.181] lstrcmpiW (lpString1=".accdc", lpString2="PH.DLL") returned -1 [0058.181] lstrlenW (lpString=".accde") returned 6 [0058.181] lstrcmpiW (lpString1=".accde", lpString2="PH.DLL") returned -1 [0058.181] lstrlenW (lpString=".accdt") returned 6 [0058.181] lstrcmpiW (lpString1=".accdt", lpString2="PH.DLL") returned -1 [0058.181] lstrlenW (lpString=".accdw") returned 6 [0058.181] lstrcmpiW (lpString1=".accdw", lpString2="PH.DLL") returned -1 [0058.181] lstrlenW (lpString=".adb") returned 4 [0058.181] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0058.181] lstrlenW (lpString=".adp") returned 4 [0058.181] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".ai") returned 3 [0058.182] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0058.182] lstrlenW (lpString=".ai3") returned 4 [0058.182] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".ai4") returned 4 [0058.182] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".ai5") returned 4 [0058.182] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".ai6") returned 4 [0058.182] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".ai7") returned 4 [0058.182] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".ai8") returned 4 [0058.182] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".anim") returned 5 [0058.182] lstrcmpiW (lpString1=".anim", lpString2="H.DLL") returned -1 [0058.182] lstrlenW (lpString=".arw") returned 4 [0058.182] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".as") returned 3 [0058.182] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0058.182] lstrlenW (lpString=".asa") returned 4 [0058.182] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".asc") returned 4 [0058.182] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".ascx") returned 5 [0058.182] lstrcmpiW (lpString1=".ascx", lpString2="H.DLL") returned -1 [0058.182] lstrlenW (lpString=".asm") returned 4 [0058.182] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".asmx") returned 5 [0058.182] lstrcmpiW (lpString1=".asmx", lpString2="H.DLL") returned -1 [0058.182] lstrlenW (lpString=".asp") returned 4 [0058.182] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0058.182] lstrlenW (lpString=".aspx") returned 5 [0058.183] lstrcmpiW (lpString1=".aspx", lpString2="H.DLL") returned -1 [0058.183] lstrlenW (lpString=".asr") returned 4 [0058.183] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".asx") returned 4 [0058.183] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".avi") returned 4 [0058.183] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".avs") returned 4 [0058.183] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".backup") returned 7 [0058.183] lstrcmpiW (lpString1=".backup", lpString2="LPH.DLL") returned -1 [0058.183] lstrlenW (lpString=".bak") returned 4 [0058.183] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".bay") returned 4 [0058.183] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".bd") returned 3 [0058.183] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0058.183] lstrlenW (lpString=".bin") returned 4 [0058.183] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".bmp") returned 4 [0058.183] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".bz2") returned 4 [0058.183] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".c") returned 2 [0058.183] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0058.183] lstrlenW (lpString=".cdr") returned 4 [0058.183] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".cer") returned 4 [0058.183] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".cf") returned 3 [0058.183] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0058.183] lstrlenW (lpString=".cfc") returned 4 [0058.183] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0058.183] lstrlenW (lpString=".cfm") returned 4 [0058.184] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".cfml") returned 5 [0058.184] lstrcmpiW (lpString1=".cfml", lpString2="H.DLL") returned -1 [0058.184] lstrlenW (lpString=".cfu") returned 4 [0058.184] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".chm") returned 4 [0058.184] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".cin") returned 4 [0058.184] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".class") returned 6 [0058.184] lstrcmpiW (lpString1=".class", lpString2="PH.DLL") returned -1 [0058.184] lstrlenW (lpString=".clx") returned 4 [0058.184] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".config") returned 7 [0058.184] lstrcmpiW (lpString1=".config", lpString2="LPH.DLL") returned -1 [0058.184] lstrlenW (lpString=".cpp") returned 4 [0058.184] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".cr2") returned 4 [0058.184] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".crt") returned 4 [0058.184] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".crw") returned 4 [0058.184] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".cs") returned 3 [0058.184] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0058.184] lstrlenW (lpString=".css") returned 4 [0058.184] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".csv") returned 4 [0058.184] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".cub") returned 4 [0058.184] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".dae") returned 4 [0058.184] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0058.184] lstrlenW (lpString=".dat") returned 4 [0058.184] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0058.185] lstrlenW (lpString=".db") returned 3 [0058.185] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0058.185] lstrlenW (lpString=".dbf") returned 4 [0058.185] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0058.185] lstrlenW (lpString=".dbx") returned 4 [0058.185] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0058.185] lstrlenW (lpString=".dc3") returned 4 [0058.185] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0058.185] lstrlenW (lpString=".dcm") returned 4 [0058.185] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0058.185] lstrlenW (lpString=".dcr") returned 4 [0058.185] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0058.185] lstrlenW (lpString=".der") returned 4 [0058.185] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0058.185] lstrlenW (lpString=".dib") returned 4 [0058.185] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0058.185] lstrlenW (lpString=".dic") returned 4 [0058.185] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0058.185] lstrlenW (lpString=".dif") returned 4 [0058.185] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0058.185] lstrlenW (lpString=".divx") returned 5 [0058.185] lstrcmpiW (lpString1=".divx", lpString2="H.DLL") returned -1 [0058.185] lstrlenW (lpString=".djvu") returned 5 [0058.185] lstrcmpiW (lpString1=".djvu", lpString2="H.DLL") returned -1 [0058.185] lstrlenW (lpString=".dng") returned 4 [0058.185] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0058.185] lstrlenW (lpString=".doc") returned 4 [0058.185] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0058.185] lstrlenW (lpString=".docm") returned 5 [0058.185] lstrcmpiW (lpString1=".docm", lpString2="H.DLL") returned -1 [0058.185] lstrlenW (lpString=".docx") returned 5 [0058.185] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0058.185] lstrlenW (lpString=".dot") returned 4 [0058.185] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".dotm") returned 5 [0058.186] lstrcmpiW (lpString1=".dotm", lpString2="H.DLL") returned -1 [0058.186] lstrlenW (lpString=".dotx") returned 5 [0058.186] lstrcmpiW (lpString1=".dotx", lpString2="H.DLL") returned -1 [0058.186] lstrlenW (lpString=".dpx") returned 4 [0058.186] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".dqy") returned 4 [0058.186] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".dsn") returned 4 [0058.186] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".dt") returned 3 [0058.186] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0058.186] lstrlenW (lpString=".dtd") returned 4 [0058.186] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".dwg") returned 4 [0058.186] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".dwt") returned 4 [0058.186] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".dx") returned 3 [0058.186] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0058.186] lstrlenW (lpString=".dxf") returned 4 [0058.186] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".edml") returned 5 [0058.186] lstrcmpiW (lpString1=".edml", lpString2="H.DLL") returned -1 [0058.186] lstrlenW (lpString=".efd") returned 4 [0058.186] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".elf") returned 4 [0058.186] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".emf") returned 4 [0058.186] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".emz") returned 4 [0058.186] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0058.186] lstrlenW (lpString=".epf") returned 4 [0058.187] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".eps") returned 4 [0058.187] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".epsf") returned 5 [0058.187] lstrcmpiW (lpString1=".epsf", lpString2="H.DLL") returned -1 [0058.187] lstrlenW (lpString=".epsp") returned 5 [0058.187] lstrcmpiW (lpString1=".epsp", lpString2="H.DLL") returned -1 [0058.187] lstrlenW (lpString=".erf") returned 4 [0058.187] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".exr") returned 4 [0058.187] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".f4v") returned 4 [0058.187] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".fido") returned 5 [0058.187] lstrcmpiW (lpString1=".fido", lpString2="H.DLL") returned -1 [0058.187] lstrlenW (lpString=".flm") returned 4 [0058.187] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".flv") returned 4 [0058.187] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".frm") returned 4 [0058.187] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".fxg") returned 4 [0058.187] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".geo") returned 4 [0058.187] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".gif") returned 4 [0058.187] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".grs") returned 4 [0058.187] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0058.187] lstrlenW (lpString=".gz") returned 3 [0058.187] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0058.187] lstrlenW (lpString=".h") returned 2 [0058.187] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0058.187] lstrlenW (lpString=".hdr") returned 4 [0058.188] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".hpp") returned 4 [0058.188] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".hta") returned 4 [0058.188] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".htc") returned 4 [0058.188] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".htm") returned 4 [0058.188] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".html") returned 5 [0058.188] lstrcmpiW (lpString1=".html", lpString2="H.DLL") returned -1 [0058.188] lstrlenW (lpString=".icb") returned 4 [0058.188] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".ics") returned 4 [0058.188] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".iff") returned 4 [0058.188] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".inc") returned 4 [0058.188] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".indd") returned 5 [0058.188] lstrcmpiW (lpString1=".indd", lpString2="H.DLL") returned -1 [0058.188] lstrlenW (lpString=".ini") returned 4 [0058.188] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".iqy") returned 4 [0058.188] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".j2c") returned 4 [0058.188] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".j2k") returned 4 [0058.188] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".java") returned 5 [0058.188] lstrcmpiW (lpString1=".java", lpString2="H.DLL") returned -1 [0058.188] lstrlenW (lpString=".jp2") returned 4 [0058.188] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0058.188] lstrlenW (lpString=".jpc") returned 4 [0058.189] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".jpe") returned 4 [0058.189] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".jpeg") returned 5 [0058.189] lstrcmpiW (lpString1=".jpeg", lpString2="H.DLL") returned -1 [0058.189] lstrlenW (lpString=".jpf") returned 4 [0058.189] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".jpg") returned 4 [0058.189] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".jpx") returned 4 [0058.189] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".js") returned 3 [0058.189] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0058.189] lstrlenW (lpString=".jsf") returned 4 [0058.189] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".json") returned 5 [0058.189] lstrcmpiW (lpString1=".json", lpString2="H.DLL") returned -1 [0058.189] lstrlenW (lpString=".jsp") returned 4 [0058.189] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".kdc") returned 4 [0058.189] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".kmz") returned 4 [0058.189] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".kwm") returned 4 [0058.189] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".lasso") returned 6 [0058.189] lstrcmpiW (lpString1=".lasso", lpString2="PH.DLL") returned -1 [0058.189] lstrlenW (lpString=".lbi") returned 4 [0058.189] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".lgf") returned 4 [0058.189] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".lgp") returned 4 [0058.189] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0058.189] lstrlenW (lpString=".log") returned 4 [0058.190] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".m1v") returned 4 [0058.190] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".m4a") returned 4 [0058.190] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".m4v") returned 4 [0058.190] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".max") returned 4 [0058.190] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".md") returned 3 [0058.190] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0058.190] lstrlenW (lpString=".mda") returned 4 [0058.190] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".mdb") returned 4 [0058.190] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".mde") returned 4 [0058.190] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".mdf") returned 4 [0058.190] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".mdw") returned 4 [0058.190] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".mef") returned 4 [0058.190] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".mft") returned 4 [0058.190] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".mfw") returned 4 [0058.190] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".mht") returned 4 [0058.190] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0058.190] lstrlenW (lpString=".mhtml") returned 6 [0058.190] lstrcmpiW (lpString1=".mhtml", lpString2="PH.DLL") returned -1 [0058.190] lstrlenW (lpString=".mka") returned 4 [0058.190] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".mkidx") returned 6 [0058.191] lstrcmpiW (lpString1=".mkidx", lpString2="PH.DLL") returned -1 [0058.191] lstrlenW (lpString=".mkv") returned 4 [0058.191] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".mos") returned 4 [0058.191] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".mov") returned 4 [0058.191] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".mp3") returned 4 [0058.191] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".mp4") returned 4 [0058.191] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".mpeg") returned 5 [0058.191] lstrcmpiW (lpString1=".mpeg", lpString2="H.DLL") returned -1 [0058.191] lstrlenW (lpString=".mpg") returned 4 [0058.191] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".mpv") returned 4 [0058.191] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".mrw") returned 4 [0058.191] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".msg") returned 4 [0058.191] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".mxl") returned 4 [0058.191] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".myd") returned 4 [0058.191] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".myi") returned 4 [0058.191] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".nef") returned 4 [0058.191] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".nrw") returned 4 [0058.191] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0058.191] lstrlenW (lpString=".obj") returned 4 [0058.191] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".odb") returned 4 [0058.192] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".odc") returned 4 [0058.192] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".odm") returned 4 [0058.192] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".odp") returned 4 [0058.192] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".ods") returned 4 [0058.192] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".oft") returned 4 [0058.192] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".one") returned 4 [0058.192] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".onepkg") returned 7 [0058.192] lstrcmpiW (lpString1=".onepkg", lpString2="LPH.DLL") returned -1 [0058.192] lstrlenW (lpString=".onetoc2") returned 8 [0058.192] lstrcmpiW (lpString1=".onetoc2", lpString2="TLPH.DLL") returned -1 [0058.192] lstrlenW (lpString=".opt") returned 4 [0058.192] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".oqy") returned 4 [0058.192] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".orf") returned 4 [0058.192] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".p12") returned 4 [0058.192] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".p7b") returned 4 [0058.192] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".p7c") returned 4 [0058.192] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".pam") returned 4 [0058.192] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0058.192] lstrlenW (lpString=".pbm") returned 4 [0058.192] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pct") returned 4 [0058.193] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pcx") returned 4 [0058.193] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pdd") returned 4 [0058.193] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pdf") returned 4 [0058.193] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pdp") returned 4 [0058.193] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pef") returned 4 [0058.193] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pem") returned 4 [0058.193] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pff") returned 4 [0058.193] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pfm") returned 4 [0058.193] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pfx") returned 4 [0058.193] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".pgm") returned 4 [0058.193] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".php") returned 4 [0058.193] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0058.193] lstrlenW (lpString=".php3") returned 5 [0058.193] lstrcmpiW (lpString1=".php3", lpString2="H.DLL") returned -1 [0058.193] lstrlenW (lpString=".php4") returned 5 [0058.193] lstrcmpiW (lpString1=".php4", lpString2="H.DLL") returned -1 [0058.193] lstrlenW (lpString=".php5") returned 5 [0058.193] lstrcmpiW (lpString1=".php5", lpString2="H.DLL") returned -1 [0058.193] lstrlenW (lpString=".phtml") returned 6 [0058.193] lstrcmpiW (lpString1=".phtml", lpString2="PH.DLL") returned -1 [0058.193] lstrlenW (lpString=".pict") returned 5 [0058.194] lstrcmpiW (lpString1=".pict", lpString2="H.DLL") returned -1 [0058.194] lstrlenW (lpString=".pl") returned 3 [0058.194] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0058.194] lstrlenW (lpString=".pls") returned 4 [0058.194] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0058.194] lstrlenW (lpString=".pm") returned 3 [0058.194] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0058.194] lstrlenW (lpString=".png") returned 4 [0058.194] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0058.194] lstrlenW (lpString=".pnm") returned 4 [0058.194] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0058.194] lstrlenW (lpString=".pot") returned 4 [0058.194] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0058.194] lstrlenW (lpString=".potm") returned 5 [0058.194] lstrcmpiW (lpString1=".potm", lpString2="H.DLL") returned -1 [0058.194] lstrlenW (lpString=".potx") returned 5 [0058.194] lstrcmpiW (lpString1=".potx", lpString2="H.DLL") returned -1 [0058.194] lstrlenW (lpString=".ppa") returned 4 [0058.194] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0058.194] lstrlenW (lpString=".ppam") returned 5 [0058.194] lstrcmpiW (lpString1=".ppam", lpString2="H.DLL") returned -1 [0058.194] lstrlenW (lpString=".ppm") returned 4 [0058.194] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0058.194] lstrlenW (lpString=".pps") returned 4 [0058.194] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0058.194] lstrlenW (lpString=".ppsm") returned 5 [0058.194] lstrcmpiW (lpString1=".ppsm", lpString2="H.DLL") returned -1 [0058.194] lstrlenW (lpString=".ppt") returned 4 [0058.194] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0058.194] lstrlenW (lpString=".pptm") returned 5 [0058.194] lstrcmpiW (lpString1=".pptm", lpString2="H.DLL") returned -1 [0058.194] lstrlenW (lpString=".pptx") returned 5 [0058.194] lstrcmpiW (lpString1=".pptx", lpString2="H.DLL") returned -1 [0058.195] lstrlenW (lpString=".prn") returned 4 [0058.195] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0058.195] lstrlenW (lpString=".ps") returned 3 [0058.195] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0058.195] lstrlenW (lpString=".psb") returned 4 [0058.195] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0058.195] lstrlenW (lpString=".psd") returned 4 [0058.195] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0058.195] lstrlenW (lpString=".pst") returned 4 [0058.195] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0058.195] lstrlenW (lpString=".ptx") returned 4 [0058.195] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0058.195] lstrlenW (lpString=".pub") returned 4 [0058.195] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0058.195] lstrlenW (lpString=".pwm") returned 4 [0058.195] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0058.195] lstrlenW (lpString=".pxr") returned 4 [0058.195] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0058.195] lstrlenW (lpString=".py") returned 3 [0058.195] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0058.195] lstrlenW (lpString=".qt") returned 3 [0058.195] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0058.195] lstrlenW (lpString=".r3d") returned 4 [0058.195] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0058.195] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x38006d0 [0058.195] FindFirstFileW (in: lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\PAGESIZE\\*", lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12288 [0058.318] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x59d27370, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6ce49790, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6ce49790, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0058.319] FindNextFileW (in: hFindFile=0x3f12288, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xb180a100, ftCreationTime.dwHighDateTime=0x1ca10e6, ftLastAccessTime.dwLowDateTime=0x59d27370, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xb180a100, ftLastWriteTime.dwHighDateTime=0x1ca10e6, nFileSizeHigh=0x0, nFileSizeLow=0xfb6, dwReserved0=0x0, dwReserved1=0x0, cFileName="PGLBL001.XML", cAlternateFileName="")) returned 1 [0060.821] FindNextFileW (in: hFindFile=0x3f12348, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x81f24da0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0x81f971c0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x81f971c0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0060.821] FindNextFileW (in: hFindFile=0x3f12348, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9c36ae00, ftCreationTime.dwHighDateTime=0x1cb84b4, ftLastAccessTime.dwLowDateTime=0x81f24da0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0x9c36ae00, ftLastWriteTime.dwHighDateTime=0x1cb84b4, nFileSizeHigh=0x0, nFileSizeLow=0x9586, dwReserved0=0x0, dwReserved1=0x0, cFileName="DEXShare.asfx", cAlternateFileName="DEXSHA~1.ASF")) returned 1 [0067.358] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x8012b5d2, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x1eab37af, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.508] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x3edf808 | out: lpFindFileData=0x3edf808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0067.561] FindFirstFileW (in: lpFileName="C:\\Program Files (x86)\\Windows Sidebar\\en-US\\*", lpFindFileData=0x3edf58c | out: lpFindFileData=0x3edf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12188 [0067.568] FindNextFileW (in: hFindFile=0x3f12188, lpFindFileData=0x3edf58c | out: lpFindFileData=0x3edf58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x1eab37af, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x229eba17, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1eab37af, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0067.590] FindNextFileW (in: hFindFile=0x3f12188, lpFindFileData=0x3edf58c | out: lpFindFileData=0x3edf58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1193665a, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x11c7e240, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x1193665a, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x800, dwReserved0=0x0, dwReserved1=0x0, cFileName="sbdrop.dll.mui", cAlternateFileName="")) returned 1 [0068.131] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\*", lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12108 [0068.131] FindNextFileW (in: hFindFile=0x3f12108, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81caf400, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x8246bb80, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.131] FindNextFileW (in: hFindFile=0x3f12108, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Accessibility", cAlternateFileName="ACCESS~1")) returned 1 [0068.285] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\Accessibility\\*", lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12188 [0068.285] FindNextFileW (in: hFindFile=0x3f12188, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x89bce0a9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.285] FindNextFileW (in: hFindFile=0x3f12188, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xec0a7698, ftCreationTime.dwHighDateTime=0x1ca042b, ftLastAccessTime.dwLowDateTime=0xec0a7698, ftLastAccessTime.dwHighDateTime=0x1ca042b, ftLastWriteTime.dwLowDateTime=0x89bf4209, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x172, dwReserved0=0x0, dwReserved1=0x0, cFileName="Desktop.ini", cAlternateFileName="")) returned 1 [0068.285] FindClose (in: hFindFile=0x3f12188 | out: hFindFile=0x3f12188) returned 1 [0068.285] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f554a0 | out: hHeap=0x8d0000) returned 1 [0068.285] FindNextFileW (in: hFindFile=0x3f12108, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e3e9c58, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e3e9c58, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e435f19, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4ce, dwReserved0=0x0, dwReserved1=0x0, cFileName="Calculator.lnk", cAlternateFileName="CALCUL~1.LNK")) returned 1 [0068.285] lstrlenW (lpString="Calculator.lnk") returned 14 [0068.285] lstrlenW (lpString=".1cd") returned 4 [0068.285] lstrcmpiW (lpString1=".1cd", lpString2=".lnk") returned -1 [0068.285] lstrlenW (lpString=".3ds") returned 4 [0068.285] lstrcmpiW (lpString1=".3ds", lpString2=".lnk") returned -1 [0068.286] lstrlenW (lpString=".3fr") returned 4 [0068.286] lstrcmpiW (lpString1=".3fr", lpString2=".lnk") returned -1 [0068.286] lstrlenW (lpString=".3g2") returned 4 [0068.286] lstrcmpiW (lpString1=".3g2", lpString2=".lnk") returned -1 [0068.286] lstrlenW (lpString=".3gp") returned 4 [0068.286] lstrcmpiW (lpString1=".3gp", lpString2=".lnk") returned -1 [0068.286] lstrlenW (lpString=".7z") returned 3 [0068.286] lstrcmpiW (lpString1=".7z", lpString2="lnk") returned -1 [0068.286] lstrlenW (lpString=".accda") returned 6 [0068.286] lstrcmpiW (lpString1=".accda", lpString2="or.lnk") returned -1 [0068.286] lstrlenW (lpString=".accdb") returned 6 [0068.286] lstrcmpiW (lpString1=".accdb", lpString2="or.lnk") returned -1 [0068.286] lstrlenW (lpString=".accdc") returned 6 [0068.286] lstrcmpiW (lpString1=".accdc", lpString2="or.lnk") returned -1 [0068.286] lstrlenW (lpString=".accde") returned 6 [0068.286] lstrcmpiW (lpString1=".accde", lpString2="or.lnk") returned -1 [0068.286] lstrlenW (lpString=".accdt") returned 6 [0068.286] lstrcmpiW (lpString1=".accdt", lpString2="or.lnk") returned -1 [0068.286] lstrlenW (lpString=".accdw") returned 6 [0068.286] lstrcmpiW (lpString1=".accdw", lpString2="or.lnk") returned -1 [0068.286] lstrlenW (lpString=".adb") returned 4 [0068.286] lstrcmpiW (lpString1=".adb", lpString2=".lnk") returned -1 [0068.286] lstrlenW (lpString=".adp") returned 4 [0068.286] lstrcmpiW (lpString1=".adp", lpString2=".lnk") returned -1 [0068.286] lstrlenW (lpString=".ai") returned 3 [0068.286] lstrcmpiW (lpString1=".ai", lpString2="lnk") returned -1 [0068.286] lstrlenW (lpString=".ai3") returned 4 [0068.286] lstrcmpiW (lpString1=".ai3", lpString2=".lnk") returned -1 [0068.286] lstrlenW (lpString=".ai4") returned 4 [0068.286] lstrcmpiW (lpString1=".ai4", lpString2=".lnk") returned -1 [0068.286] lstrlenW (lpString=".ai5") returned 4 [0068.286] lstrcmpiW (lpString1=".ai5", lpString2=".lnk") returned -1 [0068.286] lstrlenW (lpString=".ai6") returned 4 [0068.287] lstrcmpiW (lpString1=".ai6", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".ai7") returned 4 [0068.287] lstrcmpiW (lpString1=".ai7", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".ai8") returned 4 [0068.287] lstrcmpiW (lpString1=".ai8", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".anim") returned 5 [0068.287] lstrcmpiW (lpString1=".anim", lpString2="r.lnk") returned -1 [0068.287] lstrlenW (lpString=".arw") returned 4 [0068.287] lstrcmpiW (lpString1=".arw", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".as") returned 3 [0068.287] lstrcmpiW (lpString1=".as", lpString2="lnk") returned -1 [0068.287] lstrlenW (lpString=".asa") returned 4 [0068.287] lstrcmpiW (lpString1=".asa", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".asc") returned 4 [0068.287] lstrcmpiW (lpString1=".asc", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".ascx") returned 5 [0068.287] lstrcmpiW (lpString1=".ascx", lpString2="r.lnk") returned -1 [0068.287] lstrlenW (lpString=".asm") returned 4 [0068.287] lstrcmpiW (lpString1=".asm", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".asmx") returned 5 [0068.287] lstrcmpiW (lpString1=".asmx", lpString2="r.lnk") returned -1 [0068.287] lstrlenW (lpString=".asp") returned 4 [0068.287] lstrcmpiW (lpString1=".asp", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".aspx") returned 5 [0068.287] lstrcmpiW (lpString1=".aspx", lpString2="r.lnk") returned -1 [0068.287] lstrlenW (lpString=".asr") returned 4 [0068.287] lstrcmpiW (lpString1=".asr", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".asx") returned 4 [0068.287] lstrcmpiW (lpString1=".asx", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".avi") returned 4 [0068.287] lstrcmpiW (lpString1=".avi", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".avs") returned 4 [0068.287] lstrcmpiW (lpString1=".avs", lpString2=".lnk") returned -1 [0068.287] lstrlenW (lpString=".backup") returned 7 [0068.287] lstrcmpiW (lpString1=".backup", lpString2="tor.lnk") returned -1 [0068.288] lstrlenW (lpString=".bak") returned 4 [0068.288] lstrcmpiW (lpString1=".bak", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".bay") returned 4 [0068.288] lstrcmpiW (lpString1=".bay", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".bd") returned 3 [0068.288] lstrcmpiW (lpString1=".bd", lpString2="lnk") returned -1 [0068.288] lstrlenW (lpString=".bin") returned 4 [0068.288] lstrcmpiW (lpString1=".bin", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".bmp") returned 4 [0068.288] lstrcmpiW (lpString1=".bmp", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".bz2") returned 4 [0068.288] lstrcmpiW (lpString1=".bz2", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".c") returned 2 [0068.288] lstrcmpiW (lpString1=".c", lpString2="nk") returned -1 [0068.288] lstrlenW (lpString=".cdr") returned 4 [0068.288] lstrcmpiW (lpString1=".cdr", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".cer") returned 4 [0068.288] lstrcmpiW (lpString1=".cer", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".cf") returned 3 [0068.288] lstrcmpiW (lpString1=".cf", lpString2="lnk") returned -1 [0068.288] lstrlenW (lpString=".cfc") returned 4 [0068.288] lstrcmpiW (lpString1=".cfc", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".cfm") returned 4 [0068.288] lstrcmpiW (lpString1=".cfm", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".cfml") returned 5 [0068.288] lstrcmpiW (lpString1=".cfml", lpString2="r.lnk") returned -1 [0068.288] lstrlenW (lpString=".cfu") returned 4 [0068.288] lstrcmpiW (lpString1=".cfu", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".chm") returned 4 [0068.288] lstrcmpiW (lpString1=".chm", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".cin") returned 4 [0068.288] lstrcmpiW (lpString1=".cin", lpString2=".lnk") returned -1 [0068.288] lstrlenW (lpString=".class") returned 6 [0068.288] lstrcmpiW (lpString1=".class", lpString2="or.lnk") returned -1 [0068.289] lstrlenW (lpString=".clx") returned 4 [0068.289] lstrcmpiW (lpString1=".clx", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".config") returned 7 [0068.289] lstrcmpiW (lpString1=".config", lpString2="tor.lnk") returned -1 [0068.289] lstrlenW (lpString=".cpp") returned 4 [0068.289] lstrcmpiW (lpString1=".cpp", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".cr2") returned 4 [0068.289] lstrcmpiW (lpString1=".cr2", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".crt") returned 4 [0068.289] lstrcmpiW (lpString1=".crt", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".crw") returned 4 [0068.289] lstrcmpiW (lpString1=".crw", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".cs") returned 3 [0068.289] lstrcmpiW (lpString1=".cs", lpString2="lnk") returned -1 [0068.289] lstrlenW (lpString=".css") returned 4 [0068.289] lstrcmpiW (lpString1=".css", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".csv") returned 4 [0068.289] lstrcmpiW (lpString1=".csv", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".cub") returned 4 [0068.289] lstrcmpiW (lpString1=".cub", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".dae") returned 4 [0068.289] lstrcmpiW (lpString1=".dae", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".dat") returned 4 [0068.289] lstrcmpiW (lpString1=".dat", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".db") returned 3 [0068.289] lstrcmpiW (lpString1=".db", lpString2="lnk") returned -1 [0068.289] lstrlenW (lpString=".dbf") returned 4 [0068.289] lstrcmpiW (lpString1=".dbf", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".dbx") returned 4 [0068.289] lstrcmpiW (lpString1=".dbx", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".dc3") returned 4 [0068.289] lstrcmpiW (lpString1=".dc3", lpString2=".lnk") returned -1 [0068.289] lstrlenW (lpString=".dcm") returned 4 [0068.290] lstrcmpiW (lpString1=".dcm", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".dcr") returned 4 [0068.290] lstrcmpiW (lpString1=".dcr", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".der") returned 4 [0068.290] lstrcmpiW (lpString1=".der", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".dib") returned 4 [0068.290] lstrcmpiW (lpString1=".dib", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".dic") returned 4 [0068.290] lstrcmpiW (lpString1=".dic", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".dif") returned 4 [0068.290] lstrcmpiW (lpString1=".dif", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".divx") returned 5 [0068.290] lstrcmpiW (lpString1=".divx", lpString2="r.lnk") returned -1 [0068.290] lstrlenW (lpString=".djvu") returned 5 [0068.290] lstrcmpiW (lpString1=".djvu", lpString2="r.lnk") returned -1 [0068.290] lstrlenW (lpString=".dng") returned 4 [0068.290] lstrcmpiW (lpString1=".dng", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".doc") returned 4 [0068.290] lstrcmpiW (lpString1=".doc", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".docm") returned 5 [0068.290] lstrcmpiW (lpString1=".docm", lpString2="r.lnk") returned -1 [0068.290] lstrlenW (lpString=".docx") returned 5 [0068.290] lstrcmpiW (lpString1=".docx", lpString2="r.lnk") returned -1 [0068.290] lstrlenW (lpString=".dot") returned 4 [0068.290] lstrcmpiW (lpString1=".dot", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".dotm") returned 5 [0068.290] lstrcmpiW (lpString1=".dotm", lpString2="r.lnk") returned -1 [0068.290] lstrlenW (lpString=".dotx") returned 5 [0068.290] lstrcmpiW (lpString1=".dotx", lpString2="r.lnk") returned -1 [0068.290] lstrlenW (lpString=".dpx") returned 4 [0068.290] lstrcmpiW (lpString1=".dpx", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".dqy") returned 4 [0068.290] lstrcmpiW (lpString1=".dqy", lpString2=".lnk") returned -1 [0068.290] lstrlenW (lpString=".dsn") returned 4 [0068.291] lstrcmpiW (lpString1=".dsn", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".dt") returned 3 [0068.291] lstrcmpiW (lpString1=".dt", lpString2="lnk") returned -1 [0068.291] lstrlenW (lpString=".dtd") returned 4 [0068.291] lstrcmpiW (lpString1=".dtd", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".dwg") returned 4 [0068.291] lstrcmpiW (lpString1=".dwg", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".dwt") returned 4 [0068.291] lstrcmpiW (lpString1=".dwt", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".dx") returned 3 [0068.291] lstrcmpiW (lpString1=".dx", lpString2="lnk") returned -1 [0068.291] lstrlenW (lpString=".dxf") returned 4 [0068.291] lstrcmpiW (lpString1=".dxf", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".edml") returned 5 [0068.291] lstrcmpiW (lpString1=".edml", lpString2="r.lnk") returned -1 [0068.291] lstrlenW (lpString=".efd") returned 4 [0068.291] lstrcmpiW (lpString1=".efd", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".elf") returned 4 [0068.291] lstrcmpiW (lpString1=".elf", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".emf") returned 4 [0068.291] lstrcmpiW (lpString1=".emf", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".emz") returned 4 [0068.291] lstrcmpiW (lpString1=".emz", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".epf") returned 4 [0068.291] lstrcmpiW (lpString1=".epf", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".eps") returned 4 [0068.291] lstrcmpiW (lpString1=".eps", lpString2=".lnk") returned -1 [0068.291] lstrlenW (lpString=".epsf") returned 5 [0068.291] lstrcmpiW (lpString1=".epsf", lpString2="r.lnk") returned -1 [0068.291] lstrlenW (lpString=".epsp") returned 5 [0068.291] lstrcmpiW (lpString1=".epsp", lpString2="r.lnk") returned -1 [0068.291] lstrlenW (lpString=".erf") returned 4 [0068.291] lstrcmpiW (lpString1=".erf", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".exr") returned 4 [0068.292] lstrcmpiW (lpString1=".exr", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".f4v") returned 4 [0068.292] lstrcmpiW (lpString1=".f4v", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".fido") returned 5 [0068.292] lstrcmpiW (lpString1=".fido", lpString2="r.lnk") returned -1 [0068.292] lstrlenW (lpString=".flm") returned 4 [0068.292] lstrcmpiW (lpString1=".flm", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".flv") returned 4 [0068.292] lstrcmpiW (lpString1=".flv", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".frm") returned 4 [0068.292] lstrcmpiW (lpString1=".frm", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".fxg") returned 4 [0068.292] lstrcmpiW (lpString1=".fxg", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".geo") returned 4 [0068.292] lstrcmpiW (lpString1=".geo", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".gif") returned 4 [0068.292] lstrcmpiW (lpString1=".gif", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".grs") returned 4 [0068.292] lstrcmpiW (lpString1=".grs", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".gz") returned 3 [0068.292] lstrcmpiW (lpString1=".gz", lpString2="lnk") returned -1 [0068.292] lstrlenW (lpString=".h") returned 2 [0068.292] lstrcmpiW (lpString1=".h", lpString2="nk") returned -1 [0068.292] lstrlenW (lpString=".hdr") returned 4 [0068.292] lstrcmpiW (lpString1=".hdr", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".hpp") returned 4 [0068.292] lstrcmpiW (lpString1=".hpp", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".hta") returned 4 [0068.292] lstrcmpiW (lpString1=".hta", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".htc") returned 4 [0068.292] lstrcmpiW (lpString1=".htc", lpString2=".lnk") returned -1 [0068.292] lstrlenW (lpString=".htm") returned 4 [0068.292] lstrcmpiW (lpString1=".htm", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".html") returned 5 [0068.293] lstrcmpiW (lpString1=".html", lpString2="r.lnk") returned -1 [0068.293] lstrlenW (lpString=".icb") returned 4 [0068.293] lstrcmpiW (lpString1=".icb", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".ics") returned 4 [0068.293] lstrcmpiW (lpString1=".ics", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".iff") returned 4 [0068.293] lstrcmpiW (lpString1=".iff", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".inc") returned 4 [0068.293] lstrcmpiW (lpString1=".inc", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".indd") returned 5 [0068.293] lstrcmpiW (lpString1=".indd", lpString2="r.lnk") returned -1 [0068.293] lstrlenW (lpString=".ini") returned 4 [0068.293] lstrcmpiW (lpString1=".ini", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".iqy") returned 4 [0068.293] lstrcmpiW (lpString1=".iqy", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".j2c") returned 4 [0068.293] lstrcmpiW (lpString1=".j2c", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".j2k") returned 4 [0068.293] lstrcmpiW (lpString1=".j2k", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".java") returned 5 [0068.293] lstrcmpiW (lpString1=".java", lpString2="r.lnk") returned -1 [0068.293] lstrlenW (lpString=".jp2") returned 4 [0068.293] lstrcmpiW (lpString1=".jp2", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".jpc") returned 4 [0068.293] lstrcmpiW (lpString1=".jpc", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".jpe") returned 4 [0068.293] lstrcmpiW (lpString1=".jpe", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".jpeg") returned 5 [0068.293] lstrcmpiW (lpString1=".jpeg", lpString2="r.lnk") returned -1 [0068.293] lstrlenW (lpString=".jpf") returned 4 [0068.293] lstrcmpiW (lpString1=".jpf", lpString2=".lnk") returned -1 [0068.293] lstrlenW (lpString=".jpg") returned 4 [0068.293] lstrcmpiW (lpString1=".jpg", lpString2=".lnk") returned -1 [0068.294] lstrlenW (lpString=".jpx") returned 4 [0068.294] lstrcmpiW (lpString1=".jpx", lpString2=".lnk") returned -1 [0068.294] lstrlenW (lpString=".js") returned 3 [0068.294] lstrcmpiW (lpString1=".js", lpString2="lnk") returned -1 [0068.294] lstrlenW (lpString=".jsf") returned 4 [0068.294] lstrcmpiW (lpString1=".jsf", lpString2=".lnk") returned -1 [0068.294] lstrlenW (lpString=".json") returned 5 [0068.294] lstrcmpiW (lpString1=".json", lpString2="r.lnk") returned -1 [0068.294] lstrlenW (lpString=".jsp") returned 4 [0068.294] lstrcmpiW (lpString1=".jsp", lpString2=".lnk") returned -1 [0068.294] lstrlenW (lpString=".kdc") returned 4 [0068.294] lstrcmpiW (lpString1=".kdc", lpString2=".lnk") returned -1 [0068.294] lstrlenW (lpString=".kmz") returned 4 [0068.294] lstrcmpiW (lpString1=".kmz", lpString2=".lnk") returned -1 [0068.294] lstrlenW (lpString=".kwm") returned 4 [0068.294] lstrcmpiW (lpString1=".kwm", lpString2=".lnk") returned -1 [0068.294] lstrlenW (lpString=".lasso") returned 6 [0068.294] lstrcmpiW (lpString1=".lasso", lpString2="or.lnk") returned -1 [0068.294] lstrlenW (lpString=".lbi") returned 4 [0068.294] lstrcmpiW (lpString1=".lbi", lpString2=".lnk") returned -1 [0068.294] lstrlenW (lpString=".lgf") returned 4 [0068.294] lstrcmpiW (lpString1=".lgf", lpString2=".lnk") returned -1 [0068.294] lstrlenW (lpString=".lgp") returned 4 [0068.294] lstrcmpiW (lpString1=".lgp", lpString2=".lnk") returned -1 [0068.294] lstrlenW (lpString=".log") returned 4 [0068.294] lstrcmpiW (lpString1=".log", lpString2=".lnk") returned 1 [0068.294] lstrlenW (lpString=".m1v") returned 4 [0068.294] lstrcmpiW (lpString1=".m1v", lpString2=".lnk") returned 1 [0068.294] lstrlenW (lpString=".m4a") returned 4 [0068.294] lstrcmpiW (lpString1=".m4a", lpString2=".lnk") returned 1 [0068.294] lstrlenW (lpString=".m4v") returned 4 [0068.294] lstrcmpiW (lpString1=".m4v", lpString2=".lnk") returned 1 [0068.294] lstrlenW (lpString=".max") returned 4 [0068.294] lstrcmpiW (lpString1=".max", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".md") returned 3 [0068.295] lstrcmpiW (lpString1=".md", lpString2="lnk") returned -1 [0068.295] lstrlenW (lpString=".mda") returned 4 [0068.295] lstrcmpiW (lpString1=".mda", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mdb") returned 4 [0068.295] lstrcmpiW (lpString1=".mdb", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mde") returned 4 [0068.295] lstrcmpiW (lpString1=".mde", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mdf") returned 4 [0068.295] lstrcmpiW (lpString1=".mdf", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mdw") returned 4 [0068.295] lstrcmpiW (lpString1=".mdw", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mef") returned 4 [0068.295] lstrcmpiW (lpString1=".mef", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mft") returned 4 [0068.295] lstrcmpiW (lpString1=".mft", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mfw") returned 4 [0068.295] lstrcmpiW (lpString1=".mfw", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mht") returned 4 [0068.295] lstrcmpiW (lpString1=".mht", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mhtml") returned 6 [0068.295] lstrcmpiW (lpString1=".mhtml", lpString2="or.lnk") returned -1 [0068.295] lstrlenW (lpString=".mka") returned 4 [0068.295] lstrcmpiW (lpString1=".mka", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mkidx") returned 6 [0068.295] lstrcmpiW (lpString1=".mkidx", lpString2="or.lnk") returned -1 [0068.295] lstrlenW (lpString=".mkv") returned 4 [0068.295] lstrcmpiW (lpString1=".mkv", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mos") returned 4 [0068.295] lstrcmpiW (lpString1=".mos", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mov") returned 4 [0068.295] lstrcmpiW (lpString1=".mov", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mp3") returned 4 [0068.295] lstrcmpiW (lpString1=".mp3", lpString2=".lnk") returned 1 [0068.295] lstrlenW (lpString=".mp4") returned 4 [0068.296] lstrcmpiW (lpString1=".mp4", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".mpeg") returned 5 [0068.296] lstrcmpiW (lpString1=".mpeg", lpString2="r.lnk") returned -1 [0068.296] lstrlenW (lpString=".mpg") returned 4 [0068.296] lstrcmpiW (lpString1=".mpg", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".mpv") returned 4 [0068.296] lstrcmpiW (lpString1=".mpv", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".mrw") returned 4 [0068.296] lstrcmpiW (lpString1=".mrw", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".msg") returned 4 [0068.296] lstrcmpiW (lpString1=".msg", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".mxl") returned 4 [0068.296] lstrcmpiW (lpString1=".mxl", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".myd") returned 4 [0068.296] lstrcmpiW (lpString1=".myd", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".myi") returned 4 [0068.296] lstrcmpiW (lpString1=".myi", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".nef") returned 4 [0068.296] lstrcmpiW (lpString1=".nef", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".nrw") returned 4 [0068.296] lstrcmpiW (lpString1=".nrw", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".obj") returned 4 [0068.296] lstrcmpiW (lpString1=".obj", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".odb") returned 4 [0068.296] lstrcmpiW (lpString1=".odb", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".odc") returned 4 [0068.296] lstrcmpiW (lpString1=".odc", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".odm") returned 4 [0068.296] lstrcmpiW (lpString1=".odm", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".odp") returned 4 [0068.296] lstrcmpiW (lpString1=".odp", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".ods") returned 4 [0068.296] lstrcmpiW (lpString1=".ods", lpString2=".lnk") returned 1 [0068.296] lstrlenW (lpString=".oft") returned 4 [0068.297] lstrcmpiW (lpString1=".oft", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".one") returned 4 [0068.297] lstrcmpiW (lpString1=".one", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".onepkg") returned 7 [0068.297] lstrcmpiW (lpString1=".onepkg", lpString2="tor.lnk") returned -1 [0068.297] lstrlenW (lpString=".onetoc2") returned 8 [0068.297] lstrcmpiW (lpString1=".onetoc2", lpString2="ator.lnk") returned -1 [0068.297] lstrlenW (lpString=".opt") returned 4 [0068.297] lstrcmpiW (lpString1=".opt", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".oqy") returned 4 [0068.297] lstrcmpiW (lpString1=".oqy", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".orf") returned 4 [0068.297] lstrcmpiW (lpString1=".orf", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".p12") returned 4 [0068.297] lstrcmpiW (lpString1=".p12", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".p7b") returned 4 [0068.297] lstrcmpiW (lpString1=".p7b", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".p7c") returned 4 [0068.297] lstrcmpiW (lpString1=".p7c", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".pam") returned 4 [0068.297] lstrcmpiW (lpString1=".pam", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".pbm") returned 4 [0068.297] lstrcmpiW (lpString1=".pbm", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".pct") returned 4 [0068.297] lstrcmpiW (lpString1=".pct", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".pcx") returned 4 [0068.297] lstrcmpiW (lpString1=".pcx", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".pdd") returned 4 [0068.297] lstrcmpiW (lpString1=".pdd", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".pdf") returned 4 [0068.297] lstrcmpiW (lpString1=".pdf", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".pdp") returned 4 [0068.297] lstrcmpiW (lpString1=".pdp", lpString2=".lnk") returned 1 [0068.297] lstrlenW (lpString=".pef") returned 4 [0068.298] lstrcmpiW (lpString1=".pef", lpString2=".lnk") returned 1 [0068.298] lstrlenW (lpString=".pem") returned 4 [0068.298] lstrcmpiW (lpString1=".pem", lpString2=".lnk") returned 1 [0068.298] lstrlenW (lpString=".pff") returned 4 [0068.298] lstrcmpiW (lpString1=".pff", lpString2=".lnk") returned 1 [0068.298] lstrlenW (lpString=".pfm") returned 4 [0068.298] lstrcmpiW (lpString1=".pfm", lpString2=".lnk") returned 1 [0068.298] lstrlenW (lpString=".pfx") returned 4 [0068.298] lstrcmpiW (lpString1=".pfx", lpString2=".lnk") returned 1 [0068.298] lstrlenW (lpString=".pgm") returned 4 [0068.298] lstrcmpiW (lpString1=".pgm", lpString2=".lnk") returned 1 [0068.298] lstrlenW (lpString=".php") returned 4 [0068.298] lstrcmpiW (lpString1=".php", lpString2=".lnk") returned 1 [0068.298] lstrlenW (lpString=".php3") returned 5 [0068.298] lstrcmpiW (lpString1=".php3", lpString2="r.lnk") returned -1 [0068.298] lstrlenW (lpString=".php4") returned 5 [0068.298] lstrcmpiW (lpString1=".php4", lpString2="r.lnk") returned -1 [0068.298] lstrlenW (lpString=".php5") returned 5 [0068.298] lstrcmpiW (lpString1=".php5", lpString2="r.lnk") returned -1 [0068.298] lstrlenW (lpString=".phtml") returned 6 [0068.298] lstrcmpiW (lpString1=".phtml", lpString2="or.lnk") returned -1 [0068.298] lstrlenW (lpString=".pict") returned 5 [0068.298] lstrcmpiW (lpString1=".pict", lpString2="r.lnk") returned -1 [0068.298] lstrlenW (lpString=".pl") returned 3 [0068.298] lstrcmpiW (lpString1=".pl", lpString2="lnk") returned -1 [0068.298] lstrlenW (lpString=".pls") returned 4 [0068.298] lstrcmpiW (lpString1=".pls", lpString2=".lnk") returned 1 [0068.298] lstrlenW (lpString=".pm") returned 3 [0068.298] lstrcmpiW (lpString1=".pm", lpString2="lnk") returned -1 [0068.298] lstrlenW (lpString=".png") returned 4 [0068.298] lstrcmpiW (lpString1=".png", lpString2=".lnk") returned 1 [0068.298] lstrlenW (lpString=".pnm") returned 4 [0068.298] lstrcmpiW (lpString1=".pnm", lpString2=".lnk") returned 1 [0068.298] lstrlenW (lpString=".pot") returned 4 [0068.299] lstrcmpiW (lpString1=".pot", lpString2=".lnk") returned 1 [0068.299] lstrlenW (lpString=".potm") returned 5 [0068.299] lstrcmpiW (lpString1=".potm", lpString2="r.lnk") returned -1 [0068.299] lstrlenW (lpString=".potx") returned 5 [0068.299] lstrcmpiW (lpString1=".potx", lpString2="r.lnk") returned -1 [0068.299] lstrlenW (lpString=".ppa") returned 4 [0068.299] lstrcmpiW (lpString1=".ppa", lpString2=".lnk") returned 1 [0068.299] lstrlenW (lpString=".ppam") returned 5 [0068.299] lstrcmpiW (lpString1=".ppam", lpString2="r.lnk") returned -1 [0068.299] lstrlenW (lpString=".ppm") returned 4 [0068.299] lstrcmpiW (lpString1=".ppm", lpString2=".lnk") returned 1 [0068.299] lstrlenW (lpString=".pps") returned 4 [0068.299] lstrcmpiW (lpString1=".pps", lpString2=".lnk") returned 1 [0068.299] lstrlenW (lpString=".ppsm") returned 5 [0068.299] lstrcmpiW (lpString1=".ppsm", lpString2="r.lnk") returned -1 [0068.299] lstrlenW (lpString=".ppt") returned 4 [0068.299] lstrcmpiW (lpString1=".ppt", lpString2=".lnk") returned 1 [0068.299] lstrlenW (lpString=".pptm") returned 5 [0068.299] lstrcmpiW (lpString1=".pptm", lpString2="r.lnk") returned -1 [0068.299] lstrlenW (lpString=".pptx") returned 5 [0068.299] lstrcmpiW (lpString1=".pptx", lpString2="r.lnk") returned -1 [0068.299] lstrlenW (lpString=".prn") returned 4 [0068.299] lstrcmpiW (lpString1=".prn", lpString2=".lnk") returned 1 [0068.299] lstrlenW (lpString=".ps") returned 3 [0068.299] lstrcmpiW (lpString1=".ps", lpString2="lnk") returned -1 [0068.299] lstrlenW (lpString=".psb") returned 4 [0068.299] lstrcmpiW (lpString1=".psb", lpString2=".lnk") returned 1 [0068.299] lstrlenW (lpString=".psd") returned 4 [0068.299] lstrcmpiW (lpString1=".psd", lpString2=".lnk") returned 1 [0068.299] lstrlenW (lpString=".pst") returned 4 [0068.299] lstrcmpiW (lpString1=".pst", lpString2=".lnk") returned 1 [0068.299] lstrlenW (lpString=".ptx") returned 4 [0068.299] lstrcmpiW (lpString1=".ptx", lpString2=".lnk") returned 1 [0068.299] lstrlenW (lpString=".pub") returned 4 [0068.300] lstrcmpiW (lpString1=".pub", lpString2=".lnk") returned 1 [0068.300] lstrlenW (lpString=".pwm") returned 4 [0068.300] lstrcmpiW (lpString1=".pwm", lpString2=".lnk") returned 1 [0068.300] lstrlenW (lpString=".pxr") returned 4 [0068.300] lstrcmpiW (lpString1=".pxr", lpString2=".lnk") returned 1 [0068.300] lstrlenW (lpString=".py") returned 3 [0068.300] lstrcmpiW (lpString1=".py", lpString2="lnk") returned -1 [0068.300] lstrlenW (lpString=".qt") returned 3 [0068.300] lstrcmpiW (lpString1=".qt", lpString2="lnk") returned -1 [0068.300] lstrlenW (lpString=".r3d") returned 4 [0068.300] lstrcmpiW (lpString1=".r3d", lpString2=".lnk") returned 1 [0068.300] lstrlenW (lpString=".raf") returned 4 [0068.300] lstrcmpiW (lpString1=".raf", lpString2=".lnk") returned 1 [0068.300] lstrlenW (lpString=".rar") returned 4 [0068.300] lstrcmpiW (lpString1=".rar", lpString2=".lnk") returned 1 [0068.300] lstrlenW (lpString=".raw") returned 4 [0068.300] lstrcmpiW (lpString1=".raw", lpString2=".lnk") returned 1 [0068.301] FindFirstFileW (in: lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Accessories\\System Tools\\*", lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12188 [0068.301] FindNextFileW (in: hFindFile=0x3f12188, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfd9dbcac, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x8ace9ee9, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x8ace9ee9, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0068.301] FindNextFileW (in: hFindFile=0x3f12188, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x3e4ce49a, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x3e4ce49a, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x3e51a75b, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Character Map.lnk", cAlternateFileName="CHARAC~1.LNK")) returned 1 [0070.256] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.257] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857953d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.257] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857953d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857953d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.257] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.257] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.257] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0070.257] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.257] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.257] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.258] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.258] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.258] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0070.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.258] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.258] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.258] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.258] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.258] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0070.258] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.259] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.259] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.259] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.259] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.259] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0070.259] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.259] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.259] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.259] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.259] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.259] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0070.260] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.260] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.260] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bc4d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xea, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.260] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.260] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.260] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0070.260] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.260] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857bb530, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x857bb530, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.260] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x857bb530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x857e35d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x112, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.260] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.260] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.260] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0070.261] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.261] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x857e1690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.261] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.261] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.261] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.261] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0070.261] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.261] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.261] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.262] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.262] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.262] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0070.262] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.263] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859aa710, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859aa710, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.263] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859aa710, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859abe80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.264] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.264] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.264] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0070.264] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.264] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.264] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.264] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.264] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.265] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0070.265] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.265] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.265] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.266] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.266] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.266] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0070.266] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.266] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859d0870, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.266] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859d0870, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859d0870, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.266] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.266] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.266] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0070.267] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.267] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.267] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.267] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.268] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0070.268] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0070.268] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.268] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.268] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.268] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.268] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.268] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0070.268] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.269] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f69d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x859f69d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.269] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x859f69d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x859f7970, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.269] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.269] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.269] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0070.270] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.270] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.270] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x123, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.270] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.270] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.270] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0070.270] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.271] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.271] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.271] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.271] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.271] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0070.272] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.272] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1cb30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a1cb30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.272] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a1ea70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.272] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.272] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.272] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0070.272] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.273] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a1cb30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.273] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.273] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.273] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.273] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0070.273] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.274] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.274] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a43460, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xec, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.274] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.274] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.274] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0070.274] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.275] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a42c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a42c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.275] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a42c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.275] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.275] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.275] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0070.275] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.275] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.275] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.276] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.276] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.276] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0070.276] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.279] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a68df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a68df0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.279] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a6a560, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.279] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.280] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.280] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ms", cAlternateFileName="")) returned 1 [0070.280] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0070.280] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a68df0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.280] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.280] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0070.280] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.280] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0070.280] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.281] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.281] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.281] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.282] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.282] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="no", cAlternateFileName="")) returned 1 [0070.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.282] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.282] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xe4180700, ftLastWriteTime.dwHighDateTime=0x1d03f5e, nFileSizeHigh=0x0, nFileSizeLow=0xcb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.282] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.282] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.282] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0070.282] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.283] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85a8ef50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.283] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85a8ef50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85a8ef50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.283] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.283] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.283] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0070.284] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.284] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.284] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.284] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.284] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.284] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0070.284] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.285] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab50b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85ab50b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.285] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85ab6050, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.285] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.285] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.285] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0070.285] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.286] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85ab50b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.286] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xde, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.286] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.286] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.286] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0070.286] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.287] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.287] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x110, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.287] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.287] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.287] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0070.287] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.287] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.288] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.288] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.288] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.288] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0070.288] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.289] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85adb210, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85adb210, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.289] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85adb210, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85add150, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdf, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.289] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.289] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.289] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0070.289] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.289] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.289] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.289] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.290] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.290] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0070.290] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.290] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.290] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xe2, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.291] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.291] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.291] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0070.291] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.291] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01370, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b01370, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.291] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b01b40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.291] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.291] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.291] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0070.292] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.292] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b01370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.292] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xdd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.293] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.293] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.293] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0070.293] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.293] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.293] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x10e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.293] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.293] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.293] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0070.294] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.294] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.294] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xed, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.294] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.294] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.295] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0070.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0070.295] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b274d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b274d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.295] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b274d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b28c40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd7, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0070.295] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0070.295] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0070.295] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0070.295] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f124c8 [0070.388] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85b4d630, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0070.399] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x85b4d630, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x85b4d630, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x85cca3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xd1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.391] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.391] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.391] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.391] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.391] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.391] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="bg", cAlternateFileName="")) returned 1 [0071.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg") returned 138 [0071.391] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg") returned 1 [0071.391] lstrlenW (lpString="bg") returned 2 [0071.391] lstrcmpiW (lpString1="C:\\Windows", lpString2="bg") returned 1 [0071.391] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x406bd38 [0071.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg") returned 138 [0071.391] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.392] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.392] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.392] lstrlenW (lpString="messages.json") returned 13 [0071.392] lstrlenW (lpString=".1cd") returned 4 [0071.392] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0071.392] lstrlenW (lpString=".3ds") returned 4 [0071.392] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0071.392] lstrlenW (lpString=".3fr") returned 4 [0071.392] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0071.393] lstrlenW (lpString=".3g2") returned 4 [0071.393] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0071.393] lstrlenW (lpString=".3gp") returned 4 [0071.393] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0071.393] lstrlenW (lpString=".7z") returned 3 [0071.393] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0071.393] lstrlenW (lpString=".accda") returned 6 [0071.393] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0071.393] lstrlenW (lpString=".accdb") returned 6 [0071.393] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0071.393] lstrlenW (lpString=".accdc") returned 6 [0071.393] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0071.393] lstrlenW (lpString=".accde") returned 6 [0071.393] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0071.393] lstrlenW (lpString=".accdt") returned 6 [0071.393] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0071.393] lstrlenW (lpString=".accdw") returned 6 [0071.393] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0071.393] lstrlenW (lpString=".adb") returned 4 [0071.393] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0071.393] lstrlenW (lpString=".adp") returned 4 [0071.394] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0071.394] lstrlenW (lpString=".ai") returned 3 [0071.394] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0071.394] lstrlenW (lpString=".ai3") returned 4 [0071.394] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0071.394] lstrlenW (lpString=".ai4") returned 4 [0071.394] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0071.394] lstrlenW (lpString=".ai5") returned 4 [0071.394] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0071.394] lstrlenW (lpString=".ai6") returned 4 [0071.394] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0071.394] lstrlenW (lpString=".ai7") returned 4 [0071.394] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0071.394] lstrlenW (lpString=".ai8") returned 4 [0071.395] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0071.395] lstrlenW (lpString=".anim") returned 5 [0071.395] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0071.395] lstrlenW (lpString=".arw") returned 4 [0071.395] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0071.395] lstrlenW (lpString=".as") returned 3 [0071.395] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0071.395] lstrlenW (lpString=".asa") returned 4 [0071.395] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0071.395] lstrlenW (lpString=".asc") returned 4 [0071.395] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0071.395] lstrlenW (lpString=".ascx") returned 5 [0071.395] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0071.395] lstrlenW (lpString=".asm") returned 4 [0071.395] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0071.395] lstrlenW (lpString=".asmx") returned 5 [0071.395] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0071.395] lstrlenW (lpString=".asp") returned 4 [0071.395] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0071.395] lstrlenW (lpString=".aspx") returned 5 [0071.395] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0071.395] lstrlenW (lpString=".asr") returned 4 [0071.395] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0071.395] lstrlenW (lpString=".asx") returned 4 [0071.395] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0071.395] lstrlenW (lpString=".avi") returned 4 [0071.395] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0071.395] lstrlenW (lpString=".avs") returned 4 [0071.395] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0071.395] lstrlenW (lpString=".backup") returned 7 [0071.395] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0071.395] lstrlenW (lpString=".bak") returned 4 [0071.395] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".bay") returned 4 [0071.396] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".bd") returned 3 [0071.396] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0071.396] lstrlenW (lpString=".bin") returned 4 [0071.396] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".bmp") returned 4 [0071.396] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".bz2") returned 4 [0071.396] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".c") returned 2 [0071.396] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0071.396] lstrlenW (lpString=".cdr") returned 4 [0071.396] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".cer") returned 4 [0071.396] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".cf") returned 3 [0071.396] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0071.396] lstrlenW (lpString=".cfc") returned 4 [0071.396] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".cfm") returned 4 [0071.396] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".cfml") returned 5 [0071.396] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0071.396] lstrlenW (lpString=".cfu") returned 4 [0071.396] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".chm") returned 4 [0071.396] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".cin") returned 4 [0071.396] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0071.396] lstrlenW (lpString=".class") returned 6 [0071.396] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0071.396] lstrlenW (lpString=".clx") returned 4 [0071.396] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".config") returned 7 [0071.397] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0071.397] lstrlenW (lpString=".cpp") returned 4 [0071.397] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".cr2") returned 4 [0071.397] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".crt") returned 4 [0071.397] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".crw") returned 4 [0071.397] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".cs") returned 3 [0071.397] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0071.397] lstrlenW (lpString=".css") returned 4 [0071.397] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".csv") returned 4 [0071.397] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".cub") returned 4 [0071.397] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".dae") returned 4 [0071.397] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".dat") returned 4 [0071.397] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".db") returned 3 [0071.397] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0071.397] lstrlenW (lpString=".dbf") returned 4 [0071.397] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".dbx") returned 4 [0071.397] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".dc3") returned 4 [0071.397] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".dcm") returned 4 [0071.397] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0071.397] lstrlenW (lpString=".dcr") returned 4 [0071.398] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0071.398] lstrlenW (lpString=".der") returned 4 [0071.398] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0071.398] lstrlenW (lpString=".dib") returned 4 [0071.398] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0071.398] lstrlenW (lpString=".dic") returned 4 [0071.398] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0071.398] lstrlenW (lpString=".dif") returned 4 [0071.398] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0071.398] lstrlenW (lpString=".divx") returned 5 [0071.398] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0071.398] lstrlenW (lpString=".djvu") returned 5 [0071.398] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0071.398] lstrlenW (lpString=".dng") returned 4 [0071.398] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0071.398] lstrlenW (lpString=".doc") returned 4 [0071.398] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0071.398] lstrlenW (lpString=".docm") returned 5 [0071.398] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0071.398] lstrlenW (lpString=".docx") returned 5 [0071.398] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0071.398] lstrlenW (lpString=".dot") returned 4 [0071.398] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0071.398] lstrlenW (lpString=".dotm") returned 5 [0071.398] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0071.398] lstrlenW (lpString=".dotx") returned 5 [0071.398] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0071.398] lstrlenW (lpString=".dpx") returned 4 [0071.398] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0071.398] lstrlenW (lpString=".dqy") returned 4 [0071.398] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0071.398] lstrlenW (lpString=".dsn") returned 4 [0071.398] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".dt") returned 3 [0071.399] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0071.399] lstrlenW (lpString=".dtd") returned 4 [0071.399] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".dwg") returned 4 [0071.399] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".dwt") returned 4 [0071.399] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".dx") returned 3 [0071.399] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0071.399] lstrlenW (lpString=".dxf") returned 4 [0071.399] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".edml") returned 5 [0071.399] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0071.399] lstrlenW (lpString=".efd") returned 4 [0071.399] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".elf") returned 4 [0071.399] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".emf") returned 4 [0071.399] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".emz") returned 4 [0071.399] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".epf") returned 4 [0071.399] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".eps") returned 4 [0071.399] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".epsf") returned 5 [0071.399] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0071.399] lstrlenW (lpString=".epsp") returned 5 [0071.399] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0071.399] lstrlenW (lpString=".erf") returned 4 [0071.399] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0071.399] lstrlenW (lpString=".exr") returned 4 [0071.400] lstrcmpiW (lpString1=".exr", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".f4v") returned 4 [0071.400] lstrcmpiW (lpString1=".f4v", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".fido") returned 5 [0071.400] lstrcmpiW (lpString1=".fido", lpString2=".json") returned -1 [0071.400] lstrlenW (lpString=".flm") returned 4 [0071.400] lstrcmpiW (lpString1=".flm", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".flv") returned 4 [0071.400] lstrcmpiW (lpString1=".flv", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".frm") returned 4 [0071.400] lstrcmpiW (lpString1=".frm", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".fxg") returned 4 [0071.400] lstrcmpiW (lpString1=".fxg", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".geo") returned 4 [0071.400] lstrcmpiW (lpString1=".geo", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".gif") returned 4 [0071.400] lstrcmpiW (lpString1=".gif", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".grs") returned 4 [0071.400] lstrcmpiW (lpString1=".grs", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".gz") returned 3 [0071.400] lstrcmpiW (lpString1=".gz", lpString2="son") returned -1 [0071.400] lstrlenW (lpString=".h") returned 2 [0071.400] lstrcmpiW (lpString1=".h", lpString2="on") returned -1 [0071.400] lstrlenW (lpString=".hdr") returned 4 [0071.400] lstrcmpiW (lpString1=".hdr", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".hpp") returned 4 [0071.400] lstrcmpiW (lpString1=".hpp", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".hta") returned 4 [0071.400] lstrcmpiW (lpString1=".hta", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".htc") returned 4 [0071.400] lstrcmpiW (lpString1=".htc", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".htm") returned 4 [0071.400] lstrcmpiW (lpString1=".htm", lpString2="json") returned -1 [0071.400] lstrlenW (lpString=".html") returned 5 [0071.401] lstrcmpiW (lpString1=".html", lpString2=".json") returned -1 [0071.401] lstrlenW (lpString=".icb") returned 4 [0071.401] lstrcmpiW (lpString1=".icb", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".ics") returned 4 [0071.401] lstrcmpiW (lpString1=".ics", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".iff") returned 4 [0071.401] lstrcmpiW (lpString1=".iff", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".inc") returned 4 [0071.401] lstrcmpiW (lpString1=".inc", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".indd") returned 5 [0071.401] lstrcmpiW (lpString1=".indd", lpString2=".json") returned -1 [0071.401] lstrlenW (lpString=".ini") returned 4 [0071.401] lstrcmpiW (lpString1=".ini", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".iqy") returned 4 [0071.401] lstrcmpiW (lpString1=".iqy", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".j2c") returned 4 [0071.401] lstrcmpiW (lpString1=".j2c", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".j2k") returned 4 [0071.401] lstrcmpiW (lpString1=".j2k", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".java") returned 5 [0071.401] lstrcmpiW (lpString1=".java", lpString2=".json") returned -1 [0071.401] lstrlenW (lpString=".jp2") returned 4 [0071.401] lstrcmpiW (lpString1=".jp2", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".jpc") returned 4 [0071.401] lstrcmpiW (lpString1=".jpc", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".jpe") returned 4 [0071.401] lstrcmpiW (lpString1=".jpe", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".jpeg") returned 5 [0071.401] lstrcmpiW (lpString1=".jpeg", lpString2=".json") returned -1 [0071.401] lstrlenW (lpString=".jpf") returned 4 [0071.401] lstrcmpiW (lpString1=".jpf", lpString2="json") returned -1 [0071.401] lstrlenW (lpString=".jpg") returned 4 [0071.401] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0071.402] lstrlenW (lpString=".jpx") returned 4 [0071.402] lstrcmpiW (lpString1=".jpx", lpString2="json") returned -1 [0071.402] lstrlenW (lpString=".js") returned 3 [0071.402] lstrcmpiW (lpString1=".js", lpString2="son") returned -1 [0071.402] lstrlenW (lpString=".jsf") returned 4 [0071.402] lstrcmpiW (lpString1=".jsf", lpString2="json") returned -1 [0071.402] lstrlenW (lpString=".json") returned 5 [0071.402] lstrcmpiW (lpString1=".json", lpString2=".json") returned 0 [0071.402] lstrlenW (lpString="messages.json") returned 13 [0071.402] lstrlenW (lpString=".wiki") returned 5 [0071.402] lstrcmpiW (lpString1=".wiki", lpString2=".json") returned 1 [0071.402] lstrlenW (lpString="messages.json") returned 13 [0071.402] lstrcmpiW (lpString1="boot.ini", lpString2="messages.json") returned -1 [0071.402] lstrcmpiW (lpString1="bootfont.bin", lpString2="messages.json") returned -1 [0071.402] lstrcmpiW (lpString1="ntldr", lpString2="messages.json") returned 1 [0071.402] lstrcmpiW (lpString1="ntdetect.com", lpString2="messages.json") returned 1 [0071.402] lstrcmpiW (lpString1="io.sys", lpString2="messages.json") returned -1 [0071.402] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="messages.json") returned -1 [0071.402] lstrcmpiW (lpString1="Info.hta", lpString2="messages.json") returned -1 [0071.402] lstrcmpiW (lpString1="1Black.exe", lpString2="messages.json") returned -1 [0071.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0071.402] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x13f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.402] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.403] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.403] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0071.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca") returned 138 [0071.403] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca") returned 1 [0071.403] lstrlenW (lpString="ca") returned 2 [0071.403] lstrcmpiW (lpString1="C:\\Windows", lpString2="ca") returned -1 [0071.403] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x406bd38 [0071.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca") returned 138 [0071.403] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.403] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.403] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.403] lstrlenW (lpString="messages.json") returned 13 [0071.403] lstrlenW (lpString=".1cd") returned 4 [0071.403] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0071.403] lstrlenW (lpString=".3ds") returned 4 [0071.403] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0071.403] lstrlenW (lpString=".3fr") returned 4 [0071.403] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0071.403] lstrlenW (lpString=".3g2") returned 4 [0071.403] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0071.403] lstrlenW (lpString=".3gp") returned 4 [0071.404] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0071.404] lstrlenW (lpString=".7z") returned 3 [0071.404] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0071.404] lstrlenW (lpString=".accda") returned 6 [0071.404] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0071.404] lstrlenW (lpString=".accdb") returned 6 [0071.404] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0071.404] lstrlenW (lpString=".accdc") returned 6 [0071.404] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0071.404] lstrlenW (lpString=".accde") returned 6 [0071.404] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0071.404] lstrlenW (lpString=".accdt") returned 6 [0071.404] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0071.404] lstrlenW (lpString=".accdw") returned 6 [0071.404] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0071.404] lstrlenW (lpString=".adb") returned 4 [0071.404] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0071.404] lstrlenW (lpString=".adp") returned 4 [0071.404] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0071.404] lstrlenW (lpString=".ai") returned 3 [0071.404] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0071.404] lstrlenW (lpString=".ai3") returned 4 [0071.404] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0071.404] lstrlenW (lpString=".ai4") returned 4 [0071.404] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0071.404] lstrlenW (lpString=".ai5") returned 4 [0071.404] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0071.404] lstrlenW (lpString=".ai6") returned 4 [0071.404] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0071.404] lstrlenW (lpString=".ai7") returned 4 [0071.404] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0071.404] lstrlenW (lpString=".ai8") returned 4 [0071.404] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0071.404] lstrlenW (lpString=".anim") returned 5 [0071.405] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0071.405] lstrlenW (lpString=".arw") returned 4 [0071.405] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0071.405] lstrlenW (lpString=".as") returned 3 [0071.405] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0071.405] lstrlenW (lpString=".asa") returned 4 [0071.405] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0071.405] lstrlenW (lpString=".asc") returned 4 [0071.405] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0071.405] lstrlenW (lpString=".ascx") returned 5 [0071.405] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0071.405] lstrlenW (lpString=".asm") returned 4 [0071.405] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0071.405] lstrlenW (lpString=".asmx") returned 5 [0071.405] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0071.405] lstrlenW (lpString=".asp") returned 4 [0071.405] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0071.405] lstrlenW (lpString=".aspx") returned 5 [0071.405] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0071.405] lstrlenW (lpString=".asr") returned 4 [0071.405] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0071.405] lstrlenW (lpString=".asx") returned 4 [0071.405] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0071.405] lstrlenW (lpString=".avi") returned 4 [0071.405] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0071.405] lstrlenW (lpString=".avs") returned 4 [0071.405] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0071.405] lstrlenW (lpString=".backup") returned 7 [0071.405] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0071.405] lstrlenW (lpString=".bak") returned 4 [0071.405] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0071.405] lstrlenW (lpString=".bay") returned 4 [0071.405] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".bd") returned 3 [0071.406] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0071.406] lstrlenW (lpString=".bin") returned 4 [0071.406] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".bmp") returned 4 [0071.406] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".bz2") returned 4 [0071.406] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".c") returned 2 [0071.406] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0071.406] lstrlenW (lpString=".cdr") returned 4 [0071.406] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".cer") returned 4 [0071.406] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".cf") returned 3 [0071.406] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0071.406] lstrlenW (lpString=".cfc") returned 4 [0071.406] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".cfm") returned 4 [0071.406] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".cfml") returned 5 [0071.406] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0071.406] lstrlenW (lpString=".cfu") returned 4 [0071.406] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".chm") returned 4 [0071.406] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".cin") returned 4 [0071.406] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0071.406] lstrlenW (lpString=".class") returned 6 [0071.406] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0071.406] lstrlenW (lpString=".clx") returned 4 [0071.406] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".config") returned 7 [0071.407] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0071.407] lstrlenW (lpString=".cpp") returned 4 [0071.407] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".cr2") returned 4 [0071.407] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".crt") returned 4 [0071.407] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".crw") returned 4 [0071.407] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".cs") returned 3 [0071.407] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0071.407] lstrlenW (lpString=".css") returned 4 [0071.407] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".csv") returned 4 [0071.407] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".cub") returned 4 [0071.407] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".dae") returned 4 [0071.407] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".dat") returned 4 [0071.407] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".db") returned 3 [0071.407] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0071.407] lstrlenW (lpString=".dbf") returned 4 [0071.407] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".dbx") returned 4 [0071.407] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".dc3") returned 4 [0071.407] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".dcm") returned 4 [0071.407] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0071.407] lstrlenW (lpString=".dcr") returned 4 [0071.407] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".der") returned 4 [0071.408] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".dib") returned 4 [0071.408] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".dic") returned 4 [0071.408] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".dif") returned 4 [0071.408] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".divx") returned 5 [0071.408] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0071.408] lstrlenW (lpString=".djvu") returned 5 [0071.408] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0071.408] lstrlenW (lpString=".dng") returned 4 [0071.408] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".doc") returned 4 [0071.408] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".docm") returned 5 [0071.408] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0071.408] lstrlenW (lpString=".docx") returned 5 [0071.408] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0071.408] lstrlenW (lpString=".dot") returned 4 [0071.408] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".dotm") returned 5 [0071.408] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0071.408] lstrlenW (lpString=".dotx") returned 5 [0071.408] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0071.408] lstrlenW (lpString=".dpx") returned 4 [0071.408] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".dqy") returned 4 [0071.408] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".dsn") returned 4 [0071.408] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0071.408] lstrlenW (lpString=".dt") returned 3 [0071.409] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0071.409] lstrlenW (lpString=".dtd") returned 4 [0071.409] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0071.409] lstrlenW (lpString=".dwg") returned 4 [0071.409] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0071.409] lstrlenW (lpString=".dwt") returned 4 [0071.409] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0071.409] lstrlenW (lpString=".dx") returned 3 [0071.410] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0071.410] lstrlenW (lpString=".dxf") returned 4 [0071.410] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0071.410] lstrlenW (lpString=".edml") returned 5 [0071.410] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0071.410] lstrlenW (lpString=".efd") returned 4 [0071.410] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0071.410] lstrlenW (lpString=".elf") returned 4 [0071.410] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0071.410] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x109, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.410] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.411] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.411] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0071.411] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.411] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.411] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.411] lstrlenW (lpString="messages.json") returned 13 [0071.411] lstrlenW (lpString=".1cd") returned 4 [0071.411] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0071.411] lstrlenW (lpString=".3ds") returned 4 [0071.411] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0071.411] lstrlenW (lpString=".3fr") returned 4 [0071.411] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0071.411] lstrlenW (lpString=".3g2") returned 4 [0071.411] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0071.411] lstrlenW (lpString=".3gp") returned 4 [0071.411] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0071.411] lstrlenW (lpString=".7z") returned 3 [0071.412] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0071.412] lstrlenW (lpString=".accda") returned 6 [0071.412] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0071.412] lstrlenW (lpString=".accdb") returned 6 [0071.412] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0071.412] lstrlenW (lpString=".accdc") returned 6 [0071.412] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0071.412] lstrlenW (lpString=".accde") returned 6 [0071.412] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0071.412] lstrlenW (lpString=".accdt") returned 6 [0071.412] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0071.412] lstrlenW (lpString=".accdw") returned 6 [0071.412] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0071.412] lstrlenW (lpString=".adb") returned 4 [0071.412] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0071.412] lstrlenW (lpString=".adp") returned 4 [0071.412] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0071.412] lstrlenW (lpString=".ai") returned 3 [0071.412] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0071.412] lstrlenW (lpString=".ai3") returned 4 [0071.412] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0071.412] lstrlenW (lpString=".ai4") returned 4 [0071.412] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0071.412] lstrlenW (lpString=".ai5") returned 4 [0071.412] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0071.412] lstrlenW (lpString=".ai6") returned 4 [0071.412] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0071.412] lstrlenW (lpString=".ai7") returned 4 [0071.412] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0071.412] lstrlenW (lpString=".ai8") returned 4 [0071.412] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0071.412] lstrlenW (lpString=".anim") returned 5 [0071.412] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0071.413] lstrlenW (lpString=".arw") returned 4 [0071.413] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".as") returned 3 [0071.413] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0071.413] lstrlenW (lpString=".asa") returned 4 [0071.413] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".asc") returned 4 [0071.413] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".ascx") returned 5 [0071.413] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0071.413] lstrlenW (lpString=".asm") returned 4 [0071.413] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".asmx") returned 5 [0071.413] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0071.413] lstrlenW (lpString=".asp") returned 4 [0071.413] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".aspx") returned 5 [0071.413] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0071.413] lstrlenW (lpString=".asr") returned 4 [0071.413] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".asx") returned 4 [0071.413] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".avi") returned 4 [0071.413] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".avs") returned 4 [0071.413] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".backup") returned 7 [0071.413] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0071.413] lstrlenW (lpString=".bak") returned 4 [0071.413] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".bay") returned 4 [0071.413] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0071.413] lstrlenW (lpString=".bd") returned 3 [0071.413] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0071.414] lstrlenW (lpString=".bin") returned 4 [0071.414] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".bmp") returned 4 [0071.414] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".bz2") returned 4 [0071.414] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".c") returned 2 [0071.414] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0071.414] lstrlenW (lpString=".cdr") returned 4 [0071.414] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".cer") returned 4 [0071.414] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".cf") returned 3 [0071.414] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0071.414] lstrlenW (lpString=".cfc") returned 4 [0071.414] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".cfm") returned 4 [0071.414] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".cfml") returned 5 [0071.414] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0071.414] lstrlenW (lpString=".cfu") returned 4 [0071.414] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".chm") returned 4 [0071.414] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".cin") returned 4 [0071.414] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".class") returned 6 [0071.414] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0071.414] lstrlenW (lpString=".clx") returned 4 [0071.414] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0071.414] lstrlenW (lpString=".config") returned 7 [0071.414] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0071.414] lstrlenW (lpString=".cpp") returned 4 [0071.414] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".cr2") returned 4 [0071.415] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".crt") returned 4 [0071.415] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".crw") returned 4 [0071.415] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".cs") returned 3 [0071.415] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0071.415] lstrlenW (lpString=".css") returned 4 [0071.415] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".csv") returned 4 [0071.415] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".cub") returned 4 [0071.415] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".dae") returned 4 [0071.415] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".dat") returned 4 [0071.415] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".db") returned 3 [0071.415] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0071.415] lstrlenW (lpString=".dbf") returned 4 [0071.415] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".dbx") returned 4 [0071.415] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".dc3") returned 4 [0071.415] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".dcm") returned 4 [0071.415] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".dcr") returned 4 [0071.415] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".der") returned 4 [0071.415] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0071.415] lstrlenW (lpString=".dib") returned 4 [0071.416] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0071.416] lstrlenW (lpString=".dic") returned 4 [0071.416] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0071.416] lstrlenW (lpString=".dif") returned 4 [0071.416] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0071.416] lstrlenW (lpString=".divx") returned 5 [0071.416] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0071.416] lstrlenW (lpString=".djvu") returned 5 [0071.416] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0071.416] lstrlenW (lpString=".dng") returned 4 [0071.416] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0071.416] lstrlenW (lpString=".doc") returned 4 [0071.416] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0071.416] lstrlenW (lpString=".docm") returned 5 [0071.416] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0071.416] lstrlenW (lpString=".docx") returned 5 [0071.416] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0071.416] lstrlenW (lpString=".dot") returned 4 [0071.416] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0071.416] lstrlenW (lpString=".dotm") returned 5 [0071.416] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0071.416] lstrlenW (lpString=".dotx") returned 5 [0071.416] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0071.416] lstrlenW (lpString=".dpx") returned 4 [0071.416] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0071.416] lstrlenW (lpString=".dqy") returned 4 [0071.416] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0071.416] lstrlenW (lpString=".dsn") returned 4 [0071.416] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0071.416] lstrlenW (lpString=".dt") returned 3 [0071.416] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0071.416] lstrlenW (lpString=".dtd") returned 4 [0071.416] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0071.416] lstrlenW (lpString=".dwg") returned 4 [0071.417] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".dwt") returned 4 [0071.417] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".dx") returned 3 [0071.417] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0071.417] lstrlenW (lpString=".dxf") returned 4 [0071.417] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".edml") returned 5 [0071.417] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0071.417] lstrlenW (lpString=".efd") returned 4 [0071.417] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".elf") returned 4 [0071.417] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".emf") returned 4 [0071.417] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".emz") returned 4 [0071.417] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".epf") returned 4 [0071.417] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".eps") returned 4 [0071.417] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".epsf") returned 5 [0071.417] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0071.417] lstrlenW (lpString=".epsp") returned 5 [0071.417] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0071.417] lstrlenW (lpString=".erf") returned 4 [0071.417] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".exr") returned 4 [0071.417] lstrcmpiW (lpString1=".exr", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".f4v") returned 4 [0071.417] lstrcmpiW (lpString1=".f4v", lpString2="json") returned -1 [0071.417] lstrlenW (lpString=".fido") returned 5 [0071.417] lstrcmpiW (lpString1=".fido", lpString2=".json") returned -1 [0071.417] lstrlenW (lpString=".flm") returned 4 [0071.418] lstrcmpiW (lpString1=".flm", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".flv") returned 4 [0071.418] lstrcmpiW (lpString1=".flv", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".frm") returned 4 [0071.418] lstrcmpiW (lpString1=".frm", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".fxg") returned 4 [0071.418] lstrcmpiW (lpString1=".fxg", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".geo") returned 4 [0071.418] lstrcmpiW (lpString1=".geo", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".gif") returned 4 [0071.418] lstrcmpiW (lpString1=".gif", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".grs") returned 4 [0071.418] lstrcmpiW (lpString1=".grs", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".gz") returned 3 [0071.418] lstrcmpiW (lpString1=".gz", lpString2="son") returned -1 [0071.418] lstrlenW (lpString=".h") returned 2 [0071.418] lstrcmpiW (lpString1=".h", lpString2="on") returned -1 [0071.418] lstrlenW (lpString=".hdr") returned 4 [0071.418] lstrcmpiW (lpString1=".hdr", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".hpp") returned 4 [0071.418] lstrcmpiW (lpString1=".hpp", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".hta") returned 4 [0071.418] lstrcmpiW (lpString1=".hta", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".htc") returned 4 [0071.418] lstrcmpiW (lpString1=".htc", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".htm") returned 4 [0071.418] lstrcmpiW (lpString1=".htm", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".html") returned 5 [0071.418] lstrcmpiW (lpString1=".html", lpString2=".json") returned -1 [0071.418] lstrlenW (lpString=".icb") returned 4 [0071.418] lstrcmpiW (lpString1=".icb", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".ics") returned 4 [0071.418] lstrcmpiW (lpString1=".ics", lpString2="json") returned -1 [0071.418] lstrlenW (lpString=".iff") returned 4 [0071.419] lstrcmpiW (lpString1=".iff", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".inc") returned 4 [0071.419] lstrcmpiW (lpString1=".inc", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".indd") returned 5 [0071.419] lstrcmpiW (lpString1=".indd", lpString2=".json") returned -1 [0071.419] lstrlenW (lpString=".ini") returned 4 [0071.419] lstrcmpiW (lpString1=".ini", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".iqy") returned 4 [0071.419] lstrcmpiW (lpString1=".iqy", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".j2c") returned 4 [0071.419] lstrcmpiW (lpString1=".j2c", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".j2k") returned 4 [0071.419] lstrcmpiW (lpString1=".j2k", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".java") returned 5 [0071.419] lstrcmpiW (lpString1=".java", lpString2=".json") returned -1 [0071.419] lstrlenW (lpString=".jp2") returned 4 [0071.419] lstrcmpiW (lpString1=".jp2", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".jpc") returned 4 [0071.419] lstrcmpiW (lpString1=".jpc", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".jpe") returned 4 [0071.419] lstrcmpiW (lpString1=".jpe", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".jpeg") returned 5 [0071.419] lstrcmpiW (lpString1=".jpeg", lpString2=".json") returned -1 [0071.419] lstrlenW (lpString=".jpf") returned 4 [0071.419] lstrcmpiW (lpString1=".jpf", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".jpg") returned 4 [0071.419] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".jpx") returned 4 [0071.419] lstrcmpiW (lpString1=".jpx", lpString2="json") returned -1 [0071.419] lstrlenW (lpString=".js") returned 3 [0071.419] lstrcmpiW (lpString1=".js", lpString2="son") returned -1 [0071.419] lstrlenW (lpString=".jsf") returned 4 [0071.419] lstrcmpiW (lpString1=".jsf", lpString2="json") returned -1 [0071.420] lstrlenW (lpString=".json") returned 5 [0071.420] lstrcmpiW (lpString1=".json", lpString2=".json") returned 0 [0071.420] lstrlenW (lpString="messages.json") returned 13 [0071.420] lstrlenW (lpString=".wiki") returned 5 [0071.420] lstrcmpiW (lpString1=".wiki", lpString2=".json") returned 1 [0071.420] lstrlenW (lpString="messages.json") returned 13 [0071.420] lstrcmpiW (lpString1="boot.ini", lpString2="messages.json") returned -1 [0071.420] lstrcmpiW (lpString1="bootfont.bin", lpString2="messages.json") returned -1 [0071.420] lstrcmpiW (lpString1="ntldr", lpString2="messages.json") returned 1 [0071.420] lstrcmpiW (lpString1="ntdetect.com", lpString2="messages.json") returned 1 [0071.420] lstrcmpiW (lpString1="io.sys", lpString2="messages.json") returned -1 [0071.420] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="messages.json") returned -1 [0071.420] lstrcmpiW (lpString1="Info.hta", lpString2="messages.json") returned -1 [0071.420] lstrcmpiW (lpString1="1Black.exe", lpString2="messages.json") returned -1 [0071.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0071.420] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.420] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.420] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.420] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0071.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da") returned 138 [0071.420] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da") returned 1 [0071.420] lstrlenW (lpString="da") returned 2 [0071.420] lstrcmpiW (lpString1="C:\\Windows", lpString2="da") returned -1 [0071.420] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x406bd38 [0071.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da") returned 138 [0071.421] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.421] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4cab0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e4cab0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.421] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e4cab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e4da50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.421] lstrlenW (lpString="messages.json") returned 13 [0071.421] lstrlenW (lpString=".1cd") returned 4 [0071.421] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0071.421] lstrlenW (lpString=".3ds") returned 4 [0071.421] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0071.421] lstrlenW (lpString=".3fr") returned 4 [0071.421] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0071.421] lstrlenW (lpString=".3g2") returned 4 [0071.421] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0071.421] lstrlenW (lpString=".3gp") returned 4 [0071.421] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0071.421] lstrlenW (lpString=".7z") returned 3 [0071.421] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0071.421] lstrlenW (lpString=".accda") returned 6 [0071.421] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0071.421] lstrlenW (lpString=".accdb") returned 6 [0071.421] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0071.421] lstrlenW (lpString=".accdc") returned 6 [0071.421] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0071.421] lstrlenW (lpString=".accde") returned 6 [0071.421] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0071.422] lstrlenW (lpString=".accdt") returned 6 [0071.422] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0071.422] lstrlenW (lpString=".accdw") returned 6 [0071.422] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0071.422] lstrlenW (lpString=".adb") returned 4 [0071.422] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".adp") returned 4 [0071.422] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".ai") returned 3 [0071.422] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0071.422] lstrlenW (lpString=".ai3") returned 4 [0071.422] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".ai4") returned 4 [0071.422] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".ai5") returned 4 [0071.422] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".ai6") returned 4 [0071.422] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".ai7") returned 4 [0071.422] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".ai8") returned 4 [0071.422] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".anim") returned 5 [0071.422] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0071.422] lstrlenW (lpString=".arw") returned 4 [0071.422] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".as") returned 3 [0071.422] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0071.422] lstrlenW (lpString=".asa") returned 4 [0071.422] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".asc") returned 4 [0071.422] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0071.422] lstrlenW (lpString=".ascx") returned 5 [0071.423] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0071.423] lstrlenW (lpString=".asm") returned 4 [0071.423] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".asmx") returned 5 [0071.423] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0071.423] lstrlenW (lpString=".asp") returned 4 [0071.423] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".aspx") returned 5 [0071.423] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0071.423] lstrlenW (lpString=".asr") returned 4 [0071.423] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".asx") returned 4 [0071.423] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".avi") returned 4 [0071.423] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".avs") returned 4 [0071.423] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".backup") returned 7 [0071.423] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0071.423] lstrlenW (lpString=".bak") returned 4 [0071.423] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".bay") returned 4 [0071.423] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".bd") returned 3 [0071.423] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0071.423] lstrlenW (lpString=".bin") returned 4 [0071.423] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".bmp") returned 4 [0071.423] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".bz2") returned 4 [0071.423] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0071.423] lstrlenW (lpString=".c") returned 2 [0071.423] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0071.423] lstrlenW (lpString=".cdr") returned 4 [0071.424] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0071.424] lstrlenW (lpString=".cer") returned 4 [0071.424] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0071.424] lstrlenW (lpString=".cf") returned 3 [0071.424] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0071.424] lstrlenW (lpString=".cfc") returned 4 [0071.424] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0071.424] lstrlenW (lpString=".cfm") returned 4 [0071.424] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0071.424] lstrlenW (lpString=".cfml") returned 5 [0071.424] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0071.424] lstrlenW (lpString=".cfu") returned 4 [0071.424] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0071.424] lstrlenW (lpString=".chm") returned 4 [0071.424] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0071.424] lstrlenW (lpString=".cin") returned 4 [0071.424] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0071.424] lstrlenW (lpString=".class") returned 6 [0071.424] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0071.424] lstrlenW (lpString=".clx") returned 4 [0071.424] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0071.424] lstrlenW (lpString=".config") returned 7 [0071.424] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0071.424] lstrlenW (lpString=".cpp") returned 4 [0071.424] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0071.424] lstrlenW (lpString=".cr2") returned 4 [0071.424] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".crt") returned 4 [0071.461] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".crw") returned 4 [0071.461] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".cs") returned 3 [0071.461] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0071.461] lstrlenW (lpString=".css") returned 4 [0071.461] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".csv") returned 4 [0071.461] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".cub") returned 4 [0071.461] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".dae") returned 4 [0071.461] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".dat") returned 4 [0071.461] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".db") returned 3 [0071.461] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0071.461] lstrlenW (lpString=".dbf") returned 4 [0071.461] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".dbx") returned 4 [0071.461] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".dc3") returned 4 [0071.461] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".dcm") returned 4 [0071.461] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".dcr") returned 4 [0071.461] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0071.461] lstrlenW (lpString=".der") returned 4 [0071.462] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0071.462] lstrlenW (lpString=".dib") returned 4 [0071.462] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0071.462] lstrlenW (lpString=".dic") returned 4 [0071.462] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0071.462] lstrlenW (lpString=".dif") returned 4 [0071.462] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0071.462] lstrlenW (lpString=".divx") returned 5 [0071.462] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0071.462] lstrlenW (lpString=".djvu") returned 5 [0071.462] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0071.462] lstrlenW (lpString=".dng") returned 4 [0071.462] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0071.462] lstrlenW (lpString=".doc") returned 4 [0071.462] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0071.462] lstrlenW (lpString=".docm") returned 5 [0071.462] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0071.462] lstrlenW (lpString=".docx") returned 5 [0071.462] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0071.462] lstrlenW (lpString=".dot") returned 4 [0071.462] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0071.462] lstrlenW (lpString=".dotm") returned 5 [0071.462] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0071.462] lstrlenW (lpString=".dotx") returned 5 [0071.462] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0071.462] lstrlenW (lpString=".dpx") returned 4 [0071.462] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0071.462] lstrlenW (lpString=".dqy") returned 4 [0071.462] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0071.462] lstrlenW (lpString=".dsn") returned 4 [0071.462] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0071.462] lstrlenW (lpString=".dt") returned 3 [0071.462] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0071.462] lstrlenW (lpString=".dtd") returned 4 [0071.463] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0071.463] lstrlenW (lpString=".dwg") returned 4 [0071.463] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0071.463] lstrlenW (lpString=".dwt") returned 4 [0071.463] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0071.463] lstrlenW (lpString=".dx") returned 3 [0071.463] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0071.463] lstrlenW (lpString=".dxf") returned 4 [0071.463] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0071.463] lstrlenW (lpString=".edml") returned 5 [0071.463] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0071.463] lstrlenW (lpString=".efd") returned 4 [0071.463] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0071.463] lstrlenW (lpString=".elf") returned 4 [0071.463] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0071.463] lstrlenW (lpString=".emf") returned 4 [0071.463] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0071.463] lstrlenW (lpString=".emz") returned 4 [0071.463] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0071.463] lstrlenW (lpString=".epf") returned 4 [0071.463] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0071.463] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.464] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.464] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0071.464] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.464] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.464] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x100, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.465] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.465] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.465] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0071.465] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.465] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.465] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x149, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.465] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.465] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.465] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0071.466] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.466] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e72c10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e72c10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.466] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e74b50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.466] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.466] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.466] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_US", cAlternateFileName="")) returned 1 [0071.466] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.466] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e72c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.466] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xf9, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.467] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.467] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.467] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0071.467] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.467] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.467] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.467] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.468] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.468] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.468] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0071.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419") returned 142 [0071.468] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419") returned 1 [0071.468] lstrlenW (lpString="es_419") returned 6 [0071.468] lstrcmpiW (lpString1="C:\\Windows", lpString2="es_419") returned -1 [0071.468] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x406bd38 [0071.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419") returned 142 [0071.468] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.468] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.468] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.468] lstrlenW (lpString="messages.json") returned 13 [0071.468] lstrlenW (lpString=".1cd") returned 4 [0071.468] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0071.468] lstrlenW (lpString=".3ds") returned 4 [0071.468] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0071.468] lstrlenW (lpString=".3fr") returned 4 [0071.468] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0071.468] lstrlenW (lpString=".3g2") returned 4 [0071.469] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0071.469] lstrlenW (lpString=".3gp") returned 4 [0071.469] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0071.469] lstrlenW (lpString=".7z") returned 3 [0071.469] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0071.469] lstrlenW (lpString=".accda") returned 6 [0071.469] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0071.469] lstrlenW (lpString=".accdb") returned 6 [0071.469] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0071.469] lstrlenW (lpString=".accdc") returned 6 [0071.469] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0071.469] lstrlenW (lpString=".accde") returned 6 [0071.469] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0071.469] lstrlenW (lpString=".accdt") returned 6 [0071.469] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0071.469] lstrlenW (lpString=".accdw") returned 6 [0071.469] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0071.469] lstrlenW (lpString=".adb") returned 4 [0071.469] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0071.469] lstrlenW (lpString=".adp") returned 4 [0071.469] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0071.469] lstrlenW (lpString=".ai") returned 3 [0071.469] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0071.469] lstrlenW (lpString=".ai3") returned 4 [0071.469] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0071.469] lstrlenW (lpString=".ai4") returned 4 [0071.469] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0071.469] lstrlenW (lpString=".ai5") returned 4 [0071.469] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0071.469] lstrlenW (lpString=".ai6") returned 4 [0071.469] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0071.469] lstrlenW (lpString=".ai7") returned 4 [0071.469] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0071.469] lstrlenW (lpString=".ai8") returned 4 [0071.470] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0071.470] lstrlenW (lpString=".anim") returned 5 [0071.470] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0071.470] lstrlenW (lpString=".arw") returned 4 [0071.470] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0071.470] lstrlenW (lpString=".as") returned 3 [0071.470] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0071.470] lstrlenW (lpString=".asa") returned 4 [0071.470] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0071.470] lstrlenW (lpString=".asc") returned 4 [0071.470] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0071.470] lstrlenW (lpString=".ascx") returned 5 [0071.470] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0071.470] lstrlenW (lpString=".asm") returned 4 [0071.470] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0071.470] lstrlenW (lpString=".asmx") returned 5 [0071.470] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0071.470] lstrlenW (lpString=".asp") returned 4 [0071.470] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0071.470] lstrlenW (lpString=".aspx") returned 5 [0071.470] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0071.470] lstrlenW (lpString=".asr") returned 4 [0071.470] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0071.470] lstrlenW (lpString=".asx") returned 4 [0071.470] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0071.470] lstrlenW (lpString=".avi") returned 4 [0071.470] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0071.470] lstrlenW (lpString=".avs") returned 4 [0071.470] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0071.470] lstrlenW (lpString=".backup") returned 7 [0071.470] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0071.470] lstrlenW (lpString=".bak") returned 4 [0071.470] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0071.471] lstrlenW (lpString=".bay") returned 4 [0071.471] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0071.471] lstrlenW (lpString=".bd") returned 3 [0071.471] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0071.471] lstrlenW (lpString=".bin") returned 4 [0071.471] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0071.471] lstrlenW (lpString=".bmp") returned 4 [0071.471] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0071.471] lstrlenW (lpString=".bz2") returned 4 [0071.471] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0071.471] lstrlenW (lpString=".c") returned 2 [0071.471] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0071.471] lstrlenW (lpString=".cdr") returned 4 [0071.471] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0071.471] lstrlenW (lpString=".cer") returned 4 [0071.471] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0071.471] lstrlenW (lpString=".cf") returned 3 [0071.471] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0071.471] lstrlenW (lpString=".cfc") returned 4 [0071.472] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0071.472] lstrlenW (lpString=".cfm") returned 4 [0071.472] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0071.472] lstrlenW (lpString=".cfml") returned 5 [0071.472] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0071.472] lstrlenW (lpString=".cfu") returned 4 [0071.472] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0071.472] lstrlenW (lpString=".chm") returned 4 [0071.472] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0071.472] lstrlenW (lpString=".cin") returned 4 [0071.472] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0071.472] lstrlenW (lpString=".class") returned 6 [0071.472] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0071.472] lstrlenW (lpString=".clx") returned 4 [0071.472] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0071.472] lstrlenW (lpString=".config") returned 7 [0071.472] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0071.472] lstrlenW (lpString=".cpp") returned 4 [0071.472] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0071.472] lstrlenW (lpString=".cr2") returned 4 [0071.472] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0071.472] lstrlenW (lpString=".crt") returned 4 [0071.472] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0071.472] lstrlenW (lpString=".crw") returned 4 [0071.472] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0071.472] lstrlenW (lpString=".cs") returned 3 [0071.473] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0071.473] lstrlenW (lpString=".css") returned 4 [0071.473] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".csv") returned 4 [0071.473] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".cub") returned 4 [0071.473] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".dae") returned 4 [0071.473] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".dat") returned 4 [0071.473] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".db") returned 3 [0071.473] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0071.473] lstrlenW (lpString=".dbf") returned 4 [0071.473] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".dbx") returned 4 [0071.473] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".dc3") returned 4 [0071.473] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".dcm") returned 4 [0071.473] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".dcr") returned 4 [0071.473] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".der") returned 4 [0071.473] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".dib") returned 4 [0071.473] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".dic") returned 4 [0071.473] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".dif") returned 4 [0071.473] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0071.473] lstrlenW (lpString=".divx") returned 5 [0071.473] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0071.473] lstrlenW (lpString=".djvu") returned 5 [0071.474] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0071.474] lstrlenW (lpString=".dng") returned 4 [0071.474] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0071.474] lstrlenW (lpString=".doc") returned 4 [0071.474] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0071.474] lstrlenW (lpString=".docm") returned 5 [0071.474] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0071.474] lstrlenW (lpString=".docx") returned 5 [0071.474] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0071.474] lstrlenW (lpString=".dot") returned 4 [0071.474] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0071.474] lstrlenW (lpString=".dotm") returned 5 [0071.474] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0071.474] lstrlenW (lpString=".dotx") returned 5 [0071.474] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0071.474] lstrlenW (lpString=".dpx") returned 4 [0071.474] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0071.474] lstrlenW (lpString=".dqy") returned 4 [0071.474] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0071.474] lstrlenW (lpString=".dsn") returned 4 [0071.474] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0071.474] lstrlenW (lpString=".dt") returned 3 [0071.474] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0071.474] lstrlenW (lpString=".dtd") returned 4 [0071.474] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0071.474] lstrlenW (lpString=".dwg") returned 4 [0071.474] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0071.474] lstrlenW (lpString=".dwt") returned 4 [0071.474] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0071.474] lstrlenW (lpString=".dx") returned 3 [0071.474] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0071.474] lstrlenW (lpString=".dxf") returned 4 [0071.474] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0071.474] lstrlenW (lpString=".edml") returned 5 [0071.475] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0071.475] lstrlenW (lpString=".efd") returned 4 [0071.475] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".elf") returned 4 [0071.475] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".emf") returned 4 [0071.475] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".emz") returned 4 [0071.475] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".epf") returned 4 [0071.475] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".eps") returned 4 [0071.475] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".epsf") returned 5 [0071.475] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0071.475] lstrlenW (lpString=".epsp") returned 5 [0071.475] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0071.475] lstrlenW (lpString=".erf") returned 4 [0071.475] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".exr") returned 4 [0071.475] lstrcmpiW (lpString1=".exr", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".f4v") returned 4 [0071.475] lstrcmpiW (lpString1=".f4v", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".fido") returned 5 [0071.475] lstrcmpiW (lpString1=".fido", lpString2=".json") returned -1 [0071.475] lstrlenW (lpString=".flm") returned 4 [0071.475] lstrcmpiW (lpString1=".flm", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".flv") returned 4 [0071.475] lstrcmpiW (lpString1=".flv", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".frm") returned 4 [0071.475] lstrcmpiW (lpString1=".frm", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".fxg") returned 4 [0071.475] lstrcmpiW (lpString1=".fxg", lpString2="json") returned -1 [0071.475] lstrlenW (lpString=".geo") returned 4 [0071.476] lstrcmpiW (lpString1=".geo", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".gif") returned 4 [0071.476] lstrcmpiW (lpString1=".gif", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".grs") returned 4 [0071.476] lstrcmpiW (lpString1=".grs", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".gz") returned 3 [0071.476] lstrcmpiW (lpString1=".gz", lpString2="son") returned -1 [0071.476] lstrlenW (lpString=".h") returned 2 [0071.476] lstrcmpiW (lpString1=".h", lpString2="on") returned -1 [0071.476] lstrlenW (lpString=".hdr") returned 4 [0071.476] lstrcmpiW (lpString1=".hdr", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".hpp") returned 4 [0071.476] lstrcmpiW (lpString1=".hpp", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".hta") returned 4 [0071.476] lstrcmpiW (lpString1=".hta", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".htc") returned 4 [0071.476] lstrcmpiW (lpString1=".htc", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".htm") returned 4 [0071.476] lstrcmpiW (lpString1=".htm", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".html") returned 5 [0071.476] lstrcmpiW (lpString1=".html", lpString2=".json") returned -1 [0071.476] lstrlenW (lpString=".icb") returned 4 [0071.476] lstrcmpiW (lpString1=".icb", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".ics") returned 4 [0071.476] lstrcmpiW (lpString1=".ics", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".iff") returned 4 [0071.476] lstrcmpiW (lpString1=".iff", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".inc") returned 4 [0071.476] lstrcmpiW (lpString1=".inc", lpString2="json") returned -1 [0071.476] lstrlenW (lpString=".indd") returned 5 [0071.476] lstrcmpiW (lpString1=".indd", lpString2=".json") returned -1 [0071.476] lstrlenW (lpString=".ini") returned 4 [0071.477] lstrcmpiW (lpString1=".ini", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".iqy") returned 4 [0071.477] lstrcmpiW (lpString1=".iqy", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".j2c") returned 4 [0071.477] lstrcmpiW (lpString1=".j2c", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".j2k") returned 4 [0071.477] lstrcmpiW (lpString1=".j2k", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".java") returned 5 [0071.477] lstrcmpiW (lpString1=".java", lpString2=".json") returned -1 [0071.477] lstrlenW (lpString=".jp2") returned 4 [0071.477] lstrcmpiW (lpString1=".jp2", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".jpc") returned 4 [0071.477] lstrcmpiW (lpString1=".jpc", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".jpe") returned 4 [0071.477] lstrcmpiW (lpString1=".jpe", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".jpeg") returned 5 [0071.477] lstrcmpiW (lpString1=".jpeg", lpString2=".json") returned -1 [0071.477] lstrlenW (lpString=".jpf") returned 4 [0071.477] lstrcmpiW (lpString1=".jpf", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".jpg") returned 4 [0071.477] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".jpx") returned 4 [0071.477] lstrcmpiW (lpString1=".jpx", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".js") returned 3 [0071.477] lstrcmpiW (lpString1=".js", lpString2="son") returned -1 [0071.477] lstrlenW (lpString=".jsf") returned 4 [0071.477] lstrcmpiW (lpString1=".jsf", lpString2="json") returned -1 [0071.477] lstrlenW (lpString=".json") returned 5 [0071.477] lstrcmpiW (lpString1=".json", lpString2=".json") returned 0 [0071.477] lstrlenW (lpString="messages.json") returned 13 [0071.477] lstrlenW (lpString=".wiki") returned 5 [0071.477] lstrcmpiW (lpString1=".wiki", lpString2=".json") returned 1 [0071.477] lstrlenW (lpString="messages.json") returned 13 [0071.477] lstrcmpiW (lpString1="boot.ini", lpString2="messages.json") returned -1 [0071.478] lstrcmpiW (lpString1="bootfont.bin", lpString2="messages.json") returned -1 [0071.478] lstrcmpiW (lpString1="ntldr", lpString2="messages.json") returned 1 [0071.478] lstrcmpiW (lpString1="ntdetect.com", lpString2="messages.json") returned 1 [0071.478] lstrcmpiW (lpString1="io.sys", lpString2="messages.json") returned -1 [0071.478] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="messages.json") returned -1 [0071.478] lstrcmpiW (lpString1="Info.hta", lpString2="messages.json") returned -1 [0071.478] lstrcmpiW (lpString1="1Black.exe", lpString2="messages.json") returned -1 [0071.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0071.478] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x103, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.478] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.478] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.478] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0071.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et") returned 138 [0071.478] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et") returned 1 [0071.478] lstrlenW (lpString="et") returned 2 [0071.478] lstrcmpiW (lpString1="C:\\Windows", lpString2="et") returned -1 [0071.478] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x406bd38 [0071.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et") returned 138 [0071.478] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.479] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e98d70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86e98d70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.479] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86e98d70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86e99540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.479] lstrlenW (lpString="messages.json") returned 13 [0071.479] lstrlenW (lpString=".1cd") returned 4 [0071.479] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0071.479] lstrlenW (lpString=".3ds") returned 4 [0071.479] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0071.479] lstrlenW (lpString=".3fr") returned 4 [0071.479] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0071.479] lstrlenW (lpString=".3g2") returned 4 [0071.479] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0071.479] lstrlenW (lpString=".3gp") returned 4 [0071.479] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0071.479] lstrlenW (lpString=".7z") returned 3 [0071.479] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0071.479] lstrlenW (lpString=".accda") returned 6 [0071.479] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0071.479] lstrlenW (lpString=".accdb") returned 6 [0071.479] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0071.479] lstrlenW (lpString=".accdc") returned 6 [0071.479] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0071.479] lstrlenW (lpString=".accde") returned 6 [0071.479] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0071.479] lstrlenW (lpString=".accdt") returned 6 [0071.479] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0071.479] lstrlenW (lpString=".accdw") returned 6 [0071.479] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0071.479] lstrlenW (lpString=".adb") returned 4 [0071.479] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0071.479] lstrlenW (lpString=".adp") returned 4 [0071.479] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".ai") returned 3 [0071.480] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0071.480] lstrlenW (lpString=".ai3") returned 4 [0071.480] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".ai4") returned 4 [0071.480] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".ai5") returned 4 [0071.480] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".ai6") returned 4 [0071.480] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".ai7") returned 4 [0071.480] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".ai8") returned 4 [0071.480] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".anim") returned 5 [0071.480] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0071.480] lstrlenW (lpString=".arw") returned 4 [0071.480] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".as") returned 3 [0071.480] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0071.480] lstrlenW (lpString=".asa") returned 4 [0071.480] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".asc") returned 4 [0071.480] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".ascx") returned 5 [0071.480] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0071.480] lstrlenW (lpString=".asm") returned 4 [0071.480] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".asmx") returned 5 [0071.480] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0071.480] lstrlenW (lpString=".asp") returned 4 [0071.480] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0071.480] lstrlenW (lpString=".aspx") returned 5 [0071.480] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0071.481] lstrlenW (lpString=".asr") returned 4 [0071.481] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".asx") returned 4 [0071.481] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".avi") returned 4 [0071.481] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".avs") returned 4 [0071.481] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".backup") returned 7 [0071.481] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0071.481] lstrlenW (lpString=".bak") returned 4 [0071.481] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".bay") returned 4 [0071.481] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".bd") returned 3 [0071.481] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0071.481] lstrlenW (lpString=".bin") returned 4 [0071.481] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".bmp") returned 4 [0071.481] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".bz2") returned 4 [0071.481] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".c") returned 2 [0071.481] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0071.481] lstrlenW (lpString=".cdr") returned 4 [0071.481] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".cer") returned 4 [0071.481] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".cf") returned 3 [0071.481] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0071.481] lstrlenW (lpString=".cfc") returned 4 [0071.481] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0071.481] lstrlenW (lpString=".cfm") returned 4 [0071.481] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".cfml") returned 5 [0071.482] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0071.482] lstrlenW (lpString=".cfu") returned 4 [0071.482] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".chm") returned 4 [0071.482] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".cin") returned 4 [0071.482] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".class") returned 6 [0071.482] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0071.482] lstrlenW (lpString=".clx") returned 4 [0071.482] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".config") returned 7 [0071.482] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0071.482] lstrlenW (lpString=".cpp") returned 4 [0071.482] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".cr2") returned 4 [0071.482] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".crt") returned 4 [0071.482] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".crw") returned 4 [0071.482] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".cs") returned 3 [0071.482] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0071.482] lstrlenW (lpString=".css") returned 4 [0071.482] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".csv") returned 4 [0071.482] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".cub") returned 4 [0071.482] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".dae") returned 4 [0071.482] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0071.482] lstrlenW (lpString=".dat") returned 4 [0071.482] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".db") returned 3 [0071.483] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0071.483] lstrlenW (lpString=".dbf") returned 4 [0071.483] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".dbx") returned 4 [0071.483] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".dc3") returned 4 [0071.483] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".dcm") returned 4 [0071.483] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".dcr") returned 4 [0071.483] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".der") returned 4 [0071.483] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".dib") returned 4 [0071.483] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".dic") returned 4 [0071.483] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".dif") returned 4 [0071.483] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".divx") returned 5 [0071.483] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0071.483] lstrlenW (lpString=".djvu") returned 5 [0071.483] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0071.483] lstrlenW (lpString=".dng") returned 4 [0071.483] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".doc") returned 4 [0071.483] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0071.483] lstrlenW (lpString=".docm") returned 5 [0071.483] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0071.483] lstrlenW (lpString=".docx") returned 5 [0071.483] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0071.483] lstrlenW (lpString=".dot") returned 4 [0071.483] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0071.484] lstrlenW (lpString=".dotm") returned 5 [0071.484] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0071.484] lstrlenW (lpString=".dotx") returned 5 [0071.484] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0071.484] lstrlenW (lpString=".dpx") returned 4 [0071.484] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0071.484] lstrlenW (lpString=".dqy") returned 4 [0071.484] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0071.484] lstrlenW (lpString=".dsn") returned 4 [0071.484] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0071.484] lstrlenW (lpString=".dt") returned 3 [0071.484] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0071.484] lstrlenW (lpString=".dtd") returned 4 [0071.484] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0071.484] lstrlenW (lpString=".dwg") returned 4 [0071.484] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0071.484] lstrlenW (lpString=".dwt") returned 4 [0071.484] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0071.484] lstrlenW (lpString=".dx") returned 3 [0071.484] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0071.484] lstrlenW (lpString=".dxf") returned 4 [0071.484] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0071.484] lstrlenW (lpString=".edml") returned 5 [0071.484] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0071.484] lstrlenW (lpString=".efd") returned 4 [0071.484] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0071.484] lstrlenW (lpString=".elf") returned 4 [0071.484] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0071.484] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.485] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.485] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="eu", cAlternateFileName="")) returned 1 [0071.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.485] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.485] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0xd3d59700, ftLastWriteTime.dwHighDateTime=0x1d10aaf, nFileSizeHigh=0x0, nFileSizeLow=0xf3, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.485] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.485] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.485] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0071.485] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.486] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ebeed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ebeed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ec0640, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x101, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.486] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.486] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0071.486] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.486] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ebeed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.486] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x104, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.486] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.487] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.487] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0071.487] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.488] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.488] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0xfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.488] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.488] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.488] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="he", cAlternateFileName="")) returned 1 [0071.488] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.488] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.488] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x116, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.488] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.489] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.489] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0071.489] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.489] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86ee5030, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.489] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86ee5030, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86ee5030, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x159, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.489] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.489] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.489] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0071.489] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.489] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.489] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x107, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.490] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.490] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.490] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0071.490] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.490] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.490] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x108, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.490] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.490] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.490] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0071.491] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.491] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.491] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x105, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.491] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.491] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.491] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0071.491] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.492] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.492] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.492] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.492] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.492] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0071.493] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.493] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.493] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.493] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x125, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.493] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.493] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.493] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0071.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko") returned 138 [0071.493] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko") returned 1 [0071.494] lstrlenW (lpString="ko") returned 2 [0071.494] lstrcmpiW (lpString1="C:\\Windows", lpString2="ko") returned -1 [0071.494] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x406bd38 [0071.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko") returned 138 [0071.494] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.494] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0b190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f0b190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.494] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.494] lstrlenW (lpString="messages.json") returned 13 [0071.494] lstrlenW (lpString=".1cd") returned 4 [0071.495] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0071.495] lstrlenW (lpString=".3ds") returned 4 [0071.495] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0071.495] lstrlenW (lpString=".3fr") returned 4 [0071.495] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0071.495] lstrlenW (lpString=".3g2") returned 4 [0071.495] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0071.495] lstrlenW (lpString=".3gp") returned 4 [0071.495] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0071.495] lstrlenW (lpString=".7z") returned 3 [0071.495] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0071.495] lstrlenW (lpString=".accda") returned 6 [0071.495] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0071.495] lstrlenW (lpString=".accdb") returned 6 [0071.495] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0071.495] lstrlenW (lpString=".accdc") returned 6 [0071.495] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0071.495] lstrlenW (lpString=".accde") returned 6 [0071.495] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0071.495] lstrlenW (lpString=".accdt") returned 6 [0071.495] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0071.495] lstrlenW (lpString=".accdw") returned 6 [0071.495] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0071.495] lstrlenW (lpString=".adb") returned 4 [0071.495] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0071.495] lstrlenW (lpString=".adp") returned 4 [0071.495] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0071.495] lstrlenW (lpString=".ai") returned 3 [0071.495] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0071.495] lstrlenW (lpString=".ai3") returned 4 [0071.495] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0071.495] lstrlenW (lpString=".ai4") returned 4 [0071.495] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0071.495] lstrlenW (lpString=".ai5") returned 4 [0071.496] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".ai6") returned 4 [0071.496] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".ai7") returned 4 [0071.496] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".ai8") returned 4 [0071.496] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".anim") returned 5 [0071.496] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0071.496] lstrlenW (lpString=".arw") returned 4 [0071.496] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".as") returned 3 [0071.496] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0071.496] lstrlenW (lpString=".asa") returned 4 [0071.496] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".asc") returned 4 [0071.496] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".ascx") returned 5 [0071.496] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0071.496] lstrlenW (lpString=".asm") returned 4 [0071.496] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".asmx") returned 5 [0071.496] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0071.496] lstrlenW (lpString=".asp") returned 4 [0071.496] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".aspx") returned 5 [0071.496] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0071.496] lstrlenW (lpString=".asr") returned 4 [0071.496] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".asx") returned 4 [0071.496] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".avi") returned 4 [0071.496] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0071.496] lstrlenW (lpString=".avs") returned 4 [0071.497] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".backup") returned 7 [0071.497] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0071.497] lstrlenW (lpString=".bak") returned 4 [0071.497] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".bay") returned 4 [0071.497] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".bd") returned 3 [0071.497] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0071.497] lstrlenW (lpString=".bin") returned 4 [0071.497] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".bmp") returned 4 [0071.497] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".bz2") returned 4 [0071.497] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".c") returned 2 [0071.497] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0071.497] lstrlenW (lpString=".cdr") returned 4 [0071.497] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".cer") returned 4 [0071.497] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".cf") returned 3 [0071.497] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0071.497] lstrlenW (lpString=".cfc") returned 4 [0071.497] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".cfm") returned 4 [0071.497] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".cfml") returned 5 [0071.497] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0071.497] lstrlenW (lpString=".cfu") returned 4 [0071.497] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".chm") returned 4 [0071.497] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0071.497] lstrlenW (lpString=".cin") returned 4 [0071.497] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".class") returned 6 [0071.498] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0071.498] lstrlenW (lpString=".clx") returned 4 [0071.498] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".config") returned 7 [0071.498] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0071.498] lstrlenW (lpString=".cpp") returned 4 [0071.498] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".cr2") returned 4 [0071.498] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".crt") returned 4 [0071.498] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".crw") returned 4 [0071.498] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".cs") returned 3 [0071.498] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0071.498] lstrlenW (lpString=".css") returned 4 [0071.498] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".csv") returned 4 [0071.498] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".cub") returned 4 [0071.498] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".dae") returned 4 [0071.498] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".dat") returned 4 [0071.498] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".db") returned 3 [0071.498] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0071.498] lstrlenW (lpString=".dbf") returned 4 [0071.498] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".dbx") returned 4 [0071.498] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0071.498] lstrlenW (lpString=".dc3") returned 4 [0071.499] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".dcm") returned 4 [0071.499] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".dcr") returned 4 [0071.499] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".der") returned 4 [0071.499] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".dib") returned 4 [0071.499] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".dic") returned 4 [0071.499] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".dif") returned 4 [0071.499] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".divx") returned 5 [0071.499] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0071.499] lstrlenW (lpString=".djvu") returned 5 [0071.499] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0071.499] lstrlenW (lpString=".dng") returned 4 [0071.499] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".doc") returned 4 [0071.499] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".docm") returned 5 [0071.499] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0071.499] lstrlenW (lpString=".docx") returned 5 [0071.499] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0071.499] lstrlenW (lpString=".dot") returned 4 [0071.499] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".dotm") returned 5 [0071.499] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0071.499] lstrlenW (lpString=".dotx") returned 5 [0071.499] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0071.499] lstrlenW (lpString=".dpx") returned 4 [0071.499] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0071.499] lstrlenW (lpString=".dqy") returned 4 [0071.499] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".dsn") returned 4 [0071.500] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".dt") returned 3 [0071.500] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0071.500] lstrlenW (lpString=".dtd") returned 4 [0071.500] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".dwg") returned 4 [0071.500] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".dwt") returned 4 [0071.500] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".dx") returned 3 [0071.500] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0071.500] lstrlenW (lpString=".dxf") returned 4 [0071.500] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".edml") returned 5 [0071.500] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0071.500] lstrlenW (lpString=".efd") returned 4 [0071.500] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".elf") returned 4 [0071.500] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".emf") returned 4 [0071.500] lstrcmpiW (lpString1=".emf", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".emz") returned 4 [0071.500] lstrcmpiW (lpString1=".emz", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".epf") returned 4 [0071.500] lstrcmpiW (lpString1=".epf", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".eps") returned 4 [0071.500] lstrcmpiW (lpString1=".eps", lpString2="json") returned -1 [0071.500] lstrlenW (lpString=".epsf") returned 5 [0071.500] lstrcmpiW (lpString1=".epsf", lpString2=".json") returned -1 [0071.500] lstrlenW (lpString=".epsp") returned 5 [0071.500] lstrcmpiW (lpString1=".epsp", lpString2=".json") returned -1 [0071.500] lstrlenW (lpString=".erf") returned 4 [0071.500] lstrcmpiW (lpString1=".erf", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".exr") returned 4 [0071.501] lstrcmpiW (lpString1=".exr", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".f4v") returned 4 [0071.501] lstrcmpiW (lpString1=".f4v", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".fido") returned 5 [0071.501] lstrcmpiW (lpString1=".fido", lpString2=".json") returned -1 [0071.501] lstrlenW (lpString=".flm") returned 4 [0071.501] lstrcmpiW (lpString1=".flm", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".flv") returned 4 [0071.501] lstrcmpiW (lpString1=".flv", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".frm") returned 4 [0071.501] lstrcmpiW (lpString1=".frm", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".fxg") returned 4 [0071.501] lstrcmpiW (lpString1=".fxg", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".geo") returned 4 [0071.501] lstrcmpiW (lpString1=".geo", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".gif") returned 4 [0071.501] lstrcmpiW (lpString1=".gif", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".grs") returned 4 [0071.501] lstrcmpiW (lpString1=".grs", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".gz") returned 3 [0071.501] lstrcmpiW (lpString1=".gz", lpString2="son") returned -1 [0071.501] lstrlenW (lpString=".h") returned 2 [0071.501] lstrcmpiW (lpString1=".h", lpString2="on") returned -1 [0071.501] lstrlenW (lpString=".hdr") returned 4 [0071.501] lstrcmpiW (lpString1=".hdr", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".hpp") returned 4 [0071.501] lstrcmpiW (lpString1=".hpp", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".hta") returned 4 [0071.501] lstrcmpiW (lpString1=".hta", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".htc") returned 4 [0071.501] lstrcmpiW (lpString1=".htc", lpString2="json") returned -1 [0071.501] lstrlenW (lpString=".htm") returned 4 [0071.501] lstrcmpiW (lpString1=".htm", lpString2="json") returned -1 [0071.502] lstrlenW (lpString=".html") returned 5 [0071.502] lstrcmpiW (lpString1=".html", lpString2=".json") returned -1 [0071.502] lstrlenW (lpString=".icb") returned 4 [0071.502] lstrcmpiW (lpString1=".icb", lpString2="json") returned -1 [0071.502] lstrlenW (lpString=".ics") returned 4 [0071.502] lstrcmpiW (lpString1=".ics", lpString2="json") returned -1 [0071.502] lstrlenW (lpString=".iff") returned 4 [0071.502] lstrcmpiW (lpString1=".iff", lpString2="json") returned -1 [0071.502] lstrlenW (lpString=".inc") returned 4 [0071.502] lstrcmpiW (lpString1=".inc", lpString2="json") returned -1 [0071.502] lstrlenW (lpString=".indd") returned 5 [0071.502] lstrcmpiW (lpString1=".indd", lpString2=".json") returned -1 [0071.502] lstrlenW (lpString=".ini") returned 4 [0071.502] lstrcmpiW (lpString1=".ini", lpString2="json") returned -1 [0071.502] lstrlenW (lpString=".iqy") returned 4 [0071.502] lstrcmpiW (lpString1=".iqy", lpString2="json") returned -1 [0071.502] lstrlenW (lpString=".j2c") returned 4 [0071.502] lstrcmpiW (lpString1=".j2c", lpString2="json") returned -1 [0071.502] lstrlenW (lpString=".j2k") returned 4 [0071.502] lstrcmpiW (lpString1=".j2k", lpString2="json") returned -1 [0071.502] lstrlenW (lpString=".java") returned 5 [0071.502] lstrcmpiW (lpString1=".java", lpString2=".json") returned -1 [0071.502] lstrlenW (lpString=".jp2") returned 4 [0071.502] lstrcmpiW (lpString1=".jp2", lpString2="json") returned -1 [0071.502] lstrlenW (lpString=".jpc") returned 4 [0071.502] lstrcmpiW (lpString1=".jpc", lpString2="json") returned -1 [0071.517] lstrlenW (lpString=".jpe") returned 4 [0071.518] lstrcmpiW (lpString1=".jpe", lpString2="json") returned -1 [0071.518] lstrlenW (lpString=".jpeg") returned 5 [0071.518] lstrcmpiW (lpString1=".jpeg", lpString2=".json") returned -1 [0071.518] lstrlenW (lpString=".jpf") returned 4 [0071.518] lstrcmpiW (lpString1=".jpf", lpString2="json") returned -1 [0071.518] lstrlenW (lpString=".jpg") returned 4 [0071.518] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0071.518] lstrlenW (lpString=".jpx") returned 4 [0071.518] lstrcmpiW (lpString1=".jpx", lpString2="json") returned -1 [0071.518] lstrlenW (lpString=".js") returned 3 [0071.518] lstrcmpiW (lpString1=".js", lpString2="son") returned -1 [0071.518] lstrlenW (lpString=".jsf") returned 4 [0071.518] lstrcmpiW (lpString1=".jsf", lpString2="json") returned -1 [0071.518] lstrlenW (lpString=".json") returned 5 [0071.518] lstrcmpiW (lpString1=".json", lpString2=".json") returned 0 [0071.518] lstrlenW (lpString="messages.json") returned 13 [0071.518] lstrlenW (lpString=".wiki") returned 5 [0071.518] lstrcmpiW (lpString1=".wiki", lpString2=".json") returned 1 [0071.518] lstrlenW (lpString="messages.json") returned 13 [0071.518] lstrcmpiW (lpString1="boot.ini", lpString2="messages.json") returned -1 [0071.519] lstrcmpiW (lpString1="bootfont.bin", lpString2="messages.json") returned -1 [0071.519] lstrcmpiW (lpString1="ntldr", lpString2="messages.json") returned 1 [0071.519] lstrcmpiW (lpString1="ntdetect.com", lpString2="messages.json") returned 1 [0071.519] lstrcmpiW (lpString1="io.sys", lpString2="messages.json") returned -1 [0071.519] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="messages.json") returned -1 [0071.519] lstrcmpiW (lpString1="Info.hta", lpString2="messages.json") returned -1 [0071.519] lstrcmpiW (lpString1="1Black.exe", lpString2="messages.json") returned -1 [0071.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0071.519] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f0b190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f0c130, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x119, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 0 [0071.519] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.519] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.519] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0071.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt") returned 138 [0071.519] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt") returned 1 [0071.519] lstrlenW (lpString="lt") returned 2 [0071.519] lstrcmpiW (lpString1="C:\\Windows", lpString2="lt") returned -1 [0071.519] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0xfffe) returned 0x406bd38 [0071.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt") returned 138 [0071.519] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.520] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.520] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x11d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.520] lstrlenW (lpString="messages.json") returned 13 [0071.520] lstrlenW (lpString=".1cd") returned 4 [0071.520] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0071.520] lstrlenW (lpString=".3ds") returned 4 [0071.520] lstrcmpiW (lpString1=".3ds", lpString2="json") returned -1 [0071.520] lstrlenW (lpString=".3fr") returned 4 [0071.520] lstrcmpiW (lpString1=".3fr", lpString2="json") returned -1 [0071.520] lstrlenW (lpString=".3g2") returned 4 [0071.520] lstrcmpiW (lpString1=".3g2", lpString2="json") returned -1 [0071.520] lstrlenW (lpString=".3gp") returned 4 [0071.520] lstrcmpiW (lpString1=".3gp", lpString2="json") returned -1 [0071.520] lstrlenW (lpString=".7z") returned 3 [0071.520] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0071.520] lstrlenW (lpString=".accda") returned 6 [0071.520] lstrcmpiW (lpString1=".accda", lpString2="s.json") returned -1 [0071.520] lstrlenW (lpString=".accdb") returned 6 [0071.520] lstrcmpiW (lpString1=".accdb", lpString2="s.json") returned -1 [0071.520] lstrlenW (lpString=".accdc") returned 6 [0071.520] lstrcmpiW (lpString1=".accdc", lpString2="s.json") returned -1 [0071.520] lstrlenW (lpString=".accde") returned 6 [0071.520] lstrcmpiW (lpString1=".accde", lpString2="s.json") returned -1 [0071.520] lstrlenW (lpString=".accdt") returned 6 [0071.520] lstrcmpiW (lpString1=".accdt", lpString2="s.json") returned -1 [0071.520] lstrlenW (lpString=".accdw") returned 6 [0071.520] lstrcmpiW (lpString1=".accdw", lpString2="s.json") returned -1 [0071.520] lstrlenW (lpString=".adb") returned 4 [0071.520] lstrcmpiW (lpString1=".adb", lpString2="json") returned -1 [0071.520] lstrlenW (lpString=".adp") returned 4 [0071.520] lstrcmpiW (lpString1=".adp", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".ai") returned 3 [0071.521] lstrcmpiW (lpString1=".ai", lpString2="son") returned -1 [0071.521] lstrlenW (lpString=".ai3") returned 4 [0071.521] lstrcmpiW (lpString1=".ai3", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".ai4") returned 4 [0071.521] lstrcmpiW (lpString1=".ai4", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".ai5") returned 4 [0071.521] lstrcmpiW (lpString1=".ai5", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".ai6") returned 4 [0071.521] lstrcmpiW (lpString1=".ai6", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".ai7") returned 4 [0071.521] lstrcmpiW (lpString1=".ai7", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".ai8") returned 4 [0071.521] lstrcmpiW (lpString1=".ai8", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".anim") returned 5 [0071.521] lstrcmpiW (lpString1=".anim", lpString2=".json") returned -1 [0071.521] lstrlenW (lpString=".arw") returned 4 [0071.521] lstrcmpiW (lpString1=".arw", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".as") returned 3 [0071.521] lstrcmpiW (lpString1=".as", lpString2="son") returned -1 [0071.521] lstrlenW (lpString=".asa") returned 4 [0071.521] lstrcmpiW (lpString1=".asa", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".asc") returned 4 [0071.521] lstrcmpiW (lpString1=".asc", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".ascx") returned 5 [0071.521] lstrcmpiW (lpString1=".ascx", lpString2=".json") returned -1 [0071.521] lstrlenW (lpString=".asm") returned 4 [0071.521] lstrcmpiW (lpString1=".asm", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".asmx") returned 5 [0071.521] lstrcmpiW (lpString1=".asmx", lpString2=".json") returned -1 [0071.521] lstrlenW (lpString=".asp") returned 4 [0071.521] lstrcmpiW (lpString1=".asp", lpString2="json") returned -1 [0071.521] lstrlenW (lpString=".aspx") returned 5 [0071.521] lstrcmpiW (lpString1=".aspx", lpString2=".json") returned -1 [0071.522] lstrlenW (lpString=".asr") returned 4 [0071.522] lstrcmpiW (lpString1=".asr", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".asx") returned 4 [0071.522] lstrcmpiW (lpString1=".asx", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".avi") returned 4 [0071.522] lstrcmpiW (lpString1=".avi", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".avs") returned 4 [0071.522] lstrcmpiW (lpString1=".avs", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".backup") returned 7 [0071.522] lstrcmpiW (lpString1=".backup", lpString2="es.json") returned -1 [0071.522] lstrlenW (lpString=".bak") returned 4 [0071.522] lstrcmpiW (lpString1=".bak", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".bay") returned 4 [0071.522] lstrcmpiW (lpString1=".bay", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".bd") returned 3 [0071.522] lstrcmpiW (lpString1=".bd", lpString2="son") returned -1 [0071.522] lstrlenW (lpString=".bin") returned 4 [0071.522] lstrcmpiW (lpString1=".bin", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".bmp") returned 4 [0071.522] lstrcmpiW (lpString1=".bmp", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".bz2") returned 4 [0071.522] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".c") returned 2 [0071.522] lstrcmpiW (lpString1=".c", lpString2="on") returned -1 [0071.522] lstrlenW (lpString=".cdr") returned 4 [0071.522] lstrcmpiW (lpString1=".cdr", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".cer") returned 4 [0071.522] lstrcmpiW (lpString1=".cer", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".cf") returned 3 [0071.522] lstrcmpiW (lpString1=".cf", lpString2="son") returned -1 [0071.522] lstrlenW (lpString=".cfc") returned 4 [0071.522] lstrcmpiW (lpString1=".cfc", lpString2="json") returned -1 [0071.522] lstrlenW (lpString=".cfm") returned 4 [0071.522] lstrcmpiW (lpString1=".cfm", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".cfml") returned 5 [0071.523] lstrcmpiW (lpString1=".cfml", lpString2=".json") returned -1 [0071.523] lstrlenW (lpString=".cfu") returned 4 [0071.523] lstrcmpiW (lpString1=".cfu", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".chm") returned 4 [0071.523] lstrcmpiW (lpString1=".chm", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".cin") returned 4 [0071.523] lstrcmpiW (lpString1=".cin", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".class") returned 6 [0071.523] lstrcmpiW (lpString1=".class", lpString2="s.json") returned -1 [0071.523] lstrlenW (lpString=".clx") returned 4 [0071.523] lstrcmpiW (lpString1=".clx", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".config") returned 7 [0071.523] lstrcmpiW (lpString1=".config", lpString2="es.json") returned -1 [0071.523] lstrlenW (lpString=".cpp") returned 4 [0071.523] lstrcmpiW (lpString1=".cpp", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".cr2") returned 4 [0071.523] lstrcmpiW (lpString1=".cr2", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".crt") returned 4 [0071.523] lstrcmpiW (lpString1=".crt", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".crw") returned 4 [0071.523] lstrcmpiW (lpString1=".crw", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".cs") returned 3 [0071.523] lstrcmpiW (lpString1=".cs", lpString2="son") returned -1 [0071.523] lstrlenW (lpString=".css") returned 4 [0071.523] lstrcmpiW (lpString1=".css", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".csv") returned 4 [0071.523] lstrcmpiW (lpString1=".csv", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".cub") returned 4 [0071.523] lstrcmpiW (lpString1=".cub", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".dae") returned 4 [0071.523] lstrcmpiW (lpString1=".dae", lpString2="json") returned -1 [0071.523] lstrlenW (lpString=".dat") returned 4 [0071.523] lstrcmpiW (lpString1=".dat", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".db") returned 3 [0071.524] lstrcmpiW (lpString1=".db", lpString2="son") returned -1 [0071.524] lstrlenW (lpString=".dbf") returned 4 [0071.524] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".dbx") returned 4 [0071.524] lstrcmpiW (lpString1=".dbx", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".dc3") returned 4 [0071.524] lstrcmpiW (lpString1=".dc3", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".dcm") returned 4 [0071.524] lstrcmpiW (lpString1=".dcm", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".dcr") returned 4 [0071.524] lstrcmpiW (lpString1=".dcr", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".der") returned 4 [0071.524] lstrcmpiW (lpString1=".der", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".dib") returned 4 [0071.524] lstrcmpiW (lpString1=".dib", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".dic") returned 4 [0071.524] lstrcmpiW (lpString1=".dic", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".dif") returned 4 [0071.524] lstrcmpiW (lpString1=".dif", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".divx") returned 5 [0071.524] lstrcmpiW (lpString1=".divx", lpString2=".json") returned -1 [0071.524] lstrlenW (lpString=".djvu") returned 5 [0071.524] lstrcmpiW (lpString1=".djvu", lpString2=".json") returned -1 [0071.524] lstrlenW (lpString=".dng") returned 4 [0071.524] lstrcmpiW (lpString1=".dng", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".doc") returned 4 [0071.524] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".docm") returned 5 [0071.524] lstrcmpiW (lpString1=".docm", lpString2=".json") returned -1 [0071.524] lstrlenW (lpString=".docx") returned 5 [0071.524] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0071.524] lstrlenW (lpString=".dot") returned 4 [0071.524] lstrcmpiW (lpString1=".dot", lpString2="json") returned -1 [0071.524] lstrlenW (lpString=".dotm") returned 5 [0071.525] lstrcmpiW (lpString1=".dotm", lpString2=".json") returned -1 [0071.525] lstrlenW (lpString=".dotx") returned 5 [0071.525] lstrcmpiW (lpString1=".dotx", lpString2=".json") returned -1 [0071.525] lstrlenW (lpString=".dpx") returned 4 [0071.525] lstrcmpiW (lpString1=".dpx", lpString2="json") returned -1 [0071.525] lstrlenW (lpString=".dqy") returned 4 [0071.525] lstrcmpiW (lpString1=".dqy", lpString2="json") returned -1 [0071.525] lstrlenW (lpString=".dsn") returned 4 [0071.525] lstrcmpiW (lpString1=".dsn", lpString2="json") returned -1 [0071.525] lstrlenW (lpString=".dt") returned 3 [0071.525] lstrcmpiW (lpString1=".dt", lpString2="son") returned -1 [0071.525] lstrlenW (lpString=".dtd") returned 4 [0071.525] lstrcmpiW (lpString1=".dtd", lpString2="json") returned -1 [0071.525] lstrlenW (lpString=".dwg") returned 4 [0071.525] lstrcmpiW (lpString1=".dwg", lpString2="json") returned -1 [0071.525] lstrlenW (lpString=".dwt") returned 4 [0071.525] lstrcmpiW (lpString1=".dwt", lpString2="json") returned -1 [0071.525] lstrlenW (lpString=".dx") returned 3 [0071.525] lstrcmpiW (lpString1=".dx", lpString2="son") returned -1 [0071.525] lstrlenW (lpString=".dxf") returned 4 [0071.525] lstrcmpiW (lpString1=".dxf", lpString2="json") returned -1 [0071.525] lstrlenW (lpString=".edml") returned 5 [0071.525] lstrcmpiW (lpString1=".edml", lpString2=".json") returned -1 [0071.525] lstrlenW (lpString=".efd") returned 4 [0071.525] lstrcmpiW (lpString1=".efd", lpString2="json") returned -1 [0071.525] lstrlenW (lpString=".elf") returned 4 [0071.525] lstrcmpiW (lpString1=".elf", lpString2="json") returned -1 [0071.525] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.525] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x406bd38 | out: hHeap=0x8d0000) returned 1 [0071.526] FindNextFileW (in: hFindFile=0x3f124c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0071.526] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.652] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f312f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x86f312f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.653] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x86f312f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x86f33230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x871928f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x102, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.921] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.922] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8266a530, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8266f350, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.922] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8266f350, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8266f350, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x376, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.922] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.922] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.922] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ca", cAlternateFileName="")) returned 1 [0071.922] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.922] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82676880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8267ddb0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.922] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8267ddb0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8267ddb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aab310, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.922] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.923] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.923] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cs", cAlternateFileName="")) returned 1 [0071.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.923] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826a0090, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a27a0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826a27a0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.923] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826a27a0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826a4eb0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x297, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.923] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.923] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.923] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da", cAlternateFileName="")) returned 1 [0071.923] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.923] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ac3e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826b1200, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.924] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826b1200, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826b1200, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.924] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.924] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.924] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de", cAlternateFileName="")) returned 1 [0071.924] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.925] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826b8730, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826bae40, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.925] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826bae40, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826bae40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bd, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.925] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.925] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.925] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el", cAlternateFileName="")) returned 1 [0071.925] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.925] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826c2370, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826c7190, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.925] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826c7190, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826c7190, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x36b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.925] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.925] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.925] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en", cAlternateFileName="")) returned 1 [0071.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.926] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ce6c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d0dd0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826d0dd0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.926] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826d0dd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826d34e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.926] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.926] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.926] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en_GB", cAlternateFileName="")) returned 1 [0071.926] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.926] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826d8300, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826df830, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826df830, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.926] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826df830, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826e1f40, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.926] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.927] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.927] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es", cAlternateFileName="")) returned 1 [0071.927] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.927] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826e9470, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826ebb80, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.927] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826ebb80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826ebb80, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b8, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.927] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.927] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.927] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es_419", cAlternateFileName="")) returned 1 [0071.927] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.927] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826f30b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x826f7ed0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.927] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x826f7ed0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x826f7ed0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.928] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.928] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.928] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et", cAlternateFileName="")) returned 1 [0071.928] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.928] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x826ff400, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82701b10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82701b10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.928] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82701b10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82704220, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x261, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.928] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.928] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.928] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi", cAlternateFileName="")) returned 1 [0071.928] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.928] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82709040, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8270de60, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.929] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8270de60, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8270de60, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2a1, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.929] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.929] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.929] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fil", cAlternateFileName="")) returned 1 [0071.929] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.929] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82715390, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82717aa0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.929] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82717aa0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82717aa0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82aada20, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2b4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.929] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.929] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.929] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr", cAlternateFileName="")) returned 1 [0071.929] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.930] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8271efd0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827216e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827216e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.930] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827216e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82723df0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.930] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.930] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.930] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hi", cAlternateFileName="")) returned 1 [0071.930] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.930] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82728c10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8272da30, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.930] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8272da30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8272da30, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x3ad, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.930] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.930] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.931] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hr", cAlternateFileName="")) returned 1 [0071.931] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.931] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827412b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827439c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827439c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.931] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827439c0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827460d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x279, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.931] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.931] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.931] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu", cAlternateFileName="")) returned 1 [0071.931] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.931] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8274aef0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274d600, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8274d600, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.931] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8274d600, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8274fd10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2c6, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.932] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.932] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.932] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="id", cAlternateFileName="")) returned 1 [0071.932] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.932] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82752420, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.932] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82752420, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82752420, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x269, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.932] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.932] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.932] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it", cAlternateFileName="")) returned 1 [0071.932] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.932] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82759950, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8275c060, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.932] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8275c060, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8275c060, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x26e, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.933] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.933] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.933] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja", cAlternateFileName="")) returned 1 [0071.933] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.933] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82763590, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82765ca0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.933] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82765ca0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82765ca0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.933] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.933] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.934] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko", cAlternateFileName="")) returned 1 [0071.934] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.934] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8276d1d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8276f8e0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.934] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8276f8e0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8276f8e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29d, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.934] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.934] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.934] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lt", cAlternateFileName="")) returned 1 [0071.934] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.935] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82776e10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82779520, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.935] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82779520, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82779520, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2ae, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.935] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.935] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.935] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="lv", cAlternateFileName="")) returned 1 [0071.936] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.936] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8277e340, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82783160, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.936] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82783160, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82783160, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2bb, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.936] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.936] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.936] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nb", cAlternateFileName="")) returned 1 [0071.936] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.937] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82787f80, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8278a690, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.937] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8278a690, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8278a690, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x284, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.937] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.937] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.937] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl", cAlternateFileName="")) returned 1 [0071.937] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.938] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82791bc0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827942d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827942d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.938] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827942d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827969e0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab0130, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.938] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.938] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.938] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl", cAlternateFileName="")) returned 1 [0071.938] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.939] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8279b800, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8279df10, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.939] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8279df10, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8279df10, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.939] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.939] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.939] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_BR", cAlternateFileName="")) returned 1 [0071.940] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.940] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827a2d30, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827a5440, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.940] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827a5440, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827a5440, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.940] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.940] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.940] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt_PT", cAlternateFileName="")) returned 1 [0071.940] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.941] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827aa260, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827af080, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.941] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827af080, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827af080, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x295, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.941] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.941] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.941] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ro", cAlternateFileName="")) returned 1 [0071.941] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.942] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827b3ea0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b65b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827b65b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.942] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827b65b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827b8cc0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.942] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.942] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.942] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru", cAlternateFileName="")) returned 1 [0071.942] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.943] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827c7720, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cc540, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827cc540, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.943] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827cc540, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827cec50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x30f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.943] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.943] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.943] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sk", cAlternateFileName="")) returned 1 [0071.943] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12748 [0071.944] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827e4be0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e72f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827e72f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.944] FindNextFileW (in: hFindFile=0x3f12748, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827e72f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827e9a00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x29f, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.944] FindClose (in: hFindFile=0x3f12748 | out: hFindFile=0x3f12748) returned 1 [0071.944] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.944] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sl", cAlternateFileName="")) returned 1 [0071.944] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.945] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x827f5d50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fab70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x827fab70, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.945] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x827fab70, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x827fd280, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x282, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.945] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.945] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.945] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sr", cAlternateFileName="")) returned 1 [0071.945] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.945] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828095d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8280e3f0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8280e3f0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.946] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8280e3f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82821c70, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x32c, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.946] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.946] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.946] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv", cAlternateFileName="")) returned 1 [0071.946] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.947] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8282b8b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828306d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828306d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.947] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828306d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8283ca20, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x289, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.947] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.947] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.947] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="th", cAlternateFileName="")) returned 1 [0071.947] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.947] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8284db90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828529b0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.947] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x828529b0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828529b0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x44b, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.948] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.948] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.948] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr", cAlternateFileName="")) returned 1 [0071.948] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.948] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82863b20, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82866230, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.949] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82866230, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82866230, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab2840, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x28a, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.949] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.949] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.949] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="uk", cAlternateFileName="")) returned 1 [0071.949] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.949] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x8286b050, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8286d760, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.949] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8286d760, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8286d760, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x315, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.949] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.950] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.950] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="vi", cAlternateFileName="")) returned 1 [0071.950] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.950] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82872580, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82874c90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.950] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82874c90, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82874c90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x2d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.951] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.951] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.951] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_CN", cAlternateFileName="")) returned 1 [0071.951] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.951] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x82879ab0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x8287e8d0, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.951] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x8287e8d0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x8287e8d0, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x253, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.951] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.951] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.951] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 1 [0071.951] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\*", lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12788 [0071.952] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0071.952] FindNextFileW (in: hFindFile=0x3f12788, lpFindFileData=0x3eddcb4 | out: lpFindFileData=0x3eddcb4*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x82885e00, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82ab4f50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x280, dwReserved0=0x0, dwReserved1=0x0, cFileName="messages.json", cAlternateFileName="MESSAG~1.JSO")) returned 1 [0071.952] FindClose (in: hFindFile=0x3f12788 | out: hFindFile=0x3f12788) returned 1 [0071.952] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fb54d0 | out: hHeap=0x8d0000) returned 1 [0071.953] FindNextFileW (in: hFindFile=0x3f126c8, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828836f0, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x82885e00, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x82885e00, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh_TW", cAlternateFileName="")) returned 0 [0071.953] FindClose (in: hFindFile=0x3f126c8 | out: hFindFile=0x3f126c8) returned 1 [0071.953] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fa54c8 | out: hHeap=0x8d0000) returned 1 [0071.953] FindNextFileW (in: hFindFile=0x3f12708, lpFindFileData=0x3ede1ac | out: lpFindFileData=0x3ede1ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x828e7880, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x828e9f90, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x828e9f90, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="_metadata", cAlternateFileName="_METAD~1")) returned 1 [0072.671] FindClose (in: hFindFile=0x3f12188 | out: hFindFile=0x3f12188) returned 1 [0072.672] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3fa54c8 | out: hHeap=0x8d0000) returned 1 [0072.672] FindNextFileW (in: hFindFile=0x3f12548, lpFindFileData=0x3eddf30 | out: lpFindFileData=0x3eddf30*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Roaming", cAlternateFileName="")) returned 0 [0072.673] FindClose (in: hFindFile=0x3f12548 | out: hFindFile=0x3f12548) returned 1 [0072.673] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f954c0 | out: hHeap=0x8d0000) returned 1 [0072.673] FindNextFileW (in: hFindFile=0x3f12488, lpFindFileData=0x3ede1ac | out: lpFindFileData=0x3ede1ac*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AppData", cAlternateFileName="")) returned 0 [0072.673] FindClose (in: hFindFile=0x3f12488 | out: hFindFile=0x3f12488) returned 1 [0072.673] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f43488 | out: hHeap=0x8d0000) returned 1 [0072.673] FindNextFileW (in: hFindFile=0x3f121c8, lpFindFileData=0x3ede428 | out: lpFindFileData=0x3ede428*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0 [0072.673] FindClose (in: hFindFile=0x3f121c8 | out: hFindFile=0x3f121c8) returned 1 [0072.673] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f33480 | out: hHeap=0x8d0000) returned 1 [0072.673] FindNextFileW (in: hFindFile=0x3f12408, lpFindFileData=0x3ede6a4 | out: lpFindFileData=0x3ede6a4*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Users", cAlternateFileName="")) returned 0 [0072.673] FindClose (in: hFindFile=0x3f12408 | out: hFindFile=0x3f12408) returned 1 [0072.673] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f754b0 | out: hHeap=0x8d0000) returned 1 [0072.675] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x50f82a50, ftCreationTime.dwHighDateTime=0x1d2dd9e, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="C", cAlternateFileName="")) returned 0 [0072.675] FindClose (in: hFindFile=0x3f12648 | out: hFindFile=0x3f12648) returned 1 [0072.675] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f654a8 | out: hHeap=0x8d0000) returned 1 [0072.675] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2012, ftCreationTime.dwLowDateTime=0x28d257a0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x50f82a50, ftLastAccessTime.dwHighDateTime=0x1d2dd9e, ftLastWriteTime.dwLowDateTime=0x50f82a50, ftLastWriteTime.dwHighDateTime=0x1d2dd9e, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Virtualized", cAlternateFileName="VIRTUA~1")) returned 0 [0072.675] FindClose (in: hFindFile=0x3f125c8 | out: hFindFile=0x3f125c8) returned 1 [0072.675] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f854b8 | out: hHeap=0x8d0000) returned 1 [0072.676] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Themes", cAlternateFileName="")) returned 1 [0072.677] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\*", lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f125c8 [0072.677] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d1fc80, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0072.677] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xd8d1fc80, ftCreationTime.dwHighDateTime=0x1d3373f, ftLastAccessTime.dwLowDateTime=0xd8d1fc80, ftLastAccessTime.dwHighDateTime=0x1d3373f, ftLastWriteTime.dwLowDateTime=0xd8d6bf40, ftLastWriteTime.dwHighDateTime=0x1d3373f, nFileSizeHigh=0x0, nFileSizeLow=0x70a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Custom.theme", cAlternateFileName="CUSTOM~1.THE")) returned 1 [0072.677] FindClose (in: hFindFile=0x3f125c8 | out: hFindFile=0x3f125c8) returned 1 [0072.677] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f33480 | out: hHeap=0x8d0000) returned 1 [0072.679] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x22, ftCreationTime.dwLowDateTime=0x28ea2560, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2c4d89a0, ftLastAccessTime.dwHighDateTime=0x1d4d597, ftLastWriteTime.dwLowDateTime=0x2c4d89a0, ftLastWriteTime.dwHighDateTime=0x1d4d597, nFileSizeHigh=0x0, nFileSizeLow=0x100000, dwReserved0=0x0, dwReserved1=0x0, cFileName="UsrClass.dat", cAlternateFileName="")) returned 1 [0074.073] FindClose (in: hFindFile=0x3f12648 | out: hFindFile=0x3f12648) returned 1 [0074.074] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f43488 | out: hHeap=0x8d0000) returned 1 [0074.074] FindNextFileW (in: hFindFile=0x3f12108, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xc87fb40, ftCreationTime.dwHighDateTime=0x1d4d0c5, ftLastAccessTime.dwLowDateTime=0xbdff8a90, ftLastAccessTime.dwHighDateTime=0x1d4cbe4, ftLastWriteTime.dwLowDateTime=0xbdff8a90, ftLastWriteTime.dwHighDateTime=0x1d4cbe4, nFileSizeHigh=0x0, nFileSizeLow=0x723e, dwReserved0=0x0, dwReserved1=0x0, cFileName="cxln trTpnDpGQeKH.bmp", cAlternateFileName="CXLNTR~1.BMP")) returned 1 [0074.074] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\*", lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12648 [0074.378] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.378] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 1 [0074.380] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\History\\History.IE5\\*", lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12588 [0074.380] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.380] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd9824200, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x91, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.380] FindClose (in: hFindFile=0x3f12588 | out: hFindFile=0x3f12588) returned 1 [0074.380] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401bd10 | out: hHeap=0x8d0000) returned 1 [0074.380] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97fe0a0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97fe0a0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97fe0a0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="History.IE5", cAlternateFileName="")) returned 0 [0074.380] FindClose (in: hFindFile=0x3f12648 | out: hFindFile=0x3f12648) returned 1 [0074.381] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f43488 | out: hHeap=0x8d0000) returned 1 [0074.382] FindNextFileW (in: hFindFile=0x3f12108, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0xce105170, ftCreationTime.dwHighDateTime=0x1d4c9b0, ftLastAccessTime.dwLowDateTime=0xe2c07a10, ftLastAccessTime.dwHighDateTime=0x1d4d23d, ftLastWriteTime.dwLowDateTime=0xe2c07a10, ftLastWriteTime.dwHighDateTime=0x1d4d23d, nFileSizeHigh=0x0, nFileSizeLow=0x72b5, dwReserved0=0x0, dwReserved1=0x0, cFileName="IOJ0_DmZKx.jpg", cAlternateFileName="IOJ0_D~1.JPG")) returned 1 [0074.383] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\*", lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12648 [0074.385] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd978bc80, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd978bc80, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.385] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 1 [0074.387] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\*", lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12588 [0074.387] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.387] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="03J4UQW0", cAlternateFileName="")) returned 1 [0074.387] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\03J4UQW0\\*", lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f125c8 [0074.388] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.388] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.388] FindClose (in: hFindFile=0x3f125c8 | out: hFindFile=0x3f125c8) returned 1 [0074.388] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0074.388] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.389] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\KETAJP6D\\*", lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f125c8 [0074.389] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.389] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.389] FindClose (in: hFindFile=0x3f125c8 | out: hFindFile=0x3f125c8) returned 1 [0074.391] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0074.391] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VB18B0KB", cAlternateFileName="")) returned 1 [0074.391] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\VB18B0KB\\*", lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f125c8 [0074.391] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.391] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.391] FindClose (in: hFindFile=0x3f125c8 | out: hFindFile=0x3f125c8) returned 1 [0074.391] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0074.391] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 1 [0074.391] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\Temporary Internet Files\\Content.IE5\\XT1RPYG9\\*", lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f125c8 [0074.392] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.392] FindNextFileW (in: hFindFile=0x3f125c8, lpFindFileData=0x3ede920 | out: lpFindFileData=0x3ede920*(dwFileAttributes=0x2006, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x43, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0074.392] FindClose (in: hFindFile=0x3f125c8 | out: hFindFile=0x3f125c8) returned 1 [0074.393] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0074.393] FindNextFileW (in: hFindFile=0x3f12588, lpFindFileData=0x3edeb9c | out: lpFindFileData=0x3edeb9c*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97b1de0, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97b1de0, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97b1de0, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="XT1RPYG9", cAlternateFileName="")) returned 0 [0074.393] FindClose (in: hFindFile=0x3f12588 | out: hFindFile=0x3f12588) returned 1 [0074.393] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x401bd10 | out: hHeap=0x8d0000) returned 1 [0074.393] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd978bc80, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Content.IE5", cAlternateFileName="")) returned 0 [0074.393] FindClose (in: hFindFile=0x3f12648 | out: hFindFile=0x3f12648) returned 1 [0074.393] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f43488 | out: hHeap=0x8d0000) returned 1 [0074.394] FindNextFileW (in: hFindFile=0x3f12108, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x68157d30, ftCreationTime.dwHighDateTime=0x1d4cc91, ftLastAccessTime.dwLowDateTime=0x7c10b8d0, ftLastAccessTime.dwHighDateTime=0x1d4d0ac, ftLastWriteTime.dwLowDateTime=0x7c10b8d0, ftLastWriteTime.dwHighDateTime=0x1d4d0ac, nFileSizeHigh=0x0, nFileSizeLow=0xe3f3, dwReserved0=0x0, dwReserved1=0x0, cFileName="ul0UMBkxMQy_mBsLM.m4a", cAlternateFileName="UL0UMB~1.M4A")) returned 1 [0074.395] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Temp\\WPDNSE\\*", lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12648 [0074.395] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0074.395] FindNextFileW (in: hFindFile=0x3f12648, lpFindFileData=0x3edee18 | out: lpFindFileData=0x3edee18*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x874c95a0, ftCreationTime.dwHighDateTime=0x1d4d5ae, ftLastAccessTime.dwLowDateTime=0x874c95a0, ftLastAccessTime.dwHighDateTime=0x1d4d5ae, ftLastWriteTime.dwLowDateTime=0x874c95a0, ftLastWriteTime.dwHighDateTime=0x1d4d5ae, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0074.395] FindClose (in: hFindFile=0x3f12648 | out: hFindFile=0x3f12648) returned 1 [0074.395] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f43488 | out: hHeap=0x8d0000) returned 1 [0074.395] FindNextFileW (in: hFindFile=0x3f12108, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x5c13ac80, ftCreationTime.dwHighDateTime=0x1d4d102, ftLastAccessTime.dwLowDateTime=0x1fb756e0, ftLastAccessTime.dwHighDateTime=0x1d4cef7, ftLastWriteTime.dwLowDateTime=0x1fb756e0, ftLastWriteTime.dwHighDateTime=0x1d4cef7, nFileSizeHigh=0x0, nFileSizeLow=0x1240b, dwReserved0=0x0, dwReserved1=0x0, cFileName="XsYLv7vLjkckmu6y3.png", cAlternateFileName="XSYLV7~1.PNG")) returned 1 [0075.392] FindClose (in: hFindFile=0x3f12248 | out: hFindFile=0x3f12248) returned 1 [0075.392] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0075.392] FindNextFileW (in: hFindFile=0x3f123c8, lpFindFileData=0x3edf58c | out: lpFindFileData=0x3edf58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="VISIO", cAlternateFileName="")) returned 1 [0075.392] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\VISIO\\*", lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12248 [0075.393] FindNextFileW (in: hFindFile=0x3f12248, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.393] FindNextFileW (in: hFindFile=0x3f12248, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x80ac5760, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0x80ac5760, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x80ac5760, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.393] FindClose (in: hFindFile=0x3f12248 | out: hFindFile=0x3f12248) returned 1 [0075.393] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x3f13470 | out: hHeap=0x8d0000) returned 1 [0075.393] FindNextFileW (in: hFindFile=0x3f123c8, lpFindFileData=0x3edf58c | out: lpFindFileData=0x3edf58c*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Windows", cAlternateFileName="")) returned 1 [0075.393] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\*", lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12248 [0075.393] FindNextFileW (in: hFindFile=0x3f12248, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x60ae73a0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x60ae73a0, ftLastWriteTime.dwHighDateTime=0x1d2de2a, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.393] FindNextFileW (in: hFindFile=0x3f12248, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="AIT", cAlternateFileName="")) returned 1 [0075.394] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\AIT\\*", lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12548 [0075.394] FindNextFileW (in: hFindFile=0x3f12548, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.394] FindNextFileW (in: hFindFile=0x3f12548, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x14, ftCreationTime.dwLowDateTime=0xfd9b5b52, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd9b5b52, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xd5be7172, ftLastWriteTime.dwHighDateTime=0x1ca042b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0075.394] FindClose (in: hFindFile=0x3f12548 | out: hFindFile=0x3f12548) returned 1 [0075.394] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x402bd18 | out: hHeap=0x8d0000) returned 1 [0075.394] FindNextFileW (in: hFindFile=0x3f12248, lpFindFileData=0x3edf310 | out: lpFindFileData=0x3edf310*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Caches", cAlternateFileName="")) returned 1 [0075.394] FindFirstFileW (in: lpFileName="C:\\Users\\All Users\\Microsoft\\Windows\\Caches\\*", lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3f12548 [0075.395] FindNextFileW (in: hFindFile=0x3f12548, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x2010, ftCreationTime.dwLowDateTime=0x283ea490, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x9b86da60, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x9b86da60, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0075.395] FindNextFileW (in: hFindFile=0x3f12548, lpFindFileData=0x3edf094 | out: lpFindFileData=0x3edf094*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x284cecd2, ftCreationTime.dwHighDateTime=0x1ca043f, ftLastAccessTime.dwLowDateTime=0x284cecd2, ftLastAccessTime.dwHighDateTime=0x1ca043f, ftLastWriteTime.dwLowDateTime=0x284cecd2, ftLastWriteTime.dwHighDateTime=0x1ca043f, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="cversions.2.db", cAlternateFileName="CVERSI~1.DB")) returned 1 Thread: id = 26 os_tid = 0xae0 Process: id = "3" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x3622a000" os_pid = "0xa78" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0xa68" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 8 os_tid = 0xa7c [0047.074] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x31fc30 | out: lpSystemTimeAsFileTime=0x31fc30*(dwLowDateTime=0x999cf1b0, dwHighDateTime=0x1d58773)) [0047.074] GetCurrentProcessId () returned 0xa78 [0047.074] GetCurrentThreadId () returned 0xa7c [0047.074] GetTickCount () returned 0x11461cf [0047.074] QueryPerformanceCounter (in: lpPerformanceCount=0x31fc38 | out: lpPerformanceCount=0x31fc38*=16714476686) returned 1 [0047.076] GetModuleHandleW (lpModuleName=0x0) returned 0x4a8a0000 [0047.076] __set_app_type (_Type=0x1) [0047.076] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a8c7810) returned 0x0 [0047.076] __getmainargs (in: _Argc=0x4a8ea608, _Argv=0x4a8ea618, _Env=0x4a8ea610, _DoWildCard=0, _StartInfo=0x4a8ce0f4 | out: _Argc=0x4a8ea608, _Argv=0x4a8ea618, _Env=0x4a8ea610) returned 0 [0047.076] GetCurrentThreadId () returned 0xa7c [0047.076] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0xa7c) returned 0x3c [0047.078] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0047.078] GetProcAddress (hModule=0x76e30000, lpProcName="SetThreadUILanguage") returned 0x76e46d40 [0047.078] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0047.079] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0047.079] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x31fbc8 | out: phkResult=0x31fbc8*=0x0) returned 0x2 [0047.079] VirtualQuery (in: lpAddress=0x31fbb0, lpBuffer=0x31fb30, dwLength=0x30 | out: lpBuffer=0x31fb30*(BaseAddress=0x31f000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0047.079] VirtualQuery (in: lpAddress=0x220000, lpBuffer=0x31fb30, dwLength=0x30 | out: lpBuffer=0x31fb30*(BaseAddress=0x220000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0047.079] VirtualQuery (in: lpAddress=0x221000, lpBuffer=0x31fb30, dwLength=0x30 | out: lpBuffer=0x31fb30*(BaseAddress=0x221000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0047.079] VirtualQuery (in: lpAddress=0x224000, lpBuffer=0x31fb30, dwLength=0x30 | out: lpBuffer=0x31fb30*(BaseAddress=0x224000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0047.079] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x31fb30, dwLength=0x30 | out: lpBuffer=0x31fb30*(BaseAddress=0x320000, AllocationBase=0x0, AllocationProtect=0x0, __alignment1=0x0, RegionSize=0x140000, State=0x10000, Protect=0x1, Type=0x0, __alignment2=0x0)) returned 0x30 [0047.079] GetConsoleOutputCP () returned 0x1b5 [0047.079] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8dbfe0 | out: lpCPInfo=0x4a8dbfe0) returned 1 [0047.079] SetConsoleCtrlHandler (HandlerRoutine=0x4a8c3184, Add=1) returned 1 [0047.079] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.079] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0047.080] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.080] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a8ce194 | out: lpMode=0x4a8ce194) returned 0 [0047.080] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.080] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a8ce198 | out: lpMode=0x4a8ce198) returned 0 [0047.080] GetEnvironmentStringsW () returned 0x478a60* [0047.080] GetProcessHeap () returned 0x460000 [0047.080] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa7c) returned 0x4794f0 [0047.080] FreeEnvironmentStringsW (penv=0x478a60) returned 1 [0047.080] GetProcessHeap () returned 0x460000 [0047.080] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x8) returned 0x4788e0 [0047.080] GetEnvironmentStringsW () returned 0x478a60* [0047.080] GetProcessHeap () returned 0x460000 [0047.080] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa7c) returned 0x479f80 [0047.081] FreeEnvironmentStringsW (penv=0x478a60) returned 1 [0047.081] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x31ea88 | out: phkResult=0x31ea88*=0x44) returned 0x0 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x0, lpData=0x31eaa0*=0x18, lpcbData=0x31ea84*=0x1000) returned 0x2 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x4, lpData=0x31eaa0*=0x1, lpcbData=0x31ea84*=0x4) returned 0x0 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x0, lpData=0x31eaa0*=0x1, lpcbData=0x31ea84*=0x1000) returned 0x2 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x4, lpData=0x31eaa0*=0x0, lpcbData=0x31ea84*=0x4) returned 0x0 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x4, lpData=0x31eaa0*=0x40, lpcbData=0x31ea84*=0x4) returned 0x0 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x4, lpData=0x31eaa0*=0x40, lpcbData=0x31ea84*=0x4) returned 0x0 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x0, lpData=0x31eaa0*=0x40, lpcbData=0x31ea84*=0x1000) returned 0x2 [0047.081] RegCloseKey (hKey=0x44) returned 0x0 [0047.081] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x31ea88 | out: phkResult=0x31ea88*=0x44) returned 0x0 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x0, lpData=0x31eaa0*=0x40, lpcbData=0x31ea84*=0x1000) returned 0x2 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x4, lpData=0x31eaa0*=0x1, lpcbData=0x31ea84*=0x4) returned 0x0 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x0, lpData=0x31eaa0*=0x1, lpcbData=0x31ea84*=0x1000) returned 0x2 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x4, lpData=0x31eaa0*=0x0, lpcbData=0x31ea84*=0x4) returned 0x0 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x4, lpData=0x31eaa0*=0x9, lpcbData=0x31ea84*=0x4) returned 0x0 [0047.081] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x4, lpData=0x31eaa0*=0x9, lpcbData=0x31ea84*=0x4) returned 0x0 [0047.082] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x31ea80, lpData=0x31eaa0, lpcbData=0x31ea84*=0x1000 | out: lpType=0x31ea80*=0x0, lpData=0x31eaa0*=0x9, lpcbData=0x31ea84*=0x1000) returned 0x2 [0047.082] RegCloseKey (hKey=0x44) returned 0x0 [0047.082] time (in: timer=0x0 | out: timer=0x0) returned 0x5daca658 [0047.082] srand (_Seed=0x5daca658) [0047.082] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0047.082] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0047.082] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0047.082] GetProcessHeap () returned 0x460000 [0047.082] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x218) returned 0x47aa10 [0047.082] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x47aa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0047.082] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0047.082] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0047.082] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0047.082] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0047.082] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0047.082] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0047.082] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0047.082] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0047.082] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0047.082] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0047.082] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0047.083] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0047.083] GetProcessHeap () returned 0x460000 [0047.083] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x4794f0 | out: hHeap=0x460000) returned 1 [0047.083] GetEnvironmentStringsW () returned 0x478a60* [0047.083] GetProcessHeap () returned 0x460000 [0047.083] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xa94) returned 0x47ac30 [0047.083] FreeEnvironmentStringsW (penv=0x478a60) returned 1 [0047.083] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0047.083] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0047.083] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0047.083] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0047.083] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0047.083] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0047.083] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0047.083] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0047.083] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0047.083] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0047.083] GetProcessHeap () returned 0x460000 [0047.083] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x5c) returned 0x47b6d0 [0047.083] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x31f890 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0047.083] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x31f890, lpFilePart=0x31f870 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31f870*="Desktop") returned 0x25 [0047.083] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0047.084] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x31f5a0 | out: lpFindFileData=0x31f5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x47b740 [0047.084] FindClose (in: hFindFile=0x47b740 | out: hFindFile=0x47b740) returned 1 [0047.084] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x31f5a0 | out: lpFindFileData=0x31f5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x47b740 [0047.084] FindClose (in: hFindFile=0x47b740 | out: hFindFile=0x47b740) returned 1 [0047.084] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0047.084] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x31f5a0 | out: lpFindFileData=0x31f5a0*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x89364e20, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0x89364e20, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x47b740 [0047.084] FindClose (in: hFindFile=0x47b740 | out: hFindFile=0x47b740) returned 1 [0047.084] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0047.084] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0047.084] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0047.084] GetProcessHeap () returned 0x460000 [0047.084] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47ac30 | out: hHeap=0x460000) returned 1 [0047.084] GetEnvironmentStringsW () returned 0x47b740* [0047.085] GetProcessHeap () returned 0x460000 [0047.085] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xae8) returned 0x47c230 [0047.085] FreeEnvironmentStringsW (penv=0x47b740) returned 1 [0047.085] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0047.085] GetProcessHeap () returned 0x460000 [0047.085] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47b6d0 | out: hHeap=0x460000) returned 1 [0047.085] GetProcessHeap () returned 0x460000 [0047.085] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4016) returned 0x47cd20 [0047.085] GetProcessHeap () returned 0x460000 [0047.085] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47cd20 | out: hHeap=0x460000) returned 1 [0047.085] GetConsoleOutputCP () returned 0x1b5 [0047.085] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8dbfe0 | out: lpCPInfo=0x4a8dbfe0) returned 1 [0047.085] GetUserDefaultLCID () returned 0x409 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a8d7b50, cchData=8 | out: lpLCData=":") returned 2 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x31f9a0, cchData=128 | out: lpLCData="0") returned 2 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x31f9a0, cchData=128 | out: lpLCData="0") returned 2 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x31f9a0, cchData=128 | out: lpLCData="1") returned 2 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a8ea740, cchData=8 | out: lpLCData="/") returned 2 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a8ea4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a8ea460, cchData=32 | out: lpLCData="Tue") returned 4 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a8ea420, cchData=32 | out: lpLCData="Wed") returned 4 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a8ea3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a8ea3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0047.086] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a8ea360, cchData=32 | out: lpLCData="Sat") returned 4 [0047.087] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a8ea700, cchData=32 | out: lpLCData="Sun") returned 4 [0047.087] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a8d7b40, cchData=8 | out: lpLCData=".") returned 2 [0047.087] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a8ea4e0, cchData=8 | out: lpLCData=",") returned 2 [0047.087] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0047.088] GetProcessHeap () returned 0x460000 [0047.088] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x0, Size=0x20c) returned 0x4795c0 [0047.088] GetConsoleTitleW (in: lpConsoleTitle=0x4795c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0047.088] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.088] GetFileType (hFile=0xf4) returned 0x3 [0047.088] BrandingFormatString () returned 0x4797e0 [0047.093] GetVersion () returned 0x1db10106 [0047.093] _vsnwprintf (in: _Buffer=0x31fb10, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x31faa8 | out: _Buffer="6.1.7601") returned 8 [0047.093] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.093] GetFileType (hFile=0xf4) returned 0x3 [0047.093] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a8e6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0047.093] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a8e6340, nSize=0x2000, Arguments=0x31fab0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0047.093] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.093] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a8dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0047.093] WriteFile (in: hFile=0xf4, lpBuffer=0x4a8dc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x31fa38, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesWritten=0x31fa38*=0x24, lpOverlapped=0x0) returned 1 [0047.094] _vsnwprintf (in: _Buffer=0x4a8e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31fad8 | out: _Buffer="\r\n") returned 2 [0047.094] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.094] GetFileType (hFile=0xf4) returned 0x3 [0047.094] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.094] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a8dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0047.094] WriteFile (in: hFile=0xf4, lpBuffer=0x4a8dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31faa8, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesWritten=0x31faa8*=0x2, lpOverlapped=0x0) returned 1 [0047.094] _vsnwprintf (in: _Buffer=0x4a8e6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x31fad8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0047.094] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.094] GetFileType (hFile=0xf4) returned 0x3 [0047.094] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.094] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a8dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0047.094] WriteFile (in: hFile=0xf4, lpBuffer=0x4a8dc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x31faa8, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesWritten=0x31faa8*=0x3f, lpOverlapped=0x0) returned 1 [0047.094] _vsnwprintf (in: _Buffer=0x4a8e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31fad8 | out: _Buffer="\r\n") returned 2 [0047.094] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.094] GetFileType (hFile=0xf4) returned 0x3 [0047.094] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.094] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a8dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0047.094] WriteFile (in: hFile=0xf4, lpBuffer=0x4a8dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31faa8, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesWritten=0x31faa8*=0x2, lpOverlapped=0x0) returned 1 [0047.095] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76e30000 [0047.095] GetProcAddress (hModule=0x76e30000, lpProcName="CopyFileExW") returned 0x76e423d0 [0047.095] GetProcAddress (hModule=0x76e30000, lpProcName="IsDebuggerPresent") returned 0x76e38290 [0047.095] GetProcAddress (hModule=0x76e30000, lpProcName="SetConsoleInputExeNameW") returned 0x76e417e0 [0047.095] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.095] GetFileType (hFile=0xe8) returned 0x3 [0047.095] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0047.095] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x31f900 | out: TokenHandle=0x31f900*=0x0) returned 0xc000007c [0047.095] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x31f900 | out: TokenHandle=0x31f900*=0x50) returned 0x0 [0047.095] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x31f910, TokenInformationLength=0x4, ReturnLength=0x31f918 | out: TokenInformation=0x31f910, ReturnLength=0x31f918) returned 0x0 [0047.095] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x31f918, TokenInformationLength=0x4, ReturnLength=0x31f910 | out: TokenInformation=0x31f918, ReturnLength=0x31f910) returned 0x0 [0047.095] NtClose (Handle=0x50) returned 0x0 [0047.095] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x31f8e0, nSize=0x0, Arguments=0x31f8e8 | out: lpBuffer="韠G") returned 0xf [0047.095] GetProcessHeap () returned 0x460000 [0047.096] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x218) returned 0x461ab0 [0047.096] GetConsoleTitleW (in: lpConsoleTitle=0x31f930, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0047.096] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0047.096] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0047.097] GetProcessHeap () returned 0x460000 [0047.097] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x461ab0 | out: hHeap=0x460000) returned 1 [0047.097] LocalFree (hMem=0x4797e0) returned 0x0 [0047.097] GetProcessHeap () returned 0x460000 [0047.097] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47aa10 | out: hHeap=0x460000) returned 1 [0047.097] _vsnwprintf (in: _Buffer=0x4a8e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f618 | out: _Buffer="\r\n") returned 2 [0047.097] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.097] GetFileType (hFile=0xf4) returned 0x3 [0047.097] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.097] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a8dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0047.097] WriteFile (in: hFile=0xf4, lpBuffer=0x4a8dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31f5e8, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesWritten=0x31f5e8*=0x2, lpOverlapped=0x0) returned 1 [0047.097] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0047.097] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0047.097] _vsnwprintf (in: _Buffer=0x4a8ceb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f628 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0047.097] _vsnwprintf (in: _Buffer=0x4a8cebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f628 | out: _Buffer=">") returned 1 [0047.098] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.098] GetFileType (hFile=0xf4) returned 0x3 [0047.098] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.098] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a8dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0047.098] WriteFile (in: hFile=0xf4, lpBuffer=0x4a8dc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x31f618, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesWritten=0x31f618*=0x26, lpOverlapped=0x0) returned 1 [0047.098] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.098] GetFileType (hFile=0xe8) returned 0x3 [0047.098] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.098] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.098] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.098] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0047.099] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.099] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.099] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0047.099] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.099] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.099] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0047.099] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.099] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.099] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0047.099] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.099] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.099] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0047.099] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.099] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.099] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.099] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0047.099] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.099] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.100] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0047.100] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.100] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.100] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0047.100] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.100] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.100] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0047.100] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.100] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.100] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0047.100] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.100] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.100] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0047.100] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.100] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.100] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0047.100] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.100] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.100] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.100] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0047.100] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.101] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.101] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0047.101] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.101] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.101] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0047.101] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.101] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.101] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0047.101] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.101] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.101] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0047.101] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.101] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.101] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0047.101] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.101] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.101] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.101] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0047.101] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.101] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.101] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0047.102] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.102] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.102] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0047.102] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.102] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.102] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0047.102] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.102] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.102] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0047.102] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.102] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.102] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0047.102] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0047.103] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.103] GetFileType (hFile=0xe8) returned 0x3 [0047.103] _get_osfhandle (_FileHandle=0) returned 0xe8 [0047.103] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0047.103] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.103] GetFileType (hFile=0xf4) returned 0x3 [0047.103] _get_osfhandle (_FileHandle=1) returned 0xf4 [0047.103] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a8dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0047.103] WriteFile (in: hFile=0xf4, lpBuffer=0x4a8dc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x31f8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesWritten=0x31f8f8*=0x18, lpOverlapped=0x0) returned 1 [0047.103] GetProcessHeap () returned 0x460000 [0047.103] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4012) returned 0x47cd20 [0047.103] GetProcessHeap () returned 0x460000 [0047.103] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47cd20 | out: hHeap=0x460000) returned 1 [0047.103] _wcsicmp (_String1="mode", _String2=")") returned 68 [0047.103] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0047.103] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0047.104] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0047.104] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0047.104] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0047.104] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0047.104] GetProcessHeap () returned 0x460000 [0047.104] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb0) returned 0x4797e0 [0047.104] GetProcessHeap () returned 0x460000 [0047.104] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x1a) returned 0x474610 [0047.105] GetProcessHeap () returned 0x460000 [0047.105] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x38) returned 0x476510 [0047.106] GetConsoleOutputCP () returned 0x1b5 [0047.106] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a8dbfe0 | out: lpCPInfo=0x4a8dbfe0) returned 1 [0047.106] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0047.106] GetConsoleTitleW (in: lpConsoleTitle=0x31f8b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0047.106] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0047.106] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0047.107] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0047.107] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0047.107] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0047.107] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0047.107] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0047.107] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0047.107] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0047.107] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0047.107] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0047.107] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0047.107] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0047.107] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0047.107] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0047.107] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0047.107] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0047.107] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0047.107] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0047.107] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0047.107] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0047.107] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0047.107] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0047.107] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0047.107] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0047.107] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0047.107] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0047.107] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0047.107] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0047.107] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0047.107] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0047.107] _wcsicmp (_String1="mode", _String2="START") returned -6 [0047.107] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0047.107] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0047.107] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0047.107] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0047.107] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0047.107] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0047.108] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0047.108] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0047.108] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0047.108] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0047.108] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0047.108] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0047.108] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0047.108] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0047.108] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0047.108] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0047.108] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0047.108] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0047.108] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0047.108] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0047.108] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0047.108] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0047.108] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0047.108] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0047.108] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0047.108] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0047.108] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0047.108] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0047.108] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0047.108] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0047.108] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0047.108] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0047.108] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0047.108] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0047.108] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0047.108] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0047.108] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0047.108] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0047.108] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0047.108] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0047.108] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0047.108] _wcsicmp (_String1="mode", _String2="START") returned -6 [0047.108] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0047.109] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0047.109] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0047.109] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0047.109] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0047.109] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0047.109] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0047.109] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0047.109] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0047.109] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0047.109] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0047.109] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0047.109] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0047.109] GetProcessHeap () returned 0x460000 [0047.109] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x218) returned 0x461ab0 [0047.109] GetProcessHeap () returned 0x460000 [0047.109] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x42) returned 0x4798a0 [0047.109] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0047.109] GetProcessHeap () returned 0x460000 [0047.109] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x420) returned 0x479a80 [0047.109] SetErrorMode (uMode=0x0) returned 0x0 [0047.110] SetErrorMode (uMode=0x1) returned 0x0 [0047.110] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x479a90, lpFilePart=0x31f140 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31f140*="Desktop") returned 0x25 [0047.110] SetErrorMode (uMode=0x0) returned 0x1 [0047.110] GetProcessHeap () returned 0x460000 [0047.110] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x479a80, Size=0x66) returned 0x479a80 [0047.110] GetProcessHeap () returned 0x460000 [0047.110] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x479a80) returned 0x66 [0047.110] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0047.110] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0047.110] GetProcessHeap () returned 0x460000 [0047.110] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x128) returned 0x461cd0 [0047.110] GetProcessHeap () returned 0x460000 [0047.110] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x240) returned 0x479b00 [0047.116] GetProcessHeap () returned 0x460000 [0047.116] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x479b00, Size=0x12a) returned 0x479b00 [0047.116] GetProcessHeap () returned 0x460000 [0047.116] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x479b00) returned 0x12a [0047.116] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0047.116] GetProcessHeap () returned 0x460000 [0047.116] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xe8) returned 0x475b70 [0047.116] GetProcessHeap () returned 0x460000 [0047.116] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x475b70, Size=0x7e) returned 0x475b70 [0047.116] GetProcessHeap () returned 0x460000 [0047.116] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x475b70) returned 0x7e [0047.222] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0047.223] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x31eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eeb0) returned 0xffffffffffffffff [0047.223] GetLastError () returned 0x2 [0047.223] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x31eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eeb0) returned 0xffffffffffffffff [0047.223] GetLastError () returned 0x2 [0047.223] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0047.223] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x31eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eeb0) returned 0x475c00 [0047.223] GetProcessHeap () returned 0x460000 [0047.223] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x0, Size=0x28) returned 0x474640 [0047.224] FindClose (in: hFindFile=0x475c00 | out: hFindFile=0x475c00) returned 1 [0047.224] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x31eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eeb0) returned 0x475c00 [0047.224] GetProcessHeap () returned 0x460000 [0047.224] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x474640, Size=0x8) returned 0x4798f0 [0047.224] FindClose (in: hFindFile=0x475c00 | out: hFindFile=0x475c00) returned 1 [0047.224] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0047.224] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0047.224] GetConsoleTitleW (in: lpConsoleTitle=0x31f400, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0047.224] GetProcessHeap () returned 0x460000 [0047.224] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x21c) returned 0x479c40 [0047.225] GetConsoleTitleW (in: lpConsoleTitle=0x479c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0047.225] GetProcessHeap () returned 0x460000 [0047.225] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x479c40, Size=0xa8) returned 0x479c40 [0047.225] GetProcessHeap () returned 0x460000 [0047.225] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x479c40) returned 0xa8 [0047.225] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0047.226] GetProcessHeap () returned 0x460000 [0047.226] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x479c40 | out: hHeap=0x460000) returned 1 [0047.226] InitializeProcThreadAttributeList (in: lpAttributeList=0x31f1b8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31f178 | out: lpAttributeList=0x31f1b8, lpSize=0x31f178) returned 1 [0047.226] UpdateProcThreadAttribute (in: lpAttributeList=0x31f1b8, dwFlags=0x0, Attribute=0x60001, lpValue=0x31f168, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31f1b8, lpPreviousValue=0x0) returned 1 [0047.226] GetStartupInfoW (in: lpStartupInfo=0x31f2d0 | out: lpStartupInfo=0x31f2d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0047.226] GetProcessHeap () returned 0x460000 [0047.226] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x20) returned 0x474640 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0047.226] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0047.227] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0047.227] GetProcessHeap () returned 0x460000 [0047.227] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x474640 | out: hHeap=0x460000) returned 1 [0047.227] GetProcessHeap () returned 0x460000 [0047.227] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x12) returned 0x478900 [0047.227] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x31f1f0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31f1a0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x31f1a0*(hProcess=0x54, hThread=0x50, dwProcessId=0xacc, dwThreadId=0xad0)) returned 1 [0047.237] CloseHandle (hObject=0x50) returned 1 [0047.237] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0047.237] GetProcessHeap () returned 0x460000 [0047.237] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47c230 | out: hHeap=0x460000) returned 1 [0047.237] GetEnvironmentStringsW () returned 0x47aa10* [0047.237] GetProcessHeap () returned 0x460000 [0047.237] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xae8) returned 0x47b500 [0047.237] FreeEnvironmentStringsW (penv=0x47aa10) returned 1 [0047.237] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f50000 [0047.237] GetProcAddress (hModule=0x76f50000, lpProcName="NtQueryInformationProcess") returned 0x76fa14a0 [0047.237] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x31eaa8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x31eaa8, ReturnLength=0x0) returned 0x0 [0047.238] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x31eae0, nSize=0x380, lpNumberOfBytesRead=0x31eaa0 | out: lpBuffer=0x31eae0*, lpNumberOfBytesRead=0x31eaa0*=0x380) returned 1 [0047.238] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0049.975] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x31f0e8 | out: lpExitCode=0x31f0e8*=0x0) returned 1 [0049.975] CloseHandle (hObject=0x54) returned 1 [0049.975] _vsnwprintf (in: _Buffer=0x31f358, _BufferCount=0x13, _Format="%08X", _ArgList=0x31f0f8 | out: _Buffer="00000000") returned 8 [0049.976] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0049.976] GetProcessHeap () returned 0x460000 [0049.976] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47b500 | out: hHeap=0x460000) returned 1 [0049.976] GetEnvironmentStringsW () returned 0x47aa10* [0049.976] GetProcessHeap () returned 0x460000 [0049.976] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb0e) returned 0x47eb10 [0049.976] FreeEnvironmentStringsW (penv=0x47aa10) returned 1 [0049.976] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0049.976] GetProcessHeap () returned 0x460000 [0049.976] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47eb10 | out: hHeap=0x460000) returned 1 [0049.976] GetEnvironmentStringsW () returned 0x47aa10* [0049.976] GetProcessHeap () returned 0x460000 [0049.976] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb0e) returned 0x47eb10 [0049.976] FreeEnvironmentStringsW (penv=0x47aa10) returned 1 [0049.976] GetProcessHeap () returned 0x460000 [0049.976] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x478900 | out: hHeap=0x460000) returned 1 [0049.976] DeleteProcThreadAttributeList (in: lpAttributeList=0x31f1b8 | out: lpAttributeList=0x31f1b8) [0050.224] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0050.225] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.225] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0050.225] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.225] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a8ce194 | out: lpMode=0x4a8ce194) returned 0 [0050.225] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.225] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a8ce198 | out: lpMode=0x4a8ce198) returned 0 [0050.225] GetConsoleOutputCP () returned 0x4e3 [0050.225] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a8dbfe0 | out: lpCPInfo=0x4a8dbfe0) returned 1 [0050.226] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0050.226] GetProcessHeap () returned 0x460000 [0050.226] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x475b70 | out: hHeap=0x460000) returned 1 [0050.226] GetProcessHeap () returned 0x460000 [0050.226] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x479b00 | out: hHeap=0x460000) returned 1 [0050.226] GetProcessHeap () returned 0x460000 [0050.226] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x461cd0 | out: hHeap=0x460000) returned 1 [0050.226] GetProcessHeap () returned 0x460000 [0050.226] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x479a80 | out: hHeap=0x460000) returned 1 [0050.226] GetProcessHeap () returned 0x460000 [0050.226] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x4798a0 | out: hHeap=0x460000) returned 1 [0050.226] GetProcessHeap () returned 0x460000 [0050.226] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x461ab0 | out: hHeap=0x460000) returned 1 [0050.226] GetProcessHeap () returned 0x460000 [0050.226] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x476510 | out: hHeap=0x460000) returned 1 [0050.226] GetProcessHeap () returned 0x460000 [0050.226] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x474610 | out: hHeap=0x460000) returned 1 [0050.226] GetProcessHeap () returned 0x460000 [0050.226] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x4797e0 | out: hHeap=0x460000) returned 1 [0050.226] _vsnwprintf (in: _Buffer=0x4a8e6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f618 | out: _Buffer="\r\n") returned 2 [0050.226] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.227] GetFileType (hFile=0xf4) returned 0x3 [0050.227] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.227] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a8dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0050.227] WriteFile (in: hFile=0xf4, lpBuffer=0x4a8dc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31f5e8, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesWritten=0x31f5e8*=0x2, lpOverlapped=0x0) returned 1 [0050.227] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0050.227] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a8dc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0050.227] _vsnwprintf (in: _Buffer=0x4a8ceb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f628 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0050.227] _vsnwprintf (in: _Buffer=0x4a8cebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x31f628 | out: _Buffer=">") returned 1 [0050.227] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.227] GetFileType (hFile=0xf4) returned 0x3 [0050.227] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.227] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a8dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0050.227] WriteFile (in: hFile=0xf4, lpBuffer=0x4a8dc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x31f618, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesWritten=0x31f618*=0x26, lpOverlapped=0x0) returned 1 [0050.227] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.227] GetFileType (hFile=0xe8) returned 0x3 [0050.227] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.227] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.227] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.227] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0050.228] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.228] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.228] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.228] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0050.228] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.228] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.228] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.228] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0050.228] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.228] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.228] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.228] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0050.228] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.228] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.228] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.228] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0050.228] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.228] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.228] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.228] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0050.228] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.228] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.228] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.228] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0050.228] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.228] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.229] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.229] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0050.229] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.229] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.229] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.229] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0050.229] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.229] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.229] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.229] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0050.229] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.229] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.229] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.229] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0050.229] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.229] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.229] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.229] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0050.229] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.229] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.229] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.229] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0050.229] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.229] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.229] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.230] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0050.230] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.230] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.230] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.230] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0050.230] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.230] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.230] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.230] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0050.230] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.230] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.230] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.230] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0050.230] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.230] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.230] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.230] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0050.230] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.230] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.230] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.230] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0050.230] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.230] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.230] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.230] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0050.230] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.231] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.231] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.231] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0050.231] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.231] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.231] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.231] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0050.231] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.231] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.231] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.231] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0050.231] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.231] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.231] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.231] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0050.231] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.231] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.231] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.231] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0050.231] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.231] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.231] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.231] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0050.231] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.231] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.232] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.232] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0050.232] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.232] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.232] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.232] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0050.232] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.232] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.232] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.232] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0050.232] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.232] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.232] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.232] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0050.232] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.232] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.232] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.232] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0050.232] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.232] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.232] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.232] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0050.232] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.232] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.232] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.232] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0050.233] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.233] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.233] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.233] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0050.233] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.233] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.233] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.233] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0050.233] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.233] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.233] ReadFile (in: hFile=0xe8, lpBuffer=0x4a8dc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f918, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesRead=0x31f918*=0x1, lpOverlapped=0x0) returned 1 [0050.233] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a8dc320, cbMultiByte=1, lpWideCharStr=0x4a8de366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0050.233] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.233] GetFileType (hFile=0xe8) returned 0x3 [0050.233] _get_osfhandle (_FileHandle=0) returned 0xe8 [0050.233] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0050.233] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.233] GetFileType (hFile=0xf4) returned 0x3 [0050.233] _get_osfhandle (_FileHandle=1) returned 0xf4 [0050.233] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a8dc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0050.233] WriteFile (in: hFile=0xf4, lpBuffer=0x4a8dc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x31f8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a8dc320*, lpNumberOfBytesWritten=0x31f8f8*=0x24, lpOverlapped=0x0) returned 1 [0050.233] GetProcessHeap () returned 0x460000 [0050.233] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x4012) returned 0x47f630 [0050.234] GetProcessHeap () returned 0x460000 [0050.234] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47f630 | out: hHeap=0x460000) returned 1 [0050.234] GetProcessHeap () returned 0x460000 [0050.234] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb0) returned 0x4797e0 [0050.234] GetProcessHeap () returned 0x460000 [0050.234] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x22) returned 0x474610 [0050.235] GetProcessHeap () returned 0x460000 [0050.235] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x48) returned 0x47aa90 [0050.235] GetConsoleOutputCP () returned 0x4e3 [0050.235] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a8dbfe0 | out: lpCPInfo=0x4a8dbfe0) returned 1 [0050.235] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0050.235] GetConsoleTitleW (in: lpConsoleTitle=0x31f8b0, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0050.235] GetProcessHeap () returned 0x460000 [0050.235] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x218) returned 0x479910 [0050.235] GetProcessHeap () returned 0x460000 [0050.235] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x5a) returned 0x479b30 [0050.235] GetProcessHeap () returned 0x460000 [0050.236] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x420) returned 0x479090 [0050.236] SetErrorMode (uMode=0x0) returned 0x0 [0050.236] SetErrorMode (uMode=0x1) returned 0x0 [0050.236] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x4790a0, lpFilePart=0x31f140 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x31f140*="Desktop") returned 0x25 [0050.236] SetErrorMode (uMode=0x0) returned 0x1 [0050.236] GetProcessHeap () returned 0x460000 [0050.236] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x479090, Size=0x6e) returned 0x479090 [0050.236] GetProcessHeap () returned 0x460000 [0050.236] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x479090) returned 0x6e [0050.236] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0050.236] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0050.236] GetProcessHeap () returned 0x460000 [0050.236] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x128) returned 0x475b70 [0050.236] GetProcessHeap () returned 0x460000 [0050.236] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x240) returned 0x461ab0 [0050.236] GetProcessHeap () returned 0x460000 [0050.236] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x461ab0, Size=0x12a) returned 0x461ab0 [0050.236] GetProcessHeap () returned 0x460000 [0050.236] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x461ab0) returned 0x12a [0050.236] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a8cf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0050.236] GetProcessHeap () returned 0x460000 [0050.236] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xe8) returned 0x479db0 [0050.236] GetProcessHeap () returned 0x460000 [0050.236] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x479db0, Size=0x7e) returned 0x479db0 [0050.236] GetProcessHeap () returned 0x460000 [0050.236] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x479db0) returned 0x7e [0050.236] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.237] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x31eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eeb0) returned 0xffffffffffffffff [0050.237] GetLastError () returned 0x2 [0050.237] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x31eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eeb0) returned 0xffffffffffffffff [0050.237] GetLastError () returned 0x2 [0050.237] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0050.237] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x31eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eeb0) returned 0x479ba0 [0050.237] FindClose (in: hFindFile=0x479ba0 | out: hFindFile=0x479ba0) returned 1 [0050.237] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x31eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eeb0) returned 0xffffffffffffffff [0050.237] GetLastError () returned 0x2 [0050.237] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x31eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31eeb0) returned 0x479ba0 [0050.238] FindClose (in: hFindFile=0x479ba0 | out: hFindFile=0x479ba0) returned 1 [0050.238] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0050.238] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0050.238] GetConsoleTitleW (in: lpConsoleTitle=0x31f400, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0050.238] GetProcessHeap () returned 0x460000 [0050.238] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x21c) returned 0x479110 [0050.238] GetConsoleTitleW (in: lpConsoleTitle=0x479120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0050.238] GetProcessHeap () returned 0x460000 [0050.238] RtlReAllocateHeap (Heap=0x460000, Flags=0x0, Ptr=0x479110, Size=0xc0) returned 0x479110 [0050.238] GetProcessHeap () returned 0x460000 [0050.238] RtlSizeHeap (HeapHandle=0x460000, Flags=0x0, MemoryPointer=0x479110) returned 0xc0 [0050.238] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0050.239] GetProcessHeap () returned 0x460000 [0050.239] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x479110 | out: hHeap=0x460000) returned 1 [0050.239] InitializeProcThreadAttributeList (in: lpAttributeList=0x31f1b8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31f178 | out: lpAttributeList=0x31f1b8, lpSize=0x31f178) returned 1 [0050.239] UpdateProcThreadAttribute (in: lpAttributeList=0x31f1b8, dwFlags=0x0, Attribute=0x60001, lpValue=0x31f168, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31f1b8, lpPreviousValue=0x0) returned 1 [0050.239] GetStartupInfoW (in: lpStartupInfo=0x31f2d0 | out: lpStartupInfo=0x31f2d0*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0050.239] GetProcessHeap () returned 0x460000 [0050.239] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x20) returned 0x474640 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0050.239] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0050.240] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0050.240] GetProcessHeap () returned 0x460000 [0050.241] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x474640 | out: hHeap=0x460000) returned 1 [0050.241] GetProcessHeap () returned 0x460000 [0050.241] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0x12) returned 0x478900 [0050.241] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x31f1f0*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31f1a0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x31f1a0*(hProcess=0x50, hThread=0x54, dwProcessId=0xad8, dwThreadId=0xadc)) returned 1 [0050.247] CloseHandle (hObject=0x54) returned 1 [0050.247] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0050.247] GetProcessHeap () returned 0x460000 [0050.247] HeapFree (in: hHeap=0x460000, dwFlags=0x0, lpMem=0x47eb10 | out: hHeap=0x460000) returned 1 [0050.247] GetEnvironmentStringsW () returned 0x47eb10* [0050.248] GetProcessHeap () returned 0x460000 [0050.248] RtlAllocateHeap (HeapHandle=0x460000, Flags=0x8, Size=0xb0e) returned 0x47f630 [0050.248] FreeEnvironmentStringsW (penv=0x47eb10) returned 1 [0050.248] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x31eaa8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x31eaa8, ReturnLength=0x0) returned 0x0 [0050.248] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffd6000, lpBuffer=0x31eae0, nSize=0x380, lpNumberOfBytesRead=0x31eaa0 | out: lpBuffer=0x31eae0*, lpNumberOfBytesRead=0x31eaa0*=0x380) returned 1 [0050.248] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "4" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x36b84000" os_pid = "0xacc" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xa78" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 24 os_tid = 0xad0 Process: id = "5" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x34c95000" os_pid = "0xad8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "3" os_parent_pid = "0xa78" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e9ce" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 25 os_tid = 0xadc Thread: id = 27 os_tid = 0xae4 Thread: id = 28 os_tid = 0xae8 Thread: id = 29 os_tid = 0xaec Thread: id = 30 os_tid = 0xaf0 Process: id = "6" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x31d7e000" os_pid = "0xaf4" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0xad8" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00084a87" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 31 os_tid = 0xb34 Thread: id = 32 os_tid = 0xb30 Thread: id = 33 os_tid = 0xb10 Thread: id = 34 os_tid = 0xb04 [0059.082] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xefdb00 | out: lpSystemTimeAsFileTime=0xefdb00*(dwLowDateTime=0x9fce4570, dwHighDateTime=0x1d58773)) [0059.083] GetCurrentProcessId () returned 0xaf4 [0059.083] GetCurrentThreadId () returned 0xb04 [0059.083] GetTickCount () returned 0x1148a65 [0059.083] QueryPerformanceCounter (in: lpPerformanceCount=0xefdb08 | out: lpPerformanceCount=0xefdb08*=17915323887) returned 1 [0059.083] malloc (_Size=0x100) returned 0x1f8e80 Thread: id = 35 os_tid = 0xb00 Thread: id = 36 os_tid = 0xafc Thread: id = 37 os_tid = 0xaf8 Thread: id = 38 os_tid = 0xb5c Thread: id = 45 os_tid = 0xbf0 Thread: id = 46 os_tid = 0x40c Process: id = "7" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x2ab83000" os_pid = "0xb48" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "6" os_parent_pid = "0xaf4" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "64" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00085858" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 39 os_tid = 0xb64 Thread: id = 40 os_tid = 0xb60 Thread: id = 41 os_tid = 0xb58 Thread: id = 42 os_tid = 0xb54 Thread: id = 43 os_tid = 0xb50 Thread: id = 44 os_tid = 0xb4c Thread: id = 47 os_tid = 0x518 Process: id = "8" image_name = "1black.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe" page_root = "0x79ee3000" os_pid = "0x4f8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e003" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 48 os_tid = 0x4fc [0134.204] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff6c | out: lpSystemTimeAsFileTime=0x18ff6c*(dwLowDateTime=0xd125e4c0, dwHighDateTime=0x1d58773)) [0134.204] GetCurrentThreadId () returned 0x4fc [0134.204] GetCurrentProcessId () returned 0x4f8 [0134.204] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff64 | out: lpPerformanceCount=0x18ff64*=6521145222) returned 1 [0134.230] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0134.230] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0134.230] GetLastError () returned 0x57 [0134.230] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0134.230] GetLastError () returned 0x57 [0134.230] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x74d80000 [0134.232] GetProcAddress (hModule=0x74d80000, lpProcName="InitializeCriticalSectionEx") returned 0x74d94d28 [0134.232] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0134.232] GetLastError () returned 0x57 [0134.232] GetProcAddress (hModule=0x74d80000, lpProcName="FlsAlloc") returned 0x74d94f2b [0134.232] GetProcAddress (hModule=0x74d80000, lpProcName="FlsSetValue") returned 0x74d94208 [0134.232] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0134.232] GetLastError () returned 0x57 [0134.232] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0134.232] GetLastError () returned 0x57 [0134.232] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x74d80000 [0134.232] GetProcAddress (hModule=0x74d80000, lpProcName="InitializeCriticalSectionEx") returned 0x74d94d28 [0134.233] GetProcessHeap () returned 0x530000 [0134.233] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0134.233] GetLastError () returned 0x57 [0134.233] GetProcAddress (hModule=0x74d80000, lpProcName="FlsAlloc") returned 0x74d94f2b [0134.233] GetLastError () returned 0x57 [0134.233] GetProcAddress (hModule=0x74d80000, lpProcName="FlsGetValue") returned 0x74d91252 [0134.233] GetProcAddress (hModule=0x74d80000, lpProcName="FlsSetValue") returned 0x74d94208 [0134.233] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x364) returned 0x54ad88 [0134.233] SetLastError (dwErrCode=0x57) [0134.233] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xe00) returned 0x54b0f8 [0134.235] GetStartupInfoW (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40faf0, hStdOutput=0x541c5ddc, hStdError=0xfffffffe)) [0134.235] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0134.235] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0134.235] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0134.235] GetCommandLineA () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\" " [0134.235] GetCommandLineW () returned="\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\" " [0134.235] GetACP () returned 0x4e4 [0134.235] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x220) returned 0x54c700 [0134.235] IsValidCodePage (CodePage=0x4e4) returned 1 [0134.235] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fec4 | out: lpCPInfo=0x18fec4) returned 1 [0134.235] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f78c | out: lpCPInfo=0x18f78c) returned 1 [0134.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0134.235] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f7a0 | out: lpCharType=0x18f7a0) returned 1 [0134.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.235] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f4e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0134.235] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0134.235] GetLastError () returned 0x57 [0134.235] GetProcAddress (hModule=0x74d80000, lpProcName="LCMapStringEx") returned 0x74e147f1 [0134.366] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0134.592] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0134.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18fca0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿà¥@TÜþ\x18", lpUsedDefaultChar=0x0) returned 256 [0134.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0134.592] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0134.592] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0134.592] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0134.592] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18fba0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿà¥@TÜþ\x18", lpUsedDefaultChar=0x0) returned 256 [0134.592] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x80) returned 0x54c928 [0134.592] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fce8, nSize=0x105 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe")) returned 0x47 [0134.592] GetProcAddress (hModule=0x74d80000, lpProcName="AreFileApisANSI") returned 0x74e140d1 [0134.592] AreFileApisANSI () returned 1 [0134.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 72 [0134.962] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", cchWideChar=-1, lpMultiByteStr=0x4455c8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpUsedDefaultChar=0x0) returned 72 [0134.962] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x50) returned 0x541e08 [0134.962] RtlInitializeSListHead (in: ListHead=0x4454c8 | out: ListHead=0x4454c8) [0134.962] GetLastError () returned 0x0 [0134.962] SetLastError (dwErrCode=0x0) [0134.962] GetEnvironmentStringsW () returned 0x54c9b0* [0134.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1409 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x581) returned 0x54d4c0 [0134.963] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x54d4c0, cbMultiByte=1409, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1409 [0134.963] FreeEnvironmentStringsW (penv=0x54c9b0) returned 1 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x9c) returned 0x54da50 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x1f) returned 0x54c530 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x36) returned 0x54daf8 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x37) returned 0x54db38 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x3c) returned 0x5423b0 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x31) returned 0x54db78 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x17) returned 0x547d30 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x24) returned 0x54dbb8 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x14) returned 0x547d50 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xd) returned 0x549a00 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x25) returned 0x54dbe8 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x39) returned 0x5423f8 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x18) returned 0x547d70 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x17) returned 0x547d90 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xe) returned 0x5499e8 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x69) returned 0x54dc18 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x3e) returned 0x542440 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x1b) returned 0x54c558 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x1d) returned 0x54c580 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x48) returned 0x54dc90 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x12) returned 0x547db0 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x18) returned 0x547dd0 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x1b) returned 0x54c5a8 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x24) returned 0x54dce0 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x29) returned 0x54dd10 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x1e) returned 0x54c5d0 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x41) returned 0x54dd48 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x17) returned 0x547df0 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x14) returned 0x547e10 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0xf) returned 0x549a18 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x16) returned 0x547e30 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x2a) returned 0x54dd98 [0134.963] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x29) returned 0x54ddd0 [0134.964] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x15) returned 0x547e50 [0134.964] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x1e) returned 0x54c5f8 [0134.964] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x2a) returned 0x54de08 [0134.964] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x12) returned 0x547e70 [0134.964] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x18) returned 0x547e90 [0134.964] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x46) returned 0x54de40 [0134.964] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x54d4c0 | out: hHeap=0x530000) returned 1 [0134.964] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x800) returned 0x54c9b0 [0134.964] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0134.964] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40e130) returned 0x0 [0134.964] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0134.965] DeletePwrScheme (uiID=0x0) returned 0 [0134.965] SetFocus (hWnd=0x0) returned 0x0 [0134.965] InsertMenuA (hMenu=0x0, uPosition=0x0, uFlags=0x10, uIDNewItem=0x102, lpNewItem="Файл") returned 0 [0134.966] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x541e60 [0134.966] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x20) returned 0x54c698 [0134.966] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x549a30 [0134.966] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x549a48 [0134.966] ReadProcessorPwrScheme (in: uiID=0x0, pMachineProcessorPowerPolicy=0x0 | out: pMachineProcessorPowerPolicy=0x0) returned 0 [0135.239] UnRegisterTypeLib (libID=0x18f990*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, syskind=0x1) returned 0x8002801c [0135.398] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe0 [0135.398] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.398] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xdc [0135.398] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.398] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe4 [0135.398] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.398] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe8 [0135.398] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.398] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xec [0135.398] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.398] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf0 [0135.398] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.398] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf4 [0135.398] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.398] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf8 [0135.398] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.398] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xfc [0135.398] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.398] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x100 [0135.398] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x104 [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x108 [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x10c [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x110 [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x114 [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x118 [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x11c [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x120 [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x124 [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x128 [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x12c [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x130 [0135.399] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0135.399] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x549a48 | out: hHeap=0x530000) returned 1 [0135.399] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x549a30 | out: hHeap=0x530000) returned 1 [0135.399] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x54c698 | out: hHeap=0x530000) returned 1 [0135.399] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x541e60 | out: hHeap=0x530000) returned 1 [0135.399] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1400) returned 0x54de90 [0135.400] GetLastError () returned 0x578 [0135.400] IsIconic (hWnd=0x0) returned 0 [0135.401] GetClientRect (in: hWnd=0x0, lpRect=0x18f980 | out: lpRect=0x18f980) returned 0 [0135.401] InvalidateRect (hWnd=0x0, lpRect=0x0, bErase=0) returned 1 [0135.411] WSAStringToAddressA (in: AddressString="", AddressFamily=-7989, lpProtocolInfo=0x0, lpAddress=0x18f900, lpAddressLength=0x18f8fc | out: lpAddress=0x18f900, lpAddressLength=0x18f8fc) returned -1 [0135.411] GetKeyState (nVirtKey=16) returned 0 [0135.411] SetFocus (hWnd=0x0) returned 0x0 [0135.411] GetSystemMetrics (nIndex=0) returned 1440 [0135.530] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x24805f8) returned 0x0 [0135.679] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x2b505f8) returned 0x0 [0136.174] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x2f505f8) returned 0x0 [0136.469] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x34505f8) returned 0x0 [0137.510] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x39505f8) returned 0x0 [0137.732] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x3e505f8) returned 0x0 [0137.919] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x43505f8) returned 0x0 [0138.968] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x48505f8) returned 0x0 [0139.496] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x4d505f8) returned 0x0 [0139.506] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x52505f8) returned 0x0 [0139.637] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x57505f8) returned 0x0 [0139.765] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x5c505f8) returned 0x0 [0139.848] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x61505f8) returned 0x0 [0139.909] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x66505f8) returned 0x0 [0140.044] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x6b505f8) returned 0x0 [0140.110] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x70505f8) returned 0x0 [0140.167] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x75505f8) returned 0x0 [0140.407] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x7a505f8) returned 0x0 [0140.461] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x7f505f8) returned 0x0 [0140.622] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x84505f8) returned 0x0 [0140.843] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x89505f8) returned 0x0 [0141.014] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x8e505f8) returned 0x0 [0141.068] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x93505f8) returned 0x0 [0141.105] CanUserWritePwrScheme () returned 0 [0141.107] GetSystemMetrics (nIndex=46) returned 2 [0141.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.107] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.293] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.293] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.294] GetLastError () returned 0x578 [0141.294] SetLastError (dwErrCode=0x578) [0141.294] GetLastError () returned 0x578 [0141.294] SetLastError (dwErrCode=0x578) [0141.294] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1000) returned 0x560428 [0141.294] CanUserWritePwrScheme () returned 0 [0141.295] GetSystemMetrics (nIndex=46) returned 2 [0141.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.307] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.307] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.308] GetLastError () returned 0x578 [0141.308] SetLastError (dwErrCode=0x578) [0141.308] CanUserWritePwrScheme () returned 0 [0141.309] GetSystemMetrics (nIndex=46) returned 2 [0141.309] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.309] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.309] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.309] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.323] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.323] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.323] GetLastError () returned 0x578 [0141.323] SetLastError (dwErrCode=0x578) [0141.323] CanUserWritePwrScheme () returned 0 [0141.324] GetSystemMetrics (nIndex=46) returned 2 [0141.324] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.324] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.324] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.324] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.337] GetLastError () returned 0x578 [0141.337] SetLastError (dwErrCode=0x578) [0141.338] CanUserWritePwrScheme () returned 0 [0141.339] GetSystemMetrics (nIndex=46) returned 2 [0141.339] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.339] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.339] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.339] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.354] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.354] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.354] GetLastError () returned 0x578 [0141.354] SetLastError (dwErrCode=0x578) [0141.354] CanUserWritePwrScheme () returned 0 [0141.355] GetSystemMetrics (nIndex=46) returned 2 [0141.355] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.355] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.355] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.355] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.362] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.362] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.362] GetLastError () returned 0x578 [0141.362] SetLastError (dwErrCode=0x578) [0141.362] CanUserWritePwrScheme () returned 0 [0141.363] GetSystemMetrics (nIndex=46) returned 2 [0141.363] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.363] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.363] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.363] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.370] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.370] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.370] GetLastError () returned 0x578 [0141.370] SetLastError (dwErrCode=0x578) [0141.370] CanUserWritePwrScheme () returned 0 [0141.371] GetSystemMetrics (nIndex=46) returned 2 [0141.371] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.371] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.372] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.372] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.384] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.384] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.384] GetLastError () returned 0x578 [0141.384] SetLastError (dwErrCode=0x578) [0141.384] CanUserWritePwrScheme () returned 0 [0141.385] GetSystemMetrics (nIndex=46) returned 2 [0141.385] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.386] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.386] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.386] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.405] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.405] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.405] GetLastError () returned 0x578 [0141.405] SetLastError (dwErrCode=0x578) [0141.405] CanUserWritePwrScheme () returned 0 [0141.406] GetSystemMetrics (nIndex=46) returned 2 [0141.406] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.406] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.406] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.406] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.421] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.421] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.421] GetLastError () returned 0x578 [0141.421] SetLastError (dwErrCode=0x578) [0141.421] CanUserWritePwrScheme () returned 0 [0141.422] GetSystemMetrics (nIndex=46) returned 2 [0141.422] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.422] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.422] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.422] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.434] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.434] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.435] GetLastError () returned 0x578 [0141.435] SetLastError (dwErrCode=0x578) [0141.435] CanUserWritePwrScheme () returned 0 [0141.436] GetSystemMetrics (nIndex=46) returned 2 [0141.436] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.436] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.436] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.436] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.451] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.451] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.451] GetLastError () returned 0x578 [0141.451] SetLastError (dwErrCode=0x578) [0141.451] CanUserWritePwrScheme () returned 0 [0141.452] GetSystemMetrics (nIndex=46) returned 2 [0141.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.452] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.452] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.452] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.467] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.467] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.467] GetLastError () returned 0x578 [0141.467] SetLastError (dwErrCode=0x578) [0141.467] CanUserWritePwrScheme () returned 0 [0141.468] GetSystemMetrics (nIndex=46) returned 2 [0141.468] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.468] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.469] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.469] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.483] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.483] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.483] GetLastError () returned 0x578 [0141.483] SetLastError (dwErrCode=0x578) [0141.483] CanUserWritePwrScheme () returned 0 [0141.484] GetSystemMetrics (nIndex=46) returned 2 [0141.484] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.484] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.484] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.484] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.496] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.496] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.496] GetLastError () returned 0x578 [0141.496] SetLastError (dwErrCode=0x578) [0141.497] CanUserWritePwrScheme () returned 0 [0141.497] GetSystemMetrics (nIndex=46) returned 2 [0141.497] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.497] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.497] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.497] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.509] GetLastError () returned 0x578 [0141.509] SetLastError (dwErrCode=0x578) [0141.509] CanUserWritePwrScheme () returned 0 [0141.510] GetSystemMetrics (nIndex=46) returned 2 [0141.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.510] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.510] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.510] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.522] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.522] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.522] GetLastError () returned 0x578 [0141.522] SetLastError (dwErrCode=0x578) [0141.522] CanUserWritePwrScheme () returned 0 [0141.523] GetSystemMetrics (nIndex=46) returned 2 [0141.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.523] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.523] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.523] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.546] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.546] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.546] GetLastError () returned 0x578 [0141.546] SetLastError (dwErrCode=0x578) [0141.546] CanUserWritePwrScheme () returned 0 [0141.547] GetSystemMetrics (nIndex=46) returned 2 [0141.547] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.547] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.547] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.547] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.559] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.559] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.559] GetLastError () returned 0x578 [0141.559] SetLastError (dwErrCode=0x578) [0141.559] CanUserWritePwrScheme () returned 0 [0141.560] GetSystemMetrics (nIndex=46) returned 2 [0141.560] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.560] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.560] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.560] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.572] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.572] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.572] GetLastError () returned 0x578 [0141.572] SetLastError (dwErrCode=0x578) [0141.572] CanUserWritePwrScheme () returned 0 [0141.573] GetSystemMetrics (nIndex=46) returned 2 [0141.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.573] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.573] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.573] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.585] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.585] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.585] GetLastError () returned 0x578 [0141.585] SetLastError (dwErrCode=0x578) [0141.585] CanUserWritePwrScheme () returned 0 [0141.586] GetSystemMetrics (nIndex=46) returned 2 [0141.586] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.586] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.586] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.586] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.598] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.598] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.598] GetLastError () returned 0x578 [0141.598] SetLastError (dwErrCode=0x578) [0141.598] CanUserWritePwrScheme () returned 0 [0141.599] GetSystemMetrics (nIndex=46) returned 2 [0141.599] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.599] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.599] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.599] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.613] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.613] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.613] GetLastError () returned 0x578 [0141.614] SetLastError (dwErrCode=0x578) [0141.614] CanUserWritePwrScheme () returned 0 [0141.615] GetSystemMetrics (nIndex=46) returned 2 [0141.615] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.615] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.615] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.615] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.626] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.626] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.626] GetLastError () returned 0x578 [0141.626] SetLastError (dwErrCode=0x578) [0141.626] CanUserWritePwrScheme () returned 0 [0141.627] GetSystemMetrics (nIndex=46) returned 2 [0141.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.627] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.627] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.627] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.646] GetLastError () returned 0x578 [0141.646] SetLastError (dwErrCode=0x578) [0141.646] CanUserWritePwrScheme () returned 0 [0141.647] GetSystemMetrics (nIndex=46) returned 2 [0141.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.647] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.648] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.663] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.663] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.663] GetLastError () returned 0x578 [0141.663] SetLastError (dwErrCode=0x578) [0141.663] CanUserWritePwrScheme () returned 0 [0141.664] GetSystemMetrics (nIndex=46) returned 2 [0141.664] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.664] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.664] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.664] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.682] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.682] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.682] GetLastError () returned 0x578 [0141.682] SetLastError (dwErrCode=0x578) [0141.682] CanUserWritePwrScheme () returned 0 [0141.683] GetSystemMetrics (nIndex=46) returned 2 [0141.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.683] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.683] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.683] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.695] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.695] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.696] GetLastError () returned 0x578 [0141.696] SetLastError (dwErrCode=0x578) [0141.696] CanUserWritePwrScheme () returned 0 [0141.697] GetSystemMetrics (nIndex=46) returned 2 [0141.697] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.697] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.697] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.697] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.709] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.709] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.709] GetLastError () returned 0x578 [0141.709] SetLastError (dwErrCode=0x578) [0141.709] CanUserWritePwrScheme () returned 0 [0141.710] GetSystemMetrics (nIndex=46) returned 2 [0141.710] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.710] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.710] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.710] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.722] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.722] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.722] GetLastError () returned 0x578 [0141.722] SetLastError (dwErrCode=0x578) [0141.722] CanUserWritePwrScheme () returned 0 [0141.723] GetSystemMetrics (nIndex=46) returned 2 [0141.723] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.723] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.723] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.723] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.735] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.735] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.735] GetLastError () returned 0x578 [0141.735] SetLastError (dwErrCode=0x578) [0141.735] CanUserWritePwrScheme () returned 0 [0141.739] GetSystemMetrics (nIndex=46) returned 2 [0141.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.740] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.740] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.740] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.752] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.752] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.752] GetLastError () returned 0x578 [0141.752] SetLastError (dwErrCode=0x578) [0141.752] CanUserWritePwrScheme () returned 0 [0141.753] GetSystemMetrics (nIndex=46) returned 2 [0141.753] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.753] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.753] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.753] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.765] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.765] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.765] GetLastError () returned 0x578 [0141.765] SetLastError (dwErrCode=0x578) [0141.765] CanUserWritePwrScheme () returned 0 [0141.766] GetSystemMetrics (nIndex=46) returned 2 [0141.766] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.766] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.766] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.766] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.778] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.778] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.778] GetLastError () returned 0x578 [0141.779] SetLastError (dwErrCode=0x578) [0141.779] CanUserWritePwrScheme () returned 0 [0141.779] GetSystemMetrics (nIndex=46) returned 2 [0141.779] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.792] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.792] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.792] GetLastError () returned 0x578 [0141.792] SetLastError (dwErrCode=0x578) [0141.792] CanUserWritePwrScheme () returned 0 [0141.793] GetSystemMetrics (nIndex=46) returned 2 [0141.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.793] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.793] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.793] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.878] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.878] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.878] GetLastError () returned 0x578 [0141.878] SetLastError (dwErrCode=0x578) [0141.878] CanUserWritePwrScheme () returned 0 [0141.879] GetSystemMetrics (nIndex=46) returned 2 [0141.879] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.879] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.879] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.879] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.891] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.891] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.891] GetLastError () returned 0x578 [0141.891] SetLastError (dwErrCode=0x578) [0141.891] CanUserWritePwrScheme () returned 0 [0141.892] GetSystemMetrics (nIndex=46) returned 2 [0141.892] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.892] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.892] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.892] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.904] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.904] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.904] GetLastError () returned 0x578 [0141.904] SetLastError (dwErrCode=0x578) [0141.904] CanUserWritePwrScheme () returned 0 [0141.905] GetSystemMetrics (nIndex=46) returned 2 [0141.905] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.905] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.905] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.905] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.927] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.928] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.928] GetLastError () returned 0x578 [0141.928] SetLastError (dwErrCode=0x578) [0141.928] CanUserWritePwrScheme () returned 0 [0141.929] GetSystemMetrics (nIndex=46) returned 2 [0141.929] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.929] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.929] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.929] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.943] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.943] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.943] GetLastError () returned 0x578 [0141.943] SetLastError (dwErrCode=0x578) [0141.943] CanUserWritePwrScheme () returned 0 [0141.944] GetSystemMetrics (nIndex=46) returned 2 [0141.944] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.944] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.944] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.944] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.957] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.957] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.957] GetLastError () returned 0x578 [0141.957] SetLastError (dwErrCode=0x578) [0141.957] CanUserWritePwrScheme () returned 0 [0141.958] GetSystemMetrics (nIndex=46) returned 2 [0141.958] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.958] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.958] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.958] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.970] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.970] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.970] GetLastError () returned 0x578 [0141.970] SetLastError (dwErrCode=0x578) [0141.970] CanUserWritePwrScheme () returned 0 [0141.971] GetSystemMetrics (nIndex=46) returned 2 [0141.971] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.971] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.971] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.971] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.983] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.983] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.983] GetLastError () returned 0x578 [0141.983] SetLastError (dwErrCode=0x578) [0141.983] CanUserWritePwrScheme () returned 0 [0141.984] GetSystemMetrics (nIndex=46) returned 2 [0141.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.996] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.996] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.996] GetLastError () returned 0x578 [0141.996] SetLastError (dwErrCode=0x578) [0141.997] CanUserWritePwrScheme () returned 0 [0142.000] GetSystemMetrics (nIndex=46) returned 2 [0142.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.000] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.000] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.000] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.033] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.033] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.033] GetLastError () returned 0x578 [0142.033] SetLastError (dwErrCode=0x578) [0142.033] CanUserWritePwrScheme () returned 0 [0142.034] GetSystemMetrics (nIndex=46) returned 2 [0142.034] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.034] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.034] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.034] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.047] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.047] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.047] GetLastError () returned 0x578 [0142.047] SetLastError (dwErrCode=0x578) [0142.047] CanUserWritePwrScheme () returned 0 [0142.048] GetSystemMetrics (nIndex=46) returned 2 [0142.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.048] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.048] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.048] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.060] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.060] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.060] GetLastError () returned 0x578 [0142.060] SetLastError (dwErrCode=0x578) [0142.060] CanUserWritePwrScheme () returned 0 [0142.061] GetSystemMetrics (nIndex=46) returned 2 [0142.061] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.061] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.061] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.061] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.075] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.075] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.075] GetLastError () returned 0x578 [0142.075] SetLastError (dwErrCode=0x578) [0142.076] CanUserWritePwrScheme () returned 0 [0142.077] GetSystemMetrics (nIndex=46) returned 2 [0142.077] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.077] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.077] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.077] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.088] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.088] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.089] GetLastError () returned 0x578 [0142.089] SetLastError (dwErrCode=0x578) [0142.089] CanUserWritePwrScheme () returned 0 [0142.089] GetSystemMetrics (nIndex=46) returned 2 [0142.090] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.090] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.090] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.090] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.101] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.101] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.101] GetLastError () returned 0x578 [0142.101] SetLastError (dwErrCode=0x578) [0142.101] CanUserWritePwrScheme () returned 0 [0142.102] GetSystemMetrics (nIndex=46) returned 2 [0142.102] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.102] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.102] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.102] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.114] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.114] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.114] GetLastError () returned 0x578 [0142.114] SetLastError (dwErrCode=0x578) [0142.114] CanUserWritePwrScheme () returned 0 [0142.115] GetSystemMetrics (nIndex=46) returned 2 [0142.115] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.116] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.116] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.116] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.131] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.131] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.131] GetLastError () returned 0x578 [0142.131] SetLastError (dwErrCode=0x578) [0142.131] CanUserWritePwrScheme () returned 0 [0142.132] GetSystemMetrics (nIndex=46) returned 2 [0142.132] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.132] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.132] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.132] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.152] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.152] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.152] GetLastError () returned 0x578 [0142.152] SetLastError (dwErrCode=0x578) [0142.152] CanUserWritePwrScheme () returned 0 [0142.153] GetSystemMetrics (nIndex=46) returned 2 [0142.153] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.153] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.153] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.153] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.165] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.165] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.165] GetLastError () returned 0x578 [0142.165] SetLastError (dwErrCode=0x578) [0142.165] CanUserWritePwrScheme () returned 0 [0142.167] GetSystemMetrics (nIndex=46) returned 2 [0142.167] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.167] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.167] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.167] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.179] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.179] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.179] GetLastError () returned 0x578 [0142.179] SetLastError (dwErrCode=0x578) [0142.179] CanUserWritePwrScheme () returned 0 [0142.180] GetSystemMetrics (nIndex=46) returned 2 [0142.180] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.180] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.180] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.180] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.195] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.195] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.195] GetLastError () returned 0x578 [0142.195] SetLastError (dwErrCode=0x578) [0142.195] CanUserWritePwrScheme () returned 0 [0142.196] GetSystemMetrics (nIndex=46) returned 2 [0142.196] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.196] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.196] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.196] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.208] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.208] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.208] GetLastError () returned 0x578 [0142.208] SetLastError (dwErrCode=0x578) [0142.208] CanUserWritePwrScheme () returned 0 [0142.209] GetSystemMetrics (nIndex=46) returned 2 [0142.209] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.209] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.209] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.209] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.222] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.222] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.222] GetLastError () returned 0x578 [0142.222] SetLastError (dwErrCode=0x578) [0142.222] CanUserWritePwrScheme () returned 0 [0142.223] GetSystemMetrics (nIndex=46) returned 2 [0142.223] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.223] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.223] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.223] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.235] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.235] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.235] GetLastError () returned 0x578 [0142.235] SetLastError (dwErrCode=0x578) [0142.235] CanUserWritePwrScheme () returned 0 [0142.236] GetSystemMetrics (nIndex=46) returned 2 [0142.236] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.236] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.236] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.236] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.248] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.248] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.249] GetLastError () returned 0x578 [0142.249] SetLastError (dwErrCode=0x578) [0142.249] CanUserWritePwrScheme () returned 0 [0142.249] GetSystemMetrics (nIndex=46) returned 2 [0142.250] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.250] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.250] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.250] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.264] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.264] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.264] GetLastError () returned 0x578 [0142.264] SetLastError (dwErrCode=0x578) [0142.264] CanUserWritePwrScheme () returned 0 [0142.265] GetSystemMetrics (nIndex=46) returned 2 [0142.265] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.265] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.265] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.265] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.277] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.277] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.277] GetLastError () returned 0x578 [0142.277] SetLastError (dwErrCode=0x578) [0142.277] CanUserWritePwrScheme () returned 0 [0142.279] GetSystemMetrics (nIndex=46) returned 2 [0142.279] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.279] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.279] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.279] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.290] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.290] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.290] GetLastError () returned 0x578 [0142.290] SetLastError (dwErrCode=0x578) [0142.290] CanUserWritePwrScheme () returned 0 [0142.291] GetSystemMetrics (nIndex=46) returned 2 [0142.291] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.291] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.291] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.291] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.303] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.303] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.303] GetLastError () returned 0x578 [0142.303] SetLastError (dwErrCode=0x578) [0142.303] CanUserWritePwrScheme () returned 0 [0142.304] GetSystemMetrics (nIndex=46) returned 2 [0142.304] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.304] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.304] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.304] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.316] GetLastError () returned 0x578 [0142.316] SetLastError (dwErrCode=0x578) [0142.316] CanUserWritePwrScheme () returned 0 [0142.317] GetSystemMetrics (nIndex=46) returned 2 [0142.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.332] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.332] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.332] GetLastError () returned 0x578 [0142.332] SetLastError (dwErrCode=0x578) [0142.332] CanUserWritePwrScheme () returned 0 [0142.333] GetSystemMetrics (nIndex=46) returned 2 [0142.333] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.333] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.333] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.333] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.345] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.345] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.345] GetLastError () returned 0x578 [0142.345] SetLastError (dwErrCode=0x578) [0142.345] CanUserWritePwrScheme () returned 0 [0142.346] GetSystemMetrics (nIndex=46) returned 2 [0142.346] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.346] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.346] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.346] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.358] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.358] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.358] GetLastError () returned 0x578 [0142.358] SetLastError (dwErrCode=0x578) [0142.358] CanUserWritePwrScheme () returned 0 [0142.359] GetSystemMetrics (nIndex=46) returned 2 [0142.359] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.359] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.359] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.359] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.372] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.372] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.372] GetLastError () returned 0x578 [0142.372] SetLastError (dwErrCode=0x578) [0142.372] CanUserWritePwrScheme () returned 0 [0142.373] GetSystemMetrics (nIndex=46) returned 2 [0142.373] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.373] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.373] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.373] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.408] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.408] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.408] GetLastError () returned 0x578 [0142.408] SetLastError (dwErrCode=0x578) [0142.408] CanUserWritePwrScheme () returned 0 [0142.409] GetSystemMetrics (nIndex=46) returned 2 [0142.409] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.409] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.409] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.409] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.421] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.421] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.421] GetLastError () returned 0x578 [0142.421] SetLastError (dwErrCode=0x578) [0142.421] CanUserWritePwrScheme () returned 0 [0142.422] GetSystemMetrics (nIndex=46) returned 2 [0142.422] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.422] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.422] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.422] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.434] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.434] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.434] GetLastError () returned 0x578 [0142.435] SetLastError (dwErrCode=0x578) [0142.435] CanUserWritePwrScheme () returned 0 [0142.436] GetSystemMetrics (nIndex=46) returned 2 [0142.436] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.436] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.436] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.436] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.448] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.448] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.448] GetLastError () returned 0x578 [0142.448] SetLastError (dwErrCode=0x578) [0142.448] CanUserWritePwrScheme () returned 0 [0142.449] GetSystemMetrics (nIndex=46) returned 2 [0142.449] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.449] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.449] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.449] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.563] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.563] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.563] GetLastError () returned 0x578 [0142.563] SetLastError (dwErrCode=0x578) [0142.563] CanUserWritePwrScheme () returned 0 [0142.564] GetSystemMetrics (nIndex=46) returned 2 [0142.564] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.564] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.564] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.564] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.576] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.576] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.576] GetLastError () returned 0x578 [0142.576] SetLastError (dwErrCode=0x578) [0142.576] CanUserWritePwrScheme () returned 0 [0142.577] GetSystemMetrics (nIndex=46) returned 2 [0142.577] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.577] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.577] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.577] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.592] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.592] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.592] GetLastError () returned 0x578 [0142.592] SetLastError (dwErrCode=0x578) [0142.592] CanUserWritePwrScheme () returned 0 [0142.593] GetSystemMetrics (nIndex=46) returned 2 [0142.593] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.593] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.593] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.593] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.605] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.605] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.605] GetLastError () returned 0x578 [0142.605] SetLastError (dwErrCode=0x578) [0142.605] CanUserWritePwrScheme () returned 0 [0142.606] GetSystemMetrics (nIndex=46) returned 2 [0142.606] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.606] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.607] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.607] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.619] GetLastError () returned 0x578 [0142.619] SetLastError (dwErrCode=0x578) [0142.619] CanUserWritePwrScheme () returned 0 [0142.620] GetSystemMetrics (nIndex=46) returned 2 [0142.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.632] GetLastError () returned 0x578 [0142.632] SetLastError (dwErrCode=0x578) [0142.632] CanUserWritePwrScheme () returned 0 [0142.633] GetSystemMetrics (nIndex=46) returned 2 [0142.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.646] GetLastError () returned 0x578 [0142.646] SetLastError (dwErrCode=0x578) [0142.646] CanUserWritePwrScheme () returned 0 [0142.647] GetSystemMetrics (nIndex=46) returned 2 [0142.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.647] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.647] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.661] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.661] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.662] GetLastError () returned 0x578 [0142.662] SetLastError (dwErrCode=0x578) [0142.662] CanUserWritePwrScheme () returned 0 [0142.663] GetSystemMetrics (nIndex=46) returned 2 [0142.663] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.663] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.663] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.663] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.675] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.675] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.675] GetLastError () returned 0x578 [0142.675] SetLastError (dwErrCode=0x578) [0142.675] CanUserWritePwrScheme () returned 0 [0142.676] GetSystemMetrics (nIndex=46) returned 2 [0142.676] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.676] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.676] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.676] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.688] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.688] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.688] GetLastError () returned 0x578 [0142.688] SetLastError (dwErrCode=0x578) [0142.688] CanUserWritePwrScheme () returned 0 [0142.689] GetSystemMetrics (nIndex=46) returned 2 [0142.689] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.689] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.689] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.689] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.701] GetLastError () returned 0x578 [0142.701] SetLastError (dwErrCode=0x578) [0142.701] CanUserWritePwrScheme () returned 0 [0142.702] GetSystemMetrics (nIndex=46) returned 2 [0142.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.717] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.717] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.717] GetLastError () returned 0x578 [0142.717] SetLastError (dwErrCode=0x578) [0142.717] CanUserWritePwrScheme () returned 0 [0142.718] GetSystemMetrics (nIndex=46) returned 2 [0142.718] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.718] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.718] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.718] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.730] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.730] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.730] GetLastError () returned 0x578 [0142.730] SetLastError (dwErrCode=0x578) [0142.731] CanUserWritePwrScheme () returned 0 [0142.732] GetSystemMetrics (nIndex=46) returned 2 [0142.732] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.732] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.732] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.732] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.744] GetLastError () returned 0x578 [0142.744] SetLastError (dwErrCode=0x578) [0142.744] CanUserWritePwrScheme () returned 0 [0142.745] GetSystemMetrics (nIndex=46) returned 2 [0142.745] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.745] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.745] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.745] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.757] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.757] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.757] GetLastError () returned 0x578 [0142.757] SetLastError (dwErrCode=0x578) [0142.757] CanUserWritePwrScheme () returned 0 [0142.758] GetSystemMetrics (nIndex=46) returned 2 [0142.758] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.758] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.758] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.758] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.770] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.770] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.770] GetLastError () returned 0x578 [0142.770] SetLastError (dwErrCode=0x578) [0142.770] CanUserWritePwrScheme () returned 0 [0142.771] GetSystemMetrics (nIndex=46) returned 2 [0142.771] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.771] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.771] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.771] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.786] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.786] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.786] GetLastError () returned 0x578 [0142.786] SetLastError (dwErrCode=0x578) [0142.786] CanUserWritePwrScheme () returned 0 [0142.787] GetSystemMetrics (nIndex=46) returned 2 [0142.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.794] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.794] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.794] GetLastError () returned 0x578 [0142.794] SetLastError (dwErrCode=0x578) [0142.794] CanUserWritePwrScheme () returned 0 [0142.795] GetSystemMetrics (nIndex=46) returned 2 [0142.795] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.795] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.795] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.795] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.800] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.800] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.800] GetLastError () returned 0x578 [0142.800] SetLastError (dwErrCode=0x578) [0142.800] CanUserWritePwrScheme () returned 0 [0142.801] GetSystemMetrics (nIndex=46) returned 2 [0142.801] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.801] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.801] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.801] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.806] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.806] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.807] GetLastError () returned 0x578 [0142.807] SetLastError (dwErrCode=0x578) [0142.807] CanUserWritePwrScheme () returned 0 [0142.808] GetSystemMetrics (nIndex=46) returned 2 [0142.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.808] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.808] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.808] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.813] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.813] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.813] GetLastError () returned 0x578 [0142.813] SetLastError (dwErrCode=0x578) [0142.813] CanUserWritePwrScheme () returned 0 [0142.814] GetSystemMetrics (nIndex=46) returned 2 [0142.814] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.814] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.814] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.814] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.820] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.820] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.820] GetLastError () returned 0x578 [0142.820] SetLastError (dwErrCode=0x578) [0142.820] CanUserWritePwrScheme () returned 0 [0142.821] GetSystemMetrics (nIndex=46) returned 2 [0142.821] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.821] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.821] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.821] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.828] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.828] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.828] GetLastError () returned 0x578 [0142.828] SetLastError (dwErrCode=0x578) [0142.828] CanUserWritePwrScheme () returned 0 [0142.829] GetSystemMetrics (nIndex=46) returned 2 [0142.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.829] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.829] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.829] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.835] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.835] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.835] GetLastError () returned 0x578 [0142.835] SetLastError (dwErrCode=0x578) [0142.835] CanUserWritePwrScheme () returned 0 [0142.836] GetSystemMetrics (nIndex=46) returned 2 [0142.836] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.836] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.836] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.836] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.841] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.842] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.842] GetLastError () returned 0x578 [0142.842] SetLastError (dwErrCode=0x578) [0142.842] CanUserWritePwrScheme () returned 0 [0142.843] GetSystemMetrics (nIndex=46) returned 2 [0142.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.843] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.843] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.851] GetLastError () returned 0x578 [0142.851] SetLastError (dwErrCode=0x578) [0142.851] CanUserWritePwrScheme () returned 0 [0142.852] GetSystemMetrics (nIndex=46) returned 2 [0142.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.852] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.852] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.852] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.857] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.857] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.857] GetLastError () returned 0x578 [0142.857] SetLastError (dwErrCode=0x578) [0142.857] CanUserWritePwrScheme () returned 0 [0142.858] GetSystemMetrics (nIndex=46) returned 2 [0142.858] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.858] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.858] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.858] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.866] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.866] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.866] GetLastError () returned 0x578 [0142.866] SetLastError (dwErrCode=0x578) [0142.866] CanUserWritePwrScheme () returned 0 [0142.867] GetSystemMetrics (nIndex=46) returned 2 [0142.867] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.867] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.867] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.867] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.883] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.883] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.883] GetLastError () returned 0x578 [0142.883] SetLastError (dwErrCode=0x578) [0142.883] CanUserWritePwrScheme () returned 0 [0142.884] GetSystemMetrics (nIndex=46) returned 2 [0142.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.884] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.884] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.884] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.900] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.900] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.900] GetLastError () returned 0x578 [0142.900] SetLastError (dwErrCode=0x578) [0142.900] CanUserWritePwrScheme () returned 0 [0142.901] GetSystemMetrics (nIndex=46) returned 2 [0142.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.901] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.901] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.901] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.915] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.915] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.915] GetLastError () returned 0x578 [0142.915] SetLastError (dwErrCode=0x578) [0142.915] CanUserWritePwrScheme () returned 0 [0142.916] GetSystemMetrics (nIndex=46) returned 2 [0142.916] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.916] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.916] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.916] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.928] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.928] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.928] GetLastError () returned 0x578 [0142.928] SetLastError (dwErrCode=0x578) [0142.929] CanUserWritePwrScheme () returned 0 [0142.930] GetSystemMetrics (nIndex=46) returned 2 [0142.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.930] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.942] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.942] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.942] GetLastError () returned 0x578 [0142.942] SetLastError (dwErrCode=0x578) [0142.942] CanUserWritePwrScheme () returned 0 [0142.943] GetSystemMetrics (nIndex=46) returned 2 [0142.943] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.943] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.943] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.943] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.954] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.954] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.955] GetLastError () returned 0x578 [0142.955] SetLastError (dwErrCode=0x578) [0142.955] CanUserWritePwrScheme () returned 0 [0142.955] GetSystemMetrics (nIndex=46) returned 2 [0142.956] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.956] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.956] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.956] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.967] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.967] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.967] GetLastError () returned 0x578 [0142.967] SetLastError (dwErrCode=0x578) [0142.967] CanUserWritePwrScheme () returned 0 [0142.968] GetSystemMetrics (nIndex=46) returned 2 [0142.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.983] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.983] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.983] GetLastError () returned 0x578 [0142.983] SetLastError (dwErrCode=0x578) [0142.983] CanUserWritePwrScheme () returned 0 [0142.984] GetSystemMetrics (nIndex=46) returned 2 [0142.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.995] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.995] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.996] GetLastError () returned 0x578 [0142.996] SetLastError (dwErrCode=0x578) [0142.996] CanUserWritePwrScheme () returned 0 [0142.997] GetSystemMetrics (nIndex=46) returned 2 [0142.997] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.997] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.997] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.997] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.009] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.009] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.009] GetLastError () returned 0x578 [0143.009] SetLastError (dwErrCode=0x578) [0143.009] CanUserWritePwrScheme () returned 0 [0143.010] GetSystemMetrics (nIndex=46) returned 2 [0143.010] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.010] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.010] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.010] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.022] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.022] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.022] GetLastError () returned 0x578 [0143.022] SetLastError (dwErrCode=0x578) [0143.022] CanUserWritePwrScheme () returned 0 [0143.023] GetSystemMetrics (nIndex=46) returned 2 [0143.023] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.023] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.023] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.023] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.035] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.035] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.035] GetLastError () returned 0x578 [0143.035] SetLastError (dwErrCode=0x578) [0143.035] CanUserWritePwrScheme () returned 0 [0143.036] GetSystemMetrics (nIndex=46) returned 2 [0143.036] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.036] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.036] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.036] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.062] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.062] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.063] GetLastError () returned 0x578 [0143.063] SetLastError (dwErrCode=0x578) [0143.063] CanUserWritePwrScheme () returned 0 [0143.064] GetSystemMetrics (nIndex=46) returned 2 [0143.064] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.064] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.064] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.064] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.075] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.075] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.075] GetLastError () returned 0x578 [0143.076] SetLastError (dwErrCode=0x578) [0143.076] CanUserWritePwrScheme () returned 0 [0143.076] GetSystemMetrics (nIndex=46) returned 2 [0143.076] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.077] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.077] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.077] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.088] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.088] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.089] GetLastError () returned 0x578 [0143.089] SetLastError (dwErrCode=0x578) [0143.089] CanUserWritePwrScheme () returned 0 [0143.090] GetSystemMetrics (nIndex=46) returned 2 [0143.090] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.090] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.090] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.090] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.101] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.101] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.101] GetLastError () returned 0x578 [0143.102] SetLastError (dwErrCode=0x578) [0143.102] CanUserWritePwrScheme () returned 0 [0143.102] GetSystemMetrics (nIndex=46) returned 2 [0143.103] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.103] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.103] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.103] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.115] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.115] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.116] GetLastError () returned 0x578 [0143.116] SetLastError (dwErrCode=0x578) [0143.116] CanUserWritePwrScheme () returned 0 [0143.117] GetSystemMetrics (nIndex=46) returned 2 [0143.117] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.117] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.117] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.117] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.122] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.122] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.122] GetLastError () returned 0x578 [0143.122] SetLastError (dwErrCode=0x578) [0143.122] CanUserWritePwrScheme () returned 0 [0143.123] GetSystemMetrics (nIndex=46) returned 2 [0143.123] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.123] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.123] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.123] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.129] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.129] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.129] GetLastError () returned 0x578 [0143.129] SetLastError (dwErrCode=0x578) [0143.129] CanUserWritePwrScheme () returned 0 [0143.130] GetSystemMetrics (nIndex=46) returned 2 [0143.130] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.130] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.130] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.130] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.135] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.135] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.135] GetLastError () returned 0x578 [0143.135] SetLastError (dwErrCode=0x578) [0143.135] CanUserWritePwrScheme () returned 0 [0143.136] GetSystemMetrics (nIndex=46) returned 2 [0143.136] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.136] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.136] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.136] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.143] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.143] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.143] GetLastError () returned 0x578 [0143.143] SetLastError (dwErrCode=0x578) [0143.143] CanUserWritePwrScheme () returned 0 [0143.144] GetSystemMetrics (nIndex=46) returned 2 [0143.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.144] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.144] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.144] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.156] GetLastError () returned 0x578 [0143.156] SetLastError (dwErrCode=0x578) [0143.156] CanUserWritePwrScheme () returned 0 [0143.157] GetSystemMetrics (nIndex=46) returned 2 [0143.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.157] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.157] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.157] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.169] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.169] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.169] GetLastError () returned 0x578 [0143.169] SetLastError (dwErrCode=0x578) [0143.169] CanUserWritePwrScheme () returned 0 [0143.173] GetSystemMetrics (nIndex=46) returned 2 [0143.173] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.173] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.173] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.173] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.249] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.249] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.249] GetLastError () returned 0x578 [0143.249] SetLastError (dwErrCode=0x578) [0143.249] CanUserWritePwrScheme () returned 0 [0143.250] GetSystemMetrics (nIndex=46) returned 2 [0143.250] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.250] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.250] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.250] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.262] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.262] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.262] GetLastError () returned 0x578 [0143.262] SetLastError (dwErrCode=0x578) [0143.262] CanUserWritePwrScheme () returned 0 [0143.263] GetSystemMetrics (nIndex=46) returned 2 [0143.263] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.263] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.263] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.263] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.275] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.276] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.276] GetLastError () returned 0x578 [0143.276] SetLastError (dwErrCode=0x578) [0143.276] CanUserWritePwrScheme () returned 0 [0143.277] GetSystemMetrics (nIndex=46) returned 2 [0143.277] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.277] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.277] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.277] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.289] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.289] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.289] GetLastError () returned 0x578 [0143.289] SetLastError (dwErrCode=0x578) [0143.289] CanUserWritePwrScheme () returned 0 [0143.290] GetSystemMetrics (nIndex=46) returned 2 [0143.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.304] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.304] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.304] GetLastError () returned 0x578 [0143.304] SetLastError (dwErrCode=0x578) [0143.304] CanUserWritePwrScheme () returned 0 [0143.305] GetSystemMetrics (nIndex=46) returned 2 [0143.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.305] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.305] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.305] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.317] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.317] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.317] GetLastError () returned 0x578 [0143.317] SetLastError (dwErrCode=0x578) [0143.317] CanUserWritePwrScheme () returned 0 [0143.319] GetSystemMetrics (nIndex=46) returned 2 [0143.319] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.319] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.319] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.319] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.324] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.324] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.324] GetLastError () returned 0x578 [0143.324] SetLastError (dwErrCode=0x578) [0143.324] CanUserWritePwrScheme () returned 0 [0143.325] GetSystemMetrics (nIndex=46) returned 2 [0143.325] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.325] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.325] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.325] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.331] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.331] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.331] GetLastError () returned 0x578 [0143.331] SetLastError (dwErrCode=0x578) [0143.331] CanUserWritePwrScheme () returned 0 [0143.332] GetSystemMetrics (nIndex=46) returned 2 [0143.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.337] GetLastError () returned 0x578 [0143.337] SetLastError (dwErrCode=0x578) [0143.337] CanUserWritePwrScheme () returned 0 [0143.339] GetSystemMetrics (nIndex=46) returned 2 [0143.339] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.339] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.339] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.339] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.351] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.351] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.351] GetLastError () returned 0x578 [0143.351] SetLastError (dwErrCode=0x578) [0143.352] CanUserWritePwrScheme () returned 0 [0143.352] GetSystemMetrics (nIndex=46) returned 2 [0143.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.353] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.353] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.353] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.364] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.364] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.364] GetLastError () returned 0x578 [0143.364] SetLastError (dwErrCode=0x578) [0143.364] CanUserWritePwrScheme () returned 0 [0143.368] GetSystemMetrics (nIndex=46) returned 2 [0143.368] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.368] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.368] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.368] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.380] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.380] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.380] GetLastError () returned 0x578 [0143.380] SetLastError (dwErrCode=0x578) [0143.380] CanUserWritePwrScheme () returned 0 [0143.381] GetSystemMetrics (nIndex=46) returned 2 [0143.381] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.382] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.382] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.382] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.393] GetLastError () returned 0x578 [0143.393] SetLastError (dwErrCode=0x578) [0143.393] CanUserWritePwrScheme () returned 0 [0143.394] GetSystemMetrics (nIndex=46) returned 2 [0143.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.394] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.394] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.394] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.414] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.414] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.414] GetLastError () returned 0x578 [0143.414] SetLastError (dwErrCode=0x578) [0143.414] CanUserWritePwrScheme () returned 0 [0143.415] GetSystemMetrics (nIndex=46) returned 2 [0143.415] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.415] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.415] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.415] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.428] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.429] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.429] GetLastError () returned 0x578 [0143.429] SetLastError (dwErrCode=0x578) [0143.429] CanUserWritePwrScheme () returned 0 [0143.430] GetSystemMetrics (nIndex=46) returned 2 [0143.430] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.430] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.430] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.433] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.445] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.445] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.445] GetLastError () returned 0x578 [0143.445] SetLastError (dwErrCode=0x578) [0143.445] CanUserWritePwrScheme () returned 0 [0143.447] GetSystemMetrics (nIndex=46) returned 2 [0143.447] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.447] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.447] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.447] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.459] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.459] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.459] GetLastError () returned 0x578 [0143.459] SetLastError (dwErrCode=0x578) [0143.459] CanUserWritePwrScheme () returned 0 [0143.460] GetSystemMetrics (nIndex=46) returned 2 [0143.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.460] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.460] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.460] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.472] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.472] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.472] GetLastError () returned 0x578 [0143.472] SetLastError (dwErrCode=0x578) [0143.472] CanUserWritePwrScheme () returned 0 [0143.473] GetSystemMetrics (nIndex=46) returned 2 [0143.473] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.473] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.473] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.473] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.484] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.484] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.485] GetLastError () returned 0x578 [0143.485] SetLastError (dwErrCode=0x578) [0143.485] CanUserWritePwrScheme () returned 0 [0143.486] GetSystemMetrics (nIndex=46) returned 2 [0143.486] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.486] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.486] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.486] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.500] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.500] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.501] GetLastError () returned 0x578 [0143.501] SetLastError (dwErrCode=0x578) [0143.501] CanUserWritePwrScheme () returned 0 [0143.501] GetSystemMetrics (nIndex=46) returned 2 [0143.502] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.502] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.502] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.502] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.514] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.514] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.514] GetLastError () returned 0x578 [0143.514] SetLastError (dwErrCode=0x578) [0143.514] CanUserWritePwrScheme () returned 0 [0143.515] GetSystemMetrics (nIndex=46) returned 2 [0143.515] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.515] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.515] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.515] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.527] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.527] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.527] GetLastError () returned 0x578 [0143.527] SetLastError (dwErrCode=0x578) [0143.527] CanUserWritePwrScheme () returned 0 [0143.528] GetSystemMetrics (nIndex=46) returned 2 [0143.528] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.528] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.528] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.528] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.540] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.540] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.540] GetLastError () returned 0x578 [0143.540] SetLastError (dwErrCode=0x578) [0143.540] CanUserWritePwrScheme () returned 0 [0143.541] GetSystemMetrics (nIndex=46) returned 2 [0143.541] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.541] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.541] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.541] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.553] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.553] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.553] GetLastError () returned 0x578 [0143.553] SetLastError (dwErrCode=0x578) [0143.553] CanUserWritePwrScheme () returned 0 [0143.554] GetSystemMetrics (nIndex=46) returned 2 [0143.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.554] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.554] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.554] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.569] GetLastError () returned 0x578 [0143.569] SetLastError (dwErrCode=0x578) [0143.569] CanUserWritePwrScheme () returned 0 [0143.570] GetSystemMetrics (nIndex=46) returned 2 [0143.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.570] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.570] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.570] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.582] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.582] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.582] GetLastError () returned 0x578 [0143.582] SetLastError (dwErrCode=0x578) [0143.582] CanUserWritePwrScheme () returned 0 [0143.583] GetSystemMetrics (nIndex=46) returned 2 [0143.583] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.583] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.583] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.583] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.595] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.595] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.595] GetLastError () returned 0x578 [0143.595] SetLastError (dwErrCode=0x578) [0143.595] CanUserWritePwrScheme () returned 0 [0143.596] GetSystemMetrics (nIndex=46) returned 2 [0143.596] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.596] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.596] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.596] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.608] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.608] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.609] GetLastError () returned 0x578 [0143.609] SetLastError (dwErrCode=0x578) [0143.609] CanUserWritePwrScheme () returned 0 [0143.610] GetSystemMetrics (nIndex=46) returned 2 [0143.610] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.610] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.610] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.610] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.621] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.621] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.621] GetLastError () returned 0x578 [0143.621] SetLastError (dwErrCode=0x578) [0143.621] CanUserWritePwrScheme () returned 0 [0143.622] GetSystemMetrics (nIndex=46) returned 2 [0143.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.622] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.622] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.622] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.638] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.638] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.639] GetLastError () returned 0x578 [0143.639] SetLastError (dwErrCode=0x578) [0143.639] CanUserWritePwrScheme () returned 0 [0143.640] GetSystemMetrics (nIndex=46) returned 2 [0143.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.640] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.640] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.640] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.652] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.652] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.652] GetLastError () returned 0x578 [0143.652] SetLastError (dwErrCode=0x578) [0143.652] CanUserWritePwrScheme () returned 0 [0143.653] GetSystemMetrics (nIndex=46) returned 2 [0143.653] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.653] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.653] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.653] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.664] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.664] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.664] GetLastError () returned 0x578 [0143.664] SetLastError (dwErrCode=0x578) [0143.665] CanUserWritePwrScheme () returned 0 [0143.665] GetSystemMetrics (nIndex=46) returned 2 [0143.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.665] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.665] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.666] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.677] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.677] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.677] GetLastError () returned 0x578 [0143.677] SetLastError (dwErrCode=0x578) [0143.677] CanUserWritePwrScheme () returned 0 [0143.678] GetSystemMetrics (nIndex=46) returned 2 [0143.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.679] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.693] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.693] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.693] GetLastError () returned 0x578 [0143.694] SetLastError (dwErrCode=0x578) [0143.694] CanUserWritePwrScheme () returned 0 [0143.694] GetSystemMetrics (nIndex=46) returned 2 [0143.694] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.695] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.695] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.695] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.714] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.714] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.714] GetLastError () returned 0x578 [0143.714] SetLastError (dwErrCode=0x578) [0143.714] CanUserWritePwrScheme () returned 0 [0143.715] GetSystemMetrics (nIndex=46) returned 2 [0143.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.715] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.715] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.715] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.726] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.726] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.726] GetLastError () returned 0x578 [0143.727] SetLastError (dwErrCode=0x578) [0143.727] CanUserWritePwrScheme () returned 0 [0143.727] GetSystemMetrics (nIndex=46) returned 2 [0143.727] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.728] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.728] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.728] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.740] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.740] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.740] GetLastError () returned 0x578 [0143.740] SetLastError (dwErrCode=0x578) [0143.740] CanUserWritePwrScheme () returned 0 [0143.741] GetSystemMetrics (nIndex=46) returned 2 [0143.741] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.741] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.741] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.741] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.753] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.753] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.753] GetLastError () returned 0x578 [0143.753] SetLastError (dwErrCode=0x578) [0143.753] CanUserWritePwrScheme () returned 0 [0143.754] GetSystemMetrics (nIndex=46) returned 2 [0143.754] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.754] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.754] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.754] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.769] GetLastError () returned 0x578 [0143.769] SetLastError (dwErrCode=0x578) [0143.769] CanUserWritePwrScheme () returned 0 [0143.770] GetSystemMetrics (nIndex=46) returned 2 [0143.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.782] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.782] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.782] GetLastError () returned 0x578 [0143.782] SetLastError (dwErrCode=0x578) [0143.782] CanUserWritePwrScheme () returned 0 [0143.783] GetSystemMetrics (nIndex=46) returned 2 [0143.783] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.783] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.783] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.783] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.795] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.795] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.795] GetLastError () returned 0x578 [0143.795] SetLastError (dwErrCode=0x578) [0143.795] CanUserWritePwrScheme () returned 0 [0143.796] GetSystemMetrics (nIndex=46) returned 2 [0143.796] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.796] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.796] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.796] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.808] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.808] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.808] GetLastError () returned 0x578 [0143.808] SetLastError (dwErrCode=0x578) [0143.808] CanUserWritePwrScheme () returned 0 [0143.809] GetSystemMetrics (nIndex=46) returned 2 [0143.809] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.809] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.809] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.809] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.814] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.814] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.814] GetLastError () returned 0x578 [0143.815] SetLastError (dwErrCode=0x578) [0143.815] CanUserWritePwrScheme () returned 0 [0143.815] GetSystemMetrics (nIndex=46) returned 2 [0143.815] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.815] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.816] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.816] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.821] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.821] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.821] GetLastError () returned 0x578 [0143.821] SetLastError (dwErrCode=0x578) [0143.821] CanUserWritePwrScheme () returned 0 [0143.824] GetSystemMetrics (nIndex=46) returned 2 [0143.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.824] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.825] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.825] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.830] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.830] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.830] GetLastError () returned 0x578 [0143.830] SetLastError (dwErrCode=0x578) [0143.830] CanUserWritePwrScheme () returned 0 [0143.831] GetSystemMetrics (nIndex=46) returned 2 [0143.831] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.831] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.831] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.831] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.836] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.836] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.836] GetLastError () returned 0x578 [0143.837] SetLastError (dwErrCode=0x578) [0143.837] CanUserWritePwrScheme () returned 0 [0143.837] GetSystemMetrics (nIndex=46) returned 2 [0143.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.838] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.838] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.838] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.843] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.843] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.843] GetLastError () returned 0x578 [0143.843] SetLastError (dwErrCode=0x578) [0143.843] CanUserWritePwrScheme () returned 0 [0143.844] GetSystemMetrics (nIndex=46) returned 2 [0143.844] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.844] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.844] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.844] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.850] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.850] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.850] GetLastError () returned 0x578 [0143.850] SetLastError (dwErrCode=0x578) [0143.850] CanUserWritePwrScheme () returned 0 [0143.851] GetSystemMetrics (nIndex=46) returned 2 [0143.851] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.851] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.851] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.851] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.856] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.856] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.856] GetLastError () returned 0x578 [0143.856] SetLastError (dwErrCode=0x578) [0143.856] CanUserWritePwrScheme () returned 0 [0143.857] GetSystemMetrics (nIndex=46) returned 2 [0143.857] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.857] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.857] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.857] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.863] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.863] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.863] GetLastError () returned 0x578 [0143.863] SetLastError (dwErrCode=0x578) [0143.863] CanUserWritePwrScheme () returned 0 [0143.864] GetSystemMetrics (nIndex=46) returned 2 [0143.864] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.864] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.864] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.864] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.869] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.869] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.869] GetLastError () returned 0x578 [0143.869] SetLastError (dwErrCode=0x578) [0143.869] CanUserWritePwrScheme () returned 0 [0143.870] GetSystemMetrics (nIndex=46) returned 2 [0143.870] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.870] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.870] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.871] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.876] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.876] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.876] GetLastError () returned 0x578 [0143.876] SetLastError (dwErrCode=0x578) [0143.876] CanUserWritePwrScheme () returned 0 [0143.877] GetSystemMetrics (nIndex=46) returned 2 [0143.877] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.877] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.877] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.877] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.892] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.892] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.892] GetLastError () returned 0x578 [0143.892] SetLastError (dwErrCode=0x578) [0143.892] CanUserWritePwrScheme () returned 0 [0143.893] GetSystemMetrics (nIndex=46) returned 2 [0143.893] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.893] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.893] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.893] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.905] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.905] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.905] GetLastError () returned 0x578 [0143.905] SetLastError (dwErrCode=0x578) [0143.905] CanUserWritePwrScheme () returned 0 [0143.906] GetSystemMetrics (nIndex=46) returned 2 [0143.906] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.906] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.906] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.906] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.918] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.918] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.918] GetLastError () returned 0x578 [0143.918] SetLastError (dwErrCode=0x578) [0143.918] CanUserWritePwrScheme () returned 0 [0143.919] GetSystemMetrics (nIndex=46) returned 2 [0143.919] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.919] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.919] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.919] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.931] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.931] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.931] GetLastError () returned 0x578 [0143.931] SetLastError (dwErrCode=0x578) [0143.931] CanUserWritePwrScheme () returned 0 [0143.932] GetSystemMetrics (nIndex=46) returned 2 [0143.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.932] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.932] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.932] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.945] GetLastError () returned 0x578 [0143.945] SetLastError (dwErrCode=0x578) [0143.945] CanUserWritePwrScheme () returned 0 [0143.946] GetSystemMetrics (nIndex=46) returned 2 [0143.946] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.946] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.946] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.946] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.961] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.961] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.961] GetLastError () returned 0x578 [0143.961] SetLastError (dwErrCode=0x578) [0143.961] CanUserWritePwrScheme () returned 0 [0143.962] GetSystemMetrics (nIndex=46) returned 2 [0143.962] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.962] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.962] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.962] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.973] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.973] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.973] GetLastError () returned 0x578 [0143.974] SetLastError (dwErrCode=0x578) [0143.974] CanUserWritePwrScheme () returned 0 [0143.975] GetSystemMetrics (nIndex=46) returned 2 [0143.975] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.975] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.975] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.975] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.986] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.986] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.986] GetLastError () returned 0x578 [0143.987] SetLastError (dwErrCode=0x578) [0143.987] CanUserWritePwrScheme () returned 0 [0143.987] GetSystemMetrics (nIndex=46) returned 2 [0143.987] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.988] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.988] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.988] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.999] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.999] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.999] GetLastError () returned 0x578 [0143.999] SetLastError (dwErrCode=0x578) [0144.000] CanUserWritePwrScheme () returned 0 [0144.001] GetSystemMetrics (nIndex=46) returned 2 [0144.001] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.001] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.001] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.001] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.013] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.013] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.013] GetLastError () returned 0x578 [0144.013] SetLastError (dwErrCode=0x578) [0144.013] CanUserWritePwrScheme () returned 0 [0144.014] GetSystemMetrics (nIndex=46) returned 2 [0144.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.029] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.029] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.029] GetLastError () returned 0x578 [0144.029] SetLastError (dwErrCode=0x578) [0144.029] CanUserWritePwrScheme () returned 0 [0144.030] GetSystemMetrics (nIndex=46) returned 2 [0144.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.030] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.030] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.030] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.042] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.042] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.042] GetLastError () returned 0x578 [0144.042] SetLastError (dwErrCode=0x578) [0144.042] CanUserWritePwrScheme () returned 0 [0144.043] GetSystemMetrics (nIndex=46) returned 2 [0144.043] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.043] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.043] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.043] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.055] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.055] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.055] GetLastError () returned 0x578 [0144.055] SetLastError (dwErrCode=0x578) [0144.055] CanUserWritePwrScheme () returned 0 [0144.063] GetSystemMetrics (nIndex=46) returned 2 [0144.063] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.063] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.063] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.063] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.075] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.075] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.075] GetLastError () returned 0x578 [0144.075] SetLastError (dwErrCode=0x578) [0144.075] CanUserWritePwrScheme () returned 0 [0144.076] GetSystemMetrics (nIndex=46) returned 2 [0144.076] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.076] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.076] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.076] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.091] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.091] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.091] GetLastError () returned 0x578 [0144.091] SetLastError (dwErrCode=0x578) [0144.091] CanUserWritePwrScheme () returned 0 [0144.092] GetSystemMetrics (nIndex=46) returned 2 [0144.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.092] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.092] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.092] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.104] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.104] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.104] GetLastError () returned 0x578 [0144.104] SetLastError (dwErrCode=0x578) [0144.104] CanUserWritePwrScheme () returned 0 [0144.105] GetSystemMetrics (nIndex=46) returned 2 [0144.105] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.105] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.105] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.105] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.117] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.117] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.117] GetLastError () returned 0x578 [0144.117] SetLastError (dwErrCode=0x578) [0144.117] CanUserWritePwrScheme () returned 0 [0144.118] GetSystemMetrics (nIndex=46) returned 2 [0144.118] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.118] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.118] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.118] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.123] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.123] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.124] GetLastError () returned 0x578 [0144.124] SetLastError (dwErrCode=0x578) [0144.124] CanUserWritePwrScheme () returned 0 [0144.125] GetSystemMetrics (nIndex=46) returned 2 [0144.125] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.125] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.125] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.125] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.130] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.130] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.130] GetLastError () returned 0x578 [0144.130] SetLastError (dwErrCode=0x578) [0144.130] CanUserWritePwrScheme () returned 0 [0144.131] GetSystemMetrics (nIndex=46) returned 2 [0144.131] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.131] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.131] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.131] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.136] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.136] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.136] GetLastError () returned 0x578 [0144.136] SetLastError (dwErrCode=0x578) [0144.136] CanUserWritePwrScheme () returned 0 [0144.137] GetSystemMetrics (nIndex=46) returned 2 [0144.137] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.137] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.137] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.137] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.143] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.143] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.143] GetLastError () returned 0x578 [0144.143] SetLastError (dwErrCode=0x578) [0144.143] CanUserWritePwrScheme () returned 0 [0144.144] GetSystemMetrics (nIndex=46) returned 2 [0144.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.144] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.144] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.144] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.152] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.152] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.153] GetLastError () returned 0x578 [0144.153] SetLastError (dwErrCode=0x578) [0144.153] CanUserWritePwrScheme () returned 0 [0144.154] GetSystemMetrics (nIndex=46) returned 2 [0144.154] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.154] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.154] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.154] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.159] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.159] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.159] GetLastError () returned 0x578 [0144.159] SetLastError (dwErrCode=0x578) [0144.159] CanUserWritePwrScheme () returned 0 [0144.160] GetSystemMetrics (nIndex=46) returned 2 [0144.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.160] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.160] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.160] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.165] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.165] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.165] GetLastError () returned 0x578 [0144.165] SetLastError (dwErrCode=0x578) [0144.165] CanUserWritePwrScheme () returned 0 [0144.167] GetSystemMetrics (nIndex=46) returned 2 [0144.167] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.167] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.167] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.167] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.172] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.172] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.172] GetLastError () returned 0x578 [0144.172] SetLastError (dwErrCode=0x578) [0144.172] CanUserWritePwrScheme () returned 0 [0144.173] GetSystemMetrics (nIndex=46) returned 2 [0144.173] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.173] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.173] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.173] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.178] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.178] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.178] GetLastError () returned 0x578 [0144.179] SetLastError (dwErrCode=0x578) [0144.179] CanUserWritePwrScheme () returned 0 [0144.180] GetSystemMetrics (nIndex=46) returned 2 [0144.180] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.180] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.180] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.180] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.192] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.192] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.192] GetLastError () returned 0x578 [0144.192] SetLastError (dwErrCode=0x578) [0144.192] CanUserWritePwrScheme () returned 0 [0144.193] GetSystemMetrics (nIndex=46) returned 2 [0144.193] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.193] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.193] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.193] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.205] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.205] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.205] GetLastError () returned 0x578 [0144.205] SetLastError (dwErrCode=0x578) [0144.205] CanUserWritePwrScheme () returned 0 [0144.206] GetSystemMetrics (nIndex=46) returned 2 [0144.206] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.206] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.206] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.206] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.221] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.221] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.221] GetLastError () returned 0x578 [0144.221] SetLastError (dwErrCode=0x578) [0144.221] CanUserWritePwrScheme () returned 0 [0144.222] GetSystemMetrics (nIndex=46) returned 2 [0144.222] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.222] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.222] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.222] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.234] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.234] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.234] GetLastError () returned 0x578 [0144.234] SetLastError (dwErrCode=0x578) [0144.234] CanUserWritePwrScheme () returned 0 [0144.235] GetSystemMetrics (nIndex=46) returned 2 [0144.235] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.235] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.235] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.235] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.246] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.247] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.247] GetLastError () returned 0x578 [0144.247] SetLastError (dwErrCode=0x578) [0144.247] CanUserWritePwrScheme () returned 0 [0144.248] GetSystemMetrics (nIndex=46) returned 2 [0144.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.248] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.248] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.248] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.260] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.260] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.260] GetLastError () returned 0x578 [0144.260] SetLastError (dwErrCode=0x578) [0144.260] CanUserWritePwrScheme () returned 0 [0144.261] GetSystemMetrics (nIndex=46) returned 2 [0144.261] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.261] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.261] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.261] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.273] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.273] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.273] GetLastError () returned 0x578 [0144.273] SetLastError (dwErrCode=0x578) [0144.273] CanUserWritePwrScheme () returned 0 [0144.274] GetSystemMetrics (nIndex=46) returned 2 [0144.274] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.274] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.274] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.274] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.290] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.290] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.290] GetLastError () returned 0x578 [0144.290] SetLastError (dwErrCode=0x578) [0144.290] CanUserWritePwrScheme () returned 0 [0144.291] GetSystemMetrics (nIndex=46) returned 2 [0144.291] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.291] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.291] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.291] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.303] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.303] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.303] GetLastError () returned 0x578 [0144.303] SetLastError (dwErrCode=0x578) [0144.303] CanUserWritePwrScheme () returned 0 [0144.304] GetSystemMetrics (nIndex=46) returned 2 [0144.304] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.304] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.304] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.304] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.316] GetLastError () returned 0x578 [0144.316] SetLastError (dwErrCode=0x578) [0144.316] CanUserWritePwrScheme () returned 0 [0144.317] GetSystemMetrics (nIndex=46) returned 2 [0144.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.328] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.328] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.328] GetLastError () returned 0x578 [0144.328] SetLastError (dwErrCode=0x578) [0144.328] CanUserWritePwrScheme () returned 0 [0144.329] GetSystemMetrics (nIndex=46) returned 2 [0144.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.342] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.342] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.342] GetLastError () returned 0x578 [0144.342] SetLastError (dwErrCode=0x578) [0144.342] CanUserWritePwrScheme () returned 0 [0144.345] GetSystemMetrics (nIndex=46) returned 2 [0144.345] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.345] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.345] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.345] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.361] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.361] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.361] GetLastError () returned 0x578 [0144.361] SetLastError (dwErrCode=0x578) [0144.361] CanUserWritePwrScheme () returned 0 [0144.362] GetSystemMetrics (nIndex=46) returned 2 [0144.362] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.362] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.362] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.362] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.374] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.374] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.374] GetLastError () returned 0x578 [0144.374] SetLastError (dwErrCode=0x578) [0144.375] CanUserWritePwrScheme () returned 0 [0144.376] GetSystemMetrics (nIndex=46) returned 2 [0144.376] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.376] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.376] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.376] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.387] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.387] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.387] GetLastError () returned 0x578 [0144.388] SetLastError (dwErrCode=0x578) [0144.388] CanUserWritePwrScheme () returned 0 [0144.388] GetSystemMetrics (nIndex=46) returned 2 [0144.389] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.389] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.389] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.389] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.408] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.408] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.408] GetLastError () returned 0x578 [0144.409] SetLastError (dwErrCode=0x578) [0144.409] CanUserWritePwrScheme () returned 0 [0144.410] GetSystemMetrics (nIndex=46) returned 2 [0144.410] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.410] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.410] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.410] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.423] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.423] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.423] GetLastError () returned 0x578 [0144.423] SetLastError (dwErrCode=0x578) [0144.423] CanUserWritePwrScheme () returned 0 [0144.424] GetSystemMetrics (nIndex=46) returned 2 [0144.424] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.424] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.424] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.424] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.429] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.430] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.430] GetLastError () returned 0x578 [0144.430] SetLastError (dwErrCode=0x578) [0144.430] CanUserWritePwrScheme () returned 0 [0144.431] GetSystemMetrics (nIndex=46) returned 2 [0144.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.436] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.437] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.437] GetLastError () returned 0x578 [0144.437] SetLastError (dwErrCode=0x578) [0144.437] CanUserWritePwrScheme () returned 0 [0144.438] GetSystemMetrics (nIndex=46) returned 2 [0144.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.438] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.443] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.443] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.444] GetLastError () returned 0x578 [0144.444] SetLastError (dwErrCode=0x578) [0144.444] CanUserWritePwrScheme () returned 0 [0144.444] GetSystemMetrics (nIndex=46) returned 2 [0144.445] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.445] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.445] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.445] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.450] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.450] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.450] GetLastError () returned 0x578 [0144.450] SetLastError (dwErrCode=0x578) [0144.451] CanUserWritePwrScheme () returned 0 [0144.451] GetSystemMetrics (nIndex=46) returned 2 [0144.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.451] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.452] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.452] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.456] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.457] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.457] GetLastError () returned 0x578 [0144.457] SetLastError (dwErrCode=0x578) [0144.457] CanUserWritePwrScheme () returned 0 [0144.458] GetSystemMetrics (nIndex=46) returned 2 [0144.458] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.458] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.458] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.458] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.464] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.464] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.464] GetLastError () returned 0x578 [0144.464] SetLastError (dwErrCode=0x578) [0144.464] CanUserWritePwrScheme () returned 0 [0144.465] GetSystemMetrics (nIndex=46) returned 2 [0144.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.465] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.465] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.470] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.470] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.470] GetLastError () returned 0x578 [0144.470] SetLastError (dwErrCode=0x578) [0144.470] CanUserWritePwrScheme () returned 0 [0144.471] GetSystemMetrics (nIndex=46) returned 2 [0144.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.478] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.478] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.478] GetLastError () returned 0x578 [0144.478] SetLastError (dwErrCode=0x578) [0144.478] CanUserWritePwrScheme () returned 0 [0144.572] GetSystemMetrics (nIndex=46) returned 2 [0144.572] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.572] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.572] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.572] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.583] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.583] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.583] GetLastError () returned 0x578 [0144.583] SetLastError (dwErrCode=0x578) [0144.583] CanUserWritePwrScheme () returned 0 [0144.584] GetSystemMetrics (nIndex=46) returned 2 [0144.584] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.584] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.584] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.584] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.596] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.596] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.596] GetLastError () returned 0x578 [0144.596] SetLastError (dwErrCode=0x578) [0144.597] CanUserWritePwrScheme () returned 0 [0144.597] GetSystemMetrics (nIndex=46) returned 2 [0144.597] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.597] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.598] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.598] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.611] GetLastError () returned 0x578 [0144.611] SetLastError (dwErrCode=0x578) [0144.611] CanUserWritePwrScheme () returned 0 [0144.612] GetSystemMetrics (nIndex=46) returned 2 [0144.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.612] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.623] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.623] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.623] GetLastError () returned 0x578 [0144.623] SetLastError (dwErrCode=0x578) [0144.623] CanUserWritePwrScheme () returned 0 [0144.624] GetSystemMetrics (nIndex=46) returned 2 [0144.624] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.624] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.624] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.624] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.629] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.629] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.629] GetLastError () returned 0x578 [0144.629] SetLastError (dwErrCode=0x578) [0144.629] CanUserWritePwrScheme () returned 0 [0144.630] GetSystemMetrics (nIndex=46) returned 2 [0144.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.639] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.639] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.639] GetLastError () returned 0x578 [0144.639] SetLastError (dwErrCode=0x578) [0144.639] CanUserWritePwrScheme () returned 0 [0144.640] GetSystemMetrics (nIndex=46) returned 2 [0144.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.640] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.640] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.640] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.645] GetLastError () returned 0x578 [0144.645] SetLastError (dwErrCode=0x578) [0144.645] CanUserWritePwrScheme () returned 0 [0144.646] GetSystemMetrics (nIndex=46) returned 2 [0144.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.652] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.652] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.652] GetLastError () returned 0x578 [0144.652] SetLastError (dwErrCode=0x578) [0144.652] CanUserWritePwrScheme () returned 0 [0144.653] GetSystemMetrics (nIndex=46) returned 2 [0144.653] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.653] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.653] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.653] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.658] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.658] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.658] GetLastError () returned 0x578 [0144.658] SetLastError (dwErrCode=0x578) [0144.659] CanUserWritePwrScheme () returned 0 [0144.660] GetSystemMetrics (nIndex=46) returned 2 [0144.660] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.660] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.660] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.660] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.666] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.666] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.666] GetLastError () returned 0x578 [0144.666] SetLastError (dwErrCode=0x578) [0144.666] CanUserWritePwrScheme () returned 0 [0144.667] GetSystemMetrics (nIndex=46) returned 2 [0144.667] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.667] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.667] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.667] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.678] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.678] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.678] GetLastError () returned 0x578 [0144.678] SetLastError (dwErrCode=0x578) [0144.679] CanUserWritePwrScheme () returned 0 [0144.679] GetSystemMetrics (nIndex=46) returned 2 [0144.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.680] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.693] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.693] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.693] GetLastError () returned 0x578 [0144.693] SetLastError (dwErrCode=0x578) [0144.693] CanUserWritePwrScheme () returned 0 [0144.694] GetSystemMetrics (nIndex=46) returned 2 [0144.694] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.694] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.694] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.694] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.705] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.705] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.705] GetLastError () returned 0x578 [0144.705] SetLastError (dwErrCode=0x578) [0144.705] CanUserWritePwrScheme () returned 0 [0144.707] GetSystemMetrics (nIndex=46) returned 2 [0144.707] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.707] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.707] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.707] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.720] GetLastError () returned 0x578 [0144.720] SetLastError (dwErrCode=0x578) [0144.720] CanUserWritePwrScheme () returned 0 [0144.721] GetSystemMetrics (nIndex=46) returned 2 [0144.721] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.721] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.721] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.721] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.734] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.734] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.734] GetLastError () returned 0x578 [0144.734] SetLastError (dwErrCode=0x578) [0144.734] CanUserWritePwrScheme () returned 0 [0144.735] GetSystemMetrics (nIndex=46) returned 2 [0144.735] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.735] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.735] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.735] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.747] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.747] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.747] GetLastError () returned 0x578 [0144.747] SetLastError (dwErrCode=0x578) [0144.747] CanUserWritePwrScheme () returned 0 [0144.748] GetSystemMetrics (nIndex=46) returned 2 [0144.748] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.748] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.748] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.748] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.761] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.762] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.762] GetLastError () returned 0x578 [0144.762] SetLastError (dwErrCode=0x578) [0144.762] CanUserWritePwrScheme () returned 0 [0144.763] GetSystemMetrics (nIndex=46) returned 2 [0144.763] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.763] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.763] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.763] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.774] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.774] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.774] GetLastError () returned 0x578 [0144.774] SetLastError (dwErrCode=0x578) [0144.774] CanUserWritePwrScheme () returned 0 [0144.775] GetSystemMetrics (nIndex=46) returned 2 [0144.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.775] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.775] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.775] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.789] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.789] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.789] GetLastError () returned 0x578 [0144.789] SetLastError (dwErrCode=0x578) [0144.789] CanUserWritePwrScheme () returned 0 [0144.790] GetSystemMetrics (nIndex=46) returned 2 [0144.790] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.790] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.790] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.790] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.802] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.802] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.802] GetLastError () returned 0x578 [0144.802] CanUserWritePwrScheme () returned 0 [0144.803] GetSystemMetrics (nIndex=46) returned 2 [0144.803] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.803] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.803] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.803] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.816] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.816] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.816] GetLastError () returned 0x578 [0144.816] CanUserWritePwrScheme () returned 0 [0144.817] GetSystemMetrics (nIndex=46) returned 2 [0144.817] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.817] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.817] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.817] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.829] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.829] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.829] GetLastError () returned 0x578 [0144.829] CanUserWritePwrScheme () returned 0 [0144.830] GetSystemMetrics (nIndex=46) returned 2 [0144.830] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.830] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.830] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.830] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.842] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.842] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.842] GetLastError () returned 0x578 [0144.842] CanUserWritePwrScheme () returned 0 [0144.844] GetSystemMetrics (nIndex=46) returned 2 [0144.844] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.844] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.844] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.844] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.856] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.856] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.856] GetLastError () returned 0x578 [0144.856] CanUserWritePwrScheme () returned 0 [0144.857] GetSystemMetrics (nIndex=46) returned 2 [0144.857] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.857] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.857] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.857] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.869] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.869] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.869] GetLastError () returned 0x578 [0144.869] CanUserWritePwrScheme () returned 0 [0144.870] GetSystemMetrics (nIndex=46) returned 2 [0144.870] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.870] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.870] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.870] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.883] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.883] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.883] GetLastError () returned 0x578 [0144.883] CanUserWritePwrScheme () returned 0 [0144.884] GetSystemMetrics (nIndex=46) returned 2 [0144.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.884] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.884] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.884] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.896] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.896] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.896] GetLastError () returned 0x578 [0144.896] CanUserWritePwrScheme () returned 0 [0144.897] GetSystemMetrics (nIndex=46) returned 2 [0144.897] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.897] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.897] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.897] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.903] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.903] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.903] GetLastError () returned 0x578 [0144.903] CanUserWritePwrScheme () returned 0 [0144.904] GetSystemMetrics (nIndex=46) returned 2 [0144.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.904] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.904] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.904] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.910] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.910] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.910] GetLastError () returned 0x578 [0144.910] CanUserWritePwrScheme () returned 0 [0144.912] GetSystemMetrics (nIndex=46) returned 2 [0144.912] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.912] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.912] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.912] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.917] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.917] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.917] GetLastError () returned 0x578 [0144.917] CanUserWritePwrScheme () returned 0 [0144.918] GetSystemMetrics (nIndex=46) returned 2 [0144.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.918] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.918] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.918] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.924] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.924] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.924] GetLastError () returned 0x578 [0144.924] CanUserWritePwrScheme () returned 0 [0144.925] GetSystemMetrics (nIndex=46) returned 2 [0144.925] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.925] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.925] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.925] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.930] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.930] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.930] GetLastError () returned 0x578 [0144.930] CanUserWritePwrScheme () returned 0 [0144.931] GetSystemMetrics (nIndex=46) returned 2 [0144.931] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.931] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.931] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.931] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.936] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.936] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.936] GetLastError () returned 0x578 [0144.936] CanUserWritePwrScheme () returned 0 [0144.937] GetSystemMetrics (nIndex=46) returned 2 [0144.937] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.937] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.937] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.937] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.944] GetLastError () returned 0x578 [0144.944] CanUserWritePwrScheme () returned 0 [0144.945] GetSystemMetrics (nIndex=46) returned 2 [0144.945] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.945] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.945] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.945] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.951] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.951] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.951] GetLastError () returned 0x578 [0144.951] CanUserWritePwrScheme () returned 0 [0144.952] GetSystemMetrics (nIndex=46) returned 2 [0144.952] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.952] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.952] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.952] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.964] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.964] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.964] GetLastError () returned 0x578 [0144.964] CanUserWritePwrScheme () returned 0 [0144.965] GetSystemMetrics (nIndex=46) returned 2 [0144.966] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.966] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.966] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.966] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.979] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.979] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.979] GetLastError () returned 0x578 [0144.979] CanUserWritePwrScheme () returned 0 [0144.980] GetSystemMetrics (nIndex=46) returned 2 [0144.980] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.980] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.980] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.980] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.992] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.992] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.992] GetLastError () returned 0x578 [0144.992] CanUserWritePwrScheme () returned 0 [0144.993] GetSystemMetrics (nIndex=46) returned 2 [0144.993] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.993] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.993] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.993] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.006] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.006] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.006] GetLastError () returned 0x578 [0145.006] CanUserWritePwrScheme () returned 0 [0145.007] GetSystemMetrics (nIndex=46) returned 2 [0145.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.007] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.007] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.007] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.020] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.020] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.020] GetLastError () returned 0x578 [0145.020] CanUserWritePwrScheme () returned 0 [0145.021] GetSystemMetrics (nIndex=46) returned 2 [0145.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.021] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.021] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.021] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.035] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.035] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.035] GetLastError () returned 0x578 [0145.035] CanUserWritePwrScheme () returned 0 [0145.036] GetSystemMetrics (nIndex=46) returned 2 [0145.036] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.036] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.036] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.036] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.049] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.049] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.049] GetLastError () returned 0x578 [0145.049] CanUserWritePwrScheme () returned 0 [0145.050] GetSystemMetrics (nIndex=46) returned 2 [0145.050] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.050] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.050] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.050] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.061] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.061] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.061] GetLastError () returned 0x578 [0145.061] CanUserWritePwrScheme () returned 0 [0145.062] GetSystemMetrics (nIndex=46) returned 2 [0145.062] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.062] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.062] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.062] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.073] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.074] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.074] GetLastError () returned 0x578 [0145.074] CanUserWritePwrScheme () returned 0 [0145.074] GetSystemMetrics (nIndex=46) returned 2 [0145.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.075] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.075] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.075] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.087] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.087] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.087] GetLastError () returned 0x578 [0145.088] CanUserWritePwrScheme () returned 0 [0145.088] GetSystemMetrics (nIndex=46) returned 2 [0145.088] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.088] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.088] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.089] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.099] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.100] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.100] GetLastError () returned 0x578 [0145.100] CanUserWritePwrScheme () returned 0 [0145.100] GetSystemMetrics (nIndex=46) returned 2 [0145.101] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.101] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.101] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.101] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.112] GetLastError () returned 0x578 [0145.112] CanUserWritePwrScheme () returned 0 [0145.113] GetSystemMetrics (nIndex=46) returned 2 [0145.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.129] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.129] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.129] GetLastError () returned 0x578 [0145.129] CanUserWritePwrScheme () returned 0 [0145.130] GetSystemMetrics (nIndex=46) returned 2 [0145.130] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.130] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.130] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.130] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.142] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.142] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.142] GetLastError () returned 0x578 [0145.142] CanUserWritePwrScheme () returned 0 [0145.143] GetSystemMetrics (nIndex=46) returned 2 [0145.143] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.143] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.143] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.143] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.154] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.154] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.154] GetLastError () returned 0x578 [0145.154] CanUserWritePwrScheme () returned 0 [0145.155] GetSystemMetrics (nIndex=46) returned 2 [0145.155] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.155] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.155] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.155] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.168] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.168] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.168] GetLastError () returned 0x578 [0145.168] CanUserWritePwrScheme () returned 0 [0145.208] GetSystemMetrics (nIndex=46) returned 2 [0145.208] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.208] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.208] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.208] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.219] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.219] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.219] GetLastError () returned 0x578 [0145.219] CanUserWritePwrScheme () returned 0 [0145.220] GetSystemMetrics (nIndex=46) returned 2 [0145.220] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.220] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.220] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.220] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.230] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.230] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.230] GetLastError () returned 0x578 [0145.230] CanUserWritePwrScheme () returned 0 [0145.231] GetSystemMetrics (nIndex=46) returned 2 [0145.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.231] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.231] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.231] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.244] GetLastError () returned 0x578 [0145.244] CanUserWritePwrScheme () returned 0 [0145.245] GetSystemMetrics (nIndex=46) returned 2 [0145.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.256] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.256] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.256] GetLastError () returned 0x578 [0145.256] CanUserWritePwrScheme () returned 0 [0145.257] GetSystemMetrics (nIndex=46) returned 2 [0145.257] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.257] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.257] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.268] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.268] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.268] GetLastError () returned 0x578 [0145.268] CanUserWritePwrScheme () returned 0 [0145.269] GetSystemMetrics (nIndex=46) returned 2 [0145.269] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.269] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.269] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.269] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.280] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.280] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.280] GetLastError () returned 0x578 [0145.280] CanUserWritePwrScheme () returned 0 [0145.281] GetSystemMetrics (nIndex=46) returned 2 [0145.281] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.281] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.281] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.281] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.294] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.294] GetLastError () returned 0x578 [0145.295] CanUserWritePwrScheme () returned 0 [0145.295] GetSystemMetrics (nIndex=46) returned 2 [0145.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.296] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.306] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.306] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.306] GetLastError () returned 0x578 [0145.306] CanUserWritePwrScheme () returned 0 [0145.307] GetSystemMetrics (nIndex=46) returned 2 [0145.307] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.307] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.307] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.307] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.318] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.318] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.318] GetLastError () returned 0x578 [0145.318] CanUserWritePwrScheme () returned 0 [0145.319] GetSystemMetrics (nIndex=46) returned 2 [0145.319] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.319] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.319] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.319] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.331] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.331] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.331] GetLastError () returned 0x578 [0145.332] CanUserWritePwrScheme () returned 0 [0145.332] GetSystemMetrics (nIndex=46) returned 2 [0145.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.344] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.344] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.344] GetLastError () returned 0x578 [0145.344] CanUserWritePwrScheme () returned 0 [0145.345] GetSystemMetrics (nIndex=46) returned 2 [0145.345] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.345] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.345] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.345] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.354] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.354] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.354] GetLastError () returned 0x578 [0145.354] CanUserWritePwrScheme () returned 0 [0145.355] GetSystemMetrics (nIndex=46) returned 2 [0145.355] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.355] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.355] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.355] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.360] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.360] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.360] GetLastError () returned 0x578 [0145.360] CanUserWritePwrScheme () returned 0 [0145.361] GetSystemMetrics (nIndex=46) returned 2 [0145.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.361] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.361] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.361] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.366] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.366] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.366] GetLastError () returned 0x578 [0145.366] CanUserWritePwrScheme () returned 0 [0145.367] GetSystemMetrics (nIndex=46) returned 2 [0145.367] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.367] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.367] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.367] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.374] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.374] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.374] GetLastError () returned 0x578 [0145.374] CanUserWritePwrScheme () returned 0 [0145.375] GetSystemMetrics (nIndex=46) returned 2 [0145.375] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.375] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.375] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.375] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.380] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.380] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.380] GetLastError () returned 0x578 [0145.380] CanUserWritePwrScheme () returned 0 [0145.381] GetSystemMetrics (nIndex=46) returned 2 [0145.381] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.381] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.381] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.381] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.387] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.387] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.387] GetLastError () returned 0x578 [0145.387] CanUserWritePwrScheme () returned 0 [0145.387] GetSystemMetrics (nIndex=46) returned 2 [0145.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.388] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.388] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.388] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.490] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.490] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.490] GetLastError () returned 0x578 [0145.490] CanUserWritePwrScheme () returned 0 [0145.491] GetSystemMetrics (nIndex=46) returned 2 [0145.491] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.491] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.491] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.491] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.502] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.502] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.502] GetLastError () returned 0x578 [0145.502] CanUserWritePwrScheme () returned 0 [0145.503] GetSystemMetrics (nIndex=46) returned 2 [0145.503] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.503] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.503] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.503] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.515] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.515] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.515] GetLastError () returned 0x578 [0145.516] CanUserWritePwrScheme () returned 0 [0145.516] GetSystemMetrics (nIndex=46) returned 2 [0145.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.528] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.528] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.528] GetLastError () returned 0x578 [0145.528] CanUserWritePwrScheme () returned 0 [0145.529] GetSystemMetrics (nIndex=46) returned 2 [0145.529] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.529] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.529] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.529] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.540] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.540] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.540] GetLastError () returned 0x578 [0145.540] CanUserWritePwrScheme () returned 0 [0145.541] GetSystemMetrics (nIndex=46) returned 2 [0145.541] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.541] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.541] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.541] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.546] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.546] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.546] GetLastError () returned 0x578 [0145.546] CanUserWritePwrScheme () returned 0 [0145.547] GetSystemMetrics (nIndex=46) returned 2 [0145.547] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.547] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.547] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.547] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.552] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.552] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.552] GetLastError () returned 0x578 [0145.552] CanUserWritePwrScheme () returned 0 [0145.553] GetSystemMetrics (nIndex=46) returned 2 [0145.553] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.553] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.553] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.553] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.560] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.560] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.560] GetLastError () returned 0x578 [0145.560] CanUserWritePwrScheme () returned 0 [0145.561] GetSystemMetrics (nIndex=46) returned 2 [0145.561] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.561] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.561] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.561] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.566] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.566] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.566] GetLastError () returned 0x578 [0145.566] CanUserWritePwrScheme () returned 0 [0145.567] GetSystemMetrics (nIndex=46) returned 2 [0145.567] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.567] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.567] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.567] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.572] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.572] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.572] GetLastError () returned 0x578 [0145.572] CanUserWritePwrScheme () returned 0 [0145.573] GetSystemMetrics (nIndex=46) returned 2 [0145.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.573] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.573] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.573] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.580] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.580] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.580] GetLastError () returned 0x578 [0145.580] CanUserWritePwrScheme () returned 0 [0145.581] GetSystemMetrics (nIndex=46) returned 2 [0145.581] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.581] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.581] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.581] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.592] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.592] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.592] GetLastError () returned 0x578 [0145.592] CanUserWritePwrScheme () returned 0 [0145.593] GetSystemMetrics (nIndex=46) returned 2 [0145.593] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.593] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.593] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.593] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.606] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.606] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.606] GetLastError () returned 0x578 [0145.606] CanUserWritePwrScheme () returned 0 [0145.607] GetSystemMetrics (nIndex=46) returned 2 [0145.607] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.607] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.607] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.607] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.618] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.618] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.618] GetLastError () returned 0x578 [0145.618] CanUserWritePwrScheme () returned 0 [0145.619] GetSystemMetrics (nIndex=46) returned 2 [0145.619] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.619] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.619] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.619] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.630] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.630] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.630] GetLastError () returned 0x578 [0145.630] CanUserWritePwrScheme () returned 0 [0145.631] GetSystemMetrics (nIndex=46) returned 2 [0145.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.643] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.643] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.643] GetLastError () returned 0x578 [0145.643] CanUserWritePwrScheme () returned 0 [0145.644] GetSystemMetrics (nIndex=46) returned 2 [0145.644] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.644] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.644] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.644] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.657] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.657] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.657] GetLastError () returned 0x578 [0145.657] CanUserWritePwrScheme () returned 0 [0145.658] GetSystemMetrics (nIndex=46) returned 2 [0145.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.658] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.658] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.658] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.671] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.671] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.671] GetLastError () returned 0x578 [0145.671] CanUserWritePwrScheme () returned 0 [0145.672] GetSystemMetrics (nIndex=46) returned 2 [0145.672] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.672] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.672] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.672] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.748] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.748] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.748] GetLastError () returned 0x578 [0145.748] CanUserWritePwrScheme () returned 0 [0145.749] GetSystemMetrics (nIndex=46) returned 2 [0145.749] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.749] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.749] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.749] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.770] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.770] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.770] GetLastError () returned 0x578 [0145.770] CanUserWritePwrScheme () returned 0 [0145.771] GetSystemMetrics (nIndex=46) returned 2 [0145.771] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.771] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.771] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.771] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.782] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.782] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.782] GetLastError () returned 0x578 [0145.782] CanUserWritePwrScheme () returned 0 [0145.783] GetSystemMetrics (nIndex=46) returned 2 [0145.783] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.783] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.783] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.783] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.794] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.794] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.794] GetLastError () returned 0x578 [0145.794] CanUserWritePwrScheme () returned 0 [0145.795] GetSystemMetrics (nIndex=46) returned 2 [0145.795] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.795] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.795] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.795] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.806] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.806] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.806] GetLastError () returned 0x578 [0145.806] CanUserWritePwrScheme () returned 0 [0145.807] GetSystemMetrics (nIndex=46) returned 2 [0145.807] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.807] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.807] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.807] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.821] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.821] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.821] GetLastError () returned 0x578 [0145.821] CanUserWritePwrScheme () returned 0 [0145.822] GetSystemMetrics (nIndex=46) returned 2 [0145.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.822] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.822] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.822] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.833] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.833] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.833] GetLastError () returned 0x578 [0145.833] CanUserWritePwrScheme () returned 0 [0145.834] GetSystemMetrics (nIndex=46) returned 2 [0145.834] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.834] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.834] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.834] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.845] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.845] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.845] GetLastError () returned 0x578 [0145.845] CanUserWritePwrScheme () returned 0 [0145.846] GetSystemMetrics (nIndex=46) returned 2 [0145.846] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.846] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.846] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.846] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.859] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.859] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.859] GetLastError () returned 0x578 [0145.860] CanUserWritePwrScheme () returned 0 [0145.860] GetSystemMetrics (nIndex=46) returned 2 [0145.860] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.860] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.860] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.873] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.873] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.873] GetLastError () returned 0x578 [0145.874] CanUserWritePwrScheme () returned 0 [0145.874] GetSystemMetrics (nIndex=46) returned 2 [0145.874] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.874] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.874] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.875] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.885] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.885] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.886] GetLastError () returned 0x578 [0145.886] CanUserWritePwrScheme () returned 0 [0145.886] GetSystemMetrics (nIndex=46) returned 2 [0145.886] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.887] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.887] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.887] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.898] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.898] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.898] GetLastError () returned 0x578 [0145.898] CanUserWritePwrScheme () returned 0 [0145.899] GetSystemMetrics (nIndex=46) returned 2 [0145.899] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.899] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.899] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.899] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.910] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.910] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.910] GetLastError () returned 0x578 [0145.910] CanUserWritePwrScheme () returned 0 [0145.911] GetSystemMetrics (nIndex=46) returned 2 [0145.911] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.911] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.911] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.911] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.924] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.924] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.924] GetLastError () returned 0x578 [0145.924] CanUserWritePwrScheme () returned 0 [0145.925] GetSystemMetrics (nIndex=46) returned 2 [0145.925] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.925] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.925] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.925] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.936] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.936] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.936] GetLastError () returned 0x578 [0145.936] CanUserWritePwrScheme () returned 0 [0145.937] GetSystemMetrics (nIndex=46) returned 2 [0145.937] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.937] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.937] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.937] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.950] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.950] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.950] GetLastError () returned 0x578 [0145.950] CanUserWritePwrScheme () returned 0 [0145.951] GetSystemMetrics (nIndex=46) returned 2 [0145.951] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.951] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.951] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.951] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.962] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.962] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.962] GetLastError () returned 0x578 [0145.962] CanUserWritePwrScheme () returned 0 [0145.963] GetSystemMetrics (nIndex=46) returned 2 [0145.963] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.963] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.963] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.963] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.974] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.974] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.974] GetLastError () returned 0x578 [0145.974] CanUserWritePwrScheme () returned 0 [0145.975] GetSystemMetrics (nIndex=46) returned 2 [0145.975] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.975] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.975] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.975] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.035] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.035] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.035] GetLastError () returned 0x578 [0146.035] CanUserWritePwrScheme () returned 0 [0146.036] GetSystemMetrics (nIndex=46) returned 2 [0146.036] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.036] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.036] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.036] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.050] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.050] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.050] GetLastError () returned 0x578 [0146.050] CanUserWritePwrScheme () returned 0 [0146.051] GetSystemMetrics (nIndex=46) returned 2 [0146.051] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.051] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.051] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.051] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.062] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.062] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.062] GetLastError () returned 0x578 [0146.062] CanUserWritePwrScheme () returned 0 [0146.063] GetSystemMetrics (nIndex=46) returned 2 [0146.063] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.063] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.063] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.063] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.074] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.074] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.074] GetLastError () returned 0x578 [0146.074] CanUserWritePwrScheme () returned 0 [0146.075] GetSystemMetrics (nIndex=46) returned 2 [0146.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.075] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.075] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.075] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.086] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.086] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.086] GetLastError () returned 0x578 [0146.086] CanUserWritePwrScheme () returned 0 [0146.087] GetSystemMetrics (nIndex=46) returned 2 [0146.087] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.087] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.087] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.087] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.100] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.100] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.100] GetLastError () returned 0x578 [0146.100] CanUserWritePwrScheme () returned 0 [0146.101] GetSystemMetrics (nIndex=46) returned 2 [0146.101] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.101] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.101] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.101] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.112] GetLastError () returned 0x578 [0146.112] CanUserWritePwrScheme () returned 0 [0146.113] GetSystemMetrics (nIndex=46) returned 2 [0146.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.124] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.124] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.124] GetLastError () returned 0x578 [0146.124] CanUserWritePwrScheme () returned 0 [0146.125] GetSystemMetrics (nIndex=46) returned 2 [0146.125] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.125] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.125] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.125] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.136] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.136] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.136] GetLastError () returned 0x578 [0146.136] CanUserWritePwrScheme () returned 0 [0146.137] GetSystemMetrics (nIndex=46) returned 2 [0146.137] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.137] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.137] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.137] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.148] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.148] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.148] GetLastError () returned 0x578 [0146.148] CanUserWritePwrScheme () returned 0 [0146.149] GetSystemMetrics (nIndex=46) returned 2 [0146.149] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.149] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.149] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.149] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.162] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.162] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.162] GetLastError () returned 0x578 [0146.162] CanUserWritePwrScheme () returned 0 [0146.163] GetSystemMetrics (nIndex=46) returned 2 [0146.163] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.163] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.163] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.163] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.167] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.167] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.168] GetLastError () returned 0x578 [0146.168] CanUserWritePwrScheme () returned 0 [0146.168] GetSystemMetrics (nIndex=46) returned 2 [0146.168] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.168] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.168] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.169] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.173] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.173] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.173] GetLastError () returned 0x578 [0146.173] CanUserWritePwrScheme () returned 0 [0146.174] GetSystemMetrics (nIndex=46) returned 2 [0146.174] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.174] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.174] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.174] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.179] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.179] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.179] GetLastError () returned 0x578 [0146.179] CanUserWritePwrScheme () returned 0 [0146.180] GetSystemMetrics (nIndex=46) returned 2 [0146.180] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.180] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.180] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.180] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.185] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.185] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.185] GetLastError () returned 0x578 [0146.185] CanUserWritePwrScheme () returned 0 [0146.186] GetSystemMetrics (nIndex=46) returned 2 [0146.186] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.186] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.186] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.186] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.191] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.191] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.191] GetLastError () returned 0x578 [0146.191] CanUserWritePwrScheme () returned 0 [0146.192] GetSystemMetrics (nIndex=46) returned 2 [0146.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.192] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.192] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.192] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.197] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.197] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.197] GetLastError () returned 0x578 [0146.198] CanUserWritePwrScheme () returned 0 [0146.198] GetSystemMetrics (nIndex=46) returned 2 [0146.198] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.198] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.198] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.199] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.210] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.210] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.210] GetLastError () returned 0x578 [0146.210] CanUserWritePwrScheme () returned 0 [0146.211] GetSystemMetrics (nIndex=46) returned 2 [0146.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.211] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.211] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.211] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.292] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.292] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.292] GetLastError () returned 0x578 [0146.292] CanUserWritePwrScheme () returned 0 [0146.293] GetSystemMetrics (nIndex=46) returned 2 [0146.293] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.293] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.293] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.293] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.304] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.304] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.304] GetLastError () returned 0x578 [0146.304] CanUserWritePwrScheme () returned 0 [0146.305] GetSystemMetrics (nIndex=46) returned 2 [0146.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.305] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.305] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.305] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.315] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.315] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.315] GetLastError () returned 0x578 [0146.315] CanUserWritePwrScheme () returned 0 [0146.316] GetSystemMetrics (nIndex=46) returned 2 [0146.316] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.316] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.316] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.316] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.328] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.328] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.328] GetLastError () returned 0x578 [0146.328] CanUserWritePwrScheme () returned 0 [0146.329] GetSystemMetrics (nIndex=46) returned 2 [0146.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.340] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.340] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.340] GetLastError () returned 0x578 [0146.340] CanUserWritePwrScheme () returned 0 [0146.341] GetSystemMetrics (nIndex=46) returned 2 [0146.341] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.341] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.341] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.341] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.354] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.354] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.354] GetLastError () returned 0x578 [0146.354] CanUserWritePwrScheme () returned 0 [0146.355] GetSystemMetrics (nIndex=46) returned 2 [0146.355] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.355] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.355] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.355] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.360] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.360] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.360] GetLastError () returned 0x578 [0146.360] CanUserWritePwrScheme () returned 0 [0146.361] GetSystemMetrics (nIndex=46) returned 2 [0146.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.361] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.361] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.361] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.366] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.366] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.366] GetLastError () returned 0x578 [0146.366] CanUserWritePwrScheme () returned 0 [0146.367] GetSystemMetrics (nIndex=46) returned 2 [0146.367] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.367] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.367] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.367] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.378] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.378] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.378] GetLastError () returned 0x578 [0146.378] CanUserWritePwrScheme () returned 0 [0146.379] GetSystemMetrics (nIndex=46) returned 2 [0146.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.379] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.379] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.379] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.390] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.390] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.390] GetLastError () returned 0x578 [0146.390] CanUserWritePwrScheme () returned 0 [0146.391] GetSystemMetrics (nIndex=46) returned 2 [0146.391] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.391] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.391] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.391] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.411] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.411] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.411] GetLastError () returned 0x578 [0146.411] CanUserWritePwrScheme () returned 0 [0146.412] GetSystemMetrics (nIndex=46) returned 2 [0146.412] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.412] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.412] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.412] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.423] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.423] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.423] GetLastError () returned 0x578 [0146.423] CanUserWritePwrScheme () returned 0 [0146.424] GetSystemMetrics (nIndex=46) returned 2 [0146.424] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.424] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.424] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.424] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.434] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.434] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.434] GetLastError () returned 0x578 [0146.434] CanUserWritePwrScheme () returned 0 [0146.435] GetSystemMetrics (nIndex=46) returned 2 [0146.435] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.435] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.435] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.435] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.446] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.446] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.446] GetLastError () returned 0x578 [0146.446] CanUserWritePwrScheme () returned 0 [0146.447] GetSystemMetrics (nIndex=46) returned 2 [0146.447] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.447] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.447] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.447] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.458] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.458] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.458] GetLastError () returned 0x578 [0146.458] CanUserWritePwrScheme () returned 0 [0146.459] GetSystemMetrics (nIndex=46) returned 2 [0146.459] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.459] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.459] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.459] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.470] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.470] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.470] GetLastError () returned 0x578 [0146.470] CanUserWritePwrScheme () returned 0 [0146.471] GetSystemMetrics (nIndex=46) returned 2 [0146.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.484] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.484] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.484] GetLastError () returned 0x578 [0146.484] CanUserWritePwrScheme () returned 0 [0146.485] GetSystemMetrics (nIndex=46) returned 2 [0146.485] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.485] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.485] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.485] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.496] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.496] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.496] GetLastError () returned 0x578 [0146.496] CanUserWritePwrScheme () returned 0 [0146.497] GetSystemMetrics (nIndex=46) returned 2 [0146.497] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.497] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.497] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.497] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.542] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.542] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.542] GetLastError () returned 0x578 [0146.542] CanUserWritePwrScheme () returned 0 [0146.543] GetSystemMetrics (nIndex=46) returned 2 [0146.543] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.543] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.543] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.543] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.552] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.552] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.552] GetLastError () returned 0x578 [0146.552] CanUserWritePwrScheme () returned 0 [0146.553] GetSystemMetrics (nIndex=46) returned 2 [0146.553] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.553] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.553] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.553] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.564] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.564] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.564] GetLastError () returned 0x578 [0146.564] CanUserWritePwrScheme () returned 0 [0146.565] GetSystemMetrics (nIndex=46) returned 2 [0146.565] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.565] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.565] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.565] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.576] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.576] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.576] GetLastError () returned 0x578 [0146.576] CanUserWritePwrScheme () returned 0 [0146.577] GetSystemMetrics (nIndex=46) returned 2 [0146.577] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.577] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.577] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.577] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.588] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.588] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.588] GetLastError () returned 0x578 [0146.588] CanUserWritePwrScheme () returned 0 [0146.589] GetSystemMetrics (nIndex=46) returned 2 [0146.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.599] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.600] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.600] GetLastError () returned 0x578 [0146.600] CanUserWritePwrScheme () returned 0 [0146.600] GetSystemMetrics (nIndex=46) returned 2 [0146.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.614] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.614] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.614] GetLastError () returned 0x578 [0146.614] CanUserWritePwrScheme () returned 0 [0146.615] GetSystemMetrics (nIndex=46) returned 2 [0146.615] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.615] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.615] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.615] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.626] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.626] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.626] GetLastError () returned 0x578 [0146.626] CanUserWritePwrScheme () returned 0 [0146.627] GetSystemMetrics (nIndex=46) returned 2 [0146.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.627] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.627] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.627] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.640] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.640] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.640] GetLastError () returned 0x578 [0146.640] CanUserWritePwrScheme () returned 0 [0146.641] GetSystemMetrics (nIndex=46) returned 2 [0146.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.641] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.641] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.641] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.652] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.652] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.652] GetLastError () returned 0x578 [0146.652] CanUserWritePwrScheme () returned 0 [0146.653] GetSystemMetrics (nIndex=46) returned 2 [0146.653] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.653] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.653] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.653] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.664] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.664] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.664] GetLastError () returned 0x578 [0146.664] CanUserWritePwrScheme () returned 0 [0146.665] GetSystemMetrics (nIndex=46) returned 2 [0146.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.665] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.665] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.665] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.678] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.678] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.678] GetLastError () returned 0x578 [0146.678] CanUserWritePwrScheme () returned 0 [0146.679] GetSystemMetrics (nIndex=46) returned 2 [0146.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.679] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.690] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.690] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.690] GetLastError () returned 0x578 [0146.690] CanUserWritePwrScheme () returned 0 [0146.691] GetSystemMetrics (nIndex=46) returned 2 [0146.691] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.691] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.691] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.691] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.702] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.702] GetLastError () returned 0x578 [0146.702] CanUserWritePwrScheme () returned 0 [0146.702] GetSystemMetrics (nIndex=46) returned 2 [0146.703] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.703] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.703] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.703] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.714] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.714] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.714] GetLastError () returned 0x578 [0146.714] CanUserWritePwrScheme () returned 0 [0146.715] GetSystemMetrics (nIndex=46) returned 2 [0146.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.715] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.715] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.715] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.725] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.725] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.725] GetLastError () returned 0x578 [0146.725] CanUserWritePwrScheme () returned 0 [0146.726] GetSystemMetrics (nIndex=46) returned 2 [0146.726] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.726] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.726] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.726] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.739] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.739] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.740] GetLastError () returned 0x578 [0146.740] CanUserWritePwrScheme () returned 0 [0146.740] GetSystemMetrics (nIndex=46) returned 2 [0146.740] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.740] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.741] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.741] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.752] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.752] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.752] GetLastError () returned 0x578 [0146.752] CanUserWritePwrScheme () returned 0 [0146.753] GetSystemMetrics (nIndex=46) returned 2 [0146.753] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.753] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.753] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.753] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.764] GetLastError () returned 0x578 [0146.764] CanUserWritePwrScheme () returned 0 [0146.765] GetSystemMetrics (nIndex=46) returned 2 [0146.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.765] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.765] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.765] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.775] GetLastError () returned 0x578 [0146.775] CanUserWritePwrScheme () returned 0 [0146.776] GetSystemMetrics (nIndex=46) returned 2 [0146.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.776] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.776] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.776] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.781] GetLastError () returned 0x578 [0146.781] CanUserWritePwrScheme () returned 0 [0146.782] GetSystemMetrics (nIndex=46) returned 2 [0146.782] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.782] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.782] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.782] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.787] GetLastError () returned 0x578 [0146.787] CanUserWritePwrScheme () returned 0 [0146.788] GetSystemMetrics (nIndex=46) returned 2 [0146.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.788] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.788] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.793] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.793] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.793] GetLastError () returned 0x578 [0146.793] CanUserWritePwrScheme () returned 0 [0146.794] GetSystemMetrics (nIndex=46) returned 2 [0146.794] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.794] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.794] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.794] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.801] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.801] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.801] GetLastError () returned 0x578 [0146.801] CanUserWritePwrScheme () returned 0 [0146.802] GetSystemMetrics (nIndex=46) returned 2 [0146.802] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.802] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.802] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.802] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.807] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.807] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.808] GetLastError () returned 0x578 [0146.808] CanUserWritePwrScheme () returned 0 [0146.808] GetSystemMetrics (nIndex=46) returned 2 [0146.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.808] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.809] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.809] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.819] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.819] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.819] GetLastError () returned 0x578 [0146.819] CanUserWritePwrScheme () returned 0 [0146.820] GetSystemMetrics (nIndex=46) returned 2 [0146.820] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.820] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.820] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.820] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.831] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.831] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.831] GetLastError () returned 0x578 [0146.831] CanUserWritePwrScheme () returned 0 [0146.832] GetSystemMetrics (nIndex=46) returned 2 [0146.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.832] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.832] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.832] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.842] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.842] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.842] GetLastError () returned 0x578 [0146.842] CanUserWritePwrScheme () returned 0 [0146.843] GetSystemMetrics (nIndex=46) returned 2 [0146.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.843] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.843] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.854] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.854] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.854] GetLastError () returned 0x578 [0146.854] CanUserWritePwrScheme () returned 0 [0146.855] GetSystemMetrics (nIndex=46) returned 2 [0146.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.855] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.855] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.855] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.868] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.868] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.868] GetLastError () returned 0x578 [0146.869] CanUserWritePwrScheme () returned 0 [0146.869] GetSystemMetrics (nIndex=46) returned 2 [0146.869] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.869] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.869] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.869] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.880] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.880] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.880] GetLastError () returned 0x578 [0146.880] CanUserWritePwrScheme () returned 0 [0146.881] GetSystemMetrics (nIndex=46) returned 2 [0146.881] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.881] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.881] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.881] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.891] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.891] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.891] GetLastError () returned 0x578 [0146.892] CanUserWritePwrScheme () returned 0 [0146.892] GetSystemMetrics (nIndex=46) returned 2 [0146.892] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.892] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.892] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.892] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.950] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.950] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.950] GetLastError () returned 0x578 [0146.950] CanUserWritePwrScheme () returned 0 [0146.951] GetSystemMetrics (nIndex=46) returned 2 [0146.951] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.951] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.951] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.951] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.962] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.962] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.962] GetLastError () returned 0x578 [0146.962] CanUserWritePwrScheme () returned 0 [0146.963] GetSystemMetrics (nIndex=46) returned 2 [0146.963] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.963] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.963] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.963] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.974] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.974] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.974] GetLastError () returned 0x578 [0146.974] CanUserWritePwrScheme () returned 0 [0146.975] GetSystemMetrics (nIndex=46) returned 2 [0146.975] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.975] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.975] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.975] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.985] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.985] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.985] GetLastError () returned 0x578 [0146.986] CanUserWritePwrScheme () returned 0 [0146.986] GetSystemMetrics (nIndex=46) returned 2 [0146.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.986] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.000] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.000] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.000] GetLastError () returned 0x578 [0147.000] CanUserWritePwrScheme () returned 0 [0147.001] GetSystemMetrics (nIndex=46) returned 2 [0147.001] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.001] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.001] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.001] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.012] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.012] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.012] GetLastError () returned 0x578 [0147.013] CanUserWritePwrScheme () returned 0 [0147.013] GetSystemMetrics (nIndex=46) returned 2 [0147.013] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.013] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.013] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.013] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.024] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.024] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.024] GetLastError () returned 0x578 [0147.024] CanUserWritePwrScheme () returned 0 [0147.025] GetSystemMetrics (nIndex=46) returned 2 [0147.025] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.025] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.025] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.025] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.036] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.036] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.036] GetLastError () returned 0x578 [0147.036] CanUserWritePwrScheme () returned 0 [0147.037] GetSystemMetrics (nIndex=46) returned 2 [0147.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.037] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.037] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.037] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.047] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.047] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.047] GetLastError () returned 0x578 [0147.047] CanUserWritePwrScheme () returned 0 [0147.048] GetSystemMetrics (nIndex=46) returned 2 [0147.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.048] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.048] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.048] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.062] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.062] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.062] GetLastError () returned 0x578 [0147.062] CanUserWritePwrScheme () returned 0 [0147.063] GetSystemMetrics (nIndex=46) returned 2 [0147.063] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.063] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.063] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.063] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.074] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.074] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.074] GetLastError () returned 0x578 [0147.074] CanUserWritePwrScheme () returned 0 [0147.075] GetSystemMetrics (nIndex=46) returned 2 [0147.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.075] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.075] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.075] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.086] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.086] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.086] GetLastError () returned 0x578 [0147.086] CanUserWritePwrScheme () returned 0 [0147.087] GetSystemMetrics (nIndex=46) returned 2 [0147.087] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.087] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.087] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.087] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.098] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.098] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.098] GetLastError () returned 0x578 [0147.098] CanUserWritePwrScheme () returned 0 [0147.099] GetSystemMetrics (nIndex=46) returned 2 [0147.099] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.099] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.099] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.099] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.109] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.109] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.109] GetLastError () returned 0x578 [0147.109] CanUserWritePwrScheme () returned 0 [0147.110] GetSystemMetrics (nIndex=46) returned 2 [0147.110] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.110] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.110] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.110] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.128] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.128] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.128] GetLastError () returned 0x578 [0147.128] CanUserWritePwrScheme () returned 0 [0147.129] GetSystemMetrics (nIndex=46) returned 2 [0147.129] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.129] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.129] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.129] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.139] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.139] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.139] GetLastError () returned 0x578 [0147.139] CanUserWritePwrScheme () returned 0 [0147.140] GetSystemMetrics (nIndex=46) returned 2 [0147.140] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.140] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.140] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.140] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.151] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.151] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.151] GetLastError () returned 0x578 [0147.151] CanUserWritePwrScheme () returned 0 [0147.152] GetSystemMetrics (nIndex=46) returned 2 [0147.152] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.152] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.152] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.152] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.163] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.163] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.163] GetLastError () returned 0x578 [0147.163] CanUserWritePwrScheme () returned 0 [0147.164] GetSystemMetrics (nIndex=46) returned 2 [0147.164] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.164] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.164] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.164] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.209] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.209] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.209] GetLastError () returned 0x578 [0147.209] CanUserWritePwrScheme () returned 0 [0147.210] GetSystemMetrics (nIndex=46) returned 2 [0147.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.210] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.210] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.210] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.221] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.221] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.221] GetLastError () returned 0x578 [0147.221] CanUserWritePwrScheme () returned 0 [0147.222] GetSystemMetrics (nIndex=46) returned 2 [0147.222] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.222] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.222] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.222] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.232] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.232] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.232] GetLastError () returned 0x578 [0147.232] CanUserWritePwrScheme () returned 0 [0147.233] GetSystemMetrics (nIndex=46) returned 2 [0147.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.233] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.233] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.233] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.244] GetLastError () returned 0x578 [0147.244] CanUserWritePwrScheme () returned 0 [0147.245] GetSystemMetrics (nIndex=46) returned 2 [0147.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.258] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.258] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.258] GetLastError () returned 0x578 [0147.258] CanUserWritePwrScheme () returned 0 [0147.259] GetSystemMetrics (nIndex=46) returned 2 [0147.259] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.259] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.259] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.259] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.270] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.270] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.270] GetLastError () returned 0x578 [0147.270] CanUserWritePwrScheme () returned 0 [0147.271] GetSystemMetrics (nIndex=46) returned 2 [0147.271] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.271] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.271] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.271] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.281] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.281] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.281] GetLastError () returned 0x578 [0147.281] CanUserWritePwrScheme () returned 0 [0147.282] GetSystemMetrics (nIndex=46) returned 2 [0147.282] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.282] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.282] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.282] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.292] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.292] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.292] GetLastError () returned 0x578 [0147.293] CanUserWritePwrScheme () returned 0 [0147.293] GetSystemMetrics (nIndex=46) returned 2 [0147.293] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.293] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.293] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.294] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.304] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.304] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.304] GetLastError () returned 0x578 [0147.304] CanUserWritePwrScheme () returned 0 [0147.305] GetSystemMetrics (nIndex=46) returned 2 [0147.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.305] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.305] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.305] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.316] GetLastError () returned 0x578 [0147.316] CanUserWritePwrScheme () returned 0 [0147.317] GetSystemMetrics (nIndex=46) returned 2 [0147.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.330] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.330] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.330] GetLastError () returned 0x578 [0147.330] CanUserWritePwrScheme () returned 0 [0147.331] GetSystemMetrics (nIndex=46) returned 2 [0147.331] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.331] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.331] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.331] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.342] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.342] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.342] GetLastError () returned 0x578 [0147.342] CanUserWritePwrScheme () returned 0 [0147.343] GetSystemMetrics (nIndex=46) returned 2 [0147.343] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.343] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.343] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.343] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.354] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.354] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.354] GetLastError () returned 0x578 [0147.354] CanUserWritePwrScheme () returned 0 [0147.355] GetSystemMetrics (nIndex=46) returned 2 [0147.355] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.355] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.355] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.355] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.366] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.366] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.366] GetLastError () returned 0x578 [0147.366] CanUserWritePwrScheme () returned 0 [0147.367] GetSystemMetrics (nIndex=46) returned 2 [0147.367] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.367] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.367] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.367] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.378] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.378] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.378] GetLastError () returned 0x578 [0147.378] CanUserWritePwrScheme () returned 0 [0147.379] GetSystemMetrics (nIndex=46) returned 2 [0147.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.379] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.379] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.379] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.393] GetLastError () returned 0x578 [0147.393] CanUserWritePwrScheme () returned 0 [0147.394] GetSystemMetrics (nIndex=46) returned 2 [0147.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.394] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.394] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.394] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.412] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.412] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.412] GetLastError () returned 0x578 [0147.413] CanUserWritePwrScheme () returned 0 [0147.413] GetSystemMetrics (nIndex=46) returned 2 [0147.413] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.413] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.413] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.413] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.424] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.424] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.424] GetLastError () returned 0x578 [0147.424] CanUserWritePwrScheme () returned 0 [0147.425] GetSystemMetrics (nIndex=46) returned 2 [0147.425] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.425] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.425] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.425] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.499] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.499] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.499] GetLastError () returned 0x578 [0147.499] CanUserWritePwrScheme () returned 0 [0147.500] GetSystemMetrics (nIndex=46) returned 2 [0147.500] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.500] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.500] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.500] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.510] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.510] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.511] GetLastError () returned 0x578 [0147.511] CanUserWritePwrScheme () returned 0 [0147.511] GetSystemMetrics (nIndex=46) returned 2 [0147.511] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.511] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.511] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.512] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.528] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.528] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.528] GetLastError () returned 0x578 [0147.528] CanUserWritePwrScheme () returned 0 [0147.529] GetSystemMetrics (nIndex=46) returned 2 [0147.529] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.529] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.529] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.529] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.540] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.540] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.540] GetLastError () returned 0x578 [0147.540] CanUserWritePwrScheme () returned 0 [0147.541] GetSystemMetrics (nIndex=46) returned 2 [0147.541] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.541] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.541] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.541] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.552] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.552] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.552] GetLastError () returned 0x578 [0147.552] CanUserWritePwrScheme () returned 0 [0147.553] GetSystemMetrics (nIndex=46) returned 2 [0147.553] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.553] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.553] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.553] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.564] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.564] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.564] GetLastError () returned 0x578 [0147.564] CanUserWritePwrScheme () returned 0 [0147.565] GetSystemMetrics (nIndex=46) returned 2 [0147.565] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.565] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.565] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.565] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.576] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.576] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.576] GetLastError () returned 0x578 [0147.576] CanUserWritePwrScheme () returned 0 [0147.577] GetSystemMetrics (nIndex=46) returned 2 [0147.577] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.577] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.577] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.577] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.590] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.590] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.590] GetLastError () returned 0x578 [0147.590] CanUserWritePwrScheme () returned 0 [0147.591] GetSystemMetrics (nIndex=46) returned 2 [0147.591] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.591] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.591] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.591] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.602] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.602] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.602] GetLastError () returned 0x578 [0147.603] CanUserWritePwrScheme () returned 0 [0147.603] GetSystemMetrics (nIndex=46) returned 2 [0147.603] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.603] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.603] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.604] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.614] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.614] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.614] GetLastError () returned 0x578 [0147.614] CanUserWritePwrScheme () returned 0 [0147.615] GetSystemMetrics (nIndex=46) returned 2 [0147.615] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.615] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.615] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.615] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.626] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.626] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.626] GetLastError () returned 0x578 [0147.626] CanUserWritePwrScheme () returned 0 [0147.627] GetSystemMetrics (nIndex=46) returned 2 [0147.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.627] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.627] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.627] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.639] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.639] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.639] GetLastError () returned 0x578 [0147.639] CanUserWritePwrScheme () returned 0 [0147.640] GetSystemMetrics (nIndex=46) returned 2 [0147.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.640] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.640] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.640] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.654] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.654] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.654] GetLastError () returned 0x578 [0147.654] CanUserWritePwrScheme () returned 0 [0147.655] GetSystemMetrics (nIndex=46) returned 2 [0147.655] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.655] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.655] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.655] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.667] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.667] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.667] GetLastError () returned 0x578 [0147.667] CanUserWritePwrScheme () returned 0 [0147.668] GetSystemMetrics (nIndex=46) returned 2 [0147.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.668] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.668] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.668] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.679] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.679] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.679] GetLastError () returned 0x578 [0147.679] CanUserWritePwrScheme () returned 0 [0147.680] GetSystemMetrics (nIndex=46) returned 2 [0147.680] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.680] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.680] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.680] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.690] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.690] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.690] GetLastError () returned 0x578 [0147.691] CanUserWritePwrScheme () returned 0 [0147.691] GetSystemMetrics (nIndex=46) returned 2 [0147.691] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.691] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.691] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.691] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.702] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.702] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.702] GetLastError () returned 0x578 [0147.702] CanUserWritePwrScheme () returned 0 [0147.703] GetSystemMetrics (nIndex=46) returned 2 [0147.703] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.703] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.703] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.703] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.717] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.717] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.717] GetLastError () returned 0x578 [0147.717] CanUserWritePwrScheme () returned 0 [0147.718] GetSystemMetrics (nIndex=46) returned 2 [0147.718] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.718] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.718] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.718] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.729] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.729] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.729] GetLastError () returned 0x578 [0147.729] CanUserWritePwrScheme () returned 0 [0147.730] GetSystemMetrics (nIndex=46) returned 2 [0147.730] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.730] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.730] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.730] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.740] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.740] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.740] GetLastError () returned 0x578 [0147.740] CanUserWritePwrScheme () returned 0 [0147.741] GetSystemMetrics (nIndex=46) returned 2 [0147.741] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.741] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.741] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.741] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.752] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.752] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.753] GetLastError () returned 0x578 [0147.753] CanUserWritePwrScheme () returned 0 [0147.753] GetSystemMetrics (nIndex=46) returned 2 [0147.753] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.753] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.754] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.754] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.764] GetLastError () returned 0x578 [0147.764] CanUserWritePwrScheme () returned 0 [0147.765] GetSystemMetrics (nIndex=46) returned 2 [0147.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.765] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.765] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.765] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.779] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.779] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.779] GetLastError () returned 0x578 [0147.779] CanUserWritePwrScheme () returned 0 [0147.780] GetSystemMetrics (nIndex=46) returned 2 [0147.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.791] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.791] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.791] GetLastError () returned 0x578 [0147.791] CanUserWritePwrScheme () returned 0 [0147.792] GetSystemMetrics (nIndex=46) returned 2 [0147.792] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.792] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.792] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.792] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.803] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.803] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.803] GetLastError () returned 0x578 [0147.803] CanUserWritePwrScheme () returned 0 [0147.804] GetSystemMetrics (nIndex=46) returned 2 [0147.804] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.804] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.804] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.804] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.815] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.815] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.815] GetLastError () returned 0x578 [0147.815] CanUserWritePwrScheme () returned 0 [0147.816] GetSystemMetrics (nIndex=46) returned 2 [0147.816] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.816] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.816] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.816] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.826] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.827] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.827] GetLastError () returned 0x578 [0147.827] CanUserWritePwrScheme () returned 0 [0147.827] GetSystemMetrics (nIndex=46) returned 2 [0147.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.828] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.828] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.828] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.842] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.842] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.842] GetLastError () returned 0x578 [0147.842] CanUserWritePwrScheme () returned 0 [0147.843] GetSystemMetrics (nIndex=46) returned 2 [0147.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.843] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.843] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.854] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.854] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.854] GetLastError () returned 0x578 [0147.854] CanUserWritePwrScheme () returned 0 [0147.855] GetSystemMetrics (nIndex=46) returned 2 [0147.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.855] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.855] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.855] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.865] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.865] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.865] GetLastError () returned 0x578 [0147.865] CanUserWritePwrScheme () returned 0 [0147.866] GetSystemMetrics (nIndex=46) returned 2 [0147.866] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.866] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.866] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.866] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.877] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.877] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.877] GetLastError () returned 0x578 [0147.877] CanUserWritePwrScheme () returned 0 [0147.878] GetSystemMetrics (nIndex=46) returned 2 [0147.878] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.878] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.878] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.878] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.889] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.889] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.889] GetLastError () returned 0x578 [0147.889] CanUserWritePwrScheme () returned 0 [0147.890] GetSystemMetrics (nIndex=46) returned 2 [0147.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.890] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.905] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.905] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.905] GetLastError () returned 0x578 [0147.905] CanUserWritePwrScheme () returned 0 [0147.909] GetSystemMetrics (nIndex=46) returned 2 [0147.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.909] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.909] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.909] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.920] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.920] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.920] GetLastError () returned 0x578 [0147.920] CanUserWritePwrScheme () returned 0 [0147.921] GetSystemMetrics (nIndex=46) returned 2 [0147.921] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.921] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.921] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.921] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.931] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.932] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.932] GetLastError () returned 0x578 [0147.932] CanUserWritePwrScheme () returned 0 [0147.932] GetSystemMetrics (nIndex=46) returned 2 [0147.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.933] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.933] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.933] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.944] GetLastError () returned 0x578 [0147.944] CanUserWritePwrScheme () returned 0 [0147.945] GetSystemMetrics (nIndex=46) returned 2 [0147.945] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.945] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.945] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.945] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.956] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.956] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.956] GetLastError () returned 0x578 [0147.956] CanUserWritePwrScheme () returned 0 [0147.957] GetSystemMetrics (nIndex=46) returned 2 [0147.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.957] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.957] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.957] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.967] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.967] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.967] GetLastError () returned 0x578 [0147.968] CanUserWritePwrScheme () returned 0 [0147.968] GetSystemMetrics (nIndex=46) returned 2 [0147.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.982] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.982] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.983] GetLastError () returned 0x578 [0147.983] CanUserWritePwrScheme () returned 0 [0147.983] GetSystemMetrics (nIndex=46) returned 2 [0147.983] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.994] GetLastError () returned 0x578 [0147.994] CanUserWritePwrScheme () returned 0 [0147.995] GetSystemMetrics (nIndex=46) returned 2 [0147.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.006] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.006] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.006] GetLastError () returned 0x578 [0148.006] CanUserWritePwrScheme () returned 0 [0148.007] GetSystemMetrics (nIndex=46) returned 2 [0148.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.007] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.007] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.007] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.018] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.018] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.018] GetLastError () returned 0x578 [0148.018] CanUserWritePwrScheme () returned 0 [0148.019] GetSystemMetrics (nIndex=46) returned 2 [0148.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.019] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.030] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.030] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.030] GetLastError () returned 0x578 [0148.030] CanUserWritePwrScheme () returned 0 [0148.031] GetSystemMetrics (nIndex=46) returned 2 [0148.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.031] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.031] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.031] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.045] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.045] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.045] GetLastError () returned 0x578 [0148.045] CanUserWritePwrScheme () returned 0 [0148.046] GetSystemMetrics (nIndex=46) returned 2 [0148.046] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.046] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.046] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.046] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.056] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.057] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.057] GetLastError () returned 0x578 [0148.057] CanUserWritePwrScheme () returned 0 [0148.057] GetSystemMetrics (nIndex=46) returned 2 [0148.058] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.058] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.058] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.058] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.068] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.068] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.068] GetLastError () returned 0x578 [0148.068] CanUserWritePwrScheme () returned 0 [0148.069] GetSystemMetrics (nIndex=46) returned 2 [0148.069] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.069] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.069] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.069] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.080] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.080] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.080] GetLastError () returned 0x578 [0148.080] CanUserWritePwrScheme () returned 0 [0148.081] GetSystemMetrics (nIndex=46) returned 2 [0148.081] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.081] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.081] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.081] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.092] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.092] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.092] GetLastError () returned 0x578 [0148.092] CanUserWritePwrScheme () returned 0 [0148.093] GetSystemMetrics (nIndex=46) returned 2 [0148.093] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.093] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.093] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.093] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.107] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.107] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.107] GetLastError () returned 0x578 [0148.107] CanUserWritePwrScheme () returned 0 [0148.108] GetSystemMetrics (nIndex=46) returned 2 [0148.108] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.108] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.108] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.108] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.119] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.119] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.119] GetLastError () returned 0x578 [0148.119] CanUserWritePwrScheme () returned 0 [0148.120] GetSystemMetrics (nIndex=46) returned 2 [0148.120] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.120] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.120] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.120] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.132] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.132] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.132] GetLastError () returned 0x578 [0148.132] CanUserWritePwrScheme () returned 0 [0148.133] GetSystemMetrics (nIndex=46) returned 2 [0148.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.133] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.133] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.133] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.144] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.144] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.144] GetLastError () returned 0x578 [0148.144] CanUserWritePwrScheme () returned 0 [0148.145] GetSystemMetrics (nIndex=46) returned 2 [0148.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.145] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.145] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.145] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.156] GetLastError () returned 0x578 [0148.156] CanUserWritePwrScheme () returned 0 [0148.157] GetSystemMetrics (nIndex=46) returned 2 [0148.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.157] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.157] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.157] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.171] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.171] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.171] GetLastError () returned 0x578 [0148.171] CanUserWritePwrScheme () returned 0 [0148.172] GetSystemMetrics (nIndex=46) returned 2 [0148.172] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.172] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.172] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.172] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.193] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.193] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.193] GetLastError () returned 0x578 [0148.193] CanUserWritePwrScheme () returned 0 [0148.194] GetSystemMetrics (nIndex=46) returned 2 [0148.194] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.194] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.194] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.194] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.205] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.205] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.205] GetLastError () returned 0x578 [0148.205] CanUserWritePwrScheme () returned 0 [0148.206] GetSystemMetrics (nIndex=46) returned 2 [0148.206] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.206] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.206] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.206] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.216] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.216] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.216] GetLastError () returned 0x578 [0148.216] CanUserWritePwrScheme () returned 0 [0148.217] GetSystemMetrics (nIndex=46) returned 2 [0148.217] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.217] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.217] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.217] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.228] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.228] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.228] GetLastError () returned 0x578 [0148.228] CanUserWritePwrScheme () returned 0 [0148.229] GetSystemMetrics (nIndex=46) returned 2 [0148.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.229] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.229] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.229] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.243] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.243] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.243] GetLastError () returned 0x578 [0148.243] CanUserWritePwrScheme () returned 0 [0148.244] GetSystemMetrics (nIndex=46) returned 2 [0148.244] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.244] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.244] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.244] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.255] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.255] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.255] GetLastError () returned 0x578 [0148.255] CanUserWritePwrScheme () returned 0 [0148.256] GetSystemMetrics (nIndex=46) returned 2 [0148.256] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.256] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.256] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.256] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.266] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.267] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.267] GetLastError () returned 0x578 [0148.267] CanUserWritePwrScheme () returned 0 [0148.268] GetSystemMetrics (nIndex=46) returned 2 [0148.268] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.268] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.268] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.268] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.278] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.278] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.278] GetLastError () returned 0x578 [0148.278] CanUserWritePwrScheme () returned 0 [0148.279] GetSystemMetrics (nIndex=46) returned 2 [0148.279] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.279] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.279] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.279] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.290] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.290] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.290] GetLastError () returned 0x578 [0148.290] CanUserWritePwrScheme () returned 0 [0148.291] GetSystemMetrics (nIndex=46) returned 2 [0148.291] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.291] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.291] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.291] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.305] GetLastError () returned 0x578 [0148.305] CanUserWritePwrScheme () returned 0 [0148.306] GetSystemMetrics (nIndex=46) returned 2 [0148.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.306] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.306] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.306] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.316] GetLastError () returned 0x578 [0148.316] CanUserWritePwrScheme () returned 0 [0148.317] GetSystemMetrics (nIndex=46) returned 2 [0148.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.328] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.328] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.328] GetLastError () returned 0x578 [0148.328] CanUserWritePwrScheme () returned 0 [0148.329] GetSystemMetrics (nIndex=46) returned 2 [0148.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.340] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.340] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.340] GetLastError () returned 0x578 [0148.340] CanUserWritePwrScheme () returned 0 [0148.341] GetSystemMetrics (nIndex=46) returned 2 [0148.341] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.341] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.341] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.341] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.352] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.352] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.352] GetLastError () returned 0x578 [0148.352] CanUserWritePwrScheme () returned 0 [0148.353] GetSystemMetrics (nIndex=46) returned 2 [0148.353] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.353] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.353] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.353] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.367] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.367] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.367] GetLastError () returned 0x578 [0148.367] CanUserWritePwrScheme () returned 0 [0148.368] GetSystemMetrics (nIndex=46) returned 2 [0148.368] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.368] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.368] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.368] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.379] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.379] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.379] GetLastError () returned 0x578 [0148.379] CanUserWritePwrScheme () returned 0 [0148.380] GetSystemMetrics (nIndex=46) returned 2 [0148.380] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.380] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.380] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.380] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.391] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.391] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.391] GetLastError () returned 0x578 [0148.391] CanUserWritePwrScheme () returned 0 [0148.392] GetSystemMetrics (nIndex=46) returned 2 [0148.392] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.392] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.392] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.392] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.409] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.409] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.410] GetLastError () returned 0x578 [0148.410] CanUserWritePwrScheme () returned 0 [0148.410] GetSystemMetrics (nIndex=46) returned 2 [0148.411] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.411] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.411] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.411] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.421] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.421] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.421] GetLastError () returned 0x578 [0148.421] CanUserWritePwrScheme () returned 0 [0148.422] GetSystemMetrics (nIndex=46) returned 2 [0148.422] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.422] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.422] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.422] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.430] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.430] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.430] GetLastError () returned 0x578 [0148.430] CanUserWritePwrScheme () returned 0 [0148.431] GetSystemMetrics (nIndex=46) returned 2 [0148.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.436] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.436] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.436] GetLastError () returned 0x578 [0148.436] CanUserWritePwrScheme () returned 0 [0148.437] GetSystemMetrics (nIndex=46) returned 2 [0148.437] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.437] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.437] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.437] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.442] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.442] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.442] GetLastError () returned 0x578 [0148.442] CanUserWritePwrScheme () returned 0 [0148.443] GetSystemMetrics (nIndex=46) returned 2 [0148.443] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.443] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.443] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.443] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.448] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.448] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.448] GetLastError () returned 0x578 [0148.448] CanUserWritePwrScheme () returned 0 [0148.449] GetSystemMetrics (nIndex=46) returned 2 [0148.449] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.449] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.449] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.449] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.454] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.454] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.454] GetLastError () returned 0x578 [0148.454] CanUserWritePwrScheme () returned 0 [0148.455] GetSystemMetrics (nIndex=46) returned 2 [0148.455] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.455] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.455] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.455] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.460] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.460] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.460] GetLastError () returned 0x578 [0148.460] CanUserWritePwrScheme () returned 0 [0148.461] GetSystemMetrics (nIndex=46) returned 2 [0148.461] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.461] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.461] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.461] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.467] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.467] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.467] GetLastError () returned 0x578 [0148.467] CanUserWritePwrScheme () returned 0 [0148.468] GetSystemMetrics (nIndex=46) returned 2 [0148.468] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.468] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.468] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.468] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.479] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.479] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.479] GetLastError () returned 0x578 [0148.479] CanUserWritePwrScheme () returned 0 [0148.480] GetSystemMetrics (nIndex=46) returned 2 [0148.480] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.480] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.480] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.480] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.491] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.491] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.491] GetLastError () returned 0x578 [0148.491] CanUserWritePwrScheme () returned 0 [0148.495] GetSystemMetrics (nIndex=46) returned 2 [0148.495] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.495] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.495] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.495] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.506] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.506] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.506] GetLastError () returned 0x578 [0148.506] CanUserWritePwrScheme () returned 0 [0148.507] GetSystemMetrics (nIndex=46) returned 2 [0148.507] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.507] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.507] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.507] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.517] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.517] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.518] GetLastError () returned 0x578 [0148.518] CanUserWritePwrScheme () returned 0 [0148.518] GetSystemMetrics (nIndex=46) returned 2 [0148.518] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.519] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.519] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.519] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.529] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.529] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.529] GetLastError () returned 0x578 [0148.529] CanUserWritePwrScheme () returned 0 [0148.530] GetSystemMetrics (nIndex=46) returned 2 [0148.530] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.530] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.530] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.530] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.541] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.541] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.541] GetLastError () returned 0x578 [0148.541] CanUserWritePwrScheme () returned 0 [0148.542] GetSystemMetrics (nIndex=46) returned 2 [0148.542] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.542] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.542] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.542] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.553] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.553] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.553] GetLastError () returned 0x578 [0148.553] CanUserWritePwrScheme () returned 0 [0148.554] GetSystemMetrics (nIndex=46) returned 2 [0148.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.554] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.554] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.554] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.568] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.568] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.568] GetLastError () returned 0x578 [0148.568] CanUserWritePwrScheme () returned 0 [0148.569] GetSystemMetrics (nIndex=46) returned 2 [0148.569] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.569] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.569] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.569] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.579] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.580] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.580] GetLastError () returned 0x578 [0148.580] CanUserWritePwrScheme () returned 0 [0148.580] GetSystemMetrics (nIndex=46) returned 2 [0148.580] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.581] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.581] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.581] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.591] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.591] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.591] GetLastError () returned 0x578 [0148.591] CanUserWritePwrScheme () returned 0 [0148.592] GetSystemMetrics (nIndex=46) returned 2 [0148.592] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.592] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.592] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.592] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.650] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.650] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.650] GetLastError () returned 0x578 [0148.650] CanUserWritePwrScheme () returned 0 [0148.651] GetSystemMetrics (nIndex=46) returned 2 [0148.651] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.651] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.651] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.651] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.662] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.662] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.662] GetLastError () returned 0x578 [0148.662] CanUserWritePwrScheme () returned 0 [0148.663] GetSystemMetrics (nIndex=46) returned 2 [0148.663] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.663] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.663] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.663] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.674] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.674] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.674] GetLastError () returned 0x578 [0148.674] CanUserWritePwrScheme () returned 0 [0148.675] GetSystemMetrics (nIndex=46) returned 2 [0148.675] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.675] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.675] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.675] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.685] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.686] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.686] GetLastError () returned 0x578 [0148.686] CanUserWritePwrScheme () returned 0 [0148.689] GetSystemMetrics (nIndex=46) returned 2 [0148.689] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.689] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.689] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.689] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.700] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.700] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.700] GetLastError () returned 0x578 [0148.700] CanUserWritePwrScheme () returned 0 [0148.701] GetSystemMetrics (nIndex=46) returned 2 [0148.701] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.701] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.701] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.701] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.711] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.711] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.711] GetLastError () returned 0x578 [0148.711] CanUserWritePwrScheme () returned 0 [0148.712] GetSystemMetrics (nIndex=46) returned 2 [0148.712] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.712] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.712] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.712] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.723] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.723] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.723] GetLastError () returned 0x578 [0148.723] CanUserWritePwrScheme () returned 0 [0148.724] GetSystemMetrics (nIndex=46) returned 2 [0148.724] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.724] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.724] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.724] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.735] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.735] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.735] GetLastError () returned 0x578 [0148.735] CanUserWritePwrScheme () returned 0 [0148.736] GetSystemMetrics (nIndex=46) returned 2 [0148.736] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.736] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.736] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.736] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.748] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.748] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.748] GetLastError () returned 0x578 [0148.748] CanUserWritePwrScheme () returned 0 [0148.749] GetSystemMetrics (nIndex=46) returned 2 [0148.749] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.749] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.749] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.749] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.763] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.763] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.763] GetLastError () returned 0x578 [0148.763] CanUserWritePwrScheme () returned 0 [0148.764] GetSystemMetrics (nIndex=46) returned 2 [0148.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.764] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.764] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.764] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.775] GetLastError () returned 0x578 [0148.775] CanUserWritePwrScheme () returned 0 [0148.776] GetSystemMetrics (nIndex=46) returned 2 [0148.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.776] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.776] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.776] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.787] GetLastError () returned 0x578 [0148.787] CanUserWritePwrScheme () returned 0 [0148.788] GetSystemMetrics (nIndex=46) returned 2 [0148.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.788] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.788] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.799] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.799] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.799] GetLastError () returned 0x578 [0148.799] CanUserWritePwrScheme () returned 0 [0148.800] GetSystemMetrics (nIndex=46) returned 2 [0148.800] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.800] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.800] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.800] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.810] GetLastError () returned 0x578 [0148.810] CanUserWritePwrScheme () returned 0 [0148.811] GetSystemMetrics (nIndex=46) returned 2 [0148.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.825] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.825] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.825] GetLastError () returned 0x578 [0148.825] CanUserWritePwrScheme () returned 0 [0148.826] GetSystemMetrics (nIndex=46) returned 2 [0148.826] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.826] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.826] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.826] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.837] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.837] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.837] GetLastError () returned 0x578 [0148.837] CanUserWritePwrScheme () returned 0 [0148.838] GetSystemMetrics (nIndex=46) returned 2 [0148.838] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.838] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.838] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.838] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.848] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.848] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.848] GetLastError () returned 0x578 [0148.848] CanUserWritePwrScheme () returned 0 [0148.849] GetSystemMetrics (nIndex=46) returned 2 [0148.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.849] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.849] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.849] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.860] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.860] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.860] GetLastError () returned 0x578 [0148.860] CanUserWritePwrScheme () returned 0 [0148.861] GetSystemMetrics (nIndex=46) returned 2 [0148.861] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.872] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.872] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.872] GetLastError () returned 0x578 [0148.872] CanUserWritePwrScheme () returned 0 [0148.873] GetSystemMetrics (nIndex=46) returned 2 [0148.873] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.873] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.873] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.873] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.887] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.887] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.887] GetLastError () returned 0x578 [0148.887] CanUserWritePwrScheme () returned 0 [0148.887] GetSystemMetrics (nIndex=46) returned 2 [0148.888] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.888] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.888] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.888] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.899] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.899] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.899] GetLastError () returned 0x578 [0148.899] CanUserWritePwrScheme () returned 0 [0148.900] GetSystemMetrics (nIndex=46) returned 2 [0148.900] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.900] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.900] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.900] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.910] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.911] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.911] GetLastError () returned 0x578 [0148.911] CanUserWritePwrScheme () returned 0 [0148.911] GetSystemMetrics (nIndex=46) returned 2 [0148.912] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.912] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.912] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.912] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.922] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.922] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.923] GetLastError () returned 0x578 [0148.923] CanUserWritePwrScheme () returned 0 [0148.923] GetSystemMetrics (nIndex=46) returned 2 [0148.923] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.923] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.923] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.924] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.934] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.934] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.934] GetLastError () returned 0x578 [0148.934] CanUserWritePwrScheme () returned 0 [0148.935] GetSystemMetrics (nIndex=46) returned 2 [0148.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.946] GetLastError () returned 0x578 [0148.946] CanUserWritePwrScheme () returned 0 [0148.947] GetSystemMetrics (nIndex=46) returned 2 [0148.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.947] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.947] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.948] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.961] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.961] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.961] GetLastError () returned 0x578 [0148.961] CanUserWritePwrScheme () returned 0 [0148.962] GetSystemMetrics (nIndex=46) returned 2 [0148.962] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.962] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.962] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.962] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.973] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.973] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.973] GetLastError () returned 0x578 [0148.973] CanUserWritePwrScheme () returned 0 [0148.974] GetSystemMetrics (nIndex=46) returned 2 [0148.974] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.974] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.974] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.974] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.985] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.985] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.985] GetLastError () returned 0x578 [0148.985] CanUserWritePwrScheme () returned 0 [0148.986] GetSystemMetrics (nIndex=46) returned 2 [0148.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.986] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.997] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.997] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.997] GetLastError () returned 0x578 [0148.997] CanUserWritePwrScheme () returned 0 [0148.998] GetSystemMetrics (nIndex=46) returned 2 [0148.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.998] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.998] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.998] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.009] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.009] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.009] GetLastError () returned 0x578 [0149.009] CanUserWritePwrScheme () returned 0 [0149.010] GetSystemMetrics (nIndex=46) returned 2 [0149.010] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.010] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.010] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.010] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.023] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.023] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.023] GetLastError () returned 0x578 [0149.023] CanUserWritePwrScheme () returned 0 [0149.024] GetSystemMetrics (nIndex=46) returned 2 [0149.024] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.024] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.024] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.024] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.035] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.035] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.035] GetLastError () returned 0x578 [0149.035] CanUserWritePwrScheme () returned 0 [0149.036] GetSystemMetrics (nIndex=46) returned 2 [0149.036] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.036] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.036] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.036] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.047] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.047] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.047] GetLastError () returned 0x578 [0149.047] CanUserWritePwrScheme () returned 0 [0149.048] GetSystemMetrics (nIndex=46) returned 2 [0149.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.048] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.048] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.048] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.059] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.059] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.059] GetLastError () returned 0x578 [0149.059] CanUserWritePwrScheme () returned 0 [0149.060] GetSystemMetrics (nIndex=46) returned 2 [0149.060] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.060] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.060] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.060] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.071] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.071] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.071] GetLastError () returned 0x578 [0149.071] CanUserWritePwrScheme () returned 0 [0149.072] GetSystemMetrics (nIndex=46) returned 2 [0149.072] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.072] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.072] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.072] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.085] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.085] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.085] GetLastError () returned 0x578 [0149.085] CanUserWritePwrScheme () returned 0 [0149.086] GetSystemMetrics (nIndex=46) returned 2 [0149.086] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.086] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.086] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.086] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.097] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.097] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.097] GetLastError () returned 0x578 [0149.097] CanUserWritePwrScheme () returned 0 [0149.098] GetSystemMetrics (nIndex=46) returned 2 [0149.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.098] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.098] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.098] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.109] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.109] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.109] GetLastError () returned 0x578 [0149.109] CanUserWritePwrScheme () returned 0 [0149.110] GetSystemMetrics (nIndex=46) returned 2 [0149.110] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.110] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.110] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.110] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.121] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.121] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.121] GetLastError () returned 0x578 [0149.121] CanUserWritePwrScheme () returned 0 [0149.122] GetSystemMetrics (nIndex=46) returned 2 [0149.122] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.122] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.122] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.122] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.133] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.133] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.133] GetLastError () returned 0x578 [0149.133] CanUserWritePwrScheme () returned 0 [0149.134] GetSystemMetrics (nIndex=46) returned 2 [0149.134] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.134] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.134] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.134] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.148] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.148] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.148] GetLastError () returned 0x578 [0149.148] CanUserWritePwrScheme () returned 0 [0149.149] GetSystemMetrics (nIndex=46) returned 2 [0149.149] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.149] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.149] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.149] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.160] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.160] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.160] GetLastError () returned 0x578 [0149.160] CanUserWritePwrScheme () returned 0 [0149.161] GetSystemMetrics (nIndex=46) returned 2 [0149.161] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.161] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.161] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.161] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.176] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.176] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.176] GetLastError () returned 0x578 [0149.176] CanUserWritePwrScheme () returned 0 [0149.177] GetSystemMetrics (nIndex=46) returned 2 [0149.177] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.177] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.177] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.177] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.188] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.188] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.188] GetLastError () returned 0x578 [0149.188] CanUserWritePwrScheme () returned 0 [0149.189] GetSystemMetrics (nIndex=46) returned 2 [0149.189] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.189] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.189] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.189] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.199] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.199] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.200] GetLastError () returned 0x578 [0149.200] CanUserWritePwrScheme () returned 0 [0149.200] GetSystemMetrics (nIndex=46) returned 2 [0149.200] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.200] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.201] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.201] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.214] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.214] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.214] GetLastError () returned 0x578 [0149.214] CanUserWritePwrScheme () returned 0 [0149.215] GetSystemMetrics (nIndex=46) returned 2 [0149.215] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.215] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.215] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.215] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.226] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.226] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.226] GetLastError () returned 0x578 [0149.226] CanUserWritePwrScheme () returned 0 [0149.227] GetSystemMetrics (nIndex=46) returned 2 [0149.227] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.227] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.227] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.227] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.238] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.238] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.238] GetLastError () returned 0x578 [0149.238] CanUserWritePwrScheme () returned 0 [0149.239] GetSystemMetrics (nIndex=46) returned 2 [0149.239] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.239] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.239] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.239] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.250] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.250] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.250] GetLastError () returned 0x578 [0149.250] CanUserWritePwrScheme () returned 0 [0149.251] GetSystemMetrics (nIndex=46) returned 2 [0149.251] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.251] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.251] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.251] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.262] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.262] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.262] GetLastError () returned 0x578 [0149.262] CanUserWritePwrScheme () returned 0 [0149.263] GetSystemMetrics (nIndex=46) returned 2 [0149.263] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.263] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.263] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.263] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.277] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.277] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.277] GetLastError () returned 0x578 [0149.277] CanUserWritePwrScheme () returned 0 [0149.278] GetSystemMetrics (nIndex=46) returned 2 [0149.278] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.278] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.278] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.278] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.289] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.289] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.289] GetLastError () returned 0x578 [0149.289] CanUserWritePwrScheme () returned 0 [0149.290] GetSystemMetrics (nIndex=46) returned 2 [0149.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.301] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.301] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.301] GetLastError () returned 0x578 [0149.301] CanUserWritePwrScheme () returned 0 [0149.302] GetSystemMetrics (nIndex=46) returned 2 [0149.302] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.302] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.302] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.302] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.313] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.313] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.313] GetLastError () returned 0x578 [0149.313] CanUserWritePwrScheme () returned 0 [0149.314] GetSystemMetrics (nIndex=46) returned 2 [0149.314] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.314] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.314] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.314] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.324] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.324] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.324] GetLastError () returned 0x578 [0149.324] CanUserWritePwrScheme () returned 0 [0149.325] GetSystemMetrics (nIndex=46) returned 2 [0149.325] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.325] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.325] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.325] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.336] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.336] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.336] GetLastError () returned 0x578 [0149.336] CanUserWritePwrScheme () returned 0 [0149.337] GetSystemMetrics (nIndex=46) returned 2 [0149.337] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.337] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.337] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.337] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.351] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.351] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.351] GetLastError () returned 0x578 [0149.351] CanUserWritePwrScheme () returned 0 [0149.352] GetSystemMetrics (nIndex=46) returned 2 [0149.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.352] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.352] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.352] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.363] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.363] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.363] GetLastError () returned 0x578 [0149.363] CanUserWritePwrScheme () returned 0 [0149.364] GetSystemMetrics (nIndex=46) returned 2 [0149.364] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.364] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.364] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.364] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.375] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.375] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.375] GetLastError () returned 0x578 [0149.375] CanUserWritePwrScheme () returned 0 [0149.376] GetSystemMetrics (nIndex=46) returned 2 [0149.376] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.376] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.376] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.376] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.387] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.387] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.387] GetLastError () returned 0x578 [0149.387] CanUserWritePwrScheme () returned 0 [0149.388] GetSystemMetrics (nIndex=46) returned 2 [0149.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.388] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.388] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.388] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.409] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.409] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.409] GetLastError () returned 0x578 [0149.409] CanUserWritePwrScheme () returned 0 [0149.410] GetSystemMetrics (nIndex=46) returned 2 [0149.410] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.410] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.410] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.410] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.421] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.421] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.421] GetLastError () returned 0x578 [0149.421] CanUserWritePwrScheme () returned 0 [0149.422] GetSystemMetrics (nIndex=46) returned 2 [0149.422] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.422] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.422] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.422] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.433] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.433] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.433] GetLastError () returned 0x578 [0149.433] CanUserWritePwrScheme () returned 0 [0149.434] GetSystemMetrics (nIndex=46) returned 2 [0149.434] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.434] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.434] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.434] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.445] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.445] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.445] GetLastError () returned 0x578 [0149.445] CanUserWritePwrScheme () returned 0 [0149.446] GetSystemMetrics (nIndex=46) returned 2 [0149.446] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.446] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.446] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.446] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.457] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.457] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.457] GetLastError () returned 0x578 [0149.457] CanUserWritePwrScheme () returned 0 [0149.458] GetSystemMetrics (nIndex=46) returned 2 [0149.458] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.458] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.458] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.458] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.471] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.471] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.472] GetLastError () returned 0x578 [0149.472] CanUserWritePwrScheme () returned 0 [0149.472] GetSystemMetrics (nIndex=46) returned 2 [0149.472] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.472] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.473] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.473] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.483] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.483] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.483] GetLastError () returned 0x578 [0149.483] CanUserWritePwrScheme () returned 0 [0149.484] GetSystemMetrics (nIndex=46) returned 2 [0149.484] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.484] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.484] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.484] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.495] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.495] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.495] GetLastError () returned 0x578 [0149.495] CanUserWritePwrScheme () returned 0 [0149.496] GetSystemMetrics (nIndex=46) returned 2 [0149.496] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.496] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.496] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.496] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.509] GetLastError () returned 0x578 [0149.509] CanUserWritePwrScheme () returned 0 [0149.510] GetSystemMetrics (nIndex=46) returned 2 [0149.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.510] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.510] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.510] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.521] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.521] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.521] GetLastError () returned 0x578 [0149.521] CanUserWritePwrScheme () returned 0 [0149.522] GetSystemMetrics (nIndex=46) returned 2 [0149.522] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.522] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.522] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.522] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.533] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.533] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.533] GetLastError () returned 0x578 [0149.533] CanUserWritePwrScheme () returned 0 [0149.536] GetSystemMetrics (nIndex=46) returned 2 [0149.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.547] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.547] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.547] GetLastError () returned 0x578 [0149.547] CanUserWritePwrScheme () returned 0 [0149.548] GetSystemMetrics (nIndex=46) returned 2 [0149.548] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.548] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.548] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.548] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.559] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.559] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.559] GetLastError () returned 0x578 [0149.559] CanUserWritePwrScheme () returned 0 [0149.560] GetSystemMetrics (nIndex=46) returned 2 [0149.560] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.560] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.560] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.560] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.571] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.571] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.571] GetLastError () returned 0x578 [0149.571] CanUserWritePwrScheme () returned 0 [0149.572] GetSystemMetrics (nIndex=46) returned 2 [0149.572] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.572] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.572] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.572] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.583] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.583] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.583] GetLastError () returned 0x578 [0149.583] CanUserWritePwrScheme () returned 0 [0149.584] GetSystemMetrics (nIndex=46) returned 2 [0149.584] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.584] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.584] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.584] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.595] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.595] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.595] GetLastError () returned 0x578 [0149.595] CanUserWritePwrScheme () returned 0 [0149.596] GetSystemMetrics (nIndex=46) returned 2 [0149.596] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.596] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.596] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.596] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.609] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.609] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.609] GetLastError () returned 0x578 [0149.609] CanUserWritePwrScheme () returned 0 [0149.610] GetSystemMetrics (nIndex=46) returned 2 [0149.610] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.610] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.610] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.610] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.621] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.621] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.621] GetLastError () returned 0x578 [0149.621] CanUserWritePwrScheme () returned 0 [0149.622] GetSystemMetrics (nIndex=46) returned 2 [0149.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.622] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.622] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.622] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.633] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.633] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.633] GetLastError () returned 0x578 [0149.633] CanUserWritePwrScheme () returned 0 [0149.634] GetSystemMetrics (nIndex=46) returned 2 [0149.634] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.634] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.634] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.634] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.646] GetLastError () returned 0x578 [0149.646] CanUserWritePwrScheme () returned 0 [0149.647] GetSystemMetrics (nIndex=46) returned 2 [0149.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.647] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.647] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.658] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.658] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.658] GetLastError () returned 0x578 [0149.658] CanUserWritePwrScheme () returned 0 [0149.659] GetSystemMetrics (nIndex=46) returned 2 [0149.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.659] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.659] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.659] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.672] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.672] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.672] GetLastError () returned 0x578 [0149.672] CanUserWritePwrScheme () returned 0 [0149.673] GetSystemMetrics (nIndex=46) returned 2 [0149.673] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.673] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.673] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.673] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.684] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.684] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.684] GetLastError () returned 0x578 [0149.684] CanUserWritePwrScheme () returned 0 [0149.685] GetSystemMetrics (nIndex=46) returned 2 [0149.685] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.685] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.685] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.685] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.695] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.695] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.696] GetLastError () returned 0x578 [0149.696] CanUserWritePwrScheme () returned 0 [0149.696] GetSystemMetrics (nIndex=46) returned 2 [0149.696] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.696] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.696] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.697] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.707] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.707] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.707] GetLastError () returned 0x578 [0149.707] CanUserWritePwrScheme () returned 0 [0149.708] GetSystemMetrics (nIndex=46) returned 2 [0149.708] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.708] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.708] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.708] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.719] GetLastError () returned 0x578 [0149.719] CanUserWritePwrScheme () returned 0 [0149.720] GetSystemMetrics (nIndex=46) returned 2 [0149.720] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.720] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.720] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.720] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.733] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.733] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.733] GetLastError () returned 0x578 [0149.733] CanUserWritePwrScheme () returned 0 [0149.734] GetSystemMetrics (nIndex=46) returned 2 [0149.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.734] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.734] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.734] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.745] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.745] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.745] GetLastError () returned 0x578 [0149.745] CanUserWritePwrScheme () returned 0 [0149.746] GetSystemMetrics (nIndex=46) returned 2 [0149.746] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.746] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.746] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.746] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.757] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.757] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.757] GetLastError () returned 0x578 [0149.757] CanUserWritePwrScheme () returned 0 [0149.758] GetSystemMetrics (nIndex=46) returned 2 [0149.758] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.758] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.758] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.758] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.769] GetLastError () returned 0x578 [0149.769] CanUserWritePwrScheme () returned 0 [0149.770] GetSystemMetrics (nIndex=46) returned 2 [0149.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.781] GetLastError () returned 0x578 [0149.781] CanUserWritePwrScheme () returned 0 [0149.782] GetSystemMetrics (nIndex=46) returned 2 [0149.782] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.782] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.782] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.782] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.796] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.796] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.796] GetLastError () returned 0x578 [0149.796] CanUserWritePwrScheme () returned 0 [0149.797] GetSystemMetrics (nIndex=46) returned 2 [0149.797] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.797] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.797] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.797] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.808] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.808] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.808] GetLastError () returned 0x578 [0149.808] CanUserWritePwrScheme () returned 0 [0149.809] GetSystemMetrics (nIndex=46) returned 2 [0149.809] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.809] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.809] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.809] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.820] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.820] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.820] GetLastError () returned 0x578 [0149.820] CanUserWritePwrScheme () returned 0 [0149.821] GetSystemMetrics (nIndex=46) returned 2 [0149.821] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.821] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.821] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.821] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.832] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.832] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.832] GetLastError () returned 0x578 [0149.832] CanUserWritePwrScheme () returned 0 [0149.833] GetSystemMetrics (nIndex=46) returned 2 [0149.833] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.833] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.833] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.833] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.843] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.843] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.843] GetLastError () returned 0x578 [0149.843] CanUserWritePwrScheme () returned 0 [0149.844] GetSystemMetrics (nIndex=46) returned 2 [0149.844] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.844] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.844] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.844] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.855] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.855] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.855] GetLastError () returned 0x578 [0149.855] CanUserWritePwrScheme () returned 0 [0149.856] GetSystemMetrics (nIndex=46) returned 2 [0149.856] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.856] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.856] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.870] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.870] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.870] GetLastError () returned 0x578 [0149.870] CanUserWritePwrScheme () returned 0 [0149.871] GetSystemMetrics (nIndex=46) returned 2 [0149.871] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.871] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.871] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.871] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.882] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.882] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.882] GetLastError () returned 0x578 [0149.882] CanUserWritePwrScheme () returned 0 [0149.883] GetSystemMetrics (nIndex=46) returned 2 [0149.883] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.883] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.883] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.883] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.894] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.894] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.894] GetLastError () returned 0x578 [0149.894] CanUserWritePwrScheme () returned 0 [0149.895] GetSystemMetrics (nIndex=46) returned 2 [0149.895] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.895] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.895] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.895] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.906] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.906] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.906] GetLastError () returned 0x578 [0149.906] CanUserWritePwrScheme () returned 0 [0149.907] GetSystemMetrics (nIndex=46) returned 2 [0149.907] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.907] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.907] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.907] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.917] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.917] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.917] GetLastError () returned 0x578 [0149.917] CanUserWritePwrScheme () returned 0 [0149.918] GetSystemMetrics (nIndex=46) returned 2 [0149.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.918] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.918] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.918] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.932] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.932] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.932] GetLastError () returned 0x578 [0149.933] CanUserWritePwrScheme () returned 0 [0149.933] GetSystemMetrics (nIndex=46) returned 2 [0149.933] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.933] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.933] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.933] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.944] GetLastError () returned 0x578 [0149.944] CanUserWritePwrScheme () returned 0 [0149.945] GetSystemMetrics (nIndex=46) returned 2 [0149.945] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.945] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.945] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.945] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.956] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.956] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.956] GetLastError () returned 0x578 [0149.956] CanUserWritePwrScheme () returned 0 [0149.957] GetSystemMetrics (nIndex=46) returned 2 [0149.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.957] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.957] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.957] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.968] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.968] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.968] GetLastError () returned 0x578 [0149.968] CanUserWritePwrScheme () returned 0 [0149.969] GetSystemMetrics (nIndex=46) returned 2 [0149.969] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.969] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.969] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.969] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.979] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.979] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.980] GetLastError () returned 0x578 [0149.980] CanUserWritePwrScheme () returned 0 [0149.980] GetSystemMetrics (nIndex=46) returned 2 [0149.980] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.980] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.980] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.981] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.994] GetLastError () returned 0x578 [0149.994] CanUserWritePwrScheme () returned 0 [0149.995] GetSystemMetrics (nIndex=46) returned 2 [0149.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.054] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.054] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.054] GetLastError () returned 0x578 [0150.054] CanUserWritePwrScheme () returned 0 [0150.057] GetSystemMetrics (nIndex=46) returned 2 [0150.057] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.057] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.058] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.058] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.068] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.068] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.068] GetLastError () returned 0x578 [0150.068] CanUserWritePwrScheme () returned 0 [0150.069] GetSystemMetrics (nIndex=46) returned 2 [0150.069] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.069] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.069] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.069] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.080] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.080] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.080] GetLastError () returned 0x578 [0150.080] CanUserWritePwrScheme () returned 0 [0150.081] GetSystemMetrics (nIndex=46) returned 2 [0150.081] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.081] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.081] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.081] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.092] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.092] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.092] GetLastError () returned 0x578 [0150.092] CanUserWritePwrScheme () returned 0 [0150.093] GetSystemMetrics (nIndex=46) returned 2 [0150.093] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.093] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.093] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.093] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.104] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.104] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.104] GetLastError () returned 0x578 [0150.104] CanUserWritePwrScheme () returned 0 [0150.105] GetSystemMetrics (nIndex=46) returned 2 [0150.105] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.105] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.105] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.105] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.116] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.116] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.116] GetLastError () returned 0x578 [0150.116] CanUserWritePwrScheme () returned 0 [0150.117] GetSystemMetrics (nIndex=46) returned 2 [0150.117] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.117] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.117] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.117] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.131] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.131] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.131] GetLastError () returned 0x578 [0150.131] CanUserWritePwrScheme () returned 0 [0150.132] GetSystemMetrics (nIndex=46) returned 2 [0150.132] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.132] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.132] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.132] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.145] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.145] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.145] GetLastError () returned 0x578 [0150.145] CanUserWritePwrScheme () returned 0 [0150.146] GetSystemMetrics (nIndex=46) returned 2 [0150.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.146] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.146] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.146] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.157] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.157] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.157] GetLastError () returned 0x578 [0150.157] CanUserWritePwrScheme () returned 0 [0150.158] GetSystemMetrics (nIndex=46) returned 2 [0150.158] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.158] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.158] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.158] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.168] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.168] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.169] GetLastError () returned 0x578 [0150.169] CanUserWritePwrScheme () returned 0 [0150.169] GetSystemMetrics (nIndex=46) returned 2 [0150.169] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.169] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.169] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.170] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.180] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.180] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.180] GetLastError () returned 0x578 [0150.181] CanUserWritePwrScheme () returned 0 [0150.181] GetSystemMetrics (nIndex=46) returned 2 [0150.181] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.181] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.181] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.181] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.195] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.195] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.195] GetLastError () returned 0x578 [0150.195] CanUserWritePwrScheme () returned 0 [0150.196] GetSystemMetrics (nIndex=46) returned 2 [0150.196] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.196] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.196] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.196] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.207] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.207] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.207] GetLastError () returned 0x578 [0150.207] CanUserWritePwrScheme () returned 0 [0150.208] GetSystemMetrics (nIndex=46) returned 2 [0150.208] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.208] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.208] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.208] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.219] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.219] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.219] GetLastError () returned 0x578 [0150.219] CanUserWritePwrScheme () returned 0 [0150.220] GetSystemMetrics (nIndex=46) returned 2 [0150.220] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.220] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.220] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.220] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.231] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.231] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.231] GetLastError () returned 0x578 [0150.231] CanUserWritePwrScheme () returned 0 [0150.232] GetSystemMetrics (nIndex=46) returned 2 [0150.232] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.232] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.232] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.232] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.243] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.243] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.243] GetLastError () returned 0x578 [0150.243] CanUserWritePwrScheme () returned 0 [0150.244] GetSystemMetrics (nIndex=46) returned 2 [0150.244] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.244] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.244] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.244] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.258] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.258] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.258] GetLastError () returned 0x578 [0150.258] CanUserWritePwrScheme () returned 0 [0150.259] GetSystemMetrics (nIndex=46) returned 2 [0150.259] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.259] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.259] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.259] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.270] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.270] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.270] GetLastError () returned 0x578 [0150.270] CanUserWritePwrScheme () returned 0 [0150.271] GetSystemMetrics (nIndex=46) returned 2 [0150.271] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.271] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.271] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.271] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.331] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.331] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.331] GetLastError () returned 0x578 [0150.331] CanUserWritePwrScheme () returned 0 [0150.332] GetSystemMetrics (nIndex=46) returned 2 [0150.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.343] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.343] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.343] GetLastError () returned 0x578 [0150.343] CanUserWritePwrScheme () returned 0 [0150.344] GetSystemMetrics (nIndex=46) returned 2 [0150.344] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.344] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.344] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.344] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.355] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.355] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.355] GetLastError () returned 0x578 [0150.355] CanUserWritePwrScheme () returned 0 [0150.356] GetSystemMetrics (nIndex=46) returned 2 [0150.356] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.356] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.356] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.356] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.367] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.367] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.367] GetLastError () returned 0x578 [0150.367] CanUserWritePwrScheme () returned 0 [0150.368] GetSystemMetrics (nIndex=46) returned 2 [0150.368] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.368] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.368] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.368] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.379] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.379] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.379] GetLastError () returned 0x578 [0150.379] CanUserWritePwrScheme () returned 0 [0150.382] GetSystemMetrics (nIndex=46) returned 2 [0150.382] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.382] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.382] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.382] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.394] GetLastError () returned 0x578 [0150.394] CanUserWritePwrScheme () returned 0 [0150.394] GetSystemMetrics (nIndex=46) returned 2 [0150.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.395] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.395] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.395] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.413] GetLastError () returned 0x578 [0150.413] CanUserWritePwrScheme () returned 0 [0150.414] GetSystemMetrics (nIndex=46) returned 2 [0150.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.414] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.414] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.414] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.425] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.425] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.425] GetLastError () returned 0x578 [0150.425] CanUserWritePwrScheme () returned 0 [0150.426] GetSystemMetrics (nIndex=46) returned 2 [0150.426] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.426] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.426] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.426] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.437] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.437] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.437] GetLastError () returned 0x578 [0150.437] CanUserWritePwrScheme () returned 0 [0150.438] GetSystemMetrics (nIndex=46) returned 2 [0150.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.438] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.452] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.452] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.452] GetLastError () returned 0x578 [0150.452] CanUserWritePwrScheme () returned 0 [0150.453] GetSystemMetrics (nIndex=46) returned 2 [0150.453] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.453] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.453] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.453] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.464] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.464] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.464] GetLastError () returned 0x578 [0150.464] CanUserWritePwrScheme () returned 0 [0150.465] GetSystemMetrics (nIndex=46) returned 2 [0150.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.465] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.465] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.476] GetLastError () returned 0x578 [0150.476] CanUserWritePwrScheme () returned 0 [0150.477] GetSystemMetrics (nIndex=46) returned 2 [0150.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.488] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.488] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.488] GetLastError () returned 0x578 [0150.488] CanUserWritePwrScheme () returned 0 [0150.489] GetSystemMetrics (nIndex=46) returned 2 [0150.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.489] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.489] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.489] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.500] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.500] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.500] GetLastError () returned 0x578 [0150.500] CanUserWritePwrScheme () returned 0 [0150.501] GetSystemMetrics (nIndex=46) returned 2 [0150.501] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.501] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.501] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.501] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.515] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.515] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.515] GetLastError () returned 0x578 [0150.515] CanUserWritePwrScheme () returned 0 [0150.516] GetSystemMetrics (nIndex=46) returned 2 [0150.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.527] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.527] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.527] GetLastError () returned 0x578 [0150.527] CanUserWritePwrScheme () returned 0 [0150.528] GetSystemMetrics (nIndex=46) returned 2 [0150.528] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.528] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.528] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.528] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.539] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.539] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.539] GetLastError () returned 0x578 [0150.539] CanUserWritePwrScheme () returned 0 [0150.540] GetSystemMetrics (nIndex=46) returned 2 [0150.540] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.540] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.540] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.540] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.551] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.551] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.551] GetLastError () returned 0x578 [0150.551] CanUserWritePwrScheme () returned 0 [0150.552] GetSystemMetrics (nIndex=46) returned 2 [0150.552] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.552] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.552] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.552] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.563] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.563] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.563] GetLastError () returned 0x578 [0150.563] CanUserWritePwrScheme () returned 0 [0150.564] GetSystemMetrics (nIndex=46) returned 2 [0150.564] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.564] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.564] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.564] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.578] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.578] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.578] GetLastError () returned 0x578 [0150.578] CanUserWritePwrScheme () returned 0 [0150.579] GetSystemMetrics (nIndex=46) returned 2 [0150.579] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.579] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.579] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.579] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.590] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.590] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.590] GetLastError () returned 0x578 [0150.590] CanUserWritePwrScheme () returned 0 [0150.591] GetSystemMetrics (nIndex=46) returned 2 [0150.591] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.591] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.591] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.591] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.602] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.602] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.602] GetLastError () returned 0x578 [0150.602] CanUserWritePwrScheme () returned 0 [0150.603] GetSystemMetrics (nIndex=46) returned 2 [0150.603] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.603] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.603] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.603] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.614] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.614] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.614] GetLastError () returned 0x578 [0150.614] CanUserWritePwrScheme () returned 0 [0150.615] GetSystemMetrics (nIndex=46) returned 2 [0150.615] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.615] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.615] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.615] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.626] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.626] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.626] GetLastError () returned 0x578 [0150.626] CanUserWritePwrScheme () returned 0 [0150.627] GetSystemMetrics (nIndex=46) returned 2 [0150.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.627] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.627] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.627] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.639] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.639] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.639] GetLastError () returned 0x578 [0150.639] CanUserWritePwrScheme () returned 0 [0150.642] GetSystemMetrics (nIndex=46) returned 2 [0150.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.642] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.642] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.642] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.653] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.653] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.653] GetLastError () returned 0x578 [0150.653] CanUserWritePwrScheme () returned 0 [0150.654] GetSystemMetrics (nIndex=46) returned 2 [0150.654] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.654] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.654] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.654] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.665] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.665] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.665] GetLastError () returned 0x578 [0150.665] CanUserWritePwrScheme () returned 0 [0150.666] GetSystemMetrics (nIndex=46) returned 2 [0150.666] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.666] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.666] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.666] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.677] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.677] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.677] GetLastError () returned 0x578 [0150.677] CanUserWritePwrScheme () returned 0 [0150.678] GetSystemMetrics (nIndex=46) returned 2 [0150.678] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.678] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.678] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.678] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.689] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.689] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.689] GetLastError () returned 0x578 [0150.689] CanUserWritePwrScheme () returned 0 [0150.690] GetSystemMetrics (nIndex=46) returned 2 [0150.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.690] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.690] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.690] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.701] GetLastError () returned 0x578 [0150.701] CanUserWritePwrScheme () returned 0 [0150.702] GetSystemMetrics (nIndex=46) returned 2 [0150.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.715] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.715] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.715] GetLastError () returned 0x578 [0150.715] CanUserWritePwrScheme () returned 0 [0150.716] GetSystemMetrics (nIndex=46) returned 2 [0150.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.716] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.716] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.716] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.727] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.727] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.727] GetLastError () returned 0x578 [0150.727] CanUserWritePwrScheme () returned 0 [0150.728] GetSystemMetrics (nIndex=46) returned 2 [0150.728] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.728] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.728] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.728] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.739] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.739] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.739] GetLastError () returned 0x578 [0150.739] CanUserWritePwrScheme () returned 0 [0150.740] GetSystemMetrics (nIndex=46) returned 2 [0150.740] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.740] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.740] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.740] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.751] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.751] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.751] GetLastError () returned 0x578 [0150.751] CanUserWritePwrScheme () returned 0 [0150.752] GetSystemMetrics (nIndex=46) returned 2 [0150.752] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.752] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.752] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.752] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.763] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.763] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.763] GetLastError () returned 0x578 [0150.763] CanUserWritePwrScheme () returned 0 [0150.764] GetSystemMetrics (nIndex=46) returned 2 [0150.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.764] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.764] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.764] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.777] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.777] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.777] GetLastError () returned 0x578 [0150.777] CanUserWritePwrScheme () returned 0 [0150.778] GetSystemMetrics (nIndex=46) returned 2 [0150.778] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.778] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.778] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.778] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.789] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.789] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.789] GetLastError () returned 0x578 [0150.789] CanUserWritePwrScheme () returned 0 [0150.790] GetSystemMetrics (nIndex=46) returned 2 [0150.790] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.790] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.790] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.790] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.801] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.801] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.802] GetLastError () returned 0x578 [0150.802] CanUserWritePwrScheme () returned 0 [0150.802] GetSystemMetrics (nIndex=46) returned 2 [0150.802] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.802] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.803] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.803] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.813] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.813] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.813] GetLastError () returned 0x578 [0150.813] CanUserWritePwrScheme () returned 0 [0150.814] GetSystemMetrics (nIndex=46) returned 2 [0150.814] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.814] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.814] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.814] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.825] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.825] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.825] GetLastError () returned 0x578 [0150.825] CanUserWritePwrScheme () returned 0 [0150.826] GetSystemMetrics (nIndex=46) returned 2 [0150.826] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.826] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.826] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.826] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.839] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.839] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.839] GetLastError () returned 0x578 [0150.839] CanUserWritePwrScheme () returned 0 [0150.840] GetSystemMetrics (nIndex=46) returned 2 [0150.840] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.840] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.841] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.841] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.852] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.853] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.853] GetLastError () returned 0x578 [0150.853] CanUserWritePwrScheme () returned 0 [0150.853] GetSystemMetrics (nIndex=46) returned 2 [0150.854] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.854] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.854] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.854] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.864] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.864] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.864] GetLastError () returned 0x578 [0150.864] CanUserWritePwrScheme () returned 0 [0150.865] GetSystemMetrics (nIndex=46) returned 2 [0150.865] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.865] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.865] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.865] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.876] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.876] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.876] GetLastError () returned 0x578 [0150.876] CanUserWritePwrScheme () returned 0 [0150.877] GetSystemMetrics (nIndex=46) returned 2 [0150.877] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.877] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.877] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.877] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.888] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.888] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.888] GetLastError () returned 0x578 [0150.888] CanUserWritePwrScheme () returned 0 [0150.889] GetSystemMetrics (nIndex=46) returned 2 [0150.889] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.889] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.889] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.889] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.900] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.900] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.900] GetLastError () returned 0x578 [0150.900] CanUserWritePwrScheme () returned 0 [0150.903] GetSystemMetrics (nIndex=46) returned 2 [0150.903] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.904] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.904] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.904] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.914] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.914] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.914] GetLastError () returned 0x578 [0150.915] CanUserWritePwrScheme () returned 0 [0150.915] GetSystemMetrics (nIndex=46) returned 2 [0150.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.915] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.915] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.915] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.926] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.926] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.926] GetLastError () returned 0x578 [0150.926] CanUserWritePwrScheme () returned 0 [0150.927] GetSystemMetrics (nIndex=46) returned 2 [0150.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.927] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.927] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.927] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.938] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.938] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.939] GetLastError () returned 0x578 [0150.939] CanUserWritePwrScheme () returned 0 [0150.939] GetSystemMetrics (nIndex=46) returned 2 [0150.939] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.939] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.940] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.940] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.950] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.950] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.950] GetLastError () returned 0x578 [0150.950] CanUserWritePwrScheme () returned 0 [0150.951] GetSystemMetrics (nIndex=46) returned 2 [0150.951] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.951] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.951] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.951] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.962] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.962] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.962] GetLastError () returned 0x578 [0150.962] CanUserWritePwrScheme () returned 0 [0150.963] GetSystemMetrics (nIndex=46) returned 2 [0150.963] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.963] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.963] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.963] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.977] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.977] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.977] GetLastError () returned 0x578 [0150.977] CanUserWritePwrScheme () returned 0 [0150.978] GetSystemMetrics (nIndex=46) returned 2 [0150.978] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.978] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.978] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.978] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.988] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.988] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.988] GetLastError () returned 0x578 [0150.988] CanUserWritePwrScheme () returned 0 [0150.989] GetSystemMetrics (nIndex=46) returned 2 [0150.989] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.989] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.989] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.989] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.000] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.000] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.000] GetLastError () returned 0x578 [0151.000] CanUserWritePwrScheme () returned 0 [0151.001] GetSystemMetrics (nIndex=46) returned 2 [0151.001] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.001] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.001] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.001] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.012] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.012] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.012] GetLastError () returned 0x578 [0151.012] CanUserWritePwrScheme () returned 0 [0151.013] GetSystemMetrics (nIndex=46) returned 2 [0151.013] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.013] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.013] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.013] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.024] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.024] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.024] GetLastError () returned 0x578 [0151.024] CanUserWritePwrScheme () returned 0 [0151.025] GetSystemMetrics (nIndex=46) returned 2 [0151.025] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.025] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.025] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.025] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.038] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.038] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.038] GetLastError () returned 0x578 [0151.038] CanUserWritePwrScheme () returned 0 [0151.039] GetSystemMetrics (nIndex=46) returned 2 [0151.039] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.039] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.039] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.039] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.050] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.050] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.050] GetLastError () returned 0x578 [0151.050] CanUserWritePwrScheme () returned 0 [0151.051] GetSystemMetrics (nIndex=46) returned 2 [0151.051] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.051] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.051] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.051] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.062] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.062] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.062] GetLastError () returned 0x578 [0151.062] CanUserWritePwrScheme () returned 0 [0151.063] GetSystemMetrics (nIndex=46) returned 2 [0151.063] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.063] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.063] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.063] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.073] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.073] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.073] GetLastError () returned 0x578 [0151.073] CanUserWritePwrScheme () returned 0 [0151.074] GetSystemMetrics (nIndex=46) returned 2 [0151.074] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.074] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.074] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.074] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.110] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.110] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.110] GetLastError () returned 0x578 [0151.110] CanUserWritePwrScheme () returned 0 [0151.111] GetSystemMetrics (nIndex=46) returned 2 [0151.111] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.111] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.111] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.111] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.123] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.123] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.123] GetLastError () returned 0x578 [0151.123] CanUserWritePwrScheme () returned 0 [0151.124] GetSystemMetrics (nIndex=46) returned 2 [0151.124] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.124] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.124] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.124] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.135] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.135] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.135] GetLastError () returned 0x578 [0151.135] CanUserWritePwrScheme () returned 0 [0151.136] GetSystemMetrics (nIndex=46) returned 2 [0151.136] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.136] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.136] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.136] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.148] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.148] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.148] GetLastError () returned 0x578 [0151.148] CanUserWritePwrScheme () returned 0 [0151.149] GetSystemMetrics (nIndex=46) returned 2 [0151.149] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.149] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.149] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.149] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.160] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.160] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.160] GetLastError () returned 0x578 [0151.160] CanUserWritePwrScheme () returned 0 [0151.163] GetSystemMetrics (nIndex=46) returned 2 [0151.163] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.163] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.163] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.163] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.174] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.174] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.174] GetLastError () returned 0x578 [0151.174] CanUserWritePwrScheme () returned 0 [0151.175] GetSystemMetrics (nIndex=46) returned 2 [0151.175] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.175] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.175] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.175] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.186] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.186] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.186] GetLastError () returned 0x578 [0151.186] CanUserWritePwrScheme () returned 0 [0151.187] GetSystemMetrics (nIndex=46) returned 2 [0151.187] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.187] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.187] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.187] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.197] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.197] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.198] GetLastError () returned 0x578 [0151.198] CanUserWritePwrScheme () returned 0 [0151.198] GetSystemMetrics (nIndex=46) returned 2 [0151.198] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.199] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.199] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.199] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.210] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.210] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.210] GetLastError () returned 0x578 [0151.210] CanUserWritePwrScheme () returned 0 [0151.211] GetSystemMetrics (nIndex=46) returned 2 [0151.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.211] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.211] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.211] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.222] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.222] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.222] GetLastError () returned 0x578 [0151.222] CanUserWritePwrScheme () returned 0 [0151.223] GetSystemMetrics (nIndex=46) returned 2 [0151.223] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.223] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.223] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.223] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.273] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.273] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.273] GetLastError () returned 0x578 [0151.273] CanUserWritePwrScheme () returned 0 [0151.274] GetSystemMetrics (nIndex=46) returned 2 [0151.274] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.274] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.274] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.274] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.284] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.285] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.285] GetLastError () returned 0x578 [0151.285] CanUserWritePwrScheme () returned 0 [0151.285] GetSystemMetrics (nIndex=46) returned 2 [0151.285] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.286] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.286] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.286] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.299] GetLastError () returned 0x578 [0151.299] CanUserWritePwrScheme () returned 0 [0151.300] GetSystemMetrics (nIndex=46) returned 2 [0151.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.311] GetLastError () returned 0x578 [0151.311] CanUserWritePwrScheme () returned 0 [0151.312] GetSystemMetrics (nIndex=46) returned 2 [0151.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.322] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.322] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.323] GetLastError () returned 0x578 [0151.323] CanUserWritePwrScheme () returned 0 [0151.323] GetSystemMetrics (nIndex=46) returned 2 [0151.323] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.323] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.323] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.324] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.334] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.334] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.334] GetLastError () returned 0x578 [0151.334] CanUserWritePwrScheme () returned 0 [0151.335] GetSystemMetrics (nIndex=46) returned 2 [0151.335] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.335] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.335] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.335] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.346] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.346] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.346] GetLastError () returned 0x578 [0151.346] CanUserWritePwrScheme () returned 0 [0151.347] GetSystemMetrics (nIndex=46) returned 2 [0151.347] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.347] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.347] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.347] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.360] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.360] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.361] GetLastError () returned 0x578 [0151.361] CanUserWritePwrScheme () returned 0 [0151.361] GetSystemMetrics (nIndex=46) returned 2 [0151.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.361] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.362] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.362] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.372] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.372] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.372] GetLastError () returned 0x578 [0151.372] CanUserWritePwrScheme () returned 0 [0151.373] GetSystemMetrics (nIndex=46) returned 2 [0151.373] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.373] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.373] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.373] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.384] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.384] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.384] GetLastError () returned 0x578 [0151.384] CanUserWritePwrScheme () returned 0 [0151.385] GetSystemMetrics (nIndex=46) returned 2 [0151.385] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.385] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.385] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.385] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.404] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.404] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.404] GetLastError () returned 0x578 [0151.404] CanUserWritePwrScheme () returned 0 [0151.405] GetSystemMetrics (nIndex=46) returned 2 [0151.405] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.405] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.405] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.405] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.416] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.416] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.416] GetLastError () returned 0x578 [0151.416] CanUserWritePwrScheme () returned 0 [0151.417] GetSystemMetrics (nIndex=46) returned 2 [0151.417] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.417] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.417] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.417] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.431] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.431] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.431] GetLastError () returned 0x578 [0151.431] CanUserWritePwrScheme () returned 0 [0151.432] GetSystemMetrics (nIndex=46) returned 2 [0151.432] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.432] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.432] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.432] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.443] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.443] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.443] GetLastError () returned 0x578 [0151.443] CanUserWritePwrScheme () returned 0 [0151.444] GetSystemMetrics (nIndex=46) returned 2 [0151.444] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.444] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.444] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.444] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.454] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.454] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.455] GetLastError () returned 0x578 [0151.455] CanUserWritePwrScheme () returned 0 [0151.455] GetSystemMetrics (nIndex=46) returned 2 [0151.455] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.455] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.456] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.456] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.466] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.466] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.466] GetLastError () returned 0x578 [0151.466] CanUserWritePwrScheme () returned 0 [0151.467] GetSystemMetrics (nIndex=46) returned 2 [0151.467] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.467] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.467] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.467] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.478] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.478] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.478] GetLastError () returned 0x578 [0151.478] CanUserWritePwrScheme () returned 0 [0151.479] GetSystemMetrics (nIndex=46) returned 2 [0151.479] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.479] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.479] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.479] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.503] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.503] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.504] GetLastError () returned 0x578 [0151.504] CanUserWritePwrScheme () returned 0 [0151.504] GetSystemMetrics (nIndex=46) returned 2 [0151.504] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.504] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.505] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.505] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.515] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.515] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.515] GetLastError () returned 0x578 [0151.515] CanUserWritePwrScheme () returned 0 [0151.516] GetSystemMetrics (nIndex=46) returned 2 [0151.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.527] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.527] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.527] GetLastError () returned 0x578 [0151.527] CanUserWritePwrScheme () returned 0 [0151.528] GetSystemMetrics (nIndex=46) returned 2 [0151.528] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.528] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.528] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.528] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.539] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.539] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.539] GetLastError () returned 0x578 [0151.539] CanUserWritePwrScheme () returned 0 [0151.540] GetSystemMetrics (nIndex=46) returned 2 [0151.540] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.540] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.540] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.540] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.550] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.550] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.550] GetLastError () returned 0x578 [0151.551] CanUserWritePwrScheme () returned 0 [0151.554] GetSystemMetrics (nIndex=46) returned 2 [0151.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.554] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.554] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.554] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.565] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.565] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.565] GetLastError () returned 0x578 [0151.565] CanUserWritePwrScheme () returned 0 [0151.566] GetSystemMetrics (nIndex=46) returned 2 [0151.566] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.566] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.566] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.566] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.576] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.576] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.576] GetLastError () returned 0x578 [0151.577] CanUserWritePwrScheme () returned 0 [0151.577] GetSystemMetrics (nIndex=46) returned 2 [0151.577] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.577] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.577] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.577] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.588] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.588] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.588] GetLastError () returned 0x578 [0151.588] CanUserWritePwrScheme () returned 0 [0151.589] GetSystemMetrics (nIndex=46) returned 2 [0151.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.600] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.600] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.600] GetLastError () returned 0x578 [0151.600] CanUserWritePwrScheme () returned 0 [0151.601] GetSystemMetrics (nIndex=46) returned 2 [0151.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.612] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.612] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.612] GetLastError () returned 0x578 [0151.612] CanUserWritePwrScheme () returned 0 [0151.613] GetSystemMetrics (nIndex=46) returned 2 [0151.613] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.613] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.613] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.613] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.626] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.627] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.627] GetLastError () returned 0x578 [0151.627] CanUserWritePwrScheme () returned 0 [0151.627] GetSystemMetrics (nIndex=46) returned 2 [0151.628] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.628] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.628] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.628] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.640] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.640] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.640] GetLastError () returned 0x578 [0151.640] CanUserWritePwrScheme () returned 0 [0151.641] GetSystemMetrics (nIndex=46) returned 2 [0151.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.641] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.641] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.641] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.652] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.652] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.652] GetLastError () returned 0x578 [0151.652] CanUserWritePwrScheme () returned 0 [0151.653] GetSystemMetrics (nIndex=46) returned 2 [0151.653] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.653] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.653] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.653] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.664] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.664] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.664] GetLastError () returned 0x578 [0151.664] CanUserWritePwrScheme () returned 0 [0151.665] GetSystemMetrics (nIndex=46) returned 2 [0151.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.665] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.665] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.665] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.675] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.675] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.675] GetLastError () returned 0x578 [0151.675] CanUserWritePwrScheme () returned 0 [0151.676] GetSystemMetrics (nIndex=46) returned 2 [0151.676] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.676] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.676] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.676] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.690] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.690] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.690] GetLastError () returned 0x578 [0151.690] CanUserWritePwrScheme () returned 0 [0151.691] GetSystemMetrics (nIndex=46) returned 2 [0151.691] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.691] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.691] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.691] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.702] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.702] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.702] GetLastError () returned 0x578 [0151.702] CanUserWritePwrScheme () returned 0 [0151.702] GetSystemMetrics (nIndex=46) returned 2 [0151.703] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.703] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.703] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.703] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.713] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.713] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.713] GetLastError () returned 0x578 [0151.713] CanUserWritePwrScheme () returned 0 [0151.714] GetSystemMetrics (nIndex=46) returned 2 [0151.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.714] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.714] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.715] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.726] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.726] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.726] GetLastError () returned 0x578 [0151.726] CanUserWritePwrScheme () returned 0 [0151.727] GetSystemMetrics (nIndex=46) returned 2 [0151.727] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.727] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.727] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.727] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.734] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.734] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.734] GetLastError () returned 0x578 [0151.734] CanUserWritePwrScheme () returned 0 [0151.735] GetSystemMetrics (nIndex=46) returned 2 [0151.735] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.735] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.735] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.735] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.740] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.740] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.740] GetLastError () returned 0x578 [0151.740] CanUserWritePwrScheme () returned 0 [0151.741] GetSystemMetrics (nIndex=46) returned 2 [0151.741] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.741] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.741] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.741] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.748] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.748] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.748] GetLastError () returned 0x578 [0151.748] CanUserWritePwrScheme () returned 0 [0151.749] GetSystemMetrics (nIndex=46) returned 2 [0151.749] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.749] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.749] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.749] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.754] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.754] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.754] GetLastError () returned 0x578 [0151.754] CanUserWritePwrScheme () returned 0 [0151.755] GetSystemMetrics (nIndex=46) returned 2 [0151.755] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.755] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.755] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.755] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.760] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.760] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.760] GetLastError () returned 0x578 [0151.760] CanUserWritePwrScheme () returned 0 [0151.761] GetSystemMetrics (nIndex=46) returned 2 [0151.761] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.761] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.761] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.761] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.766] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.766] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.766] GetLastError () returned 0x578 [0151.766] CanUserWritePwrScheme () returned 0 [0151.767] GetSystemMetrics (nIndex=46) returned 2 [0151.767] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.767] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.767] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.767] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.772] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.772] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.772] GetLastError () returned 0x578 [0151.772] CanUserWritePwrScheme () returned 0 [0151.773] GetSystemMetrics (nIndex=46) returned 2 [0151.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.773] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.773] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.778] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.778] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.778] GetLastError () returned 0x578 [0151.778] CanUserWritePwrScheme () returned 0 [0151.779] GetSystemMetrics (nIndex=46) returned 2 [0151.779] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.779] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.779] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.779] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.784] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.784] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.784] GetLastError () returned 0x578 [0151.784] CanUserWritePwrScheme () returned 0 [0151.785] GetSystemMetrics (nIndex=46) returned 2 [0151.785] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.785] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.785] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.785] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.790] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.790] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.790] GetLastError () returned 0x578 [0151.790] CanUserWritePwrScheme () returned 0 [0151.791] GetSystemMetrics (nIndex=46) returned 2 [0151.791] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.791] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.791] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.791] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.795] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.795] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.795] GetLastError () returned 0x578 [0151.796] CanUserWritePwrScheme () returned 0 [0151.796] GetSystemMetrics (nIndex=46) returned 2 [0151.796] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.796] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.796] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.796] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.801] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.801] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.801] GetLastError () returned 0x578 [0151.801] CanUserWritePwrScheme () returned 0 [0151.802] GetSystemMetrics (nIndex=46) returned 2 [0151.802] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.802] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.802] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.802] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.814] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.814] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.814] GetLastError () returned 0x578 [0151.814] CanUserWritePwrScheme () returned 0 [0151.815] GetSystemMetrics (nIndex=46) returned 2 [0151.815] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.815] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.815] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.815] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.826] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.826] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.826] GetLastError () returned 0x578 [0151.826] CanUserWritePwrScheme () returned 0 [0151.827] GetSystemMetrics (nIndex=46) returned 2 [0151.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.827] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.827] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.827] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.837] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.837] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.838] GetLastError () returned 0x578 [0151.838] CanUserWritePwrScheme () returned 0 [0151.838] GetSystemMetrics (nIndex=46) returned 2 [0151.838] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.838] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.838] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.839] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.849] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.849] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.849] GetLastError () returned 0x578 [0151.849] CanUserWritePwrScheme () returned 0 [0151.850] GetSystemMetrics (nIndex=46) returned 2 [0151.850] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.850] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.850] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.850] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.861] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.861] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.861] GetLastError () returned 0x578 [0151.861] CanUserWritePwrScheme () returned 0 [0151.862] GetSystemMetrics (nIndex=46) returned 2 [0151.862] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.862] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.862] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.862] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.873] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.873] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.873] GetLastError () returned 0x578 [0151.873] CanUserWritePwrScheme () returned 0 [0151.874] GetSystemMetrics (nIndex=46) returned 2 [0151.874] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.874] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.874] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.874] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.887] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.887] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.887] GetLastError () returned 0x578 [0151.887] CanUserWritePwrScheme () returned 0 [0151.888] GetSystemMetrics (nIndex=46) returned 2 [0151.888] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.888] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.888] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.888] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.900] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.900] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.900] GetLastError () returned 0x578 [0151.901] CanUserWritePwrScheme () returned 0 [0151.949] GetSystemMetrics (nIndex=46) returned 2 [0151.949] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.949] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.949] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.949] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.959] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.959] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.960] GetLastError () returned 0x578 [0151.960] CanUserWritePwrScheme () returned 0 [0151.960] GetSystemMetrics (nIndex=46) returned 2 [0151.960] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.960] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.961] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.961] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.971] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.971] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.971] GetLastError () returned 0x578 [0151.971] CanUserWritePwrScheme () returned 0 [0151.972] GetSystemMetrics (nIndex=46) returned 2 [0151.972] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.972] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.972] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.972] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.983] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.983] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.983] GetLastError () returned 0x578 [0151.983] CanUserWritePwrScheme () returned 0 [0151.984] GetSystemMetrics (nIndex=46) returned 2 [0151.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.994] GetLastError () returned 0x578 [0151.994] CanUserWritePwrScheme () returned 0 [0151.995] GetSystemMetrics (nIndex=46) returned 2 [0151.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.007] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.007] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.007] GetLastError () returned 0x578 [0152.007] CanUserWritePwrScheme () returned 0 [0152.011] GetSystemMetrics (nIndex=46) returned 2 [0152.011] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.011] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.011] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.011] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.021] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.022] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.022] GetLastError () returned 0x578 [0152.022] CanUserWritePwrScheme () returned 0 [0152.022] GetSystemMetrics (nIndex=46) returned 2 [0152.022] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.023] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.023] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.023] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.033] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.033] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.033] GetLastError () returned 0x578 [0152.033] CanUserWritePwrScheme () returned 0 [0152.034] GetSystemMetrics (nIndex=46) returned 2 [0152.034] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.034] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.034] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.034] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.045] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.045] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.045] GetLastError () returned 0x578 [0152.045] CanUserWritePwrScheme () returned 0 [0152.046] GetSystemMetrics (nIndex=46) returned 2 [0152.046] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.046] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.046] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.046] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.057] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.057] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.057] GetLastError () returned 0x578 [0152.057] CanUserWritePwrScheme () returned 0 [0152.058] GetSystemMetrics (nIndex=46) returned 2 [0152.058] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.058] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.058] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.058] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.068] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.068] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.068] GetLastError () returned 0x578 [0152.068] CanUserWritePwrScheme () returned 0 [0152.069] GetSystemMetrics (nIndex=46) returned 2 [0152.069] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.069] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.069] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.069] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.083] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.083] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.083] GetLastError () returned 0x578 [0152.083] CanUserWritePwrScheme () returned 0 [0152.084] GetSystemMetrics (nIndex=46) returned 2 [0152.084] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.084] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.084] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.084] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.094] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.094] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.094] GetLastError () returned 0x578 [0152.094] CanUserWritePwrScheme () returned 0 [0152.095] GetSystemMetrics (nIndex=46) returned 2 [0152.095] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.095] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.095] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.095] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.106] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.106] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.106] GetLastError () returned 0x578 [0152.106] CanUserWritePwrScheme () returned 0 [0152.107] GetSystemMetrics (nIndex=46) returned 2 [0152.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.107] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.118] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.118] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.118] GetLastError () returned 0x578 [0152.118] CanUserWritePwrScheme () returned 0 [0152.119] GetSystemMetrics (nIndex=46) returned 2 [0152.119] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.119] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.119] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.119] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.130] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.130] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.130] GetLastError () returned 0x578 [0152.130] CanUserWritePwrScheme () returned 0 [0152.131] GetSystemMetrics (nIndex=46) returned 2 [0152.131] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.131] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.131] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.131] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.144] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.144] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.144] GetLastError () returned 0x578 [0152.144] CanUserWritePwrScheme () returned 0 [0152.145] GetSystemMetrics (nIndex=46) returned 2 [0152.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.145] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.145] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.145] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.168] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.168] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.168] GetLastError () returned 0x578 [0152.168] CanUserWritePwrScheme () returned 0 [0152.169] GetSystemMetrics (nIndex=46) returned 2 [0152.169] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.169] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.169] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.169] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.180] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.180] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.180] GetLastError () returned 0x578 [0152.180] CanUserWritePwrScheme () returned 0 [0152.181] GetSystemMetrics (nIndex=46) returned 2 [0152.181] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.181] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.181] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.181] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.191] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.191] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.191] GetLastError () returned 0x578 [0152.191] CanUserWritePwrScheme () returned 0 [0152.192] GetSystemMetrics (nIndex=46) returned 2 [0152.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.192] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.192] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.192] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.206] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.206] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.206] GetLastError () returned 0x578 [0152.206] CanUserWritePwrScheme () returned 0 [0152.207] GetSystemMetrics (nIndex=46) returned 2 [0152.207] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.207] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.207] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.207] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.218] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.218] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.218] GetLastError () returned 0x578 [0152.218] CanUserWritePwrScheme () returned 0 [0152.219] GetSystemMetrics (nIndex=46) returned 2 [0152.219] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.219] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.219] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.219] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.230] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.230] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.230] GetLastError () returned 0x578 [0152.230] CanUserWritePwrScheme () returned 0 [0152.231] GetSystemMetrics (nIndex=46) returned 2 [0152.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.231] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.231] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.231] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.241] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.241] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.241] GetLastError () returned 0x578 [0152.241] CanUserWritePwrScheme () returned 0 [0152.242] GetSystemMetrics (nIndex=46) returned 2 [0152.242] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.242] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.242] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.242] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.253] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.253] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.254] GetLastError () returned 0x578 [0152.254] CanUserWritePwrScheme () returned 0 [0152.254] GetSystemMetrics (nIndex=46) returned 2 [0152.254] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.255] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.255] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.265] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.265] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.266] GetLastError () returned 0x578 [0152.266] CanUserWritePwrScheme () returned 0 [0152.266] GetSystemMetrics (nIndex=46) returned 2 [0152.267] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.267] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.267] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.267] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.280] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.280] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.280] GetLastError () returned 0x578 [0152.280] CanUserWritePwrScheme () returned 0 [0152.281] GetSystemMetrics (nIndex=46) returned 2 [0152.281] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.281] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.281] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.281] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.292] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.292] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.292] GetLastError () returned 0x578 [0152.292] CanUserWritePwrScheme () returned 0 [0152.293] GetSystemMetrics (nIndex=46) returned 2 [0152.293] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.293] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.293] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.293] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.304] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.304] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.304] GetLastError () returned 0x578 [0152.304] CanUserWritePwrScheme () returned 0 [0152.305] GetSystemMetrics (nIndex=46) returned 2 [0152.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.305] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.305] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.305] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.316] GetLastError () returned 0x578 [0152.316] CanUserWritePwrScheme () returned 0 [0152.317] GetSystemMetrics (nIndex=46) returned 2 [0152.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.327] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.327] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.327] GetLastError () returned 0x578 [0152.328] CanUserWritePwrScheme () returned 0 [0152.328] GetSystemMetrics (nIndex=46) returned 2 [0152.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.328] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.328] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.328] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.342] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.342] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.342] GetLastError () returned 0x578 [0152.342] CanUserWritePwrScheme () returned 0 [0152.343] GetSystemMetrics (nIndex=46) returned 2 [0152.343] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.343] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.343] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.343] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.354] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.354] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.354] GetLastError () returned 0x578 [0152.354] CanUserWritePwrScheme () returned 0 [0152.355] GetSystemMetrics (nIndex=46) returned 2 [0152.355] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.355] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.355] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.355] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.365] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.365] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.365] GetLastError () returned 0x578 [0152.366] CanUserWritePwrScheme () returned 0 [0152.366] GetSystemMetrics (nIndex=46) returned 2 [0152.366] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.366] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.366] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.367] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.377] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.377] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.377] GetLastError () returned 0x578 [0152.377] CanUserWritePwrScheme () returned 0 [0152.378] GetSystemMetrics (nIndex=46) returned 2 [0152.378] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.378] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.378] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.378] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.389] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.389] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.389] GetLastError () returned 0x578 [0152.389] CanUserWritePwrScheme () returned 0 [0152.390] GetSystemMetrics (nIndex=46) returned 2 [0152.390] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.390] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.390] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.390] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.408] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.408] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.408] GetLastError () returned 0x578 [0152.408] CanUserWritePwrScheme () returned 0 [0152.409] GetSystemMetrics (nIndex=46) returned 2 [0152.409] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.409] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.409] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.409] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.420] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.420] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.420] GetLastError () returned 0x578 [0152.420] CanUserWritePwrScheme () returned 0 [0152.421] GetSystemMetrics (nIndex=46) returned 2 [0152.421] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.421] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.421] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.421] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.431] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.431] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.431] GetLastError () returned 0x578 [0152.431] CanUserWritePwrScheme () returned 0 [0152.433] GetSystemMetrics (nIndex=46) returned 2 [0152.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.433] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.433] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.433] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.443] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.443] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.443] GetLastError () returned 0x578 [0152.443] CanUserWritePwrScheme () returned 0 [0152.444] GetSystemMetrics (nIndex=46) returned 2 [0152.444] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.444] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.444] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.444] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.455] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.455] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.455] GetLastError () returned 0x578 [0152.455] CanUserWritePwrScheme () returned 0 [0152.456] GetSystemMetrics (nIndex=46) returned 2 [0152.456] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.456] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.456] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.456] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.469] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.469] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.470] GetLastError () returned 0x578 [0152.470] CanUserWritePwrScheme () returned 0 [0152.470] GetSystemMetrics (nIndex=46) returned 2 [0152.470] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.470] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.481] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.481] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.481] GetLastError () returned 0x578 [0152.481] CanUserWritePwrScheme () returned 0 [0152.482] GetSystemMetrics (nIndex=46) returned 2 [0152.482] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.482] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.482] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.482] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.493] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.493] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.493] GetLastError () returned 0x578 [0152.493] CanUserWritePwrScheme () returned 0 [0152.494] GetSystemMetrics (nIndex=46) returned 2 [0152.494] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.494] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.494] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.494] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.505] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.505] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.505] GetLastError () returned 0x578 [0152.505] CanUserWritePwrScheme () returned 0 [0152.505] GetSystemMetrics (nIndex=46) returned 2 [0152.506] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.506] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.506] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.506] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.516] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.516] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.516] GetLastError () returned 0x578 [0152.516] CanUserWritePwrScheme () returned 0 [0152.517] GetSystemMetrics (nIndex=46) returned 2 [0152.517] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.517] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.517] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.517] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.528] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.528] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.528] GetLastError () returned 0x578 [0152.528] CanUserWritePwrScheme () returned 0 [0152.531] GetSystemMetrics (nIndex=46) returned 2 [0152.531] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.531] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.531] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.531] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.542] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.542] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.542] GetLastError () returned 0x578 [0152.542] CanUserWritePwrScheme () returned 0 [0152.543] GetSystemMetrics (nIndex=46) returned 2 [0152.543] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.543] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.543] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.543] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.554] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.554] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.554] GetLastError () returned 0x578 [0152.554] CanUserWritePwrScheme () returned 0 [0152.555] GetSystemMetrics (nIndex=46) returned 2 [0152.555] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.555] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.555] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.555] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.566] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.566] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.566] GetLastError () returned 0x578 [0152.566] CanUserWritePwrScheme () returned 0 [0152.567] GetSystemMetrics (nIndex=46) returned 2 [0152.567] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.567] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.567] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.567] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.578] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.578] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.578] GetLastError () returned 0x578 [0152.578] CanUserWritePwrScheme () returned 0 [0152.579] GetSystemMetrics (nIndex=46) returned 2 [0152.579] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.579] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.579] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.579] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.589] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.589] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.590] GetLastError () returned 0x578 [0152.590] CanUserWritePwrScheme () returned 0 [0152.590] GetSystemMetrics (nIndex=46) returned 2 [0152.590] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.591] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.591] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.591] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.604] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.604] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.604] GetLastError () returned 0x578 [0152.604] CanUserWritePwrScheme () returned 0 [0152.605] GetSystemMetrics (nIndex=46) returned 2 [0152.605] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.605] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.605] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.605] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.610] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.610] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.610] GetLastError () returned 0x578 [0152.610] CanUserWritePwrScheme () returned 0 [0152.611] GetSystemMetrics (nIndex=46) returned 2 [0152.611] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.611] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.611] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.611] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.616] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.616] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.616] GetLastError () returned 0x578 [0152.616] CanUserWritePwrScheme () returned 0 [0152.617] GetSystemMetrics (nIndex=46) returned 2 [0152.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.617] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.617] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.617] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.622] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.622] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.622] GetLastError () returned 0x578 [0152.622] CanUserWritePwrScheme () returned 0 [0152.623] GetSystemMetrics (nIndex=46) returned 2 [0152.623] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.623] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.623] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.623] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.628] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.628] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.628] GetLastError () returned 0x578 [0152.628] CanUserWritePwrScheme () returned 0 [0152.629] GetSystemMetrics (nIndex=46) returned 2 [0152.629] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.629] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.629] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.629] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.634] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.634] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.634] GetLastError () returned 0x578 [0152.634] CanUserWritePwrScheme () returned 0 [0152.636] GetSystemMetrics (nIndex=46) returned 2 [0152.636] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.636] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.636] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.636] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.641] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.641] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.641] GetLastError () returned 0x578 [0152.641] CanUserWritePwrScheme () returned 0 [0152.642] GetSystemMetrics (nIndex=46) returned 2 [0152.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.642] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.642] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.642] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.647] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.647] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.647] GetLastError () returned 0x578 [0152.647] CanUserWritePwrScheme () returned 0 [0152.648] GetSystemMetrics (nIndex=46) returned 2 [0152.648] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.648] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.648] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.648] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.653] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.653] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.653] GetLastError () returned 0x578 [0152.653] CanUserWritePwrScheme () returned 0 [0152.654] GetSystemMetrics (nIndex=46) returned 2 [0152.654] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.654] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.654] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.654] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.661] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.661] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.661] GetLastError () returned 0x578 [0152.661] CanUserWritePwrScheme () returned 0 [0152.662] GetSystemMetrics (nIndex=46) returned 2 [0152.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.662] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.662] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.662] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.669] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.669] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.669] GetLastError () returned 0x578 [0152.669] CanUserWritePwrScheme () returned 0 [0152.670] GetSystemMetrics (nIndex=46) returned 2 [0152.670] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.670] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.670] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.670] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.681] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.681] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.681] GetLastError () returned 0x578 [0152.681] CanUserWritePwrScheme () returned 0 [0152.682] GetSystemMetrics (nIndex=46) returned 2 [0152.682] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.682] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.682] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.682] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.692] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.692] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.693] GetLastError () returned 0x578 [0152.693] CanUserWritePwrScheme () returned 0 [0152.693] GetSystemMetrics (nIndex=46) returned 2 [0152.693] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.693] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.693] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.693] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.704] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.704] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.704] GetLastError () returned 0x578 [0152.704] CanUserWritePwrScheme () returned 0 [0152.705] GetSystemMetrics (nIndex=46) returned 2 [0152.705] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.705] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.705] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.705] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.716] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.716] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.716] GetLastError () returned 0x578 [0152.716] CanUserWritePwrScheme () returned 0 [0152.717] GetSystemMetrics (nIndex=46) returned 2 [0152.717] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.717] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.717] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.717] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.731] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.731] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.731] GetLastError () returned 0x578 [0152.731] CanUserWritePwrScheme () returned 0 [0152.732] GetSystemMetrics (nIndex=46) returned 2 [0152.732] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.732] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.732] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.732] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.743] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.743] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.743] GetLastError () returned 0x578 [0152.743] CanUserWritePwrScheme () returned 0 [0152.744] GetSystemMetrics (nIndex=46) returned 2 [0152.744] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.744] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.744] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.744] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.755] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.755] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.755] GetLastError () returned 0x578 [0152.755] CanUserWritePwrScheme () returned 0 [0152.756] GetSystemMetrics (nIndex=46) returned 2 [0152.756] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.756] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.756] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.756] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.767] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.767] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.767] GetLastError () returned 0x578 [0152.767] CanUserWritePwrScheme () returned 0 [0152.768] GetSystemMetrics (nIndex=46) returned 2 [0152.768] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.768] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.768] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.768] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.838] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.838] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.838] GetLastError () returned 0x578 [0152.838] CanUserWritePwrScheme () returned 0 [0152.839] GetSystemMetrics (nIndex=46) returned 2 [0152.839] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.839] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.839] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.839] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.850] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.850] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.850] GetLastError () returned 0x578 [0152.850] CanUserWritePwrScheme () returned 0 [0152.851] GetSystemMetrics (nIndex=46) returned 2 [0152.851] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.851] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.851] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.851] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.864] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.864] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.864] GetLastError () returned 0x578 [0152.864] CanUserWritePwrScheme () returned 0 [0152.865] GetSystemMetrics (nIndex=46) returned 2 [0152.865] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.865] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.865] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.865] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.876] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.876] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.876] GetLastError () returned 0x578 [0152.876] CanUserWritePwrScheme () returned 0 [0152.877] GetSystemMetrics (nIndex=46) returned 2 [0152.877] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.877] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.877] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.877] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.888] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.888] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.888] GetLastError () returned 0x578 [0152.888] CanUserWritePwrScheme () returned 0 [0152.889] GetSystemMetrics (nIndex=46) returned 2 [0152.889] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.889] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.889] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.889] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.900] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.900] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.900] GetLastError () returned 0x578 [0152.903] CanUserWritePwrScheme () returned 0 [0152.904] GetSystemMetrics (nIndex=46) returned 2 [0152.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.904] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.904] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.904] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.914] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.914] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.914] GetLastError () returned 0x578 [0152.915] CanUserWritePwrScheme () returned 0 [0152.915] GetSystemMetrics (nIndex=46) returned 2 [0152.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.916] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.916] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.916] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.929] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.929] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.929] GetLastError () returned 0x578 [0152.929] CanUserWritePwrScheme () returned 0 [0152.930] GetSystemMetrics (nIndex=46) returned 2 [0152.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.931] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.942] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.942] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.942] GetLastError () returned 0x578 [0152.942] CanUserWritePwrScheme () returned 0 [0152.943] GetSystemMetrics (nIndex=46) returned 2 [0152.943] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.943] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.943] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.943] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.954] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.954] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.954] GetLastError () returned 0x578 [0152.954] CanUserWritePwrScheme () returned 0 [0152.955] GetSystemMetrics (nIndex=46) returned 2 [0152.955] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.955] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.955] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.955] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.966] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.966] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.966] GetLastError () returned 0x578 [0152.966] CanUserWritePwrScheme () returned 0 [0152.967] GetSystemMetrics (nIndex=46) returned 2 [0152.967] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.967] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.967] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.967] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.978] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.978] GetLastError () returned 0x578 [0152.978] CanUserWritePwrScheme () returned 0 [0152.979] GetSystemMetrics (nIndex=46) returned 2 [0152.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.979] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.979] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.979] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.993] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.993] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.993] GetLastError () returned 0x578 [0152.993] CanUserWritePwrScheme () returned 0 [0152.994] GetSystemMetrics (nIndex=46) returned 2 [0152.994] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.994] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.994] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.994] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.004] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.004] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.004] GetLastError () returned 0x578 [0153.004] CanUserWritePwrScheme () returned 0 [0153.005] GetSystemMetrics (nIndex=46) returned 2 [0153.005] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.005] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.005] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.005] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.016] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.016] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.016] GetLastError () returned 0x578 [0153.016] CanUserWritePwrScheme () returned 0 [0153.017] GetSystemMetrics (nIndex=46) returned 2 [0153.017] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.017] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.017] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.017] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.028] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.028] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.028] GetLastError () returned 0x578 [0153.028] CanUserWritePwrScheme () returned 0 [0153.029] GetSystemMetrics (nIndex=46) returned 2 [0153.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.029] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.029] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.029] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.040] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.040] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.040] GetLastError () returned 0x578 [0153.040] CanUserWritePwrScheme () returned 0 [0153.041] GetSystemMetrics (nIndex=46) returned 2 [0153.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.054] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.054] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.054] GetLastError () returned 0x578 [0153.054] CanUserWritePwrScheme () returned 0 [0153.055] GetSystemMetrics (nIndex=46) returned 2 [0153.055] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.055] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.055] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.055] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.066] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.066] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.066] GetLastError () returned 0x578 [0153.066] CanUserWritePwrScheme () returned 0 [0153.067] GetSystemMetrics (nIndex=46) returned 2 [0153.067] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.067] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.067] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.067] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.077] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.077] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.078] GetLastError () returned 0x578 [0153.078] CanUserWritePwrScheme () returned 0 [0153.078] GetSystemMetrics (nIndex=46) returned 2 [0153.078] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.078] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.078] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.079] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.089] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.089] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.089] GetLastError () returned 0x578 [0153.089] CanUserWritePwrScheme () returned 0 [0153.090] GetSystemMetrics (nIndex=46) returned 2 [0153.090] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.090] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.090] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.090] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.101] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.101] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.101] GetLastError () returned 0x578 [0153.101] CanUserWritePwrScheme () returned 0 [0153.102] GetSystemMetrics (nIndex=46) returned 2 [0153.102] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.102] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.102] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.102] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.113] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.113] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.113] GetLastError () returned 0x578 [0153.113] CanUserWritePwrScheme () returned 0 [0153.113] GetSystemMetrics (nIndex=46) returned 2 [0153.114] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.114] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.114] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.114] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.127] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.127] GetLastError () returned 0x578 [0153.127] CanUserWritePwrScheme () returned 0 [0153.128] GetSystemMetrics (nIndex=46) returned 2 [0153.128] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.128] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.128] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.128] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.139] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.139] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.139] GetLastError () returned 0x578 [0153.139] CanUserWritePwrScheme () returned 0 [0153.140] GetSystemMetrics (nIndex=46) returned 2 [0153.140] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.140] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.140] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.140] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.150] GetLastError () returned 0x578 [0153.150] CanUserWritePwrScheme () returned 0 [0153.151] GetSystemMetrics (nIndex=46) returned 2 [0153.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.151] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.151] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.151] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.161] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.161] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.162] GetLastError () returned 0x578 [0153.162] CanUserWritePwrScheme () returned 0 [0153.162] GetSystemMetrics (nIndex=46) returned 2 [0153.162] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.162] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.163] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.163] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.173] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.173] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.173] GetLastError () returned 0x578 [0153.173] CanUserWritePwrScheme () returned 0 [0153.174] GetSystemMetrics (nIndex=46) returned 2 [0153.174] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.174] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.174] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.174] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.188] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.188] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.188] GetLastError () returned 0x578 [0153.188] CanUserWritePwrScheme () returned 0 [0153.189] GetSystemMetrics (nIndex=46) returned 2 [0153.189] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.189] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.189] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.189] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.199] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.199] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.199] GetLastError () returned 0x578 [0153.199] CanUserWritePwrScheme () returned 0 [0153.200] GetSystemMetrics (nIndex=46) returned 2 [0153.200] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.200] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.200] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.200] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.211] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.211] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.211] GetLastError () returned 0x578 [0153.211] CanUserWritePwrScheme () returned 0 [0153.212] GetSystemMetrics (nIndex=46) returned 2 [0153.212] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.212] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.212] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.212] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.222] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.222] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.222] GetLastError () returned 0x578 [0153.222] CanUserWritePwrScheme () returned 0 [0153.223] GetSystemMetrics (nIndex=46) returned 2 [0153.223] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.223] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.223] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.223] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.234] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.234] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.234] GetLastError () returned 0x578 [0153.234] CanUserWritePwrScheme () returned 0 [0153.235] GetSystemMetrics (nIndex=46) returned 2 [0153.235] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.235] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.235] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.235] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.248] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.249] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.249] GetLastError () returned 0x578 [0153.249] CanUserWritePwrScheme () returned 0 [0153.249] GetSystemMetrics (nIndex=46) returned 2 [0153.249] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.250] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.250] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.250] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.260] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.260] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.260] GetLastError () returned 0x578 [0153.260] CanUserWritePwrScheme () returned 0 [0153.261] GetSystemMetrics (nIndex=46) returned 2 [0153.261] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.261] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.261] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.261] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.272] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.272] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.272] GetLastError () returned 0x578 [0153.272] CanUserWritePwrScheme () returned 0 [0153.273] GetSystemMetrics (nIndex=46) returned 2 [0153.273] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.273] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.273] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.273] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.363] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.363] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.363] GetLastError () returned 0x578 [0153.363] CanUserWritePwrScheme () returned 0 [0153.364] GetSystemMetrics (nIndex=46) returned 2 [0153.364] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.364] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.364] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.364] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.372] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.373] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.373] GetLastError () returned 0x578 [0153.373] CanUserWritePwrScheme () returned 0 [0153.374] GetSystemMetrics (nIndex=46) returned 2 [0153.374] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.374] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.374] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.374] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.387] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.387] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.388] GetLastError () returned 0x578 [0153.388] CanUserWritePwrScheme () returned 0 [0153.388] GetSystemMetrics (nIndex=46) returned 2 [0153.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.389] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.389] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.389] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.406] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.406] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.406] GetLastError () returned 0x578 [0153.406] CanUserWritePwrScheme () returned 0 [0153.407] GetSystemMetrics (nIndex=46) returned 2 [0153.407] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.407] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.407] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.407] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.412] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.412] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.412] GetLastError () returned 0x578 [0153.412] CanUserWritePwrScheme () returned 0 [0153.413] GetSystemMetrics (nIndex=46) returned 2 [0153.413] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.413] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.413] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.413] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.418] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.418] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.418] GetLastError () returned 0x578 [0153.418] CanUserWritePwrScheme () returned 0 [0153.419] GetSystemMetrics (nIndex=46) returned 2 [0153.419] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.419] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.419] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.419] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.423] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.423] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.423] GetLastError () returned 0x578 [0153.423] CanUserWritePwrScheme () returned 0 [0153.424] GetSystemMetrics (nIndex=46) returned 2 [0153.424] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.424] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.424] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.424] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.429] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.429] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.429] GetLastError () returned 0x578 [0153.429] CanUserWritePwrScheme () returned 0 [0153.430] GetSystemMetrics (nIndex=46) returned 2 [0153.430] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.430] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.436] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.436] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.436] GetLastError () returned 0x578 [0153.436] CanUserWritePwrScheme () returned 0 [0153.437] GetSystemMetrics (nIndex=46) returned 2 [0153.437] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.437] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.437] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.437] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.451] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.451] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.451] GetLastError () returned 0x578 [0153.451] CanUserWritePwrScheme () returned 0 [0153.452] GetSystemMetrics (nIndex=46) returned 2 [0153.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.452] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.452] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.452] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.463] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.463] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.463] GetLastError () returned 0x578 [0153.463] CanUserWritePwrScheme () returned 0 [0153.464] GetSystemMetrics (nIndex=46) returned 2 [0153.464] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.464] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.464] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.464] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.474] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.474] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.474] GetLastError () returned 0x578 [0153.474] CanUserWritePwrScheme () returned 0 [0153.475] GetSystemMetrics (nIndex=46) returned 2 [0153.475] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.475] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.475] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.475] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.486] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.486] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.486] GetLastError () returned 0x578 [0153.486] CanUserWritePwrScheme () returned 0 [0153.487] GetSystemMetrics (nIndex=46) returned 2 [0153.487] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.487] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.487] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.487] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.497] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.497] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.498] GetLastError () returned 0x578 [0153.498] CanUserWritePwrScheme () returned 0 [0153.498] GetSystemMetrics (nIndex=46) returned 2 [0153.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.498] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.499] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.499] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.512] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.512] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.512] GetLastError () returned 0x578 [0153.513] CanUserWritePwrScheme () returned 0 [0153.513] GetSystemMetrics (nIndex=46) returned 2 [0153.513] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.513] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.513] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.513] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.524] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.524] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.524] GetLastError () returned 0x578 [0153.524] CanUserWritePwrScheme () returned 0 [0153.525] GetSystemMetrics (nIndex=46) returned 2 [0153.525] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.525] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.525] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.525] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.536] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.536] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.536] GetLastError () returned 0x578 [0153.536] CanUserWritePwrScheme () returned 0 [0153.537] GetSystemMetrics (nIndex=46) returned 2 [0153.537] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.537] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.537] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.537] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.549] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.549] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.549] GetLastError () returned 0x578 [0153.549] CanUserWritePwrScheme () returned 0 [0153.550] GetSystemMetrics (nIndex=46) returned 2 [0153.550] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.550] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.550] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.550] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.561] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.561] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.561] GetLastError () returned 0x578 [0153.561] CanUserWritePwrScheme () returned 0 [0153.562] GetSystemMetrics (nIndex=46) returned 2 [0153.562] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.562] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.562] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.562] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.576] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.576] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.576] GetLastError () returned 0x578 [0153.576] CanUserWritePwrScheme () returned 0 [0153.577] GetSystemMetrics (nIndex=46) returned 2 [0153.577] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.577] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.577] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.577] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.588] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.588] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.588] GetLastError () returned 0x578 [0153.588] CanUserWritePwrScheme () returned 0 [0153.589] GetSystemMetrics (nIndex=46) returned 2 [0153.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.600] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.600] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.600] GetLastError () returned 0x578 [0153.600] CanUserWritePwrScheme () returned 0 [0153.601] GetSystemMetrics (nIndex=46) returned 2 [0153.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.612] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.612] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.612] GetLastError () returned 0x578 [0153.612] CanUserWritePwrScheme () returned 0 [0153.613] GetSystemMetrics (nIndex=46) returned 2 [0153.613] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.613] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.613] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.613] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.624] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.624] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.624] GetLastError () returned 0x578 [0153.624] CanUserWritePwrScheme () returned 0 [0153.625] GetSystemMetrics (nIndex=46) returned 2 [0153.625] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.625] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.625] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.625] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.640] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.640] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.640] GetLastError () returned 0x578 [0153.640] CanUserWritePwrScheme () returned 0 [0153.641] GetSystemMetrics (nIndex=46) returned 2 [0153.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.641] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.641] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.641] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.651] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.651] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.651] GetLastError () returned 0x578 [0153.651] CanUserWritePwrScheme () returned 0 [0153.652] GetSystemMetrics (nIndex=46) returned 2 [0153.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.652] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.652] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.652] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.663] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.663] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.663] GetLastError () returned 0x578 [0153.663] CanUserWritePwrScheme () returned 0 [0153.664] GetSystemMetrics (nIndex=46) returned 2 [0153.664] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.664] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.664] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.664] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.675] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.675] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.675] GetLastError () returned 0x578 [0153.675] CanUserWritePwrScheme () returned 0 [0153.676] GetSystemMetrics (nIndex=46) returned 2 [0153.676] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.676] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.676] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.676] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.687] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.687] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.687] GetLastError () returned 0x578 [0153.687] CanUserWritePwrScheme () returned 0 [0153.688] GetSystemMetrics (nIndex=46) returned 2 [0153.688] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.688] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.688] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.688] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.699] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.699] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.699] GetLastError () returned 0x578 [0153.699] CanUserWritePwrScheme () returned 0 [0153.699] GetSystemMetrics (nIndex=46) returned 2 [0153.700] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.700] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.700] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.700] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.713] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.713] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.713] GetLastError () returned 0x578 [0153.713] CanUserWritePwrScheme () returned 0 [0153.714] GetSystemMetrics (nIndex=46) returned 2 [0153.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.714] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.714] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.714] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.724] GetLastError () returned 0x578 [0153.724] CanUserWritePwrScheme () returned 0 [0153.725] GetSystemMetrics (nIndex=46) returned 2 [0153.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.725] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.725] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.725] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.736] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.736] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.736] GetLastError () returned 0x578 [0153.736] CanUserWritePwrScheme () returned 0 [0153.737] GetSystemMetrics (nIndex=46) returned 2 [0153.737] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.737] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.737] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.737] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.748] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.748] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.748] GetLastError () returned 0x578 [0153.748] CanUserWritePwrScheme () returned 0 [0153.749] GetSystemMetrics (nIndex=46) returned 2 [0153.749] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.749] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.749] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.749] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.760] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.760] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.760] GetLastError () returned 0x578 [0153.760] CanUserWritePwrScheme () returned 0 [0153.761] GetSystemMetrics (nIndex=46) returned 2 [0153.761] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.761] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.761] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.761] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.774] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.774] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.774] GetLastError () returned 0x578 [0153.774] CanUserWritePwrScheme () returned 0 [0153.775] GetSystemMetrics (nIndex=46) returned 2 [0153.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.775] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.775] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.775] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.786] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.786] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.786] GetLastError () returned 0x578 [0153.786] CanUserWritePwrScheme () returned 0 [0153.787] GetSystemMetrics (nIndex=46) returned 2 [0153.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.798] GetLastError () returned 0x578 [0153.798] CanUserWritePwrScheme () returned 0 [0153.799] GetSystemMetrics (nIndex=46) returned 2 [0153.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.799] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.799] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.799] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.810] GetLastError () returned 0x578 [0153.810] CanUserWritePwrScheme () returned 0 [0153.811] GetSystemMetrics (nIndex=46) returned 2 [0153.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.821] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.821] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.822] GetLastError () returned 0x578 [0153.822] CanUserWritePwrScheme () returned 0 [0153.822] GetSystemMetrics (nIndex=46) returned 2 [0153.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.836] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.836] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.836] GetLastError () returned 0x578 [0153.836] CanUserWritePwrScheme () returned 0 [0153.837] GetSystemMetrics (nIndex=46) returned 2 [0153.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.837] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.837] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.837] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.848] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.848] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.848] GetLastError () returned 0x578 [0153.848] CanUserWritePwrScheme () returned 0 [0153.849] GetSystemMetrics (nIndex=46) returned 2 [0153.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.849] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.849] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.849] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.860] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.860] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.860] GetLastError () returned 0x578 [0153.860] CanUserWritePwrScheme () returned 0 [0153.861] GetSystemMetrics (nIndex=46) returned 2 [0153.861] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.872] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.872] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.872] GetLastError () returned 0x578 [0153.872] CanUserWritePwrScheme () returned 0 [0153.873] GetSystemMetrics (nIndex=46) returned 2 [0153.873] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.873] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.873] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.873] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.884] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.884] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.884] GetLastError () returned 0x578 [0153.884] CanUserWritePwrScheme () returned 0 [0153.885] GetSystemMetrics (nIndex=46) returned 2 [0153.885] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.885] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.885] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.885] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.899] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.899] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.899] GetLastError () returned 0x578 [0153.899] CanUserWritePwrScheme () returned 0 [0153.900] GetSystemMetrics (nIndex=46) returned 2 [0153.900] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.900] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.900] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.900] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.911] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.911] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.911] GetLastError () returned 0x578 [0153.911] CanUserWritePwrScheme () returned 0 [0153.911] GetSystemMetrics (nIndex=46) returned 2 [0153.912] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.912] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.912] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.912] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.922] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.922] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.922] GetLastError () returned 0x578 [0153.922] CanUserWritePwrScheme () returned 0 [0153.923] GetSystemMetrics (nIndex=46) returned 2 [0153.923] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.923] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.923] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.923] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.934] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.934] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.934] GetLastError () returned 0x578 [0153.934] CanUserWritePwrScheme () returned 0 [0153.935] GetSystemMetrics (nIndex=46) returned 2 [0153.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.946] GetLastError () returned 0x578 [0153.946] CanUserWritePwrScheme () returned 0 [0153.947] GetSystemMetrics (nIndex=46) returned 2 [0153.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.947] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.947] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.947] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.958] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.958] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.958] GetLastError () returned 0x578 [0153.958] CanUserWritePwrScheme () returned 0 [0153.959] GetSystemMetrics (nIndex=46) returned 2 [0153.959] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.959] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.959] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.959] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.973] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.973] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.973] GetLastError () returned 0x578 [0153.973] CanUserWritePwrScheme () returned 0 [0153.974] GetSystemMetrics (nIndex=46) returned 2 [0153.974] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.974] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.974] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.974] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.985] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.985] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.985] GetLastError () returned 0x578 [0153.985] CanUserWritePwrScheme () returned 0 [0153.986] GetSystemMetrics (nIndex=46) returned 2 [0153.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.986] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.997] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.997] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.997] GetLastError () returned 0x578 [0153.997] CanUserWritePwrScheme () returned 0 [0153.998] GetSystemMetrics (nIndex=46) returned 2 [0153.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.998] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.998] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.998] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.009] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.009] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.009] GetLastError () returned 0x578 [0154.009] CanUserWritePwrScheme () returned 0 [0154.010] GetSystemMetrics (nIndex=46) returned 2 [0154.010] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.010] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.010] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.010] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.020] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.020] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.020] GetLastError () returned 0x578 [0154.021] CanUserWritePwrScheme () returned 0 [0154.021] GetSystemMetrics (nIndex=46) returned 2 [0154.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.021] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.021] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.021] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.035] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.035] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.035] GetLastError () returned 0x578 [0154.035] CanUserWritePwrScheme () returned 0 [0154.036] GetSystemMetrics (nIndex=46) returned 2 [0154.036] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.036] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.036] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.036] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.047] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.047] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.047] GetLastError () returned 0x578 [0154.047] CanUserWritePwrScheme () returned 0 [0154.048] GetSystemMetrics (nIndex=46) returned 2 [0154.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.048] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.048] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.048] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.058] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.058] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.059] GetLastError () returned 0x578 [0154.059] CanUserWritePwrScheme () returned 0 [0154.059] GetSystemMetrics (nIndex=46) returned 2 [0154.059] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.059] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.060] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.060] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.070] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.070] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.070] GetLastError () returned 0x578 [0154.070] CanUserWritePwrScheme () returned 0 [0154.071] GetSystemMetrics (nIndex=46) returned 2 [0154.071] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.071] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.071] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.071] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.082] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.082] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.082] GetLastError () returned 0x578 [0154.082] CanUserWritePwrScheme () returned 0 [0154.083] GetSystemMetrics (nIndex=46) returned 2 [0154.083] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.083] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.083] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.083] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.096] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.096] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.097] GetLastError () returned 0x578 [0154.097] CanUserWritePwrScheme () returned 0 [0154.097] GetSystemMetrics (nIndex=46) returned 2 [0154.097] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.097] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.098] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.098] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.109] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.109] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.109] GetLastError () returned 0x578 [0154.109] CanUserWritePwrScheme () returned 0 [0154.110] GetSystemMetrics (nIndex=46) returned 2 [0154.110] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.110] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.110] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.110] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.120] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.121] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.121] GetLastError () returned 0x578 [0154.121] CanUserWritePwrScheme () returned 0 [0154.121] GetSystemMetrics (nIndex=46) returned 2 [0154.122] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.122] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.122] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.122] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.132] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.132] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.132] GetLastError () returned 0x578 [0154.133] CanUserWritePwrScheme () returned 0 [0154.133] GetSystemMetrics (nIndex=46) returned 2 [0154.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.133] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.133] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.134] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.144] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.144] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.144] GetLastError () returned 0x578 [0154.144] CanUserWritePwrScheme () returned 0 [0154.145] GetSystemMetrics (nIndex=46) returned 2 [0154.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.145] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.145] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.145] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.156] GetLastError () returned 0x578 [0154.156] CanUserWritePwrScheme () returned 0 [0154.160] GetSystemMetrics (nIndex=46) returned 2 [0154.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.160] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.160] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.160] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.170] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.170] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.170] GetLastError () returned 0x578 [0154.170] CanUserWritePwrScheme () returned 0 [0154.171] GetSystemMetrics (nIndex=46) returned 2 [0154.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.171] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.171] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.171] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.182] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.182] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.182] GetLastError () returned 0x578 [0154.182] CanUserWritePwrScheme () returned 0 [0154.183] GetSystemMetrics (nIndex=46) returned 2 [0154.183] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.183] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.183] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.183] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.194] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.194] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.194] GetLastError () returned 0x578 [0154.194] CanUserWritePwrScheme () returned 0 [0154.195] GetSystemMetrics (nIndex=46) returned 2 [0154.195] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.195] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.195] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.195] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.206] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.206] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.206] GetLastError () returned 0x578 [0154.206] CanUserWritePwrScheme () returned 0 [0154.207] GetSystemMetrics (nIndex=46) returned 2 [0154.207] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.207] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.207] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.207] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.217] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.217] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.217] GetLastError () returned 0x578 [0154.217] CanUserWritePwrScheme () returned 0 [0154.218] GetSystemMetrics (nIndex=46) returned 2 [0154.218] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.218] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.218] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.218] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.232] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.232] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.232] GetLastError () returned 0x578 [0154.232] CanUserWritePwrScheme () returned 0 [0154.233] GetSystemMetrics (nIndex=46) returned 2 [0154.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.233] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.233] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.233] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.244] GetLastError () returned 0x578 [0154.244] CanUserWritePwrScheme () returned 0 [0154.245] GetSystemMetrics (nIndex=46) returned 2 [0154.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.255] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.256] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.256] GetLastError () returned 0x578 [0154.256] CanUserWritePwrScheme () returned 0 [0154.256] GetSystemMetrics (nIndex=46) returned 2 [0154.257] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.257] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.257] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.267] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.267] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.268] GetLastError () returned 0x578 [0154.268] CanUserWritePwrScheme () returned 0 [0154.268] GetSystemMetrics (nIndex=46) returned 2 [0154.268] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.269] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.269] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.269] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.279] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.279] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.279] GetLastError () returned 0x578 [0154.279] CanUserWritePwrScheme () returned 0 [0154.280] GetSystemMetrics (nIndex=46) returned 2 [0154.280] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.280] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.280] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.280] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.294] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.294] GetLastError () returned 0x578 [0154.294] CanUserWritePwrScheme () returned 0 [0154.295] GetSystemMetrics (nIndex=46) returned 2 [0154.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.306] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.306] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.306] GetLastError () returned 0x578 [0154.306] CanUserWritePwrScheme () returned 0 [0154.307] GetSystemMetrics (nIndex=46) returned 2 [0154.307] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.307] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.307] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.307] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.316] GetLastError () returned 0x578 [0154.316] CanUserWritePwrScheme () returned 0 [0154.317] GetSystemMetrics (nIndex=46) returned 2 [0154.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.322] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.322] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.322] GetLastError () returned 0x578 [0154.322] CanUserWritePwrScheme () returned 0 [0154.323] GetSystemMetrics (nIndex=46) returned 2 [0154.323] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.323] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.323] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.323] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.328] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.328] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.328] GetLastError () returned 0x578 [0154.328] CanUserWritePwrScheme () returned 0 [0154.329] GetSystemMetrics (nIndex=46) returned 2 [0154.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.334] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.334] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.334] GetLastError () returned 0x578 [0154.334] CanUserWritePwrScheme () returned 0 [0154.335] GetSystemMetrics (nIndex=46) returned 2 [0154.335] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.335] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.335] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.335] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.346] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.346] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.346] GetLastError () returned 0x578 [0154.346] CanUserWritePwrScheme () returned 0 [0154.347] GetSystemMetrics (nIndex=46) returned 2 [0154.347] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.347] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.347] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.347] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.368] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.368] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.368] GetLastError () returned 0x578 [0154.368] CanUserWritePwrScheme () returned 0 [0154.369] GetSystemMetrics (nIndex=46) returned 2 [0154.369] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.369] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.369] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.369] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.380] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.380] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.380] GetLastError () returned 0x578 [0154.380] CanUserWritePwrScheme () returned 0 [0154.381] GetSystemMetrics (nIndex=46) returned 2 [0154.381] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.381] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.381] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.381] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.393] GetLastError () returned 0x578 [0154.393] CanUserWritePwrScheme () returned 0 [0154.394] GetSystemMetrics (nIndex=46) returned 2 [0154.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.394] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.394] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.394] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.412] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.412] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.412] GetLastError () returned 0x578 [0154.412] CanUserWritePwrScheme () returned 0 [0154.413] GetSystemMetrics (nIndex=46) returned 2 [0154.413] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.413] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.413] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.413] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.425] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.425] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.425] GetLastError () returned 0x578 [0154.425] CanUserWritePwrScheme () returned 0 [0154.426] GetSystemMetrics (nIndex=46) returned 2 [0154.426] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.426] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.426] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.426] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.437] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.437] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.437] GetLastError () returned 0x578 [0154.437] CanUserWritePwrScheme () returned 0 [0154.438] GetSystemMetrics (nIndex=46) returned 2 [0154.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.438] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.450] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.450] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.450] GetLastError () returned 0x578 [0154.450] CanUserWritePwrScheme () returned 0 [0154.451] GetSystemMetrics (nIndex=46) returned 2 [0154.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.451] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.451] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.451] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.462] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.462] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.462] GetLastError () returned 0x578 [0154.462] CanUserWritePwrScheme () returned 0 [0154.463] GetSystemMetrics (nIndex=46) returned 2 [0154.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.463] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.463] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.463] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.475] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.475] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.475] GetLastError () returned 0x578 [0154.475] CanUserWritePwrScheme () returned 0 [0154.476] GetSystemMetrics (nIndex=46) returned 2 [0154.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.476] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.476] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.476] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.486] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.486] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.486] GetLastError () returned 0x578 [0154.487] CanUserWritePwrScheme () returned 0 [0154.487] GetSystemMetrics (nIndex=46) returned 2 [0154.487] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.487] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.487] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.487] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.499] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.499] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.499] GetLastError () returned 0x578 [0154.499] CanUserWritePwrScheme () returned 0 [0154.500] GetSystemMetrics (nIndex=46) returned 2 [0154.500] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.500] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.500] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.500] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.513] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.513] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.514] GetLastError () returned 0x578 [0154.514] CanUserWritePwrScheme () returned 0 [0154.514] GetSystemMetrics (nIndex=46) returned 2 [0154.514] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.514] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.514] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.515] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.526] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.526] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.526] GetLastError () returned 0x578 [0154.526] CanUserWritePwrScheme () returned 0 [0154.527] GetSystemMetrics (nIndex=46) returned 2 [0154.527] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.527] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.527] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.527] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.538] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.538] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.538] GetLastError () returned 0x578 [0154.538] CanUserWritePwrScheme () returned 0 [0154.539] GetSystemMetrics (nIndex=46) returned 2 [0154.539] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.539] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.539] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.539] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.550] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.550] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.550] GetLastError () returned 0x578 [0154.550] CanUserWritePwrScheme () returned 0 [0154.551] GetSystemMetrics (nIndex=46) returned 2 [0154.551] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.551] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.551] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.551] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.562] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.562] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.562] GetLastError () returned 0x578 [0154.562] CanUserWritePwrScheme () returned 0 [0154.564] GetSystemMetrics (nIndex=46) returned 2 [0154.564] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.564] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.564] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.564] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.575] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.575] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.575] GetLastError () returned 0x578 [0154.575] CanUserWritePwrScheme () returned 0 [0154.576] GetSystemMetrics (nIndex=46) returned 2 [0154.576] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.576] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.576] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.576] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.587] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.587] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.587] GetLastError () returned 0x578 [0154.587] CanUserWritePwrScheme () returned 0 [0154.588] GetSystemMetrics (nIndex=46) returned 2 [0154.588] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.588] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.588] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.588] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.599] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.599] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.599] GetLastError () returned 0x578 [0154.599] CanUserWritePwrScheme () returned 0 [0154.600] GetSystemMetrics (nIndex=46) returned 2 [0154.600] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.612] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.612] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.612] GetLastError () returned 0x578 [0154.612] CanUserWritePwrScheme () returned 0 [0154.613] GetSystemMetrics (nIndex=46) returned 2 [0154.613] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.613] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.613] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.613] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.624] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.624] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.624] GetLastError () returned 0x578 [0154.624] CanUserWritePwrScheme () returned 0 [0154.625] GetSystemMetrics (nIndex=46) returned 2 [0154.625] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.625] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.625] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.625] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.639] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.639] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.639] GetLastError () returned 0x578 [0154.639] CanUserWritePwrScheme () returned 0 [0154.640] GetSystemMetrics (nIndex=46) returned 2 [0154.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.640] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.640] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.640] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.651] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.651] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.651] GetLastError () returned 0x578 [0154.651] CanUserWritePwrScheme () returned 0 [0154.652] GetSystemMetrics (nIndex=46) returned 2 [0154.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.652] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.652] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.652] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.664] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.664] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.664] GetLastError () returned 0x578 [0154.664] CanUserWritePwrScheme () returned 0 [0154.665] GetSystemMetrics (nIndex=46) returned 2 [0154.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.665] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.665] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.665] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.675] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.675] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.675] GetLastError () returned 0x578 [0154.675] CanUserWritePwrScheme () returned 0 [0154.676] GetSystemMetrics (nIndex=46) returned 2 [0154.676] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.676] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.676] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.676] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.688] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.688] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.688] GetLastError () returned 0x578 [0154.688] CanUserWritePwrScheme () returned 0 [0154.689] GetSystemMetrics (nIndex=46) returned 2 [0154.689] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.689] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.689] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.689] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.700] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.700] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.700] GetLastError () returned 0x578 [0154.700] CanUserWritePwrScheme () returned 0 [0154.701] GetSystemMetrics (nIndex=46) returned 2 [0154.701] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.701] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.701] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.701] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.713] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.713] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.713] GetLastError () returned 0x578 [0154.713] CanUserWritePwrScheme () returned 0 [0154.714] GetSystemMetrics (nIndex=46) returned 2 [0154.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.714] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.714] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.714] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.724] GetLastError () returned 0x578 [0154.725] CanUserWritePwrScheme () returned 0 [0154.725] GetSystemMetrics (nIndex=46) returned 2 [0154.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.726] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.726] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.726] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.737] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.737] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.737] GetLastError () returned 0x578 [0154.737] CanUserWritePwrScheme () returned 0 [0154.738] GetSystemMetrics (nIndex=46) returned 2 [0154.738] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.738] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.738] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.738] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.749] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.749] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.749] GetLastError () returned 0x578 [0154.749] CanUserWritePwrScheme () returned 0 [0154.750] GetSystemMetrics (nIndex=46) returned 2 [0154.750] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.750] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.750] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.750] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.762] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.762] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.762] GetLastError () returned 0x578 [0154.762] CanUserWritePwrScheme () returned 0 [0154.763] GetSystemMetrics (nIndex=46) returned 2 [0154.763] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.763] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.763] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.763] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.774] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.774] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.774] GetLastError () returned 0x578 [0154.774] CanUserWritePwrScheme () returned 0 [0154.775] GetSystemMetrics (nIndex=46) returned 2 [0154.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.775] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.775] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.775] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.786] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.786] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.786] GetLastError () returned 0x578 [0154.786] CanUserWritePwrScheme () returned 0 [0154.787] GetSystemMetrics (nIndex=46) returned 2 [0154.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.799] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.799] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.799] GetLastError () returned 0x578 [0154.799] CanUserWritePwrScheme () returned 0 [0154.800] GetSystemMetrics (nIndex=46) returned 2 [0154.800] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.800] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.800] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.800] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.811] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.811] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.811] GetLastError () returned 0x578 [0154.811] CanUserWritePwrScheme () returned 0 [0154.812] GetSystemMetrics (nIndex=46) returned 2 [0154.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.812] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.812] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.812] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.824] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.824] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.824] GetLastError () returned 0x578 [0154.824] CanUserWritePwrScheme () returned 0 [0154.825] GetSystemMetrics (nIndex=46) returned 2 [0154.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.825] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.825] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.825] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.835] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.835] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.835] GetLastError () returned 0x578 [0154.835] CanUserWritePwrScheme () returned 0 [0154.836] GetSystemMetrics (nIndex=46) returned 2 [0154.836] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.836] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.836] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.836] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.847] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.847] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.847] GetLastError () returned 0x578 [0154.847] CanUserWritePwrScheme () returned 0 [0154.848] GetSystemMetrics (nIndex=46) returned 2 [0154.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.848] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.848] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.848] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.860] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.860] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.860] GetLastError () returned 0x578 [0154.860] CanUserWritePwrScheme () returned 0 [0154.861] GetSystemMetrics (nIndex=46) returned 2 [0154.861] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.872] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.872] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.872] GetLastError () returned 0x578 [0154.872] CanUserWritePwrScheme () returned 0 [0154.873] GetSystemMetrics (nIndex=46) returned 2 [0154.873] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.873] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.873] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.873] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.885] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.885] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.885] GetLastError () returned 0x578 [0154.886] CanUserWritePwrScheme () returned 0 [0154.886] GetSystemMetrics (nIndex=46) returned 2 [0154.886] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.886] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.886] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.887] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.897] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.897] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.897] GetLastError () returned 0x578 [0154.897] CanUserWritePwrScheme () returned 0 [0154.898] GetSystemMetrics (nIndex=46) returned 2 [0154.898] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.898] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.898] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.898] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.909] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.909] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.909] GetLastError () returned 0x578 [0154.909] CanUserWritePwrScheme () returned 0 [0154.910] GetSystemMetrics (nIndex=46) returned 2 [0154.910] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.910] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.910] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.910] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.922] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.923] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.923] GetLastError () returned 0x578 [0154.923] CanUserWritePwrScheme () returned 0 [0154.923] GetSystemMetrics (nIndex=46) returned 2 [0154.923] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.924] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.924] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.924] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.934] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.934] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.934] GetLastError () returned 0x578 [0154.934] CanUserWritePwrScheme () returned 0 [0154.935] GetSystemMetrics (nIndex=46) returned 2 [0154.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.946] GetLastError () returned 0x578 [0154.946] CanUserWritePwrScheme () returned 0 [0154.947] GetSystemMetrics (nIndex=46) returned 2 [0154.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.947] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.947] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.947] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.959] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.959] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.959] GetLastError () returned 0x578 [0154.959] CanUserWritePwrScheme () returned 0 [0154.960] GetSystemMetrics (nIndex=46) returned 2 [0154.960] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.960] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.960] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.960] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.971] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.971] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.971] GetLastError () returned 0x578 [0154.971] CanUserWritePwrScheme () returned 0 [0154.972] GetSystemMetrics (nIndex=46) returned 2 [0154.972] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.972] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.972] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.972] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.986] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.986] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.986] GetLastError () returned 0x578 [0154.986] CanUserWritePwrScheme () returned 0 [0154.987] GetSystemMetrics (nIndex=46) returned 2 [0154.987] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.987] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.987] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.987] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.997] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.997] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.997] GetLastError () returned 0x578 [0154.997] CanUserWritePwrScheme () returned 0 [0154.998] GetSystemMetrics (nIndex=46) returned 2 [0154.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.998] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.998] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.998] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.003] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.003] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.003] GetLastError () returned 0x578 [0155.003] CanUserWritePwrScheme () returned 0 [0155.004] GetSystemMetrics (nIndex=46) returned 2 [0155.004] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.004] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.004] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.004] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.009] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.009] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.009] GetLastError () returned 0x578 [0155.009] CanUserWritePwrScheme () returned 0 [0155.010] GetSystemMetrics (nIndex=46) returned 2 [0155.010] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.010] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.010] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.010] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.015] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.015] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.015] GetLastError () returned 0x578 [0155.015] CanUserWritePwrScheme () returned 0 [0155.016] GetSystemMetrics (nIndex=46) returned 2 [0155.016] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.016] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.016] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.016] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.022] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.022] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.022] GetLastError () returned 0x578 [0155.022] CanUserWritePwrScheme () returned 0 [0155.023] GetSystemMetrics (nIndex=46) returned 2 [0155.023] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.023] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.023] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.023] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.028] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.028] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.028] GetLastError () returned 0x578 [0155.028] CanUserWritePwrScheme () returned 0 [0155.029] GetSystemMetrics (nIndex=46) returned 2 [0155.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.029] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.029] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.029] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.034] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.034] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.034] GetLastError () returned 0x578 [0155.034] CanUserWritePwrScheme () returned 0 [0155.035] GetSystemMetrics (nIndex=46) returned 2 [0155.035] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.035] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.035] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.035] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.039] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.040] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.040] GetLastError () returned 0x578 [0155.040] CanUserWritePwrScheme () returned 0 [0155.040] GetSystemMetrics (nIndex=46) returned 2 [0155.040] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.045] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.045] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.045] GetLastError () returned 0x578 [0155.045] CanUserWritePwrScheme () returned 0 [0155.046] GetSystemMetrics (nIndex=46) returned 2 [0155.046] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.046] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.046] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.046] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.051] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.051] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.051] GetLastError () returned 0x578 [0155.051] CanUserWritePwrScheme () returned 0 [0155.052] GetSystemMetrics (nIndex=46) returned 2 [0155.052] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.052] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.052] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.052] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.057] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.057] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.057] GetLastError () returned 0x578 [0155.057] CanUserWritePwrScheme () returned 0 [0155.059] GetSystemMetrics (nIndex=46) returned 2 [0155.060] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.060] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.060] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.060] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.064] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.064] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.064] GetLastError () returned 0x578 [0155.064] CanUserWritePwrScheme () returned 0 [0155.065] GetSystemMetrics (nIndex=46) returned 2 [0155.065] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.065] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.065] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.065] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.071] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.071] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.071] GetLastError () returned 0x578 [0155.071] CanUserWritePwrScheme () returned 0 [0155.071] GetSystemMetrics (nIndex=46) returned 2 [0155.072] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.072] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.072] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.072] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.082] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.082] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.082] GetLastError () returned 0x578 [0155.082] CanUserWritePwrScheme () returned 0 [0155.083] GetSystemMetrics (nIndex=46) returned 2 [0155.083] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.083] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.083] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.083] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.094] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.094] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.094] GetLastError () returned 0x578 [0155.094] CanUserWritePwrScheme () returned 0 [0155.095] GetSystemMetrics (nIndex=46) returned 2 [0155.095] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.095] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.095] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.095] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.107] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.107] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.107] GetLastError () returned 0x578 [0155.107] CanUserWritePwrScheme () returned 0 [0155.108] GetSystemMetrics (nIndex=46) returned 2 [0155.108] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.108] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.108] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.108] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.119] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.119] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.119] GetLastError () returned 0x578 [0155.119] CanUserWritePwrScheme () returned 0 [0155.120] GetSystemMetrics (nIndex=46) returned 2 [0155.120] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.120] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.120] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.120] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.131] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.131] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.131] GetLastError () returned 0x578 [0155.131] CanUserWritePwrScheme () returned 0 [0155.132] GetSystemMetrics (nIndex=46) returned 2 [0155.132] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.132] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.132] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.132] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.144] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.144] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.144] GetLastError () returned 0x578 [0155.144] CanUserWritePwrScheme () returned 0 [0155.145] GetSystemMetrics (nIndex=46) returned 2 [0155.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.145] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.145] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.145] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.158] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.158] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.158] GetLastError () returned 0x578 [0155.158] CanUserWritePwrScheme () returned 0 [0155.159] GetSystemMetrics (nIndex=46) returned 2 [0155.159] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.159] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.159] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.159] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.195] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.195] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.195] GetLastError () returned 0x578 [0155.195] CanUserWritePwrScheme () returned 0 [0155.196] GetSystemMetrics (nIndex=46) returned 2 [0155.196] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.196] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.196] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.196] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.207] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.207] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.207] GetLastError () returned 0x578 [0155.207] CanUserWritePwrScheme () returned 0 [0155.208] GetSystemMetrics (nIndex=46) returned 2 [0155.208] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.208] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.208] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.208] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.218] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.218] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.218] GetLastError () returned 0x578 [0155.218] CanUserWritePwrScheme () returned 0 [0155.219] GetSystemMetrics (nIndex=46) returned 2 [0155.219] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.219] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.219] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.219] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.231] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.231] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.231] GetLastError () returned 0x578 [0155.231] CanUserWritePwrScheme () returned 0 [0155.232] GetSystemMetrics (nIndex=46) returned 2 [0155.232] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.232] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.232] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.232] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.243] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.243] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.243] GetLastError () returned 0x578 [0155.243] CanUserWritePwrScheme () returned 0 [0155.244] GetSystemMetrics (nIndex=46) returned 2 [0155.244] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.244] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.244] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.244] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.254] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.255] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.255] GetLastError () returned 0x578 [0155.255] CanUserWritePwrScheme () returned 0 [0155.256] GetSystemMetrics (nIndex=46) returned 2 [0155.256] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.256] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.256] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.256] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.268] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.268] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.268] GetLastError () returned 0x578 [0155.268] CanUserWritePwrScheme () returned 0 [0155.269] GetSystemMetrics (nIndex=46) returned 2 [0155.269] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.269] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.269] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.269] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.279] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.279] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.279] GetLastError () returned 0x578 [0155.280] CanUserWritePwrScheme () returned 0 [0155.280] GetSystemMetrics (nIndex=46) returned 2 [0155.280] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.280] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.280] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.280] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.291] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.291] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.291] GetLastError () returned 0x578 [0155.291] CanUserWritePwrScheme () returned 0 [0155.292] GetSystemMetrics (nIndex=46) returned 2 [0155.292] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.292] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.292] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.292] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.302] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.302] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.302] GetLastError () returned 0x578 [0155.302] CanUserWritePwrScheme () returned 0 [0155.303] GetSystemMetrics (nIndex=46) returned 2 [0155.303] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.303] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.303] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.303] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.317] GetLastError () returned 0x578 [0155.317] CanUserWritePwrScheme () returned 0 [0155.317] GetSystemMetrics (nIndex=46) returned 2 [0155.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.318] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.328] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.328] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.328] GetLastError () returned 0x578 [0155.328] CanUserWritePwrScheme () returned 0 [0155.329] GetSystemMetrics (nIndex=46) returned 2 [0155.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.340] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.340] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.340] GetLastError () returned 0x578 [0155.340] CanUserWritePwrScheme () returned 0 [0155.341] GetSystemMetrics (nIndex=46) returned 2 [0155.341] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.341] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.341] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.341] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.352] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.352] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.352] GetLastError () returned 0x578 [0155.352] CanUserWritePwrScheme () returned 0 [0155.355] GetSystemMetrics (nIndex=46) returned 2 [0155.355] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.355] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.355] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.355] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.365] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.365] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.365] GetLastError () returned 0x578 [0155.365] CanUserWritePwrScheme () returned 0 [0155.366] GetSystemMetrics (nIndex=46) returned 2 [0155.366] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.366] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.366] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.366] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.377] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.377] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.377] GetLastError () returned 0x578 [0155.377] CanUserWritePwrScheme () returned 0 [0155.378] GetSystemMetrics (nIndex=46) returned 2 [0155.378] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.378] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.378] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.378] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.388] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.388] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.389] GetLastError () returned 0x578 [0155.389] CanUserWritePwrScheme () returned 0 [0155.389] GetSystemMetrics (nIndex=46) returned 2 [0155.389] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.389] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.389] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.389] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.407] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.407] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.407] GetLastError () returned 0x578 [0155.407] CanUserWritePwrScheme () returned 0 [0155.408] GetSystemMetrics (nIndex=46) returned 2 [0155.408] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.408] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.408] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.408] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.419] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.419] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.419] GetLastError () returned 0x578 [0155.419] CanUserWritePwrScheme () returned 0 [0155.420] GetSystemMetrics (nIndex=46) returned 2 [0155.420] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.420] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.420] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.420] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.431] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.431] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.431] GetLastError () returned 0x578 [0155.431] CanUserWritePwrScheme () returned 0 [0155.432] GetSystemMetrics (nIndex=46) returned 2 [0155.432] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.432] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.432] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.432] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.442] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.442] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.442] GetLastError () returned 0x578 [0155.442] CanUserWritePwrScheme () returned 0 [0155.443] GetSystemMetrics (nIndex=46) returned 2 [0155.443] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.443] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.443] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.443] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.456] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.456] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.456] GetLastError () returned 0x578 [0155.456] CanUserWritePwrScheme () returned 0 [0155.457] GetSystemMetrics (nIndex=46) returned 2 [0155.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.457] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.457] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.457] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.468] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.468] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.468] GetLastError () returned 0x578 [0155.468] CanUserWritePwrScheme () returned 0 [0155.469] GetSystemMetrics (nIndex=46) returned 2 [0155.469] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.469] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.469] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.469] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.480] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.481] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.481] GetLastError () returned 0x578 [0155.481] CanUserWritePwrScheme () returned 0 [0155.481] GetSystemMetrics (nIndex=46) returned 2 [0155.481] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.482] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.482] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.482] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.492] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.492] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.492] GetLastError () returned 0x578 [0155.492] CanUserWritePwrScheme () returned 0 [0155.493] GetSystemMetrics (nIndex=46) returned 2 [0155.493] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.493] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.493] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.493] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.506] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.506] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.506] GetLastError () returned 0x578 [0155.506] CanUserWritePwrScheme () returned 0 [0155.507] GetSystemMetrics (nIndex=46) returned 2 [0155.507] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.507] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.507] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.507] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.518] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.518] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.518] GetLastError () returned 0x578 [0155.518] CanUserWritePwrScheme () returned 0 [0155.519] GetSystemMetrics (nIndex=46) returned 2 [0155.519] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.519] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.519] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.519] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.529] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.529] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.529] GetLastError () returned 0x578 [0155.529] CanUserWritePwrScheme () returned 0 [0155.530] GetSystemMetrics (nIndex=46) returned 2 [0155.530] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.530] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.530] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.530] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.541] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.541] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.541] GetLastError () returned 0x578 [0155.541] CanUserWritePwrScheme () returned 0 [0155.542] GetSystemMetrics (nIndex=46) returned 2 [0155.542] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.542] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.542] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.542] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.556] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.556] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.556] GetLastError () returned 0x578 [0155.556] CanUserWritePwrScheme () returned 0 [0155.557] GetSystemMetrics (nIndex=46) returned 2 [0155.557] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.557] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.557] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.557] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.568] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.568] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.568] GetLastError () returned 0x578 [0155.568] CanUserWritePwrScheme () returned 0 [0155.569] GetSystemMetrics (nIndex=46) returned 2 [0155.569] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.569] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.569] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.569] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.579] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.579] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.579] GetLastError () returned 0x578 [0155.579] CanUserWritePwrScheme () returned 0 [0155.580] GetSystemMetrics (nIndex=46) returned 2 [0155.580] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.580] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.580] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.580] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.591] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.591] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.591] GetLastError () returned 0x578 [0155.591] CanUserWritePwrScheme () returned 0 [0155.592] GetSystemMetrics (nIndex=46) returned 2 [0155.592] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.592] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.592] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.592] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.605] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.605] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.605] GetLastError () returned 0x578 [0155.605] CanUserWritePwrScheme () returned 0 [0155.606] GetSystemMetrics (nIndex=46) returned 2 [0155.606] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.606] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.606] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.606] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.617] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.617] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.617] GetLastError () returned 0x578 [0155.617] CanUserWritePwrScheme () returned 0 [0155.618] GetSystemMetrics (nIndex=46) returned 2 [0155.618] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.618] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.618] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.618] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.628] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.628] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.628] GetLastError () returned 0x578 [0155.628] CanUserWritePwrScheme () returned 0 [0155.629] GetSystemMetrics (nIndex=46) returned 2 [0155.629] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.629] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.629] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.629] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.641] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.641] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.641] GetLastError () returned 0x578 [0155.641] CanUserWritePwrScheme () returned 0 [0155.642] GetSystemMetrics (nIndex=46) returned 2 [0155.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.642] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.642] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.642] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.655] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.655] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.655] GetLastError () returned 0x578 [0155.655] CanUserWritePwrScheme () returned 0 [0155.656] GetSystemMetrics (nIndex=46) returned 2 [0155.656] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.656] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.656] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.656] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.667] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.667] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.667] GetLastError () returned 0x578 [0155.667] CanUserWritePwrScheme () returned 0 [0155.668] GetSystemMetrics (nIndex=46) returned 2 [0155.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.668] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.668] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.668] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.679] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.679] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.679] GetLastError () returned 0x578 [0155.679] CanUserWritePwrScheme () returned 0 [0155.680] GetSystemMetrics (nIndex=46) returned 2 [0155.680] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.680] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.680] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.680] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.691] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.691] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.691] GetLastError () returned 0x578 [0155.691] CanUserWritePwrScheme () returned 0 [0155.692] GetSystemMetrics (nIndex=46) returned 2 [0155.692] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.692] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.692] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.692] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.705] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.705] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.705] GetLastError () returned 0x578 [0155.705] CanUserWritePwrScheme () returned 0 [0155.706] GetSystemMetrics (nIndex=46) returned 2 [0155.706] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.706] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.706] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.706] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.716] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.716] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.716] GetLastError () returned 0x578 [0155.716] CanUserWritePwrScheme () returned 0 [0155.717] GetSystemMetrics (nIndex=46) returned 2 [0155.717] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.717] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.717] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.717] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.729] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.729] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.729] GetLastError () returned 0x578 [0155.729] CanUserWritePwrScheme () returned 0 [0155.730] GetSystemMetrics (nIndex=46) returned 2 [0155.730] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.730] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.730] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.730] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.741] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.741] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.741] GetLastError () returned 0x578 [0155.741] CanUserWritePwrScheme () returned 0 [0155.742] GetSystemMetrics (nIndex=46) returned 2 [0155.742] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.742] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.742] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.742] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.754] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.754] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.754] GetLastError () returned 0x578 [0155.754] CanUserWritePwrScheme () returned 0 [0155.755] GetSystemMetrics (nIndex=46) returned 2 [0155.755] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.755] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.755] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.756] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.766] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.766] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.766] GetLastError () returned 0x578 [0155.766] CanUserWritePwrScheme () returned 0 [0155.767] GetSystemMetrics (nIndex=46) returned 2 [0155.767] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.767] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.767] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.767] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.779] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.779] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.779] GetLastError () returned 0x578 [0155.779] CanUserWritePwrScheme () returned 0 [0155.779] GetSystemMetrics (nIndex=46) returned 2 [0155.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.790] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.790] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.791] GetLastError () returned 0x578 [0155.791] CanUserWritePwrScheme () returned 0 [0155.791] GetSystemMetrics (nIndex=46) returned 2 [0155.791] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.791] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.792] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.792] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.802] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.802] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.802] GetLastError () returned 0x578 [0155.802] CanUserWritePwrScheme () returned 0 [0155.805] GetSystemMetrics (nIndex=46) returned 2 [0155.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.816] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.816] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.816] GetLastError () returned 0x578 [0155.816] CanUserWritePwrScheme () returned 0 [0155.817] GetSystemMetrics (nIndex=46) returned 2 [0155.817] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.817] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.817] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.817] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.828] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.828] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.828] GetLastError () returned 0x578 [0155.828] CanUserWritePwrScheme () returned 0 [0155.829] GetSystemMetrics (nIndex=46) returned 2 [0155.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.829] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.829] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.829] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.839] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.839] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.839] GetLastError () returned 0x578 [0155.839] CanUserWritePwrScheme () returned 0 [0155.840] GetSystemMetrics (nIndex=46) returned 2 [0155.840] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.840] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.840] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.840] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.851] GetLastError () returned 0x578 [0155.851] CanUserWritePwrScheme () returned 0 [0155.852] GetSystemMetrics (nIndex=46) returned 2 [0155.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.852] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.852] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.852] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.866] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.866] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.866] GetLastError () returned 0x578 [0155.866] CanUserWritePwrScheme () returned 0 [0155.867] GetSystemMetrics (nIndex=46) returned 2 [0155.867] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.867] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.867] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.867] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.878] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.878] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.878] GetLastError () returned 0x578 [0155.878] CanUserWritePwrScheme () returned 0 [0155.879] GetSystemMetrics (nIndex=46) returned 2 [0155.879] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.879] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.879] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.879] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.890] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.890] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.890] GetLastError () returned 0x578 [0155.890] CanUserWritePwrScheme () returned 0 [0155.891] GetSystemMetrics (nIndex=46) returned 2 [0155.891] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.891] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.891] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.891] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.904] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.904] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.904] GetLastError () returned 0x578 [0155.904] CanUserWritePwrScheme () returned 0 [0155.905] GetSystemMetrics (nIndex=46) returned 2 [0155.905] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.905] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.905] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.905] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.918] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.918] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.918] GetLastError () returned 0x578 [0155.918] CanUserWritePwrScheme () returned 0 [0155.919] GetSystemMetrics (nIndex=46) returned 2 [0155.919] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.919] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.919] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.919] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.929] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.929] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.929] GetLastError () returned 0x578 [0155.929] CanUserWritePwrScheme () returned 0 [0155.930] GetSystemMetrics (nIndex=46) returned 2 [0155.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.930] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.941] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.941] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.941] GetLastError () returned 0x578 [0155.941] CanUserWritePwrScheme () returned 0 [0155.942] GetSystemMetrics (nIndex=46) returned 2 [0155.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.953] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.953] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.953] GetLastError () returned 0x578 [0155.953] CanUserWritePwrScheme () returned 0 [0155.954] GetSystemMetrics (nIndex=46) returned 2 [0155.954] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.954] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.954] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.954] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.965] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.965] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.965] GetLastError () returned 0x578 [0155.965] CanUserWritePwrScheme () returned 0 [0155.966] GetSystemMetrics (nIndex=46) returned 2 [0155.966] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.966] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.966] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.966] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.979] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.979] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.979] GetLastError () returned 0x578 [0155.979] CanUserWritePwrScheme () returned 0 [0155.980] GetSystemMetrics (nIndex=46) returned 2 [0155.980] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.980] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.980] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.980] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.990] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.990] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.991] GetLastError () returned 0x578 [0155.991] CanUserWritePwrScheme () returned 0 [0155.991] GetSystemMetrics (nIndex=46) returned 2 [0155.991] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.991] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.992] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.992] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.002] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.002] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.002] GetLastError () returned 0x578 [0156.002] CanUserWritePwrScheme () returned 0 [0156.003] GetSystemMetrics (nIndex=46) returned 2 [0156.003] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.003] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.003] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.003] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.014] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.014] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.015] GetLastError () returned 0x578 [0156.015] CanUserWritePwrScheme () returned 0 [0156.015] GetSystemMetrics (nIndex=46) returned 2 [0156.015] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.015] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.016] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.016] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.027] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.027] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.027] GetLastError () returned 0x578 [0156.027] CanUserWritePwrScheme () returned 0 [0156.028] GetSystemMetrics (nIndex=46) returned 2 [0156.028] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.028] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.028] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.028] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.041] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.041] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.041] GetLastError () returned 0x578 [0156.041] CanUserWritePwrScheme () returned 0 [0156.042] GetSystemMetrics (nIndex=46) returned 2 [0156.042] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.042] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.042] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.042] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.053] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.053] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.053] GetLastError () returned 0x578 [0156.053] CanUserWritePwrScheme () returned 0 [0156.054] GetSystemMetrics (nIndex=46) returned 2 [0156.054] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.054] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.054] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.054] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.065] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.065] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.065] GetLastError () returned 0x578 [0156.065] CanUserWritePwrScheme () returned 0 [0156.066] GetSystemMetrics (nIndex=46) returned 2 [0156.066] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.066] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.066] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.066] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.077] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.077] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.077] GetLastError () returned 0x578 [0156.077] CanUserWritePwrScheme () returned 0 [0156.078] GetSystemMetrics (nIndex=46) returned 2 [0156.078] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.078] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.078] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.078] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.176] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.176] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.176] GetLastError () returned 0x578 [0156.176] CanUserWritePwrScheme () returned 0 [0156.177] GetSystemMetrics (nIndex=46) returned 2 [0156.177] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.177] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.177] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.177] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.188] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.188] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.188] GetLastError () returned 0x578 [0156.188] CanUserWritePwrScheme () returned 0 [0156.189] GetSystemMetrics (nIndex=46) returned 2 [0156.189] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.189] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.189] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.189] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.200] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.200] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.200] GetLastError () returned 0x578 [0156.200] CanUserWritePwrScheme () returned 0 [0156.201] GetSystemMetrics (nIndex=46) returned 2 [0156.201] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.201] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.201] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.201] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.212] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.212] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.212] GetLastError () returned 0x578 [0156.212] CanUserWritePwrScheme () returned 0 [0156.213] GetSystemMetrics (nIndex=46) returned 2 [0156.213] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.213] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.213] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.213] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.226] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.226] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.227] GetLastError () returned 0x578 [0156.227] CanUserWritePwrScheme () returned 0 [0156.227] GetSystemMetrics (nIndex=46) returned 2 [0156.227] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.227] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.228] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.228] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.238] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.238] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.238] GetLastError () returned 0x578 [0156.238] CanUserWritePwrScheme () returned 0 [0156.239] GetSystemMetrics (nIndex=46) returned 2 [0156.239] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.239] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.239] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.239] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.250] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.250] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.250] GetLastError () returned 0x578 [0156.250] CanUserWritePwrScheme () returned 0 [0156.251] GetSystemMetrics (nIndex=46) returned 2 [0156.251] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.251] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.251] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.251] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.262] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.262] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.262] GetLastError () returned 0x578 [0156.262] CanUserWritePwrScheme () returned 0 [0156.263] GetSystemMetrics (nIndex=46) returned 2 [0156.263] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.263] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.263] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.263] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.274] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.274] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.274] GetLastError () returned 0x578 [0156.274] CanUserWritePwrScheme () returned 0 [0156.275] GetSystemMetrics (nIndex=46) returned 2 [0156.275] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.275] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.275] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.275] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.289] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.289] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.289] GetLastError () returned 0x578 [0156.289] CanUserWritePwrScheme () returned 0 [0156.290] GetSystemMetrics (nIndex=46) returned 2 [0156.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.301] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.301] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.301] GetLastError () returned 0x578 [0156.301] CanUserWritePwrScheme () returned 0 [0156.302] GetSystemMetrics (nIndex=46) returned 2 [0156.302] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.302] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.302] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.302] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.312] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.312] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.312] GetLastError () returned 0x578 [0156.312] CanUserWritePwrScheme () returned 0 [0156.313] GetSystemMetrics (nIndex=46) returned 2 [0156.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.313] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.313] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.313] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.324] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.324] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.324] GetLastError () returned 0x578 [0156.324] CanUserWritePwrScheme () returned 0 [0156.325] GetSystemMetrics (nIndex=46) returned 2 [0156.325] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.325] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.325] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.325] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.336] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.336] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.336] GetLastError () returned 0x578 [0156.336] CanUserWritePwrScheme () returned 0 [0156.337] GetSystemMetrics (nIndex=46) returned 2 [0156.337] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.337] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.337] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.337] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.351] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.351] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.351] GetLastError () returned 0x578 [0156.351] CanUserWritePwrScheme () returned 0 [0156.352] GetSystemMetrics (nIndex=46) returned 2 [0156.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.352] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.352] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.352] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.363] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.363] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.363] GetLastError () returned 0x578 [0156.363] CanUserWritePwrScheme () returned 0 [0156.364] GetSystemMetrics (nIndex=46) returned 2 [0156.364] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.364] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.364] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.364] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.375] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.375] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.375] GetLastError () returned 0x578 [0156.375] CanUserWritePwrScheme () returned 0 [0156.376] GetSystemMetrics (nIndex=46) returned 2 [0156.376] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.376] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.376] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.376] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.387] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.387] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.387] GetLastError () returned 0x578 [0156.387] CanUserWritePwrScheme () returned 0 [0156.388] GetSystemMetrics (nIndex=46) returned 2 [0156.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.388] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.388] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.388] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.406] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.406] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.406] GetLastError () returned 0x578 [0156.406] CanUserWritePwrScheme () returned 0 [0156.409] GetSystemMetrics (nIndex=46) returned 2 [0156.409] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.409] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.409] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.409] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.420] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.420] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.420] GetLastError () returned 0x578 [0156.420] CanUserWritePwrScheme () returned 0 [0156.421] GetSystemMetrics (nIndex=46) returned 2 [0156.421] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.421] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.421] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.421] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.432] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.432] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.432] GetLastError () returned 0x578 [0156.432] CanUserWritePwrScheme () returned 0 [0156.433] GetSystemMetrics (nIndex=46) returned 2 [0156.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.433] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.433] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.433] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.444] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.444] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.444] GetLastError () returned 0x578 [0156.444] CanUserWritePwrScheme () returned 0 [0156.445] GetSystemMetrics (nIndex=46) returned 2 [0156.445] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.445] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.445] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.445] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.456] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.456] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.456] GetLastError () returned 0x578 [0156.456] CanUserWritePwrScheme () returned 0 [0156.457] GetSystemMetrics (nIndex=46) returned 2 [0156.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.457] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.457] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.457] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.467] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.467] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.467] GetLastError () returned 0x578 [0156.467] CanUserWritePwrScheme () returned 0 [0156.468] GetSystemMetrics (nIndex=46) returned 2 [0156.468] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.468] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.468] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.468] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.482] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.482] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.482] GetLastError () returned 0x578 [0156.482] CanUserWritePwrScheme () returned 0 [0156.483] GetSystemMetrics (nIndex=46) returned 2 [0156.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.483] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.483] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.483] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.494] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.495] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.495] GetLastError () returned 0x578 [0156.495] CanUserWritePwrScheme () returned 0 [0156.495] GetSystemMetrics (nIndex=46) returned 2 [0156.496] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.496] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.496] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.496] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.506] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.506] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.506] GetLastError () returned 0x578 [0156.506] CanUserWritePwrScheme () returned 0 [0156.507] GetSystemMetrics (nIndex=46) returned 2 [0156.507] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.507] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.507] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.507] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.518] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.518] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.518] GetLastError () returned 0x578 [0156.518] CanUserWritePwrScheme () returned 0 [0156.519] GetSystemMetrics (nIndex=46) returned 2 [0156.519] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.519] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.519] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.519] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.530] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.530] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.530] GetLastError () returned 0x578 [0156.530] CanUserWritePwrScheme () returned 0 [0156.531] GetSystemMetrics (nIndex=46) returned 2 [0156.531] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.531] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.531] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.531] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.545] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.545] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.545] GetLastError () returned 0x578 [0156.545] CanUserWritePwrScheme () returned 0 [0156.546] GetSystemMetrics (nIndex=46) returned 2 [0156.546] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.546] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.546] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.546] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.557] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.557] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.557] GetLastError () returned 0x578 [0156.557] CanUserWritePwrScheme () returned 0 [0156.558] GetSystemMetrics (nIndex=46) returned 2 [0156.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.558] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.558] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.558] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.569] GetLastError () returned 0x578 [0156.569] CanUserWritePwrScheme () returned 0 [0156.570] GetSystemMetrics (nIndex=46) returned 2 [0156.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.570] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.570] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.570] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.581] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.581] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.581] GetLastError () returned 0x578 [0156.581] CanUserWritePwrScheme () returned 0 [0156.582] GetSystemMetrics (nIndex=46) returned 2 [0156.582] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.582] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.582] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.582] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.592] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.592] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.592] GetLastError () returned 0x578 [0156.593] CanUserWritePwrScheme () returned 0 [0156.593] GetSystemMetrics (nIndex=46) returned 2 [0156.593] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.593] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.593] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.594] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.607] GetLastError () returned 0x578 [0156.607] CanUserWritePwrScheme () returned 0 [0156.608] GetSystemMetrics (nIndex=46) returned 2 [0156.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.608] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.608] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.608] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.619] GetLastError () returned 0x578 [0156.619] CanUserWritePwrScheme () returned 0 [0156.620] GetSystemMetrics (nIndex=46) returned 2 [0156.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.631] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.631] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.631] GetLastError () returned 0x578 [0156.631] CanUserWritePwrScheme () returned 0 [0156.632] GetSystemMetrics (nIndex=46) returned 2 [0156.632] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.632] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.632] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.632] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.645] GetLastError () returned 0x578 [0156.645] CanUserWritePwrScheme () returned 0 [0156.646] GetSystemMetrics (nIndex=46) returned 2 [0156.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.657] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.657] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.657] GetLastError () returned 0x578 [0156.657] CanUserWritePwrScheme () returned 0 [0156.658] GetSystemMetrics (nIndex=46) returned 2 [0156.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.658] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.658] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.658] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.682] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.682] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.683] GetLastError () returned 0x578 [0156.683] CanUserWritePwrScheme () returned 0 [0156.684] GetSystemMetrics (nIndex=46) returned 2 [0156.684] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.684] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.684] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.695] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.695] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.695] GetLastError () returned 0x578 [0156.695] CanUserWritePwrScheme () returned 0 [0156.696] GetSystemMetrics (nIndex=46) returned 2 [0156.696] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.696] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.696] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.696] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.707] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.707] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.707] GetLastError () returned 0x578 [0156.707] CanUserWritePwrScheme () returned 0 [0156.708] GetSystemMetrics (nIndex=46) returned 2 [0156.708] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.708] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.708] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.708] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.719] GetLastError () returned 0x578 [0156.719] CanUserWritePwrScheme () returned 0 [0156.720] GetSystemMetrics (nIndex=46) returned 2 [0156.720] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.720] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.720] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.720] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.731] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.731] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.731] GetLastError () returned 0x578 [0156.731] CanUserWritePwrScheme () returned 0 [0156.734] GetSystemMetrics (nIndex=46) returned 2 [0156.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.734] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.734] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.734] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.745] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.745] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.745] GetLastError () returned 0x578 [0156.745] CanUserWritePwrScheme () returned 0 [0156.746] GetSystemMetrics (nIndex=46) returned 2 [0156.746] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.746] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.746] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.746] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.757] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.757] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.757] GetLastError () returned 0x578 [0156.757] CanUserWritePwrScheme () returned 0 [0156.758] GetSystemMetrics (nIndex=46) returned 2 [0156.758] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.758] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.758] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.758] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.769] GetLastError () returned 0x578 [0156.769] CanUserWritePwrScheme () returned 0 [0156.770] GetSystemMetrics (nIndex=46) returned 2 [0156.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.781] GetLastError () returned 0x578 [0156.781] CanUserWritePwrScheme () returned 0 [0156.782] GetSystemMetrics (nIndex=46) returned 2 [0156.782] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.782] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.782] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.782] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.793] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.793] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.793] GetLastError () returned 0x578 [0156.793] CanUserWritePwrScheme () returned 0 [0156.794] GetSystemMetrics (nIndex=46) returned 2 [0156.794] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.794] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.794] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.794] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.865] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.865] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.865] GetLastError () returned 0x578 [0156.866] CanUserWritePwrScheme () returned 0 [0156.866] GetSystemMetrics (nIndex=46) returned 2 [0156.866] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.866] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.866] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.867] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.877] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.877] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.877] GetLastError () returned 0x578 [0156.877] CanUserWritePwrScheme () returned 0 [0156.879] GetSystemMetrics (nIndex=46) returned 2 [0156.879] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.879] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.879] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.879] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.889] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.889] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.889] GetLastError () returned 0x578 [0156.889] CanUserWritePwrScheme () returned 0 [0156.890] GetSystemMetrics (nIndex=46) returned 2 [0156.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.890] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.949] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.949] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.949] GetLastError () returned 0x578 [0156.949] CanUserWritePwrScheme () returned 0 [0156.950] GetSystemMetrics (nIndex=46) returned 2 [0156.950] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.950] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.950] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.950] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.960] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.961] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.961] GetLastError () returned 0x578 [0156.961] CanUserWritePwrScheme () returned 0 [0156.961] GetSystemMetrics (nIndex=46) returned 2 [0156.962] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.962] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.962] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.962] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.972] GetLastError () returned 0x578 [0156.972] CanUserWritePwrScheme () returned 0 [0156.973] GetSystemMetrics (nIndex=46) returned 2 [0156.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.984] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.984] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.984] GetLastError () returned 0x578 [0156.984] CanUserWritePwrScheme () returned 0 [0156.985] GetSystemMetrics (nIndex=46) returned 2 [0156.985] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.985] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.985] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.985] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.998] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.998] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.998] GetLastError () returned 0x578 [0156.998] CanUserWritePwrScheme () returned 0 [0156.999] GetSystemMetrics (nIndex=46) returned 2 [0156.999] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.999] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.999] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.999] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.012] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.012] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.012] GetLastError () returned 0x578 [0157.012] CanUserWritePwrScheme () returned 0 [0157.013] GetSystemMetrics (nIndex=46) returned 2 [0157.013] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.013] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.013] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.013] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.035] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.035] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.036] GetLastError () returned 0x578 [0157.036] CanUserWritePwrScheme () returned 0 [0157.037] GetSystemMetrics (nIndex=46) returned 2 [0157.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.037] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.037] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.037] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.048] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.048] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.048] GetLastError () returned 0x578 [0157.048] CanUserWritePwrScheme () returned 0 [0157.049] GetSystemMetrics (nIndex=46) returned 2 [0157.049] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.049] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.049] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.049] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.063] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.063] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.063] GetLastError () returned 0x578 [0157.063] CanUserWritePwrScheme () returned 0 [0157.064] GetSystemMetrics (nIndex=46) returned 2 [0157.064] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.064] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.064] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.064] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.075] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.075] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.075] GetLastError () returned 0x578 [0157.075] CanUserWritePwrScheme () returned 0 [0157.076] GetSystemMetrics (nIndex=46) returned 2 [0157.076] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.076] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.076] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.076] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.087] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.087] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.087] GetLastError () returned 0x578 [0157.087] CanUserWritePwrScheme () returned 0 [0157.088] GetSystemMetrics (nIndex=46) returned 2 [0157.088] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.088] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.088] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.088] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.099] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.099] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.099] GetLastError () returned 0x578 [0157.099] CanUserWritePwrScheme () returned 0 [0157.100] GetSystemMetrics (nIndex=46) returned 2 [0157.100] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.100] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.100] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.100] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.111] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.111] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.111] GetLastError () returned 0x578 [0157.111] CanUserWritePwrScheme () returned 0 [0157.112] GetSystemMetrics (nIndex=46) returned 2 [0157.112] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.112] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.112] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.112] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.123] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.123] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.123] GetLastError () returned 0x578 [0157.123] CanUserWritePwrScheme () returned 0 [0157.124] GetSystemMetrics (nIndex=46) returned 2 [0157.124] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.124] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.124] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.124] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.137] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.137] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.137] GetLastError () returned 0x578 [0157.137] CanUserWritePwrScheme () returned 0 [0157.138] GetSystemMetrics (nIndex=46) returned 2 [0157.138] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.138] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.138] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.139] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.150] GetLastError () returned 0x578 [0157.150] CanUserWritePwrScheme () returned 0 [0157.151] GetSystemMetrics (nIndex=46) returned 2 [0157.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.151] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.151] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.151] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.166] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.166] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.166] GetLastError () returned 0x578 [0157.166] CanUserWritePwrScheme () returned 0 [0157.167] GetSystemMetrics (nIndex=46) returned 2 [0157.167] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.167] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.167] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.167] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.178] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.178] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.178] GetLastError () returned 0x578 [0157.178] CanUserWritePwrScheme () returned 0 [0157.179] GetSystemMetrics (nIndex=46) returned 2 [0157.179] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.179] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.179] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.179] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.193] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.193] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.193] GetLastError () returned 0x578 [0157.193] CanUserWritePwrScheme () returned 0 [0157.194] GetSystemMetrics (nIndex=46) returned 2 [0157.194] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.194] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.194] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.194] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.205] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.205] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.205] GetLastError () returned 0x578 [0157.205] CanUserWritePwrScheme () returned 0 [0157.206] GetSystemMetrics (nIndex=46) returned 2 [0157.206] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.206] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.206] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.206] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.216] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.216] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.216] GetLastError () returned 0x578 [0157.216] CanUserWritePwrScheme () returned 0 [0157.217] GetSystemMetrics (nIndex=46) returned 2 [0157.217] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.217] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.217] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.217] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.228] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.228] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.228] GetLastError () returned 0x578 [0157.228] CanUserWritePwrScheme () returned 0 [0157.229] GetSystemMetrics (nIndex=46) returned 2 [0157.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.229] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.229] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.229] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.240] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.240] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.240] GetLastError () returned 0x578 [0157.240] CanUserWritePwrScheme () returned 0 [0157.241] GetSystemMetrics (nIndex=46) returned 2 [0157.241] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.241] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.241] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.241] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.252] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.252] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.252] GetLastError () returned 0x578 [0157.252] CanUserWritePwrScheme () returned 0 [0157.253] GetSystemMetrics (nIndex=46) returned 2 [0157.253] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.253] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.253] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.253] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.266] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.266] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.266] GetLastError () returned 0x578 [0157.266] CanUserWritePwrScheme () returned 0 [0157.267] GetSystemMetrics (nIndex=46) returned 2 [0157.267] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.267] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.267] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.267] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.278] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.278] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.278] GetLastError () returned 0x578 [0157.278] CanUserWritePwrScheme () returned 0 [0157.279] GetSystemMetrics (nIndex=46) returned 2 [0157.279] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.279] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.279] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.279] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.290] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.290] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.290] GetLastError () returned 0x578 [0157.290] CanUserWritePwrScheme () returned 0 [0157.291] GetSystemMetrics (nIndex=46) returned 2 [0157.291] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.291] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.291] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.291] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.301] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.301] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.301] GetLastError () returned 0x578 [0157.301] CanUserWritePwrScheme () returned 0 [0157.302] GetSystemMetrics (nIndex=46) returned 2 [0157.302] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.302] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.302] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.302] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.313] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.313] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.313] GetLastError () returned 0x578 [0157.313] CanUserWritePwrScheme () returned 0 [0157.314] GetSystemMetrics (nIndex=46) returned 2 [0157.314] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.314] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.314] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.314] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.327] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.327] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.327] GetLastError () returned 0x578 [0157.328] CanUserWritePwrScheme () returned 0 [0157.328] GetSystemMetrics (nIndex=46) returned 2 [0157.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.328] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.328] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.328] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.339] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.339] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.339] GetLastError () returned 0x578 [0157.339] CanUserWritePwrScheme () returned 0 [0157.340] GetSystemMetrics (nIndex=46) returned 2 [0157.340] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.340] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.340] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.340] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.351] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.351] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.351] GetLastError () returned 0x578 [0157.351] CanUserWritePwrScheme () returned 0 [0157.352] GetSystemMetrics (nIndex=46) returned 2 [0157.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.352] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.352] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.352] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.368] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.368] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.368] GetLastError () returned 0x578 [0157.368] CanUserWritePwrScheme () returned 0 [0157.369] GetSystemMetrics (nIndex=46) returned 2 [0157.369] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.369] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.369] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.369] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.379] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.379] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.379] GetLastError () returned 0x578 [0157.379] CanUserWritePwrScheme () returned 0 [0157.380] GetSystemMetrics (nIndex=46) returned 2 [0157.380] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.380] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.380] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.380] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.394] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.394] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.394] GetLastError () returned 0x578 [0157.394] CanUserWritePwrScheme () returned 0 [0157.395] GetSystemMetrics (nIndex=46) returned 2 [0157.395] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.395] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.395] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.395] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.413] GetLastError () returned 0x578 [0157.413] CanUserWritePwrScheme () returned 0 [0157.414] GetSystemMetrics (nIndex=46) returned 2 [0157.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.414] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.414] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.414] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.424] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.424] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.424] GetLastError () returned 0x578 [0157.425] CanUserWritePwrScheme () returned 0 [0157.425] GetSystemMetrics (nIndex=46) returned 2 [0157.425] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.425] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.425] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.425] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.436] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.436] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.436] GetLastError () returned 0x578 [0157.436] CanUserWritePwrScheme () returned 0 [0157.437] GetSystemMetrics (nIndex=46) returned 2 [0157.437] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.437] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.437] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.437] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.448] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.448] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.448] GetLastError () returned 0x578 [0157.448] CanUserWritePwrScheme () returned 0 [0157.449] GetSystemMetrics (nIndex=46) returned 2 [0157.449] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.449] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.449] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.449] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.462] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.462] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.462] GetLastError () returned 0x578 [0157.462] CanUserWritePwrScheme () returned 0 [0157.463] GetSystemMetrics (nIndex=46) returned 2 [0157.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.463] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.463] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.463] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.474] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.474] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.474] GetLastError () returned 0x578 [0157.474] CanUserWritePwrScheme () returned 0 [0157.475] GetSystemMetrics (nIndex=46) returned 2 [0157.475] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.475] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.475] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.475] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.486] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.486] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.486] GetLastError () returned 0x578 [0157.486] CanUserWritePwrScheme () returned 0 [0157.487] GetSystemMetrics (nIndex=46) returned 2 [0157.487] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.487] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.487] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.487] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.498] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.498] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.498] GetLastError () returned 0x578 [0157.498] CanUserWritePwrScheme () returned 0 [0157.499] GetSystemMetrics (nIndex=46) returned 2 [0157.499] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.499] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.499] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.499] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.510] GetLastError () returned 0x578 [0157.510] CanUserWritePwrScheme () returned 0 [0157.510] GetSystemMetrics (nIndex=46) returned 2 [0157.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.511] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.511] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.511] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.523] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.523] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.523] GetLastError () returned 0x578 [0157.524] CanUserWritePwrScheme () returned 0 [0157.524] GetSystemMetrics (nIndex=46) returned 2 [0157.524] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.524] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.524] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.524] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.535] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.535] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.535] GetLastError () returned 0x578 [0157.535] CanUserWritePwrScheme () returned 0 [0157.536] GetSystemMetrics (nIndex=46) returned 2 [0157.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.546] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.546] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.546] GetLastError () returned 0x578 [0157.546] CanUserWritePwrScheme () returned 0 [0157.547] GetSystemMetrics (nIndex=46) returned 2 [0157.547] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.547] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.547] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.547] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.558] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.558] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.558] GetLastError () returned 0x578 [0157.558] CanUserWritePwrScheme () returned 0 [0157.559] GetSystemMetrics (nIndex=46) returned 2 [0157.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.559] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.559] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.559] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.570] GetLastError () returned 0x578 [0157.570] CanUserWritePwrScheme () returned 0 [0157.570] GetSystemMetrics (nIndex=46) returned 2 [0157.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.570] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.571] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.571] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.584] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.584] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.584] GetLastError () returned 0x578 [0157.584] CanUserWritePwrScheme () returned 0 [0157.585] GetSystemMetrics (nIndex=46) returned 2 [0157.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.585] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.585] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.585] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.596] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.596] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.596] GetLastError () returned 0x578 [0157.596] CanUserWritePwrScheme () returned 0 [0157.597] GetSystemMetrics (nIndex=46) returned 2 [0157.597] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.597] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.597] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.597] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.608] GetLastError () returned 0x578 [0157.608] CanUserWritePwrScheme () returned 0 [0157.608] GetSystemMetrics (nIndex=46) returned 2 [0157.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.608] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.609] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.609] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.619] GetLastError () returned 0x578 [0157.619] CanUserWritePwrScheme () returned 0 [0157.620] GetSystemMetrics (nIndex=46) returned 2 [0157.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.625] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.625] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.625] GetLastError () returned 0x578 [0157.625] CanUserWritePwrScheme () returned 0 [0157.626] GetSystemMetrics (nIndex=46) returned 2 [0157.626] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.626] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.626] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.626] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.639] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.639] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.639] GetLastError () returned 0x578 [0157.640] CanUserWritePwrScheme () returned 0 [0157.640] GetSystemMetrics (nIndex=46) returned 2 [0157.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.640] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.640] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.640] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.654] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.654] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.654] GetLastError () returned 0x578 [0157.654] CanUserWritePwrScheme () returned 0 [0157.655] GetSystemMetrics (nIndex=46) returned 2 [0157.655] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.655] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.655] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.655] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.666] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.666] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.666] GetLastError () returned 0x578 [0157.666] CanUserWritePwrScheme () returned 0 [0157.667] GetSystemMetrics (nIndex=46) returned 2 [0157.667] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.667] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.667] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.667] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.678] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.678] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.678] GetLastError () returned 0x578 [0157.678] CanUserWritePwrScheme () returned 0 [0157.678] GetSystemMetrics (nIndex=46) returned 2 [0157.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.679] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.692] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.692] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.692] GetLastError () returned 0x578 [0157.692] CanUserWritePwrScheme () returned 0 [0157.693] GetSystemMetrics (nIndex=46) returned 2 [0157.693] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.693] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.693] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.693] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.703] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.703] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.703] GetLastError () returned 0x578 [0157.703] CanUserWritePwrScheme () returned 0 [0157.704] GetSystemMetrics (nIndex=46) returned 2 [0157.704] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.704] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.704] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.704] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.718] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.718] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.718] GetLastError () returned 0x578 [0157.718] CanUserWritePwrScheme () returned 0 [0157.719] GetSystemMetrics (nIndex=46) returned 2 [0157.719] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.719] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.719] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.719] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.730] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.730] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.730] GetLastError () returned 0x578 [0157.730] CanUserWritePwrScheme () returned 0 [0157.731] GetSystemMetrics (nIndex=46) returned 2 [0157.731] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.731] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.731] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.731] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.741] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.741] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.741] GetLastError () returned 0x578 [0157.741] CanUserWritePwrScheme () returned 0 [0157.742] GetSystemMetrics (nIndex=46) returned 2 [0157.742] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.742] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.742] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.742] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.753] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.753] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.753] GetLastError () returned 0x578 [0157.753] CanUserWritePwrScheme () returned 0 [0157.754] GetSystemMetrics (nIndex=46) returned 2 [0157.754] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.754] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.754] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.754] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.765] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.765] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.765] GetLastError () returned 0x578 [0157.765] CanUserWritePwrScheme () returned 0 [0157.766] GetSystemMetrics (nIndex=46) returned 2 [0157.766] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.766] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.766] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.766] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.779] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.779] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.779] GetLastError () returned 0x578 [0157.779] CanUserWritePwrScheme () returned 0 [0157.780] GetSystemMetrics (nIndex=46) returned 2 [0157.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.792] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.792] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.792] GetLastError () returned 0x578 [0157.792] CanUserWritePwrScheme () returned 0 [0157.793] GetSystemMetrics (nIndex=46) returned 2 [0157.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.793] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.793] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.793] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.804] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.804] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.804] GetLastError () returned 0x578 [0157.804] CanUserWritePwrScheme () returned 0 [0157.805] GetSystemMetrics (nIndex=46) returned 2 [0157.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.815] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.815] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.815] GetLastError () returned 0x578 [0157.815] CanUserWritePwrScheme () returned 0 [0157.816] GetSystemMetrics (nIndex=46) returned 2 [0157.816] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.816] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.816] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.816] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.827] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.827] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.827] GetLastError () returned 0x578 [0157.827] CanUserWritePwrScheme () returned 0 [0157.828] GetSystemMetrics (nIndex=46) returned 2 [0157.828] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.828] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.828] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.828] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.839] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.839] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.839] GetLastError () returned 0x578 [0157.839] CanUserWritePwrScheme () returned 0 [0157.842] GetSystemMetrics (nIndex=46) returned 2 [0157.842] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.842] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.842] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.842] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.853] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.853] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.853] GetLastError () returned 0x578 [0157.853] CanUserWritePwrScheme () returned 0 [0157.854] GetSystemMetrics (nIndex=46) returned 2 [0157.854] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.854] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.854] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.854] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.867] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.868] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.868] GetLastError () returned 0x578 [0157.868] CanUserWritePwrScheme () returned 0 [0157.868] GetSystemMetrics (nIndex=46) returned 2 [0157.868] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.869] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.869] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.869] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.879] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.880] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.880] GetLastError () returned 0x578 [0157.880] CanUserWritePwrScheme () returned 0 [0157.880] GetSystemMetrics (nIndex=46) returned 2 [0157.880] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.881] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.881] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.881] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.891] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.891] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.891] GetLastError () returned 0x578 [0157.891] CanUserWritePwrScheme () returned 0 [0157.897] GetSystemMetrics (nIndex=46) returned 2 [0157.897] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.897] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.897] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.897] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.910] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.910] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.910] GetLastError () returned 0x578 [0157.910] CanUserWritePwrScheme () returned 0 [0157.911] GetSystemMetrics (nIndex=46) returned 2 [0157.911] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.911] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.911] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.911] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.921] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.921] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.922] GetLastError () returned 0x578 [0157.922] CanUserWritePwrScheme () returned 0 [0157.922] GetSystemMetrics (nIndex=46) returned 2 [0157.922] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.922] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.923] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.923] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.933] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.933] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.933] GetLastError () returned 0x578 [0157.933] CanUserWritePwrScheme () returned 0 [0157.934] GetSystemMetrics (nIndex=46) returned 2 [0157.934] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.934] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.934] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.934] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.945] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.945] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.945] GetLastError () returned 0x578 [0157.945] CanUserWritePwrScheme () returned 0 [0157.946] GetSystemMetrics (nIndex=46) returned 2 [0157.946] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.946] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.946] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.946] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.957] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.957] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.957] GetLastError () returned 0x578 [0157.957] CanUserWritePwrScheme () returned 0 [0157.958] GetSystemMetrics (nIndex=46) returned 2 [0157.958] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.958] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.958] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.958] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.968] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.968] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.968] GetLastError () returned 0x578 [0157.968] CanUserWritePwrScheme () returned 0 [0157.969] GetSystemMetrics (nIndex=46) returned 2 [0157.969] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.969] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.969] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.969] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.982] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.983] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.983] GetLastError () returned 0x578 [0157.983] CanUserWritePwrScheme () returned 0 [0157.983] GetSystemMetrics (nIndex=46) returned 2 [0157.983] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.994] GetLastError () returned 0x578 [0157.994] CanUserWritePwrScheme () returned 0 [0157.995] GetSystemMetrics (nIndex=46) returned 2 [0157.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.006] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.006] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.006] GetLastError () returned 0x578 [0158.006] CanUserWritePwrScheme () returned 0 [0158.007] GetSystemMetrics (nIndex=46) returned 2 [0158.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.007] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.007] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.007] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.018] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.018] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.018] GetLastError () returned 0x578 [0158.018] CanUserWritePwrScheme () returned 0 [0158.019] GetSystemMetrics (nIndex=46) returned 2 [0158.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.019] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.029] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.029] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.029] GetLastError () returned 0x578 [0158.029] CanUserWritePwrScheme () returned 0 [0158.030] GetSystemMetrics (nIndex=46) returned 2 [0158.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.030] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.030] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.030] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.046] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.046] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.046] GetLastError () returned 0x578 [0158.046] CanUserWritePwrScheme () returned 0 [0158.047] GetSystemMetrics (nIndex=46) returned 2 [0158.047] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.047] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.047] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.047] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.057] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.057] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.057] GetLastError () returned 0x578 [0158.057] CanUserWritePwrScheme () returned 0 [0158.058] GetSystemMetrics (nIndex=46) returned 2 [0158.058] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.058] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.058] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.058] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.069] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.069] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.069] GetLastError () returned 0x578 [0158.069] CanUserWritePwrScheme () returned 0 [0158.070] GetSystemMetrics (nIndex=46) returned 2 [0158.070] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.070] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.070] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.070] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.080] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.080] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.081] GetLastError () returned 0x578 [0158.081] CanUserWritePwrScheme () returned 0 [0158.081] GetSystemMetrics (nIndex=46) returned 2 [0158.081] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.081] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.082] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.082] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.091] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.091] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.091] GetLastError () returned 0x578 [0158.091] CanUserWritePwrScheme () returned 0 [0158.092] GetSystemMetrics (nIndex=46) returned 2 [0158.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.092] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.092] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.092] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.097] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.097] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.097] GetLastError () returned 0x578 [0158.097] CanUserWritePwrScheme () returned 0 [0158.098] GetSystemMetrics (nIndex=46) returned 2 [0158.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.098] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.098] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.098] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.106] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.106] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.106] GetLastError () returned 0x578 [0158.106] CanUserWritePwrScheme () returned 0 [0158.107] GetSystemMetrics (nIndex=46) returned 2 [0158.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.107] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.112] GetLastError () returned 0x578 [0158.112] CanUserWritePwrScheme () returned 0 [0158.113] GetSystemMetrics (nIndex=46) returned 2 [0158.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.118] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.118] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.118] GetLastError () returned 0x578 [0158.118] CanUserWritePwrScheme () returned 0 [0158.119] GetSystemMetrics (nIndex=46) returned 2 [0158.119] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.119] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.119] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.119] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.124] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.124] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.124] GetLastError () returned 0x578 [0158.124] CanUserWritePwrScheme () returned 0 [0158.124] GetSystemMetrics (nIndex=46) returned 2 [0158.125] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.125] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.125] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.125] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.129] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.130] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.130] GetLastError () returned 0x578 [0158.130] CanUserWritePwrScheme () returned 0 [0158.130] GetSystemMetrics (nIndex=46) returned 2 [0158.130] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.131] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.131] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.131] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.137] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.137] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.137] GetLastError () returned 0x578 [0158.137] CanUserWritePwrScheme () returned 0 [0158.138] GetSystemMetrics (nIndex=46) returned 2 [0158.138] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.138] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.138] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.138] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.149] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.149] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.149] GetLastError () returned 0x578 [0158.149] CanUserWritePwrScheme () returned 0 [0158.150] GetSystemMetrics (nIndex=46) returned 2 [0158.150] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.150] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.150] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.150] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.160] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.160] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.160] GetLastError () returned 0x578 [0158.161] CanUserWritePwrScheme () returned 0 [0158.161] GetSystemMetrics (nIndex=46) returned 2 [0158.161] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.161] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.161] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.161] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.175] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.175] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.175] GetLastError () returned 0x578 [0158.175] CanUserWritePwrScheme () returned 0 [0158.176] GetSystemMetrics (nIndex=46) returned 2 [0158.176] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.176] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.176] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.176] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.186] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.186] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.186] GetLastError () returned 0x578 [0158.187] CanUserWritePwrScheme () returned 0 [0158.187] GetSystemMetrics (nIndex=46) returned 2 [0158.187] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.187] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.187] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.187] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.198] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.198] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.198] GetLastError () returned 0x578 [0158.198] CanUserWritePwrScheme () returned 0 [0158.199] GetSystemMetrics (nIndex=46) returned 2 [0158.199] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.199] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.199] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.199] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.210] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.210] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.210] GetLastError () returned 0x578 [0158.210] CanUserWritePwrScheme () returned 0 [0158.211] GetSystemMetrics (nIndex=46) returned 2 [0158.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.211] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.211] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.211] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.223] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.223] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.223] GetLastError () returned 0x578 [0158.223] CanUserWritePwrScheme () returned 0 [0158.224] GetSystemMetrics (nIndex=46) returned 2 [0158.224] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.224] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.224] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.224] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.237] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.237] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.237] GetLastError () returned 0x578 [0158.237] CanUserWritePwrScheme () returned 0 [0158.238] GetSystemMetrics (nIndex=46) returned 2 [0158.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.238] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.238] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.238] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.249] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.249] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.249] GetLastError () returned 0x578 [0158.249] CanUserWritePwrScheme () returned 0 [0158.250] GetSystemMetrics (nIndex=46) returned 2 [0158.250] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.250] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.250] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.250] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.261] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.261] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.261] GetLastError () returned 0x578 [0158.261] CanUserWritePwrScheme () returned 0 [0158.262] GetSystemMetrics (nIndex=46) returned 2 [0158.262] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.262] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.262] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.262] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.273] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.273] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.273] GetLastError () returned 0x578 [0158.273] CanUserWritePwrScheme () returned 0 [0158.274] GetSystemMetrics (nIndex=46) returned 2 [0158.274] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.274] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.274] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.274] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.306] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.306] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.306] GetLastError () returned 0x578 [0158.306] CanUserWritePwrScheme () returned 0 [0158.307] GetSystemMetrics (nIndex=46) returned 2 [0158.307] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.307] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.307] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.307] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.318] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.318] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.318] GetLastError () returned 0x578 [0158.318] CanUserWritePwrScheme () returned 0 [0158.319] GetSystemMetrics (nIndex=46) returned 2 [0158.319] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.319] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.319] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.319] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.329] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.329] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.330] GetLastError () returned 0x578 [0158.330] CanUserWritePwrScheme () returned 0 [0158.330] GetSystemMetrics (nIndex=46) returned 2 [0158.330] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.330] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.331] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.331] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.336] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.336] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.336] GetLastError () returned 0x578 [0158.336] CanUserWritePwrScheme () returned 0 [0158.337] GetSystemMetrics (nIndex=46) returned 2 [0158.337] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.337] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.337] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.337] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.342] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.342] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.342] GetLastError () returned 0x578 [0158.342] CanUserWritePwrScheme () returned 0 [0158.343] GetSystemMetrics (nIndex=46) returned 2 [0158.343] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.343] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.343] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.343] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.348] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.348] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.348] GetLastError () returned 0x578 [0158.348] CanUserWritePwrScheme () returned 0 [0158.349] GetSystemMetrics (nIndex=46) returned 2 [0158.349] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.349] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.349] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.349] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.354] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.354] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.354] GetLastError () returned 0x578 [0158.354] CanUserWritePwrScheme () returned 0 [0158.355] GetSystemMetrics (nIndex=46) returned 2 [0158.355] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.355] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.355] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.355] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.360] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.360] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.360] GetLastError () returned 0x578 [0158.360] CanUserWritePwrScheme () returned 0 [0158.361] GetSystemMetrics (nIndex=46) returned 2 [0158.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.361] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.361] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.361] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.369] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.369] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.369] GetLastError () returned 0x578 [0158.369] CanUserWritePwrScheme () returned 0 [0158.370] GetSystemMetrics (nIndex=46) returned 2 [0158.370] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.370] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.370] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.370] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.375] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.375] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.375] GetLastError () returned 0x578 [0158.375] CanUserWritePwrScheme () returned 0 [0158.376] GetSystemMetrics (nIndex=46) returned 2 [0158.376] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.376] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.376] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.376] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.381] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.381] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.381] GetLastError () returned 0x578 [0158.381] CanUserWritePwrScheme () returned 0 [0158.382] GetSystemMetrics (nIndex=46) returned 2 [0158.382] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.382] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.382] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.382] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.390] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.390] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.390] GetLastError () returned 0x578 [0158.390] CanUserWritePwrScheme () returned 0 [0158.391] GetSystemMetrics (nIndex=46) returned 2 [0158.391] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.391] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.391] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.391] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.409] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.409] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.409] GetLastError () returned 0x578 [0158.409] CanUserWritePwrScheme () returned 0 [0158.410] GetSystemMetrics (nIndex=46) returned 2 [0158.410] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.410] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.410] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.410] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.420] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.421] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.421] GetLastError () returned 0x578 [0158.421] CanUserWritePwrScheme () returned 0 [0158.422] GetSystemMetrics (nIndex=46) returned 2 [0158.422] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.422] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.422] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.422] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.435] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.435] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.435] GetLastError () returned 0x578 [0158.436] CanUserWritePwrScheme () returned 0 [0158.436] GetSystemMetrics (nIndex=46) returned 2 [0158.436] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.436] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.437] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.437] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.447] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.447] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.447] GetLastError () returned 0x578 [0158.447] CanUserWritePwrScheme () returned 0 [0158.448] GetSystemMetrics (nIndex=46) returned 2 [0158.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.448] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.448] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.448] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.459] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.459] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.459] GetLastError () returned 0x578 [0158.459] CanUserWritePwrScheme () returned 0 [0158.460] GetSystemMetrics (nIndex=46) returned 2 [0158.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.460] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.460] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.460] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.471] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.471] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.471] GetLastError () returned 0x578 [0158.471] CanUserWritePwrScheme () returned 0 [0158.472] GetSystemMetrics (nIndex=46) returned 2 [0158.472] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.472] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.472] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.472] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.561] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.561] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.561] GetLastError () returned 0x578 [0158.561] CanUserWritePwrScheme () returned 0 [0158.562] GetSystemMetrics (nIndex=46) returned 2 [0158.562] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.562] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.562] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.562] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.572] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.573] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.573] GetLastError () returned 0x578 [0158.573] CanUserWritePwrScheme () returned 0 [0158.573] GetSystemMetrics (nIndex=46) returned 2 [0158.574] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.574] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.574] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.574] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.584] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.584] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.584] GetLastError () returned 0x578 [0158.584] CanUserWritePwrScheme () returned 0 [0158.585] GetSystemMetrics (nIndex=46) returned 2 [0158.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.585] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.585] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.585] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.596] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.596] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.596] GetLastError () returned 0x578 [0158.596] CanUserWritePwrScheme () returned 0 [0158.597] GetSystemMetrics (nIndex=46) returned 2 [0158.597] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.597] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.597] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.597] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.608] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.608] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.608] GetLastError () returned 0x578 [0158.608] CanUserWritePwrScheme () returned 0 [0158.609] GetSystemMetrics (nIndex=46) returned 2 [0158.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.609] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.609] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.609] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.620] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.620] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.620] GetLastError () returned 0x578 [0158.620] CanUserWritePwrScheme () returned 0 [0158.621] GetSystemMetrics (nIndex=46) returned 2 [0158.621] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.621] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.621] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.621] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.636] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.636] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.636] GetLastError () returned 0x578 [0158.636] CanUserWritePwrScheme () returned 0 [0158.637] GetSystemMetrics (nIndex=46) returned 2 [0158.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.637] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.637] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.637] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.647] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.648] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.648] GetLastError () returned 0x578 [0158.648] CanUserWritePwrScheme () returned 0 [0158.649] GetSystemMetrics (nIndex=46) returned 2 [0158.649] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.649] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.649] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.649] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.660] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.660] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.660] GetLastError () returned 0x578 [0158.660] CanUserWritePwrScheme () returned 0 [0158.661] GetSystemMetrics (nIndex=46) returned 2 [0158.661] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.661] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.661] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.661] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.671] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.671] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.671] GetLastError () returned 0x578 [0158.671] CanUserWritePwrScheme () returned 0 [0158.672] GetSystemMetrics (nIndex=46) returned 2 [0158.672] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.672] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.672] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.672] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.683] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.683] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.683] GetLastError () returned 0x578 [0158.683] CanUserWritePwrScheme () returned 0 [0158.684] GetSystemMetrics (nIndex=46) returned 2 [0158.684] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.684] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.684] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.697] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.697] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.697] GetLastError () returned 0x578 [0158.697] CanUserWritePwrScheme () returned 0 [0158.698] GetSystemMetrics (nIndex=46) returned 2 [0158.698] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.698] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.698] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.699] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.709] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.709] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.709] GetLastError () returned 0x578 [0158.710] CanUserWritePwrScheme () returned 0 [0158.710] GetSystemMetrics (nIndex=46) returned 2 [0158.710] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.710] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.710] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.710] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.721] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.721] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.721] GetLastError () returned 0x578 [0158.721] CanUserWritePwrScheme () returned 0 [0158.722] GetSystemMetrics (nIndex=46) returned 2 [0158.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.722] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.722] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.722] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.733] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.733] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.733] GetLastError () returned 0x578 [0158.733] CanUserWritePwrScheme () returned 0 [0158.734] GetSystemMetrics (nIndex=46) returned 2 [0158.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.734] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.734] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.734] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.745] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.745] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.745] GetLastError () returned 0x578 [0158.745] CanUserWritePwrScheme () returned 0 [0158.746] GetSystemMetrics (nIndex=46) returned 2 [0158.746] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.746] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.746] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.746] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.804] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.804] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.804] GetLastError () returned 0x578 [0158.804] CanUserWritePwrScheme () returned 0 [0158.805] GetSystemMetrics (nIndex=46) returned 2 [0158.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.814] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.814] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.814] GetLastError () returned 0x578 [0158.814] CanUserWritePwrScheme () returned 0 [0158.815] GetSystemMetrics (nIndex=46) returned 2 [0158.815] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.815] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.815] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.815] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.829] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.829] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.829] GetLastError () returned 0x578 [0158.829] CanUserWritePwrScheme () returned 0 [0158.830] GetSystemMetrics (nIndex=46) returned 2 [0158.830] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.830] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.830] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.830] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.840] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.840] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.840] GetLastError () returned 0x578 [0158.840] CanUserWritePwrScheme () returned 0 [0158.841] GetSystemMetrics (nIndex=46) returned 2 [0158.841] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.841] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.841] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.841] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.852] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.852] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.852] GetLastError () returned 0x578 [0158.852] CanUserWritePwrScheme () returned 0 [0158.853] GetSystemMetrics (nIndex=46) returned 2 [0158.853] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.853] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.853] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.853] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.864] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.864] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.864] GetLastError () returned 0x578 [0158.864] CanUserWritePwrScheme () returned 0 [0158.865] GetSystemMetrics (nIndex=46) returned 2 [0158.865] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.865] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.865] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.865] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.876] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.876] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.876] GetLastError () returned 0x578 [0158.876] CanUserWritePwrScheme () returned 0 [0158.877] GetSystemMetrics (nIndex=46) returned 2 [0158.877] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.877] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.877] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.877] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.890] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.890] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.890] GetLastError () returned 0x578 [0158.890] CanUserWritePwrScheme () returned 0 [0158.891] GetSystemMetrics (nIndex=46) returned 2 [0158.891] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.891] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.891] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.891] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.903] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.903] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.903] GetLastError () returned 0x578 [0158.903] CanUserWritePwrScheme () returned 0 [0158.904] GetSystemMetrics (nIndex=46) returned 2 [0158.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.904] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.904] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.904] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.915] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.915] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.915] GetLastError () returned 0x578 [0158.915] CanUserWritePwrScheme () returned 0 [0158.916] GetSystemMetrics (nIndex=46) returned 2 [0158.916] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.916] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.916] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.916] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.927] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.927] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.927] GetLastError () returned 0x578 [0158.928] CanUserWritePwrScheme () returned 0 [0158.928] GetSystemMetrics (nIndex=46) returned 2 [0158.928] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.928] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.928] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.928] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.939] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.939] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.939] GetLastError () returned 0x578 [0158.939] CanUserWritePwrScheme () returned 0 [0158.940] GetSystemMetrics (nIndex=46) returned 2 [0158.940] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.940] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.940] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.940] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.945] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.945] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.945] GetLastError () returned 0x578 [0158.945] CanUserWritePwrScheme () returned 0 [0158.946] GetSystemMetrics (nIndex=46) returned 2 [0158.946] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.946] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.946] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.946] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.953] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.953] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.953] GetLastError () returned 0x578 [0158.953] CanUserWritePwrScheme () returned 0 [0158.954] GetSystemMetrics (nIndex=46) returned 2 [0158.954] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.954] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.954] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.954] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.959] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.959] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.959] GetLastError () returned 0x578 [0158.959] CanUserWritePwrScheme () returned 0 [0158.960] GetSystemMetrics (nIndex=46) returned 2 [0158.960] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.960] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.960] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.960] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.965] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.965] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.965] GetLastError () returned 0x578 [0158.965] CanUserWritePwrScheme () returned 0 [0158.966] GetSystemMetrics (nIndex=46) returned 2 [0158.966] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.966] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.966] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.966] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.972] GetLastError () returned 0x578 [0158.972] CanUserWritePwrScheme () returned 0 [0158.973] GetSystemMetrics (nIndex=46) returned 2 [0158.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.983] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.983] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.983] GetLastError () returned 0x578 [0158.983] CanUserWritePwrScheme () returned 0 [0158.984] GetSystemMetrics (nIndex=46) returned 2 [0158.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.062] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.062] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.062] GetLastError () returned 0x578 [0159.062] CanUserWritePwrScheme () returned 0 [0159.063] GetSystemMetrics (nIndex=46) returned 2 [0159.063] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.063] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.063] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.063] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.074] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.074] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.074] GetLastError () returned 0x578 [0159.074] CanUserWritePwrScheme () returned 0 [0159.075] GetSystemMetrics (nIndex=46) returned 2 [0159.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.075] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.075] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.075] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.088] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.088] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.088] GetLastError () returned 0x578 [0159.088] CanUserWritePwrScheme () returned 0 [0159.089] GetSystemMetrics (nIndex=46) returned 2 [0159.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.089] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.089] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.089] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.100] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.100] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.100] GetLastError () returned 0x578 [0159.100] CanUserWritePwrScheme () returned 0 [0159.101] GetSystemMetrics (nIndex=46) returned 2 [0159.101] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.101] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.101] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.101] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.112] GetLastError () returned 0x578 [0159.112] CanUserWritePwrScheme () returned 0 [0159.113] GetSystemMetrics (nIndex=46) returned 2 [0159.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.124] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.124] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.124] GetLastError () returned 0x578 [0159.124] CanUserWritePwrScheme () returned 0 [0159.125] GetSystemMetrics (nIndex=46) returned 2 [0159.125] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.125] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.125] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.125] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.133] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.133] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.133] GetLastError () returned 0x578 [0159.133] CanUserWritePwrScheme () returned 0 [0159.134] GetSystemMetrics (nIndex=46) returned 2 [0159.134] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.134] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.134] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.134] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.139] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.139] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.139] GetLastError () returned 0x578 [0159.139] CanUserWritePwrScheme () returned 0 [0159.140] GetSystemMetrics (nIndex=46) returned 2 [0159.140] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.140] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.140] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.140] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.148] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.148] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.148] GetLastError () returned 0x578 [0159.148] CanUserWritePwrScheme () returned 0 [0159.149] GetSystemMetrics (nIndex=46) returned 2 [0159.149] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.149] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.149] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.149] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.160] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.160] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.160] GetLastError () returned 0x578 [0159.161] CanUserWritePwrScheme () returned 0 [0159.161] GetSystemMetrics (nIndex=46) returned 2 [0159.161] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.161] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.161] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.161] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.172] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.172] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.172] GetLastError () returned 0x578 [0159.172] CanUserWritePwrScheme () returned 0 [0159.173] GetSystemMetrics (nIndex=46) returned 2 [0159.173] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.173] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.173] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.173] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.183] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.183] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.183] GetLastError () returned 0x578 [0159.184] CanUserWritePwrScheme () returned 0 [0159.184] GetSystemMetrics (nIndex=46) returned 2 [0159.184] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.184] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.184] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.184] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.195] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.195] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.195] GetLastError () returned 0x578 [0159.195] CanUserWritePwrScheme () returned 0 [0159.196] GetSystemMetrics (nIndex=46) returned 2 [0159.196] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.196] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.196] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.196] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.207] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.207] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.207] GetLastError () returned 0x578 [0159.207] CanUserWritePwrScheme () returned 0 [0159.208] GetSystemMetrics (nIndex=46) returned 2 [0159.208] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.208] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.208] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.208] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.221] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.221] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.221] GetLastError () returned 0x578 [0159.221] CanUserWritePwrScheme () returned 0 [0159.222] GetSystemMetrics (nIndex=46) returned 2 [0159.222] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.222] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.222] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.222] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.232] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.232] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.232] GetLastError () returned 0x578 [0159.232] CanUserWritePwrScheme () returned 0 [0159.233] GetSystemMetrics (nIndex=46) returned 2 [0159.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.233] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.233] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.233] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.244] GetLastError () returned 0x578 [0159.244] CanUserWritePwrScheme () returned 0 [0159.245] GetSystemMetrics (nIndex=46) returned 2 [0159.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.257] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.257] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.257] GetLastError () returned 0x578 [0159.257] CanUserWritePwrScheme () returned 0 [0159.258] GetSystemMetrics (nIndex=46) returned 2 [0159.258] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.258] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.258] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.258] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.269] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.269] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.269] GetLastError () returned 0x578 [0159.269] CanUserWritePwrScheme () returned 0 [0159.270] GetSystemMetrics (nIndex=46) returned 2 [0159.270] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.270] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.270] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.270] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.283] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.283] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.283] GetLastError () returned 0x578 [0159.283] CanUserWritePwrScheme () returned 0 [0159.284] GetSystemMetrics (nIndex=46) returned 2 [0159.284] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.284] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.284] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.284] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.294] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.294] GetLastError () returned 0x578 [0159.294] CanUserWritePwrScheme () returned 0 [0159.295] GetSystemMetrics (nIndex=46) returned 2 [0159.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.306] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.306] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.306] GetLastError () returned 0x578 [0159.306] CanUserWritePwrScheme () returned 0 [0159.307] GetSystemMetrics (nIndex=46) returned 2 [0159.307] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.307] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.307] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.307] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.318] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.318] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.318] GetLastError () returned 0x578 [0159.318] CanUserWritePwrScheme () returned 0 [0159.319] GetSystemMetrics (nIndex=46) returned 2 [0159.319] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.319] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.319] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.319] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.329] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.329] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.329] GetLastError () returned 0x578 [0159.329] CanUserWritePwrScheme () returned 0 [0159.330] GetSystemMetrics (nIndex=46) returned 2 [0159.330] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.330] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.330] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.330] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.344] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.344] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.344] GetLastError () returned 0x578 [0159.344] CanUserWritePwrScheme () returned 0 [0159.344] GetSystemMetrics (nIndex=46) returned 2 [0159.345] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.345] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.345] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.345] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.355] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.355] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.355] GetLastError () returned 0x578 [0159.355] CanUserWritePwrScheme () returned 0 [0159.356] GetSystemMetrics (nIndex=46) returned 2 [0159.356] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.356] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.356] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.356] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.367] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.367] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.367] GetLastError () returned 0x578 [0159.367] CanUserWritePwrScheme () returned 0 [0159.368] GetSystemMetrics (nIndex=46) returned 2 [0159.368] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.368] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.368] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.368] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.374] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.374] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.374] GetLastError () returned 0x578 [0159.374] CanUserWritePwrScheme () returned 0 [0159.375] GetSystemMetrics (nIndex=46) returned 2 [0159.375] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.375] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.375] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.375] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.380] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.380] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.380] GetLastError () returned 0x578 [0159.380] CanUserWritePwrScheme () returned 0 [0159.381] GetSystemMetrics (nIndex=46) returned 2 [0159.381] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.381] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.381] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.381] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.386] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.386] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.386] GetLastError () returned 0x578 [0159.386] CanUserWritePwrScheme () returned 0 [0159.387] GetSystemMetrics (nIndex=46) returned 2 [0159.387] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.387] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.387] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.387] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.392] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.392] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.392] GetLastError () returned 0x578 [0159.392] CanUserWritePwrScheme () returned 0 [0159.393] GetSystemMetrics (nIndex=46) returned 2 [0159.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.393] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.393] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.393] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.411] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.411] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.411] GetLastError () returned 0x578 [0159.411] CanUserWritePwrScheme () returned 0 [0159.412] GetSystemMetrics (nIndex=46) returned 2 [0159.412] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.412] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.412] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.412] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.423] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.423] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.423] GetLastError () returned 0x578 [0159.423] CanUserWritePwrScheme () returned 0 [0159.424] GetSystemMetrics (nIndex=46) returned 2 [0159.424] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.424] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.424] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.424] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.434] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.434] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.434] GetLastError () returned 0x578 [0159.434] CanUserWritePwrScheme () returned 0 [0159.435] GetSystemMetrics (nIndex=46) returned 2 [0159.435] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.435] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.435] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.435] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.446] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.446] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.446] GetLastError () returned 0x578 [0159.446] CanUserWritePwrScheme () returned 0 [0159.447] GetSystemMetrics (nIndex=46) returned 2 [0159.447] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.447] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.447] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.447] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.458] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.458] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.458] GetLastError () returned 0x578 [0159.458] CanUserWritePwrScheme () returned 0 [0159.459] GetSystemMetrics (nIndex=46) returned 2 [0159.459] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.459] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.459] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.459] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.472] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.472] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.472] GetLastError () returned 0x578 [0159.472] CanUserWritePwrScheme () returned 0 [0159.473] GetSystemMetrics (nIndex=46) returned 2 [0159.473] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.473] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.473] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.473] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.484] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.484] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.484] GetLastError () returned 0x578 [0159.484] CanUserWritePwrScheme () returned 0 [0159.485] GetSystemMetrics (nIndex=46) returned 2 [0159.485] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.485] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.485] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.485] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.495] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.495] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.495] GetLastError () returned 0x578 [0159.495] CanUserWritePwrScheme () returned 0 [0159.496] GetSystemMetrics (nIndex=46) returned 2 [0159.496] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.496] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.496] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.496] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.508] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.508] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.508] GetLastError () returned 0x578 [0159.508] CanUserWritePwrScheme () returned 0 [0159.509] GetSystemMetrics (nIndex=46) returned 2 [0159.509] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.509] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.509] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.509] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.520] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.520] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.520] GetLastError () returned 0x578 [0159.520] CanUserWritePwrScheme () returned 0 [0159.521] GetSystemMetrics (nIndex=46) returned 2 [0159.521] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.521] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.521] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.521] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.532] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.532] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.532] GetLastError () returned 0x578 [0159.532] CanUserWritePwrScheme () returned 0 [0159.536] GetSystemMetrics (nIndex=46) returned 2 [0159.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.546] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.546] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.546] GetLastError () returned 0x578 [0159.546] CanUserWritePwrScheme () returned 0 [0159.547] GetSystemMetrics (nIndex=46) returned 2 [0159.547] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.547] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.547] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.547] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.558] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.558] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.558] GetLastError () returned 0x578 [0159.558] CanUserWritePwrScheme () returned 0 [0159.559] GetSystemMetrics (nIndex=46) returned 2 [0159.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.559] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.559] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.559] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.569] GetLastError () returned 0x578 [0159.569] CanUserWritePwrScheme () returned 0 [0159.570] GetSystemMetrics (nIndex=46) returned 2 [0159.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.570] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.570] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.570] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.581] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.581] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.581] GetLastError () returned 0x578 [0159.581] CanUserWritePwrScheme () returned 0 [0159.582] GetSystemMetrics (nIndex=46) returned 2 [0159.582] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.582] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.582] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.582] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.593] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.593] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.593] GetLastError () returned 0x578 [0159.593] CanUserWritePwrScheme () returned 0 [0159.594] GetSystemMetrics (nIndex=46) returned 2 [0159.594] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.594] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.594] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.594] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.607] GetLastError () returned 0x578 [0159.607] CanUserWritePwrScheme () returned 0 [0159.608] GetSystemMetrics (nIndex=46) returned 2 [0159.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.608] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.608] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.608] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.618] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.619] GetLastError () returned 0x578 [0159.619] CanUserWritePwrScheme () returned 0 [0159.619] GetSystemMetrics (nIndex=46) returned 2 [0159.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.630] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.630] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.630] GetLastError () returned 0x578 [0159.630] CanUserWritePwrScheme () returned 0 [0159.631] GetSystemMetrics (nIndex=46) returned 2 [0159.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.639] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.639] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.639] GetLastError () returned 0x578 [0159.639] CanUserWritePwrScheme () returned 0 [0159.640] GetSystemMetrics (nIndex=46) returned 2 [0159.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.640] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.640] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.640] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.645] GetLastError () returned 0x578 [0159.645] CanUserWritePwrScheme () returned 0 [0159.646] GetSystemMetrics (nIndex=46) returned 2 [0159.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.651] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.651] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.651] GetLastError () returned 0x578 [0159.651] CanUserWritePwrScheme () returned 0 [0159.652] GetSystemMetrics (nIndex=46) returned 2 [0159.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.652] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.652] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.652] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.657] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.657] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.657] GetLastError () returned 0x578 [0159.657] CanUserWritePwrScheme () returned 0 [0159.658] GetSystemMetrics (nIndex=46) returned 2 [0159.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.658] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.658] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.658] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.666] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.666] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.666] GetLastError () returned 0x578 [0159.666] CanUserWritePwrScheme () returned 0 [0159.667] GetSystemMetrics (nIndex=46) returned 2 [0159.667] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.667] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.667] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.667] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.672] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.672] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.672] GetLastError () returned 0x578 [0159.672] CanUserWritePwrScheme () returned 0 [0159.673] GetSystemMetrics (nIndex=46) returned 2 [0159.673] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.673] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.673] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.673] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.677] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.677] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.677] GetLastError () returned 0x578 [0159.678] CanUserWritePwrScheme () returned 0 [0159.678] GetSystemMetrics (nIndex=46) returned 2 [0159.678] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.678] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.678] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.678] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.688] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.688] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.688] GetLastError () returned 0x578 [0159.688] CanUserWritePwrScheme () returned 0 [0159.689] GetSystemMetrics (nIndex=46) returned 2 [0159.689] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.689] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.689] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.689] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.699] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.699] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.699] GetLastError () returned 0x578 [0159.699] CanUserWritePwrScheme () returned 0 [0159.700] GetSystemMetrics (nIndex=46) returned 2 [0159.700] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.700] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.700] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.700] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.711] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.711] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.711] GetLastError () returned 0x578 [0159.711] CanUserWritePwrScheme () returned 0 [0159.712] GetSystemMetrics (nIndex=46) returned 2 [0159.712] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.712] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.712] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.712] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.723] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.723] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.723] GetLastError () returned 0x578 [0159.723] CanUserWritePwrScheme () returned 0 [0159.724] GetSystemMetrics (nIndex=46) returned 2 [0159.724] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.724] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.724] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.724] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.737] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.737] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.737] GetLastError () returned 0x578 [0159.737] CanUserWritePwrScheme () returned 0 [0159.738] GetSystemMetrics (nIndex=46) returned 2 [0159.738] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.738] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.738] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.738] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.749] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.749] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.749] GetLastError () returned 0x578 [0159.749] CanUserWritePwrScheme () returned 0 [0159.750] GetSystemMetrics (nIndex=46) returned 2 [0159.750] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.750] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.750] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.750] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.761] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.761] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.761] GetLastError () returned 0x578 [0159.761] CanUserWritePwrScheme () returned 0 [0159.762] GetSystemMetrics (nIndex=46) returned 2 [0159.762] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.762] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.762] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.762] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.772] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.772] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.772] GetLastError () returned 0x578 [0159.772] CanUserWritePwrScheme () returned 0 [0159.773] GetSystemMetrics (nIndex=46) returned 2 [0159.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.773] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.773] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.783] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.783] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.784] GetLastError () returned 0x578 [0159.784] CanUserWritePwrScheme () returned 0 [0159.784] GetSystemMetrics (nIndex=46) returned 2 [0159.784] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.785] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.785] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.785] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.798] GetLastError () returned 0x578 [0159.798] CanUserWritePwrScheme () returned 0 [0159.799] GetSystemMetrics (nIndex=46) returned 2 [0159.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.799] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.799] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.799] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.809] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.809] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.809] GetLastError () returned 0x578 [0159.809] CanUserWritePwrScheme () returned 0 [0159.810] GetSystemMetrics (nIndex=46) returned 2 [0159.810] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.810] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.810] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.810] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.821] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.821] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.821] GetLastError () returned 0x578 [0159.821] CanUserWritePwrScheme () returned 0 [0159.822] GetSystemMetrics (nIndex=46) returned 2 [0159.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.822] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.822] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.822] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.832] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.832] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.832] GetLastError () returned 0x578 [0159.832] CanUserWritePwrScheme () returned 0 [0159.833] GetSystemMetrics (nIndex=46) returned 2 [0159.833] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.833] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.833] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.833] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.844] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.844] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.844] GetLastError () returned 0x578 [0159.844] CanUserWritePwrScheme () returned 0 [0159.845] GetSystemMetrics (nIndex=46) returned 2 [0159.845] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.845] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.845] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.845] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.855] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.855] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.855] GetLastError () returned 0x578 [0159.855] CanUserWritePwrScheme () returned 0 [0159.856] GetSystemMetrics (nIndex=46) returned 2 [0159.856] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.856] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.856] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.949] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.949] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.949] GetLastError () returned 0x578 [0159.949] CanUserWritePwrScheme () returned 0 [0159.950] GetSystemMetrics (nIndex=46) returned 2 [0159.950] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.950] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.950] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.950] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.961] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.961] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.961] GetLastError () returned 0x578 [0159.961] CanUserWritePwrScheme () returned 0 [0159.962] GetSystemMetrics (nIndex=46) returned 2 [0159.962] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.962] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.962] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.962] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.973] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.973] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.973] GetLastError () returned 0x578 [0159.973] CanUserWritePwrScheme () returned 0 [0159.974] GetSystemMetrics (nIndex=46) returned 2 [0159.974] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.974] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.974] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.974] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.984] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.984] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.984] GetLastError () returned 0x578 [0159.984] CanUserWritePwrScheme () returned 0 [0159.985] GetSystemMetrics (nIndex=46) returned 2 [0159.985] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.985] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.985] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.985] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.999] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.999] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.999] GetLastError () returned 0x578 [0159.999] CanUserWritePwrScheme () returned 0 [0160.000] GetSystemMetrics (nIndex=46) returned 2 [0160.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.000] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.000] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.000] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.010] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.010] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.010] GetLastError () returned 0x578 [0160.010] CanUserWritePwrScheme () returned 0 [0160.011] GetSystemMetrics (nIndex=46) returned 2 [0160.011] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.011] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.011] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.011] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.022] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.022] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.022] GetLastError () returned 0x578 [0160.022] CanUserWritePwrScheme () returned 0 [0160.023] GetSystemMetrics (nIndex=46) returned 2 [0160.023] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.023] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.023] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.023] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.033] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.033] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.033] GetLastError () returned 0x578 [0160.033] CanUserWritePwrScheme () returned 0 [0160.034] GetSystemMetrics (nIndex=46) returned 2 [0160.034] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.034] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.034] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.034] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.039] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.039] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.039] GetLastError () returned 0x578 [0160.039] CanUserWritePwrScheme () returned 0 [0160.040] GetSystemMetrics (nIndex=46) returned 2 [0160.040] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.040] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.040] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.040] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.045] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.045] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.045] GetLastError () returned 0x578 [0160.045] CanUserWritePwrScheme () returned 0 [0160.046] GetSystemMetrics (nIndex=46) returned 2 [0160.046] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.046] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.046] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.046] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.051] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.051] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.051] GetLastError () returned 0x578 [0160.051] CanUserWritePwrScheme () returned 0 [0160.052] GetSystemMetrics (nIndex=46) returned 2 [0160.052] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.052] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.052] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.052] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.059] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.059] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.059] GetLastError () returned 0x578 [0160.059] CanUserWritePwrScheme () returned 0 [0160.060] GetSystemMetrics (nIndex=46) returned 2 [0160.060] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.060] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.060] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.060] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.065] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.065] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.065] GetLastError () returned 0x578 [0160.065] CanUserWritePwrScheme () returned 0 [0160.066] GetSystemMetrics (nIndex=46) returned 2 [0160.066] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.066] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.066] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.066] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.071] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.071] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.071] GetLastError () returned 0x578 [0160.071] CanUserWritePwrScheme () returned 0 [0160.072] GetSystemMetrics (nIndex=46) returned 2 [0160.072] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.072] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.072] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.072] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.076] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.076] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.076] GetLastError () returned 0x578 [0160.077] CanUserWritePwrScheme () returned 0 [0160.077] GetSystemMetrics (nIndex=46) returned 2 [0160.077] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.077] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.077] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.077] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.082] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.082] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.082] GetLastError () returned 0x578 [0160.082] CanUserWritePwrScheme () returned 0 [0160.083] GetSystemMetrics (nIndex=46) returned 2 [0160.083] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.083] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.083] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.083] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.088] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.088] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.088] GetLastError () returned 0x578 [0160.088] CanUserWritePwrScheme () returned 0 [0160.089] GetSystemMetrics (nIndex=46) returned 2 [0160.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.089] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.089] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.089] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.094] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.094] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.094] GetLastError () returned 0x578 [0160.094] CanUserWritePwrScheme () returned 0 [0160.095] GetSystemMetrics (nIndex=46) returned 2 [0160.095] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.095] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.095] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.095] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.100] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.100] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.100] GetLastError () returned 0x578 [0160.100] CanUserWritePwrScheme () returned 0 [0160.101] GetSystemMetrics (nIndex=46) returned 2 [0160.101] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.101] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.101] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.101] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.105] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.105] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.106] GetLastError () returned 0x578 [0160.106] CanUserWritePwrScheme () returned 0 [0160.106] GetSystemMetrics (nIndex=46) returned 2 [0160.106] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.106] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.112] GetLastError () returned 0x578 [0160.112] CanUserWritePwrScheme () returned 0 [0160.113] GetSystemMetrics (nIndex=46) returned 2 [0160.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.127] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.127] GetLastError () returned 0x578 [0160.127] CanUserWritePwrScheme () returned 0 [0160.128] GetSystemMetrics (nIndex=46) returned 2 [0160.128] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.128] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.128] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.128] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.138] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.138] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.138] GetLastError () returned 0x578 [0160.138] CanUserWritePwrScheme () returned 0 [0160.139] GetSystemMetrics (nIndex=46) returned 2 [0160.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.139] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.139] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.139] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.150] GetLastError () returned 0x578 [0160.150] CanUserWritePwrScheme () returned 0 [0160.153] GetSystemMetrics (nIndex=46) returned 2 [0160.153] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.153] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.153] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.153] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.165] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.165] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.165] GetLastError () returned 0x578 [0160.165] CanUserWritePwrScheme () returned 0 [0160.166] GetSystemMetrics (nIndex=46) returned 2 [0160.166] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.166] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.166] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.166] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.176] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.176] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.176] GetLastError () returned 0x578 [0160.176] CanUserWritePwrScheme () returned 0 [0160.177] GetSystemMetrics (nIndex=46) returned 2 [0160.177] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.177] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.177] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.177] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.190] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.190] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.190] GetLastError () returned 0x578 [0160.191] CanUserWritePwrScheme () returned 0 [0160.191] GetSystemMetrics (nIndex=46) returned 2 [0160.191] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.191] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.191] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.191] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.202] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.202] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.202] GetLastError () returned 0x578 [0160.202] CanUserWritePwrScheme () returned 0 [0160.203] GetSystemMetrics (nIndex=46) returned 2 [0160.203] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.203] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.203] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.203] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.214] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.214] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.214] GetLastError () returned 0x578 [0160.214] CanUserWritePwrScheme () returned 0 [0160.215] GetSystemMetrics (nIndex=46) returned 2 [0160.215] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.215] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.215] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.215] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.225] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.225] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.225] GetLastError () returned 0x578 [0160.225] CanUserWritePwrScheme () returned 0 [0160.226] GetSystemMetrics (nIndex=46) returned 2 [0160.226] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.226] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.226] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.226] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.237] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.237] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.237] GetLastError () returned 0x578 [0160.237] CanUserWritePwrScheme () returned 0 [0160.238] GetSystemMetrics (nIndex=46) returned 2 [0160.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.238] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.238] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.238] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.249] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.249] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.249] GetLastError () returned 0x578 [0160.249] CanUserWritePwrScheme () returned 0 [0160.250] GetSystemMetrics (nIndex=46) returned 2 [0160.250] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.250] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.250] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.250] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.263] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.263] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.263] GetLastError () returned 0x578 [0160.263] CanUserWritePwrScheme () returned 0 [0160.264] GetSystemMetrics (nIndex=46) returned 2 [0160.264] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.264] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.264] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.264] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.275] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.275] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.275] GetLastError () returned 0x578 [0160.275] CanUserWritePwrScheme () returned 0 [0160.276] GetSystemMetrics (nIndex=46) returned 2 [0160.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.276] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.276] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.276] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.287] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.287] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.287] GetLastError () returned 0x578 [0160.287] CanUserWritePwrScheme () returned 0 [0160.288] GetSystemMetrics (nIndex=46) returned 2 [0160.288] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.288] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.288] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.288] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.299] GetLastError () returned 0x578 [0160.299] CanUserWritePwrScheme () returned 0 [0160.300] GetSystemMetrics (nIndex=46) returned 2 [0160.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.387] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.387] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.387] GetLastError () returned 0x578 [0160.387] CanUserWritePwrScheme () returned 0 [0160.388] GetSystemMetrics (nIndex=46) returned 2 [0160.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.388] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.388] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.388] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.406] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.406] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.406] GetLastError () returned 0x578 [0160.406] CanUserWritePwrScheme () returned 0 [0160.407] GetSystemMetrics (nIndex=46) returned 2 [0160.407] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.407] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.407] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.407] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.418] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.418] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.418] GetLastError () returned 0x578 [0160.418] CanUserWritePwrScheme () returned 0 [0160.419] GetSystemMetrics (nIndex=46) returned 2 [0160.419] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.419] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.419] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.419] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.430] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.430] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.430] GetLastError () returned 0x578 [0160.430] CanUserWritePwrScheme () returned 0 [0160.431] GetSystemMetrics (nIndex=46) returned 2 [0160.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.442] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.442] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.442] GetLastError () returned 0x578 [0160.442] CanUserWritePwrScheme () returned 0 [0160.443] GetSystemMetrics (nIndex=46) returned 2 [0160.443] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.443] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.443] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.443] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.456] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.456] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.456] GetLastError () returned 0x578 [0160.456] CanUserWritePwrScheme () returned 0 [0160.457] GetSystemMetrics (nIndex=46) returned 2 [0160.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.457] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.457] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.457] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.468] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.468] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.468] GetLastError () returned 0x578 [0160.468] CanUserWritePwrScheme () returned 0 [0160.469] GetSystemMetrics (nIndex=46) returned 2 [0160.469] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.469] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.469] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.469] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.480] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.480] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.480] GetLastError () returned 0x578 [0160.480] CanUserWritePwrScheme () returned 0 [0160.481] GetSystemMetrics (nIndex=46) returned 2 [0160.481] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.481] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.481] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.481] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.491] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.491] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.491] GetLastError () returned 0x578 [0160.491] CanUserWritePwrScheme () returned 0 [0160.492] GetSystemMetrics (nIndex=46) returned 2 [0160.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.492] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.492] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.492] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.497] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.497] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.497] GetLastError () returned 0x578 [0160.497] CanUserWritePwrScheme () returned 0 [0160.498] GetSystemMetrics (nIndex=46) returned 2 [0160.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.498] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.498] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.498] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.503] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.503] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.503] GetLastError () returned 0x578 [0160.503] CanUserWritePwrScheme () returned 0 [0160.504] GetSystemMetrics (nIndex=46) returned 2 [0160.504] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.504] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.504] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.504] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.509] GetLastError () returned 0x578 [0160.509] CanUserWritePwrScheme () returned 0 [0160.510] GetSystemMetrics (nIndex=46) returned 2 [0160.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.510] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.510] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.510] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.517] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.517] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.517] GetLastError () returned 0x578 [0160.517] CanUserWritePwrScheme () returned 0 [0160.518] GetSystemMetrics (nIndex=46) returned 2 [0160.518] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.518] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.518] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.518] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.523] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.523] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.523] GetLastError () returned 0x578 [0160.523] CanUserWritePwrScheme () returned 0 [0160.524] GetSystemMetrics (nIndex=46) returned 2 [0160.524] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.524] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.524] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.524] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.529] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.529] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.529] GetLastError () returned 0x578 [0160.529] CanUserWritePwrScheme () returned 0 [0160.530] GetSystemMetrics (nIndex=46) returned 2 [0160.530] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.530] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.530] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.530] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.535] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.535] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.535] GetLastError () returned 0x578 [0160.535] CanUserWritePwrScheme () returned 0 [0160.536] GetSystemMetrics (nIndex=46) returned 2 [0160.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.541] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.541] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.541] GetLastError () returned 0x578 [0160.541] CanUserWritePwrScheme () returned 0 [0160.542] GetSystemMetrics (nIndex=46) returned 2 [0160.542] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.542] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.542] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.542] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.547] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.547] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.547] GetLastError () returned 0x578 [0160.547] CanUserWritePwrScheme () returned 0 [0160.548] GetSystemMetrics (nIndex=46) returned 2 [0160.548] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.548] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.548] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.548] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.557] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.557] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.557] GetLastError () returned 0x578 [0160.557] CanUserWritePwrScheme () returned 0 [0160.558] GetSystemMetrics (nIndex=46) returned 2 [0160.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.558] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.558] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.558] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.568] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.568] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.568] GetLastError () returned 0x578 [0160.568] CanUserWritePwrScheme () returned 0 [0160.569] GetSystemMetrics (nIndex=46) returned 2 [0160.569] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.569] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.569] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.569] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.583] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.583] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.583] GetLastError () returned 0x578 [0160.583] CanUserWritePwrScheme () returned 0 [0160.584] GetSystemMetrics (nIndex=46) returned 2 [0160.584] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.584] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.584] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.584] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.595] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.595] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.595] GetLastError () returned 0x578 [0160.595] CanUserWritePwrScheme () returned 0 [0160.595] GetSystemMetrics (nIndex=46) returned 2 [0160.596] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.596] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.596] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.596] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.606] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.606] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.606] GetLastError () returned 0x578 [0160.606] CanUserWritePwrScheme () returned 0 [0160.607] GetSystemMetrics (nIndex=46) returned 2 [0160.607] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.607] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.607] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.607] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.618] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.618] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.618] GetLastError () returned 0x578 [0160.618] CanUserWritePwrScheme () returned 0 [0160.619] GetSystemMetrics (nIndex=46) returned 2 [0160.619] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.619] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.619] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.619] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.630] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.630] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.630] GetLastError () returned 0x578 [0160.630] CanUserWritePwrScheme () returned 0 [0160.631] GetSystemMetrics (nIndex=46) returned 2 [0160.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.645] GetLastError () returned 0x578 [0160.645] CanUserWritePwrScheme () returned 0 [0160.646] GetSystemMetrics (nIndex=46) returned 2 [0160.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.658] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.658] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.658] GetLastError () returned 0x578 [0160.658] CanUserWritePwrScheme () returned 0 [0160.659] GetSystemMetrics (nIndex=46) returned 2 [0160.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.659] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.659] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.659] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.670] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.670] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.670] GetLastError () returned 0x578 [0160.670] CanUserWritePwrScheme () returned 0 [0160.671] GetSystemMetrics (nIndex=46) returned 2 [0160.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.671] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.671] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.671] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.682] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.682] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.682] GetLastError () returned 0x578 [0160.682] CanUserWritePwrScheme () returned 0 [0160.683] GetSystemMetrics (nIndex=46) returned 2 [0160.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.683] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.683] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.683] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.694] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.694] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.694] GetLastError () returned 0x578 [0160.694] CanUserWritePwrScheme () returned 0 [0160.695] GetSystemMetrics (nIndex=46) returned 2 [0160.695] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.695] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.695] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.695] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.706] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.706] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.706] GetLastError () returned 0x578 [0160.706] CanUserWritePwrScheme () returned 0 [0160.709] GetSystemMetrics (nIndex=46) returned 2 [0160.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.709] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.720] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.720] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.720] GetLastError () returned 0x578 [0160.720] CanUserWritePwrScheme () returned 0 [0160.721] GetSystemMetrics (nIndex=46) returned 2 [0160.721] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.721] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.721] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.721] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.732] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.732] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.732] GetLastError () returned 0x578 [0160.732] CanUserWritePwrScheme () returned 0 [0160.733] GetSystemMetrics (nIndex=46) returned 2 [0160.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.733] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.733] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.733] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.743] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.743] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.743] GetLastError () returned 0x578 [0160.744] CanUserWritePwrScheme () returned 0 [0160.744] GetSystemMetrics (nIndex=46) returned 2 [0160.744] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.744] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.744] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.745] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.755] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.755] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.755] GetLastError () returned 0x578 [0160.755] CanUserWritePwrScheme () returned 0 [0160.756] GetSystemMetrics (nIndex=46) returned 2 [0160.756] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.756] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.756] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.756] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.767] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.767] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.767] GetLastError () returned 0x578 [0160.767] CanUserWritePwrScheme () returned 0 [0160.768] GetSystemMetrics (nIndex=46) returned 2 [0160.768] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.768] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.768] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.768] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.832] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.832] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.832] GetLastError () returned 0x578 [0160.832] CanUserWritePwrScheme () returned 0 [0160.833] GetSystemMetrics (nIndex=46) returned 2 [0160.833] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.833] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.833] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.833] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.847] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.847] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.847] GetLastError () returned 0x578 [0160.847] CanUserWritePwrScheme () returned 0 [0160.848] GetSystemMetrics (nIndex=46) returned 2 [0160.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.848] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.848] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.848] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.859] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.859] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.859] GetLastError () returned 0x578 [0160.859] CanUserWritePwrScheme () returned 0 [0160.860] GetSystemMetrics (nIndex=46) returned 2 [0160.860] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.860] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.860] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.860] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.870] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.870] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.870] GetLastError () returned 0x578 [0160.870] CanUserWritePwrScheme () returned 0 [0160.871] GetSystemMetrics (nIndex=46) returned 2 [0160.871] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.872] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.872] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.872] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.882] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.882] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.882] GetLastError () returned 0x578 [0160.882] CanUserWritePwrScheme () returned 0 [0160.883] GetSystemMetrics (nIndex=46) returned 2 [0160.883] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.883] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.883] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.883] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.894] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.894] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.894] GetLastError () returned 0x578 [0160.894] CanUserWritePwrScheme () returned 0 [0160.895] GetSystemMetrics (nIndex=46) returned 2 [0160.895] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.895] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.895] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.895] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.909] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.909] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.909] GetLastError () returned 0x578 [0160.909] CanUserWritePwrScheme () returned 0 [0160.910] GetSystemMetrics (nIndex=46) returned 2 [0160.910] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.910] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.910] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.910] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.923] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.923] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.923] GetLastError () returned 0x578 [0160.923] CanUserWritePwrScheme () returned 0 [0160.924] GetSystemMetrics (nIndex=46) returned 2 [0160.924] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.924] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.924] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.924] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.934] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.934] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.934] GetLastError () returned 0x578 [0160.934] CanUserWritePwrScheme () returned 0 [0160.935] GetSystemMetrics (nIndex=46) returned 2 [0160.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.946] GetLastError () returned 0x578 [0160.946] CanUserWritePwrScheme () returned 0 [0160.947] GetSystemMetrics (nIndex=46) returned 2 [0160.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.947] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.947] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.947] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.952] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.952] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.952] GetLastError () returned 0x578 [0160.952] CanUserWritePwrScheme () returned 0 [0160.953] GetSystemMetrics (nIndex=46) returned 2 [0160.953] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.953] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.953] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.953] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.958] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.958] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.958] GetLastError () returned 0x578 [0160.958] CanUserWritePwrScheme () returned 0 [0160.959] GetSystemMetrics (nIndex=46) returned 2 [0160.959] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.959] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.959] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.959] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.964] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.964] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.964] GetLastError () returned 0x578 [0160.964] CanUserWritePwrScheme () returned 0 [0160.965] GetSystemMetrics (nIndex=46) returned 2 [0160.965] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.965] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.965] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.965] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.972] GetLastError () returned 0x578 [0160.972] CanUserWritePwrScheme () returned 0 [0160.973] GetSystemMetrics (nIndex=46) returned 2 [0160.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.978] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.978] GetLastError () returned 0x578 [0160.978] CanUserWritePwrScheme () returned 0 [0160.979] GetSystemMetrics (nIndex=46) returned 2 [0160.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.979] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.979] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.979] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.984] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.984] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.984] GetLastError () returned 0x578 [0160.985] CanUserWritePwrScheme () returned 0 [0160.985] GetSystemMetrics (nIndex=46) returned 2 [0160.985] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.985] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.985] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.985] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.990] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.990] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.990] GetLastError () returned 0x578 [0160.990] CanUserWritePwrScheme () returned 0 [0160.991] GetSystemMetrics (nIndex=46) returned 2 [0160.991] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.991] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.991] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.991] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.996] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.996] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.996] GetLastError () returned 0x578 [0160.996] CanUserWritePwrScheme () returned 0 [0160.997] GetSystemMetrics (nIndex=46) returned 2 [0160.997] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.997] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.997] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.997] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.275] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.275] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.275] GetLastError () returned 0x578 [0161.275] CanUserWritePwrScheme () returned 0 [0161.276] GetSystemMetrics (nIndex=46) returned 2 [0161.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.276] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.276] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.276] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.287] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.287] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.287] GetLastError () returned 0x578 [0161.287] CanUserWritePwrScheme () returned 0 [0161.288] GetSystemMetrics (nIndex=46) returned 2 [0161.288] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.288] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.288] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.288] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.301] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.301] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.301] GetLastError () returned 0x578 [0161.301] CanUserWritePwrScheme () returned 0 [0161.302] GetSystemMetrics (nIndex=46) returned 2 [0161.302] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.302] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.302] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.302] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.313] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.313] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.313] GetLastError () returned 0x578 [0161.313] CanUserWritePwrScheme () returned 0 [0161.314] GetSystemMetrics (nIndex=46) returned 2 [0161.314] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.314] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.314] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.314] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.325] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.325] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.325] GetLastError () returned 0x578 [0161.325] CanUserWritePwrScheme () returned 0 [0161.326] GetSystemMetrics (nIndex=46) returned 2 [0161.326] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.326] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.326] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.326] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.336] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.336] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.336] GetLastError () returned 0x578 [0161.337] CanUserWritePwrScheme () returned 0 [0161.337] GetSystemMetrics (nIndex=46) returned 2 [0161.337] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.337] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.337] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.337] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.348] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.348] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.348] GetLastError () returned 0x578 [0161.348] CanUserWritePwrScheme () returned 0 [0161.349] GetSystemMetrics (nIndex=46) returned 2 [0161.349] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.349] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.349] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.349] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.961] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.961] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.961] GetLastError () returned 0x578 [0161.961] CanUserWritePwrScheme () returned 0 [0161.962] GetSystemMetrics (nIndex=46) returned 2 [0161.962] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.962] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.962] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.962] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.972] GetLastError () returned 0x578 [0161.972] CanUserWritePwrScheme () returned 0 [0161.973] GetSystemMetrics (nIndex=46) returned 2 [0161.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.984] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.984] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.984] GetLastError () returned 0x578 [0161.984] CanUserWritePwrScheme () returned 0 [0161.985] GetSystemMetrics (nIndex=46) returned 2 [0161.985] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.985] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.985] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.985] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.996] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.996] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.996] GetLastError () returned 0x578 [0161.996] CanUserWritePwrScheme () returned 0 [0161.997] GetSystemMetrics (nIndex=46) returned 2 [0161.997] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.997] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.997] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.997] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.013] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.013] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.013] GetLastError () returned 0x578 [0162.013] CanUserWritePwrScheme () returned 0 [0162.014] GetSystemMetrics (nIndex=46) returned 2 [0162.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.024] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.024] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.024] GetLastError () returned 0x578 [0162.024] CanUserWritePwrScheme () returned 0 [0162.025] GetSystemMetrics (nIndex=46) returned 2 [0162.025] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.025] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.025] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.025] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.036] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.036] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.036] GetLastError () returned 0x578 [0162.036] CanUserWritePwrScheme () returned 0 [0162.037] GetSystemMetrics (nIndex=46) returned 2 [0162.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.037] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.037] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.037] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.119] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.119] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.119] GetLastError () returned 0x578 [0162.119] CanUserWritePwrScheme () returned 0 [0162.120] GetSystemMetrics (nIndex=46) returned 2 [0162.120] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.120] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.120] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.120] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.130] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.130] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.130] GetLastError () returned 0x578 [0162.130] CanUserWritePwrScheme () returned 0 [0162.131] GetSystemMetrics (nIndex=46) returned 2 [0162.131] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.131] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.131] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.131] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.145] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.145] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.145] GetLastError () returned 0x578 [0162.145] CanUserWritePwrScheme () returned 0 [0162.146] GetSystemMetrics (nIndex=46) returned 2 [0162.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.146] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.146] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.146] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.156] GetLastError () returned 0x578 [0162.156] CanUserWritePwrScheme () returned 0 [0162.157] GetSystemMetrics (nIndex=46) returned 2 [0162.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.157] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.157] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.157] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.168] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.168] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.168] GetLastError () returned 0x578 [0162.168] CanUserWritePwrScheme () returned 0 [0162.169] GetSystemMetrics (nIndex=46) returned 2 [0162.169] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.169] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.169] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.169] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.179] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.179] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.179] GetLastError () returned 0x578 [0162.179] CanUserWritePwrScheme () returned 0 [0162.180] GetSystemMetrics (nIndex=46) returned 2 [0162.180] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.180] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.180] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.180] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.191] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.191] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.191] GetLastError () returned 0x578 [0162.191] CanUserWritePwrScheme () returned 0 [0162.192] GetSystemMetrics (nIndex=46) returned 2 [0162.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.192] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.192] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.192] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.203] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.203] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.203] GetLastError () returned 0x578 [0162.203] CanUserWritePwrScheme () returned 0 [0162.203] GetSystemMetrics (nIndex=46) returned 2 [0162.203] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.203] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.204] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.204] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.221] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.221] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.221] GetLastError () returned 0x578 [0162.221] CanUserWritePwrScheme () returned 0 [0162.222] GetSystemMetrics (nIndex=46) returned 2 [0162.222] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.222] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.222] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.222] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.233] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.233] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.233] GetLastError () returned 0x578 [0162.233] CanUserWritePwrScheme () returned 0 [0162.234] GetSystemMetrics (nIndex=46) returned 2 [0162.234] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.234] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.234] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.234] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.244] GetLastError () returned 0x578 [0162.244] CanUserWritePwrScheme () returned 0 [0162.245] GetSystemMetrics (nIndex=46) returned 2 [0162.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.255] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.255] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.256] GetLastError () returned 0x578 [0162.256] CanUserWritePwrScheme () returned 0 [0162.256] GetSystemMetrics (nIndex=46) returned 2 [0162.256] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.256] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.256] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.256] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.267] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.267] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.267] GetLastError () returned 0x578 [0162.267] CanUserWritePwrScheme () returned 0 [0162.268] GetSystemMetrics (nIndex=46) returned 2 [0162.268] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.268] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.268] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.268] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.281] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.281] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.281] GetLastError () returned 0x578 [0162.282] CanUserWritePwrScheme () returned 0 [0162.282] GetSystemMetrics (nIndex=46) returned 2 [0162.282] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.282] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.282] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.282] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.294] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.294] GetLastError () returned 0x578 [0162.294] CanUserWritePwrScheme () returned 0 [0162.295] GetSystemMetrics (nIndex=46) returned 2 [0162.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.305] GetLastError () returned 0x578 [0162.305] CanUserWritePwrScheme () returned 0 [0162.306] GetSystemMetrics (nIndex=46) returned 2 [0162.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.306] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.306] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.306] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.463] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.463] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.464] GetLastError () returned 0x578 [0162.464] CanUserWritePwrScheme () returned 0 [0162.464] GetSystemMetrics (nIndex=46) returned 2 [0162.464] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.464] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.464] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.477] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.477] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.477] GetLastError () returned 0x578 [0162.477] CanUserWritePwrScheme () returned 0 [0162.478] GetSystemMetrics (nIndex=46) returned 2 [0162.478] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.478] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.478] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.478] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.489] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.489] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.489] GetLastError () returned 0x578 [0162.489] CanUserWritePwrScheme () returned 0 [0162.490] GetSystemMetrics (nIndex=46) returned 2 [0162.490] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.490] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.490] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.490] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.501] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.501] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.501] GetLastError () returned 0x578 [0162.501] CanUserWritePwrScheme () returned 0 [0162.502] GetSystemMetrics (nIndex=46) returned 2 [0162.502] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.502] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.502] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.502] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.512] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.512] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.512] GetLastError () returned 0x578 [0162.512] CanUserWritePwrScheme () returned 0 [0162.513] GetSystemMetrics (nIndex=46) returned 2 [0162.513] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.513] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.513] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.513] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.524] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.524] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.524] GetLastError () returned 0x578 [0162.524] CanUserWritePwrScheme () returned 0 [0162.524] GetSystemMetrics (nIndex=46) returned 2 [0162.524] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.525] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.525] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.525] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.537] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.537] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.537] GetLastError () returned 0x578 [0162.537] CanUserWritePwrScheme () returned 0 [0162.538] GetSystemMetrics (nIndex=46) returned 2 [0162.538] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.538] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.538] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.538] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.570] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.570] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.570] GetLastError () returned 0x578 [0162.570] CanUserWritePwrScheme () returned 0 [0162.571] GetSystemMetrics (nIndex=46) returned 2 [0162.571] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.571] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.571] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.571] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.582] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.582] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.582] GetLastError () returned 0x578 [0162.582] CanUserWritePwrScheme () returned 0 [0162.583] GetSystemMetrics (nIndex=46) returned 2 [0162.583] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.583] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.583] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.583] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.593] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.593] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.593] GetLastError () returned 0x578 [0162.593] CanUserWritePwrScheme () returned 0 [0162.594] GetSystemMetrics (nIndex=46) returned 2 [0162.594] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.594] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.594] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.594] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.608] GetLastError () returned 0x578 [0162.608] CanUserWritePwrScheme () returned 0 [0162.608] GetSystemMetrics (nIndex=46) returned 2 [0162.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.608] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.608] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.608] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.619] GetLastError () returned 0x578 [0162.619] CanUserWritePwrScheme () returned 0 [0162.620] GetSystemMetrics (nIndex=46) returned 2 [0162.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.631] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.631] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.631] GetLastError () returned 0x578 [0162.631] CanUserWritePwrScheme () returned 0 [0162.632] GetSystemMetrics (nIndex=46) returned 2 [0162.632] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.632] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.632] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.632] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.645] GetLastError () returned 0x578 [0162.645] CanUserWritePwrScheme () returned 0 [0162.646] GetSystemMetrics (nIndex=46) returned 2 [0162.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.769] GetLastError () returned 0x578 [0162.769] CanUserWritePwrScheme () returned 0 [0162.770] GetSystemMetrics (nIndex=46) returned 2 [0162.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.782] GetLastError () returned 0x578 [0162.782] CanUserWritePwrScheme () returned 0 [0162.782] GetSystemMetrics (nIndex=46) returned 2 [0162.782] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.782] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.782] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.782] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.796] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.796] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.796] GetLastError () returned 0x578 [0162.796] CanUserWritePwrScheme () returned 0 [0162.797] GetSystemMetrics (nIndex=46) returned 2 [0162.797] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.797] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.797] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.797] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.807] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.807] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.807] GetLastError () returned 0x578 [0162.807] CanUserWritePwrScheme () returned 0 [0162.808] GetSystemMetrics (nIndex=46) returned 2 [0162.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.808] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.808] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.808] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.824] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.824] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.824] GetLastError () returned 0x578 [0162.824] CanUserWritePwrScheme () returned 0 [0162.825] GetSystemMetrics (nIndex=46) returned 2 [0162.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.825] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.825] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.825] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.835] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.835] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.835] GetLastError () returned 0x578 [0162.835] CanUserWritePwrScheme () returned 0 [0162.836] GetSystemMetrics (nIndex=46) returned 2 [0162.836] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.836] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.836] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.836] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.847] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.847] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.847] GetLastError () returned 0x578 [0162.847] CanUserWritePwrScheme () returned 0 [0162.848] GetSystemMetrics (nIndex=46) returned 2 [0162.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.848] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.848] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.848] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.989] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.989] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.989] GetLastError () returned 0x578 [0162.989] CanUserWritePwrScheme () returned 0 [0162.990] GetSystemMetrics (nIndex=46) returned 2 [0162.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.990] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.990] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.990] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.001] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.001] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.001] GetLastError () returned 0x578 [0163.001] CanUserWritePwrScheme () returned 0 [0163.002] GetSystemMetrics (nIndex=46) returned 2 [0163.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.002] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.002] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.002] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.013] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.013] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.013] GetLastError () returned 0x578 [0163.013] CanUserWritePwrScheme () returned 0 [0163.014] GetSystemMetrics (nIndex=46) returned 2 [0163.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.026] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.026] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.026] GetLastError () returned 0x578 [0163.026] CanUserWritePwrScheme () returned 0 [0163.027] GetSystemMetrics (nIndex=46) returned 2 [0163.027] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.027] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.027] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.027] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.037] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.037] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.037] GetLastError () returned 0x578 [0163.038] CanUserWritePwrScheme () returned 0 [0163.038] GetSystemMetrics (nIndex=46) returned 2 [0163.038] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.038] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.039] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.039] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.050] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.050] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.050] GetLastError () returned 0x578 [0163.050] CanUserWritePwrScheme () returned 0 [0163.051] GetSystemMetrics (nIndex=46) returned 2 [0163.051] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.051] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.051] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.051] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.064] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.064] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.064] GetLastError () returned 0x578 [0163.064] CanUserWritePwrScheme () returned 0 [0163.065] GetSystemMetrics (nIndex=46) returned 2 [0163.065] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.065] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.065] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.065] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.100] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.100] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.100] GetLastError () returned 0x578 [0163.100] CanUserWritePwrScheme () returned 0 [0163.101] GetSystemMetrics (nIndex=46) returned 2 [0163.101] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.101] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.101] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.101] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.112] GetLastError () returned 0x578 [0163.112] CanUserWritePwrScheme () returned 0 [0163.113] GetSystemMetrics (nIndex=46) returned 2 [0163.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.126] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.126] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.127] GetLastError () returned 0x578 [0163.127] CanUserWritePwrScheme () returned 0 [0163.127] GetSystemMetrics (nIndex=46) returned 2 [0163.127] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.127] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.128] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.128] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.138] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.138] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.138] GetLastError () returned 0x578 [0163.138] CanUserWritePwrScheme () returned 0 [0163.139] GetSystemMetrics (nIndex=46) returned 2 [0163.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.139] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.139] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.139] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.149] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.149] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.149] GetLastError () returned 0x578 [0163.150] CanUserWritePwrScheme () returned 0 [0163.150] GetSystemMetrics (nIndex=46) returned 2 [0163.150] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.150] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.150] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.150] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.161] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.161] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.161] GetLastError () returned 0x578 [0163.161] CanUserWritePwrScheme () returned 0 [0163.162] GetSystemMetrics (nIndex=46) returned 2 [0163.162] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.162] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.162] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.162] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.172] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.172] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.172] GetLastError () returned 0x578 [0163.172] CanUserWritePwrScheme () returned 0 [0163.173] GetSystemMetrics (nIndex=46) returned 2 [0163.173] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.173] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.173] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.173] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.198] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.198] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.198] GetLastError () returned 0x578 [0163.198] CanUserWritePwrScheme () returned 0 [0163.199] GetSystemMetrics (nIndex=46) returned 2 [0163.199] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.199] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.199] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.199] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.209] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.209] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.209] GetLastError () returned 0x578 [0163.209] CanUserWritePwrScheme () returned 0 [0163.210] GetSystemMetrics (nIndex=46) returned 2 [0163.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.210] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.210] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.210] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.221] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.221] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.221] GetLastError () returned 0x578 [0163.221] CanUserWritePwrScheme () returned 0 [0163.222] GetSystemMetrics (nIndex=46) returned 2 [0163.222] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.222] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.222] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.222] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.232] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.232] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.232] GetLastError () returned 0x578 [0163.232] CanUserWritePwrScheme () returned 0 [0163.233] GetSystemMetrics (nIndex=46) returned 2 [0163.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.233] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.233] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.233] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.244] GetLastError () returned 0x578 [0163.244] CanUserWritePwrScheme () returned 0 [0163.245] GetSystemMetrics (nIndex=46) returned 2 [0163.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.258] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.258] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.258] GetLastError () returned 0x578 [0163.258] CanUserWritePwrScheme () returned 0 [0163.259] GetSystemMetrics (nIndex=46) returned 2 [0163.259] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.259] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.259] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.259] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.269] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.269] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.269] GetLastError () returned 0x578 [0163.269] CanUserWritePwrScheme () returned 0 [0163.270] GetSystemMetrics (nIndex=46) returned 2 [0163.270] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.270] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.270] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.270] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.532] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.532] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.532] GetLastError () returned 0x578 [0163.532] CanUserWritePwrScheme () returned 0 [0163.532] GetSystemMetrics (nIndex=46) returned 2 [0163.532] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.533] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.533] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.533] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.543] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.543] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.543] GetLastError () returned 0x578 [0163.543] CanUserWritePwrScheme () returned 0 [0163.544] GetSystemMetrics (nIndex=46) returned 2 [0163.544] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.544] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.544] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.544] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.555] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.555] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.555] GetLastError () returned 0x578 [0163.555] CanUserWritePwrScheme () returned 0 [0163.556] GetSystemMetrics (nIndex=46) returned 2 [0163.556] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.556] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.556] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.556] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.566] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.566] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.566] GetLastError () returned 0x578 [0163.566] CanUserWritePwrScheme () returned 0 [0163.567] GetSystemMetrics (nIndex=46) returned 2 [0163.567] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.567] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.567] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.567] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.581] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.581] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.581] GetLastError () returned 0x578 [0163.581] CanUserWritePwrScheme () returned 0 [0163.582] GetSystemMetrics (nIndex=46) returned 2 [0163.582] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.582] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.582] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.582] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.593] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.593] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.593] GetLastError () returned 0x578 [0163.593] CanUserWritePwrScheme () returned 0 [0163.594] GetSystemMetrics (nIndex=46) returned 2 [0163.594] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.594] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.594] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.594] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.605] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.605] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.605] GetLastError () returned 0x578 [0163.605] CanUserWritePwrScheme () returned 0 [0163.606] GetSystemMetrics (nIndex=46) returned 2 [0163.606] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.606] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.606] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.606] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.616] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.616] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.616] GetLastError () returned 0x578 [0163.616] CanUserWritePwrScheme () returned 0 [0163.617] GetSystemMetrics (nIndex=46) returned 2 [0163.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.617] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.617] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.617] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.631] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.631] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.631] GetLastError () returned 0x578 [0163.631] CanUserWritePwrScheme () returned 0 [0163.632] GetSystemMetrics (nIndex=46) returned 2 [0163.632] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.632] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.632] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.632] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.646] GetLastError () returned 0x578 [0163.646] CanUserWritePwrScheme () returned 0 [0163.647] GetSystemMetrics (nIndex=46) returned 2 [0163.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.647] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.647] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.658] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.658] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.658] GetLastError () returned 0x578 [0163.658] CanUserWritePwrScheme () returned 0 [0163.659] GetSystemMetrics (nIndex=46) returned 2 [0163.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.659] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.659] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.659] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.669] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.669] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.669] GetLastError () returned 0x578 [0163.670] CanUserWritePwrScheme () returned 0 [0163.670] GetSystemMetrics (nIndex=46) returned 2 [0163.670] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.670] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.670] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.670] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.681] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.681] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.681] GetLastError () returned 0x578 [0163.681] CanUserWritePwrScheme () returned 0 [0163.682] GetSystemMetrics (nIndex=46) returned 2 [0163.682] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.682] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.682] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.682] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.693] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.693] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.693] GetLastError () returned 0x578 [0163.693] CanUserWritePwrScheme () returned 0 [0163.694] GetSystemMetrics (nIndex=46) returned 2 [0163.694] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.694] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.694] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.694] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.709] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.709] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.709] GetLastError () returned 0x578 [0163.709] CanUserWritePwrScheme () returned 0 [0163.710] GetSystemMetrics (nIndex=46) returned 2 [0163.710] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.710] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.710] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.710] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.721] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.721] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.721] GetLastError () returned 0x578 [0163.721] CanUserWritePwrScheme () returned 0 [0163.722] GetSystemMetrics (nIndex=46) returned 2 [0163.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.722] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.722] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.722] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.732] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.732] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.732] GetLastError () returned 0x578 [0163.732] CanUserWritePwrScheme () returned 0 [0163.733] GetSystemMetrics (nIndex=46) returned 2 [0163.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.733] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.733] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.733] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.744] GetLastError () returned 0x578 [0163.744] CanUserWritePwrScheme () returned 0 [0163.745] GetSystemMetrics (nIndex=46) returned 2 [0163.745] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.745] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.745] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.745] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.755] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.755] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.755] GetLastError () returned 0x578 [0163.755] CanUserWritePwrScheme () returned 0 [0163.756] GetSystemMetrics (nIndex=46) returned 2 [0163.756] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.756] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.756] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.756] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.831] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.831] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.831] GetLastError () returned 0x578 [0163.831] CanUserWritePwrScheme () returned 0 [0163.832] GetSystemMetrics (nIndex=46) returned 2 [0163.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.832] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.832] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.832] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.845] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.845] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.845] GetLastError () returned 0x578 [0163.845] CanUserWritePwrScheme () returned 0 [0163.846] GetSystemMetrics (nIndex=46) returned 2 [0163.846] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.846] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.846] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.846] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.857] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.857] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.857] GetLastError () returned 0x578 [0163.857] CanUserWritePwrScheme () returned 0 [0163.858] GetSystemMetrics (nIndex=46) returned 2 [0163.858] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.858] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.858] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.858] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.868] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.868] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.868] GetLastError () returned 0x578 [0163.868] CanUserWritePwrScheme () returned 0 [0163.869] GetSystemMetrics (nIndex=46) returned 2 [0163.869] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.869] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.869] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.869] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.880] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.880] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.880] GetLastError () returned 0x578 [0163.880] CanUserWritePwrScheme () returned 0 [0163.881] GetSystemMetrics (nIndex=46) returned 2 [0163.881] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.881] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.881] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.881] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.891] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.891] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.891] GetLastError () returned 0x578 [0163.892] CanUserWritePwrScheme () returned 0 [0163.892] GetSystemMetrics (nIndex=46) returned 2 [0163.892] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.892] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.892] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.892] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.908] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.908] GetLastError () returned 0x578 [0163.908] CanUserWritePwrScheme () returned 0 [0163.909] GetSystemMetrics (nIndex=46) returned 2 [0163.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.909] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.909] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.909] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.922] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.922] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.922] GetLastError () returned 0x578 [0163.922] CanUserWritePwrScheme () returned 0 [0163.923] GetSystemMetrics (nIndex=46) returned 2 [0163.923] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.923] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.923] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.923] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.934] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.934] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.934] GetLastError () returned 0x578 [0163.934] CanUserWritePwrScheme () returned 0 [0163.935] GetSystemMetrics (nIndex=46) returned 2 [0163.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.946] GetLastError () returned 0x578 [0163.946] CanUserWritePwrScheme () returned 0 [0163.947] GetSystemMetrics (nIndex=46) returned 2 [0163.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.947] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.947] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.947] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.957] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.957] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.957] GetLastError () returned 0x578 [0163.957] CanUserWritePwrScheme () returned 0 [0163.958] GetSystemMetrics (nIndex=46) returned 2 [0163.958] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.958] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.958] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.958] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.971] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.971] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.971] GetLastError () returned 0x578 [0163.971] CanUserWritePwrScheme () returned 0 [0163.972] GetSystemMetrics (nIndex=46) returned 2 [0163.972] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.972] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.972] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.972] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.983] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.983] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.983] GetLastError () returned 0x578 [0163.983] CanUserWritePwrScheme () returned 0 [0163.984] GetSystemMetrics (nIndex=46) returned 2 [0163.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.995] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.995] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.995] GetLastError () returned 0x578 [0163.995] CanUserWritePwrScheme () returned 0 [0163.996] GetSystemMetrics (nIndex=46) returned 2 [0163.996] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.996] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.996] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.996] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.006] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.006] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.006] GetLastError () returned 0x578 [0164.006] CanUserWritePwrScheme () returned 0 [0164.020] GetSystemMetrics (nIndex=46) returned 2 [0164.020] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.020] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.020] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.020] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.040] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.040] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.040] GetLastError () returned 0x578 [0164.040] CanUserWritePwrScheme () returned 0 [0164.041] GetSystemMetrics (nIndex=46) returned 2 [0164.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.051] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.051] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.051] GetLastError () returned 0x578 [0164.051] CanUserWritePwrScheme () returned 0 [0164.052] GetSystemMetrics (nIndex=46) returned 2 [0164.052] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.052] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.052] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.052] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.057] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.057] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.057] GetLastError () returned 0x578 [0164.057] CanUserWritePwrScheme () returned 0 [0164.058] GetSystemMetrics (nIndex=46) returned 2 [0164.058] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.058] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.058] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.058] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.063] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.063] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.063] GetLastError () returned 0x578 [0164.063] CanUserWritePwrScheme () returned 0 [0164.064] GetSystemMetrics (nIndex=46) returned 2 [0164.064] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.064] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.064] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.064] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.069] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.069] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.069] GetLastError () returned 0x578 [0164.069] CanUserWritePwrScheme () returned 0 [0164.070] GetSystemMetrics (nIndex=46) returned 2 [0164.070] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.070] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.070] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.070] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.074] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.074] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.074] GetLastError () returned 0x578 [0164.074] CanUserWritePwrScheme () returned 0 [0164.075] GetSystemMetrics (nIndex=46) returned 2 [0164.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.076] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.076] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.076] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.080] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.080] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.080] GetLastError () returned 0x578 [0164.080] CanUserWritePwrScheme () returned 0 [0164.081] GetSystemMetrics (nIndex=46) returned 2 [0164.081] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.081] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.081] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.081] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.086] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.086] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.086] GetLastError () returned 0x578 [0164.086] CanUserWritePwrScheme () returned 0 [0164.087] GetSystemMetrics (nIndex=46) returned 2 [0164.087] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.087] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.087] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.087] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.092] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.092] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.092] GetLastError () returned 0x578 [0164.092] CanUserWritePwrScheme () returned 0 [0164.093] GetSystemMetrics (nIndex=46) returned 2 [0164.093] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.093] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.093] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.093] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.100] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.100] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.100] GetLastError () returned 0x578 [0164.100] CanUserWritePwrScheme () returned 0 [0164.101] GetSystemMetrics (nIndex=46) returned 2 [0164.101] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.101] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.101] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.102] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.106] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.106] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.106] GetLastError () returned 0x578 [0164.106] CanUserWritePwrScheme () returned 0 [0164.107] GetSystemMetrics (nIndex=46) returned 2 [0164.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.107] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.112] GetLastError () returned 0x578 [0164.112] CanUserWritePwrScheme () returned 0 [0164.113] GetSystemMetrics (nIndex=46) returned 2 [0164.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.427] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.427] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.427] GetLastError () returned 0x578 [0164.427] CanUserWritePwrScheme () returned 0 [0164.428] GetSystemMetrics (nIndex=46) returned 2 [0164.428] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.428] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.428] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.428] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.440] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.440] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.440] GetLastError () returned 0x578 [0164.440] CanUserWritePwrScheme () returned 0 [0164.441] GetSystemMetrics (nIndex=46) returned 2 [0164.441] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.441] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.441] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.441] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.452] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.452] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.452] GetLastError () returned 0x578 [0164.452] CanUserWritePwrScheme () returned 0 [0164.453] GetSystemMetrics (nIndex=46) returned 2 [0164.453] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.453] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.453] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.453] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.464] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.464] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.464] GetLastError () returned 0x578 [0164.464] CanUserWritePwrScheme () returned 0 [0164.465] GetSystemMetrics (nIndex=46) returned 2 [0164.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.465] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.465] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.476] GetLastError () returned 0x578 [0164.476] CanUserWritePwrScheme () returned 0 [0164.477] GetSystemMetrics (nIndex=46) returned 2 [0164.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.489] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.489] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.489] GetLastError () returned 0x578 [0164.489] CanUserWritePwrScheme () returned 0 [0164.490] GetSystemMetrics (nIndex=46) returned 2 [0164.490] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.490] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.490] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.490] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.502] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.502] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.502] GetLastError () returned 0x578 [0164.502] CanUserWritePwrScheme () returned 0 [0164.503] GetSystemMetrics (nIndex=46) returned 2 [0164.503] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.503] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.503] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.503] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.514] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.514] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.515] GetLastError () returned 0x578 [0164.515] CanUserWritePwrScheme () returned 0 [0164.515] GetSystemMetrics (nIndex=46) returned 2 [0164.515] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.515] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.650] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.650] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.650] GetLastError () returned 0x578 [0164.650] CanUserWritePwrScheme () returned 0 [0164.651] GetSystemMetrics (nIndex=46) returned 2 [0164.651] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.651] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.651] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.651] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.663] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.663] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.663] GetLastError () returned 0x578 [0164.663] CanUserWritePwrScheme () returned 0 [0164.664] GetSystemMetrics (nIndex=46) returned 2 [0164.664] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.664] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.664] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.664] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.675] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.675] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.676] GetLastError () returned 0x578 [0164.676] CanUserWritePwrScheme () returned 0 [0164.676] GetSystemMetrics (nIndex=46) returned 2 [0164.676] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.676] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.677] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.677] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.687] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.687] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.687] GetLastError () returned 0x578 [0164.687] CanUserWritePwrScheme () returned 0 [0164.688] GetSystemMetrics (nIndex=46) returned 2 [0164.689] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.689] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.689] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.689] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.700] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.700] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.700] GetLastError () returned 0x578 [0164.700] CanUserWritePwrScheme () returned 0 [0164.701] GetSystemMetrics (nIndex=46) returned 2 [0164.701] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.701] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.701] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.701] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.712] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.712] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.712] GetLastError () returned 0x578 [0164.712] CanUserWritePwrScheme () returned 0 [0164.713] GetSystemMetrics (nIndex=46) returned 2 [0164.713] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.713] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.713] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.713] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.725] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.725] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.725] GetLastError () returned 0x578 [0164.725] CanUserWritePwrScheme () returned 0 [0164.726] GetSystemMetrics (nIndex=46) returned 2 [0164.726] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.726] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.726] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.726] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.775] GetLastError () returned 0x578 [0164.775] CanUserWritePwrScheme () returned 0 [0164.776] GetSystemMetrics (nIndex=46) returned 2 [0164.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.776] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.776] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.776] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.787] GetLastError () returned 0x578 [0164.787] CanUserWritePwrScheme () returned 0 [0164.788] GetSystemMetrics (nIndex=46) returned 2 [0164.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.788] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.788] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.799] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.799] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.799] GetLastError () returned 0x578 [0164.799] CanUserWritePwrScheme () returned 0 [0164.801] GetSystemMetrics (nIndex=46) returned 2 [0164.801] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.801] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.801] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.801] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.811] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.811] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.812] GetLastError () returned 0x578 [0164.812] CanUserWritePwrScheme () returned 0 [0164.812] GetSystemMetrics (nIndex=46) returned 2 [0164.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.812] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.813] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.813] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.823] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.823] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.823] GetLastError () returned 0x578 [0164.823] CanUserWritePwrScheme () returned 0 [0164.824] GetSystemMetrics (nIndex=46) returned 2 [0164.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.824] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.824] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.824] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.836] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.836] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.836] GetLastError () returned 0x578 [0164.836] CanUserWritePwrScheme () returned 0 [0164.837] GetSystemMetrics (nIndex=46) returned 2 [0164.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.837] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.837] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.837] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.848] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.848] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.848] GetLastError () returned 0x578 [0164.848] CanUserWritePwrScheme () returned 0 [0164.849] GetSystemMetrics (nIndex=46) returned 2 [0164.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.849] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.849] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.849] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.938] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.938] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.939] GetLastError () returned 0x578 [0164.939] CanUserWritePwrScheme () returned 0 [0164.939] GetSystemMetrics (nIndex=46) returned 2 [0164.939] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.940] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.940] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.940] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.952] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.952] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.952] GetLastError () returned 0x578 [0164.952] CanUserWritePwrScheme () returned 0 [0164.953] GetSystemMetrics (nIndex=46) returned 2 [0164.953] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.953] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.953] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.953] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.963] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.963] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.963] GetLastError () returned 0x578 [0164.963] CanUserWritePwrScheme () returned 0 [0164.964] GetSystemMetrics (nIndex=46) returned 2 [0164.964] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.964] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.964] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.964] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.975] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.975] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.975] GetLastError () returned 0x578 [0164.975] CanUserWritePwrScheme () returned 0 [0164.976] GetSystemMetrics (nIndex=46) returned 2 [0164.976] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.976] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.976] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.976] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.988] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.988] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.988] GetLastError () returned 0x578 [0164.988] CanUserWritePwrScheme () returned 0 [0164.989] GetSystemMetrics (nIndex=46) returned 2 [0164.989] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.989] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.989] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.989] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.000] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.000] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.000] GetLastError () returned 0x578 [0165.000] CanUserWritePwrScheme () returned 0 [0165.001] GetSystemMetrics (nIndex=46) returned 2 [0165.001] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.001] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.001] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.001] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.012] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.012] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.012] GetLastError () returned 0x578 [0165.012] CanUserWritePwrScheme () returned 0 [0165.013] GetSystemMetrics (nIndex=46) returned 2 [0165.013] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.013] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.013] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.013] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.032] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.032] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.032] GetLastError () returned 0x578 [0165.032] CanUserWritePwrScheme () returned 0 [0165.033] GetSystemMetrics (nIndex=46) returned 2 [0165.033] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.033] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.033] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.033] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.044] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.044] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.044] GetLastError () returned 0x578 [0165.044] CanUserWritePwrScheme () returned 0 [0165.045] GetSystemMetrics (nIndex=46) returned 2 [0165.045] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.045] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.045] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.045] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.057] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.057] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.057] GetLastError () returned 0x578 [0165.057] CanUserWritePwrScheme () returned 0 [0165.058] GetSystemMetrics (nIndex=46) returned 2 [0165.058] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.058] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.058] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.058] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.069] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.069] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.069] GetLastError () returned 0x578 [0165.069] CanUserWritePwrScheme () returned 0 [0165.070] GetSystemMetrics (nIndex=46) returned 2 [0165.070] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.070] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.070] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.070] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.081] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.081] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.081] GetLastError () returned 0x578 [0165.081] CanUserWritePwrScheme () returned 0 [0165.081] GetSystemMetrics (nIndex=46) returned 2 [0165.082] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.082] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.082] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.082] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.093] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.093] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.093] GetLastError () returned 0x578 [0165.093] CanUserWritePwrScheme () returned 0 [0165.094] GetSystemMetrics (nIndex=46) returned 2 [0165.094] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.094] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.094] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.094] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.105] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.105] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.105] GetLastError () returned 0x578 [0165.105] CanUserWritePwrScheme () returned 0 [0165.106] GetSystemMetrics (nIndex=46) returned 2 [0165.106] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.106] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.106] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.106] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.117] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.117] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.117] GetLastError () returned 0x578 [0165.117] CanUserWritePwrScheme () returned 0 [0165.118] GetSystemMetrics (nIndex=46) returned 2 [0165.118] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.118] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.118] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.118] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.278] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.278] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.278] GetLastError () returned 0x578 [0165.278] CanUserWritePwrScheme () returned 0 [0165.279] GetSystemMetrics (nIndex=46) returned 2 [0165.279] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.279] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.279] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.279] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.292] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.292] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.292] GetLastError () returned 0x578 [0165.292] CanUserWritePwrScheme () returned 0 [0165.293] GetSystemMetrics (nIndex=46) returned 2 [0165.293] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.293] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.293] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.293] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.304] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.304] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.304] GetLastError () returned 0x578 [0165.304] CanUserWritePwrScheme () returned 0 [0165.305] GetSystemMetrics (nIndex=46) returned 2 [0165.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.305] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.305] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.305] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.315] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.315] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.315] GetLastError () returned 0x578 [0165.315] CanUserWritePwrScheme () returned 0 [0165.316] GetSystemMetrics (nIndex=46) returned 2 [0165.316] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.316] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.316] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.316] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.327] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.327] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.327] GetLastError () returned 0x578 [0165.327] CanUserWritePwrScheme () returned 0 [0165.328] GetSystemMetrics (nIndex=46) returned 2 [0165.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.328] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.328] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.328] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.341] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.341] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.341] GetLastError () returned 0x578 [0165.342] CanUserWritePwrScheme () returned 0 [0165.342] GetSystemMetrics (nIndex=46) returned 2 [0165.342] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.342] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.342] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.343] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.353] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.353] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.353] GetLastError () returned 0x578 [0165.353] CanUserWritePwrScheme () returned 0 [0165.354] GetSystemMetrics (nIndex=46) returned 2 [0165.354] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.354] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.354] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.354] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.399] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.399] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.399] GetLastError () returned 0x578 [0165.399] CanUserWritePwrScheme () returned 0 [0165.407] GetSystemMetrics (nIndex=46) returned 2 [0165.407] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.407] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.407] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.407] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.420] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.420] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.420] GetLastError () returned 0x578 [0165.420] CanUserWritePwrScheme () returned 0 [0165.421] GetSystemMetrics (nIndex=46) returned 2 [0165.421] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.421] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.421] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.421] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.432] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.432] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.432] GetLastError () returned 0x578 [0165.432] CanUserWritePwrScheme () returned 0 [0165.433] GetSystemMetrics (nIndex=46) returned 2 [0165.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.433] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.433] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.433] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.443] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.443] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.444] GetLastError () returned 0x578 [0165.444] CanUserWritePwrScheme () returned 0 [0165.444] GetSystemMetrics (nIndex=46) returned 2 [0165.444] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.444] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.444] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.445] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.455] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.455] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.455] GetLastError () returned 0x578 [0165.455] CanUserWritePwrScheme () returned 0 [0165.456] GetSystemMetrics (nIndex=46) returned 2 [0165.456] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.456] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.456] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.456] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.469] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.469] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.469] GetLastError () returned 0x578 [0165.469] CanUserWritePwrScheme () returned 0 [0165.470] GetSystemMetrics (nIndex=46) returned 2 [0165.470] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.470] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.470] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.470] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.481] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.481] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.481] GetLastError () returned 0x578 [0165.481] CanUserWritePwrScheme () returned 0 [0165.482] GetSystemMetrics (nIndex=46) returned 2 [0165.482] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.482] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.482] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.482] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.495] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.495] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.495] GetLastError () returned 0x578 [0165.495] CanUserWritePwrScheme () returned 0 [0165.496] GetSystemMetrics (nIndex=46) returned 2 [0165.496] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.496] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.496] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.496] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.507] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.507] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.507] GetLastError () returned 0x578 [0165.507] CanUserWritePwrScheme () returned 0 [0165.508] GetSystemMetrics (nIndex=46) returned 2 [0165.508] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.508] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.508] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.508] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.521] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.521] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.521] GetLastError () returned 0x578 [0165.521] CanUserWritePwrScheme () returned 0 [0165.522] GetSystemMetrics (nIndex=46) returned 2 [0165.522] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.522] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.522] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.522] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.532] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.532] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.532] GetLastError () returned 0x578 [0165.532] CanUserWritePwrScheme () returned 0 [0165.533] GetSystemMetrics (nIndex=46) returned 2 [0165.533] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.533] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.533] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.533] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.544] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.544] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.544] GetLastError () returned 0x578 [0165.544] CanUserWritePwrScheme () returned 0 [0165.545] GetSystemMetrics (nIndex=46) returned 2 [0165.545] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.545] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.545] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.545] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.556] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.556] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.556] GetLastError () returned 0x578 [0165.556] CanUserWritePwrScheme () returned 0 [0165.557] GetSystemMetrics (nIndex=46) returned 2 [0165.557] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.557] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.557] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.557] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.569] GetLastError () returned 0x578 [0165.569] CanUserWritePwrScheme () returned 0 [0165.570] GetSystemMetrics (nIndex=46) returned 2 [0165.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.570] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.570] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.570] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.581] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.581] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.581] GetLastError () returned 0x578 [0165.581] CanUserWritePwrScheme () returned 0 [0165.582] GetSystemMetrics (nIndex=46) returned 2 [0165.582] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.582] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.582] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.582] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.602] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.603] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.603] GetLastError () returned 0x578 [0165.603] CanUserWritePwrScheme () returned 0 [0165.603] GetSystemMetrics (nIndex=46) returned 2 [0165.604] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.604] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.604] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.604] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.617] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.617] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.617] GetLastError () returned 0x578 [0165.617] CanUserWritePwrScheme () returned 0 [0165.618] GetSystemMetrics (nIndex=46) returned 2 [0165.618] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.618] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.618] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.618] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.681] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.681] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.681] GetLastError () returned 0x578 [0165.681] CanUserWritePwrScheme () returned 0 [0165.682] GetSystemMetrics (nIndex=46) returned 2 [0165.682] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.682] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.682] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.683] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.696] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.696] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.696] GetLastError () returned 0x578 [0165.696] CanUserWritePwrScheme () returned 0 [0165.697] GetSystemMetrics (nIndex=46) returned 2 [0165.697] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.697] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.697] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.697] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.708] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.708] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.708] GetLastError () returned 0x578 [0165.708] CanUserWritePwrScheme () returned 0 [0165.709] GetSystemMetrics (nIndex=46) returned 2 [0165.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.709] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.722] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.722] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.722] GetLastError () returned 0x578 [0165.722] CanUserWritePwrScheme () returned 0 [0165.723] GetSystemMetrics (nIndex=46) returned 2 [0165.723] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.723] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.723] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.723] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.734] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.734] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.734] GetLastError () returned 0x578 [0165.734] CanUserWritePwrScheme () returned 0 [0165.735] GetSystemMetrics (nIndex=46) returned 2 [0165.735] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.735] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.735] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.735] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.745] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.745] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.745] GetLastError () returned 0x578 [0165.745] CanUserWritePwrScheme () returned 0 [0165.746] GetSystemMetrics (nIndex=46) returned 2 [0165.746] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.746] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.746] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.746] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.757] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.757] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.757] GetLastError () returned 0x578 [0165.757] CanUserWritePwrScheme () returned 0 [0165.758] GetSystemMetrics (nIndex=46) returned 2 [0165.758] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.758] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.758] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.758] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.772] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.772] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.772] GetLastError () returned 0x578 [0165.772] CanUserWritePwrScheme () returned 0 [0165.773] GetSystemMetrics (nIndex=46) returned 2 [0165.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.773] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.773] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.863] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.863] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.863] GetLastError () returned 0x578 [0165.863] CanUserWritePwrScheme () returned 0 [0165.864] GetSystemMetrics (nIndex=46) returned 2 [0165.864] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.864] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.864] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.864] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.877] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.877] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.877] GetLastError () returned 0x578 [0165.877] CanUserWritePwrScheme () returned 0 [0165.878] GetSystemMetrics (nIndex=46) returned 2 [0165.878] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.878] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.878] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.878] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.889] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.889] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.889] GetLastError () returned 0x578 [0165.889] CanUserWritePwrScheme () returned 0 [0165.890] GetSystemMetrics (nIndex=46) returned 2 [0165.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.890] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.903] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.903] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.903] GetLastError () returned 0x578 [0165.903] CanUserWritePwrScheme () returned 0 [0165.904] GetSystemMetrics (nIndex=46) returned 2 [0165.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.904] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.904] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.904] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.915] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.915] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.915] GetLastError () returned 0x578 [0165.915] CanUserWritePwrScheme () returned 0 [0165.916] GetSystemMetrics (nIndex=46) returned 2 [0165.916] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.916] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.916] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.916] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.929] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.929] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.929] GetLastError () returned 0x578 [0165.929] CanUserWritePwrScheme () returned 0 [0165.930] GetSystemMetrics (nIndex=46) returned 2 [0165.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.930] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.941] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.941] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.941] GetLastError () returned 0x578 [0165.941] CanUserWritePwrScheme () returned 0 [0165.942] GetSystemMetrics (nIndex=46) returned 2 [0165.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.953] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.953] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.953] GetLastError () returned 0x578 [0165.953] CanUserWritePwrScheme () returned 0 [0165.954] GetSystemMetrics (nIndex=46) returned 2 [0165.954] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.954] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.954] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.954] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.985] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.985] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.985] GetLastError () returned 0x578 [0165.985] CanUserWritePwrScheme () returned 0 [0165.986] GetSystemMetrics (nIndex=46) returned 2 [0165.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.986] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.997] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.997] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.997] GetLastError () returned 0x578 [0165.997] CanUserWritePwrScheme () returned 0 [0165.998] GetSystemMetrics (nIndex=46) returned 2 [0165.998] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.998] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.998] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.998] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.008] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.008] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.008] GetLastError () returned 0x578 [0166.008] CanUserWritePwrScheme () returned 0 [0166.009] GetSystemMetrics (nIndex=46) returned 2 [0166.009] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.009] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.009] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.009] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.020] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.020] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.020] GetLastError () returned 0x578 [0166.020] CanUserWritePwrScheme () returned 0 [0166.021] GetSystemMetrics (nIndex=46) returned 2 [0166.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.021] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.021] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.021] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.032] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.032] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.032] GetLastError () returned 0x578 [0166.032] CanUserWritePwrScheme () returned 0 [0166.033] GetSystemMetrics (nIndex=46) returned 2 [0166.033] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.033] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.033] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.033] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.046] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.046] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.046] GetLastError () returned 0x578 [0166.046] CanUserWritePwrScheme () returned 0 [0166.047] GetSystemMetrics (nIndex=46) returned 2 [0166.047] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.047] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.047] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.047] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.058] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.058] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.058] GetLastError () returned 0x578 [0166.058] CanUserWritePwrScheme () returned 0 [0166.059] GetSystemMetrics (nIndex=46) returned 2 [0166.059] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.059] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.059] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.059] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.074] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.074] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.074] GetLastError () returned 0x578 [0166.074] CanUserWritePwrScheme () returned 0 [0166.075] GetSystemMetrics (nIndex=46) returned 2 [0166.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.075] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.075] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.075] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.086] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.086] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.086] GetLastError () returned 0x578 [0166.086] CanUserWritePwrScheme () returned 0 [0166.087] GetSystemMetrics (nIndex=46) returned 2 [0166.087] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.087] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.087] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.087] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.101] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.101] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.101] GetLastError () returned 0x578 [0166.101] CanUserWritePwrScheme () returned 0 [0166.102] GetSystemMetrics (nIndex=46) returned 2 [0166.102] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.102] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.102] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.102] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.113] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.113] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.113] GetLastError () returned 0x578 [0166.113] CanUserWritePwrScheme () returned 0 [0166.114] GetSystemMetrics (nIndex=46) returned 2 [0166.114] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.114] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.114] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.114] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.124] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.124] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.124] GetLastError () returned 0x578 [0166.125] CanUserWritePwrScheme () returned 0 [0166.125] GetSystemMetrics (nIndex=46) returned 2 [0166.125] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.125] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.126] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.126] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.136] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.136] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.136] GetLastError () returned 0x578 [0166.136] CanUserWritePwrScheme () returned 0 [0166.137] GetSystemMetrics (nIndex=46) returned 2 [0166.137] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.137] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.137] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.137] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.148] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.148] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.148] GetLastError () returned 0x578 [0166.148] CanUserWritePwrScheme () returned 0 [0166.149] GetSystemMetrics (nIndex=46) returned 2 [0166.149] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.149] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.149] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.149] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.163] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.163] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.163] GetLastError () returned 0x578 [0166.163] CanUserWritePwrScheme () returned 0 [0166.164] GetSystemMetrics (nIndex=46) returned 2 [0166.164] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.164] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.164] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.164] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.175] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.175] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.175] GetLastError () returned 0x578 [0166.175] CanUserWritePwrScheme () returned 0 [0166.176] GetSystemMetrics (nIndex=46) returned 2 [0166.176] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.176] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.176] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.176] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.187] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.187] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.187] GetLastError () returned 0x578 [0166.187] CanUserWritePwrScheme () returned 0 [0166.188] GetSystemMetrics (nIndex=46) returned 2 [0166.188] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.188] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.188] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.188] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.197] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.197] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.197] GetLastError () returned 0x578 [0166.197] CanUserWritePwrScheme () returned 0 [0166.198] GetSystemMetrics (nIndex=46) returned 2 [0166.198] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.198] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.198] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.198] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.203] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.203] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.203] GetLastError () returned 0x578 [0166.203] CanUserWritePwrScheme () returned 0 [0166.204] GetSystemMetrics (nIndex=46) returned 2 [0166.204] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.204] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.204] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.204] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.209] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.209] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.209] GetLastError () returned 0x578 [0166.209] CanUserWritePwrScheme () returned 0 [0166.210] GetSystemMetrics (nIndex=46) returned 2 [0166.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.210] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.210] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.210] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.217] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.217] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.217] GetLastError () returned 0x578 [0166.217] CanUserWritePwrScheme () returned 0 [0166.218] GetSystemMetrics (nIndex=46) returned 2 [0166.218] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.218] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.218] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.218] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.223] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.223] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.223] GetLastError () returned 0x578 [0166.223] CanUserWritePwrScheme () returned 0 [0166.224] GetSystemMetrics (nIndex=46) returned 2 [0166.224] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.224] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.224] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.224] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.229] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.229] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.229] GetLastError () returned 0x578 [0166.229] CanUserWritePwrScheme () returned 0 [0166.230] GetSystemMetrics (nIndex=46) returned 2 [0166.230] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.230] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.230] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.230] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.235] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.235] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.235] GetLastError () returned 0x578 [0166.235] CanUserWritePwrScheme () returned 0 [0166.236] GetSystemMetrics (nIndex=46) returned 2 [0166.236] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.236] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.236] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.236] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.241] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.241] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.241] GetLastError () returned 0x578 [0166.241] CanUserWritePwrScheme () returned 0 [0166.242] GetSystemMetrics (nIndex=46) returned 2 [0166.242] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.242] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.242] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.242] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.247] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.248] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.248] GetLastError () returned 0x578 [0166.248] CanUserWritePwrScheme () returned 0 [0166.248] GetSystemMetrics (nIndex=46) returned 2 [0166.248] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.249] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.249] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.249] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.259] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.259] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.259] GetLastError () returned 0x578 [0166.259] CanUserWritePwrScheme () returned 0 [0166.260] GetSystemMetrics (nIndex=46) returned 2 [0166.260] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.260] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.260] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.260] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.274] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.274] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.274] GetLastError () returned 0x578 [0166.274] CanUserWritePwrScheme () returned 0 [0166.275] GetSystemMetrics (nIndex=46) returned 2 [0166.275] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.275] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.275] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.275] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.289] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.289] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.289] GetLastError () returned 0x578 [0166.289] CanUserWritePwrScheme () returned 0 [0166.290] GetSystemMetrics (nIndex=46) returned 2 [0166.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.301] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.301] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.301] GetLastError () returned 0x578 [0166.301] CanUserWritePwrScheme () returned 0 [0166.302] GetSystemMetrics (nIndex=46) returned 2 [0166.302] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.302] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.302] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.302] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.312] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.312] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.312] GetLastError () returned 0x578 [0166.312] CanUserWritePwrScheme () returned 0 [0166.313] GetSystemMetrics (nIndex=46) returned 2 [0166.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.313] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.313] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.313] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.324] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.324] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.324] GetLastError () returned 0x578 [0166.324] CanUserWritePwrScheme () returned 0 [0166.325] GetSystemMetrics (nIndex=46) returned 2 [0166.325] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.325] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.325] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.325] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.337] GetLastError () returned 0x578 [0166.337] CanUserWritePwrScheme () returned 0 [0166.338] GetSystemMetrics (nIndex=46) returned 2 [0166.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.338] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.338] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.338] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.351] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.351] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.351] GetLastError () returned 0x578 [0166.351] CanUserWritePwrScheme () returned 0 [0166.352] GetSystemMetrics (nIndex=46) returned 2 [0166.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.352] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.352] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.352] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.362] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.362] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.362] GetLastError () returned 0x578 [0166.362] CanUserWritePwrScheme () returned 0 [0166.363] GetSystemMetrics (nIndex=46) returned 2 [0166.363] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.363] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.363] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.363] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.374] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.374] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.374] GetLastError () returned 0x578 [0166.374] CanUserWritePwrScheme () returned 0 [0166.375] GetSystemMetrics (nIndex=46) returned 2 [0166.375] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.375] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.375] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.375] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.434] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.434] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.434] GetLastError () returned 0x578 [0166.434] CanUserWritePwrScheme () returned 0 [0166.435] GetSystemMetrics (nIndex=46) returned 2 [0166.435] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.435] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.435] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.435] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.441] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.441] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.441] GetLastError () returned 0x578 [0166.441] CanUserWritePwrScheme () returned 0 [0166.442] GetSystemMetrics (nIndex=46) returned 2 [0166.442] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.442] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.442] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.442] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.447] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.447] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.447] GetLastError () returned 0x578 [0166.447] CanUserWritePwrScheme () returned 0 [0166.448] GetSystemMetrics (nIndex=46) returned 2 [0166.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.448] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.448] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.448] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.452] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.452] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.452] GetLastError () returned 0x578 [0166.452] CanUserWritePwrScheme () returned 0 [0166.453] GetSystemMetrics (nIndex=46) returned 2 [0166.453] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.453] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.453] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.453] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.458] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.458] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.458] GetLastError () returned 0x578 [0166.458] CanUserWritePwrScheme () returned 0 [0166.459] GetSystemMetrics (nIndex=46) returned 2 [0166.459] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.459] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.459] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.459] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.464] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.464] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.464] GetLastError () returned 0x578 [0166.464] CanUserWritePwrScheme () returned 0 [0166.465] GetSystemMetrics (nIndex=46) returned 2 [0166.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.465] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.465] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.472] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.472] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.472] GetLastError () returned 0x578 [0166.472] CanUserWritePwrScheme () returned 0 [0166.473] GetSystemMetrics (nIndex=46) returned 2 [0166.473] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.473] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.473] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.473] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.478] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.478] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.478] GetLastError () returned 0x578 [0166.478] CanUserWritePwrScheme () returned 0 [0166.479] GetSystemMetrics (nIndex=46) returned 2 [0166.479] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.479] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.479] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.479] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.483] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.483] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.483] GetLastError () returned 0x578 [0166.483] CanUserWritePwrScheme () returned 0 [0166.484] GetSystemMetrics (nIndex=46) returned 2 [0166.484] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.484] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.484] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.484] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.489] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.489] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.490] GetLastError () returned 0x578 [0166.490] CanUserWritePwrScheme () returned 0 [0166.490] GetSystemMetrics (nIndex=46) returned 2 [0166.490] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.490] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.491] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.491] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.495] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.495] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.495] GetLastError () returned 0x578 [0166.495] CanUserWritePwrScheme () returned 0 [0166.496] GetSystemMetrics (nIndex=46) returned 2 [0166.496] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.496] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.496] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.496] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.501] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.501] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.501] GetLastError () returned 0x578 [0166.501] CanUserWritePwrScheme () returned 0 [0166.502] GetSystemMetrics (nIndex=46) returned 2 [0166.502] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.502] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.502] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.502] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.507] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.507] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.507] GetLastError () returned 0x578 [0166.507] CanUserWritePwrScheme () returned 0 [0166.508] GetSystemMetrics (nIndex=46) returned 2 [0166.508] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.508] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.508] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.508] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.513] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.513] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.513] GetLastError () returned 0x578 [0166.513] CanUserWritePwrScheme () returned 0 [0166.514] GetSystemMetrics (nIndex=46) returned 2 [0166.514] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.514] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.514] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.514] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.522] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.522] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.522] GetLastError () returned 0x578 [0166.522] CanUserWritePwrScheme () returned 0 [0166.523] GetSystemMetrics (nIndex=46) returned 2 [0166.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.523] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.523] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.523] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.534] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.534] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.534] GetLastError () returned 0x578 [0166.534] CanUserWritePwrScheme () returned 0 [0166.538] GetSystemMetrics (nIndex=46) returned 2 [0166.538] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.538] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.538] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.538] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.549] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.549] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.549] GetLastError () returned 0x578 [0166.549] CanUserWritePwrScheme () returned 0 [0166.550] GetSystemMetrics (nIndex=46) returned 2 [0166.550] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.550] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.550] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.550] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.651] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.651] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.651] GetLastError () returned 0x578 [0166.652] CanUserWritePwrScheme () returned 0 [0166.652] GetSystemMetrics (nIndex=46) returned 2 [0166.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.652] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.652] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.653] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.663] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.663] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.663] GetLastError () returned 0x578 [0166.663] CanUserWritePwrScheme () returned 0 [0166.664] GetSystemMetrics (nIndex=46) returned 2 [0166.664] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.664] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.664] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.664] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.678] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.678] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.678] GetLastError () returned 0x578 [0166.678] CanUserWritePwrScheme () returned 0 [0166.679] GetSystemMetrics (nIndex=46) returned 2 [0166.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.679] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.690] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.690] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.690] GetLastError () returned 0x578 [0166.690] CanUserWritePwrScheme () returned 0 [0166.691] GetSystemMetrics (nIndex=46) returned 2 [0166.691] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.691] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.691] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.691] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.702] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.702] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.702] GetLastError () returned 0x578 [0166.702] CanUserWritePwrScheme () returned 0 [0166.703] GetSystemMetrics (nIndex=46) returned 2 [0166.703] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.703] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.703] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.703] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.713] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.713] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.713] GetLastError () returned 0x578 [0166.713] CanUserWritePwrScheme () returned 0 [0166.714] GetSystemMetrics (nIndex=46) returned 2 [0166.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.714] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.714] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.714] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.725] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.725] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.725] GetLastError () returned 0x578 [0166.725] CanUserWritePwrScheme () returned 0 [0166.726] GetSystemMetrics (nIndex=46) returned 2 [0166.726] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.726] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.726] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.726] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.741] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.741] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.741] GetLastError () returned 0x578 [0166.741] CanUserWritePwrScheme () returned 0 [0166.742] GetSystemMetrics (nIndex=46) returned 2 [0166.742] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.742] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.742] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.742] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.753] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.753] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.753] GetLastError () returned 0x578 [0166.753] CanUserWritePwrScheme () returned 0 [0166.754] GetSystemMetrics (nIndex=46) returned 2 [0166.754] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.754] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.754] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.754] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.765] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.765] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.765] GetLastError () returned 0x578 [0166.765] CanUserWritePwrScheme () returned 0 [0166.766] GetSystemMetrics (nIndex=46) returned 2 [0166.766] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.766] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.766] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.766] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.777] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.777] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.777] GetLastError () returned 0x578 [0166.777] CanUserWritePwrScheme () returned 0 [0166.778] GetSystemMetrics (nIndex=46) returned 2 [0166.778] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.778] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.778] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.778] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.788] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.788] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.788] GetLastError () returned 0x578 [0166.788] CanUserWritePwrScheme () returned 0 [0166.789] GetSystemMetrics (nIndex=46) returned 2 [0166.789] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.789] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.789] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.789] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.803] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.803] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.803] GetLastError () returned 0x578 [0166.804] CanUserWritePwrScheme () returned 0 [0166.804] GetSystemMetrics (nIndex=46) returned 2 [0166.804] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.804] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.816] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.816] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.816] GetLastError () returned 0x578 [0166.816] CanUserWritePwrScheme () returned 0 [0166.817] GetSystemMetrics (nIndex=46) returned 2 [0166.817] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.817] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.817] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.817] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.828] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.828] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.828] GetLastError () returned 0x578 [0166.828] CanUserWritePwrScheme () returned 0 [0166.829] GetSystemMetrics (nIndex=46) returned 2 [0166.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.829] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.829] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.829] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.839] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.839] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.839] GetLastError () returned 0x578 [0166.839] CanUserWritePwrScheme () returned 0 [0166.840] GetSystemMetrics (nIndex=46) returned 2 [0166.840] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.840] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.840] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.840] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.851] GetLastError () returned 0x578 [0166.851] CanUserWritePwrScheme () returned 0 [0166.852] GetSystemMetrics (nIndex=46) returned 2 [0166.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.852] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.852] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.852] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.866] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.866] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.866] GetLastError () returned 0x578 [0166.866] CanUserWritePwrScheme () returned 0 [0166.867] GetSystemMetrics (nIndex=46) returned 2 [0166.867] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.867] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.867] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.867] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.394] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.394] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.394] GetLastError () returned 0x578 [0167.394] CanUserWritePwrScheme () returned 0 [0167.395] GetSystemMetrics (nIndex=46) returned 2 [0167.395] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.395] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.395] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.395] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.413] GetLastError () returned 0x578 [0167.414] CanUserWritePwrScheme () returned 0 [0167.414] GetSystemMetrics (nIndex=46) returned 2 [0167.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.414] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.414] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.415] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.425] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.425] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.425] GetLastError () returned 0x578 [0167.425] CanUserWritePwrScheme () returned 0 [0167.426] GetSystemMetrics (nIndex=46) returned 2 [0167.426] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.426] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.426] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.426] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.437] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.437] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.437] GetLastError () returned 0x578 [0167.437] CanUserWritePwrScheme () returned 0 [0167.438] GetSystemMetrics (nIndex=46) returned 2 [0167.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.438] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.451] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.451] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.451] GetLastError () returned 0x578 [0167.451] CanUserWritePwrScheme () returned 0 [0167.452] GetSystemMetrics (nIndex=46) returned 2 [0167.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.452] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.452] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.452] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.463] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.463] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.463] GetLastError () returned 0x578 [0167.463] CanUserWritePwrScheme () returned 0 [0167.464] GetSystemMetrics (nIndex=46) returned 2 [0167.464] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.464] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.464] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.464] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.475] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.475] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.475] GetLastError () returned 0x578 [0167.475] CanUserWritePwrScheme () returned 0 [0167.476] GetSystemMetrics (nIndex=46) returned 2 [0167.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.476] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.476] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.476] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.486] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.487] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.487] GetLastError () returned 0x578 [0167.487] CanUserWritePwrScheme () returned 0 [0167.487] GetSystemMetrics (nIndex=46) returned 2 [0167.487] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.488] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.488] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.488] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.501] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.501] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.501] GetLastError () returned 0x578 [0167.501] CanUserWritePwrScheme () returned 0 [0167.502] GetSystemMetrics (nIndex=46) returned 2 [0167.502] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.502] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.502] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.502] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.515] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.515] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.515] GetLastError () returned 0x578 [0167.515] CanUserWritePwrScheme () returned 0 [0167.516] GetSystemMetrics (nIndex=46) returned 2 [0167.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.527] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.527] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.527] GetLastError () returned 0x578 [0167.527] CanUserWritePwrScheme () returned 0 [0167.528] GetSystemMetrics (nIndex=46) returned 2 [0167.528] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.528] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.528] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.528] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.538] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.538] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.538] GetLastError () returned 0x578 [0167.538] CanUserWritePwrScheme () returned 0 [0167.539] GetSystemMetrics (nIndex=46) returned 2 [0167.539] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.539] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.539] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.539] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.550] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.550] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.550] GetLastError () returned 0x578 [0167.550] CanUserWritePwrScheme () returned 0 [0167.551] GetSystemMetrics (nIndex=46) returned 2 [0167.551] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.551] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.551] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.551] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.562] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.562] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.562] GetLastError () returned 0x578 [0167.562] CanUserWritePwrScheme () returned 0 [0167.563] GetSystemMetrics (nIndex=46) returned 2 [0167.563] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.563] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.563] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.563] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.573] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.573] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.573] GetLastError () returned 0x578 [0167.573] CanUserWritePwrScheme () returned 0 [0167.574] GetSystemMetrics (nIndex=46) returned 2 [0167.574] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.574] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.574] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.574] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.588] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.588] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.588] GetLastError () returned 0x578 [0167.588] CanUserWritePwrScheme () returned 0 [0167.589] GetSystemMetrics (nIndex=46) returned 2 [0167.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.600] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.601] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.601] GetLastError () returned 0x578 [0167.601] CanUserWritePwrScheme () returned 0 [0167.601] GetSystemMetrics (nIndex=46) returned 2 [0167.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.602] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.602] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.612] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.612] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.612] GetLastError () returned 0x578 [0167.612] CanUserWritePwrScheme () returned 0 [0167.613] GetSystemMetrics (nIndex=46) returned 2 [0167.613] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.613] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.613] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.613] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.618] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.618] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.618] GetLastError () returned 0x578 [0167.618] CanUserWritePwrScheme () returned 0 [0167.619] GetSystemMetrics (nIndex=46) returned 2 [0167.619] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.619] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.619] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.619] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.624] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.624] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.624] GetLastError () returned 0x578 [0167.624] CanUserWritePwrScheme () returned 0 [0167.625] GetSystemMetrics (nIndex=46) returned 2 [0167.625] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.625] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.625] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.625] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.630] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.630] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.630] GetLastError () returned 0x578 [0167.630] CanUserWritePwrScheme () returned 0 [0167.631] GetSystemMetrics (nIndex=46) returned 2 [0167.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.638] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.638] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.638] GetLastError () returned 0x578 [0167.638] CanUserWritePwrScheme () returned 0 [0167.639] GetSystemMetrics (nIndex=46) returned 2 [0167.639] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.639] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.639] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.639] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.647] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.647] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.647] GetLastError () returned 0x578 [0167.647] CanUserWritePwrScheme () returned 0 [0167.648] GetSystemMetrics (nIndex=46) returned 2 [0167.648] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.648] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.648] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.648] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.653] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.653] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.653] GetLastError () returned 0x578 [0167.653] CanUserWritePwrScheme () returned 0 [0167.654] GetSystemMetrics (nIndex=46) returned 2 [0167.654] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.654] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.654] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.654] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.659] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.659] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.659] GetLastError () returned 0x578 [0167.659] CanUserWritePwrScheme () returned 0 [0167.660] GetSystemMetrics (nIndex=46) returned 2 [0167.660] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.660] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.660] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.660] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.664] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.664] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.664] GetLastError () returned 0x578 [0167.665] CanUserWritePwrScheme () returned 0 [0167.665] GetSystemMetrics (nIndex=46) returned 2 [0167.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.665] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.665] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.665] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.670] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.670] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.670] GetLastError () returned 0x578 [0167.671] CanUserWritePwrScheme () returned 0 [0167.671] GetSystemMetrics (nIndex=46) returned 2 [0167.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.671] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.671] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.671] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.676] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.676] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.676] GetLastError () returned 0x578 [0167.676] CanUserWritePwrScheme () returned 0 [0167.677] GetSystemMetrics (nIndex=46) returned 2 [0167.677] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.677] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.677] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.677] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.682] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.682] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.682] GetLastError () returned 0x578 [0167.682] CanUserWritePwrScheme () returned 0 [0167.683] GetSystemMetrics (nIndex=46) returned 2 [0167.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.683] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.683] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.683] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.689] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.689] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.689] GetLastError () returned 0x578 [0167.689] CanUserWritePwrScheme () returned 0 [0167.690] GetSystemMetrics (nIndex=46) returned 2 [0167.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.690] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.690] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.690] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.701] GetLastError () returned 0x578 [0167.701] CanUserWritePwrScheme () returned 0 [0167.702] GetSystemMetrics (nIndex=46) returned 2 [0167.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.715] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.715] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.715] GetLastError () returned 0x578 [0167.715] CanUserWritePwrScheme () returned 0 [0167.716] GetSystemMetrics (nIndex=46) returned 2 [0167.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.716] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.716] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.716] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.727] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.727] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.727] GetLastError () returned 0x578 [0167.727] CanUserWritePwrScheme () returned 0 [0167.728] GetSystemMetrics (nIndex=46) returned 2 [0167.728] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.728] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.728] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.728] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.738] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.739] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.739] GetLastError () returned 0x578 [0167.739] CanUserWritePwrScheme () returned 0 [0167.739] GetSystemMetrics (nIndex=46) returned 2 [0167.740] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.740] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.740] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.740] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.750] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.750] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.750] GetLastError () returned 0x578 [0167.751] CanUserWritePwrScheme () returned 0 [0167.752] GetSystemMetrics (nIndex=46) returned 2 [0167.752] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.752] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.752] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.752] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.762] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.762] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.762] GetLastError () returned 0x578 [0167.762] CanUserWritePwrScheme () returned 0 [0167.763] GetSystemMetrics (nIndex=46) returned 2 [0167.763] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.763] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.763] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.763] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.777] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.777] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.777] GetLastError () returned 0x578 [0167.777] CanUserWritePwrScheme () returned 0 [0167.778] GetSystemMetrics (nIndex=46) returned 2 [0167.778] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.778] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.778] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.778] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.052] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.052] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.052] GetLastError () returned 0x578 [0168.052] CanUserWritePwrScheme () returned 0 [0168.053] GetSystemMetrics (nIndex=46) returned 2 [0168.053] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.053] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.053] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.053] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.082] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.082] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.082] GetLastError () returned 0x578 [0168.082] CanUserWritePwrScheme () returned 0 [0168.083] GetSystemMetrics (nIndex=46) returned 2 [0168.083] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.083] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.083] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.083] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.094] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.094] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.094] GetLastError () returned 0x578 [0168.094] CanUserWritePwrScheme () returned 0 [0168.095] GetSystemMetrics (nIndex=46) returned 2 [0168.096] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.096] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.096] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.096] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.109] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.109] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.109] GetLastError () returned 0x578 [0168.109] CanUserWritePwrScheme () returned 0 [0168.110] GetSystemMetrics (nIndex=46) returned 2 [0168.110] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.110] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.110] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.110] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.120] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.121] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.121] GetLastError () returned 0x578 [0168.121] CanUserWritePwrScheme () returned 0 [0168.121] GetSystemMetrics (nIndex=46) returned 2 [0168.121] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.122] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.122] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.122] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.132] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.132] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.133] GetLastError () returned 0x578 [0168.133] CanUserWritePwrScheme () returned 0 [0168.133] GetSystemMetrics (nIndex=46) returned 2 [0168.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.133] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.134] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.134] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.144] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.144] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.144] GetLastError () returned 0x578 [0168.144] CanUserWritePwrScheme () returned 0 [0168.145] GetSystemMetrics (nIndex=46) returned 2 [0168.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.145] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.145] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.145] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.156] GetLastError () returned 0x578 [0168.156] CanUserWritePwrScheme () returned 0 [0168.157] GetSystemMetrics (nIndex=46) returned 2 [0168.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.157] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.157] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.157] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.170] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.170] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.171] GetLastError () returned 0x578 [0168.171] CanUserWritePwrScheme () returned 0 [0168.171] GetSystemMetrics (nIndex=46) returned 2 [0168.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.171] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.172] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.172] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.238] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.238] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.238] GetLastError () returned 0x578 [0168.238] CanUserWritePwrScheme () returned 0 [0168.239] GetSystemMetrics (nIndex=46) returned 2 [0168.239] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.239] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.239] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.239] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.250] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.250] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.250] GetLastError () returned 0x578 [0168.250] CanUserWritePwrScheme () returned 0 [0168.251] GetSystemMetrics (nIndex=46) returned 2 [0168.251] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.251] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.251] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.251] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.262] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.262] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.262] GetLastError () returned 0x578 [0168.262] CanUserWritePwrScheme () returned 0 [0168.263] GetSystemMetrics (nIndex=46) returned 2 [0168.263] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.263] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.263] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.263] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.274] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.274] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.274] GetLastError () returned 0x578 [0168.274] CanUserWritePwrScheme () returned 0 [0168.275] GetSystemMetrics (nIndex=46) returned 2 [0168.275] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.275] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.275] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.275] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.285] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.285] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.285] GetLastError () returned 0x578 [0168.285] CanUserWritePwrScheme () returned 0 [0168.286] GetSystemMetrics (nIndex=46) returned 2 [0168.286] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.286] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.286] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.286] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.300] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.300] GetLastError () returned 0x578 [0168.300] CanUserWritePwrScheme () returned 0 [0168.300] GetSystemMetrics (nIndex=46) returned 2 [0168.301] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.301] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.301] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.301] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.311] GetLastError () returned 0x578 [0168.311] CanUserWritePwrScheme () returned 0 [0168.312] GetSystemMetrics (nIndex=46) returned 2 [0168.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.326] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.326] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.326] GetLastError () returned 0x578 [0168.326] CanUserWritePwrScheme () returned 0 [0168.327] GetSystemMetrics (nIndex=46) returned 2 [0168.327] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.327] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.327] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.327] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.338] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.338] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.338] GetLastError () returned 0x578 [0168.338] CanUserWritePwrScheme () returned 0 [0168.339] GetSystemMetrics (nIndex=46) returned 2 [0168.339] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.339] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.339] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.339] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.350] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.350] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.350] GetLastError () returned 0x578 [0168.350] CanUserWritePwrScheme () returned 0 [0168.351] GetSystemMetrics (nIndex=46) returned 2 [0168.351] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.351] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.351] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.351] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.365] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.365] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.365] GetLastError () returned 0x578 [0168.365] CanUserWritePwrScheme () returned 0 [0168.366] GetSystemMetrics (nIndex=46) returned 2 [0168.366] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.366] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.366] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.366] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.376] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.376] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.376] GetLastError () returned 0x578 [0168.377] CanUserWritePwrScheme () returned 0 [0168.377] GetSystemMetrics (nIndex=46) returned 2 [0168.377] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.377] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.377] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.377] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.388] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.388] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.388] GetLastError () returned 0x578 [0168.388] CanUserWritePwrScheme () returned 0 [0168.389] GetSystemMetrics (nIndex=46) returned 2 [0168.389] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.389] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.389] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.389] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.408] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.408] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.408] GetLastError () returned 0x578 [0168.408] CanUserWritePwrScheme () returned 0 [0168.409] GetSystemMetrics (nIndex=46) returned 2 [0168.409] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.409] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.409] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.409] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.441] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.441] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.441] GetLastError () returned 0x578 [0168.441] CanUserWritePwrScheme () returned 0 [0168.442] GetSystemMetrics (nIndex=46) returned 2 [0168.442] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.442] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.442] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.442] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.453] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.453] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.453] GetLastError () returned 0x578 [0168.453] CanUserWritePwrScheme () returned 0 [0168.454] GetSystemMetrics (nIndex=46) returned 2 [0168.454] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.454] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.454] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.454] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.464] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.464] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.464] GetLastError () returned 0x578 [0168.465] CanUserWritePwrScheme () returned 0 [0168.465] GetSystemMetrics (nIndex=46) returned 2 [0168.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.465] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.465] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.476] GetLastError () returned 0x578 [0168.476] CanUserWritePwrScheme () returned 0 [0168.477] GetSystemMetrics (nIndex=46) returned 2 [0168.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.488] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.488] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.488] GetLastError () returned 0x578 [0168.488] CanUserWritePwrScheme () returned 0 [0168.491] GetSystemMetrics (nIndex=46) returned 2 [0168.491] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.491] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.491] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.491] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.503] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.503] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.503] GetLastError () returned 0x578 [0168.503] CanUserWritePwrScheme () returned 0 [0168.504] GetSystemMetrics (nIndex=46) returned 2 [0168.504] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.504] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.504] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.504] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.514] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.514] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.514] GetLastError () returned 0x578 [0168.514] CanUserWritePwrScheme () returned 0 [0168.515] GetSystemMetrics (nIndex=46) returned 2 [0168.515] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.515] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.515] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.515] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.526] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.526] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.526] GetLastError () returned 0x578 [0168.526] CanUserWritePwrScheme () returned 0 [0168.527] GetSystemMetrics (nIndex=46) returned 2 [0168.527] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.527] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.527] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.527] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.584] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.584] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.584] GetLastError () returned 0x578 [0168.585] CanUserWritePwrScheme () returned 0 [0168.585] GetSystemMetrics (nIndex=46) returned 2 [0168.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.585] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.585] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.586] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.596] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.596] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.596] GetLastError () returned 0x578 [0168.596] CanUserWritePwrScheme () returned 0 [0168.597] GetSystemMetrics (nIndex=46) returned 2 [0168.597] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.597] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.597] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.597] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.608] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.608] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.608] GetLastError () returned 0x578 [0168.608] CanUserWritePwrScheme () returned 0 [0168.609] GetSystemMetrics (nIndex=46) returned 2 [0168.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.609] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.609] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.609] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.622] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.622] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.622] GetLastError () returned 0x578 [0168.622] CanUserWritePwrScheme () returned 0 [0168.623] GetSystemMetrics (nIndex=46) returned 2 [0168.623] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.623] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.623] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.623] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.634] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.634] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.634] GetLastError () returned 0x578 [0168.634] CanUserWritePwrScheme () returned 0 [0168.636] GetSystemMetrics (nIndex=46) returned 2 [0168.636] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.636] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.636] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.636] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.646] GetLastError () returned 0x578 [0168.646] CanUserWritePwrScheme () returned 0 [0168.647] GetSystemMetrics (nIndex=46) returned 2 [0168.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.647] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.647] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.658] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.658] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.658] GetLastError () returned 0x578 [0168.658] CanUserWritePwrScheme () returned 0 [0168.659] GetSystemMetrics (nIndex=46) returned 2 [0168.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.659] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.659] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.659] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.670] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.670] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.670] GetLastError () returned 0x578 [0168.670] CanUserWritePwrScheme () returned 0 [0168.671] GetSystemMetrics (nIndex=46) returned 2 [0168.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.671] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.671] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.671] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.689] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.689] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.689] GetLastError () returned 0x578 [0168.689] CanUserWritePwrScheme () returned 0 [0168.690] GetSystemMetrics (nIndex=46) returned 2 [0168.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.690] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.690] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.690] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.701] GetLastError () returned 0x578 [0168.701] CanUserWritePwrScheme () returned 0 [0168.702] GetSystemMetrics (nIndex=46) returned 2 [0168.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.713] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.713] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.713] GetLastError () returned 0x578 [0168.713] CanUserWritePwrScheme () returned 0 [0168.714] GetSystemMetrics (nIndex=46) returned 2 [0168.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.714] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.714] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.714] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.725] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.725] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.725] GetLastError () returned 0x578 [0168.725] CanUserWritePwrScheme () returned 0 [0168.726] GetSystemMetrics (nIndex=46) returned 2 [0168.726] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.726] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.726] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.726] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.737] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.737] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.737] GetLastError () returned 0x578 [0168.737] CanUserWritePwrScheme () returned 0 [0168.738] GetSystemMetrics (nIndex=46) returned 2 [0168.738] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.738] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.738] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.738] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.752] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.752] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.752] GetLastError () returned 0x578 [0168.752] CanUserWritePwrScheme () returned 0 [0168.752] GetSystemMetrics (nIndex=46) returned 2 [0168.753] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.753] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.753] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.753] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.768] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.768] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.768] GetLastError () returned 0x578 [0168.768] CanUserWritePwrScheme () returned 0 [0168.769] GetSystemMetrics (nIndex=46) returned 2 [0168.769] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.769] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.769] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.769] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.780] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.780] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.780] GetLastError () returned 0x578 [0168.780] CanUserWritePwrScheme () returned 0 [0168.781] GetSystemMetrics (nIndex=46) returned 2 [0168.781] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.781] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.781] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.781] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.792] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.792] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.792] GetLastError () returned 0x578 [0168.792] CanUserWritePwrScheme () returned 0 [0168.793] GetSystemMetrics (nIndex=46) returned 2 [0168.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.793] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.793] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.793] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.804] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.804] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.804] GetLastError () returned 0x578 [0168.804] CanUserWritePwrScheme () returned 0 [0168.805] GetSystemMetrics (nIndex=46) returned 2 [0168.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.819] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.819] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.819] GetLastError () returned 0x578 [0168.819] CanUserWritePwrScheme () returned 0 [0168.820] GetSystemMetrics (nIndex=46) returned 2 [0168.820] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.820] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.820] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.820] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.831] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.831] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.831] GetLastError () returned 0x578 [0168.831] CanUserWritePwrScheme () returned 0 [0168.832] GetSystemMetrics (nIndex=46) returned 2 [0168.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.832] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.832] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.832] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.842] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.842] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.842] GetLastError () returned 0x578 [0168.842] CanUserWritePwrScheme () returned 0 [0168.843] GetSystemMetrics (nIndex=46) returned 2 [0168.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.843] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.843] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.940] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.940] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.941] GetLastError () returned 0x578 [0168.941] CanUserWritePwrScheme () returned 0 [0168.941] GetSystemMetrics (nIndex=46) returned 2 [0168.941] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.955] GetLastError () returned 0x578 [0168.955] CanUserWritePwrScheme () returned 0 [0168.956] GetSystemMetrics (nIndex=46) returned 2 [0168.956] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.956] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.956] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.956] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.966] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.966] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.966] GetLastError () returned 0x578 [0168.966] CanUserWritePwrScheme () returned 0 [0168.967] GetSystemMetrics (nIndex=46) returned 2 [0168.967] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.967] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.967] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.967] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.978] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.978] GetLastError () returned 0x578 [0168.978] CanUserWritePwrScheme () returned 0 [0168.979] GetSystemMetrics (nIndex=46) returned 2 [0168.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.979] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.979] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.979] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.990] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.990] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.990] GetLastError () returned 0x578 [0168.990] CanUserWritePwrScheme () returned 0 [0168.990] GetSystemMetrics (nIndex=46) returned 2 [0168.991] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.991] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.991] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.991] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.001] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.001] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.001] GetLastError () returned 0x578 [0169.001] CanUserWritePwrScheme () returned 0 [0169.002] GetSystemMetrics (nIndex=46) returned 2 [0169.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.002] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.002] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.002] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.015] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.015] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.015] GetLastError () returned 0x578 [0169.015] CanUserWritePwrScheme () returned 0 [0169.016] GetSystemMetrics (nIndex=46) returned 2 [0169.016] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.016] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.016] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.016] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.148] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.148] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.148] GetLastError () returned 0x578 [0169.148] CanUserWritePwrScheme () returned 0 [0169.150] GetSystemMetrics (nIndex=46) returned 2 [0169.150] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.150] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.150] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.150] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.160] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.160] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.160] GetLastError () returned 0x578 [0169.160] CanUserWritePwrScheme () returned 0 [0169.161] GetSystemMetrics (nIndex=46) returned 2 [0169.161] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.161] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.161] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.161] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.172] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.172] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.172] GetLastError () returned 0x578 [0169.172] CanUserWritePwrScheme () returned 0 [0169.173] GetSystemMetrics (nIndex=46) returned 2 [0169.173] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.173] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.173] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.173] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.184] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.184] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.184] GetLastError () returned 0x578 [0169.184] CanUserWritePwrScheme () returned 0 [0169.185] GetSystemMetrics (nIndex=46) returned 2 [0169.185] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.185] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.185] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.185] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.196] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.196] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.196] GetLastError () returned 0x578 [0169.196] CanUserWritePwrScheme () returned 0 [0169.197] GetSystemMetrics (nIndex=46) returned 2 [0169.197] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.197] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.197] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.197] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.210] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.210] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.210] GetLastError () returned 0x578 [0169.210] CanUserWritePwrScheme () returned 0 [0169.211] GetSystemMetrics (nIndex=46) returned 2 [0169.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.211] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.211] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.211] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.273] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.273] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.273] GetLastError () returned 0x578 [0169.273] CanUserWritePwrScheme () returned 0 [0169.274] GetSystemMetrics (nIndex=46) returned 2 [0169.274] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.274] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.274] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.274] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.285] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.285] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.285] GetLastError () returned 0x578 [0169.285] CanUserWritePwrScheme () returned 0 [0169.286] GetSystemMetrics (nIndex=46) returned 2 [0169.286] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.286] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.286] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.286] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.297] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.297] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.297] GetLastError () returned 0x578 [0169.297] CanUserWritePwrScheme () returned 0 [0169.298] GetSystemMetrics (nIndex=46) returned 2 [0169.298] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.298] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.298] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.298] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.309] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.309] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.309] GetLastError () returned 0x578 [0169.309] CanUserWritePwrScheme () returned 0 [0169.310] GetSystemMetrics (nIndex=46) returned 2 [0169.310] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.310] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.310] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.310] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.321] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.321] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.321] GetLastError () returned 0x578 [0169.321] CanUserWritePwrScheme () returned 0 [0169.322] GetSystemMetrics (nIndex=46) returned 2 [0169.322] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.322] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.322] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.322] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.332] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.332] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.332] GetLastError () returned 0x578 [0169.332] CanUserWritePwrScheme () returned 0 [0169.333] GetSystemMetrics (nIndex=46) returned 2 [0169.333] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.333] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.333] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.333] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.347] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.347] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.347] GetLastError () returned 0x578 [0169.347] CanUserWritePwrScheme () returned 0 [0169.348] GetSystemMetrics (nIndex=46) returned 2 [0169.348] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.348] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.348] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.348] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.470] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.470] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.470] GetLastError () returned 0x578 [0169.470] CanUserWritePwrScheme () returned 0 [0169.471] GetSystemMetrics (nIndex=46) returned 2 [0169.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.482] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.482] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.482] GetLastError () returned 0x578 [0169.482] CanUserWritePwrScheme () returned 0 [0169.483] GetSystemMetrics (nIndex=46) returned 2 [0169.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.483] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.483] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.483] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.494] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.494] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.494] GetLastError () returned 0x578 [0169.494] CanUserWritePwrScheme () returned 0 [0169.495] GetSystemMetrics (nIndex=46) returned 2 [0169.495] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.495] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.495] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.495] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.507] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.507] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.508] GetLastError () returned 0x578 [0169.508] CanUserWritePwrScheme () returned 0 [0169.508] GetSystemMetrics (nIndex=46) returned 2 [0169.508] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.509] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.509] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.509] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.521] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.521] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.521] GetLastError () returned 0x578 [0169.521] CanUserWritePwrScheme () returned 0 [0169.521] GetSystemMetrics (nIndex=46) returned 2 [0169.522] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.522] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.522] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.522] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.535] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.535] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.535] GetLastError () returned 0x578 [0169.535] CanUserWritePwrScheme () returned 0 [0169.536] GetSystemMetrics (nIndex=46) returned 2 [0169.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.602] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.602] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.602] GetLastError () returned 0x578 [0169.602] CanUserWritePwrScheme () returned 0 [0169.603] GetSystemMetrics (nIndex=46) returned 2 [0169.603] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.603] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.603] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.603] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.614] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.614] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.614] GetLastError () returned 0x578 [0169.614] CanUserWritePwrScheme () returned 0 [0169.615] GetSystemMetrics (nIndex=46) returned 2 [0169.615] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.615] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.615] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.615] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.626] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.626] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.626] GetLastError () returned 0x578 [0169.626] CanUserWritePwrScheme () returned 0 [0169.627] GetSystemMetrics (nIndex=46) returned 2 [0169.627] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.627] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.627] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.627] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.639] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.639] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.639] GetLastError () returned 0x578 [0169.639] CanUserWritePwrScheme () returned 0 [0169.640] GetSystemMetrics (nIndex=46) returned 2 [0169.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.640] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.640] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.640] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.651] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.651] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.651] GetLastError () returned 0x578 [0169.651] CanUserWritePwrScheme () returned 0 [0169.652] GetSystemMetrics (nIndex=46) returned 2 [0169.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.652] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.652] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.652] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.666] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.666] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.666] GetLastError () returned 0x578 [0169.666] CanUserWritePwrScheme () returned 0 [0169.667] GetSystemMetrics (nIndex=46) returned 2 [0169.667] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.667] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.667] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.667] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.678] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.678] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.678] GetLastError () returned 0x578 [0169.678] CanUserWritePwrScheme () returned 0 [0169.679] GetSystemMetrics (nIndex=46) returned 2 [0169.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.679] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.738] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.738] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.738] GetLastError () returned 0x578 [0169.739] CanUserWritePwrScheme () returned 0 [0169.739] GetSystemMetrics (nIndex=46) returned 2 [0169.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.739] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.740] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.740] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.751] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.751] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.751] GetLastError () returned 0x578 [0169.751] CanUserWritePwrScheme () returned 0 [0169.752] GetSystemMetrics (nIndex=46) returned 2 [0169.752] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.752] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.752] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.752] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.763] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.763] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.763] GetLastError () returned 0x578 [0169.763] CanUserWritePwrScheme () returned 0 [0169.764] GetSystemMetrics (nIndex=46) returned 2 [0169.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.764] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.764] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.764] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.775] GetLastError () returned 0x578 [0169.775] CanUserWritePwrScheme () returned 0 [0169.776] GetSystemMetrics (nIndex=46) returned 2 [0169.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.776] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.776] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.776] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.787] GetLastError () returned 0x578 [0169.787] CanUserWritePwrScheme () returned 0 [0169.788] GetSystemMetrics (nIndex=46) returned 2 [0169.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.788] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.788] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.802] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.802] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.802] GetLastError () returned 0x578 [0169.802] CanUserWritePwrScheme () returned 0 [0169.803] GetSystemMetrics (nIndex=46) returned 2 [0169.803] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.803] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.803] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.803] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.814] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.814] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.814] GetLastError () returned 0x578 [0169.814] CanUserWritePwrScheme () returned 0 [0169.815] GetSystemMetrics (nIndex=46) returned 2 [0169.815] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.815] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.815] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.815] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.836] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.836] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.836] GetLastError () returned 0x578 [0169.836] CanUserWritePwrScheme () returned 0 [0169.837] GetSystemMetrics (nIndex=46) returned 2 [0169.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.837] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.837] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.837] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.848] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.848] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.849] GetLastError () returned 0x578 [0169.849] CanUserWritePwrScheme () returned 0 [0169.849] GetSystemMetrics (nIndex=46) returned 2 [0169.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.849] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.850] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.850] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.863] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.863] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.863] GetLastError () returned 0x578 [0169.863] CanUserWritePwrScheme () returned 0 [0169.864] GetSystemMetrics (nIndex=46) returned 2 [0169.864] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.864] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.864] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.864] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.875] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.875] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.875] GetLastError () returned 0x578 [0169.875] CanUserWritePwrScheme () returned 0 [0169.876] GetSystemMetrics (nIndex=46) returned 2 [0169.876] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.876] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.876] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.876] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.887] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.887] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.887] GetLastError () returned 0x578 [0169.887] CanUserWritePwrScheme () returned 0 [0169.888] GetSystemMetrics (nIndex=46) returned 2 [0169.888] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.888] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.888] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.888] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.899] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.899] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.899] GetLastError () returned 0x578 [0169.899] CanUserWritePwrScheme () returned 0 [0169.900] GetSystemMetrics (nIndex=46) returned 2 [0169.900] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.900] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.900] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.900] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.914] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.914] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.914] GetLastError () returned 0x578 [0169.914] CanUserWritePwrScheme () returned 0 [0169.915] GetSystemMetrics (nIndex=46) returned 2 [0169.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.915] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.915] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.915] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.986] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.986] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.986] GetLastError () returned 0x578 [0169.986] CanUserWritePwrScheme () returned 0 [0169.989] GetSystemMetrics (nIndex=46) returned 2 [0169.989] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.989] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.989] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.989] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.001] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.001] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.001] GetLastError () returned 0x578 [0170.001] CanUserWritePwrScheme () returned 0 [0170.001] GetSystemMetrics (nIndex=46) returned 2 [0170.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.002] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.002] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.002] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.012] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.012] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.012] GetLastError () returned 0x578 [0170.012] CanUserWritePwrScheme () returned 0 [0170.013] GetSystemMetrics (nIndex=46) returned 2 [0170.013] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.013] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.013] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.013] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.024] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.024] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.024] GetLastError () returned 0x578 [0170.024] CanUserWritePwrScheme () returned 0 [0170.025] GetSystemMetrics (nIndex=46) returned 2 [0170.025] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.025] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.025] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.025] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.036] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.036] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.036] GetLastError () returned 0x578 [0170.036] CanUserWritePwrScheme () returned 0 [0170.037] GetSystemMetrics (nIndex=46) returned 2 [0170.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.037] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.037] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.037] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.048] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.048] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.048] GetLastError () returned 0x578 [0170.048] CanUserWritePwrScheme () returned 0 [0170.049] GetSystemMetrics (nIndex=46) returned 2 [0170.049] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.049] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.049] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.049] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.062] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.062] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.063] GetLastError () returned 0x578 [0170.063] CanUserWritePwrScheme () returned 0 [0170.063] GetSystemMetrics (nIndex=46) returned 2 [0170.063] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.063] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.064] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.064] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.113] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.113] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.113] GetLastError () returned 0x578 [0170.113] CanUserWritePwrScheme () returned 0 [0170.114] GetSystemMetrics (nIndex=46) returned 2 [0170.114] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.114] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.114] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.114] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.127] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.127] GetLastError () returned 0x578 [0170.127] CanUserWritePwrScheme () returned 0 [0170.128] GetSystemMetrics (nIndex=46) returned 2 [0170.128] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.128] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.128] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.128] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.139] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.139] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.139] GetLastError () returned 0x578 [0170.139] CanUserWritePwrScheme () returned 0 [0170.140] GetSystemMetrics (nIndex=46) returned 2 [0170.140] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.140] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.140] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.140] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.151] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.151] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.151] GetLastError () returned 0x578 [0170.151] CanUserWritePwrScheme () returned 0 [0170.152] GetSystemMetrics (nIndex=46) returned 2 [0170.152] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.152] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.152] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.152] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.163] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.163] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.163] GetLastError () returned 0x578 [0170.163] CanUserWritePwrScheme () returned 0 [0170.164] GetSystemMetrics (nIndex=46) returned 2 [0170.164] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.164] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.164] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.164] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.175] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.175] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.175] GetLastError () returned 0x578 [0170.175] CanUserWritePwrScheme () returned 0 [0170.176] GetSystemMetrics (nIndex=46) returned 2 [0170.176] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.176] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.176] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.176] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.191] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.191] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.191] GetLastError () returned 0x578 [0170.191] CanUserWritePwrScheme () returned 0 [0170.192] GetSystemMetrics (nIndex=46) returned 2 [0170.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.192] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.192] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.192] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.282] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.282] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.282] GetLastError () returned 0x578 [0170.282] CanUserWritePwrScheme () returned 0 [0170.283] GetSystemMetrics (nIndex=46) returned 2 [0170.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.283] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.283] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.283] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.293] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.293] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.294] GetLastError () returned 0x578 [0170.294] CanUserWritePwrScheme () returned 0 [0170.295] GetSystemMetrics (nIndex=46) returned 2 [0170.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.305] GetLastError () returned 0x578 [0170.305] CanUserWritePwrScheme () returned 0 [0170.306] GetSystemMetrics (nIndex=46) returned 2 [0170.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.306] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.306] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.306] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.319] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.319] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.319] GetLastError () returned 0x578 [0170.319] CanUserWritePwrScheme () returned 0 [0170.320] GetSystemMetrics (nIndex=46) returned 2 [0170.320] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.320] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.320] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.320] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.331] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.331] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.331] GetLastError () returned 0x578 [0170.331] CanUserWritePwrScheme () returned 0 [0170.332] GetSystemMetrics (nIndex=46) returned 2 [0170.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.343] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.343] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.343] GetLastError () returned 0x578 [0170.343] CanUserWritePwrScheme () returned 0 [0170.344] GetSystemMetrics (nIndex=46) returned 2 [0170.344] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.344] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.344] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.344] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.537] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.538] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.538] GetLastError () returned 0x578 [0170.538] CanUserWritePwrScheme () returned 0 [0170.538] GetSystemMetrics (nIndex=46) returned 2 [0170.539] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.539] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.539] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.539] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.550] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.550] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.550] GetLastError () returned 0x578 [0170.550] CanUserWritePwrScheme () returned 0 [0170.551] GetSystemMetrics (nIndex=46) returned 2 [0170.551] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.551] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.551] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.551] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.582] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.582] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.582] GetLastError () returned 0x578 [0170.582] CanUserWritePwrScheme () returned 0 [0170.583] GetSystemMetrics (nIndex=46) returned 2 [0170.583] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.583] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.583] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.583] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.588] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.588] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.588] GetLastError () returned 0x578 [0170.588] CanUserWritePwrScheme () returned 0 [0170.589] GetSystemMetrics (nIndex=46) returned 2 [0170.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.594] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.594] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.594] GetLastError () returned 0x578 [0170.594] CanUserWritePwrScheme () returned 0 [0170.595] GetSystemMetrics (nIndex=46) returned 2 [0170.595] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.595] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.595] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.595] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.599] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.599] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.600] GetLastError () returned 0x578 [0170.600] CanUserWritePwrScheme () returned 0 [0170.600] GetSystemMetrics (nIndex=46) returned 2 [0170.600] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.600] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.600] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.605] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.605] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.605] GetLastError () returned 0x578 [0170.605] CanUserWritePwrScheme () returned 0 [0170.606] GetSystemMetrics (nIndex=46) returned 2 [0170.606] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.606] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.606] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.606] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.611] GetLastError () returned 0x578 [0170.611] CanUserWritePwrScheme () returned 0 [0170.612] GetSystemMetrics (nIndex=46) returned 2 [0170.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.612] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.617] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.617] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.617] GetLastError () returned 0x578 [0170.617] CanUserWritePwrScheme () returned 0 [0170.618] GetSystemMetrics (nIndex=46) returned 2 [0170.618] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.618] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.618] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.618] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.623] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.623] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.623] GetLastError () returned 0x578 [0170.623] CanUserWritePwrScheme () returned 0 [0170.624] GetSystemMetrics (nIndex=46) returned 2 [0170.624] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.624] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.624] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.624] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.628] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.628] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.628] GetLastError () returned 0x578 [0170.628] CanUserWritePwrScheme () returned 0 [0170.629] GetSystemMetrics (nIndex=46) returned 2 [0170.629] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.629] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.629] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.629] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.634] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.634] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.635] GetLastError () returned 0x578 [0170.635] CanUserWritePwrScheme () returned 0 [0170.636] GetSystemMetrics (nIndex=46) returned 2 [0170.636] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.636] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.636] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.636] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.644] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.644] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.644] GetLastError () returned 0x578 [0170.644] CanUserWritePwrScheme () returned 0 [0170.645] GetSystemMetrics (nIndex=46) returned 2 [0170.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.645] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.645] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.645] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.661] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.661] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.661] GetLastError () returned 0x578 [0170.661] CanUserWritePwrScheme () returned 0 [0170.662] GetSystemMetrics (nIndex=46) returned 2 [0170.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.662] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.662] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.662] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.667] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.667] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.667] GetLastError () returned 0x578 [0170.667] CanUserWritePwrScheme () returned 0 [0170.668] GetSystemMetrics (nIndex=46) returned 2 [0170.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.668] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.668] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.668] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.673] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.673] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.673] GetLastError () returned 0x578 [0170.673] CanUserWritePwrScheme () returned 0 [0170.674] GetSystemMetrics (nIndex=46) returned 2 [0170.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.674] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.674] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.674] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.679] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.679] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.679] GetLastError () returned 0x578 [0170.679] CanUserWritePwrScheme () returned 0 [0170.680] GetSystemMetrics (nIndex=46) returned 2 [0170.680] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.680] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.680] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.680] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.685] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.685] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.685] GetLastError () returned 0x578 [0170.685] CanUserWritePwrScheme () returned 0 [0170.686] GetSystemMetrics (nIndex=46) returned 2 [0170.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.686] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.686] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.686] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.691] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.691] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.691] GetLastError () returned 0x578 [0170.691] CanUserWritePwrScheme () returned 0 [0170.692] GetSystemMetrics (nIndex=46) returned 2 [0170.692] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.692] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.692] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.692] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.696] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.697] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.697] GetLastError () returned 0x578 [0170.697] CanUserWritePwrScheme () returned 0 [0170.697] GetSystemMetrics (nIndex=46) returned 2 [0170.697] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.697] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.698] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.698] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.791] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.791] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.791] GetLastError () returned 0x578 [0170.791] CanUserWritePwrScheme () returned 0 [0170.792] GetSystemMetrics (nIndex=46) returned 2 [0170.792] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.792] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.792] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.792] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.797] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.797] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.797] GetLastError () returned 0x578 [0170.797] CanUserWritePwrScheme () returned 0 [0170.798] GetSystemMetrics (nIndex=46) returned 2 [0170.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.798] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.798] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.798] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.803] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.803] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.803] GetLastError () returned 0x578 [0170.803] CanUserWritePwrScheme () returned 0 [0170.804] GetSystemMetrics (nIndex=46) returned 2 [0170.804] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.804] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.804] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.804] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.809] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.809] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.809] GetLastError () returned 0x578 [0170.809] CanUserWritePwrScheme () returned 0 [0170.810] GetSystemMetrics (nIndex=46) returned 2 [0170.810] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.810] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.810] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.810] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.814] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.814] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.814] GetLastError () returned 0x578 [0170.814] CanUserWritePwrScheme () returned 0 [0170.815] GetSystemMetrics (nIndex=46) returned 2 [0170.815] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.815] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.815] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.815] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.820] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.820] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.820] GetLastError () returned 0x578 [0170.820] CanUserWritePwrScheme () returned 0 [0170.821] GetSystemMetrics (nIndex=46) returned 2 [0170.821] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.821] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.821] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.821] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.826] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.826] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.826] GetLastError () returned 0x578 [0170.826] CanUserWritePwrScheme () returned 0 [0170.827] GetSystemMetrics (nIndex=46) returned 2 [0170.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.827] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.827] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.827] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.832] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.832] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.832] GetLastError () returned 0x578 [0170.832] CanUserWritePwrScheme () returned 0 [0170.833] GetSystemMetrics (nIndex=46) returned 2 [0170.833] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.833] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.833] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.833] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.840] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.840] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.840] GetLastError () returned 0x578 [0170.840] CanUserWritePwrScheme () returned 0 [0170.841] GetSystemMetrics (nIndex=46) returned 2 [0170.841] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.841] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.841] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.841] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.846] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.846] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.846] GetLastError () returned 0x578 [0170.846] CanUserWritePwrScheme () returned 0 [0170.847] GetSystemMetrics (nIndex=46) returned 2 [0170.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.847] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.847] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.847] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.851] GetLastError () returned 0x578 [0170.851] CanUserWritePwrScheme () returned 0 [0170.852] GetSystemMetrics (nIndex=46) returned 2 [0170.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.852] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.852] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.852] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.857] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.857] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.857] GetLastError () returned 0x578 [0170.857] CanUserWritePwrScheme () returned 0 [0170.858] GetSystemMetrics (nIndex=46) returned 2 [0170.858] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.858] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.858] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.858] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.863] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.863] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.863] GetLastError () returned 0x578 [0170.863] CanUserWritePwrScheme () returned 0 [0170.864] GetSystemMetrics (nIndex=46) returned 2 [0170.864] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.864] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.864] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.864] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.929] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.929] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.929] GetLastError () returned 0x578 [0170.929] CanUserWritePwrScheme () returned 0 [0170.930] GetSystemMetrics (nIndex=46) returned 2 [0170.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.930] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.935] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.935] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.935] GetLastError () returned 0x578 [0170.935] CanUserWritePwrScheme () returned 0 [0170.936] GetSystemMetrics (nIndex=46) returned 2 [0170.936] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.936] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.936] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.936] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.941] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.941] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.941] GetLastError () returned 0x578 [0170.941] CanUserWritePwrScheme () returned 0 [0170.942] GetSystemMetrics (nIndex=46) returned 2 [0170.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.947] GetLastError () returned 0x578 [0170.947] CanUserWritePwrScheme () returned 0 [0170.947] GetSystemMetrics (nIndex=46) returned 2 [0170.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.947] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.947] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.948] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.952] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.952] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.952] GetLastError () returned 0x578 [0170.952] CanUserWritePwrScheme () returned 0 [0170.953] GetSystemMetrics (nIndex=46) returned 2 [0170.953] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.953] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.953] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.953] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.958] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.958] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.958] GetLastError () returned 0x578 [0170.958] CanUserWritePwrScheme () returned 0 [0170.959] GetSystemMetrics (nIndex=46) returned 2 [0170.959] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.959] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.959] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.959] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.964] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.964] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.964] GetLastError () returned 0x578 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.964] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.965] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] timeGetTime () returned 0x1138a74 [0170.966] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0170.966] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8) returned 0x550df0 [0170.966] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x20) returned 0x55fcb8 [0170.966] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x10) returned 0x55e508 [0170.966] GetLocalTime (in: lpSystemTime=0x18f410 | out: lpSystemTime=0x18f410*(wYear=0x7e3, wMonth=0xa, wDayOfWeek=0x1, wDay=0x15, wHour=0x5, wMinute=0x1a, wSecond=0x22, wMilliseconds=0x12e)) [0170.966] SystemTimeToVariantTime (in: lpSystemTime=0x18f410, pvtime=0x18f428 | out: pvtime=0x18f428) returned 1 [0170.966] SystemTimeToVariantTime (in: lpSystemTime=0x18f410, pvtime=0x18f3d0 | out: pvtime=0x18f3d0) returned 1 [0170.966] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55e508 | out: hHeap=0x530000) returned 1 [0170.966] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55fcb8 | out: hHeap=0x530000) returned 1 [0170.967] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x550df0 | out: hHeap=0x530000) returned 1 [0170.967] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x8, Size=0x38) returned 0x559de0 [0170.967] AreFileApisANSI () returned 1 [0170.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x18f930, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0170.967] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x550df0 [0170.967] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x18f930, cbMultiByte=-1, lpWideCharStr=0x550df0, cchWideChar=3 | out: lpWideCharStr="š\x07") returned 3 [0170.967] CreateFileW (lpFileName="š\x07" (normalized: "c:\\windows\\system32\\š\x07"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f20c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.967] GetLastError () returned 0x7b [0170.967] GetLastError () returned 0x7b [0170.967] CharToOemBuffA (in: lpszSrc="", lpszDst=0x4461f0, cchDstLength=0x0 | out: lpszDst="") returned 1 [0170.967] CallMsgFilterA (lpMsg=0x18f388, nCode=0) returned 0 [0170.967] D2D1CreateFactory () returned 0x0 [0170.968] DWriteCreateFactory () returned 0x0 [0179.021] LoadLibraryA (lpLibFileName="kernel32") returned 0x74d80000 [0179.022] GetClientRect (in: hWnd=0x0, lpRect=0x18f438 | out: lpRect=0x18f438) returned 0 [0179.023] GetProcAddress (hModule=0x74d80000, lpProcName="VirtualAlloc") returned 0x74d91856 [0179.023] VirtualAlloc (lpAddress=0x0, dwSize=0x33000, flAllocationType=0x3000, flProtect=0x40) returned 0xa8a0000 [0179.024] SetRect (in: lprc=0x18f438, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x18f438) returned 1 [0179.024] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x55e598 [0179.024] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x55e5b0 [0179.024] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x55e580 [0179.024] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x55e520 [0179.024] GetCursorPos (in: lpPoint=0x18f3c8 | out: lpPoint=0x18f3c8*(x=239, y=462)) returned 1 [0179.024] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="alerts") returned 0x478 [0179.024] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55e5b0 | out: hHeap=0x530000) returned 1 [0179.024] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55e580 | out: hHeap=0x530000) returned 1 [0179.024] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55e520 | out: hHeap=0x530000) returned 1 [0179.024] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.024] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.024] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.024] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.024] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.024] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.024] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.024] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.024] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.025] GetCursorPos (in: lpPoint=0x18f3a8 | out: lpPoint=0x18f3a8*(x=239, y=462)) returned 1 [0179.025] CreateRectRgnIndirect (lprect=0x18f3f0) returned 0x1504070d [0179.026] WaitForSingleObject (hHandle=0x478, dwMilliseconds=0xbb6) returned 0x102 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.025] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.026] GetCursorPos (in: lpPoint=0x18f3a8 | out: lpPoint=0x18f3a8*(x=239, y=462)) returned 1 [0182.026] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.026] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.027] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.027] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.028] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.028] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.028] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.028] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.028] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.028] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.028] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.028] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.028] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.028] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.028] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.028] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.028] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.028] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.028] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.028] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.028] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.028] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.028] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.028] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55e598 | out: hHeap=0x530000) returned 1 [0182.028] CreateAcceleratorTableA (paccel=0x18f430, cAccel=4) returned 0x60171 [0182.028] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x55e598 [0182.028] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x55e520 [0182.028] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x55e580 [0182.028] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x55e5b0 [0182.028] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xc) returned 0x55e508 [0182.028] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55e508 | out: hHeap=0x530000) returned 1 [0182.028] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1) returned 0x550e00 [0182.028] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x2) returned 0x550e20 [0182.028] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x550e00 | out: hHeap=0x530000) returned 1 [0182.028] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x3) returned 0x550e00 [0182.028] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x550e20 | out: hHeap=0x530000) returned 1 [0182.028] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x4) returned 0x550e20 [0182.028] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x550e00 | out: hHeap=0x530000) returned 1 [0182.028] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x6) returned 0x550e00 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x550e20 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x9) returned 0x55e508 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x550e00 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd) returned 0x55e550 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55e508 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x13) returned 0x548370 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55e550 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1c) returned 0x55fc90 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x548370 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x2a) returned 0x569200 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55fc90 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x3f) returned 0x5428c0 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x569200 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x5e) returned 0x55e000 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x5428c0 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x8d) returned 0x55f1d0 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55e000 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xd3) returned 0x55f708 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55f1d0 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x13c) returned 0x563c48 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55f708 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1da) returned 0x55f708 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x563c48 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x2c7) returned 0x55f8f0 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55f708 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x42a) returned 0x569710 [0182.029] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x55f8f0 | out: hHeap=0x530000) returned 1 [0182.029] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x63f) returned 0x569b48 [0182.030] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x569710 | out: hHeap=0x530000) returned 1 [0182.030] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x95e) returned 0x56a190 [0182.030] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x569b48 | out: hHeap=0x530000) returned 1 [0182.030] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0xe0d) returned 0x56aaf8 [0182.030] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x56a190 | out: hHeap=0x530000) returned 1 [0182.030] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1536) returned 0x56b910 [0182.030] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x56aaf8 | out: hHeap=0x530000) returned 1 [0182.030] RtlAllocateHeap (HeapHandle=0x530000, Flags=0x0, Size=0x1fbf) returned 0x569710 [0182.030] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x56b910 | out: hHeap=0x530000) returned 1 [0182.030] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.030] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.030] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.031] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.032] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=1) returned 1 [0182.032] GetLastError () returned 0x715 [0182.033] GetFileVersionInfoW (in: lptstrFilename="", dwHandle=0x7fffffff, dwLen=0x0, lpData=0x445df0 | out: lpData=0x445df0) returned 0 [0182.132] GetModuleHandleA (lpModuleName="ntdll") returned 0x76f30000 [0182.132] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0182.597] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f074, nSize=0x104 | out: lpFilename="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe")) returned 0x47 [0182.597] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f01c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f2a0 | out: lpCommandLine="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpProcessInformation=0x18f2a0*(hProcess=0x480, hThread=0x47c, dwProcessId=0x690, dwThreadId=0x678)) returned 1 [0182.632] GetThreadContext (in: hThread=0x47c, lpContext=0x18ed44 | out: lpContext=0x18ed44*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x326e380, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40d5db, Ebp=0x0, Eip=0x76f401c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0182.642] LoadLibraryA (lpLibFileName="ntdll") returned 0x76f30000 [0182.643] NtQueryInformationProcess (in: ProcessHandle=0x480, ProcessInformationClass=0x0, ProcessInformation=0x18eaf0, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x18eaf0, ReturnLength=0x0) returned 0x0 [0182.643] ReadProcessMemory (in: hProcess=0x480, lpBaseAddress=0x7efde000, lpBuffer=0x18eb3c, nSize=0x1e8, lpNumberOfBytesRead=0x18ed30 | out: lpBuffer=0x18eb3c*, lpNumberOfBytesRead=0x18ed30*=0x1e8) returned 1 [0182.643] VirtualProtectEx (in: hProcess=0x480, lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x4, lpflOldProtect=0x18ed3c | out: lpflOldProtect=0x18ed3c*=0x2) returned 1 [0182.643] WriteProcessMemory (in: hProcess=0x480, lpBaseAddress=0x400000, lpBuffer=0x569710*, nSize=0x19000, lpNumberOfBytesWritten=0x18ed24 | out: lpBuffer=0x569710*, lpNumberOfBytesWritten=0x18ed24*=0x19000) returned 1 [0182.646] VirtualProtectEx (in: hProcess=0x480, lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0182.647] VirtualProtectEx (in: hProcess=0x480, lpAddress=0x401000, dwSize=0x9c25, flNewProtect=0x20, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0182.647] VirtualProtectEx (in: hProcess=0x480, lpAddress=0x40b000, dwSize=0x2636, flNewProtect=0x2, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0182.647] VirtualProtectEx (in: hProcess=0x480, lpAddress=0x40e000, dwSize=0xaad5, flNewProtect=0x4, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0182.647] SetThreadContext (hThread=0x47c, lpContext=0x18ed44*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x326e380, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40a9d0, Ebp=0x0, Eip=0x76f401c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0182.727] ResumeThread (hThread=0x47c) returned 0x1 [0182.784] ExitProcess (uExitCode=0x0) [0182.785] HeapFree (in: hHeap=0x530000, dwFlags=0x0, lpMem=0x54ad88 | out: hHeap=0x530000) returned 1 Thread: id = 51 os_tid = 0x6f8 Thread: id = 54 os_tid = 0x224 Thread: id = 55 os_tid = 0x1e8 Process: id = "9" image_name = "1black.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe" page_root = "0x7a313000" os_pid = "0x500" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x0" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e003" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 49 os_tid = 0x504 [0134.967] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff6c | out: lpSystemTimeAsFileTime=0x18ff6c*(dwLowDateTime=0xd19a8820, dwHighDateTime=0x1d58773)) [0134.967] GetCurrentThreadId () returned 0x504 [0134.967] GetCurrentProcessId () returned 0x500 [0134.967] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff64 | out: lpPerformanceCount=0x18ff64*=6871759736) returned 1 [0137.736] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0137.737] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0137.737] GetLastError () returned 0x57 [0137.737] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0137.737] GetLastError () returned 0x57 [0137.737] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x74d80000 [0137.738] GetProcAddress (hModule=0x74d80000, lpProcName="InitializeCriticalSectionEx") returned 0x74d94d28 [0137.738] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0137.738] GetLastError () returned 0x57 [0137.738] GetProcAddress (hModule=0x74d80000, lpProcName="FlsAlloc") returned 0x74d94f2b [0137.738] GetProcAddress (hModule=0x74d80000, lpProcName="FlsSetValue") returned 0x74d94208 [0137.739] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0137.739] GetLastError () returned 0x57 [0137.739] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0137.739] GetLastError () returned 0x57 [0137.739] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x74d80000 [0137.739] GetProcAddress (hModule=0x74d80000, lpProcName="InitializeCriticalSectionEx") returned 0x74d94d28 [0137.739] GetProcessHeap () returned 0x5e0000 [0137.739] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0137.739] GetLastError () returned 0x57 [0137.739] GetProcAddress (hModule=0x74d80000, lpProcName="FlsAlloc") returned 0x74d94f2b [0137.739] GetLastError () returned 0x57 [0137.739] GetProcAddress (hModule=0x74d80000, lpProcName="FlsGetValue") returned 0x74d91252 [0137.739] GetProcAddress (hModule=0x74d80000, lpProcName="FlsSetValue") returned 0x74d94208 [0137.740] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x364) returned 0x5faf60 [0137.740] SetLastError (dwErrCode=0x57) [0137.740] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xe00) returned 0x5fb2d0 [0137.741] GetStartupInfoW (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40faf0, hStdOutput=0x49854dc2, hStdError=0xfffffffe)) [0137.741] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0137.741] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0137.741] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0137.742] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\" " [0137.742] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\" " [0137.742] GetACP () returned 0x4e4 [0137.742] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x220) returned 0x5fc8d8 [0137.742] IsValidCodePage (CodePage=0x4e4) returned 1 [0137.742] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fec4 | out: lpCPInfo=0x18fec4) returned 1 [0137.742] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f78c | out: lpCPInfo=0x18f78c) returned 1 [0137.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0137.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0137.742] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f7a0 | out: lpCharType=0x18f7a0) returned 1 [0137.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0137.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f4e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0137.742] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0137.742] GetLastError () returned 0x57 [0137.742] GetProcAddress (hModule=0x74d80000, lpProcName="LCMapStringEx") returned 0x74e147f1 [0137.742] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0137.742] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0137.742] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18fca0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿþµÙIÜþ\x18", lpUsedDefaultChar=0x0) returned 256 [0137.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0137.742] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0137.742] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0137.742] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0137.743] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18fba0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿþµÙIÜþ\x18", lpUsedDefaultChar=0x0) returned 256 [0137.743] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x80) returned 0x5fcb00 [0137.743] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fce8, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe")) returned 0x66 [0137.743] GetProcAddress (hModule=0x74d80000, lpProcName="AreFileApisANSI") returned 0x74e140d1 [0137.743] AreFileApisANSI () returned 1 [0137.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 103 [0137.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", cchWideChar=-1, lpMultiByteStr=0x4455c8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpUsedDefaultChar=0x0) returned 103 [0137.743] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x6f) returned 0x5f1f50 [0137.743] RtlInitializeSListHead (in: ListHead=0x4454c8 | out: ListHead=0x4454c8) [0137.743] GetLastError () returned 0x0 [0137.743] SetLastError (dwErrCode=0x0) [0137.743] GetEnvironmentStringsW () returned 0x5fcb88* [0137.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1409 [0137.743] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x581) returned 0x5fd698 [0137.743] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="=::=::\\", cchWideChar=1409, lpMultiByteStr=0x5fd698, cbMultiByte=1409, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="=::=::\\", lpUsedDefaultChar=0x0) returned 1409 [0137.743] FreeEnvironmentStringsW (penv=0x5fcb88) returned 1 [0137.743] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x9c) returned 0x5fdc28 [0137.743] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1f) returned 0x5fc708 [0137.743] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x36) returned 0x5fdcd0 [0137.743] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x37) returned 0x5fdd10 [0137.743] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3c) returned 0x5f2538 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x31) returned 0x5fdd50 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x17) returned 0x5f7ec8 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x5fdd90 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x14) returned 0x5f7ee8 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xd) returned 0x5f9b98 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x25) returned 0x5fddc0 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x39) returned 0x5f2580 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x5f7f08 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x17) returned 0x5f7f28 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xe) returned 0x5f9b80 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x69) returned 0x5fddf0 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x3e) returned 0x5f25c8 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1b) returned 0x5fc730 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1d) returned 0x5fc758 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x48) returned 0x5fde68 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x12) returned 0x5f7f48 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x5f7f68 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1b) returned 0x5fc780 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x24) returned 0x5fdeb8 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x29) returned 0x5fdee8 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1e) returned 0x5fc7a8 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x41) returned 0x5fdf20 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x17) returned 0x5f7f88 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x14) returned 0x5f7fa8 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0xf) returned 0x5f9bb0 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x16) returned 0x5f7fc8 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2a) returned 0x5fdf70 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x29) returned 0x5fdfa8 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x15) returned 0x5f7fe8 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x1e) returned 0x5fc7d0 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x2a) returned 0x5fcb88 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x12) returned 0x5f8008 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x18) returned 0x5f8028 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x46) returned 0x5fcbc0 [0137.744] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5fd698 | out: hHeap=0x5e0000) returned 1 [0137.744] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x800) returned 0x5fcc10 [0137.745] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0137.745] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40e130) returned 0x0 [0137.745] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.745] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.746] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.746] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0137.746] DeletePwrScheme (uiID=0x0) returned 0 [0137.746] SetFocus (hWnd=0x0) returned 0x0 [0137.746] InsertMenuA (hMenu=0x0, uPosition=0x0, uFlags=0x10, uIDNewItem=0x102, lpNewItem="Файл") returned 0 [0137.747] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x5fd860 [0137.747] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20) returned 0x5fc870 [0137.747] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x5f9bc8 [0137.747] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x5f9be0 [0137.747] ReadProcessorPwrScheme (in: uiID=0x0, pMachineProcessorPowerPolicy=0x0 | out: pMachineProcessorPowerPolicy=0x0) returned 0 [0137.747] UnRegisterTypeLib (libID=0x18f990*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, syskind=0x1) returned 0x8002801c [0137.748] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe0 [0137.748] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.748] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xdc [0137.748] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.748] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe4 [0137.748] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.748] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe8 [0137.748] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.748] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xec [0137.748] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.748] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf0 [0137.748] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf4 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf8 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xfc [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x100 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x104 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x108 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x10c [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x110 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x114 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x118 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x11c [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x120 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x124 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x128 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x12c [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x130 [0137.749] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0137.749] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f9be0 | out: hHeap=0x5e0000) returned 1 [0137.749] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f9bc8 | out: hHeap=0x5e0000) returned 1 [0137.749] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5fc870 | out: hHeap=0x5e0000) returned 1 [0137.749] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5fd860 | out: hHeap=0x5e0000) returned 1 [0137.749] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1400) returned 0x5fdfe8 [0137.750] GetLastError () returned 0x578 [0137.750] IsIconic (hWnd=0x0) returned 0 [0137.750] GetClientRect (in: hWnd=0x0, lpRect=0x18f980 | out: lpRect=0x18f980) returned 0 [0137.750] InvalidateRect (hWnd=0x0, lpRect=0x0, bErase=0) returned 1 [0137.804] WSAStringToAddressA (in: AddressString="", AddressFamily=-7989, lpProtocolInfo=0x0, lpAddress=0x18f900, lpAddressLength=0x18f8fc | out: lpAddress=0x18f900, lpAddressLength=0x18f8fc) returned -1 [0137.804] GetKeyState (nVirtKey=16) returned 0 [0137.804] SetFocus (hWnd=0x0) returned 0x0 [0137.804] GetSystemMetrics (nIndex=0) returned 1440 [0137.830] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x23905f8) returned 0x0 [0137.870] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x2a605f8) returned 0x0 [0137.881] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x2f605f8) returned 0x0 [0137.890] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x34605f8) returned 0x0 [0137.902] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x39605f8) returned 0x0 [0138.003] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x3e605f8) returned 0x0 [0138.011] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x43605f8) returned 0x0 [0138.022] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x48605f8) returned 0x0 [0138.034] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x4d605f8) returned 0x0 [0138.306] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x52605f8) returned 0x0 [0138.499] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x57605f8) returned 0x0 [0138.508] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x5c605f8) returned 0x0 [0138.519] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x61605f8) returned 0x0 [0139.462] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x66605f8) returned 0x0 [0139.517] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x6b605f8) returned 0x0 [0139.530] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x70605f8) returned 0x0 [0139.553] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x75605f8) returned 0x0 [0139.606] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x7a605f8) returned 0x0 [0139.615] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x7f605f8) returned 0x0 [0139.625] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x84605f8) returned 0x0 [0139.635] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x89605f8) returned 0x0 [0139.680] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x8e605f8) returned 0x0 [0139.689] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x93605f8) returned 0x0 [0139.698] CanUserWritePwrScheme () returned 0 [0139.699] GetSystemMetrics (nIndex=46) returned 2 [0139.700] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0139.700] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0139.701] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0139.703] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.279] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.280] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.292] GetLastError () returned 0x578 [0141.292] SetLastError (dwErrCode=0x578) [0141.292] GetLastError () returned 0x578 [0141.292] SetLastError (dwErrCode=0x578) [0141.292] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1000) returned 0x6108c0 [0141.292] CanUserWritePwrScheme () returned 0 [0141.293] GetSystemMetrics (nIndex=46) returned 2 [0141.293] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.293] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.293] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.293] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.306] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.306] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.306] GetLastError () returned 0x578 [0141.306] SetLastError (dwErrCode=0x578) [0141.306] CanUserWritePwrScheme () returned 0 [0141.307] GetSystemMetrics (nIndex=46) returned 2 [0141.307] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.307] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.307] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.307] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.322] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.322] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.322] GetLastError () returned 0x578 [0141.322] SetLastError (dwErrCode=0x578) [0141.322] CanUserWritePwrScheme () returned 0 [0141.323] GetSystemMetrics (nIndex=46) returned 2 [0141.323] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.323] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.323] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.323] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.336] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.336] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.336] GetLastError () returned 0x578 [0141.336] SetLastError (dwErrCode=0x578) [0141.336] CanUserWritePwrScheme () returned 0 [0141.337] GetSystemMetrics (nIndex=46) returned 2 [0141.337] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.337] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.337] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.337] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.352] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.352] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.352] GetLastError () returned 0x578 [0141.352] SetLastError (dwErrCode=0x578) [0141.352] CanUserWritePwrScheme () returned 0 [0141.353] GetSystemMetrics (nIndex=46) returned 2 [0141.353] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.353] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.353] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.353] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.376] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.376] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.376] GetLastError () returned 0x578 [0141.376] SetLastError (dwErrCode=0x578) [0141.376] CanUserWritePwrScheme () returned 0 [0141.377] GetSystemMetrics (nIndex=46) returned 2 [0141.377] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.377] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.377] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.377] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.389] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.389] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.389] GetLastError () returned 0x578 [0141.389] SetLastError (dwErrCode=0x578) [0141.390] CanUserWritePwrScheme () returned 0 [0141.391] GetSystemMetrics (nIndex=46) returned 2 [0141.391] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.391] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.391] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.391] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.411] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.411] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.411] GetLastError () returned 0x578 [0141.411] SetLastError (dwErrCode=0x578) [0141.411] CanUserWritePwrScheme () returned 0 [0141.414] GetSystemMetrics (nIndex=46) returned 2 [0141.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.414] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.414] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.414] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.427] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.427] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.427] GetLastError () returned 0x578 [0141.427] SetLastError (dwErrCode=0x578) [0141.427] CanUserWritePwrScheme () returned 0 [0141.428] GetSystemMetrics (nIndex=46) returned 2 [0141.428] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.428] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.428] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.428] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.440] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.440] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.440] GetLastError () returned 0x578 [0141.440] SetLastError (dwErrCode=0x578) [0141.440] CanUserWritePwrScheme () returned 0 [0141.441] GetSystemMetrics (nIndex=46) returned 2 [0141.441] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.441] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.441] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.441] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.457] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.457] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.457] GetLastError () returned 0x578 [0141.457] SetLastError (dwErrCode=0x578) [0141.457] CanUserWritePwrScheme () returned 0 [0141.458] GetSystemMetrics (nIndex=46) returned 2 [0141.458] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.458] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.458] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.458] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.472] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.472] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.472] GetLastError () returned 0x578 [0141.472] SetLastError (dwErrCode=0x578) [0141.472] CanUserWritePwrScheme () returned 0 [0141.473] GetSystemMetrics (nIndex=46) returned 2 [0141.473] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.473] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.473] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.473] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.488] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.488] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.488] GetLastError () returned 0x578 [0141.488] SetLastError (dwErrCode=0x578) [0141.488] CanUserWritePwrScheme () returned 0 [0141.489] GetSystemMetrics (nIndex=46) returned 2 [0141.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.489] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.489] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.490] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.501] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.501] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.501] GetLastError () returned 0x578 [0141.501] SetLastError (dwErrCode=0x578) [0141.501] CanUserWritePwrScheme () returned 0 [0141.502] GetSystemMetrics (nIndex=46) returned 2 [0141.502] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.502] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.502] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.502] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.514] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.514] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.514] GetLastError () returned 0x578 [0141.514] SetLastError (dwErrCode=0x578) [0141.514] CanUserWritePwrScheme () returned 0 [0141.516] GetSystemMetrics (nIndex=46) returned 2 [0141.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.527] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.527] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.527] GetLastError () returned 0x578 [0141.528] SetLastError (dwErrCode=0x578) [0141.528] CanUserWritePwrScheme () returned 0 [0141.529] GetSystemMetrics (nIndex=46) returned 2 [0141.529] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.529] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.529] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.529] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.551] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.551] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.551] GetLastError () returned 0x578 [0141.551] SetLastError (dwErrCode=0x578) [0141.551] CanUserWritePwrScheme () returned 0 [0141.552] GetSystemMetrics (nIndex=46) returned 2 [0141.552] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.552] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.552] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.552] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.564] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.564] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.564] GetLastError () returned 0x578 [0141.564] SetLastError (dwErrCode=0x578) [0141.564] CanUserWritePwrScheme () returned 0 [0141.565] GetSystemMetrics (nIndex=46) returned 2 [0141.565] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.565] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.565] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.565] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.577] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.577] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.577] GetLastError () returned 0x578 [0141.577] SetLastError (dwErrCode=0x578) [0141.577] CanUserWritePwrScheme () returned 0 [0141.578] GetSystemMetrics (nIndex=46) returned 2 [0141.578] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.578] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.578] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.578] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.590] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.590] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.590] GetLastError () returned 0x578 [0141.590] SetLastError (dwErrCode=0x578) [0141.590] CanUserWritePwrScheme () returned 0 [0141.591] GetSystemMetrics (nIndex=46) returned 2 [0141.591] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.591] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.591] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.591] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.603] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.603] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.603] GetLastError () returned 0x578 [0141.603] SetLastError (dwErrCode=0x578) [0141.603] CanUserWritePwrScheme () returned 0 [0141.604] GetSystemMetrics (nIndex=46) returned 2 [0141.604] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.604] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.604] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.604] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.619] GetLastError () returned 0x578 [0141.619] SetLastError (dwErrCode=0x578) [0141.619] CanUserWritePwrScheme () returned 0 [0141.620] GetSystemMetrics (nIndex=46) returned 2 [0141.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.633] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.633] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.633] GetLastError () returned 0x578 [0141.633] SetLastError (dwErrCode=0x578) [0141.633] CanUserWritePwrScheme () returned 0 [0141.636] GetSystemMetrics (nIndex=46) returned 2 [0141.636] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.637] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.637] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.637] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.654] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.654] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.654] GetLastError () returned 0x578 [0141.654] SetLastError (dwErrCode=0x578) [0141.654] CanUserWritePwrScheme () returned 0 [0141.655] GetSystemMetrics (nIndex=46) returned 2 [0141.655] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.655] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.655] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.656] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.671] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.671] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.671] GetLastError () returned 0x578 [0141.671] SetLastError (dwErrCode=0x578) [0141.671] CanUserWritePwrScheme () returned 0 [0141.675] GetSystemMetrics (nIndex=46) returned 2 [0141.675] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.675] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.675] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.675] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.689] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.689] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.689] GetLastError () returned 0x578 [0141.689] SetLastError (dwErrCode=0x578) [0141.689] CanUserWritePwrScheme () returned 0 [0141.690] GetSystemMetrics (nIndex=46) returned 2 [0141.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.690] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.690] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.690] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.702] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.702] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.702] GetLastError () returned 0x578 [0141.702] SetLastError (dwErrCode=0x578) [0141.702] CanUserWritePwrScheme () returned 0 [0141.703] GetSystemMetrics (nIndex=46) returned 2 [0141.703] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.703] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.703] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.703] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.715] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.715] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.716] GetLastError () returned 0x578 [0141.716] SetLastError (dwErrCode=0x578) [0141.716] CanUserWritePwrScheme () returned 0 [0141.717] GetSystemMetrics (nIndex=46) returned 2 [0141.717] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.717] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.717] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.717] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.729] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.729] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.729] GetLastError () returned 0x578 [0141.729] SetLastError (dwErrCode=0x578) [0141.729] CanUserWritePwrScheme () returned 0 [0141.730] GetSystemMetrics (nIndex=46) returned 2 [0141.730] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.730] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.730] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.730] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.745] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.745] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.745] GetLastError () returned 0x578 [0141.745] SetLastError (dwErrCode=0x578) [0141.745] CanUserWritePwrScheme () returned 0 [0141.746] GetSystemMetrics (nIndex=46) returned 2 [0141.746] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.746] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.746] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.746] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.759] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.759] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.759] GetLastError () returned 0x578 [0141.759] SetLastError (dwErrCode=0x578) [0141.759] CanUserWritePwrScheme () returned 0 [0141.760] GetSystemMetrics (nIndex=46) returned 2 [0141.760] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.760] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.760] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.760] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.772] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.772] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.772] GetLastError () returned 0x578 [0141.772] SetLastError (dwErrCode=0x578) [0141.772] CanUserWritePwrScheme () returned 0 [0141.773] GetSystemMetrics (nIndex=46) returned 2 [0141.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.773] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.773] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.785] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.785] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.785] GetLastError () returned 0x578 [0141.785] SetLastError (dwErrCode=0x578) [0141.785] CanUserWritePwrScheme () returned 0 [0141.786] GetSystemMetrics (nIndex=46) returned 2 [0141.786] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.786] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.786] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.786] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.798] GetLastError () returned 0x578 [0141.798] SetLastError (dwErrCode=0x578) [0141.798] CanUserWritePwrScheme () returned 0 [0141.799] GetSystemMetrics (nIndex=46) returned 2 [0141.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.799] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.799] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.799] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.884] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.884] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.884] GetLastError () returned 0x578 [0141.884] SetLastError (dwErrCode=0x578) [0141.884] CanUserWritePwrScheme () returned 0 [0141.885] GetSystemMetrics (nIndex=46) returned 2 [0141.885] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.885] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.885] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.885] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.897] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.897] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.897] GetLastError () returned 0x578 [0141.897] SetLastError (dwErrCode=0x578) [0141.898] CanUserWritePwrScheme () returned 0 [0141.899] GetSystemMetrics (nIndex=46) returned 2 [0141.899] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.899] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.899] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.899] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.916] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.916] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.916] GetLastError () returned 0x578 [0141.916] SetLastError (dwErrCode=0x578) [0141.916] CanUserWritePwrScheme () returned 0 [0141.917] GetSystemMetrics (nIndex=46) returned 2 [0141.917] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.917] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.917] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.917] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.937] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.937] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.937] GetLastError () returned 0x578 [0141.937] SetLastError (dwErrCode=0x578) [0141.937] CanUserWritePwrScheme () returned 0 [0141.938] GetSystemMetrics (nIndex=46) returned 2 [0141.938] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.938] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.938] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.938] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.950] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.950] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.950] GetLastError () returned 0x578 [0141.950] SetLastError (dwErrCode=0x578) [0141.950] CanUserWritePwrScheme () returned 0 [0141.951] GetSystemMetrics (nIndex=46) returned 2 [0141.951] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.951] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.951] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.951] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.963] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.963] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.963] GetLastError () returned 0x578 [0141.963] SetLastError (dwErrCode=0x578) [0141.963] CanUserWritePwrScheme () returned 0 [0141.964] GetSystemMetrics (nIndex=46) returned 2 [0141.964] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.964] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.964] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.964] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.976] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.976] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.976] GetLastError () returned 0x578 [0141.976] SetLastError (dwErrCode=0x578) [0141.976] CanUserWritePwrScheme () returned 0 [0141.977] GetSystemMetrics (nIndex=46) returned 2 [0141.977] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.977] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.977] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.977] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0141.990] GetWindowTextLengthA (hWnd=0x0) returned 0 [0141.990] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0141.990] GetLastError () returned 0x578 [0141.990] SetLastError (dwErrCode=0x578) [0141.990] CanUserWritePwrScheme () returned 0 [0141.991] GetSystemMetrics (nIndex=46) returned 2 [0141.991] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0141.991] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0141.991] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0141.991] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.008] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.008] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.008] GetLastError () returned 0x578 [0142.008] SetLastError (dwErrCode=0x578) [0142.008] CanUserWritePwrScheme () returned 0 [0142.009] GetSystemMetrics (nIndex=46) returned 2 [0142.009] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.009] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.009] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.009] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.039] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.039] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.040] GetLastError () returned 0x578 [0142.040] SetLastError (dwErrCode=0x578) [0142.040] CanUserWritePwrScheme () returned 0 [0142.041] GetSystemMetrics (nIndex=46) returned 2 [0142.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.053] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.053] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.053] GetLastError () returned 0x578 [0142.053] SetLastError (dwErrCode=0x578) [0142.053] CanUserWritePwrScheme () returned 0 [0142.054] GetSystemMetrics (nIndex=46) returned 2 [0142.054] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.054] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.054] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.054] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.069] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.069] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.069] GetLastError () returned 0x578 [0142.069] SetLastError (dwErrCode=0x578) [0142.069] CanUserWritePwrScheme () returned 0 [0142.070] GetSystemMetrics (nIndex=46) returned 2 [0142.070] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.070] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.070] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.070] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.082] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.082] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.082] GetLastError () returned 0x578 [0142.082] SetLastError (dwErrCode=0x578) [0142.082] CanUserWritePwrScheme () returned 0 [0142.083] GetSystemMetrics (nIndex=46) returned 2 [0142.083] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.083] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.083] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.083] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.094] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.094] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.094] GetLastError () returned 0x578 [0142.095] SetLastError (dwErrCode=0x578) [0142.095] CanUserWritePwrScheme () returned 0 [0142.096] GetSystemMetrics (nIndex=46) returned 2 [0142.096] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.096] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.096] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.096] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.108] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.108] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.108] GetLastError () returned 0x578 [0142.108] SetLastError (dwErrCode=0x578) [0142.108] CanUserWritePwrScheme () returned 0 [0142.109] GetSystemMetrics (nIndex=46) returned 2 [0142.109] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.109] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.109] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.109] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.121] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.121] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.121] GetLastError () returned 0x578 [0142.121] SetLastError (dwErrCode=0x578) [0142.121] CanUserWritePwrScheme () returned 0 [0142.122] GetSystemMetrics (nIndex=46) returned 2 [0142.122] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.122] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.122] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.122] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.137] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.137] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.137] GetLastError () returned 0x578 [0142.137] SetLastError (dwErrCode=0x578) [0142.137] CanUserWritePwrScheme () returned 0 [0142.138] GetSystemMetrics (nIndex=46) returned 2 [0142.138] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.138] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.138] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.138] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.158] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.158] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.158] GetLastError () returned 0x578 [0142.158] SetLastError (dwErrCode=0x578) [0142.158] CanUserWritePwrScheme () returned 0 [0142.159] GetSystemMetrics (nIndex=46) returned 2 [0142.159] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.159] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.159] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.159] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.171] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.171] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.171] GetLastError () returned 0x578 [0142.171] SetLastError (dwErrCode=0x578) [0142.171] CanUserWritePwrScheme () returned 0 [0142.172] GetSystemMetrics (nIndex=46) returned 2 [0142.172] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.172] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.172] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.172] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.184] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.184] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.184] GetLastError () returned 0x578 [0142.184] SetLastError (dwErrCode=0x578) [0142.184] CanUserWritePwrScheme () returned 0 [0142.185] GetSystemMetrics (nIndex=46) returned 2 [0142.185] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.185] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.185] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.185] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.201] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.201] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.201] GetLastError () returned 0x578 [0142.201] SetLastError (dwErrCode=0x578) [0142.201] CanUserWritePwrScheme () returned 0 [0142.202] GetSystemMetrics (nIndex=46) returned 2 [0142.202] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.202] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.202] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.202] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.213] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.213] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.213] GetLastError () returned 0x578 [0142.213] SetLastError (dwErrCode=0x578) [0142.213] CanUserWritePwrScheme () returned 0 [0142.214] GetSystemMetrics (nIndex=46) returned 2 [0142.214] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.214] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.214] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.214] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.228] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.228] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.228] GetLastError () returned 0x578 [0142.228] SetLastError (dwErrCode=0x578) [0142.228] CanUserWritePwrScheme () returned 0 [0142.229] GetSystemMetrics (nIndex=46) returned 2 [0142.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.229] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.229] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.229] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.240] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.241] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.241] GetLastError () returned 0x578 [0142.241] SetLastError (dwErrCode=0x578) [0142.241] CanUserWritePwrScheme () returned 0 [0142.242] GetSystemMetrics (nIndex=46) returned 2 [0142.242] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.242] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.242] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.242] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.254] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.254] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.254] GetLastError () returned 0x578 [0142.254] SetLastError (dwErrCode=0x578) [0142.254] CanUserWritePwrScheme () returned 0 [0142.255] GetSystemMetrics (nIndex=46) returned 2 [0142.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.255] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.255] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.270] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.270] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.270] GetLastError () returned 0x578 [0142.270] SetLastError (dwErrCode=0x578) [0142.270] CanUserWritePwrScheme () returned 0 [0142.271] GetSystemMetrics (nIndex=46) returned 2 [0142.271] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.271] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.271] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.271] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.283] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.283] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.283] GetLastError () returned 0x578 [0142.283] SetLastError (dwErrCode=0x578) [0142.283] CanUserWritePwrScheme () returned 0 [0142.284] GetSystemMetrics (nIndex=46) returned 2 [0142.284] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.284] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.284] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.284] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.295] GetLastError () returned 0x578 [0142.295] SetLastError (dwErrCode=0x578) [0142.295] CanUserWritePwrScheme () returned 0 [0142.296] GetSystemMetrics (nIndex=46) returned 2 [0142.297] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.297] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.297] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.297] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.309] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.309] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.309] GetLastError () returned 0x578 [0142.309] SetLastError (dwErrCode=0x578) [0142.309] CanUserWritePwrScheme () returned 0 [0142.310] GetSystemMetrics (nIndex=46) returned 2 [0142.310] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.310] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.310] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.310] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.321] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.322] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.322] GetLastError () returned 0x578 [0142.322] SetLastError (dwErrCode=0x578) [0142.322] CanUserWritePwrScheme () returned 0 [0142.325] GetSystemMetrics (nIndex=46) returned 2 [0142.325] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.325] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.325] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.325] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.337] GetLastError () returned 0x578 [0142.337] SetLastError (dwErrCode=0x578) [0142.337] CanUserWritePwrScheme () returned 0 [0142.338] GetSystemMetrics (nIndex=46) returned 2 [0142.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.338] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.338] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.338] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.350] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.350] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.351] GetLastError () returned 0x578 [0142.351] SetLastError (dwErrCode=0x578) [0142.351] CanUserWritePwrScheme () returned 0 [0142.352] GetSystemMetrics (nIndex=46) returned 2 [0142.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.352] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.352] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.352] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.364] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.364] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.364] GetLastError () returned 0x578 [0142.364] SetLastError (dwErrCode=0x578) [0142.364] CanUserWritePwrScheme () returned 0 [0142.365] GetSystemMetrics (nIndex=46) returned 2 [0142.365] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.365] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.365] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.365] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.378] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.378] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.378] GetLastError () returned 0x578 [0142.378] SetLastError (dwErrCode=0x578) [0142.378] CanUserWritePwrScheme () returned 0 [0142.379] GetSystemMetrics (nIndex=46) returned 2 [0142.379] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.379] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.379] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.379] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.386] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.386] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.386] GetLastError () returned 0x578 [0142.386] SetLastError (dwErrCode=0x578) [0142.386] CanUserWritePwrScheme () returned 0 [0142.387] GetSystemMetrics (nIndex=46) returned 2 [0142.387] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.387] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.387] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.387] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.402] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.402] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.402] GetLastError () returned 0x578 [0142.402] SetLastError (dwErrCode=0x578) [0142.402] CanUserWritePwrScheme () returned 0 [0142.403] GetSystemMetrics (nIndex=46) returned 2 [0142.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.403] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.403] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.403] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.416] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.416] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.417] GetLastError () returned 0x578 [0142.417] SetLastError (dwErrCode=0x578) [0142.417] CanUserWritePwrScheme () returned 0 [0142.418] GetSystemMetrics (nIndex=46) returned 2 [0142.418] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.418] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.418] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.418] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.429] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.429] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.430] GetLastError () returned 0x578 [0142.430] SetLastError (dwErrCode=0x578) [0142.430] CanUserWritePwrScheme () returned 0 [0142.431] GetSystemMetrics (nIndex=46) returned 2 [0142.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.443] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.443] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.443] GetLastError () returned 0x578 [0142.443] SetLastError (dwErrCode=0x578) [0142.443] CanUserWritePwrScheme () returned 0 [0142.444] GetSystemMetrics (nIndex=46) returned 2 [0142.444] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.444] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.444] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.444] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.558] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.558] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.558] GetLastError () returned 0x578 [0142.558] SetLastError (dwErrCode=0x578) [0142.558] CanUserWritePwrScheme () returned 0 [0142.559] GetSystemMetrics (nIndex=46) returned 2 [0142.559] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.559] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.559] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.559] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.571] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.571] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.571] GetLastError () returned 0x578 [0142.571] SetLastError (dwErrCode=0x578) [0142.571] CanUserWritePwrScheme () returned 0 [0142.572] GetSystemMetrics (nIndex=46) returned 2 [0142.572] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.572] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.572] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.572] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.587] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.587] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.587] GetLastError () returned 0x578 [0142.587] SetLastError (dwErrCode=0x578) [0142.587] CanUserWritePwrScheme () returned 0 [0142.588] GetSystemMetrics (nIndex=46) returned 2 [0142.588] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.588] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.588] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.588] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.600] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.600] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.601] GetLastError () returned 0x578 [0142.601] SetLastError (dwErrCode=0x578) [0142.601] CanUserWritePwrScheme () returned 0 [0142.602] GetSystemMetrics (nIndex=46) returned 2 [0142.602] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.602] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.602] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.602] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.613] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.613] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.614] GetLastError () returned 0x578 [0142.614] SetLastError (dwErrCode=0x578) [0142.614] CanUserWritePwrScheme () returned 0 [0142.615] GetSystemMetrics (nIndex=46) returned 2 [0142.615] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.615] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.615] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.615] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.626] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.626] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.627] GetLastError () returned 0x578 [0142.627] SetLastError (dwErrCode=0x578) [0142.627] CanUserWritePwrScheme () returned 0 [0142.628] GetSystemMetrics (nIndex=46) returned 2 [0142.628] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.628] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.628] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.628] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.641] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.641] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.641] GetLastError () returned 0x578 [0142.641] SetLastError (dwErrCode=0x578) [0142.641] CanUserWritePwrScheme () returned 0 [0142.642] GetSystemMetrics (nIndex=46) returned 2 [0142.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.642] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.642] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.642] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.656] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.656] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.656] GetLastError () returned 0x578 [0142.656] SetLastError (dwErrCode=0x578) [0142.657] CanUserWritePwrScheme () returned 0 [0142.658] GetSystemMetrics (nIndex=46) returned 2 [0142.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.658] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.658] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.658] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.670] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.670] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.670] GetLastError () returned 0x578 [0142.670] SetLastError (dwErrCode=0x578) [0142.670] CanUserWritePwrScheme () returned 0 [0142.671] GetSystemMetrics (nIndex=46) returned 2 [0142.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.671] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.671] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.671] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.683] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.683] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.683] GetLastError () returned 0x578 [0142.683] SetLastError (dwErrCode=0x578) [0142.683] CanUserWritePwrScheme () returned 0 [0142.684] GetSystemMetrics (nIndex=46) returned 2 [0142.684] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.684] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.684] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.696] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.696] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.696] GetLastError () returned 0x578 [0142.696] SetLastError (dwErrCode=0x578) [0142.696] CanUserWritePwrScheme () returned 0 [0142.697] GetSystemMetrics (nIndex=46) returned 2 [0142.697] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.697] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.697] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.697] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.709] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.709] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.709] GetLastError () returned 0x578 [0142.709] SetLastError (dwErrCode=0x578) [0142.709] CanUserWritePwrScheme () returned 0 [0142.710] GetSystemMetrics (nIndex=46) returned 2 [0142.710] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.710] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.710] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.710] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.725] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.725] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.725] GetLastError () returned 0x578 [0142.725] SetLastError (dwErrCode=0x578) [0142.725] CanUserWritePwrScheme () returned 0 [0142.726] GetSystemMetrics (nIndex=46) returned 2 [0142.726] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.726] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.726] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.726] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.739] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.739] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.739] GetLastError () returned 0x578 [0142.739] SetLastError (dwErrCode=0x578) [0142.739] CanUserWritePwrScheme () returned 0 [0142.740] GetSystemMetrics (nIndex=46) returned 2 [0142.740] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.740] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.740] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.740] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.752] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.752] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.752] GetLastError () returned 0x578 [0142.752] SetLastError (dwErrCode=0x578) [0142.752] CanUserWritePwrScheme () returned 0 [0142.753] GetSystemMetrics (nIndex=46) returned 2 [0142.753] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.753] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.753] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.753] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.765] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.765] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.765] GetLastError () returned 0x578 [0142.765] SetLastError (dwErrCode=0x578) [0142.765] CanUserWritePwrScheme () returned 0 [0142.766] GetSystemMetrics (nIndex=46) returned 2 [0142.766] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.766] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.766] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.766] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.778] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.778] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.778] GetLastError () returned 0x578 [0142.778] SetLastError (dwErrCode=0x578) [0142.779] CanUserWritePwrScheme () returned 0 [0142.779] GetSystemMetrics (nIndex=46) returned 2 [0142.779] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.779] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.779] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.872] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.872] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.872] GetLastError () returned 0x578 [0142.872] SetLastError (dwErrCode=0x578) [0142.872] CanUserWritePwrScheme () returned 0 [0142.873] GetSystemMetrics (nIndex=46) returned 2 [0142.873] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.873] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.873] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.873] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.889] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.889] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.889] GetLastError () returned 0x578 [0142.889] SetLastError (dwErrCode=0x578) [0142.889] CanUserWritePwrScheme () returned 0 [0142.890] GetSystemMetrics (nIndex=46) returned 2 [0142.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.890] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.904] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.904] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.905] GetLastError () returned 0x578 [0142.905] SetLastError (dwErrCode=0x578) [0142.905] CanUserWritePwrScheme () returned 0 [0142.906] GetSystemMetrics (nIndex=46) returned 2 [0142.906] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.906] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.906] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.906] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.921] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.921] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.921] GetLastError () returned 0x578 [0142.921] SetLastError (dwErrCode=0x578) [0142.921] CanUserWritePwrScheme () returned 0 [0142.922] GetSystemMetrics (nIndex=46) returned 2 [0142.922] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.922] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.922] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.922] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.933] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.934] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.934] GetLastError () returned 0x578 [0142.934] SetLastError (dwErrCode=0x578) [0142.934] CanUserWritePwrScheme () returned 0 [0142.935] GetSystemMetrics (nIndex=46) returned 2 [0142.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.946] GetLastError () returned 0x578 [0142.946] SetLastError (dwErrCode=0x578) [0142.946] CanUserWritePwrScheme () returned 0 [0142.948] GetSystemMetrics (nIndex=46) returned 2 [0142.948] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.948] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.948] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.948] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.960] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.960] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.960] GetLastError () returned 0x578 [0142.960] SetLastError (dwErrCode=0x578) [0142.960] CanUserWritePwrScheme () returned 0 [0142.961] GetSystemMetrics (nIndex=46) returned 2 [0142.961] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.961] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.961] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.961] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.972] GetLastError () returned 0x578 [0142.972] SetLastError (dwErrCode=0x578) [0142.972] CanUserWritePwrScheme () returned 0 [0142.973] GetSystemMetrics (nIndex=46) returned 2 [0142.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0142.987] GetWindowTextLengthA (hWnd=0x0) returned 0 [0142.987] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0142.988] GetLastError () returned 0x578 [0142.988] SetLastError (dwErrCode=0x578) [0142.988] CanUserWritePwrScheme () returned 0 [0142.989] GetSystemMetrics (nIndex=46) returned 2 [0142.989] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0142.989] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0142.989] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0142.989] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.001] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.001] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.001] GetLastError () returned 0x578 [0143.001] SetLastError (dwErrCode=0x578) [0143.001] CanUserWritePwrScheme () returned 0 [0143.002] GetSystemMetrics (nIndex=46) returned 2 [0143.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.002] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.002] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.002] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.014] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.014] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.014] GetLastError () returned 0x578 [0143.014] SetLastError (dwErrCode=0x578) [0143.014] CanUserWritePwrScheme () returned 0 [0143.015] GetSystemMetrics (nIndex=46) returned 2 [0143.015] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.015] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.015] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.015] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.027] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.027] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.027] GetLastError () returned 0x578 [0143.027] SetLastError (dwErrCode=0x578) [0143.027] CanUserWritePwrScheme () returned 0 [0143.028] GetSystemMetrics (nIndex=46) returned 2 [0143.028] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.028] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.028] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.028] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.050] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.050] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.050] GetLastError () returned 0x578 [0143.050] SetLastError (dwErrCode=0x578) [0143.050] CanUserWritePwrScheme () returned 0 [0143.051] GetSystemMetrics (nIndex=46) returned 2 [0143.051] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.051] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.051] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.051] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.067] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.067] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.068] GetLastError () returned 0x578 [0143.068] SetLastError (dwErrCode=0x578) [0143.068] CanUserWritePwrScheme () returned 0 [0143.069] GetSystemMetrics (nIndex=46) returned 2 [0143.069] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.069] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.069] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.069] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.080] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.081] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.081] GetLastError () returned 0x578 [0143.081] SetLastError (dwErrCode=0x578) [0143.081] CanUserWritePwrScheme () returned 0 [0143.082] GetSystemMetrics (nIndex=46) returned 2 [0143.082] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.082] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.082] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.082] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.093] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.093] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.094] GetLastError () returned 0x578 [0143.094] SetLastError (dwErrCode=0x578) [0143.094] CanUserWritePwrScheme () returned 0 [0143.094] GetSystemMetrics (nIndex=46) returned 2 [0143.095] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.095] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.095] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.095] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.109] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.109] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.109] GetLastError () returned 0x578 [0143.109] SetLastError (dwErrCode=0x578) [0143.109] CanUserWritePwrScheme () returned 0 [0143.110] GetSystemMetrics (nIndex=46) returned 2 [0143.110] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.110] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.110] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.110] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.151] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.151] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.151] GetLastError () returned 0x578 [0143.151] SetLastError (dwErrCode=0x578) [0143.151] CanUserWritePwrScheme () returned 0 [0143.152] GetSystemMetrics (nIndex=46) returned 2 [0143.152] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.152] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.152] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.152] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.164] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.164] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.164] GetLastError () returned 0x578 [0143.164] SetLastError (dwErrCode=0x578) [0143.164] CanUserWritePwrScheme () returned 0 [0143.165] GetSystemMetrics (nIndex=46) returned 2 [0143.165] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.165] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.165] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.165] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.178] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.178] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.178] GetLastError () returned 0x578 [0143.179] SetLastError (dwErrCode=0x578) [0143.179] CanUserWritePwrScheme () returned 0 [0143.179] GetSystemMetrics (nIndex=46) returned 2 [0143.179] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.180] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.180] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.180] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.185] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.185] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.185] GetLastError () returned 0x578 [0143.185] SetLastError (dwErrCode=0x578) [0143.185] CanUserWritePwrScheme () returned 0 [0143.186] GetSystemMetrics (nIndex=46) returned 2 [0143.186] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.186] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.186] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.186] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.192] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.192] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.192] GetLastError () returned 0x578 [0143.192] SetLastError (dwErrCode=0x578) [0143.192] CanUserWritePwrScheme () returned 0 [0143.193] GetSystemMetrics (nIndex=46) returned 2 [0143.193] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.193] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.193] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.193] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.198] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.198] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.198] GetLastError () returned 0x578 [0143.198] SetLastError (dwErrCode=0x578) [0143.199] CanUserWritePwrScheme () returned 0 [0143.199] GetSystemMetrics (nIndex=46) returned 2 [0143.199] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.199] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.199] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.200] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.204] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.205] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.205] GetLastError () returned 0x578 [0143.205] SetLastError (dwErrCode=0x578) [0143.205] CanUserWritePwrScheme () returned 0 [0143.206] GetSystemMetrics (nIndex=46) returned 2 [0143.206] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.206] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.206] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.206] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.211] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.211] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.211] GetLastError () returned 0x578 [0143.211] SetLastError (dwErrCode=0x578) [0143.211] CanUserWritePwrScheme () returned 0 [0143.212] GetSystemMetrics (nIndex=46) returned 2 [0143.212] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.212] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.212] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.212] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.217] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.217] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.217] GetLastError () returned 0x578 [0143.217] SetLastError (dwErrCode=0x578) [0143.217] CanUserWritePwrScheme () returned 0 [0143.219] GetSystemMetrics (nIndex=46) returned 2 [0143.219] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.219] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.219] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.219] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.224] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.224] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.224] GetLastError () returned 0x578 [0143.224] SetLastError (dwErrCode=0x578) [0143.224] CanUserWritePwrScheme () returned 0 [0143.225] GetSystemMetrics (nIndex=46) returned 2 [0143.225] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.225] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.225] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.225] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.231] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.231] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.231] GetLastError () returned 0x578 [0143.231] SetLastError (dwErrCode=0x578) [0143.231] CanUserWritePwrScheme () returned 0 [0143.232] GetSystemMetrics (nIndex=46) returned 2 [0143.232] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.232] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.232] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.232] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.241] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.241] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.241] GetLastError () returned 0x578 [0143.241] SetLastError (dwErrCode=0x578) [0143.241] CanUserWritePwrScheme () returned 0 [0143.242] GetSystemMetrics (nIndex=46) returned 2 [0143.242] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.242] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.242] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.242] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.255] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.255] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.255] GetLastError () returned 0x578 [0143.255] SetLastError (dwErrCode=0x578) [0143.255] CanUserWritePwrScheme () returned 0 [0143.256] GetSystemMetrics (nIndex=46) returned 2 [0143.256] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.256] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.256] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.269] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.269] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.269] GetLastError () returned 0x578 [0143.269] SetLastError (dwErrCode=0x578) [0143.269] CanUserWritePwrScheme () returned 0 [0143.270] GetSystemMetrics (nIndex=46) returned 2 [0143.270] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.270] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.270] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.270] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.282] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.282] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.282] GetLastError () returned 0x578 [0143.282] SetLastError (dwErrCode=0x578) [0143.282] CanUserWritePwrScheme () returned 0 [0143.283] GetSystemMetrics (nIndex=46) returned 2 [0143.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.283] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.283] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.283] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.295] GetLastError () returned 0x578 [0143.295] SetLastError (dwErrCode=0x578) [0143.295] CanUserWritePwrScheme () returned 0 [0143.296] GetSystemMetrics (nIndex=46) returned 2 [0143.296] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.296] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.296] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.296] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.311] GetLastError () returned 0x578 [0143.311] SetLastError (dwErrCode=0x578) [0143.311] CanUserWritePwrScheme () returned 0 [0143.312] GetSystemMetrics (nIndex=46) returned 2 [0143.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.346] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.346] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.346] GetLastError () returned 0x578 [0143.346] SetLastError (dwErrCode=0x578) [0143.346] CanUserWritePwrScheme () returned 0 [0143.347] GetSystemMetrics (nIndex=46) returned 2 [0143.347] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.347] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.347] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.347] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.360] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.360] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.360] GetLastError () returned 0x578 [0143.360] SetLastError (dwErrCode=0x578) [0143.360] CanUserWritePwrScheme () returned 0 [0143.361] GetSystemMetrics (nIndex=46) returned 2 [0143.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.361] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.361] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.361] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.375] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.375] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.375] GetLastError () returned 0x578 [0143.375] SetLastError (dwErrCode=0x578) [0143.375] CanUserWritePwrScheme () returned 0 [0143.376] GetSystemMetrics (nIndex=46) returned 2 [0143.376] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.376] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.376] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.376] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.388] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.388] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.388] GetLastError () returned 0x578 [0143.388] SetLastError (dwErrCode=0x578) [0143.388] CanUserWritePwrScheme () returned 0 [0143.389] GetSystemMetrics (nIndex=46) returned 2 [0143.389] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.390] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.390] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.390] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.409] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.409] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.409] GetLastError () returned 0x578 [0143.409] SetLastError (dwErrCode=0x578) [0143.409] CanUserWritePwrScheme () returned 0 [0143.410] GetSystemMetrics (nIndex=46) returned 2 [0143.410] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.410] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.410] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.410] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.422] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.422] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.422] GetLastError () returned 0x578 [0143.423] SetLastError (dwErrCode=0x578) [0143.423] CanUserWritePwrScheme () returned 0 [0143.424] GetSystemMetrics (nIndex=46) returned 2 [0143.424] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.424] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.424] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.424] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.440] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.440] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.440] GetLastError () returned 0x578 [0143.440] SetLastError (dwErrCode=0x578) [0143.440] CanUserWritePwrScheme () returned 0 [0143.441] GetSystemMetrics (nIndex=46) returned 2 [0143.441] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.441] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.441] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.441] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.454] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.454] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.454] GetLastError () returned 0x578 [0143.454] SetLastError (dwErrCode=0x578) [0143.454] CanUserWritePwrScheme () returned 0 [0143.455] GetSystemMetrics (nIndex=46) returned 2 [0143.455] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.455] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.455] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.455] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.466] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.466] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.467] GetLastError () returned 0x578 [0143.467] SetLastError (dwErrCode=0x578) [0143.467] CanUserWritePwrScheme () returned 0 [0143.467] GetSystemMetrics (nIndex=46) returned 2 [0143.468] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.468] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.468] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.468] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.479] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.480] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.480] GetLastError () returned 0x578 [0143.480] SetLastError (dwErrCode=0x578) [0143.480] CanUserWritePwrScheme () returned 0 [0143.481] GetSystemMetrics (nIndex=46) returned 2 [0143.481] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.481] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.481] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.481] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.492] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.492] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.492] GetLastError () returned 0x578 [0143.492] SetLastError (dwErrCode=0x578) [0143.492] CanUserWritePwrScheme () returned 0 [0143.493] GetSystemMetrics (nIndex=46) returned 2 [0143.493] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.493] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.493] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.493] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.509] GetLastError () returned 0x578 [0143.509] SetLastError (dwErrCode=0x578) [0143.509] CanUserWritePwrScheme () returned 0 [0143.510] GetSystemMetrics (nIndex=46) returned 2 [0143.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.510] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.510] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.510] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.522] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.522] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.522] GetLastError () returned 0x578 [0143.522] SetLastError (dwErrCode=0x578) [0143.522] CanUserWritePwrScheme () returned 0 [0143.523] GetSystemMetrics (nIndex=46) returned 2 [0143.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.523] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.523] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.523] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.534] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.535] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.535] GetLastError () returned 0x578 [0143.535] SetLastError (dwErrCode=0x578) [0143.535] CanUserWritePwrScheme () returned 0 [0143.536] GetSystemMetrics (nIndex=46) returned 2 [0143.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.548] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.548] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.548] GetLastError () returned 0x578 [0143.548] SetLastError (dwErrCode=0x578) [0143.548] CanUserWritePwrScheme () returned 0 [0143.549] GetSystemMetrics (nIndex=46) returned 2 [0143.549] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.549] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.549] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.549] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.564] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.564] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.564] GetLastError () returned 0x578 [0143.564] SetLastError (dwErrCode=0x578) [0143.564] CanUserWritePwrScheme () returned 0 [0143.565] GetSystemMetrics (nIndex=46) returned 2 [0143.565] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.565] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.565] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.565] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.577] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.577] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.577] GetLastError () returned 0x578 [0143.577] SetLastError (dwErrCode=0x578) [0143.577] CanUserWritePwrScheme () returned 0 [0143.578] GetSystemMetrics (nIndex=46) returned 2 [0143.578] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.578] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.579] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.579] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.590] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.590] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.590] GetLastError () returned 0x578 [0143.590] SetLastError (dwErrCode=0x578) [0143.590] CanUserWritePwrScheme () returned 0 [0143.592] GetSystemMetrics (nIndex=46) returned 2 [0143.592] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.592] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.592] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.592] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.603] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.603] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.603] GetLastError () returned 0x578 [0143.603] SetLastError (dwErrCode=0x578) [0143.603] CanUserWritePwrScheme () returned 0 [0143.604] GetSystemMetrics (nIndex=46) returned 2 [0143.604] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.604] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.604] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.604] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.616] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.616] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.616] GetLastError () returned 0x578 [0143.616] SetLastError (dwErrCode=0x578) [0143.616] CanUserWritePwrScheme () returned 0 [0143.617] GetSystemMetrics (nIndex=46) returned 2 [0143.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.617] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.617] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.617] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.632] GetLastError () returned 0x578 [0143.632] SetLastError (dwErrCode=0x578) [0143.632] CanUserWritePwrScheme () returned 0 [0143.633] GetSystemMetrics (nIndex=46) returned 2 [0143.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.646] GetLastError () returned 0x578 [0143.646] SetLastError (dwErrCode=0x578) [0143.646] CanUserWritePwrScheme () returned 0 [0143.648] GetSystemMetrics (nIndex=46) returned 2 [0143.648] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.648] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.648] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.648] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.660] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.660] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.660] GetLastError () returned 0x578 [0143.660] SetLastError (dwErrCode=0x578) [0143.660] CanUserWritePwrScheme () returned 0 [0143.661] GetSystemMetrics (nIndex=46) returned 2 [0143.661] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.661] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.661] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.661] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.672] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.672] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.672] GetLastError () returned 0x578 [0143.673] SetLastError (dwErrCode=0x578) [0143.673] CanUserWritePwrScheme () returned 0 [0143.673] GetSystemMetrics (nIndex=46) returned 2 [0143.673] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.674] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.674] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.674] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.685] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.685] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.685] GetLastError () returned 0x578 [0143.685] SetLastError (dwErrCode=0x578) [0143.685] CanUserWritePwrScheme () returned 0 [0143.686] GetSystemMetrics (nIndex=46) returned 2 [0143.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.686] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.686] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.686] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.701] GetLastError () returned 0x578 [0143.701] SetLastError (dwErrCode=0x578) [0143.701] CanUserWritePwrScheme () returned 0 [0143.702] GetSystemMetrics (nIndex=46) returned 2 [0143.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.708] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.708] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.708] GetLastError () returned 0x578 [0143.708] SetLastError (dwErrCode=0x578) [0143.708] CanUserWritePwrScheme () returned 0 [0143.709] GetSystemMetrics (nIndex=46) returned 2 [0143.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.709] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.721] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.721] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.721] GetLastError () returned 0x578 [0143.721] SetLastError (dwErrCode=0x578) [0143.721] CanUserWritePwrScheme () returned 0 [0143.722] GetSystemMetrics (nIndex=46) returned 2 [0143.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.722] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.722] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.722] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.734] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.734] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.734] GetLastError () returned 0x578 [0143.734] SetLastError (dwErrCode=0x578) [0143.734] CanUserWritePwrScheme () returned 0 [0143.735] GetSystemMetrics (nIndex=46) returned 2 [0143.735] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.735] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.735] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.735] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.747] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.747] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.747] GetLastError () returned 0x578 [0143.747] SetLastError (dwErrCode=0x578) [0143.747] CanUserWritePwrScheme () returned 0 [0143.748] GetSystemMetrics (nIndex=46) returned 2 [0143.748] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.748] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.748] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.748] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.763] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.763] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.763] GetLastError () returned 0x578 [0143.763] SetLastError (dwErrCode=0x578) [0143.764] CanUserWritePwrScheme () returned 0 [0143.764] GetSystemMetrics (nIndex=46) returned 2 [0143.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.764] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.764] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.765] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.776] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.776] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.776] GetLastError () returned 0x578 [0143.776] SetLastError (dwErrCode=0x578) [0143.776] CanUserWritePwrScheme () returned 0 [0143.777] GetSystemMetrics (nIndex=46) returned 2 [0143.777] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.777] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.777] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.777] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.789] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.789] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.789] GetLastError () returned 0x578 [0143.789] SetLastError (dwErrCode=0x578) [0143.789] CanUserWritePwrScheme () returned 0 [0143.791] GetSystemMetrics (nIndex=46) returned 2 [0143.791] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.791] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.791] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.791] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.803] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.803] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.803] GetLastError () returned 0x578 [0143.803] SetLastError (dwErrCode=0x578) [0143.803] CanUserWritePwrScheme () returned 0 [0143.804] GetSystemMetrics (nIndex=46) returned 2 [0143.804] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.804] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.804] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.804] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.884] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.884] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.884] GetLastError () returned 0x578 [0143.884] SetLastError (dwErrCode=0x578) [0143.884] CanUserWritePwrScheme () returned 0 [0143.885] GetSystemMetrics (nIndex=46) returned 2 [0143.885] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.885] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.885] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.885] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.900] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.900] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.900] GetLastError () returned 0x578 [0143.900] SetLastError (dwErrCode=0x578) [0143.900] CanUserWritePwrScheme () returned 0 [0143.901] GetSystemMetrics (nIndex=46) returned 2 [0143.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.901] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.901] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.901] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.913] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.913] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.913] GetLastError () returned 0x578 [0143.913] SetLastError (dwErrCode=0x578) [0143.913] CanUserWritePwrScheme () returned 0 [0143.914] GetSystemMetrics (nIndex=46) returned 2 [0143.914] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.914] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.914] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.914] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.926] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.926] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.926] GetLastError () returned 0x578 [0143.926] SetLastError (dwErrCode=0x578) [0143.926] CanUserWritePwrScheme () returned 0 [0143.927] GetSystemMetrics (nIndex=46) returned 2 [0143.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.927] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.927] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.927] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.939] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.939] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.939] GetLastError () returned 0x578 [0143.939] SetLastError (dwErrCode=0x578) [0143.939] CanUserWritePwrScheme () returned 0 [0143.940] GetSystemMetrics (nIndex=46) returned 2 [0143.940] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.940] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.940] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.940] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.955] GetLastError () returned 0x578 [0143.955] SetLastError (dwErrCode=0x578) [0143.955] CanUserWritePwrScheme () returned 0 [0143.956] GetSystemMetrics (nIndex=46) returned 2 [0143.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.957] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.957] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.957] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.968] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.968] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.968] GetLastError () returned 0x578 [0143.968] SetLastError (dwErrCode=0x578) [0143.968] CanUserWritePwrScheme () returned 0 [0143.970] GetSystemMetrics (nIndex=46) returned 2 [0143.970] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.970] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.970] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.970] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.981] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.981] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.981] GetLastError () returned 0x578 [0143.981] SetLastError (dwErrCode=0x578) [0143.982] CanUserWritePwrScheme () returned 0 [0143.982] GetSystemMetrics (nIndex=46) returned 2 [0143.982] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.982] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.982] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.983] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0143.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0143.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0143.994] GetLastError () returned 0x578 [0143.994] SetLastError (dwErrCode=0x578) [0143.994] CanUserWritePwrScheme () returned 0 [0143.995] GetSystemMetrics (nIndex=46) returned 2 [0143.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0143.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0143.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0143.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.007] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.007] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.007] GetLastError () returned 0x578 [0144.007] SetLastError (dwErrCode=0x578) [0144.007] CanUserWritePwrScheme () returned 0 [0144.008] GetSystemMetrics (nIndex=46) returned 2 [0144.008] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.008] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.008] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.008] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.024] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.024] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.024] GetLastError () returned 0x578 [0144.024] SetLastError (dwErrCode=0x578) [0144.024] CanUserWritePwrScheme () returned 0 [0144.025] GetSystemMetrics (nIndex=46) returned 2 [0144.025] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.025] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.025] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.025] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.037] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.037] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.037] GetLastError () returned 0x578 [0144.037] SetLastError (dwErrCode=0x578) [0144.037] CanUserWritePwrScheme () returned 0 [0144.038] GetSystemMetrics (nIndex=46) returned 2 [0144.038] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.038] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.038] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.038] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.050] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.050] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.050] GetLastError () returned 0x578 [0144.050] SetLastError (dwErrCode=0x578) [0144.050] CanUserWritePwrScheme () returned 0 [0144.051] GetSystemMetrics (nIndex=46) returned 2 [0144.051] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.051] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.051] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.051] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.070] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.070] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.070] GetLastError () returned 0x578 [0144.070] SetLastError (dwErrCode=0x578) [0144.070] CanUserWritePwrScheme () returned 0 [0144.071] GetSystemMetrics (nIndex=46) returned 2 [0144.071] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.071] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.071] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.071] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.086] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.086] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.086] GetLastError () returned 0x578 [0144.086] SetLastError (dwErrCode=0x578) [0144.086] CanUserWritePwrScheme () returned 0 [0144.087] GetSystemMetrics (nIndex=46) returned 2 [0144.087] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.087] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.087] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.087] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.099] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.099] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.099] GetLastError () returned 0x578 [0144.099] SetLastError (dwErrCode=0x578) [0144.099] CanUserWritePwrScheme () returned 0 [0144.100] GetSystemMetrics (nIndex=46) returned 2 [0144.100] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.100] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.100] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.100] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.112] GetLastError () returned 0x578 [0144.112] SetLastError (dwErrCode=0x578) [0144.112] CanUserWritePwrScheme () returned 0 [0144.113] GetSystemMetrics (nIndex=46) returned 2 [0144.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.185] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.185] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.185] GetLastError () returned 0x578 [0144.185] SetLastError (dwErrCode=0x578) [0144.185] CanUserWritePwrScheme () returned 0 [0144.186] GetSystemMetrics (nIndex=46) returned 2 [0144.186] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.186] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.186] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.186] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.198] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.198] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.198] GetLastError () returned 0x578 [0144.198] SetLastError (dwErrCode=0x578) [0144.198] CanUserWritePwrScheme () returned 0 [0144.199] GetSystemMetrics (nIndex=46) returned 2 [0144.199] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.199] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.199] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.199] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.212] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.212] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.212] GetLastError () returned 0x578 [0144.212] SetLastError (dwErrCode=0x578) [0144.212] CanUserWritePwrScheme () returned 0 [0144.215] GetSystemMetrics (nIndex=46) returned 2 [0144.215] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.215] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.215] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.215] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.227] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.227] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.227] GetLastError () returned 0x578 [0144.227] SetLastError (dwErrCode=0x578) [0144.227] CanUserWritePwrScheme () returned 0 [0144.228] GetSystemMetrics (nIndex=46) returned 2 [0144.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.229] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.229] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.229] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.241] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.241] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.241] GetLastError () returned 0x578 [0144.241] SetLastError (dwErrCode=0x578) [0144.241] CanUserWritePwrScheme () returned 0 [0144.242] GetSystemMetrics (nIndex=46) returned 2 [0144.242] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.242] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.242] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.242] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.253] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.253] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.254] GetLastError () returned 0x578 [0144.254] SetLastError (dwErrCode=0x578) [0144.254] CanUserWritePwrScheme () returned 0 [0144.255] GetSystemMetrics (nIndex=46) returned 2 [0144.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.255] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.255] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.266] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.266] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.266] GetLastError () returned 0x578 [0144.266] SetLastError (dwErrCode=0x578) [0144.266] CanUserWritePwrScheme () returned 0 [0144.267] GetSystemMetrics (nIndex=46) returned 2 [0144.267] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.267] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.267] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.267] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.283] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.283] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.283] GetLastError () returned 0x578 [0144.284] SetLastError (dwErrCode=0x578) [0144.284] CanUserWritePwrScheme () returned 0 [0144.285] GetSystemMetrics (nIndex=46) returned 2 [0144.285] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.285] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.285] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.285] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.296] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.296] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.296] GetLastError () returned 0x578 [0144.297] SetLastError (dwErrCode=0x578) [0144.297] CanUserWritePwrScheme () returned 0 [0144.297] GetSystemMetrics (nIndex=46) returned 2 [0144.297] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.298] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.298] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.298] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.309] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.309] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.309] GetLastError () returned 0x578 [0144.309] SetLastError (dwErrCode=0x578) [0144.309] CanUserWritePwrScheme () returned 0 [0144.310] GetSystemMetrics (nIndex=46) returned 2 [0144.310] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.310] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.310] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.310] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.322] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.322] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.322] GetLastError () returned 0x578 [0144.322] SetLastError (dwErrCode=0x578) [0144.322] CanUserWritePwrScheme () returned 0 [0144.323] GetSystemMetrics (nIndex=46) returned 2 [0144.323] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.323] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.323] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.323] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.335] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.335] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.335] GetLastError () returned 0x578 [0144.335] SetLastError (dwErrCode=0x578) [0144.335] CanUserWritePwrScheme () returned 0 [0144.336] GetSystemMetrics (nIndex=46) returned 2 [0144.336] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.336] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.336] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.336] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.355] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.355] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.355] GetLastError () returned 0x578 [0144.355] SetLastError (dwErrCode=0x578) [0144.355] CanUserWritePwrScheme () returned 0 [0144.356] GetSystemMetrics (nIndex=46) returned 2 [0144.356] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.356] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.356] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.356] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.368] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.368] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.368] GetLastError () returned 0x578 [0144.368] SetLastError (dwErrCode=0x578) [0144.368] CanUserWritePwrScheme () returned 0 [0144.369] GetSystemMetrics (nIndex=46) returned 2 [0144.369] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.369] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.369] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.369] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.381] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.381] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.381] GetLastError () returned 0x578 [0144.381] SetLastError (dwErrCode=0x578) [0144.381] CanUserWritePwrScheme () returned 0 [0144.382] GetSystemMetrics (nIndex=46) returned 2 [0144.382] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.382] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.382] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.382] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.394] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.394] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.395] GetLastError () returned 0x578 [0144.395] SetLastError (dwErrCode=0x578) [0144.395] CanUserWritePwrScheme () returned 0 [0144.403] GetSystemMetrics (nIndex=46) returned 2 [0144.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.403] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.403] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.403] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.416] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.416] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.416] GetLastError () returned 0x578 [0144.416] SetLastError (dwErrCode=0x578) [0144.416] CanUserWritePwrScheme () returned 0 [0144.417] GetSystemMetrics (nIndex=46) returned 2 [0144.417] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.417] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.417] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.417] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.484] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.484] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.484] GetLastError () returned 0x578 [0144.484] SetLastError (dwErrCode=0x578) [0144.485] CanUserWritePwrScheme () returned 0 [0144.485] GetSystemMetrics (nIndex=46) returned 2 [0144.485] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.485] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.486] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.486] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.491] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.491] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.491] GetLastError () returned 0x578 [0144.491] SetLastError (dwErrCode=0x578) [0144.491] CanUserWritePwrScheme () returned 0 [0144.492] GetSystemMetrics (nIndex=46) returned 2 [0144.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.492] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.492] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.492] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.497] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.498] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.498] GetLastError () returned 0x578 [0144.498] SetLastError (dwErrCode=0x578) [0144.498] CanUserWritePwrScheme () returned 0 [0144.499] GetSystemMetrics (nIndex=46) returned 2 [0144.499] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.499] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.499] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.499] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.505] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.505] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.505] GetLastError () returned 0x578 [0144.505] SetLastError (dwErrCode=0x578) [0144.505] CanUserWritePwrScheme () returned 0 [0144.506] GetSystemMetrics (nIndex=46) returned 2 [0144.506] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.506] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.506] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.506] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.512] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.513] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.513] GetLastError () returned 0x578 [0144.513] SetLastError (dwErrCode=0x578) [0144.513] CanUserWritePwrScheme () returned 0 [0144.514] GetSystemMetrics (nIndex=46) returned 2 [0144.514] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.514] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.514] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.514] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.519] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.519] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.519] GetLastError () returned 0x578 [0144.519] SetLastError (dwErrCode=0x578) [0144.519] CanUserWritePwrScheme () returned 0 [0144.520] GetSystemMetrics (nIndex=46) returned 2 [0144.520] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.520] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.520] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.520] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.525] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.525] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.525] GetLastError () returned 0x578 [0144.525] SetLastError (dwErrCode=0x578) [0144.525] CanUserWritePwrScheme () returned 0 [0144.527] GetSystemMetrics (nIndex=46) returned 2 [0144.527] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.527] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.527] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.527] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.532] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.532] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.532] GetLastError () returned 0x578 [0144.532] SetLastError (dwErrCode=0x578) [0144.533] CanUserWritePwrScheme () returned 0 [0144.533] GetSystemMetrics (nIndex=46) returned 2 [0144.533] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.533] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.534] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.534] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.539] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.539] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.539] GetLastError () returned 0x578 [0144.539] SetLastError (dwErrCode=0x578) [0144.539] CanUserWritePwrScheme () returned 0 [0144.540] GetSystemMetrics (nIndex=46) returned 2 [0144.540] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.540] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.540] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.540] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.546] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.546] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.546] GetLastError () returned 0x578 [0144.546] SetLastError (dwErrCode=0x578) [0144.546] CanUserWritePwrScheme () returned 0 [0144.547] GetSystemMetrics (nIndex=46) returned 2 [0144.547] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.547] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.547] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.547] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.553] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.553] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.553] GetLastError () returned 0x578 [0144.553] SetLastError (dwErrCode=0x578) [0144.553] CanUserWritePwrScheme () returned 0 [0144.554] GetSystemMetrics (nIndex=46) returned 2 [0144.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.554] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.554] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.554] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.560] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.560] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.560] GetLastError () returned 0x578 [0144.560] SetLastError (dwErrCode=0x578) [0144.560] CanUserWritePwrScheme () returned 0 [0144.561] GetSystemMetrics (nIndex=46) returned 2 [0144.561] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.561] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.561] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.561] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.566] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.566] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.566] GetLastError () returned 0x578 [0144.566] SetLastError (dwErrCode=0x578) [0144.566] CanUserWritePwrScheme () returned 0 [0144.567] GetSystemMetrics (nIndex=46) returned 2 [0144.567] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.567] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.567] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.567] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.574] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.574] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.574] GetLastError () returned 0x578 [0144.574] SetLastError (dwErrCode=0x578) [0144.574] CanUserWritePwrScheme () returned 0 [0144.575] GetSystemMetrics (nIndex=46) returned 2 [0144.575] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.575] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.575] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.575] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.587] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.588] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.588] GetLastError () returned 0x578 [0144.588] SetLastError (dwErrCode=0x578) [0144.588] CanUserWritePwrScheme () returned 0 [0144.589] GetSystemMetrics (nIndex=46) returned 2 [0144.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.602] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.602] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.602] GetLastError () returned 0x578 [0144.602] SetLastError (dwErrCode=0x578) [0144.602] CanUserWritePwrScheme () returned 0 [0144.603] GetSystemMetrics (nIndex=46) returned 2 [0144.603] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.603] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.603] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.603] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.616] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.616] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.616] GetLastError () returned 0x578 [0144.616] SetLastError (dwErrCode=0x578) [0144.616] CanUserWritePwrScheme () returned 0 [0144.617] GetSystemMetrics (nIndex=46) returned 2 [0144.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.617] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.617] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.617] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.674] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.674] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.674] GetLastError () returned 0x578 [0144.674] SetLastError (dwErrCode=0x578) [0144.674] CanUserWritePwrScheme () returned 0 [0144.675] GetSystemMetrics (nIndex=46) returned 2 [0144.675] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.675] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.675] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.675] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.687] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.687] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.687] GetLastError () returned 0x578 [0144.687] SetLastError (dwErrCode=0x578) [0144.687] CanUserWritePwrScheme () returned 0 [0144.688] GetSystemMetrics (nIndex=46) returned 2 [0144.688] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.688] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.688] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.688] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.700] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.700] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.700] GetLastError () returned 0x578 [0144.701] SetLastError (dwErrCode=0x578) [0144.701] CanUserWritePwrScheme () returned 0 [0144.702] GetSystemMetrics (nIndex=46) returned 2 [0144.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.714] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.714] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.714] GetLastError () returned 0x578 [0144.714] SetLastError (dwErrCode=0x578) [0144.714] CanUserWritePwrScheme () returned 0 [0144.715] GetSystemMetrics (nIndex=46) returned 2 [0144.715] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.715] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.715] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.715] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.728] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.728] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.728] GetLastError () returned 0x578 [0144.728] SetLastError (dwErrCode=0x578) [0144.728] CanUserWritePwrScheme () returned 0 [0144.729] GetSystemMetrics (nIndex=46) returned 2 [0144.729] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.729] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.729] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.729] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.742] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.742] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.742] GetLastError () returned 0x578 [0144.742] SetLastError (dwErrCode=0x578) [0144.742] CanUserWritePwrScheme () returned 0 [0144.743] GetSystemMetrics (nIndex=46) returned 2 [0144.743] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.743] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.743] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.743] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.755] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.755] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.755] GetLastError () returned 0x578 [0144.755] SetLastError (dwErrCode=0x578) [0144.755] CanUserWritePwrScheme () returned 0 [0144.756] GetSystemMetrics (nIndex=46) returned 2 [0144.756] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.756] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.756] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.756] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.769] GetLastError () returned 0x578 [0144.769] SetLastError (dwErrCode=0x578) [0144.769] CanUserWritePwrScheme () returned 0 [0144.770] GetSystemMetrics (nIndex=46) returned 2 [0144.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.782] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.782] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.782] GetLastError () returned 0x578 [0144.782] SetLastError (dwErrCode=0x578) [0144.782] CanUserWritePwrScheme () returned 0 [0144.783] GetSystemMetrics (nIndex=46) returned 2 [0144.785] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.785] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.785] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.785] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.797] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.797] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.797] GetLastError () returned 0x578 [0144.797] SetLastError (dwErrCode=0x578) [0144.797] CanUserWritePwrScheme () returned 0 [0144.798] GetSystemMetrics (nIndex=46) returned 2 [0144.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.798] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.798] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.798] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.810] GetLastError () returned 0x578 [0144.810] SetLastError (dwErrCode=0x578) [0144.810] CanUserWritePwrScheme () returned 0 [0144.811] GetSystemMetrics (nIndex=46) returned 2 [0144.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.824] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.824] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.824] GetLastError () returned 0x578 [0144.824] SetLastError (dwErrCode=0x578) [0144.824] CanUserWritePwrScheme () returned 0 [0144.825] GetSystemMetrics (nIndex=46) returned 2 [0144.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.825] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.825] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.825] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.837] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.837] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.837] GetLastError () returned 0x578 [0144.837] SetLastError (dwErrCode=0x578) [0144.837] CanUserWritePwrScheme () returned 0 [0144.838] GetSystemMetrics (nIndex=46) returned 2 [0144.838] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.838] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.838] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.838] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.851] GetLastError () returned 0x578 [0144.851] SetLastError (dwErrCode=0x578) [0144.851] CanUserWritePwrScheme () returned 0 [0144.852] GetSystemMetrics (nIndex=46) returned 2 [0144.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.852] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.852] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.852] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.864] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.864] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.864] GetLastError () returned 0x578 [0144.864] SetLastError (dwErrCode=0x578) [0144.864] CanUserWritePwrScheme () returned 0 [0144.865] GetSystemMetrics (nIndex=46) returned 2 [0144.865] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.865] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.865] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.865] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.878] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.878] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.878] GetLastError () returned 0x578 [0144.878] SetLastError (dwErrCode=0x578) [0144.878] CanUserWritePwrScheme () returned 0 [0144.879] GetSystemMetrics (nIndex=46) returned 2 [0144.879] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.879] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.879] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.879] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.891] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.891] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.891] GetLastError () returned 0x578 [0144.891] SetLastError (dwErrCode=0x578) [0144.891] CanUserWritePwrScheme () returned 0 [0144.892] GetSystemMetrics (nIndex=46) returned 2 [0144.892] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.892] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.892] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.892] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.957] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.957] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.957] GetLastError () returned 0x578 [0144.957] SetLastError (dwErrCode=0x578) [0144.957] CanUserWritePwrScheme () returned 0 [0144.958] GetSystemMetrics (nIndex=46) returned 2 [0144.958] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.958] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.958] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.958] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.970] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.970] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.970] GetLastError () returned 0x578 [0144.970] SetLastError (dwErrCode=0x578) [0144.970] CanUserWritePwrScheme () returned 0 [0144.971] GetSystemMetrics (nIndex=46) returned 2 [0144.971] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.971] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.971] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.971] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.984] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.984] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.984] GetLastError () returned 0x578 [0144.984] SetLastError (dwErrCode=0x578) [0144.984] CanUserWritePwrScheme () returned 0 [0144.985] GetSystemMetrics (nIndex=46) returned 2 [0144.985] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.985] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.985] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.985] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0144.998] GetWindowTextLengthA (hWnd=0x0) returned 0 [0144.998] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0144.998] GetLastError () returned 0x578 [0144.998] SetLastError (dwErrCode=0x578) [0144.998] CanUserWritePwrScheme () returned 0 [0144.999] GetSystemMetrics (nIndex=46) returned 2 [0144.999] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0144.999] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0144.999] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0144.999] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.013] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.013] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.013] GetLastError () returned 0x578 [0145.013] SetLastError (dwErrCode=0x578) [0145.013] CanUserWritePwrScheme () returned 0 [0145.014] GetSystemMetrics (nIndex=46) returned 2 [0145.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.028] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.028] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.028] GetLastError () returned 0x578 [0145.028] SetLastError (dwErrCode=0x578) [0145.028] CanUserWritePwrScheme () returned 0 [0145.029] GetSystemMetrics (nIndex=46) returned 2 [0145.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.029] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.029] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.029] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.040] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.040] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.040] GetLastError () returned 0x578 [0145.040] SetLastError (dwErrCode=0x578) [0145.040] CanUserWritePwrScheme () returned 0 [0145.041] GetSystemMetrics (nIndex=46) returned 2 [0145.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.054] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.054] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.054] GetLastError () returned 0x578 [0145.054] SetLastError (dwErrCode=0x578) [0145.054] CanUserWritePwrScheme () returned 0 [0145.055] GetSystemMetrics (nIndex=46) returned 2 [0145.055] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.055] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.055] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.055] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.066] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.066] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.066] GetLastError () returned 0x578 [0145.067] SetLastError (dwErrCode=0x578) [0145.067] CanUserWritePwrScheme () returned 0 [0145.067] GetSystemMetrics (nIndex=46) returned 2 [0145.067] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.068] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.068] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.068] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.079] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.079] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.079] GetLastError () returned 0x578 [0145.079] SetLastError (dwErrCode=0x578) [0145.079] CanUserWritePwrScheme () returned 0 [0145.080] GetSystemMetrics (nIndex=46) returned 2 [0145.080] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.080] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.080] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.080] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.092] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.092] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.092] GetLastError () returned 0x578 [0145.093] SetLastError (dwErrCode=0x578) [0145.093] CanUserWritePwrScheme () returned 0 [0145.093] GetSystemMetrics (nIndex=46) returned 2 [0145.093] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.094] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.094] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.094] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.105] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.105] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.105] GetLastError () returned 0x578 [0145.105] SetLastError (dwErrCode=0x578) [0145.105] CanUserWritePwrScheme () returned 0 [0145.106] GetSystemMetrics (nIndex=46) returned 2 [0145.106] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.106] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.106] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.106] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.122] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.122] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.122] GetLastError () returned 0x578 [0145.122] SetLastError (dwErrCode=0x578) [0145.122] CanUserWritePwrScheme () returned 0 [0145.123] GetSystemMetrics (nIndex=46) returned 2 [0145.123] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.123] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.123] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.123] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.134] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.134] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.134] GetLastError () returned 0x578 [0145.134] SetLastError (dwErrCode=0x578) [0145.134] CanUserWritePwrScheme () returned 0 [0145.136] GetSystemMetrics (nIndex=46) returned 2 [0145.136] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.136] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.136] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.136] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.147] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.147] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.147] GetLastError () returned 0x578 [0145.147] SetLastError (dwErrCode=0x578) [0145.147] CanUserWritePwrScheme () returned 0 [0145.148] GetSystemMetrics (nIndex=46) returned 2 [0145.148] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.148] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.148] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.148] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.161] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.161] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.161] GetLastError () returned 0x578 [0145.161] SetLastError (dwErrCode=0x578) [0145.161] CanUserWritePwrScheme () returned 0 [0145.162] GetSystemMetrics (nIndex=46) returned 2 [0145.162] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.162] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.162] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.162] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.172] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.172] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.172] GetLastError () returned 0x578 [0145.173] SetLastError (dwErrCode=0x578) [0145.173] CanUserWritePwrScheme () returned 0 [0145.173] GetSystemMetrics (nIndex=46) returned 2 [0145.174] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.174] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.174] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.174] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.179] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.179] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.179] GetLastError () returned 0x578 [0145.179] SetLastError (dwErrCode=0x578) [0145.179] CanUserWritePwrScheme () returned 0 [0145.180] GetSystemMetrics (nIndex=46) returned 2 [0145.180] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.180] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.180] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.180] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.185] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.185] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.185] GetLastError () returned 0x578 [0145.185] SetLastError (dwErrCode=0x578) [0145.185] CanUserWritePwrScheme () returned 0 [0145.186] GetSystemMetrics (nIndex=46) returned 2 [0145.186] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.186] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.186] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.186] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.191] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.191] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.191] GetLastError () returned 0x578 [0145.191] SetLastError (dwErrCode=0x578) [0145.191] CanUserWritePwrScheme () returned 0 [0145.192] GetSystemMetrics (nIndex=46) returned 2 [0145.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.192] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.192] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.192] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.197] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.197] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.197] GetLastError () returned 0x578 [0145.197] CanUserWritePwrScheme () returned 0 [0145.198] GetSystemMetrics (nIndex=46) returned 2 [0145.198] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.198] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.198] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.198] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.204] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.204] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.204] GetLastError () returned 0x578 [0145.204] CanUserWritePwrScheme () returned 0 [0145.205] GetSystemMetrics (nIndex=46) returned 2 [0145.205] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.205] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.205] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.205] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.211] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.211] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.212] GetLastError () returned 0x578 [0145.212] CanUserWritePwrScheme () returned 0 [0145.212] GetSystemMetrics (nIndex=46) returned 2 [0145.212] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.212] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.212] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.213] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.223] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.223] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.223] GetLastError () returned 0x578 [0145.223] CanUserWritePwrScheme () returned 0 [0145.224] GetSystemMetrics (nIndex=46) returned 2 [0145.224] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.224] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.224] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.224] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.235] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.235] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.235] GetLastError () returned 0x578 [0145.235] CanUserWritePwrScheme () returned 0 [0145.236] GetSystemMetrics (nIndex=46) returned 2 [0145.236] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.236] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.236] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.236] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.249] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.249] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.249] GetLastError () returned 0x578 [0145.249] CanUserWritePwrScheme () returned 0 [0145.250] GetSystemMetrics (nIndex=46) returned 2 [0145.250] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.250] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.250] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.250] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.261] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.261] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.261] GetLastError () returned 0x578 [0145.261] CanUserWritePwrScheme () returned 0 [0145.262] GetSystemMetrics (nIndex=46) returned 2 [0145.262] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.262] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.262] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.262] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.273] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.273] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.273] GetLastError () returned 0x578 [0145.273] CanUserWritePwrScheme () returned 0 [0145.274] GetSystemMetrics (nIndex=46) returned 2 [0145.274] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.274] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.274] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.274] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.286] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.286] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.286] GetLastError () returned 0x578 [0145.286] CanUserWritePwrScheme () returned 0 [0145.287] GetSystemMetrics (nIndex=46) returned 2 [0145.287] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.287] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.287] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.287] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.299] GetLastError () returned 0x578 [0145.299] CanUserWritePwrScheme () returned 0 [0145.300] GetSystemMetrics (nIndex=46) returned 2 [0145.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.311] GetLastError () returned 0x578 [0145.311] CanUserWritePwrScheme () returned 0 [0145.312] GetSystemMetrics (nIndex=46) returned 2 [0145.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.323] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.323] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.323] GetLastError () returned 0x578 [0145.323] CanUserWritePwrScheme () returned 0 [0145.324] GetSystemMetrics (nIndex=46) returned 2 [0145.324] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.324] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.324] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.324] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.337] GetLastError () returned 0x578 [0145.337] CanUserWritePwrScheme () returned 0 [0145.338] GetSystemMetrics (nIndex=46) returned 2 [0145.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.338] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.338] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.338] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.348] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.348] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.348] GetLastError () returned 0x578 [0145.349] CanUserWritePwrScheme () returned 0 [0145.349] GetSystemMetrics (nIndex=46) returned 2 [0145.349] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.349] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.350] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.350] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.393] GetLastError () returned 0x578 [0145.393] CanUserWritePwrScheme () returned 0 [0145.394] GetSystemMetrics (nIndex=46) returned 2 [0145.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.394] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.394] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.394] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.407] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.407] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.407] GetLastError () returned 0x578 [0145.407] CanUserWritePwrScheme () returned 0 [0145.408] GetSystemMetrics (nIndex=46) returned 2 [0145.408] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.408] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.408] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.408] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.413] GetLastError () returned 0x578 [0145.413] CanUserWritePwrScheme () returned 0 [0145.415] GetSystemMetrics (nIndex=46) returned 2 [0145.415] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.415] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.415] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.416] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.420] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.420] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.420] GetLastError () returned 0x578 [0145.420] CanUserWritePwrScheme () returned 0 [0145.421] GetSystemMetrics (nIndex=46) returned 2 [0145.421] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.421] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.421] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.421] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.426] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.426] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.426] GetLastError () returned 0x578 [0145.426] CanUserWritePwrScheme () returned 0 [0145.427] GetSystemMetrics (nIndex=46) returned 2 [0145.427] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.427] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.427] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.427] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.432] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.432] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.432] GetLastError () returned 0x578 [0145.432] CanUserWritePwrScheme () returned 0 [0145.433] GetSystemMetrics (nIndex=46) returned 2 [0145.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.433] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.433] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.433] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.438] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.438] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.438] GetLastError () returned 0x578 [0145.438] CanUserWritePwrScheme () returned 0 [0145.439] GetSystemMetrics (nIndex=46) returned 2 [0145.439] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.439] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.439] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.439] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.444] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.444] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.444] GetLastError () returned 0x578 [0145.444] CanUserWritePwrScheme () returned 0 [0145.445] GetSystemMetrics (nIndex=46) returned 2 [0145.445] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.445] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.445] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.445] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.450] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.450] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.450] GetLastError () returned 0x578 [0145.450] CanUserWritePwrScheme () returned 0 [0145.451] GetSystemMetrics (nIndex=46) returned 2 [0145.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.451] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.451] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.451] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.456] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.456] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.456] GetLastError () returned 0x578 [0145.456] CanUserWritePwrScheme () returned 0 [0145.457] GetSystemMetrics (nIndex=46) returned 2 [0145.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.457] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.457] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.457] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.464] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.464] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.464] GetLastError () returned 0x578 [0145.464] CanUserWritePwrScheme () returned 0 [0145.465] GetSystemMetrics (nIndex=46) returned 2 [0145.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.465] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.465] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.470] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.470] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.470] GetLastError () returned 0x578 [0145.470] CanUserWritePwrScheme () returned 0 [0145.471] GetSystemMetrics (nIndex=46) returned 2 [0145.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.476] GetLastError () returned 0x578 [0145.476] CanUserWritePwrScheme () returned 0 [0145.477] GetSystemMetrics (nIndex=46) returned 2 [0145.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.488] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.488] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.488] GetLastError () returned 0x578 [0145.488] CanUserWritePwrScheme () returned 0 [0145.489] GetSystemMetrics (nIndex=46) returned 2 [0145.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.489] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.489] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.489] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.500] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.500] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.500] GetLastError () returned 0x578 [0145.500] CanUserWritePwrScheme () returned 0 [0145.501] GetSystemMetrics (nIndex=46) returned 2 [0145.501] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.501] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.501] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.501] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.514] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.514] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.514] GetLastError () returned 0x578 [0145.514] CanUserWritePwrScheme () returned 0 [0145.515] GetSystemMetrics (nIndex=46) returned 2 [0145.515] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.515] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.515] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.515] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.526] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.526] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.526] GetLastError () returned 0x578 [0145.526] CanUserWritePwrScheme () returned 0 [0145.528] GetSystemMetrics (nIndex=46) returned 2 [0145.528] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.528] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.528] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.528] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.539] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.539] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.539] GetLastError () returned 0x578 [0145.539] CanUserWritePwrScheme () returned 0 [0145.540] GetSystemMetrics (nIndex=46) returned 2 [0145.540] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.540] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.540] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.540] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.585] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.585] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.585] GetLastError () returned 0x578 [0145.585] CanUserWritePwrScheme () returned 0 [0145.586] GetSystemMetrics (nIndex=46) returned 2 [0145.586] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.586] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.586] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.586] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.597] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.597] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.597] GetLastError () returned 0x578 [0145.597] CanUserWritePwrScheme () returned 0 [0145.598] GetSystemMetrics (nIndex=46) returned 2 [0145.598] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.598] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.598] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.598] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.611] GetLastError () returned 0x578 [0145.611] CanUserWritePwrScheme () returned 0 [0145.612] GetSystemMetrics (nIndex=46) returned 2 [0145.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.612] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.622] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.622] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.623] GetLastError () returned 0x578 [0145.623] CanUserWritePwrScheme () returned 0 [0145.623] GetSystemMetrics (nIndex=46) returned 2 [0145.623] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.623] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.624] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.624] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.636] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.636] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.636] GetLastError () returned 0x578 [0145.636] CanUserWritePwrScheme () returned 0 [0145.637] GetSystemMetrics (nIndex=46) returned 2 [0145.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.637] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.637] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.637] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.648] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.648] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.648] GetLastError () returned 0x578 [0145.648] CanUserWritePwrScheme () returned 0 [0145.649] GetSystemMetrics (nIndex=46) returned 2 [0145.649] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.649] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.649] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.649] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.664] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.664] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.664] GetLastError () returned 0x578 [0145.664] CanUserWritePwrScheme () returned 0 [0145.665] GetSystemMetrics (nIndex=46) returned 2 [0145.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.665] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.665] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.665] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.676] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.676] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.676] GetLastError () returned 0x578 [0145.676] CanUserWritePwrScheme () returned 0 [0145.677] GetSystemMetrics (nIndex=46) returned 2 [0145.677] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.677] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.677] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.677] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.683] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.683] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.683] GetLastError () returned 0x578 [0145.683] CanUserWritePwrScheme () returned 0 [0145.684] GetSystemMetrics (nIndex=46) returned 2 [0145.684] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.684] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.684] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.689] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.689] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.689] GetLastError () returned 0x578 [0145.689] CanUserWritePwrScheme () returned 0 [0145.690] GetSystemMetrics (nIndex=46) returned 2 [0145.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.690] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.690] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.690] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.695] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.695] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.695] GetLastError () returned 0x578 [0145.695] CanUserWritePwrScheme () returned 0 [0145.696] GetSystemMetrics (nIndex=46) returned 2 [0145.696] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.696] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.696] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.696] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.700] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.701] GetLastError () returned 0x578 [0145.701] CanUserWritePwrScheme () returned 0 [0145.701] GetSystemMetrics (nIndex=46) returned 2 [0145.701] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.709] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.709] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.709] GetLastError () returned 0x578 [0145.709] CanUserWritePwrScheme () returned 0 [0145.710] GetSystemMetrics (nIndex=46) returned 2 [0145.710] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.710] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.711] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.711] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.715] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.715] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.715] GetLastError () returned 0x578 [0145.715] CanUserWritePwrScheme () returned 0 [0145.716] GetSystemMetrics (nIndex=46) returned 2 [0145.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.716] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.716] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.716] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.721] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.721] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.721] GetLastError () returned 0x578 [0145.721] CanUserWritePwrScheme () returned 0 [0145.722] GetSystemMetrics (nIndex=46) returned 2 [0145.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.722] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.722] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.722] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.727] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.727] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.727] GetLastError () returned 0x578 [0145.727] CanUserWritePwrScheme () returned 0 [0145.728] GetSystemMetrics (nIndex=46) returned 2 [0145.728] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.728] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.728] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.728] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.733] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.733] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.733] GetLastError () returned 0x578 [0145.733] CanUserWritePwrScheme () returned 0 [0145.734] GetSystemMetrics (nIndex=46) returned 2 [0145.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.734] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.734] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.734] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.739] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.739] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.739] GetLastError () returned 0x578 [0145.739] CanUserWritePwrScheme () returned 0 [0145.740] GetSystemMetrics (nIndex=46) returned 2 [0145.740] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.740] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.740] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.740] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.765] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.765] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.765] GetLastError () returned 0x578 [0145.765] CanUserWritePwrScheme () returned 0 [0145.766] GetSystemMetrics (nIndex=46) returned 2 [0145.766] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.766] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.766] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.766] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.777] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.777] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.777] GetLastError () returned 0x578 [0145.777] CanUserWritePwrScheme () returned 0 [0145.778] GetSystemMetrics (nIndex=46) returned 2 [0145.778] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.778] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.778] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.778] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.789] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.789] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.789] GetLastError () returned 0x578 [0145.789] CanUserWritePwrScheme () returned 0 [0145.790] GetSystemMetrics (nIndex=46) returned 2 [0145.790] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.790] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.790] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.790] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.801] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.801] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.801] GetLastError () returned 0x578 [0145.801] CanUserWritePwrScheme () returned 0 [0145.802] GetSystemMetrics (nIndex=46) returned 2 [0145.802] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.802] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.802] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.802] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.816] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.816] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.816] GetLastError () returned 0x578 [0145.816] CanUserWritePwrScheme () returned 0 [0145.817] GetSystemMetrics (nIndex=46) returned 2 [0145.817] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.817] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.817] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.817] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.828] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.828] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.828] GetLastError () returned 0x578 [0145.828] CanUserWritePwrScheme () returned 0 [0145.829] GetSystemMetrics (nIndex=46) returned 2 [0145.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.829] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.829] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.829] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.840] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.840] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.840] GetLastError () returned 0x578 [0145.840] CanUserWritePwrScheme () returned 0 [0145.841] GetSystemMetrics (nIndex=46) returned 2 [0145.841] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.841] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.841] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.841] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.854] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.854] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.855] GetLastError () returned 0x578 [0145.855] CanUserWritePwrScheme () returned 0 [0145.855] GetSystemMetrics (nIndex=46) returned 2 [0145.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.856] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.856] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.868] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.868] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.869] GetLastError () returned 0x578 [0145.869] CanUserWritePwrScheme () returned 0 [0145.869] GetSystemMetrics (nIndex=46) returned 2 [0145.869] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.869] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.870] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.870] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.881] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.881] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.881] GetLastError () returned 0x578 [0145.881] CanUserWritePwrScheme () returned 0 [0145.882] GetSystemMetrics (nIndex=46) returned 2 [0145.882] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.882] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.882] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.882] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.892] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.892] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.892] GetLastError () returned 0x578 [0145.892] CanUserWritePwrScheme () returned 0 [0145.893] GetSystemMetrics (nIndex=46) returned 2 [0145.893] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.893] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.893] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.893] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.905] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.905] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.905] GetLastError () returned 0x578 [0145.905] CanUserWritePwrScheme () returned 0 [0145.906] GetSystemMetrics (nIndex=46) returned 2 [0145.906] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.906] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.906] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.906] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.917] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.917] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.917] GetLastError () returned 0x578 [0145.917] CanUserWritePwrScheme () returned 0 [0145.918] GetSystemMetrics (nIndex=46) returned 2 [0145.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.918] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.918] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.918] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.931] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.931] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.931] GetLastError () returned 0x578 [0145.931] CanUserWritePwrScheme () returned 0 [0145.932] GetSystemMetrics (nIndex=46) returned 2 [0145.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.932] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.932] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.932] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.945] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.945] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.945] GetLastError () returned 0x578 [0145.945] CanUserWritePwrScheme () returned 0 [0145.946] GetSystemMetrics (nIndex=46) returned 2 [0145.946] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.946] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.946] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.946] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.957] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.957] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.957] GetLastError () returned 0x578 [0145.957] CanUserWritePwrScheme () returned 0 [0145.958] GetSystemMetrics (nIndex=46) returned 2 [0145.958] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.958] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.958] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.958] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.969] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.969] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.969] GetLastError () returned 0x578 [0145.969] CanUserWritePwrScheme () returned 0 [0145.970] GetSystemMetrics (nIndex=46) returned 2 [0145.970] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.970] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.970] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.970] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.982] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.982] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.982] GetLastError () returned 0x578 [0145.982] CanUserWritePwrScheme () returned 0 [0145.983] GetSystemMetrics (nIndex=46) returned 2 [0145.983] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.983] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.983] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.983] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.988] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.988] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.988] GetLastError () returned 0x578 [0145.988] CanUserWritePwrScheme () returned 0 [0145.989] GetSystemMetrics (nIndex=46) returned 2 [0145.989] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.989] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.989] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.989] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.993] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.993] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.994] GetLastError () returned 0x578 [0145.994] CanUserWritePwrScheme () returned 0 [0145.994] GetSystemMetrics (nIndex=46) returned 2 [0145.994] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0145.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0145.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0145.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0145.999] GetWindowTextLengthA (hWnd=0x0) returned 0 [0145.999] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0145.999] GetLastError () returned 0x578 [0145.999] CanUserWritePwrScheme () returned 0 [0146.000] GetSystemMetrics (nIndex=46) returned 2 [0146.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.000] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.000] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.000] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.005] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.005] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.006] GetLastError () returned 0x578 [0146.006] CanUserWritePwrScheme () returned 0 [0146.006] GetSystemMetrics (nIndex=46) returned 2 [0146.006] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.006] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.007] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.007] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.011] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.011] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.011] GetLastError () returned 0x578 [0146.011] CanUserWritePwrScheme () returned 0 [0146.012] GetSystemMetrics (nIndex=46) returned 2 [0146.012] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.012] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.012] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.012] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.017] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.017] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.017] GetLastError () returned 0x578 [0146.017] CanUserWritePwrScheme () returned 0 [0146.018] GetSystemMetrics (nIndex=46) returned 2 [0146.018] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.018] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.018] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.018] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.023] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.023] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.023] GetLastError () returned 0x578 [0146.023] CanUserWritePwrScheme () returned 0 [0146.024] GetSystemMetrics (nIndex=46) returned 2 [0146.024] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.024] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.024] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.024] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.031] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.031] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.031] GetLastError () returned 0x578 [0146.031] CanUserWritePwrScheme () returned 0 [0146.032] GetSystemMetrics (nIndex=46) returned 2 [0146.032] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.032] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.032] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.032] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.045] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.045] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.045] GetLastError () returned 0x578 [0146.045] CanUserWritePwrScheme () returned 0 [0146.046] GetSystemMetrics (nIndex=46) returned 2 [0146.046] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.046] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.046] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.046] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.057] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.057] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.057] GetLastError () returned 0x578 [0146.057] CanUserWritePwrScheme () returned 0 [0146.058] GetSystemMetrics (nIndex=46) returned 2 [0146.058] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.058] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.058] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.058] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.069] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.069] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.069] GetLastError () returned 0x578 [0146.069] CanUserWritePwrScheme () returned 0 [0146.070] GetSystemMetrics (nIndex=46) returned 2 [0146.070] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.070] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.070] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.070] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.081] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.081] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.081] GetLastError () returned 0x578 [0146.081] CanUserWritePwrScheme () returned 0 [0146.082] GetSystemMetrics (nIndex=46) returned 2 [0146.082] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.082] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.082] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.082] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.093] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.093] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.093] GetLastError () returned 0x578 [0146.093] CanUserWritePwrScheme () returned 0 [0146.094] GetSystemMetrics (nIndex=46) returned 2 [0146.094] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.094] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.094] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.094] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.107] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.107] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.107] GetLastError () returned 0x578 [0146.108] CanUserWritePwrScheme () returned 0 [0146.108] GetSystemMetrics (nIndex=46) returned 2 [0146.108] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.108] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.108] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.108] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.119] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.119] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.119] GetLastError () returned 0x578 [0146.119] CanUserWritePwrScheme () returned 0 [0146.120] GetSystemMetrics (nIndex=46) returned 2 [0146.120] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.120] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.120] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.120] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.131] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.131] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.131] GetLastError () returned 0x578 [0146.131] CanUserWritePwrScheme () returned 0 [0146.132] GetSystemMetrics (nIndex=46) returned 2 [0146.132] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.132] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.132] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.132] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.143] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.143] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.143] GetLastError () returned 0x578 [0146.143] CanUserWritePwrScheme () returned 0 [0146.144] GetSystemMetrics (nIndex=46) returned 2 [0146.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.144] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.144] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.144] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.155] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.155] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.155] GetLastError () returned 0x578 [0146.155] CanUserWritePwrScheme () returned 0 [0146.156] GetSystemMetrics (nIndex=46) returned 2 [0146.156] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.156] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.156] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.156] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.204] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.204] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.205] GetLastError () returned 0x578 [0146.205] CanUserWritePwrScheme () returned 0 [0146.205] GetSystemMetrics (nIndex=46) returned 2 [0146.205] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.206] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.206] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.206] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.215] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.215] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.215] GetLastError () returned 0x578 [0146.215] CanUserWritePwrScheme () returned 0 [0146.216] GetSystemMetrics (nIndex=46) returned 2 [0146.216] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.216] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.216] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.216] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.224] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.224] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.224] GetLastError () returned 0x578 [0146.224] CanUserWritePwrScheme () returned 0 [0146.225] GetSystemMetrics (nIndex=46) returned 2 [0146.225] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.225] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.225] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.225] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.230] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.230] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.230] GetLastError () returned 0x578 [0146.230] CanUserWritePwrScheme () returned 0 [0146.231] GetSystemMetrics (nIndex=46) returned 2 [0146.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.231] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.231] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.231] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.236] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.236] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.236] GetLastError () returned 0x578 [0146.236] CanUserWritePwrScheme () returned 0 [0146.237] GetSystemMetrics (nIndex=46) returned 2 [0146.237] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.237] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.237] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.237] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.241] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.242] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.242] GetLastError () returned 0x578 [0146.242] CanUserWritePwrScheme () returned 0 [0146.242] GetSystemMetrics (nIndex=46) returned 2 [0146.243] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.243] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.243] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.243] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.248] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.248] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.248] GetLastError () returned 0x578 [0146.248] CanUserWritePwrScheme () returned 0 [0146.249] GetSystemMetrics (nIndex=46) returned 2 [0146.249] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.249] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.249] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.249] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.253] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.253] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.254] GetLastError () returned 0x578 [0146.254] CanUserWritePwrScheme () returned 0 [0146.255] GetSystemMetrics (nIndex=46) returned 2 [0146.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.255] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.255] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.260] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.260] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.260] GetLastError () returned 0x578 [0146.260] CanUserWritePwrScheme () returned 0 [0146.261] GetSystemMetrics (nIndex=46) returned 2 [0146.261] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.261] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.261] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.261] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.265] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.265] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.265] GetLastError () returned 0x578 [0146.266] CanUserWritePwrScheme () returned 0 [0146.266] GetSystemMetrics (nIndex=46) returned 2 [0146.266] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.266] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.266] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.267] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.271] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.271] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.271] GetLastError () returned 0x578 [0146.272] CanUserWritePwrScheme () returned 0 [0146.272] GetSystemMetrics (nIndex=46) returned 2 [0146.272] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.272] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.272] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.273] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.277] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.277] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.277] GetLastError () returned 0x578 [0146.277] CanUserWritePwrScheme () returned 0 [0146.278] GetSystemMetrics (nIndex=46) returned 2 [0146.278] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.278] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.278] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.278] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.287] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.287] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.287] GetLastError () returned 0x578 [0146.287] CanUserWritePwrScheme () returned 0 [0146.288] GetSystemMetrics (nIndex=46) returned 2 [0146.288] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.288] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.288] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.288] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.299] GetLastError () returned 0x578 [0146.299] CanUserWritePwrScheme () returned 0 [0146.300] GetSystemMetrics (nIndex=46) returned 2 [0146.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.310] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.310] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.310] GetLastError () returned 0x578 [0146.310] CanUserWritePwrScheme () returned 0 [0146.311] GetSystemMetrics (nIndex=46) returned 2 [0146.311] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.311] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.311] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.311] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.323] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.323] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.323] GetLastError () returned 0x578 [0146.323] CanUserWritePwrScheme () returned 0 [0146.324] GetSystemMetrics (nIndex=46) returned 2 [0146.324] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.324] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.324] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.324] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.335] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.335] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.335] GetLastError () returned 0x578 [0146.335] CanUserWritePwrScheme () returned 0 [0146.336] GetSystemMetrics (nIndex=46) returned 2 [0146.336] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.336] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.336] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.336] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.350] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.350] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.350] GetLastError () returned 0x578 [0146.350] CanUserWritePwrScheme () returned 0 [0146.351] GetSystemMetrics (nIndex=46) returned 2 [0146.351] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.351] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.351] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.351] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.373] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.373] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.373] GetLastError () returned 0x578 [0146.373] CanUserWritePwrScheme () returned 0 [0146.374] GetSystemMetrics (nIndex=46) returned 2 [0146.374] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.374] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.374] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.374] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.385] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.385] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.385] GetLastError () returned 0x578 [0146.385] CanUserWritePwrScheme () returned 0 [0146.386] GetSystemMetrics (nIndex=46) returned 2 [0146.386] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.386] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.386] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.386] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.403] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.403] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.403] GetLastError () returned 0x578 [0146.403] CanUserWritePwrScheme () returned 0 [0146.404] GetSystemMetrics (nIndex=46) returned 2 [0146.404] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.404] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.404] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.404] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.418] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.418] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.418] GetLastError () returned 0x578 [0146.418] CanUserWritePwrScheme () returned 0 [0146.419] GetSystemMetrics (nIndex=46) returned 2 [0146.419] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.419] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.419] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.419] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.429] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.429] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.430] GetLastError () returned 0x578 [0146.430] CanUserWritePwrScheme () returned 0 [0146.430] GetSystemMetrics (nIndex=46) returned 2 [0146.430] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.441] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.441] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.441] GetLastError () returned 0x578 [0146.441] CanUserWritePwrScheme () returned 0 [0146.442] GetSystemMetrics (nIndex=46) returned 2 [0146.442] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.442] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.442] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.442] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.453] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.453] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.453] GetLastError () returned 0x578 [0146.453] CanUserWritePwrScheme () returned 0 [0146.454] GetSystemMetrics (nIndex=46) returned 2 [0146.454] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.454] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.454] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.454] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.465] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.465] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.465] GetLastError () returned 0x578 [0146.465] CanUserWritePwrScheme () returned 0 [0146.466] GetSystemMetrics (nIndex=46) returned 2 [0146.466] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.466] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.466] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.466] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.479] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.479] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.479] GetLastError () returned 0x578 [0146.479] CanUserWritePwrScheme () returned 0 [0146.480] GetSystemMetrics (nIndex=46) returned 2 [0146.480] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.480] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.480] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.480] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.491] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.491] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.491] GetLastError () returned 0x578 [0146.491] CanUserWritePwrScheme () returned 0 [0146.492] GetSystemMetrics (nIndex=46) returned 2 [0146.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.492] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.492] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.492] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.503] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.503] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.503] GetLastError () returned 0x578 [0146.503] CanUserWritePwrScheme () returned 0 [0146.503] GetSystemMetrics (nIndex=46) returned 2 [0146.504] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.504] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.504] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.504] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.512] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.512] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.512] GetLastError () returned 0x578 [0146.512] CanUserWritePwrScheme () returned 0 [0146.513] GetSystemMetrics (nIndex=46) returned 2 [0146.513] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.513] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.513] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.513] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.518] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.518] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.518] GetLastError () returned 0x578 [0146.518] CanUserWritePwrScheme () returned 0 [0146.519] GetSystemMetrics (nIndex=46) returned 2 [0146.519] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.519] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.519] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.519] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.523] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.523] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.524] GetLastError () returned 0x578 [0146.524] CanUserWritePwrScheme () returned 0 [0146.524] GetSystemMetrics (nIndex=46) returned 2 [0146.524] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.524] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.524] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.525] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.529] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.529] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.529] GetLastError () returned 0x578 [0146.529] CanUserWritePwrScheme () returned 0 [0146.530] GetSystemMetrics (nIndex=46) returned 2 [0146.530] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.530] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.530] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.530] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.535] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.535] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.535] GetLastError () returned 0x578 [0146.535] CanUserWritePwrScheme () returned 0 [0146.536] GetSystemMetrics (nIndex=46) returned 2 [0146.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.545] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.545] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.545] GetLastError () returned 0x578 [0146.545] CanUserWritePwrScheme () returned 0 [0146.546] GetSystemMetrics (nIndex=46) returned 2 [0146.546] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.546] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.546] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.546] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.557] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.557] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.557] GetLastError () returned 0x578 [0146.557] CanUserWritePwrScheme () returned 0 [0146.558] GetSystemMetrics (nIndex=46) returned 2 [0146.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.558] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.558] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.558] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.569] GetLastError () returned 0x578 [0146.569] CanUserWritePwrScheme () returned 0 [0146.570] GetSystemMetrics (nIndex=46) returned 2 [0146.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.570] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.570] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.570] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.580] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.580] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.580] GetLastError () returned 0x578 [0146.580] CanUserWritePwrScheme () returned 0 [0146.581] GetSystemMetrics (nIndex=46) returned 2 [0146.581] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.581] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.581] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.581] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.592] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.592] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.592] GetLastError () returned 0x578 [0146.592] CanUserWritePwrScheme () returned 0 [0146.593] GetSystemMetrics (nIndex=46) returned 2 [0146.593] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.593] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.593] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.593] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.607] GetLastError () returned 0x578 [0146.607] CanUserWritePwrScheme () returned 0 [0146.608] GetSystemMetrics (nIndex=46) returned 2 [0146.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.608] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.608] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.608] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.618] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.618] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.619] GetLastError () returned 0x578 [0146.619] CanUserWritePwrScheme () returned 0 [0146.619] GetSystemMetrics (nIndex=46) returned 2 [0146.619] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.619] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.630] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.630] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.630] GetLastError () returned 0x578 [0146.630] CanUserWritePwrScheme () returned 0 [0146.631] GetSystemMetrics (nIndex=46) returned 2 [0146.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.645] GetLastError () returned 0x578 [0146.645] CanUserWritePwrScheme () returned 0 [0146.646] GetSystemMetrics (nIndex=46) returned 2 [0146.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.657] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.657] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.657] GetLastError () returned 0x578 [0146.657] CanUserWritePwrScheme () returned 0 [0146.658] GetSystemMetrics (nIndex=46) returned 2 [0146.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.658] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.658] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.658] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.671] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.671] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.671] GetLastError () returned 0x578 [0146.671] CanUserWritePwrScheme () returned 0 [0146.672] GetSystemMetrics (nIndex=46) returned 2 [0146.672] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.672] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.672] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.672] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.683] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.683] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.683] GetLastError () returned 0x578 [0146.683] CanUserWritePwrScheme () returned 0 [0146.684] GetSystemMetrics (nIndex=46) returned 2 [0146.684] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.684] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.684] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.694] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.694] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.694] GetLastError () returned 0x578 [0146.695] CanUserWritePwrScheme () returned 0 [0146.695] GetSystemMetrics (nIndex=46) returned 2 [0146.695] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.695] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.695] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.695] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.706] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.706] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.706] GetLastError () returned 0x578 [0146.706] CanUserWritePwrScheme () returned 0 [0146.707] GetSystemMetrics (nIndex=46) returned 2 [0146.707] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.707] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.707] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.707] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.718] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.718] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.718] GetLastError () returned 0x578 [0146.718] CanUserWritePwrScheme () returned 0 [0146.719] GetSystemMetrics (nIndex=46) returned 2 [0146.719] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.719] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.719] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.719] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.730] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.730] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.730] GetLastError () returned 0x578 [0146.730] CanUserWritePwrScheme () returned 0 [0146.731] GetSystemMetrics (nIndex=46) returned 2 [0146.731] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.731] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.731] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.731] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.744] GetLastError () returned 0x578 [0146.744] CanUserWritePwrScheme () returned 0 [0146.745] GetSystemMetrics (nIndex=46) returned 2 [0146.745] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.745] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.745] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.745] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.756] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.756] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.756] GetLastError () returned 0x578 [0146.756] CanUserWritePwrScheme () returned 0 [0146.757] GetSystemMetrics (nIndex=46) returned 2 [0146.757] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.757] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.757] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.757] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.768] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.768] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.768] GetLastError () returned 0x578 [0146.768] CanUserWritePwrScheme () returned 0 [0146.769] GetSystemMetrics (nIndex=46) returned 2 [0146.769] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.769] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.812] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.812] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.812] GetLastError () returned 0x578 [0146.812] CanUserWritePwrScheme () returned 0 [0146.813] GetSystemMetrics (nIndex=46) returned 2 [0146.813] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.813] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.813] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.813] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.824] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.824] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.824] GetLastError () returned 0x578 [0146.824] CanUserWritePwrScheme () returned 0 [0146.825] GetSystemMetrics (nIndex=46) returned 2 [0146.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.825] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.825] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.825] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.835] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.835] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.835] GetLastError () returned 0x578 [0146.836] CanUserWritePwrScheme () returned 0 [0146.836] GetSystemMetrics (nIndex=46) returned 2 [0146.836] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.836] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.836] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.836] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.847] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.847] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.847] GetLastError () returned 0x578 [0146.847] CanUserWritePwrScheme () returned 0 [0146.848] GetSystemMetrics (nIndex=46) returned 2 [0146.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.848] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.848] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.848] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.859] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.859] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.859] GetLastError () returned 0x578 [0146.859] CanUserWritePwrScheme () returned 0 [0146.859] GetSystemMetrics (nIndex=46) returned 2 [0146.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.860] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.860] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.860] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.873] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.873] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.873] GetLastError () returned 0x578 [0146.873] CanUserWritePwrScheme () returned 0 [0146.874] GetSystemMetrics (nIndex=46) returned 2 [0146.874] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.874] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.874] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.874] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.884] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.884] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.885] GetLastError () returned 0x578 [0146.885] CanUserWritePwrScheme () returned 0 [0146.885] GetSystemMetrics (nIndex=46) returned 2 [0146.885] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.885] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.885] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.885] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.943] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.943] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.943] GetLastError () returned 0x578 [0146.943] CanUserWritePwrScheme () returned 0 [0146.944] GetSystemMetrics (nIndex=46) returned 2 [0146.944] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.944] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.944] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.944] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.955] GetLastError () returned 0x578 [0146.955] CanUserWritePwrScheme () returned 0 [0146.956] GetSystemMetrics (nIndex=46) returned 2 [0146.956] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.956] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.956] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.956] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.967] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.967] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.967] GetLastError () returned 0x578 [0146.967] CanUserWritePwrScheme () returned 0 [0146.968] GetSystemMetrics (nIndex=46) returned 2 [0146.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.978] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.978] GetLastError () returned 0x578 [0146.979] CanUserWritePwrScheme () returned 0 [0146.979] GetSystemMetrics (nIndex=46) returned 2 [0146.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.979] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.979] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.979] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0146.990] GetWindowTextLengthA (hWnd=0x0) returned 0 [0146.990] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0146.990] GetLastError () returned 0x578 [0146.990] CanUserWritePwrScheme () returned 0 [0146.991] GetSystemMetrics (nIndex=46) returned 2 [0146.991] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0146.991] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0146.991] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0146.991] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.005] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.005] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.005] GetLastError () returned 0x578 [0147.005] CanUserWritePwrScheme () returned 0 [0147.006] GetSystemMetrics (nIndex=46) returned 2 [0147.006] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.006] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.006] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.006] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.017] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.017] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.017] GetLastError () returned 0x578 [0147.017] CanUserWritePwrScheme () returned 0 [0147.018] GetSystemMetrics (nIndex=46) returned 2 [0147.018] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.018] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.018] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.018] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.028] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.028] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.029] GetLastError () returned 0x578 [0147.029] CanUserWritePwrScheme () returned 0 [0147.029] GetSystemMetrics (nIndex=46) returned 2 [0147.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.029] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.030] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.030] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.040] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.040] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.040] GetLastError () returned 0x578 [0147.040] CanUserWritePwrScheme () returned 0 [0147.041] GetSystemMetrics (nIndex=46) returned 2 [0147.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.052] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.052] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.052] GetLastError () returned 0x578 [0147.052] CanUserWritePwrScheme () returned 0 [0147.053] GetSystemMetrics (nIndex=46) returned 2 [0147.053] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.053] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.053] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.053] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.066] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.066] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.067] GetLastError () returned 0x578 [0147.067] CanUserWritePwrScheme () returned 0 [0147.067] GetSystemMetrics (nIndex=46) returned 2 [0147.067] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.067] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.067] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.068] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.078] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.078] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.078] GetLastError () returned 0x578 [0147.078] CanUserWritePwrScheme () returned 0 [0147.079] GetSystemMetrics (nIndex=46) returned 2 [0147.079] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.079] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.079] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.079] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.090] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.090] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.090] GetLastError () returned 0x578 [0147.090] CanUserWritePwrScheme () returned 0 [0147.091] GetSystemMetrics (nIndex=46) returned 2 [0147.091] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.091] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.091] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.091] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.102] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.102] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.102] GetLastError () returned 0x578 [0147.102] CanUserWritePwrScheme () returned 0 [0147.103] GetSystemMetrics (nIndex=46) returned 2 [0147.103] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.103] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.103] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.103] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.118] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.118] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.118] GetLastError () returned 0x578 [0147.118] CanUserWritePwrScheme () returned 0 [0147.119] GetSystemMetrics (nIndex=46) returned 2 [0147.119] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.119] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.119] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.119] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.132] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.132] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.132] GetLastError () returned 0x578 [0147.132] CanUserWritePwrScheme () returned 0 [0147.133] GetSystemMetrics (nIndex=46) returned 2 [0147.133] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.133] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.133] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.133] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.144] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.144] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.144] GetLastError () returned 0x578 [0147.144] CanUserWritePwrScheme () returned 0 [0147.145] GetSystemMetrics (nIndex=46) returned 2 [0147.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.145] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.145] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.145] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.156] GetLastError () returned 0x578 [0147.156] CanUserWritePwrScheme () returned 0 [0147.157] GetSystemMetrics (nIndex=46) returned 2 [0147.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.157] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.157] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.157] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.167] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.167] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.167] GetLastError () returned 0x578 [0147.168] CanUserWritePwrScheme () returned 0 [0147.168] GetSystemMetrics (nIndex=46) returned 2 [0147.168] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.168] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.168] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.168] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.177] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.177] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.177] GetLastError () returned 0x578 [0147.177] CanUserWritePwrScheme () returned 0 [0147.178] GetSystemMetrics (nIndex=46) returned 2 [0147.178] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.178] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.178] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.178] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.183] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.183] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.183] GetLastError () returned 0x578 [0147.183] CanUserWritePwrScheme () returned 0 [0147.184] GetSystemMetrics (nIndex=46) returned 2 [0147.184] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.184] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.184] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.184] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.192] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.192] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.192] GetLastError () returned 0x578 [0147.192] CanUserWritePwrScheme () returned 0 [0147.193] GetSystemMetrics (nIndex=46) returned 2 [0147.193] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.193] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.193] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.193] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.198] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.198] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.198] GetLastError () returned 0x578 [0147.198] CanUserWritePwrScheme () returned 0 [0147.199] GetSystemMetrics (nIndex=46) returned 2 [0147.199] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.199] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.199] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.199] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.203] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.203] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.203] GetLastError () returned 0x578 [0147.203] CanUserWritePwrScheme () returned 0 [0147.204] GetSystemMetrics (nIndex=46) returned 2 [0147.204] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.204] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.204] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.204] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.210] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.211] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.211] GetLastError () returned 0x578 [0147.211] CanUserWritePwrScheme () returned 0 [0147.211] GetSystemMetrics (nIndex=46) returned 2 [0147.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.212] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.212] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.212] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.222] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.222] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.222] GetLastError () returned 0x578 [0147.222] CanUserWritePwrScheme () returned 0 [0147.223] GetSystemMetrics (nIndex=46) returned 2 [0147.223] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.223] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.223] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.223] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.233] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.234] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.234] GetLastError () returned 0x578 [0147.234] CanUserWritePwrScheme () returned 0 [0147.234] GetSystemMetrics (nIndex=46) returned 2 [0147.234] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.234] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.235] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.235] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.245] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.245] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.245] GetLastError () returned 0x578 [0147.245] CanUserWritePwrScheme () returned 0 [0147.246] GetSystemMetrics (nIndex=46) returned 2 [0147.246] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.246] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.246] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.246] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.259] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.259] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.259] GetLastError () returned 0x578 [0147.259] CanUserWritePwrScheme () returned 0 [0147.260] GetSystemMetrics (nIndex=46) returned 2 [0147.260] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.260] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.260] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.260] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.271] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.271] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.271] GetLastError () returned 0x578 [0147.271] CanUserWritePwrScheme () returned 0 [0147.272] GetSystemMetrics (nIndex=46) returned 2 [0147.272] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.272] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.272] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.272] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.282] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.282] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.282] GetLastError () returned 0x578 [0147.282] CanUserWritePwrScheme () returned 0 [0147.283] GetSystemMetrics (nIndex=46) returned 2 [0147.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.283] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.283] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.283] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.294] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.294] GetLastError () returned 0x578 [0147.294] CanUserWritePwrScheme () returned 0 [0147.295] GetSystemMetrics (nIndex=46) returned 2 [0147.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.305] GetLastError () returned 0x578 [0147.305] CanUserWritePwrScheme () returned 0 [0147.306] GetSystemMetrics (nIndex=46) returned 2 [0147.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.306] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.306] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.306] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.317] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.317] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.317] GetLastError () returned 0x578 [0147.317] CanUserWritePwrScheme () returned 0 [0147.321] GetSystemMetrics (nIndex=46) returned 2 [0147.321] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.321] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.321] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.321] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.332] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.332] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.332] GetLastError () returned 0x578 [0147.332] CanUserWritePwrScheme () returned 0 [0147.332] GetSystemMetrics (nIndex=46) returned 2 [0147.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.333] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.333] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.333] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.343] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.343] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.343] GetLastError () returned 0x578 [0147.343] CanUserWritePwrScheme () returned 0 [0147.344] GetSystemMetrics (nIndex=46) returned 2 [0147.344] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.344] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.344] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.344] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.355] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.355] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.355] GetLastError () returned 0x578 [0147.355] CanUserWritePwrScheme () returned 0 [0147.356] GetSystemMetrics (nIndex=46) returned 2 [0147.356] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.356] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.356] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.356] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.367] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.367] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.367] GetLastError () returned 0x578 [0147.367] CanUserWritePwrScheme () returned 0 [0147.368] GetSystemMetrics (nIndex=46) returned 2 [0147.368] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.368] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.368] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.368] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.379] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.379] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.379] GetLastError () returned 0x578 [0147.379] CanUserWritePwrScheme () returned 0 [0147.380] GetSystemMetrics (nIndex=46) returned 2 [0147.380] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.380] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.380] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.380] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.395] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.395] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.395] GetLastError () returned 0x578 [0147.395] CanUserWritePwrScheme () returned 0 [0147.403] GetSystemMetrics (nIndex=46) returned 2 [0147.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.403] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.403] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.403] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.414] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.414] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.414] GetLastError () returned 0x578 [0147.414] CanUserWritePwrScheme () returned 0 [0147.415] GetSystemMetrics (nIndex=46) returned 2 [0147.415] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.415] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.415] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.415] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.425] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.425] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.426] GetLastError () returned 0x578 [0147.426] CanUserWritePwrScheme () returned 0 [0147.426] GetSystemMetrics (nIndex=46) returned 2 [0147.426] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.426] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.427] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.427] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.432] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.432] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.432] GetLastError () returned 0x578 [0147.432] CanUserWritePwrScheme () returned 0 [0147.433] GetSystemMetrics (nIndex=46) returned 2 [0147.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.433] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.433] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.433] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.438] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.438] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.438] GetLastError () returned 0x578 [0147.438] CanUserWritePwrScheme () returned 0 [0147.439] GetSystemMetrics (nIndex=46) returned 2 [0147.439] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.439] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.439] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.439] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.444] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.444] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.444] GetLastError () returned 0x578 [0147.444] CanUserWritePwrScheme () returned 0 [0147.445] GetSystemMetrics (nIndex=46) returned 2 [0147.445] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.445] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.445] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.445] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.453] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.453] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.453] GetLastError () returned 0x578 [0147.453] CanUserWritePwrScheme () returned 0 [0147.454] GetSystemMetrics (nIndex=46) returned 2 [0147.454] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.454] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.454] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.454] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.458] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.458] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.459] GetLastError () returned 0x578 [0147.459] CanUserWritePwrScheme () returned 0 [0147.459] GetSystemMetrics (nIndex=46) returned 2 [0147.459] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.460] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.460] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.460] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.464] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.464] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.464] GetLastError () returned 0x578 [0147.464] CanUserWritePwrScheme () returned 0 [0147.465] GetSystemMetrics (nIndex=46) returned 2 [0147.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.465] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.465] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.470] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.470] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.470] GetLastError () returned 0x578 [0147.470] CanUserWritePwrScheme () returned 0 [0147.471] GetSystemMetrics (nIndex=46) returned 2 [0147.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.476] GetLastError () returned 0x578 [0147.476] CanUserWritePwrScheme () returned 0 [0147.477] GetSystemMetrics (nIndex=46) returned 2 [0147.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.482] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.482] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.482] GetLastError () returned 0x578 [0147.482] CanUserWritePwrScheme () returned 0 [0147.483] GetSystemMetrics (nIndex=46) returned 2 [0147.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.483] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.483] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.483] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.487] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.487] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.487] GetLastError () returned 0x578 [0147.487] CanUserWritePwrScheme () returned 0 [0147.488] GetSystemMetrics (nIndex=46) returned 2 [0147.488] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.488] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.488] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.488] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.494] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.494] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.494] GetLastError () returned 0x578 [0147.494] CanUserWritePwrScheme () returned 0 [0147.495] GetSystemMetrics (nIndex=46) returned 2 [0147.495] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.495] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.495] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.495] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.506] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.506] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.506] GetLastError () returned 0x578 [0147.506] CanUserWritePwrScheme () returned 0 [0147.507] GetSystemMetrics (nIndex=46) returned 2 [0147.507] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.507] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.507] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.507] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.523] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.524] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.524] GetLastError () returned 0x578 [0147.524] CanUserWritePwrScheme () returned 0 [0147.524] GetSystemMetrics (nIndex=46) returned 2 [0147.525] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.525] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.525] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.525] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.535] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.535] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.535] GetLastError () returned 0x578 [0147.535] CanUserWritePwrScheme () returned 0 [0147.536] GetSystemMetrics (nIndex=46) returned 2 [0147.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.547] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.547] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.547] GetLastError () returned 0x578 [0147.547] CanUserWritePwrScheme () returned 0 [0147.548] GetSystemMetrics (nIndex=46) returned 2 [0147.548] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.548] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.548] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.548] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.559] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.559] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.559] GetLastError () returned 0x578 [0147.559] CanUserWritePwrScheme () returned 0 [0147.560] GetSystemMetrics (nIndex=46) returned 2 [0147.560] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.560] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.560] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.560] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.571] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.571] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.571] GetLastError () returned 0x578 [0147.571] CanUserWritePwrScheme () returned 0 [0147.572] GetSystemMetrics (nIndex=46) returned 2 [0147.572] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.572] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.572] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.572] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.585] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.585] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.586] GetLastError () returned 0x578 [0147.586] CanUserWritePwrScheme () returned 0 [0147.586] GetSystemMetrics (nIndex=46) returned 2 [0147.586] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.586] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.587] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.587] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.597] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.598] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.598] GetLastError () returned 0x578 [0147.598] CanUserWritePwrScheme () returned 0 [0147.598] GetSystemMetrics (nIndex=46) returned 2 [0147.598] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.599] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.599] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.599] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.609] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.609] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.609] GetLastError () returned 0x578 [0147.609] CanUserWritePwrScheme () returned 0 [0147.610] GetSystemMetrics (nIndex=46) returned 2 [0147.610] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.610] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.610] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.610] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.621] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.621] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.621] GetLastError () returned 0x578 [0147.621] CanUserWritePwrScheme () returned 0 [0147.622] GetSystemMetrics (nIndex=46) returned 2 [0147.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.622] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.622] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.622] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.633] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.633] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.633] GetLastError () returned 0x578 [0147.633] CanUserWritePwrScheme () returned 0 [0147.634] GetSystemMetrics (nIndex=46) returned 2 [0147.634] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.634] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.634] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.634] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.649] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.649] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.649] GetLastError () returned 0x578 [0147.649] CanUserWritePwrScheme () returned 0 [0147.650] GetSystemMetrics (nIndex=46) returned 2 [0147.650] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.650] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.650] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.650] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.661] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.661] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.661] GetLastError () returned 0x578 [0147.661] CanUserWritePwrScheme () returned 0 [0147.662] GetSystemMetrics (nIndex=46) returned 2 [0147.662] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.662] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.662] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.662] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.674] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.674] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.674] GetLastError () returned 0x578 [0147.674] CanUserWritePwrScheme () returned 0 [0147.675] GetSystemMetrics (nIndex=46) returned 2 [0147.675] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.675] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.675] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.675] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.685] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.685] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.685] GetLastError () returned 0x578 [0147.685] CanUserWritePwrScheme () returned 0 [0147.686] GetSystemMetrics (nIndex=46) returned 2 [0147.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.686] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.686] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.686] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.697] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.697] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.697] GetLastError () returned 0x578 [0147.697] CanUserWritePwrScheme () returned 0 [0147.698] GetSystemMetrics (nIndex=46) returned 2 [0147.698] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.698] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.698] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.698] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.712] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.712] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.712] GetLastError () returned 0x578 [0147.712] CanUserWritePwrScheme () returned 0 [0147.713] GetSystemMetrics (nIndex=46) returned 2 [0147.713] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.713] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.713] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.713] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.724] GetLastError () returned 0x578 [0147.724] CanUserWritePwrScheme () returned 0 [0147.725] GetSystemMetrics (nIndex=46) returned 2 [0147.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.725] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.725] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.725] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.735] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.735] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.735] GetLastError () returned 0x578 [0147.736] CanUserWritePwrScheme () returned 0 [0147.736] GetSystemMetrics (nIndex=46) returned 2 [0147.736] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.737] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.737] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.737] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.747] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.747] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.747] GetLastError () returned 0x578 [0147.747] CanUserWritePwrScheme () returned 0 [0147.748] GetSystemMetrics (nIndex=46) returned 2 [0147.748] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.748] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.748] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.748] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.759] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.759] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.759] GetLastError () returned 0x578 [0147.759] CanUserWritePwrScheme () returned 0 [0147.760] GetSystemMetrics (nIndex=46) returned 2 [0147.760] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.760] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.760] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.760] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.771] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.771] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.771] GetLastError () returned 0x578 [0147.771] CanUserWritePwrScheme () returned 0 [0147.772] GetSystemMetrics (nIndex=46) returned 2 [0147.772] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.772] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.772] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.772] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.786] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.786] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.786] GetLastError () returned 0x578 [0147.786] CanUserWritePwrScheme () returned 0 [0147.787] GetSystemMetrics (nIndex=46) returned 2 [0147.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.798] GetLastError () returned 0x578 [0147.798] CanUserWritePwrScheme () returned 0 [0147.799] GetSystemMetrics (nIndex=46) returned 2 [0147.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.799] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.799] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.799] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.810] GetLastError () returned 0x578 [0147.810] CanUserWritePwrScheme () returned 0 [0147.811] GetSystemMetrics (nIndex=46) returned 2 [0147.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.822] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.822] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.822] GetLastError () returned 0x578 [0147.822] CanUserWritePwrScheme () returned 0 [0147.823] GetSystemMetrics (nIndex=46) returned 2 [0147.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.833] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.833] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.833] GetLastError () returned 0x578 [0147.833] CanUserWritePwrScheme () returned 0 [0147.834] GetSystemMetrics (nIndex=46) returned 2 [0147.834] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.834] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.834] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.834] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.849] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.849] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.849] GetLastError () returned 0x578 [0147.849] CanUserWritePwrScheme () returned 0 [0147.850] GetSystemMetrics (nIndex=46) returned 2 [0147.850] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.850] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.850] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.850] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.860] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.860] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.860] GetLastError () returned 0x578 [0147.861] CanUserWritePwrScheme () returned 0 [0147.861] GetSystemMetrics (nIndex=46) returned 2 [0147.861] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.862] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.872] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.872] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.872] GetLastError () returned 0x578 [0147.872] CanUserWritePwrScheme () returned 0 [0147.873] GetSystemMetrics (nIndex=46) returned 2 [0147.873] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.873] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.873] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.873] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.884] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.884] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.884] GetLastError () returned 0x578 [0147.884] CanUserWritePwrScheme () returned 0 [0147.885] GetSystemMetrics (nIndex=46) returned 2 [0147.885] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.885] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.885] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.885] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.900] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.900] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.900] GetLastError () returned 0x578 [0147.900] CanUserWritePwrScheme () returned 0 [0147.901] GetSystemMetrics (nIndex=46) returned 2 [0147.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.901] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.901] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.901] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.915] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.915] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.915] GetLastError () returned 0x578 [0147.915] CanUserWritePwrScheme () returned 0 [0147.916] GetSystemMetrics (nIndex=46) returned 2 [0147.916] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.916] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.916] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.916] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.927] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.927] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.927] GetLastError () returned 0x578 [0147.927] CanUserWritePwrScheme () returned 0 [0147.928] GetSystemMetrics (nIndex=46) returned 2 [0147.928] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.928] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.928] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.928] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.938] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.938] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.938] GetLastError () returned 0x578 [0147.938] CanUserWritePwrScheme () returned 0 [0147.940] GetSystemMetrics (nIndex=46) returned 2 [0147.940] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.940] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.940] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.940] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.950] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.951] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.951] GetLastError () returned 0x578 [0147.951] CanUserWritePwrScheme () returned 0 [0147.951] GetSystemMetrics (nIndex=46) returned 2 [0147.952] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.952] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.952] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.952] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.962] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.963] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.963] GetLastError () returned 0x578 [0147.963] CanUserWritePwrScheme () returned 0 [0147.963] GetSystemMetrics (nIndex=46) returned 2 [0147.964] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.964] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.964] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.964] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.977] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.977] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.977] GetLastError () returned 0x578 [0147.977] CanUserWritePwrScheme () returned 0 [0147.978] GetSystemMetrics (nIndex=46) returned 2 [0147.978] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.978] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.978] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.978] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0147.989] GetWindowTextLengthA (hWnd=0x0) returned 0 [0147.989] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0147.989] GetLastError () returned 0x578 [0147.989] CanUserWritePwrScheme () returned 0 [0147.990] GetSystemMetrics (nIndex=46) returned 2 [0147.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0147.990] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0147.990] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0147.990] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.001] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.001] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.001] GetLastError () returned 0x578 [0148.001] CanUserWritePwrScheme () returned 0 [0148.002] GetSystemMetrics (nIndex=46) returned 2 [0148.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.002] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.002] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.002] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.013] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.013] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.013] GetLastError () returned 0x578 [0148.013] CanUserWritePwrScheme () returned 0 [0148.014] GetSystemMetrics (nIndex=46) returned 2 [0148.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.025] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.025] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.025] GetLastError () returned 0x578 [0148.025] CanUserWritePwrScheme () returned 0 [0148.026] GetSystemMetrics (nIndex=46) returned 2 [0148.026] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.026] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.026] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.026] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.040] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.040] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.040] GetLastError () returned 0x578 [0148.040] CanUserWritePwrScheme () returned 0 [0148.041] GetSystemMetrics (nIndex=46) returned 2 [0148.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.052] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.052] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.052] GetLastError () returned 0x578 [0148.052] CanUserWritePwrScheme () returned 0 [0148.053] GetSystemMetrics (nIndex=46) returned 2 [0148.053] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.053] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.053] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.053] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.063] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.063] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.063] GetLastError () returned 0x578 [0148.063] CanUserWritePwrScheme () returned 0 [0148.064] GetSystemMetrics (nIndex=46) returned 2 [0148.064] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.064] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.064] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.065] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.075] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.075] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.075] GetLastError () returned 0x578 [0148.075] CanUserWritePwrScheme () returned 0 [0148.076] GetSystemMetrics (nIndex=46) returned 2 [0148.076] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.076] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.076] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.076] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.087] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.087] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.087] GetLastError () returned 0x578 [0148.087] CanUserWritePwrScheme () returned 0 [0148.088] GetSystemMetrics (nIndex=46) returned 2 [0148.088] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.088] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.088] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.088] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.099] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.099] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.099] GetLastError () returned 0x578 [0148.099] CanUserWritePwrScheme () returned 0 [0148.100] GetSystemMetrics (nIndex=46) returned 2 [0148.100] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.100] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.100] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.100] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.114] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.114] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.114] GetLastError () returned 0x578 [0148.114] CanUserWritePwrScheme () returned 0 [0148.115] GetSystemMetrics (nIndex=46) returned 2 [0148.115] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.115] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.115] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.115] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.126] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.126] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.126] GetLastError () returned 0x578 [0148.126] CanUserWritePwrScheme () returned 0 [0148.127] GetSystemMetrics (nIndex=46) returned 2 [0148.127] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.127] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.127] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.127] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.139] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.139] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.139] GetLastError () returned 0x578 [0148.139] CanUserWritePwrScheme () returned 0 [0148.140] GetSystemMetrics (nIndex=46) returned 2 [0148.140] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.140] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.140] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.140] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.151] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.151] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.151] GetLastError () returned 0x578 [0148.151] CanUserWritePwrScheme () returned 0 [0148.152] GetSystemMetrics (nIndex=46) returned 2 [0148.152] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.152] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.152] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.152] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.163] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.163] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.163] GetLastError () returned 0x578 [0148.163] CanUserWritePwrScheme () returned 0 [0148.164] GetSystemMetrics (nIndex=46) returned 2 [0148.164] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.164] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.164] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.164] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.176] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.176] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.176] GetLastError () returned 0x578 [0148.176] CanUserWritePwrScheme () returned 0 [0148.177] GetSystemMetrics (nIndex=46) returned 2 [0148.177] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.177] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.177] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.177] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.182] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.182] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.182] GetLastError () returned 0x578 [0148.182] CanUserWritePwrScheme () returned 0 [0148.183] GetSystemMetrics (nIndex=46) returned 2 [0148.183] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.183] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.183] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.183] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.194] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.194] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.194] GetLastError () returned 0x578 [0148.194] CanUserWritePwrScheme () returned 0 [0148.195] GetSystemMetrics (nIndex=46) returned 2 [0148.195] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.195] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.195] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.195] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.206] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.206] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.206] GetLastError () returned 0x578 [0148.206] CanUserWritePwrScheme () returned 0 [0148.207] GetSystemMetrics (nIndex=46) returned 2 [0148.207] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.207] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.207] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.207] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.218] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.218] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.218] GetLastError () returned 0x578 [0148.218] CanUserWritePwrScheme () returned 0 [0148.219] GetSystemMetrics (nIndex=46) returned 2 [0148.219] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.219] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.219] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.219] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.229] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.229] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.229] GetLastError () returned 0x578 [0148.229] CanUserWritePwrScheme () returned 0 [0148.230] GetSystemMetrics (nIndex=46) returned 2 [0148.230] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.230] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.230] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.230] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.244] GetLastError () returned 0x578 [0148.244] CanUserWritePwrScheme () returned 0 [0148.245] GetSystemMetrics (nIndex=46) returned 2 [0148.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.256] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.256] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.256] GetLastError () returned 0x578 [0148.256] CanUserWritePwrScheme () returned 0 [0148.257] GetSystemMetrics (nIndex=46) returned 2 [0148.257] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.257] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.257] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.268] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.268] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.268] GetLastError () returned 0x578 [0148.268] CanUserWritePwrScheme () returned 0 [0148.269] GetSystemMetrics (nIndex=46) returned 2 [0148.269] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.269] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.269] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.269] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.279] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.279] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.280] GetLastError () returned 0x578 [0148.280] CanUserWritePwrScheme () returned 0 [0148.280] GetSystemMetrics (nIndex=46) returned 2 [0148.280] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.280] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.280] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.281] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.291] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.291] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.291] GetLastError () returned 0x578 [0148.291] CanUserWritePwrScheme () returned 0 [0148.292] GetSystemMetrics (nIndex=46) returned 2 [0148.292] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.292] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.292] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.292] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.306] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.306] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.306] GetLastError () returned 0x578 [0148.306] CanUserWritePwrScheme () returned 0 [0148.307] GetSystemMetrics (nIndex=46) returned 2 [0148.307] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.307] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.307] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.307] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.318] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.318] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.318] GetLastError () returned 0x578 [0148.318] CanUserWritePwrScheme () returned 0 [0148.319] GetSystemMetrics (nIndex=46) returned 2 [0148.319] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.319] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.319] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.319] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.329] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.329] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.329] GetLastError () returned 0x578 [0148.329] CanUserWritePwrScheme () returned 0 [0148.330] GetSystemMetrics (nIndex=46) returned 2 [0148.330] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.330] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.330] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.330] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.341] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.341] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.341] GetLastError () returned 0x578 [0148.341] CanUserWritePwrScheme () returned 0 [0148.342] GetSystemMetrics (nIndex=46) returned 2 [0148.342] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.342] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.342] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.342] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.353] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.353] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.353] GetLastError () returned 0x578 [0148.353] CanUserWritePwrScheme () returned 0 [0148.354] GetSystemMetrics (nIndex=46) returned 2 [0148.354] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.354] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.354] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.354] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.368] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.368] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.368] GetLastError () returned 0x578 [0148.368] CanUserWritePwrScheme () returned 0 [0148.369] GetSystemMetrics (nIndex=46) returned 2 [0148.369] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.369] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.369] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.369] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.380] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.380] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.380] GetLastError () returned 0x578 [0148.380] CanUserWritePwrScheme () returned 0 [0148.381] GetSystemMetrics (nIndex=46) returned 2 [0148.381] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.381] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.381] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.381] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.392] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.392] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.392] GetLastError () returned 0x578 [0148.392] CanUserWritePwrScheme () returned 0 [0148.393] GetSystemMetrics (nIndex=46) returned 2 [0148.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.393] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.393] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.393] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.411] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.411] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.411] GetLastError () returned 0x578 [0148.411] CanUserWritePwrScheme () returned 0 [0148.412] GetSystemMetrics (nIndex=46) returned 2 [0148.412] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.412] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.412] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.412] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.465] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.465] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.465] GetLastError () returned 0x578 [0148.466] CanUserWritePwrScheme () returned 0 [0148.466] GetSystemMetrics (nIndex=46) returned 2 [0148.466] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.466] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.466] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.467] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.474] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.474] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.474] GetLastError () returned 0x578 [0148.474] CanUserWritePwrScheme () returned 0 [0148.475] GetSystemMetrics (nIndex=46) returned 2 [0148.475] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.475] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.475] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.475] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.486] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.486] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.486] GetLastError () returned 0x578 [0148.486] CanUserWritePwrScheme () returned 0 [0148.487] GetSystemMetrics (nIndex=46) returned 2 [0148.487] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.487] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.487] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.487] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.501] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.501] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.501] GetLastError () returned 0x578 [0148.501] CanUserWritePwrScheme () returned 0 [0148.502] GetSystemMetrics (nIndex=46) returned 2 [0148.502] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.502] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.502] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.502] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.513] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.513] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.513] GetLastError () returned 0x578 [0148.513] CanUserWritePwrScheme () returned 0 [0148.514] GetSystemMetrics (nIndex=46) returned 2 [0148.514] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.514] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.514] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.514] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.525] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.525] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.525] GetLastError () returned 0x578 [0148.525] CanUserWritePwrScheme () returned 0 [0148.526] GetSystemMetrics (nIndex=46) returned 2 [0148.526] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.526] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.526] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.526] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.536] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.536] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.536] GetLastError () returned 0x578 [0148.536] CanUserWritePwrScheme () returned 0 [0148.537] GetSystemMetrics (nIndex=46) returned 2 [0148.537] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.537] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.537] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.537] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.548] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.548] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.548] GetLastError () returned 0x578 [0148.548] CanUserWritePwrScheme () returned 0 [0148.549] GetSystemMetrics (nIndex=46) returned 2 [0148.549] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.549] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.549] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.549] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.563] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.563] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.563] GetLastError () returned 0x578 [0148.563] CanUserWritePwrScheme () returned 0 [0148.564] GetSystemMetrics (nIndex=46) returned 2 [0148.564] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.564] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.564] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.564] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.575] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.575] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.575] GetLastError () returned 0x578 [0148.575] CanUserWritePwrScheme () returned 0 [0148.576] GetSystemMetrics (nIndex=46) returned 2 [0148.576] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.576] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.576] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.576] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.587] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.587] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.587] GetLastError () returned 0x578 [0148.587] CanUserWritePwrScheme () returned 0 [0148.588] GetSystemMetrics (nIndex=46) returned 2 [0148.588] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.588] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.588] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.588] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.597] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.597] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.597] GetLastError () returned 0x578 [0148.597] CanUserWritePwrScheme () returned 0 [0148.598] GetSystemMetrics (nIndex=46) returned 2 [0148.598] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.598] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.598] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.598] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.603] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.603] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.603] GetLastError () returned 0x578 [0148.603] CanUserWritePwrScheme () returned 0 [0148.604] GetSystemMetrics (nIndex=46) returned 2 [0148.604] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.604] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.604] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.604] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.609] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.609] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.609] GetLastError () returned 0x578 [0148.609] CanUserWritePwrScheme () returned 0 [0148.610] GetSystemMetrics (nIndex=46) returned 2 [0148.610] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.610] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.610] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.610] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.615] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.615] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.615] GetLastError () returned 0x578 [0148.615] CanUserWritePwrScheme () returned 0 [0148.616] GetSystemMetrics (nIndex=46) returned 2 [0148.616] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.616] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.616] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.616] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.620] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.620] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.621] GetLastError () returned 0x578 [0148.621] CanUserWritePwrScheme () returned 0 [0148.624] GetSystemMetrics (nIndex=46) returned 2 [0148.624] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.624] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.624] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.624] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.629] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.629] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.629] GetLastError () returned 0x578 [0148.629] CanUserWritePwrScheme () returned 0 [0148.630] GetSystemMetrics (nIndex=46) returned 2 [0148.630] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.630] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.630] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.630] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.637] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.637] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.637] GetLastError () returned 0x578 [0148.637] CanUserWritePwrScheme () returned 0 [0148.638] GetSystemMetrics (nIndex=46) returned 2 [0148.638] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.638] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.638] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.638] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.644] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.644] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.644] GetLastError () returned 0x578 [0148.644] CanUserWritePwrScheme () returned 0 [0148.645] GetSystemMetrics (nIndex=46) returned 2 [0148.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.645] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.645] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.645] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.656] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.656] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.656] GetLastError () returned 0x578 [0148.656] CanUserWritePwrScheme () returned 0 [0148.657] GetSystemMetrics (nIndex=46) returned 2 [0148.657] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.657] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.657] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.657] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.668] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.668] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.668] GetLastError () returned 0x578 [0148.668] CanUserWritePwrScheme () returned 0 [0148.669] GetSystemMetrics (nIndex=46) returned 2 [0148.669] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.669] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.669] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.669] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.680] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.680] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.680] GetLastError () returned 0x578 [0148.680] CanUserWritePwrScheme () returned 0 [0148.681] GetSystemMetrics (nIndex=46) returned 2 [0148.681] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.681] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.681] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.681] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.694] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.694] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.694] GetLastError () returned 0x578 [0148.694] CanUserWritePwrScheme () returned 0 [0148.695] GetSystemMetrics (nIndex=46) returned 2 [0148.695] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.695] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.695] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.695] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.706] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.706] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.706] GetLastError () returned 0x578 [0148.706] CanUserWritePwrScheme () returned 0 [0148.707] GetSystemMetrics (nIndex=46) returned 2 [0148.707] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.707] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.707] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.707] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.717] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.718] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.718] GetLastError () returned 0x578 [0148.718] CanUserWritePwrScheme () returned 0 [0148.718] GetSystemMetrics (nIndex=46) returned 2 [0148.719] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.719] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.719] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.719] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.729] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.729] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.729] GetLastError () returned 0x578 [0148.729] CanUserWritePwrScheme () returned 0 [0148.730] GetSystemMetrics (nIndex=46) returned 2 [0148.730] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.730] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.730] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.730] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.741] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.741] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.741] GetLastError () returned 0x578 [0148.741] CanUserWritePwrScheme () returned 0 [0148.742] GetSystemMetrics (nIndex=46) returned 2 [0148.742] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.742] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.742] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.742] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.757] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.757] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.757] GetLastError () returned 0x578 [0148.757] CanUserWritePwrScheme () returned 0 [0148.758] GetSystemMetrics (nIndex=46) returned 2 [0148.758] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.758] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.758] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.758] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.769] GetLastError () returned 0x578 [0148.769] CanUserWritePwrScheme () returned 0 [0148.770] GetSystemMetrics (nIndex=46) returned 2 [0148.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.781] GetLastError () returned 0x578 [0148.781] CanUserWritePwrScheme () returned 0 [0148.782] GetSystemMetrics (nIndex=46) returned 2 [0148.782] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.782] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.782] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.782] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.793] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.793] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.793] GetLastError () returned 0x578 [0148.793] CanUserWritePwrScheme () returned 0 [0148.794] GetSystemMetrics (nIndex=46) returned 2 [0148.794] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.794] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.794] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.794] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.805] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.805] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.805] GetLastError () returned 0x578 [0148.805] CanUserWritePwrScheme () returned 0 [0148.806] GetSystemMetrics (nIndex=46) returned 2 [0148.806] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.806] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.806] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.806] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.819] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.819] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.819] GetLastError () returned 0x578 [0148.819] CanUserWritePwrScheme () returned 0 [0148.820] GetSystemMetrics (nIndex=46) returned 2 [0148.820] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.820] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.820] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.820] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.831] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.831] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.831] GetLastError () returned 0x578 [0148.831] CanUserWritePwrScheme () returned 0 [0148.832] GetSystemMetrics (nIndex=46) returned 2 [0148.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.832] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.832] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.832] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.842] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.843] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.843] GetLastError () returned 0x578 [0148.843] CanUserWritePwrScheme () returned 0 [0148.843] GetSystemMetrics (nIndex=46) returned 2 [0148.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.844] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.844] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.854] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.854] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.854] GetLastError () returned 0x578 [0148.854] CanUserWritePwrScheme () returned 0 [0148.855] GetSystemMetrics (nIndex=46) returned 2 [0148.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.855] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.855] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.855] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.866] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.866] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.866] GetLastError () returned 0x578 [0148.866] CanUserWritePwrScheme () returned 0 [0148.867] GetSystemMetrics (nIndex=46) returned 2 [0148.867] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.867] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.867] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.867] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.878] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.878] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.878] GetLastError () returned 0x578 [0148.878] CanUserWritePwrScheme () returned 0 [0148.879] GetSystemMetrics (nIndex=46) returned 2 [0148.879] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.879] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.879] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.879] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.893] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.893] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.893] GetLastError () returned 0x578 [0148.893] CanUserWritePwrScheme () returned 0 [0148.894] GetSystemMetrics (nIndex=46) returned 2 [0148.894] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.894] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.894] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.894] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.905] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.905] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.905] GetLastError () returned 0x578 [0148.905] CanUserWritePwrScheme () returned 0 [0148.906] GetSystemMetrics (nIndex=46) returned 2 [0148.906] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.906] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.906] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.906] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.917] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.917] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.917] GetLastError () returned 0x578 [0148.917] CanUserWritePwrScheme () returned 0 [0148.918] GetSystemMetrics (nIndex=46) returned 2 [0148.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.918] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.918] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.918] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.929] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.929] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.929] GetLastError () returned 0x578 [0148.929] CanUserWritePwrScheme () returned 0 [0148.929] GetSystemMetrics (nIndex=46) returned 2 [0148.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.930] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.941] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.941] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.941] GetLastError () returned 0x578 [0148.941] CanUserWritePwrScheme () returned 0 [0148.941] GetSystemMetrics (nIndex=46) returned 2 [0148.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.955] GetLastError () returned 0x578 [0148.955] CanUserWritePwrScheme () returned 0 [0148.956] GetSystemMetrics (nIndex=46) returned 2 [0148.956] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.956] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.956] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.956] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.967] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.967] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.967] GetLastError () returned 0x578 [0148.967] CanUserWritePwrScheme () returned 0 [0148.968] GetSystemMetrics (nIndex=46) returned 2 [0148.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.979] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.979] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.979] GetLastError () returned 0x578 [0148.979] CanUserWritePwrScheme () returned 0 [0148.980] GetSystemMetrics (nIndex=46) returned 2 [0148.980] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.980] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.980] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.980] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0148.991] GetWindowTextLengthA (hWnd=0x0) returned 0 [0148.991] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0148.991] GetLastError () returned 0x578 [0148.991] CanUserWritePwrScheme () returned 0 [0148.992] GetSystemMetrics (nIndex=46) returned 2 [0148.992] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0148.992] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0148.992] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0148.992] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.003] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.003] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.003] GetLastError () returned 0x578 [0149.003] CanUserWritePwrScheme () returned 0 [0149.004] GetSystemMetrics (nIndex=46) returned 2 [0149.004] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.004] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.004] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.004] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.017] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.017] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.017] GetLastError () returned 0x578 [0149.017] CanUserWritePwrScheme () returned 0 [0149.018] GetSystemMetrics (nIndex=46) returned 2 [0149.018] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.018] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.018] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.018] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.029] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.029] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.029] GetLastError () returned 0x578 [0149.029] CanUserWritePwrScheme () returned 0 [0149.030] GetSystemMetrics (nIndex=46) returned 2 [0149.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.030] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.030] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.030] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.041] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.041] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.041] GetLastError () returned 0x578 [0149.041] CanUserWritePwrScheme () returned 0 [0149.042] GetSystemMetrics (nIndex=46) returned 2 [0149.042] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.042] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.042] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.042] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.053] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.053] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.053] GetLastError () returned 0x578 [0149.053] CanUserWritePwrScheme () returned 0 [0149.054] GetSystemMetrics (nIndex=46) returned 2 [0149.054] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.054] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.054] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.054] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.065] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.065] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.065] GetLastError () returned 0x578 [0149.065] CanUserWritePwrScheme () returned 0 [0149.066] GetSystemMetrics (nIndex=46) returned 2 [0149.066] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.066] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.066] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.066] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.077] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.077] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.077] GetLastError () returned 0x578 [0149.077] CanUserWritePwrScheme () returned 0 [0149.078] GetSystemMetrics (nIndex=46) returned 2 [0149.078] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.078] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.078] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.078] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.091] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.091] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.091] GetLastError () returned 0x578 [0149.091] CanUserWritePwrScheme () returned 0 [0149.092] GetSystemMetrics (nIndex=46) returned 2 [0149.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.092] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.092] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.092] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.103] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.103] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.103] GetLastError () returned 0x578 [0149.103] CanUserWritePwrScheme () returned 0 [0149.104] GetSystemMetrics (nIndex=46) returned 2 [0149.104] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.104] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.104] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.104] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.115] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.115] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.115] GetLastError () returned 0x578 [0149.115] CanUserWritePwrScheme () returned 0 [0149.116] GetSystemMetrics (nIndex=46) returned 2 [0149.116] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.116] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.116] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.116] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.127] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.127] GetLastError () returned 0x578 [0149.127] CanUserWritePwrScheme () returned 0 [0149.128] GetSystemMetrics (nIndex=46) returned 2 [0149.128] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.128] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.128] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.128] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.139] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.139] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.139] GetLastError () returned 0x578 [0149.139] CanUserWritePwrScheme () returned 0 [0149.140] GetSystemMetrics (nIndex=46) returned 2 [0149.140] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.140] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.140] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.140] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.154] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.154] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.154] GetLastError () returned 0x578 [0149.154] CanUserWritePwrScheme () returned 0 [0149.155] GetSystemMetrics (nIndex=46) returned 2 [0149.155] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.155] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.155] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.155] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.170] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.170] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.170] GetLastError () returned 0x578 [0149.170] CanUserWritePwrScheme () returned 0 [0149.171] GetSystemMetrics (nIndex=46) returned 2 [0149.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.171] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.171] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.171] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.182] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.182] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.182] GetLastError () returned 0x578 [0149.182] CanUserWritePwrScheme () returned 0 [0149.183] GetSystemMetrics (nIndex=46) returned 2 [0149.183] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.183] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.183] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.183] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.194] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.194] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.194] GetLastError () returned 0x578 [0149.194] CanUserWritePwrScheme () returned 0 [0149.195] GetSystemMetrics (nIndex=46) returned 2 [0149.195] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.195] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.195] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.195] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.206] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.206] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.206] GetLastError () returned 0x578 [0149.206] CanUserWritePwrScheme () returned 0 [0149.207] GetSystemMetrics (nIndex=46) returned 2 [0149.207] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.207] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.207] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.207] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.220] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.220] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.220] GetLastError () returned 0x578 [0149.220] CanUserWritePwrScheme () returned 0 [0149.221] GetSystemMetrics (nIndex=46) returned 2 [0149.221] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.221] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.221] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.221] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.232] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.232] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.232] GetLastError () returned 0x578 [0149.232] CanUserWritePwrScheme () returned 0 [0149.233] GetSystemMetrics (nIndex=46) returned 2 [0149.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.233] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.233] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.233] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.244] GetLastError () returned 0x578 [0149.244] CanUserWritePwrScheme () returned 0 [0149.245] GetSystemMetrics (nIndex=46) returned 2 [0149.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.256] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.256] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.256] GetLastError () returned 0x578 [0149.256] CanUserWritePwrScheme () returned 0 [0149.257] GetSystemMetrics (nIndex=46) returned 2 [0149.257] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.257] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.257] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.268] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.268] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.268] GetLastError () returned 0x578 [0149.268] CanUserWritePwrScheme () returned 0 [0149.269] GetSystemMetrics (nIndex=46) returned 2 [0149.269] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.269] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.269] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.269] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.283] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.283] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.283] GetLastError () returned 0x578 [0149.283] CanUserWritePwrScheme () returned 0 [0149.284] GetSystemMetrics (nIndex=46) returned 2 [0149.284] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.284] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.284] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.284] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.295] GetLastError () returned 0x578 [0149.295] CanUserWritePwrScheme () returned 0 [0149.296] GetSystemMetrics (nIndex=46) returned 2 [0149.296] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.296] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.296] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.296] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.307] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.307] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.307] GetLastError () returned 0x578 [0149.307] CanUserWritePwrScheme () returned 0 [0149.308] GetSystemMetrics (nIndex=46) returned 2 [0149.308] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.308] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.308] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.308] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.319] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.319] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.319] GetLastError () returned 0x578 [0149.319] CanUserWritePwrScheme () returned 0 [0149.320] GetSystemMetrics (nIndex=46) returned 2 [0149.320] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.320] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.320] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.320] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.331] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.331] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.331] GetLastError () returned 0x578 [0149.331] CanUserWritePwrScheme () returned 0 [0149.332] GetSystemMetrics (nIndex=46) returned 2 [0149.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.346] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.346] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.346] GetLastError () returned 0x578 [0149.346] CanUserWritePwrScheme () returned 0 [0149.347] GetSystemMetrics (nIndex=46) returned 2 [0149.347] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.347] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.347] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.347] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.358] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.358] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.358] GetLastError () returned 0x578 [0149.358] CanUserWritePwrScheme () returned 0 [0149.359] GetSystemMetrics (nIndex=46) returned 2 [0149.359] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.359] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.359] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.359] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.370] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.370] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.370] GetLastError () returned 0x578 [0149.370] CanUserWritePwrScheme () returned 0 [0149.371] GetSystemMetrics (nIndex=46) returned 2 [0149.371] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.371] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.371] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.371] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.382] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.382] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.382] GetLastError () returned 0x578 [0149.382] CanUserWritePwrScheme () returned 0 [0149.383] GetSystemMetrics (nIndex=46) returned 2 [0149.383] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.383] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.383] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.383] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.394] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.394] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.394] GetLastError () returned 0x578 [0149.394] CanUserWritePwrScheme () returned 0 [0149.402] GetSystemMetrics (nIndex=46) returned 2 [0149.402] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.402] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.402] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.402] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.416] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.416] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.416] GetLastError () returned 0x578 [0149.416] CanUserWritePwrScheme () returned 0 [0149.417] GetSystemMetrics (nIndex=46) returned 2 [0149.417] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.417] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.417] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.417] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.428] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.428] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.428] GetLastError () returned 0x578 [0149.428] CanUserWritePwrScheme () returned 0 [0149.429] GetSystemMetrics (nIndex=46) returned 2 [0149.429] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.429] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.429] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.429] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.440] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.440] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.440] GetLastError () returned 0x578 [0149.440] CanUserWritePwrScheme () returned 0 [0149.441] GetSystemMetrics (nIndex=46) returned 2 [0149.441] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.441] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.441] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.441] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.452] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.452] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.452] GetLastError () returned 0x578 [0149.452] CanUserWritePwrScheme () returned 0 [0149.453] GetSystemMetrics (nIndex=46) returned 2 [0149.453] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.453] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.453] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.453] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.464] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.464] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.464] GetLastError () returned 0x578 [0149.464] CanUserWritePwrScheme () returned 0 [0149.465] GetSystemMetrics (nIndex=46) returned 2 [0149.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.465] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.465] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.478] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.478] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.478] GetLastError () returned 0x578 [0149.478] CanUserWritePwrScheme () returned 0 [0149.479] GetSystemMetrics (nIndex=46) returned 2 [0149.479] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.479] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.479] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.479] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.490] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.490] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.490] GetLastError () returned 0x578 [0149.490] CanUserWritePwrScheme () returned 0 [0149.491] GetSystemMetrics (nIndex=46) returned 2 [0149.491] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.491] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.491] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.491] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.504] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.504] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.504] GetLastError () returned 0x578 [0149.504] CanUserWritePwrScheme () returned 0 [0149.505] GetSystemMetrics (nIndex=46) returned 2 [0149.505] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.505] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.505] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.505] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.516] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.516] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.516] GetLastError () returned 0x578 [0149.516] CanUserWritePwrScheme () returned 0 [0149.517] GetSystemMetrics (nIndex=46) returned 2 [0149.517] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.517] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.517] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.517] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.528] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.528] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.528] GetLastError () returned 0x578 [0149.528] CanUserWritePwrScheme () returned 0 [0149.529] GetSystemMetrics (nIndex=46) returned 2 [0149.529] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.529] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.529] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.529] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.542] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.542] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.542] GetLastError () returned 0x578 [0149.542] CanUserWritePwrScheme () returned 0 [0149.543] GetSystemMetrics (nIndex=46) returned 2 [0149.543] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.543] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.543] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.543] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.557] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.557] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.557] GetLastError () returned 0x578 [0149.558] CanUserWritePwrScheme () returned 0 [0149.558] GetSystemMetrics (nIndex=46) returned 2 [0149.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.558] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.558] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.559] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.570] GetLastError () returned 0x578 [0149.570] CanUserWritePwrScheme () returned 0 [0149.570] GetSystemMetrics (nIndex=46) returned 2 [0149.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.571] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.571] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.571] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.582] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.582] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.582] GetLastError () returned 0x578 [0149.582] CanUserWritePwrScheme () returned 0 [0149.583] GetSystemMetrics (nIndex=46) returned 2 [0149.583] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.583] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.583] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.583] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.593] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.594] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.594] GetLastError () returned 0x578 [0149.594] CanUserWritePwrScheme () returned 0 [0149.594] GetSystemMetrics (nIndex=46) returned 2 [0149.595] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.595] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.595] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.595] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.608] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.608] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.608] GetLastError () returned 0x578 [0149.608] CanUserWritePwrScheme () returned 0 [0149.609] GetSystemMetrics (nIndex=46) returned 2 [0149.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.609] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.609] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.609] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.620] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.620] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.620] GetLastError () returned 0x578 [0149.620] CanUserWritePwrScheme () returned 0 [0149.621] GetSystemMetrics (nIndex=46) returned 2 [0149.621] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.621] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.621] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.621] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.632] GetLastError () returned 0x578 [0149.632] CanUserWritePwrScheme () returned 0 [0149.633] GetSystemMetrics (nIndex=46) returned 2 [0149.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.644] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.644] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.644] GetLastError () returned 0x578 [0149.644] CanUserWritePwrScheme () returned 0 [0149.645] GetSystemMetrics (nIndex=46) returned 2 [0149.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.645] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.645] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.645] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.656] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.656] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.656] GetLastError () returned 0x578 [0149.657] CanUserWritePwrScheme () returned 0 [0149.657] GetSystemMetrics (nIndex=46) returned 2 [0149.657] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.657] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.657] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.658] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.671] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.671] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.671] GetLastError () returned 0x578 [0149.671] CanUserWritePwrScheme () returned 0 [0149.672] GetSystemMetrics (nIndex=46) returned 2 [0149.672] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.672] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.672] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.672] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.682] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.682] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.682] GetLastError () returned 0x578 [0149.682] CanUserWritePwrScheme () returned 0 [0149.683] GetSystemMetrics (nIndex=46) returned 2 [0149.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.683] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.683] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.683] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.694] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.694] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.694] GetLastError () returned 0x578 [0149.694] CanUserWritePwrScheme () returned 0 [0149.695] GetSystemMetrics (nIndex=46) returned 2 [0149.695] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.695] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.695] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.695] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.706] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.706] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.706] GetLastError () returned 0x578 [0149.706] CanUserWritePwrScheme () returned 0 [0149.707] GetSystemMetrics (nIndex=46) returned 2 [0149.707] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.707] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.707] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.707] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.717] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.718] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.718] GetLastError () returned 0x578 [0149.718] CanUserWritePwrScheme () returned 0 [0149.719] GetSystemMetrics (nIndex=46) returned 2 [0149.719] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.719] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.719] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.719] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.732] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.732] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.732] GetLastError () returned 0x578 [0149.732] CanUserWritePwrScheme () returned 0 [0149.733] GetSystemMetrics (nIndex=46) returned 2 [0149.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.733] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.733] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.733] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.744] GetLastError () returned 0x578 [0149.744] CanUserWritePwrScheme () returned 0 [0149.745] GetSystemMetrics (nIndex=46) returned 2 [0149.745] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.745] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.745] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.745] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.756] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.756] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.756] GetLastError () returned 0x578 [0149.756] CanUserWritePwrScheme () returned 0 [0149.757] GetSystemMetrics (nIndex=46) returned 2 [0149.757] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.757] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.757] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.757] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.767] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.767] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.768] GetLastError () returned 0x578 [0149.768] CanUserWritePwrScheme () returned 0 [0149.768] GetSystemMetrics (nIndex=46) returned 2 [0149.768] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.769] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.769] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.769] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.779] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.779] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.779] GetLastError () returned 0x578 [0149.779] CanUserWritePwrScheme () returned 0 [0149.781] GetSystemMetrics (nIndex=46) returned 2 [0149.781] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.781] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.781] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.781] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.792] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.792] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.792] GetLastError () returned 0x578 [0149.792] CanUserWritePwrScheme () returned 0 [0149.796] GetSystemMetrics (nIndex=46) returned 2 [0149.796] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.796] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.796] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.796] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.807] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.807] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.807] GetLastError () returned 0x578 [0149.807] CanUserWritePwrScheme () returned 0 [0149.808] GetSystemMetrics (nIndex=46) returned 2 [0149.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.808] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.808] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.808] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.819] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.819] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.819] GetLastError () returned 0x578 [0149.819] CanUserWritePwrScheme () returned 0 [0149.820] GetSystemMetrics (nIndex=46) returned 2 [0149.820] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.820] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.820] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.820] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.830] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.830] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.830] GetLastError () returned 0x578 [0149.830] CanUserWritePwrScheme () returned 0 [0149.831] GetSystemMetrics (nIndex=46) returned 2 [0149.831] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.831] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.831] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.831] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.842] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.842] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.842] GetLastError () returned 0x578 [0149.842] CanUserWritePwrScheme () returned 0 [0149.843] GetSystemMetrics (nIndex=46) returned 2 [0149.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.843] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.843] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.854] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.854] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.854] GetLastError () returned 0x578 [0149.854] CanUserWritePwrScheme () returned 0 [0149.855] GetSystemMetrics (nIndex=46) returned 2 [0149.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.855] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.855] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.855] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.868] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.868] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.868] GetLastError () returned 0x578 [0149.868] CanUserWritePwrScheme () returned 0 [0149.869] GetSystemMetrics (nIndex=46) returned 2 [0149.869] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.869] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.869] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.869] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.880] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.880] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.880] GetLastError () returned 0x578 [0149.880] CanUserWritePwrScheme () returned 0 [0149.881] GetSystemMetrics (nIndex=46) returned 2 [0149.881] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.881] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.881] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.881] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.893] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.893] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.893] GetLastError () returned 0x578 [0149.893] CanUserWritePwrScheme () returned 0 [0149.894] GetSystemMetrics (nIndex=46) returned 2 [0149.894] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.894] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.894] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.894] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.904] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.904] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.904] GetLastError () returned 0x578 [0149.904] CanUserWritePwrScheme () returned 0 [0149.905] GetSystemMetrics (nIndex=46) returned 2 [0149.905] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.905] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.905] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.905] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.916] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.916] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.916] GetLastError () returned 0x578 [0149.916] CanUserWritePwrScheme () returned 0 [0149.917] GetSystemMetrics (nIndex=46) returned 2 [0149.917] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.917] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.917] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.917] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.931] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.931] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.931] GetLastError () returned 0x578 [0149.931] CanUserWritePwrScheme () returned 0 [0149.932] GetSystemMetrics (nIndex=46) returned 2 [0149.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.932] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.932] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.932] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.943] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.943] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.943] GetLastError () returned 0x578 [0149.943] CanUserWritePwrScheme () returned 0 [0149.944] GetSystemMetrics (nIndex=46) returned 2 [0149.944] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.944] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.944] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.944] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.955] GetLastError () returned 0x578 [0149.955] CanUserWritePwrScheme () returned 0 [0149.956] GetSystemMetrics (nIndex=46) returned 2 [0149.956] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.956] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.956] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.956] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.966] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.966] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.967] GetLastError () returned 0x578 [0149.967] CanUserWritePwrScheme () returned 0 [0149.968] GetSystemMetrics (nIndex=46) returned 2 [0149.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.978] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.978] GetLastError () returned 0x578 [0149.978] CanUserWritePwrScheme () returned 0 [0149.979] GetSystemMetrics (nIndex=46) returned 2 [0149.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.979] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.979] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.979] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0149.993] GetWindowTextLengthA (hWnd=0x0) returned 0 [0149.993] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0149.993] GetLastError () returned 0x578 [0149.993] CanUserWritePwrScheme () returned 0 [0149.994] GetSystemMetrics (nIndex=46) returned 2 [0149.994] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0149.994] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0149.994] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0149.994] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.005] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.005] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.005] GetLastError () returned 0x578 [0150.005] CanUserWritePwrScheme () returned 0 [0150.006] GetSystemMetrics (nIndex=46) returned 2 [0150.006] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.006] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.006] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.006] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.011] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.011] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.011] GetLastError () returned 0x578 [0150.011] CanUserWritePwrScheme () returned 0 [0150.012] GetSystemMetrics (nIndex=46) returned 2 [0150.012] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.012] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.012] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.012] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.016] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.016] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.017] GetLastError () returned 0x578 [0150.017] CanUserWritePwrScheme () returned 0 [0150.017] GetSystemMetrics (nIndex=46) returned 2 [0150.017] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.018] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.018] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.018] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.022] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.022] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.022] GetLastError () returned 0x578 [0150.022] CanUserWritePwrScheme () returned 0 [0150.023] GetSystemMetrics (nIndex=46) returned 2 [0150.023] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.023] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.023] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.023] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.028] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.028] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.028] GetLastError () returned 0x578 [0150.028] CanUserWritePwrScheme () returned 0 [0150.029] GetSystemMetrics (nIndex=46) returned 2 [0150.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.029] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.029] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.029] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.034] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.034] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.034] GetLastError () returned 0x578 [0150.034] CanUserWritePwrScheme () returned 0 [0150.035] GetSystemMetrics (nIndex=46) returned 2 [0150.035] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.035] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.035] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.035] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.040] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.040] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.040] GetLastError () returned 0x578 [0150.040] CanUserWritePwrScheme () returned 0 [0150.041] GetSystemMetrics (nIndex=46) returned 2 [0150.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.046] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.046] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.046] GetLastError () returned 0x578 [0150.046] CanUserWritePwrScheme () returned 0 [0150.047] GetSystemMetrics (nIndex=46) returned 2 [0150.047] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.047] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.047] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.047] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.052] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.052] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.052] GetLastError () returned 0x578 [0150.052] CanUserWritePwrScheme () returned 0 [0150.053] GetSystemMetrics (nIndex=46) returned 2 [0150.053] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.053] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.053] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.053] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.062] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.062] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.062] GetLastError () returned 0x578 [0150.062] CanUserWritePwrScheme () returned 0 [0150.063] GetSystemMetrics (nIndex=46) returned 2 [0150.063] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.063] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.063] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.063] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.074] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.074] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.074] GetLastError () returned 0x578 [0150.074] CanUserWritePwrScheme () returned 0 [0150.075] GetSystemMetrics (nIndex=46) returned 2 [0150.075] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.075] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.075] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.075] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.086] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.086] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.086] GetLastError () returned 0x578 [0150.086] CanUserWritePwrScheme () returned 0 [0150.087] GetSystemMetrics (nIndex=46) returned 2 [0150.087] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.087] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.087] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.087] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.098] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.098] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.098] GetLastError () returned 0x578 [0150.098] CanUserWritePwrScheme () returned 0 [0150.099] GetSystemMetrics (nIndex=46) returned 2 [0150.099] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.099] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.099] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.099] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.110] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.110] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.110] GetLastError () returned 0x578 [0150.110] CanUserWritePwrScheme () returned 0 [0150.111] GetSystemMetrics (nIndex=46) returned 2 [0150.111] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.111] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.111] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.111] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.125] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.125] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.125] GetLastError () returned 0x578 [0150.125] CanUserWritePwrScheme () returned 0 [0150.126] GetSystemMetrics (nIndex=46) returned 2 [0150.126] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.126] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.126] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.126] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.138] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.138] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.138] GetLastError () returned 0x578 [0150.138] CanUserWritePwrScheme () returned 0 [0150.139] GetSystemMetrics (nIndex=46) returned 2 [0150.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.139] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.139] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.139] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.151] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.151] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.151] GetLastError () returned 0x578 [0150.151] CanUserWritePwrScheme () returned 0 [0150.152] GetSystemMetrics (nIndex=46) returned 2 [0150.152] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.152] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.152] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.152] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.162] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.162] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.163] GetLastError () returned 0x578 [0150.163] CanUserWritePwrScheme () returned 0 [0150.163] GetSystemMetrics (nIndex=46) returned 2 [0150.163] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.163] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.164] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.164] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.174] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.174] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.174] GetLastError () returned 0x578 [0150.175] CanUserWritePwrScheme () returned 0 [0150.175] GetSystemMetrics (nIndex=46) returned 2 [0150.175] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.175] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.175] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.175] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.189] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.189] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.189] GetLastError () returned 0x578 [0150.189] CanUserWritePwrScheme () returned 0 [0150.190] GetSystemMetrics (nIndex=46) returned 2 [0150.190] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.190] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.190] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.190] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.201] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.201] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.201] GetLastError () returned 0x578 [0150.201] CanUserWritePwrScheme () returned 0 [0150.202] GetSystemMetrics (nIndex=46) returned 2 [0150.202] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.202] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.202] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.202] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.213] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.213] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.213] GetLastError () returned 0x578 [0150.213] CanUserWritePwrScheme () returned 0 [0150.214] GetSystemMetrics (nIndex=46) returned 2 [0150.214] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.214] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.214] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.214] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.225] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.225] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.225] GetLastError () returned 0x578 [0150.225] CanUserWritePwrScheme () returned 0 [0150.226] GetSystemMetrics (nIndex=46) returned 2 [0150.226] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.226] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.226] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.226] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.237] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.237] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.237] GetLastError () returned 0x578 [0150.237] CanUserWritePwrScheme () returned 0 [0150.238] GetSystemMetrics (nIndex=46) returned 2 [0150.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.238] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.238] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.238] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.249] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.249] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.249] GetLastError () returned 0x578 [0150.249] CanUserWritePwrScheme () returned 0 [0150.253] GetSystemMetrics (nIndex=46) returned 2 [0150.253] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.253] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.253] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.253] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.264] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.264] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.264] GetLastError () returned 0x578 [0150.264] CanUserWritePwrScheme () returned 0 [0150.265] GetSystemMetrics (nIndex=46) returned 2 [0150.265] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.265] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.265] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.265] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.275] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.275] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.275] GetLastError () returned 0x578 [0150.275] CanUserWritePwrScheme () returned 0 [0150.276] GetSystemMetrics (nIndex=46) returned 2 [0150.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.276] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.276] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.276] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.281] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.281] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.281] GetLastError () returned 0x578 [0150.281] CanUserWritePwrScheme () returned 0 [0150.282] GetSystemMetrics (nIndex=46) returned 2 [0150.282] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.282] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.282] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.282] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.287] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.287] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.287] GetLastError () returned 0x578 [0150.287] CanUserWritePwrScheme () returned 0 [0150.288] GetSystemMetrics (nIndex=46) returned 2 [0150.288] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.288] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.288] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.288] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.293] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.293] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.293] GetLastError () returned 0x578 [0150.293] CanUserWritePwrScheme () returned 0 [0150.294] GetSystemMetrics (nIndex=46) returned 2 [0150.294] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.294] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.294] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.294] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.299] GetLastError () returned 0x578 [0150.299] CanUserWritePwrScheme () returned 0 [0150.300] GetSystemMetrics (nIndex=46) returned 2 [0150.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.305] GetLastError () returned 0x578 [0150.305] CanUserWritePwrScheme () returned 0 [0150.306] GetSystemMetrics (nIndex=46) returned 2 [0150.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.306] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.306] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.306] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.311] GetLastError () returned 0x578 [0150.311] CanUserWritePwrScheme () returned 0 [0150.312] GetSystemMetrics (nIndex=46) returned 2 [0150.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.319] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.319] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.319] GetLastError () returned 0x578 [0150.319] CanUserWritePwrScheme () returned 0 [0150.320] GetSystemMetrics (nIndex=46) returned 2 [0150.320] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.320] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.320] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.320] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.325] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.325] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.325] GetLastError () returned 0x578 [0150.325] CanUserWritePwrScheme () returned 0 [0150.326] GetSystemMetrics (nIndex=46) returned 2 [0150.326] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.326] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.326] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.326] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.337] GetLastError () returned 0x578 [0150.337] CanUserWritePwrScheme () returned 0 [0150.338] GetSystemMetrics (nIndex=46) returned 2 [0150.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.338] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.338] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.338] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.349] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.349] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.349] GetLastError () returned 0x578 [0150.349] CanUserWritePwrScheme () returned 0 [0150.350] GetSystemMetrics (nIndex=46) returned 2 [0150.350] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.350] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.350] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.350] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.361] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.361] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.361] GetLastError () returned 0x578 [0150.361] CanUserWritePwrScheme () returned 0 [0150.362] GetSystemMetrics (nIndex=46) returned 2 [0150.362] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.362] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.362] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.362] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.372] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.372] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.372] GetLastError () returned 0x578 [0150.373] CanUserWritePwrScheme () returned 0 [0150.374] GetSystemMetrics (nIndex=46) returned 2 [0150.374] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.374] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.374] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.374] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.387] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.387] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.387] GetLastError () returned 0x578 [0150.387] CanUserWritePwrScheme () returned 0 [0150.388] GetSystemMetrics (nIndex=46) returned 2 [0150.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.388] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.388] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.388] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.407] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.407] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.407] GetLastError () returned 0x578 [0150.407] CanUserWritePwrScheme () returned 0 [0150.408] GetSystemMetrics (nIndex=46) returned 2 [0150.408] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.408] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.408] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.408] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.419] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.419] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.419] GetLastError () returned 0x578 [0150.419] CanUserWritePwrScheme () returned 0 [0150.420] GetSystemMetrics (nIndex=46) returned 2 [0150.420] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.420] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.420] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.420] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.431] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.431] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.431] GetLastError () returned 0x578 [0150.431] CanUserWritePwrScheme () returned 0 [0150.432] GetSystemMetrics (nIndex=46) returned 2 [0150.432] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.432] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.432] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.432] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.443] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.443] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.443] GetLastError () returned 0x578 [0150.443] CanUserWritePwrScheme () returned 0 [0150.444] GetSystemMetrics (nIndex=46) returned 2 [0150.444] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.444] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.444] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.444] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.458] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.458] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.458] GetLastError () returned 0x578 [0150.458] CanUserWritePwrScheme () returned 0 [0150.459] GetSystemMetrics (nIndex=46) returned 2 [0150.459] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.459] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.459] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.459] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.470] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.470] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.470] GetLastError () returned 0x578 [0150.470] CanUserWritePwrScheme () returned 0 [0150.471] GetSystemMetrics (nIndex=46) returned 2 [0150.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.482] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.482] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.482] GetLastError () returned 0x578 [0150.482] CanUserWritePwrScheme () returned 0 [0150.483] GetSystemMetrics (nIndex=46) returned 2 [0150.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.483] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.483] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.483] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.494] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.494] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.494] GetLastError () returned 0x578 [0150.494] CanUserWritePwrScheme () returned 0 [0150.495] GetSystemMetrics (nIndex=46) returned 2 [0150.495] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.495] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.495] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.495] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.506] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.506] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.506] GetLastError () returned 0x578 [0150.506] CanUserWritePwrScheme () returned 0 [0150.507] GetSystemMetrics (nIndex=46) returned 2 [0150.507] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.507] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.507] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.507] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.521] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.521] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.521] GetLastError () returned 0x578 [0150.521] CanUserWritePwrScheme () returned 0 [0150.522] GetSystemMetrics (nIndex=46) returned 2 [0150.522] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.522] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.522] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.522] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.533] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.533] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.533] GetLastError () returned 0x578 [0150.533] CanUserWritePwrScheme () returned 0 [0150.534] GetSystemMetrics (nIndex=46) returned 2 [0150.534] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.534] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.534] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.534] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.545] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.545] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.545] GetLastError () returned 0x578 [0150.545] CanUserWritePwrScheme () returned 0 [0150.546] GetSystemMetrics (nIndex=46) returned 2 [0150.546] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.546] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.546] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.546] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.557] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.557] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.557] GetLastError () returned 0x578 [0150.557] CanUserWritePwrScheme () returned 0 [0150.558] GetSystemMetrics (nIndex=46) returned 2 [0150.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.558] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.558] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.558] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.569] GetLastError () returned 0x578 [0150.569] CanUserWritePwrScheme () returned 0 [0150.570] GetSystemMetrics (nIndex=46) returned 2 [0150.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.570] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.570] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.570] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.584] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.584] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.584] GetLastError () returned 0x578 [0150.584] CanUserWritePwrScheme () returned 0 [0150.585] GetSystemMetrics (nIndex=46) returned 2 [0150.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.585] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.585] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.585] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.596] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.596] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.596] GetLastError () returned 0x578 [0150.596] CanUserWritePwrScheme () returned 0 [0150.597] GetSystemMetrics (nIndex=46) returned 2 [0150.597] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.597] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.597] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.597] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.608] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.608] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.608] GetLastError () returned 0x578 [0150.608] CanUserWritePwrScheme () returned 0 [0150.609] GetSystemMetrics (nIndex=46) returned 2 [0150.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.609] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.609] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.609] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.620] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.620] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.620] GetLastError () returned 0x578 [0150.620] CanUserWritePwrScheme () returned 0 [0150.621] GetSystemMetrics (nIndex=46) returned 2 [0150.621] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.621] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.621] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.621] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.632] GetLastError () returned 0x578 [0150.632] CanUserWritePwrScheme () returned 0 [0150.633] GetSystemMetrics (nIndex=46) returned 2 [0150.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.647] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.647] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.647] GetLastError () returned 0x578 [0150.647] CanUserWritePwrScheme () returned 0 [0150.648] GetSystemMetrics (nIndex=46) returned 2 [0150.648] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.648] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.648] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.648] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.659] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.659] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.659] GetLastError () returned 0x578 [0150.659] CanUserWritePwrScheme () returned 0 [0150.660] GetSystemMetrics (nIndex=46) returned 2 [0150.660] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.660] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.660] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.660] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.671] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.671] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.671] GetLastError () returned 0x578 [0150.671] CanUserWritePwrScheme () returned 0 [0150.672] GetSystemMetrics (nIndex=46) returned 2 [0150.672] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.672] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.672] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.672] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.683] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.683] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.683] GetLastError () returned 0x578 [0150.683] CanUserWritePwrScheme () returned 0 [0150.684] GetSystemMetrics (nIndex=46) returned 2 [0150.684] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.684] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.684] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.695] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.695] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.695] GetLastError () returned 0x578 [0150.695] CanUserWritePwrScheme () returned 0 [0150.696] GetSystemMetrics (nIndex=46) returned 2 [0150.696] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.696] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.696] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.696] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.709] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.709] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.709] GetLastError () returned 0x578 [0150.709] CanUserWritePwrScheme () returned 0 [0150.710] GetSystemMetrics (nIndex=46) returned 2 [0150.710] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.710] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.710] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.710] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.721] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.721] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.721] GetLastError () returned 0x578 [0150.721] CanUserWritePwrScheme () returned 0 [0150.722] GetSystemMetrics (nIndex=46) returned 2 [0150.722] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.722] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.722] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.722] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.733] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.733] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.733] GetLastError () returned 0x578 [0150.733] CanUserWritePwrScheme () returned 0 [0150.734] GetSystemMetrics (nIndex=46) returned 2 [0150.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.734] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.734] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.734] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.745] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.745] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.745] GetLastError () returned 0x578 [0150.745] CanUserWritePwrScheme () returned 0 [0150.746] GetSystemMetrics (nIndex=46) returned 2 [0150.746] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.746] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.746] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.746] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.757] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.757] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.757] GetLastError () returned 0x578 [0150.757] CanUserWritePwrScheme () returned 0 [0150.758] GetSystemMetrics (nIndex=46) returned 2 [0150.758] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.758] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.758] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.758] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.769] GetLastError () returned 0x578 [0150.769] CanUserWritePwrScheme () returned 0 [0150.770] GetSystemMetrics (nIndex=46) returned 2 [0150.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.783] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.783] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.783] GetLastError () returned 0x578 [0150.783] CanUserWritePwrScheme () returned 0 [0150.784] GetSystemMetrics (nIndex=46) returned 2 [0150.784] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.784] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.784] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.784] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.795] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.795] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.795] GetLastError () returned 0x578 [0150.795] CanUserWritePwrScheme () returned 0 [0150.796] GetSystemMetrics (nIndex=46) returned 2 [0150.796] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.796] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.796] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.796] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.807] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.807] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.807] GetLastError () returned 0x578 [0150.807] CanUserWritePwrScheme () returned 0 [0150.808] GetSystemMetrics (nIndex=46) returned 2 [0150.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.808] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.808] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.808] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.819] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.819] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.819] GetLastError () returned 0x578 [0150.819] CanUserWritePwrScheme () returned 0 [0150.820] GetSystemMetrics (nIndex=46) returned 2 [0150.820] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.820] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.820] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.820] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.831] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.831] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.831] GetLastError () returned 0x578 [0150.831] CanUserWritePwrScheme () returned 0 [0150.832] GetSystemMetrics (nIndex=46) returned 2 [0150.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.832] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.832] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.832] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.846] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.846] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.846] GetLastError () returned 0x578 [0150.847] CanUserWritePwrScheme () returned 0 [0150.848] GetSystemMetrics (nIndex=46) returned 2 [0150.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.848] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.848] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.848] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.858] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.858] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.858] GetLastError () returned 0x578 [0150.858] CanUserWritePwrScheme () returned 0 [0150.859] GetSystemMetrics (nIndex=46) returned 2 [0150.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.859] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.859] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.859] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.870] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.870] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.870] GetLastError () returned 0x578 [0150.870] CanUserWritePwrScheme () returned 0 [0150.871] GetSystemMetrics (nIndex=46) returned 2 [0150.871] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.871] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.871] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.871] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.882] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.882] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.882] GetLastError () returned 0x578 [0150.882] CanUserWritePwrScheme () returned 0 [0150.883] GetSystemMetrics (nIndex=46) returned 2 [0150.883] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.883] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.883] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.883] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.894] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.894] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.894] GetLastError () returned 0x578 [0150.894] CanUserWritePwrScheme () returned 0 [0150.895] GetSystemMetrics (nIndex=46) returned 2 [0150.895] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.895] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.895] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.895] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.908] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.908] GetLastError () returned 0x578 [0150.909] CanUserWritePwrScheme () returned 0 [0150.909] GetSystemMetrics (nIndex=46) returned 2 [0150.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.909] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.909] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.909] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.920] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.920] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.920] GetLastError () returned 0x578 [0150.920] CanUserWritePwrScheme () returned 0 [0150.921] GetSystemMetrics (nIndex=46) returned 2 [0150.921] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.921] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.921] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.921] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.932] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.932] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.932] GetLastError () returned 0x578 [0150.932] CanUserWritePwrScheme () returned 0 [0150.933] GetSystemMetrics (nIndex=46) returned 2 [0150.933] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.933] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.933] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.933] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.944] GetLastError () returned 0x578 [0150.944] CanUserWritePwrScheme () returned 0 [0150.945] GetSystemMetrics (nIndex=46) returned 2 [0150.945] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.945] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.945] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.945] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.956] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.956] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.956] GetLastError () returned 0x578 [0150.956] CanUserWritePwrScheme () returned 0 [0150.957] GetSystemMetrics (nIndex=46) returned 2 [0150.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.957] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.957] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.957] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.971] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.971] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.971] GetLastError () returned 0x578 [0150.971] CanUserWritePwrScheme () returned 0 [0150.972] GetSystemMetrics (nIndex=46) returned 2 [0150.972] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.972] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.972] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.972] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.982] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.982] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.982] GetLastError () returned 0x578 [0150.982] CanUserWritePwrScheme () returned 0 [0150.983] GetSystemMetrics (nIndex=46) returned 2 [0150.983] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.983] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.983] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.983] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0150.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0150.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0150.994] GetLastError () returned 0x578 [0150.994] CanUserWritePwrScheme () returned 0 [0150.995] GetSystemMetrics (nIndex=46) returned 2 [0150.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0150.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0150.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0150.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.006] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.006] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.006] GetLastError () returned 0x578 [0151.006] CanUserWritePwrScheme () returned 0 [0151.007] GetSystemMetrics (nIndex=46) returned 2 [0151.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.007] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.007] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.007] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.018] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.018] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.018] GetLastError () returned 0x578 [0151.018] CanUserWritePwrScheme () returned 0 [0151.019] GetSystemMetrics (nIndex=46) returned 2 [0151.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.019] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.029] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.029] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.029] GetLastError () returned 0x578 [0151.029] CanUserWritePwrScheme () returned 0 [0151.033] GetSystemMetrics (nIndex=46) returned 2 [0151.033] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.033] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.033] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.033] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.044] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.044] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.044] GetLastError () returned 0x578 [0151.044] CanUserWritePwrScheme () returned 0 [0151.045] GetSystemMetrics (nIndex=46) returned 2 [0151.045] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.045] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.045] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.045] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.055] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.055] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.055] GetLastError () returned 0x578 [0151.055] CanUserWritePwrScheme () returned 0 [0151.056] GetSystemMetrics (nIndex=46) returned 2 [0151.056] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.056] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.056] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.056] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.067] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.067] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.067] GetLastError () returned 0x578 [0151.067] CanUserWritePwrScheme () returned 0 [0151.068] GetSystemMetrics (nIndex=46) returned 2 [0151.068] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.068] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.068] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.068] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.103] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.103] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.103] GetLastError () returned 0x578 [0151.103] CanUserWritePwrScheme () returned 0 [0151.105] GetSystemMetrics (nIndex=46) returned 2 [0151.105] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.105] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.105] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.105] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.116] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.116] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.116] GetLastError () returned 0x578 [0151.116] CanUserWritePwrScheme () returned 0 [0151.117] GetSystemMetrics (nIndex=46) returned 2 [0151.117] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.117] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.117] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.117] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.129] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.129] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.129] GetLastError () returned 0x578 [0151.129] CanUserWritePwrScheme () returned 0 [0151.130] GetSystemMetrics (nIndex=46) returned 2 [0151.130] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.130] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.130] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.130] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.141] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.141] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.142] GetLastError () returned 0x578 [0151.142] CanUserWritePwrScheme () returned 0 [0151.142] GetSystemMetrics (nIndex=46) returned 2 [0151.142] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.143] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.143] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.143] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.154] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.154] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.154] GetLastError () returned 0x578 [0151.154] CanUserWritePwrScheme () returned 0 [0151.155] GetSystemMetrics (nIndex=46) returned 2 [0151.155] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.155] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.155] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.155] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.168] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.168] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.168] GetLastError () returned 0x578 [0151.168] CanUserWritePwrScheme () returned 0 [0151.169] GetSystemMetrics (nIndex=46) returned 2 [0151.169] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.169] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.169] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.169] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.180] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.180] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.180] GetLastError () returned 0x578 [0151.180] CanUserWritePwrScheme () returned 0 [0151.181] GetSystemMetrics (nIndex=46) returned 2 [0151.181] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.181] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.181] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.181] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.191] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.192] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.192] GetLastError () returned 0x578 [0151.192] CanUserWritePwrScheme () returned 0 [0151.192] GetSystemMetrics (nIndex=46) returned 2 [0151.193] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.193] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.193] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.193] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.204] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.204] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.204] GetLastError () returned 0x578 [0151.204] CanUserWritePwrScheme () returned 0 [0151.205] GetSystemMetrics (nIndex=46) returned 2 [0151.205] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.205] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.205] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.205] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.216] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.216] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.216] GetLastError () returned 0x578 [0151.216] CanUserWritePwrScheme () returned 0 [0151.217] GetSystemMetrics (nIndex=46) returned 2 [0151.217] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.217] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.217] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.217] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.230] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.230] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.230] GetLastError () returned 0x578 [0151.230] CanUserWritePwrScheme () returned 0 [0151.231] GetSystemMetrics (nIndex=46) returned 2 [0151.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.231] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.231] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.231] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.236] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.236] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.236] GetLastError () returned 0x578 [0151.236] CanUserWritePwrScheme () returned 0 [0151.237] GetSystemMetrics (nIndex=46) returned 2 [0151.237] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.237] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.237] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.237] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.242] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.242] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.242] GetLastError () returned 0x578 [0151.242] CanUserWritePwrScheme () returned 0 [0151.243] GetSystemMetrics (nIndex=46) returned 2 [0151.243] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.243] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.243] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.243] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.248] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.248] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.248] GetLastError () returned 0x578 [0151.248] CanUserWritePwrScheme () returned 0 [0151.249] GetSystemMetrics (nIndex=46) returned 2 [0151.249] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.249] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.249] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.249] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.254] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.254] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.254] GetLastError () returned 0x578 [0151.254] CanUserWritePwrScheme () returned 0 [0151.255] GetSystemMetrics (nIndex=46) returned 2 [0151.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.255] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.255] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.260] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.260] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.260] GetLastError () returned 0x578 [0151.260] CanUserWritePwrScheme () returned 0 [0151.261] GetSystemMetrics (nIndex=46) returned 2 [0151.261] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.261] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.261] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.261] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.266] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.266] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.266] GetLastError () returned 0x578 [0151.266] CanUserWritePwrScheme () returned 0 [0151.267] GetSystemMetrics (nIndex=46) returned 2 [0151.267] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.267] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.267] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.267] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.278] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.278] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.278] GetLastError () returned 0x578 [0151.278] CanUserWritePwrScheme () returned 0 [0151.279] GetSystemMetrics (nIndex=46) returned 2 [0151.279] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.279] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.279] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.279] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.289] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.289] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.289] GetLastError () returned 0x578 [0151.289] CanUserWritePwrScheme () returned 0 [0151.290] GetSystemMetrics (nIndex=46) returned 2 [0151.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.304] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.304] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.304] GetLastError () returned 0x578 [0151.304] CanUserWritePwrScheme () returned 0 [0151.305] GetSystemMetrics (nIndex=46) returned 2 [0151.305] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.305] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.305] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.305] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.316] GetLastError () returned 0x578 [0151.316] CanUserWritePwrScheme () returned 0 [0151.317] GetSystemMetrics (nIndex=46) returned 2 [0151.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.327] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.327] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.327] GetLastError () returned 0x578 [0151.327] CanUserWritePwrScheme () returned 0 [0151.328] GetSystemMetrics (nIndex=46) returned 2 [0151.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.328] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.328] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.328] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.339] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.339] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.339] GetLastError () returned 0x578 [0151.339] CanUserWritePwrScheme () returned 0 [0151.340] GetSystemMetrics (nIndex=46) returned 2 [0151.340] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.340] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.340] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.340] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.351] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.351] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.351] GetLastError () returned 0x578 [0151.351] CanUserWritePwrScheme () returned 0 [0151.352] GetSystemMetrics (nIndex=46) returned 2 [0151.352] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.352] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.352] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.352] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.365] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.365] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.365] GetLastError () returned 0x578 [0151.365] CanUserWritePwrScheme () returned 0 [0151.366] GetSystemMetrics (nIndex=46) returned 2 [0151.366] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.366] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.366] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.366] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.377] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.377] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.377] GetLastError () returned 0x578 [0151.377] CanUserWritePwrScheme () returned 0 [0151.378] GetSystemMetrics (nIndex=46) returned 2 [0151.378] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.378] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.378] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.378] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.389] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.389] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.389] GetLastError () returned 0x578 [0151.389] CanUserWritePwrScheme () returned 0 [0151.390] GetSystemMetrics (nIndex=46) returned 2 [0151.390] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.390] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.390] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.390] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.409] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.409] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.409] GetLastError () returned 0x578 [0151.409] CanUserWritePwrScheme () returned 0 [0151.410] GetSystemMetrics (nIndex=46) returned 2 [0151.410] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.410] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.410] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.410] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.424] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.424] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.424] GetLastError () returned 0x578 [0151.424] CanUserWritePwrScheme () returned 0 [0151.425] GetSystemMetrics (nIndex=46) returned 2 [0151.425] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.425] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.425] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.425] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.436] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.436] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.436] GetLastError () returned 0x578 [0151.436] CanUserWritePwrScheme () returned 0 [0151.437] GetSystemMetrics (nIndex=46) returned 2 [0151.437] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.437] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.437] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.437] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.448] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.448] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.448] GetLastError () returned 0x578 [0151.448] CanUserWritePwrScheme () returned 0 [0151.449] GetSystemMetrics (nIndex=46) returned 2 [0151.449] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.449] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.449] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.449] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.459] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.459] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.459] GetLastError () returned 0x578 [0151.459] CanUserWritePwrScheme () returned 0 [0151.460] GetSystemMetrics (nIndex=46) returned 2 [0151.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.460] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.460] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.460] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.471] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.471] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.471] GetLastError () returned 0x578 [0151.471] CanUserWritePwrScheme () returned 0 [0151.472] GetSystemMetrics (nIndex=46) returned 2 [0151.472] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.472] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.472] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.472] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.483] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.483] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.483] GetLastError () returned 0x578 [0151.483] CanUserWritePwrScheme () returned 0 [0151.484] GetSystemMetrics (nIndex=46) returned 2 [0151.484] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.484] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.484] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.484] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.493] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.493] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.493] GetLastError () returned 0x578 [0151.493] CanUserWritePwrScheme () returned 0 [0151.493] GetSystemMetrics (nIndex=46) returned 2 [0151.494] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.494] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.494] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.494] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.499] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.499] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.499] GetLastError () returned 0x578 [0151.499] CanUserWritePwrScheme () returned 0 [0151.499] GetSystemMetrics (nIndex=46) returned 2 [0151.500] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.500] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.500] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.500] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.510] GetLastError () returned 0x578 [0151.510] CanUserWritePwrScheme () returned 0 [0151.510] GetSystemMetrics (nIndex=46) returned 2 [0151.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.511] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.511] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.511] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.521] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.521] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.521] GetLastError () returned 0x578 [0151.521] CanUserWritePwrScheme () returned 0 [0151.522] GetSystemMetrics (nIndex=46) returned 2 [0151.522] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.522] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.522] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.522] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.533] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.533] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.533] GetLastError () returned 0x578 [0151.533] CanUserWritePwrScheme () returned 0 [0151.534] GetSystemMetrics (nIndex=46) returned 2 [0151.534] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.534] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.534] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.534] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.545] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.545] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.545] GetLastError () returned 0x578 [0151.545] CanUserWritePwrScheme () returned 0 [0151.546] GetSystemMetrics (nIndex=46) returned 2 [0151.546] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.546] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.546] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.546] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.559] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.559] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.559] GetLastError () returned 0x578 [0151.559] CanUserWritePwrScheme () returned 0 [0151.560] GetSystemMetrics (nIndex=46) returned 2 [0151.560] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.560] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.560] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.560] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.571] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.571] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.571] GetLastError () returned 0x578 [0151.571] CanUserWritePwrScheme () returned 0 [0151.572] GetSystemMetrics (nIndex=46) returned 2 [0151.572] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.572] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.572] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.572] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.582] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.582] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.582] GetLastError () returned 0x578 [0151.582] CanUserWritePwrScheme () returned 0 [0151.583] GetSystemMetrics (nIndex=46) returned 2 [0151.583] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.583] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.583] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.583] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.594] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.594] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.594] GetLastError () returned 0x578 [0151.594] CanUserWritePwrScheme () returned 0 [0151.595] GetSystemMetrics (nIndex=46) returned 2 [0151.595] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.595] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.595] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.595] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.606] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.606] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.606] GetLastError () returned 0x578 [0151.606] CanUserWritePwrScheme () returned 0 [0151.607] GetSystemMetrics (nIndex=46) returned 2 [0151.607] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.607] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.607] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.607] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.621] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.621] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.621] GetLastError () returned 0x578 [0151.621] CanUserWritePwrScheme () returned 0 [0151.622] GetSystemMetrics (nIndex=46) returned 2 [0151.622] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.622] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.622] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.622] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.633] GetLastError () returned 0x578 [0151.633] CanUserWritePwrScheme () returned 0 [0151.633] GetSystemMetrics (nIndex=46) returned 2 [0151.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.634] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.646] GetLastError () returned 0x578 [0151.646] CanUserWritePwrScheme () returned 0 [0151.647] GetSystemMetrics (nIndex=46) returned 2 [0151.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.647] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.647] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.658] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.658] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.658] GetLastError () returned 0x578 [0151.658] CanUserWritePwrScheme () returned 0 [0151.659] GetSystemMetrics (nIndex=46) returned 2 [0151.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.659] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.659] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.659] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.670] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.670] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.670] GetLastError () returned 0x578 [0151.670] CanUserWritePwrScheme () returned 0 [0151.671] GetSystemMetrics (nIndex=46) returned 2 [0151.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.671] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.671] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.671] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.684] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.684] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.684] GetLastError () returned 0x578 [0151.684] CanUserWritePwrScheme () returned 0 [0151.685] GetSystemMetrics (nIndex=46) returned 2 [0151.685] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.685] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.685] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.685] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.696] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.696] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.696] GetLastError () returned 0x578 [0151.696] CanUserWritePwrScheme () returned 0 [0151.697] GetSystemMetrics (nIndex=46) returned 2 [0151.697] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.697] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.697] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.697] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.707] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.707] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.708] GetLastError () returned 0x578 [0151.708] CanUserWritePwrScheme () returned 0 [0151.708] GetSystemMetrics (nIndex=46) returned 2 [0151.708] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.708] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.719] GetLastError () returned 0x578 [0151.719] CanUserWritePwrScheme () returned 0 [0151.720] GetSystemMetrics (nIndex=46) returned 2 [0151.720] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.720] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.720] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.720] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.811] GetLastError () returned 0x578 [0151.811] CanUserWritePwrScheme () returned 0 [0151.814] GetSystemMetrics (nIndex=46) returned 2 [0151.814] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.814] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.814] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.814] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.825] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.825] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.825] GetLastError () returned 0x578 [0151.825] CanUserWritePwrScheme () returned 0 [0151.826] GetSystemMetrics (nIndex=46) returned 2 [0151.826] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.826] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.826] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.826] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.836] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.836] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.836] GetLastError () returned 0x578 [0151.836] CanUserWritePwrScheme () returned 0 [0151.837] GetSystemMetrics (nIndex=46) returned 2 [0151.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.837] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.837] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.837] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.848] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.848] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.848] GetLastError () returned 0x578 [0151.848] CanUserWritePwrScheme () returned 0 [0151.849] GetSystemMetrics (nIndex=46) returned 2 [0151.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.849] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.849] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.849] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.860] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.860] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.860] GetLastError () returned 0x578 [0151.860] CanUserWritePwrScheme () returned 0 [0151.861] GetSystemMetrics (nIndex=46) returned 2 [0151.861] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.872] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.872] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.872] GetLastError () returned 0x578 [0151.872] CanUserWritePwrScheme () returned 0 [0151.873] GetSystemMetrics (nIndex=46) returned 2 [0151.873] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.873] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.873] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.873] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.886] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.886] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.886] GetLastError () returned 0x578 [0151.886] CanUserWritePwrScheme () returned 0 [0151.887] GetSystemMetrics (nIndex=46) returned 2 [0151.887] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.887] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.887] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.887] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.899] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.899] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.899] GetLastError () returned 0x578 [0151.899] CanUserWritePwrScheme () returned 0 [0151.900] GetSystemMetrics (nIndex=46) returned 2 [0151.900] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.900] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.900] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.900] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.958] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.958] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.958] GetLastError () returned 0x578 [0151.958] CanUserWritePwrScheme () returned 0 [0151.959] GetSystemMetrics (nIndex=46) returned 2 [0151.959] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.959] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.959] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.959] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.970] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.970] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.970] GetLastError () returned 0x578 [0151.970] CanUserWritePwrScheme () returned 0 [0151.971] GetSystemMetrics (nIndex=46) returned 2 [0151.971] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.971] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.971] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.971] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.981] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.981] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.981] GetLastError () returned 0x578 [0151.982] CanUserWritePwrScheme () returned 0 [0151.982] GetSystemMetrics (nIndex=46) returned 2 [0151.982] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.982] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.982] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.982] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0151.993] GetWindowTextLengthA (hWnd=0x0) returned 0 [0151.993] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0151.993] GetLastError () returned 0x578 [0151.993] CanUserWritePwrScheme () returned 0 [0151.994] GetSystemMetrics (nIndex=46) returned 2 [0151.994] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0151.994] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0151.994] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0151.994] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.006] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.006] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.006] GetLastError () returned 0x578 [0152.006] CanUserWritePwrScheme () returned 0 [0152.007] GetSystemMetrics (nIndex=46) returned 2 [0152.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.007] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.007] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.007] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.020] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.020] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.020] GetLastError () returned 0x578 [0152.020] CanUserWritePwrScheme () returned 0 [0152.021] GetSystemMetrics (nIndex=46) returned 2 [0152.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.021] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.021] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.021] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.032] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.032] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.032] GetLastError () returned 0x578 [0152.032] CanUserWritePwrScheme () returned 0 [0152.033] GetSystemMetrics (nIndex=46) returned 2 [0152.033] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.033] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.033] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.033] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.044] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.044] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.044] GetLastError () returned 0x578 [0152.044] CanUserWritePwrScheme () returned 0 [0152.045] GetSystemMetrics (nIndex=46) returned 2 [0152.045] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.045] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.045] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.045] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.055] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.055] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.055] GetLastError () returned 0x578 [0152.055] CanUserWritePwrScheme () returned 0 [0152.056] GetSystemMetrics (nIndex=46) returned 2 [0152.056] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.056] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.056] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.056] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.067] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.067] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.067] GetLastError () returned 0x578 [0152.067] CanUserWritePwrScheme () returned 0 [0152.068] GetSystemMetrics (nIndex=46) returned 2 [0152.068] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.068] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.068] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.068] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.081] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.081] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.081] GetLastError () returned 0x578 [0152.081] CanUserWritePwrScheme () returned 0 [0152.082] GetSystemMetrics (nIndex=46) returned 2 [0152.082] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.082] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.082] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.082] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.093] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.093] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.093] GetLastError () returned 0x578 [0152.093] CanUserWritePwrScheme () returned 0 [0152.094] GetSystemMetrics (nIndex=46) returned 2 [0152.094] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.094] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.094] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.094] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.105] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.105] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.105] GetLastError () returned 0x578 [0152.105] CanUserWritePwrScheme () returned 0 [0152.106] GetSystemMetrics (nIndex=46) returned 2 [0152.106] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.106] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.106] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.106] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.117] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.117] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.117] GetLastError () returned 0x578 [0152.117] CanUserWritePwrScheme () returned 0 [0152.118] GetSystemMetrics (nIndex=46) returned 2 [0152.118] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.118] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.118] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.118] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.128] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.128] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.128] GetLastError () returned 0x578 [0152.128] CanUserWritePwrScheme () returned 0 [0152.129] GetSystemMetrics (nIndex=46) returned 2 [0152.129] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.129] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.129] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.129] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.143] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.143] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.143] GetLastError () returned 0x578 [0152.143] CanUserWritePwrScheme () returned 0 [0152.144] GetSystemMetrics (nIndex=46) returned 2 [0152.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.144] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.144] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.144] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.150] GetLastError () returned 0x578 [0152.150] CanUserWritePwrScheme () returned 0 [0152.151] GetSystemMetrics (nIndex=46) returned 2 [0152.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.151] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.151] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.151] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.156] GetLastError () returned 0x578 [0152.156] CanUserWritePwrScheme () returned 0 [0152.157] GetSystemMetrics (nIndex=46) returned 2 [0152.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.157] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.157] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.157] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.163] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.163] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.163] GetLastError () returned 0x578 [0152.163] CanUserWritePwrScheme () returned 0 [0152.164] GetSystemMetrics (nIndex=46) returned 2 [0152.164] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.164] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.164] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.164] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.175] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.175] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.175] GetLastError () returned 0x578 [0152.175] CanUserWritePwrScheme () returned 0 [0152.176] GetSystemMetrics (nIndex=46) returned 2 [0152.176] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.176] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.176] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.176] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.187] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.187] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.187] GetLastError () returned 0x578 [0152.187] CanUserWritePwrScheme () returned 0 [0152.188] GetSystemMetrics (nIndex=46) returned 2 [0152.188] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.188] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.188] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.188] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.199] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.199] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.199] GetLastError () returned 0x578 [0152.199] CanUserWritePwrScheme () returned 0 [0152.200] GetSystemMetrics (nIndex=46) returned 2 [0152.200] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.200] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.200] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.200] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.213] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.213] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.213] GetLastError () returned 0x578 [0152.213] CanUserWritePwrScheme () returned 0 [0152.214] GetSystemMetrics (nIndex=46) returned 2 [0152.214] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.214] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.214] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.214] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.225] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.225] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.225] GetLastError () returned 0x578 [0152.225] CanUserWritePwrScheme () returned 0 [0152.226] GetSystemMetrics (nIndex=46) returned 2 [0152.226] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.226] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.226] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.226] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.237] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.237] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.237] GetLastError () returned 0x578 [0152.237] CanUserWritePwrScheme () returned 0 [0152.238] GetSystemMetrics (nIndex=46) returned 2 [0152.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.238] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.238] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.238] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.249] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.249] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.249] GetLastError () returned 0x578 [0152.249] CanUserWritePwrScheme () returned 0 [0152.250] GetSystemMetrics (nIndex=46) returned 2 [0152.250] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.250] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.250] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.250] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.261] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.261] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.261] GetLastError () returned 0x578 [0152.261] CanUserWritePwrScheme () returned 0 [0152.262] GetSystemMetrics (nIndex=46) returned 2 [0152.262] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.262] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.262] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.262] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.275] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.275] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.275] GetLastError () returned 0x578 [0152.276] CanUserWritePwrScheme () returned 0 [0152.276] GetSystemMetrics (nIndex=46) returned 2 [0152.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.276] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.277] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.277] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.287] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.287] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.287] GetLastError () returned 0x578 [0152.288] CanUserWritePwrScheme () returned 0 [0152.288] GetSystemMetrics (nIndex=46) returned 2 [0152.288] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.288] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.288] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.288] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.299] GetLastError () returned 0x578 [0152.299] CanUserWritePwrScheme () returned 0 [0152.300] GetSystemMetrics (nIndex=46) returned 2 [0152.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.311] GetLastError () returned 0x578 [0152.311] CanUserWritePwrScheme () returned 0 [0152.312] GetSystemMetrics (nIndex=46) returned 2 [0152.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.323] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.323] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.323] GetLastError () returned 0x578 [0152.323] CanUserWritePwrScheme () returned 0 [0152.324] GetSystemMetrics (nIndex=46) returned 2 [0152.324] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.324] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.324] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.324] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.337] GetLastError () returned 0x578 [0152.337] CanUserWritePwrScheme () returned 0 [0152.338] GetSystemMetrics (nIndex=46) returned 2 [0152.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.338] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.338] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.338] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.349] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.349] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.349] GetLastError () returned 0x578 [0152.349] CanUserWritePwrScheme () returned 0 [0152.350] GetSystemMetrics (nIndex=46) returned 2 [0152.350] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.350] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.350] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.350] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.361] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.361] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.361] GetLastError () returned 0x578 [0152.361] CanUserWritePwrScheme () returned 0 [0152.362] GetSystemMetrics (nIndex=46) returned 2 [0152.362] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.362] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.362] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.362] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.373] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.373] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.373] GetLastError () returned 0x578 [0152.373] CanUserWritePwrScheme () returned 0 [0152.374] GetSystemMetrics (nIndex=46) returned 2 [0152.374] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.374] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.374] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.374] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.387] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.387] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.387] GetLastError () returned 0x578 [0152.388] CanUserWritePwrScheme () returned 0 [0152.388] GetSystemMetrics (nIndex=46) returned 2 [0152.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.388] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.388] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.388] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.406] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.406] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.406] GetLastError () returned 0x578 [0152.406] CanUserWritePwrScheme () returned 0 [0152.407] GetSystemMetrics (nIndex=46) returned 2 [0152.407] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.407] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.407] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.407] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.418] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.418] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.418] GetLastError () returned 0x578 [0152.418] CanUserWritePwrScheme () returned 0 [0152.419] GetSystemMetrics (nIndex=46) returned 2 [0152.419] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.419] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.419] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.419] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.430] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.430] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.430] GetLastError () returned 0x578 [0152.430] CanUserWritePwrScheme () returned 0 [0152.431] GetSystemMetrics (nIndex=46) returned 2 [0152.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.442] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.442] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.442] GetLastError () returned 0x578 [0152.442] CanUserWritePwrScheme () returned 0 [0152.443] GetSystemMetrics (nIndex=46) returned 2 [0152.443] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.443] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.443] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.443] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.454] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.454] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.454] GetLastError () returned 0x578 [0152.454] CanUserWritePwrScheme () returned 0 [0152.455] GetSystemMetrics (nIndex=46) returned 2 [0152.455] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.455] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.455] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.455] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.468] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.468] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.468] GetLastError () returned 0x578 [0152.468] CanUserWritePwrScheme () returned 0 [0152.469] GetSystemMetrics (nIndex=46) returned 2 [0152.469] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.469] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.469] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.469] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.480] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.480] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.480] GetLastError () returned 0x578 [0152.480] CanUserWritePwrScheme () returned 0 [0152.481] GetSystemMetrics (nIndex=46) returned 2 [0152.481] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.481] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.481] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.481] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.492] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.492] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.492] GetLastError () returned 0x578 [0152.492] CanUserWritePwrScheme () returned 0 [0152.493] GetSystemMetrics (nIndex=46) returned 2 [0152.493] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.493] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.493] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.493] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.503] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.503] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.503] GetLastError () returned 0x578 [0152.503] CanUserWritePwrScheme () returned 0 [0152.504] GetSystemMetrics (nIndex=46) returned 2 [0152.504] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.504] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.504] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.504] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.515] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.515] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.515] GetLastError () returned 0x578 [0152.515] CanUserWritePwrScheme () returned 0 [0152.516] GetSystemMetrics (nIndex=46) returned 2 [0152.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.527] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.527] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.527] GetLastError () returned 0x578 [0152.527] CanUserWritePwrScheme () returned 0 [0152.528] GetSystemMetrics (nIndex=46) returned 2 [0152.528] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.528] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.528] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.528] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.541] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.541] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.541] GetLastError () returned 0x578 [0152.541] CanUserWritePwrScheme () returned 0 [0152.542] GetSystemMetrics (nIndex=46) returned 2 [0152.542] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.542] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.542] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.542] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.553] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.553] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.553] GetLastError () returned 0x578 [0152.553] CanUserWritePwrScheme () returned 0 [0152.554] GetSystemMetrics (nIndex=46) returned 2 [0152.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.554] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.554] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.554] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.565] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.565] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.565] GetLastError () returned 0x578 [0152.565] CanUserWritePwrScheme () returned 0 [0152.566] GetSystemMetrics (nIndex=46) returned 2 [0152.566] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.566] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.566] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.566] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.577] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.577] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.577] GetLastError () returned 0x578 [0152.577] CanUserWritePwrScheme () returned 0 [0152.578] GetSystemMetrics (nIndex=46) returned 2 [0152.578] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.578] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.578] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.578] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.588] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.588] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.588] GetLastError () returned 0x578 [0152.588] CanUserWritePwrScheme () returned 0 [0152.589] GetSystemMetrics (nIndex=46) returned 2 [0152.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.602] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.602] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.602] GetLastError () returned 0x578 [0152.602] CanUserWritePwrScheme () returned 0 [0152.603] GetSystemMetrics (nIndex=46) returned 2 [0152.603] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.603] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.604] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.604] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.675] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.675] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.675] GetLastError () returned 0x578 [0152.675] CanUserWritePwrScheme () returned 0 [0152.676] GetSystemMetrics (nIndex=46) returned 2 [0152.676] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.676] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.676] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.676] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.687] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.687] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.687] GetLastError () returned 0x578 [0152.687] CanUserWritePwrScheme () returned 0 [0152.688] GetSystemMetrics (nIndex=46) returned 2 [0152.688] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.688] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.688] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.688] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.698] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.698] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.698] GetLastError () returned 0x578 [0152.698] CanUserWritePwrScheme () returned 0 [0152.699] GetSystemMetrics (nIndex=46) returned 2 [0152.699] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.699] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.699] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.699] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.710] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.710] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.710] GetLastError () returned 0x578 [0152.710] CanUserWritePwrScheme () returned 0 [0152.711] GetSystemMetrics (nIndex=46) returned 2 [0152.711] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.711] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.711] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.711] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.722] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.722] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.722] GetLastError () returned 0x578 [0152.722] CanUserWritePwrScheme () returned 0 [0152.723] GetSystemMetrics (nIndex=46) returned 2 [0152.723] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.723] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.723] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.723] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.737] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.737] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.737] GetLastError () returned 0x578 [0152.737] CanUserWritePwrScheme () returned 0 [0152.738] GetSystemMetrics (nIndex=46) returned 2 [0152.738] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.738] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.738] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.738] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.749] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.749] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.749] GetLastError () returned 0x578 [0152.749] CanUserWritePwrScheme () returned 0 [0152.750] GetSystemMetrics (nIndex=46) returned 2 [0152.750] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.750] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.750] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.750] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.761] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.761] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.761] GetLastError () returned 0x578 [0152.761] CanUserWritePwrScheme () returned 0 [0152.762] GetSystemMetrics (nIndex=46) returned 2 [0152.762] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.762] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.762] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.762] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.772] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.772] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.772] GetLastError () returned 0x578 [0152.772] CanUserWritePwrScheme () returned 0 [0152.773] GetSystemMetrics (nIndex=46) returned 2 [0152.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.773] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.773] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.778] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.778] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.778] GetLastError () returned 0x578 [0152.778] CanUserWritePwrScheme () returned 0 [0152.779] GetSystemMetrics (nIndex=46) returned 2 [0152.779] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.779] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.779] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.779] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.784] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.784] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.784] GetLastError () returned 0x578 [0152.784] CanUserWritePwrScheme () returned 0 [0152.785] GetSystemMetrics (nIndex=46) returned 2 [0152.785] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.785] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.785] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.785] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.792] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.792] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.792] GetLastError () returned 0x578 [0152.792] CanUserWritePwrScheme () returned 0 [0152.793] GetSystemMetrics (nIndex=46) returned 2 [0152.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.793] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.793] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.793] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.798] GetLastError () returned 0x578 [0152.798] CanUserWritePwrScheme () returned 0 [0152.799] GetSystemMetrics (nIndex=46) returned 2 [0152.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.799] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.799] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.799] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.804] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.804] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.804] GetLastError () returned 0x578 [0152.804] CanUserWritePwrScheme () returned 0 [0152.805] GetSystemMetrics (nIndex=46) returned 2 [0152.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.810] GetLastError () returned 0x578 [0152.810] CanUserWritePwrScheme () returned 0 [0152.811] GetSystemMetrics (nIndex=46) returned 2 [0152.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.816] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.816] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.816] GetLastError () returned 0x578 [0152.816] CanUserWritePwrScheme () returned 0 [0152.817] GetSystemMetrics (nIndex=46) returned 2 [0152.817] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.817] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.817] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.817] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.821] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.821] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.822] GetLastError () returned 0x578 [0152.822] CanUserWritePwrScheme () returned 0 [0152.823] GetSystemMetrics (nIndex=46) returned 2 [0152.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.828] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.828] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.828] GetLastError () returned 0x578 [0152.828] CanUserWritePwrScheme () returned 0 [0152.829] GetSystemMetrics (nIndex=46) returned 2 [0152.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.829] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.829] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.829] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.839] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.839] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.839] GetLastError () returned 0x578 [0152.839] CanUserWritePwrScheme () returned 0 [0152.840] GetSystemMetrics (nIndex=46) returned 2 [0152.840] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.840] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.840] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.840] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.851] GetLastError () returned 0x578 [0152.851] CanUserWritePwrScheme () returned 0 [0152.852] GetSystemMetrics (nIndex=46) returned 2 [0152.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.852] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.852] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.852] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.866] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.866] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.866] GetLastError () returned 0x578 [0152.866] CanUserWritePwrScheme () returned 0 [0152.867] GetSystemMetrics (nIndex=46) returned 2 [0152.867] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.867] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.867] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.867] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.877] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.877] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.877] GetLastError () returned 0x578 [0152.877] CanUserWritePwrScheme () returned 0 [0152.878] GetSystemMetrics (nIndex=46) returned 2 [0152.878] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.878] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.878] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.878] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.889] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.889] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.889] GetLastError () returned 0x578 [0152.889] CanUserWritePwrScheme () returned 0 [0152.890] GetSystemMetrics (nIndex=46) returned 2 [0152.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.890] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.904] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.904] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.904] GetLastError () returned 0x578 [0152.904] CanUserWritePwrScheme () returned 0 [0152.905] GetSystemMetrics (nIndex=46) returned 2 [0152.905] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.905] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.905] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.905] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.916] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.916] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.916] GetLastError () returned 0x578 [0152.916] CanUserWritePwrScheme () returned 0 [0152.917] GetSystemMetrics (nIndex=46) returned 2 [0152.917] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.917] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.917] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.917] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.931] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.931] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.931] GetLastError () returned 0x578 [0152.931] CanUserWritePwrScheme () returned 0 [0152.932] GetSystemMetrics (nIndex=46) returned 2 [0152.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.932] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.932] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.932] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.944] GetLastError () returned 0x578 [0152.944] CanUserWritePwrScheme () returned 0 [0152.945] GetSystemMetrics (nIndex=46) returned 2 [0152.945] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.945] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.945] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.945] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.956] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.956] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.956] GetLastError () returned 0x578 [0152.956] CanUserWritePwrScheme () returned 0 [0152.957] GetSystemMetrics (nIndex=46) returned 2 [0152.957] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.957] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.957] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.957] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.967] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.967] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.967] GetLastError () returned 0x578 [0152.967] CanUserWritePwrScheme () returned 0 [0152.968] GetSystemMetrics (nIndex=46) returned 2 [0152.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.979] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.979] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.979] GetLastError () returned 0x578 [0152.979] CanUserWritePwrScheme () returned 0 [0152.980] GetSystemMetrics (nIndex=46) returned 2 [0152.980] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.980] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.980] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.980] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0152.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0152.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0152.994] GetLastError () returned 0x578 [0152.994] CanUserWritePwrScheme () returned 0 [0152.995] GetSystemMetrics (nIndex=46) returned 2 [0152.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0152.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0152.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0152.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.006] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.006] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.006] GetLastError () returned 0x578 [0153.006] CanUserWritePwrScheme () returned 0 [0153.007] GetSystemMetrics (nIndex=46) returned 2 [0153.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.007] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.007] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.007] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.017] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.017] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.018] GetLastError () returned 0x578 [0153.018] CanUserWritePwrScheme () returned 0 [0153.018] GetSystemMetrics (nIndex=46) returned 2 [0153.018] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.019] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.029] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.029] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.029] GetLastError () returned 0x578 [0153.029] CanUserWritePwrScheme () returned 0 [0153.030] GetSystemMetrics (nIndex=46) returned 2 [0153.030] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.030] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.030] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.030] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.041] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.041] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.041] GetLastError () returned 0x578 [0153.041] CanUserWritePwrScheme () returned 0 [0153.042] GetSystemMetrics (nIndex=46) returned 2 [0153.042] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.042] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.042] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.042] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.056] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.056] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.056] GetLastError () returned 0x578 [0153.056] CanUserWritePwrScheme () returned 0 [0153.057] GetSystemMetrics (nIndex=46) returned 2 [0153.057] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.057] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.057] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.057] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.067] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.067] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.067] GetLastError () returned 0x578 [0153.067] CanUserWritePwrScheme () returned 0 [0153.068] GetSystemMetrics (nIndex=46) returned 2 [0153.068] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.068] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.068] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.068] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.079] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.079] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.079] GetLastError () returned 0x578 [0153.079] CanUserWritePwrScheme () returned 0 [0153.080] GetSystemMetrics (nIndex=46) returned 2 [0153.080] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.080] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.080] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.080] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.090] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.090] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.090] GetLastError () returned 0x578 [0153.090] CanUserWritePwrScheme () returned 0 [0153.091] GetSystemMetrics (nIndex=46) returned 2 [0153.091] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.091] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.091] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.091] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.102] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.102] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.102] GetLastError () returned 0x578 [0153.102] CanUserWritePwrScheme () returned 0 [0153.103] GetSystemMetrics (nIndex=46) returned 2 [0153.103] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.103] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.103] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.103] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.114] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.114] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.114] GetLastError () returned 0x578 [0153.114] CanUserWritePwrScheme () returned 0 [0153.115] GetSystemMetrics (nIndex=46) returned 2 [0153.115] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.115] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.115] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.115] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.128] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.128] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.128] GetLastError () returned 0x578 [0153.128] CanUserWritePwrScheme () returned 0 [0153.129] GetSystemMetrics (nIndex=46) returned 2 [0153.129] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.129] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.129] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.129] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.140] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.140] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.140] GetLastError () returned 0x578 [0153.140] CanUserWritePwrScheme () returned 0 [0153.141] GetSystemMetrics (nIndex=46) returned 2 [0153.141] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.141] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.141] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.141] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.151] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.151] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.151] GetLastError () returned 0x578 [0153.151] CanUserWritePwrScheme () returned 0 [0153.152] GetSystemMetrics (nIndex=46) returned 2 [0153.152] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.152] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.152] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.152] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.163] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.163] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.163] GetLastError () returned 0x578 [0153.163] CanUserWritePwrScheme () returned 0 [0153.164] GetSystemMetrics (nIndex=46) returned 2 [0153.164] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.164] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.164] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.164] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.174] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.174] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.174] GetLastError () returned 0x578 [0153.174] CanUserWritePwrScheme () returned 0 [0153.175] GetSystemMetrics (nIndex=46) returned 2 [0153.175] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.175] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.175] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.175] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.189] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.189] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.189] GetLastError () returned 0x578 [0153.189] CanUserWritePwrScheme () returned 0 [0153.190] GetSystemMetrics (nIndex=46) returned 2 [0153.190] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.190] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.190] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.190] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.201] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.201] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.201] GetLastError () returned 0x578 [0153.201] CanUserWritePwrScheme () returned 0 [0153.202] GetSystemMetrics (nIndex=46) returned 2 [0153.202] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.202] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.202] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.202] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.212] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.212] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.212] GetLastError () returned 0x578 [0153.212] CanUserWritePwrScheme () returned 0 [0153.213] GetSystemMetrics (nIndex=46) returned 2 [0153.213] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.213] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.213] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.213] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.224] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.224] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.224] GetLastError () returned 0x578 [0153.224] CanUserWritePwrScheme () returned 0 [0153.225] GetSystemMetrics (nIndex=46) returned 2 [0153.225] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.225] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.225] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.225] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.235] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.235] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.235] GetLastError () returned 0x578 [0153.235] CanUserWritePwrScheme () returned 0 [0153.236] GetSystemMetrics (nIndex=46) returned 2 [0153.236] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.236] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.236] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.236] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.250] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.250] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.250] GetLastError () returned 0x578 [0153.250] CanUserWritePwrScheme () returned 0 [0153.251] GetSystemMetrics (nIndex=46) returned 2 [0153.251] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.251] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.251] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.251] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.261] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.261] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.261] GetLastError () returned 0x578 [0153.261] CanUserWritePwrScheme () returned 0 [0153.262] GetSystemMetrics (nIndex=46) returned 2 [0153.262] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.262] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.262] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.262] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.273] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.273] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.273] GetLastError () returned 0x578 [0153.273] CanUserWritePwrScheme () returned 0 [0153.274] GetSystemMetrics (nIndex=46) returned 2 [0153.274] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.274] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.274] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.274] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.283] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.283] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.283] GetLastError () returned 0x578 [0153.283] CanUserWritePwrScheme () returned 0 [0153.284] GetSystemMetrics (nIndex=46) returned 2 [0153.284] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.284] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.284] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.284] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.289] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.289] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.289] GetLastError () returned 0x578 [0153.289] CanUserWritePwrScheme () returned 0 [0153.290] GetSystemMetrics (nIndex=46) returned 2 [0153.290] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.290] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.290] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.290] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.295] GetLastError () returned 0x578 [0153.295] CanUserWritePwrScheme () returned 0 [0153.296] GetSystemMetrics (nIndex=46) returned 2 [0153.296] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.296] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.296] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.296] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.301] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.301] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.301] GetLastError () returned 0x578 [0153.301] CanUserWritePwrScheme () returned 0 [0153.302] GetSystemMetrics (nIndex=46) returned 2 [0153.302] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.302] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.302] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.302] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.307] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.307] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.307] GetLastError () returned 0x578 [0153.307] CanUserWritePwrScheme () returned 0 [0153.308] GetSystemMetrics (nIndex=46) returned 2 [0153.308] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.308] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.308] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.308] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.316] GetLastError () returned 0x578 [0153.316] CanUserWritePwrScheme () returned 0 [0153.317] GetSystemMetrics (nIndex=46) returned 2 [0153.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.322] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.322] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.322] GetLastError () returned 0x578 [0153.322] CanUserWritePwrScheme () returned 0 [0153.323] GetSystemMetrics (nIndex=46) returned 2 [0153.323] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.323] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.323] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.323] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.328] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.328] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.328] GetLastError () returned 0x578 [0153.328] CanUserWritePwrScheme () returned 0 [0153.329] GetSystemMetrics (nIndex=46) returned 2 [0153.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.334] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.334] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.334] GetLastError () returned 0x578 [0153.334] CanUserWritePwrScheme () returned 0 [0153.335] GetSystemMetrics (nIndex=46) returned 2 [0153.335] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.335] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.335] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.335] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.340] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.340] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.340] GetLastError () returned 0x578 [0153.340] CanUserWritePwrScheme () returned 0 [0153.341] GetSystemMetrics (nIndex=46) returned 2 [0153.341] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.341] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.341] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.341] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.346] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.346] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.346] GetLastError () returned 0x578 [0153.346] CanUserWritePwrScheme () returned 0 [0153.347] GetSystemMetrics (nIndex=46) returned 2 [0153.347] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.347] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.347] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.347] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.352] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.352] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.352] GetLastError () returned 0x578 [0153.352] CanUserWritePwrScheme () returned 0 [0153.353] GetSystemMetrics (nIndex=46) returned 2 [0153.353] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.353] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.353] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.353] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.358] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.358] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.358] GetLastError () returned 0x578 [0153.358] CanUserWritePwrScheme () returned 0 [0153.359] GetSystemMetrics (nIndex=46) returned 2 [0153.359] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.359] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.359] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.359] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.365] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.365] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.365] GetLastError () returned 0x578 [0153.365] CanUserWritePwrScheme () returned 0 [0153.366] GetSystemMetrics (nIndex=46) returned 2 [0153.366] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.366] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.366] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.366] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.380] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.380] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.380] GetLastError () returned 0x578 [0153.380] CanUserWritePwrScheme () returned 0 [0153.381] GetSystemMetrics (nIndex=46) returned 2 [0153.381] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.381] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.381] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.381] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.392] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.392] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.392] GetLastError () returned 0x578 [0153.392] CanUserWritePwrScheme () returned 0 [0153.393] GetSystemMetrics (nIndex=46) returned 2 [0153.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.393] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.393] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.393] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.443] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.443] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.443] GetLastError () returned 0x578 [0153.443] CanUserWritePwrScheme () returned 0 [0153.444] GetSystemMetrics (nIndex=46) returned 2 [0153.444] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.444] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.444] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.444] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.456] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.456] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.456] GetLastError () returned 0x578 [0153.456] CanUserWritePwrScheme () returned 0 [0153.457] GetSystemMetrics (nIndex=46) returned 2 [0153.457] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.457] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.457] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.457] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.467] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.467] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.467] GetLastError () returned 0x578 [0153.467] CanUserWritePwrScheme () returned 0 [0153.468] GetSystemMetrics (nIndex=46) returned 2 [0153.468] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.468] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.468] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.468] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.479] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.479] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.479] GetLastError () returned 0x578 [0153.479] CanUserWritePwrScheme () returned 0 [0153.480] GetSystemMetrics (nIndex=46) returned 2 [0153.480] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.480] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.480] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.480] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.490] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.490] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.490] GetLastError () returned 0x578 [0153.491] CanUserWritePwrScheme () returned 0 [0153.491] GetSystemMetrics (nIndex=46) returned 2 [0153.491] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.491] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.491] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.491] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.502] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.502] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.502] GetLastError () returned 0x578 [0153.502] CanUserWritePwrScheme () returned 0 [0153.503] GetSystemMetrics (nIndex=46) returned 2 [0153.503] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.503] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.503] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.503] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.517] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.517] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.517] GetLastError () returned 0x578 [0153.517] CanUserWritePwrScheme () returned 0 [0153.518] GetSystemMetrics (nIndex=46) returned 2 [0153.518] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.518] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.518] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.518] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.529] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.529] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.529] GetLastError () returned 0x578 [0153.529] CanUserWritePwrScheme () returned 0 [0153.530] GetSystemMetrics (nIndex=46) returned 2 [0153.530] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.530] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.530] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.530] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.541] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.541] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.541] GetLastError () returned 0x578 [0153.541] CanUserWritePwrScheme () returned 0 [0153.542] GetSystemMetrics (nIndex=46) returned 2 [0153.542] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.542] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.542] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.542] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.553] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.553] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.554] GetLastError () returned 0x578 [0153.554] CanUserWritePwrScheme () returned 0 [0153.554] GetSystemMetrics (nIndex=46) returned 2 [0153.555] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.555] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.555] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.555] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.566] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.566] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.566] GetLastError () returned 0x578 [0153.566] CanUserWritePwrScheme () returned 0 [0153.567] GetSystemMetrics (nIndex=46) returned 2 [0153.567] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.567] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.567] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.567] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.581] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.581] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.581] GetLastError () returned 0x578 [0153.581] CanUserWritePwrScheme () returned 0 [0153.582] GetSystemMetrics (nIndex=46) returned 2 [0153.582] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.582] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.582] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.582] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.593] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.593] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.593] GetLastError () returned 0x578 [0153.593] CanUserWritePwrScheme () returned 0 [0153.594] GetSystemMetrics (nIndex=46) returned 2 [0153.594] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.594] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.594] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.594] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.605] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.605] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.605] GetLastError () returned 0x578 [0153.605] CanUserWritePwrScheme () returned 0 [0153.606] GetSystemMetrics (nIndex=46) returned 2 [0153.606] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.606] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.606] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.606] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.617] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.617] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.617] GetLastError () returned 0x578 [0153.617] CanUserWritePwrScheme () returned 0 [0153.618] GetSystemMetrics (nIndex=46) returned 2 [0153.618] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.618] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.618] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.618] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.628] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.629] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.629] GetLastError () returned 0x578 [0153.629] CanUserWritePwrScheme () returned 0 [0153.629] GetSystemMetrics (nIndex=46) returned 2 [0153.629] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.630] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.630] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.630] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.644] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.644] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.644] GetLastError () returned 0x578 [0153.644] CanUserWritePwrScheme () returned 0 [0153.645] GetSystemMetrics (nIndex=46) returned 2 [0153.645] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.645] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.645] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.645] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.656] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.656] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.656] GetLastError () returned 0x578 [0153.656] CanUserWritePwrScheme () returned 0 [0153.657] GetSystemMetrics (nIndex=46) returned 2 [0153.657] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.657] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.657] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.657] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.668] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.668] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.668] GetLastError () returned 0x578 [0153.668] CanUserWritePwrScheme () returned 0 [0153.669] GetSystemMetrics (nIndex=46) returned 2 [0153.669] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.669] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.669] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.669] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.679] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.679] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.679] GetLastError () returned 0x578 [0153.680] CanUserWritePwrScheme () returned 0 [0153.680] GetSystemMetrics (nIndex=46) returned 2 [0153.680] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.680] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.680] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.680] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.691] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.691] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.691] GetLastError () returned 0x578 [0153.691] CanUserWritePwrScheme () returned 0 [0153.692] GetSystemMetrics (nIndex=46) returned 2 [0153.692] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.692] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.692] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.692] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.706] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.706] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.706] GetLastError () returned 0x578 [0153.706] CanUserWritePwrScheme () returned 0 [0153.707] GetSystemMetrics (nIndex=46) returned 2 [0153.707] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.707] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.707] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.707] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.717] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.717] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.717] GetLastError () returned 0x578 [0153.717] CanUserWritePwrScheme () returned 0 [0153.718] GetSystemMetrics (nIndex=46) returned 2 [0153.718] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.718] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.718] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.718] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.729] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.729] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.729] GetLastError () returned 0x578 [0153.729] CanUserWritePwrScheme () returned 0 [0153.730] GetSystemMetrics (nIndex=46) returned 2 [0153.730] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.730] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.730] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.730] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.741] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.741] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.741] GetLastError () returned 0x578 [0153.741] CanUserWritePwrScheme () returned 0 [0153.741] GetSystemMetrics (nIndex=46) returned 2 [0153.742] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.742] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.742] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.742] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.752] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.752] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.752] GetLastError () returned 0x578 [0153.752] CanUserWritePwrScheme () returned 0 [0153.753] GetSystemMetrics (nIndex=46) returned 2 [0153.753] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.753] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.753] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.753] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.764] GetLastError () returned 0x578 [0153.764] CanUserWritePwrScheme () returned 0 [0153.765] GetSystemMetrics (nIndex=46) returned 2 [0153.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.765] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.765] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.765] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.779] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.779] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.779] GetLastError () returned 0x578 [0153.779] CanUserWritePwrScheme () returned 0 [0153.780] GetSystemMetrics (nIndex=46) returned 2 [0153.780] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.780] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.780] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.780] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.791] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.791] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.791] GetLastError () returned 0x578 [0153.791] CanUserWritePwrScheme () returned 0 [0153.792] GetSystemMetrics (nIndex=46) returned 2 [0153.792] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.792] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.792] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.792] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.802] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.802] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.802] GetLastError () returned 0x578 [0153.802] CanUserWritePwrScheme () returned 0 [0153.803] GetSystemMetrics (nIndex=46) returned 2 [0153.803] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.803] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.803] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.803] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.814] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.814] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.814] GetLastError () returned 0x578 [0153.814] CanUserWritePwrScheme () returned 0 [0153.815] GetSystemMetrics (nIndex=46) returned 2 [0153.815] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.815] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.815] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.815] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.826] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.826] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.826] GetLastError () returned 0x578 [0153.826] CanUserWritePwrScheme () returned 0 [0153.827] GetSystemMetrics (nIndex=46) returned 2 [0153.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.827] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.827] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.827] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.841] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.841] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.841] GetLastError () returned 0x578 [0153.841] CanUserWritePwrScheme () returned 0 [0153.842] GetSystemMetrics (nIndex=46) returned 2 [0153.842] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.842] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.842] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.842] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.853] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.853] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.853] GetLastError () returned 0x578 [0153.853] CanUserWritePwrScheme () returned 0 [0153.854] GetSystemMetrics (nIndex=46) returned 2 [0153.854] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.854] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.854] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.854] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.864] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.864] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.864] GetLastError () returned 0x578 [0153.864] CanUserWritePwrScheme () returned 0 [0153.865] GetSystemMetrics (nIndex=46) returned 2 [0153.865] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.865] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.865] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.865] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.877] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.877] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.877] GetLastError () returned 0x578 [0153.877] CanUserWritePwrScheme () returned 0 [0153.878] GetSystemMetrics (nIndex=46) returned 2 [0153.878] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.878] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.878] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.878] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.889] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.889] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.889] GetLastError () returned 0x578 [0153.889] CanUserWritePwrScheme () returned 0 [0153.890] GetSystemMetrics (nIndex=46) returned 2 [0153.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.890] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.903] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.903] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.903] GetLastError () returned 0x578 [0153.903] CanUserWritePwrScheme () returned 0 [0153.904] GetSystemMetrics (nIndex=46) returned 2 [0153.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.904] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.904] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.904] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.915] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.915] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.915] GetLastError () returned 0x578 [0153.915] CanUserWritePwrScheme () returned 0 [0153.916] GetSystemMetrics (nIndex=46) returned 2 [0153.916] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.916] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.916] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.916] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.927] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.927] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.927] GetLastError () returned 0x578 [0153.927] CanUserWritePwrScheme () returned 0 [0153.928] GetSystemMetrics (nIndex=46) returned 2 [0153.928] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.928] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.928] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.928] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.939] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.939] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.939] GetLastError () returned 0x578 [0153.939] CanUserWritePwrScheme () returned 0 [0153.940] GetSystemMetrics (nIndex=46) returned 2 [0153.940] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.940] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.940] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.940] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.951] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.951] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.951] GetLastError () returned 0x578 [0153.951] CanUserWritePwrScheme () returned 0 [0153.952] GetSystemMetrics (nIndex=46) returned 2 [0153.952] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.952] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.952] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.952] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.966] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.966] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.966] GetLastError () returned 0x578 [0153.966] CanUserWritePwrScheme () returned 0 [0153.967] GetSystemMetrics (nIndex=46) returned 2 [0153.967] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.967] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.967] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.967] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.978] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.978] GetLastError () returned 0x578 [0153.978] CanUserWritePwrScheme () returned 0 [0153.979] GetSystemMetrics (nIndex=46) returned 2 [0153.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.979] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.979] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.979] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0153.989] GetWindowTextLengthA (hWnd=0x0) returned 0 [0153.990] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0153.990] GetLastError () returned 0x578 [0153.990] CanUserWritePwrScheme () returned 0 [0153.991] GetSystemMetrics (nIndex=46) returned 2 [0153.991] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0153.991] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0153.991] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0153.991] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.001] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.001] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.001] GetLastError () returned 0x578 [0154.001] CanUserWritePwrScheme () returned 0 [0154.002] GetSystemMetrics (nIndex=46) returned 2 [0154.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.002] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.002] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.002] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.013] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.013] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.013] GetLastError () returned 0x578 [0154.013] CanUserWritePwrScheme () returned 0 [0154.014] GetSystemMetrics (nIndex=46) returned 2 [0154.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.025] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.025] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.025] GetLastError () returned 0x578 [0154.025] CanUserWritePwrScheme () returned 0 [0154.028] GetSystemMetrics (nIndex=46) returned 2 [0154.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.029] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.029] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.029] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.039] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.040] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.040] GetLastError () returned 0x578 [0154.040] CanUserWritePwrScheme () returned 0 [0154.040] GetSystemMetrics (nIndex=46) returned 2 [0154.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.051] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.051] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.051] GetLastError () returned 0x578 [0154.051] CanUserWritePwrScheme () returned 0 [0154.052] GetSystemMetrics (nIndex=46) returned 2 [0154.052] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.052] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.052] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.052] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.063] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.063] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.063] GetLastError () returned 0x578 [0154.063] CanUserWritePwrScheme () returned 0 [0154.064] GetSystemMetrics (nIndex=46) returned 2 [0154.064] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.064] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.064] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.064] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.075] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.075] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.075] GetLastError () returned 0x578 [0154.075] CanUserWritePwrScheme () returned 0 [0154.076] GetSystemMetrics (nIndex=46) returned 2 [0154.076] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.076] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.076] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.076] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.087] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.087] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.087] GetLastError () returned 0x578 [0154.087] CanUserWritePwrScheme () returned 0 [0154.088] GetSystemMetrics (nIndex=46) returned 2 [0154.088] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.088] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.088] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.088] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.102] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.102] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.102] GetLastError () returned 0x578 [0154.102] CanUserWritePwrScheme () returned 0 [0154.103] GetSystemMetrics (nIndex=46) returned 2 [0154.103] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.103] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.103] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.103] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.113] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.113] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.113] GetLastError () returned 0x578 [0154.113] CanUserWritePwrScheme () returned 0 [0154.114] GetSystemMetrics (nIndex=46) returned 2 [0154.114] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.114] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.114] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.114] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.125] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.125] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.125] GetLastError () returned 0x578 [0154.125] CanUserWritePwrScheme () returned 0 [0154.126] GetSystemMetrics (nIndex=46) returned 2 [0154.126] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.126] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.126] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.126] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.137] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.137] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.137] GetLastError () returned 0x578 [0154.137] CanUserWritePwrScheme () returned 0 [0154.138] GetSystemMetrics (nIndex=46) returned 2 [0154.138] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.138] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.138] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.138] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.149] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.149] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.149] GetLastError () returned 0x578 [0154.149] CanUserWritePwrScheme () returned 0 [0154.150] GetSystemMetrics (nIndex=46) returned 2 [0154.150] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.150] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.150] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.150] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.163] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.163] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.163] GetLastError () returned 0x578 [0154.163] CanUserWritePwrScheme () returned 0 [0154.164] GetSystemMetrics (nIndex=46) returned 2 [0154.164] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.164] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.164] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.164] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.175] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.175] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.175] GetLastError () returned 0x578 [0154.175] CanUserWritePwrScheme () returned 0 [0154.176] GetSystemMetrics (nIndex=46) returned 2 [0154.176] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.176] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.176] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.176] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.187] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.187] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.187] GetLastError () returned 0x578 [0154.187] CanUserWritePwrScheme () returned 0 [0154.188] GetSystemMetrics (nIndex=46) returned 2 [0154.188] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.188] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.188] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.188] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.199] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.199] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.199] GetLastError () returned 0x578 [0154.199] CanUserWritePwrScheme () returned 0 [0154.199] GetSystemMetrics (nIndex=46) returned 2 [0154.200] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.200] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.200] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.200] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.210] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.210] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.210] GetLastError () returned 0x578 [0154.210] CanUserWritePwrScheme () returned 0 [0154.211] GetSystemMetrics (nIndex=46) returned 2 [0154.211] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.211] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.211] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.211] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.224] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.224] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.225] GetLastError () returned 0x578 [0154.225] CanUserWritePwrScheme () returned 0 [0154.225] GetSystemMetrics (nIndex=46) returned 2 [0154.225] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.225] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.225] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.226] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.236] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.236] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.236] GetLastError () returned 0x578 [0154.236] CanUserWritePwrScheme () returned 0 [0154.237] GetSystemMetrics (nIndex=46) returned 2 [0154.237] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.237] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.237] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.237] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.248] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.248] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.248] GetLastError () returned 0x578 [0154.248] CanUserWritePwrScheme () returned 0 [0154.249] GetSystemMetrics (nIndex=46) returned 2 [0154.249] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.249] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.249] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.249] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.260] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.260] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.260] GetLastError () returned 0x578 [0154.260] CanUserWritePwrScheme () returned 0 [0154.261] GetSystemMetrics (nIndex=46) returned 2 [0154.261] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.261] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.261] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.261] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.272] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.272] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.272] GetLastError () returned 0x578 [0154.272] CanUserWritePwrScheme () returned 0 [0154.273] GetSystemMetrics (nIndex=46) returned 2 [0154.273] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.273] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.273] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.273] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.284] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.284] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.284] GetLastError () returned 0x578 [0154.284] CanUserWritePwrScheme () returned 0 [0154.285] GetSystemMetrics (nIndex=46) returned 2 [0154.285] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.285] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.285] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.285] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.298] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.298] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.298] GetLastError () returned 0x578 [0154.298] CanUserWritePwrScheme () returned 0 [0154.299] GetSystemMetrics (nIndex=46) returned 2 [0154.299] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.299] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.299] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.299] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.310] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.310] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.310] GetLastError () returned 0x578 [0154.310] CanUserWritePwrScheme () returned 0 [0154.311] GetSystemMetrics (nIndex=46) returned 2 [0154.311] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.311] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.311] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.311] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.341] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.341] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.341] GetLastError () returned 0x578 [0154.341] CanUserWritePwrScheme () returned 0 [0154.342] GetSystemMetrics (nIndex=46) returned 2 [0154.342] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.342] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.342] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.342] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.363] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.363] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.363] GetLastError () returned 0x578 [0154.363] CanUserWritePwrScheme () returned 0 [0154.364] GetSystemMetrics (nIndex=46) returned 2 [0154.364] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.364] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.364] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.364] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.375] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.375] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.375] GetLastError () returned 0x578 [0154.375] CanUserWritePwrScheme () returned 0 [0154.376] GetSystemMetrics (nIndex=46) returned 2 [0154.376] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.376] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.376] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.376] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.388] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.388] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.388] GetLastError () returned 0x578 [0154.388] CanUserWritePwrScheme () returned 0 [0154.389] GetSystemMetrics (nIndex=46) returned 2 [0154.389] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.389] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.389] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.389] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.407] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.407] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.407] GetLastError () returned 0x578 [0154.407] CanUserWritePwrScheme () returned 0 [0154.408] GetSystemMetrics (nIndex=46) returned 2 [0154.408] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.408] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.408] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.408] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.420] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.420] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.420] GetLastError () returned 0x578 [0154.420] CanUserWritePwrScheme () returned 0 [0154.421] GetSystemMetrics (nIndex=46) returned 2 [0154.421] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.421] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.421] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.421] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.432] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.432] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.432] GetLastError () returned 0x578 [0154.432] CanUserWritePwrScheme () returned 0 [0154.433] GetSystemMetrics (nIndex=46) returned 2 [0154.433] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.433] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.433] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.433] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.445] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.445] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.445] GetLastError () returned 0x578 [0154.445] CanUserWritePwrScheme () returned 0 [0154.446] GetSystemMetrics (nIndex=46) returned 2 [0154.446] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.446] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.446] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.446] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.457] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.457] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.457] GetLastError () returned 0x578 [0154.457] CanUserWritePwrScheme () returned 0 [0154.458] GetSystemMetrics (nIndex=46) returned 2 [0154.458] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.458] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.458] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.458] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.469] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.469] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.469] GetLastError () returned 0x578 [0154.469] CanUserWritePwrScheme () returned 0 [0154.470] GetSystemMetrics (nIndex=46) returned 2 [0154.470] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.470] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.470] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.470] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.482] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.482] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.482] GetLastError () returned 0x578 [0154.482] CanUserWritePwrScheme () returned 0 [0154.483] GetSystemMetrics (nIndex=46) returned 2 [0154.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.483] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.483] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.483] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.494] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.494] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.494] GetLastError () returned 0x578 [0154.494] CanUserWritePwrScheme () returned 0 [0154.495] GetSystemMetrics (nIndex=46) returned 2 [0154.495] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.495] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.495] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.495] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.508] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.508] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.508] GetLastError () returned 0x578 [0154.508] CanUserWritePwrScheme () returned 0 [0154.509] GetSystemMetrics (nIndex=46) returned 2 [0154.509] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.509] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.509] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.509] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.520] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.520] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.520] GetLastError () returned 0x578 [0154.520] CanUserWritePwrScheme () returned 0 [0154.521] GetSystemMetrics (nIndex=46) returned 2 [0154.521] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.521] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.521] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.521] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.533] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.533] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.533] GetLastError () returned 0x578 [0154.533] CanUserWritePwrScheme () returned 0 [0154.534] GetSystemMetrics (nIndex=46) returned 2 [0154.534] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.534] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.534] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.534] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.545] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.545] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.545] GetLastError () returned 0x578 [0154.545] CanUserWritePwrScheme () returned 0 [0154.546] GetSystemMetrics (nIndex=46) returned 2 [0154.546] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.546] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.546] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.546] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.557] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.557] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.557] GetLastError () returned 0x578 [0154.557] CanUserWritePwrScheme () returned 0 [0154.558] GetSystemMetrics (nIndex=46) returned 2 [0154.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.558] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.558] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.558] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.570] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.570] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.570] GetLastError () returned 0x578 [0154.570] CanUserWritePwrScheme () returned 0 [0154.571] GetSystemMetrics (nIndex=46) returned 2 [0154.571] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.571] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.571] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.571] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.582] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.582] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.582] GetLastError () returned 0x578 [0154.582] CanUserWritePwrScheme () returned 0 [0154.583] GetSystemMetrics (nIndex=46) returned 2 [0154.583] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.583] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.583] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.583] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.594] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.594] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.594] GetLastError () returned 0x578 [0154.594] CanUserWritePwrScheme () returned 0 [0154.595] GetSystemMetrics (nIndex=46) returned 2 [0154.595] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.595] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.595] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.595] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.607] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.607] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.607] GetLastError () returned 0x578 [0154.607] CanUserWritePwrScheme () returned 0 [0154.608] GetSystemMetrics (nIndex=46) returned 2 [0154.608] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.608] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.608] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.608] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.619] GetLastError () returned 0x578 [0154.619] CanUserWritePwrScheme () returned 0 [0154.620] GetSystemMetrics (nIndex=46) returned 2 [0154.620] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.620] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.620] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.620] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.632] GetLastError () returned 0x578 [0154.632] CanUserWritePwrScheme () returned 0 [0154.633] GetSystemMetrics (nIndex=46) returned 2 [0154.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.646] GetLastError () returned 0x578 [0154.646] CanUserWritePwrScheme () returned 0 [0154.646] GetSystemMetrics (nIndex=46) returned 2 [0154.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.647] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.659] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.659] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.659] GetLastError () returned 0x578 [0154.659] CanUserWritePwrScheme () returned 0 [0154.660] GetSystemMetrics (nIndex=46) returned 2 [0154.660] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.660] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.660] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.660] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.670] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.670] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.670] GetLastError () returned 0x578 [0154.670] CanUserWritePwrScheme () returned 0 [0154.671] GetSystemMetrics (nIndex=46) returned 2 [0154.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.671] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.671] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.671] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.683] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.683] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.683] GetLastError () returned 0x578 [0154.683] CanUserWritePwrScheme () returned 0 [0154.684] GetSystemMetrics (nIndex=46) returned 2 [0154.684] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.684] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.684] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.695] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.695] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.695] GetLastError () returned 0x578 [0154.695] CanUserWritePwrScheme () returned 0 [0154.696] GetSystemMetrics (nIndex=46) returned 2 [0154.696] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.696] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.696] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.696] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.708] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.708] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.708] GetLastError () returned 0x578 [0154.708] CanUserWritePwrScheme () returned 0 [0154.709] GetSystemMetrics (nIndex=46) returned 2 [0154.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.709] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.719] GetLastError () returned 0x578 [0154.720] CanUserWritePwrScheme () returned 0 [0154.720] GetSystemMetrics (nIndex=46) returned 2 [0154.721] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.721] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.721] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.721] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.732] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.732] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.732] GetLastError () returned 0x578 [0154.732] CanUserWritePwrScheme () returned 0 [0154.733] GetSystemMetrics (nIndex=46) returned 2 [0154.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.733] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.733] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.733] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.744] GetLastError () returned 0x578 [0154.744] CanUserWritePwrScheme () returned 0 [0154.745] GetSystemMetrics (nIndex=46) returned 2 [0154.745] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.745] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.745] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.745] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.756] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.756] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.756] GetLastError () returned 0x578 [0154.756] CanUserWritePwrScheme () returned 0 [0154.757] GetSystemMetrics (nIndex=46) returned 2 [0154.757] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.757] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.757] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.757] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.769] GetLastError () returned 0x578 [0154.769] CanUserWritePwrScheme () returned 0 [0154.770] GetSystemMetrics (nIndex=46) returned 2 [0154.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.781] GetLastError () returned 0x578 [0154.781] CanUserWritePwrScheme () returned 0 [0154.782] GetSystemMetrics (nIndex=46) returned 2 [0154.782] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.782] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.782] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.782] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.794] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.794] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.794] GetLastError () returned 0x578 [0154.794] CanUserWritePwrScheme () returned 0 [0154.795] GetSystemMetrics (nIndex=46) returned 2 [0154.795] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.795] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.795] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.795] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.806] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.806] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.806] GetLastError () returned 0x578 [0154.806] CanUserWritePwrScheme () returned 0 [0154.807] GetSystemMetrics (nIndex=46) returned 2 [0154.807] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.807] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.807] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.807] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.817] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.817] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.818] GetLastError () returned 0x578 [0154.818] CanUserWritePwrScheme () returned 0 [0154.820] GetSystemMetrics (nIndex=46) returned 2 [0154.820] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.820] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.820] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.820] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.830] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.830] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.830] GetLastError () returned 0x578 [0154.830] CanUserWritePwrScheme () returned 0 [0154.831] GetSystemMetrics (nIndex=46) returned 2 [0154.831] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.831] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.831] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.831] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.842] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.842] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.842] GetLastError () returned 0x578 [0154.842] CanUserWritePwrScheme () returned 0 [0154.843] GetSystemMetrics (nIndex=46) returned 2 [0154.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.843] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.843] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.855] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.855] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.855] GetLastError () returned 0x578 [0154.856] CanUserWritePwrScheme () returned 0 [0154.856] GetSystemMetrics (nIndex=46) returned 2 [0154.856] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.856] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.857] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.867] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.867] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.867] GetLastError () returned 0x578 [0154.867] CanUserWritePwrScheme () returned 0 [0154.868] GetSystemMetrics (nIndex=46) returned 2 [0154.868] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.868] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.868] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.868] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.879] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.879] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.879] GetLastError () returned 0x578 [0154.879] CanUserWritePwrScheme () returned 0 [0154.880] GetSystemMetrics (nIndex=46) returned 2 [0154.880] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.880] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.880] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.880] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.892] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.892] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.892] GetLastError () returned 0x578 [0154.892] CanUserWritePwrScheme () returned 0 [0154.893] GetSystemMetrics (nIndex=46) returned 2 [0154.893] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.893] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.893] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.893] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.904] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.904] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.904] GetLastError () returned 0x578 [0154.904] CanUserWritePwrScheme () returned 0 [0154.905] GetSystemMetrics (nIndex=46) returned 2 [0154.905] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.905] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.905] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.905] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.917] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.917] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.917] GetLastError () returned 0x578 [0154.917] CanUserWritePwrScheme () returned 0 [0154.918] GetSystemMetrics (nIndex=46) returned 2 [0154.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.918] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.919] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.919] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.929] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.929] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.929] GetLastError () returned 0x578 [0154.929] CanUserWritePwrScheme () returned 0 [0154.930] GetSystemMetrics (nIndex=46) returned 2 [0154.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.930] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.941] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.941] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.941] GetLastError () returned 0x578 [0154.941] CanUserWritePwrScheme () returned 0 [0154.942] GetSystemMetrics (nIndex=46) returned 2 [0154.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.954] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.954] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.954] GetLastError () returned 0x578 [0154.955] CanUserWritePwrScheme () returned 0 [0154.955] GetSystemMetrics (nIndex=46) returned 2 [0154.955] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.955] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.955] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.956] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.966] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.966] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.966] GetLastError () returned 0x578 [0154.966] CanUserWritePwrScheme () returned 0 [0154.967] GetSystemMetrics (nIndex=46) returned 2 [0154.967] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.967] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.967] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.967] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.978] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.978] GetLastError () returned 0x578 [0154.978] CanUserWritePwrScheme () returned 0 [0154.979] GetSystemMetrics (nIndex=46) returned 2 [0154.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.979] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.979] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.979] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0154.992] GetWindowTextLengthA (hWnd=0x0) returned 0 [0154.992] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0154.992] GetLastError () returned 0x578 [0154.992] CanUserWritePwrScheme () returned 0 [0154.993] GetSystemMetrics (nIndex=46) returned 2 [0154.993] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0154.993] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0154.993] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0154.993] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.076] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.076] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.077] GetLastError () returned 0x578 [0155.077] CanUserWritePwrScheme () returned 0 [0155.077] GetSystemMetrics (nIndex=46) returned 2 [0155.077] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.077] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.077] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.077] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.088] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.088] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.088] GetLastError () returned 0x578 [0155.088] CanUserWritePwrScheme () returned 0 [0155.089] GetSystemMetrics (nIndex=46) returned 2 [0155.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.089] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.089] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.089] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.101] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.101] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.102] GetLastError () returned 0x578 [0155.102] CanUserWritePwrScheme () returned 0 [0155.102] GetSystemMetrics (nIndex=46) returned 2 [0155.102] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.102] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.102] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.103] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.113] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.113] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.113] GetLastError () returned 0x578 [0155.113] CanUserWritePwrScheme () returned 0 [0155.114] GetSystemMetrics (nIndex=46) returned 2 [0155.114] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.114] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.114] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.114] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.125] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.125] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.125] GetLastError () returned 0x578 [0155.125] CanUserWritePwrScheme () returned 0 [0155.126] GetSystemMetrics (nIndex=46) returned 2 [0155.126] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.126] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.126] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.126] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.137] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.137] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.137] GetLastError () returned 0x578 [0155.137] CanUserWritePwrScheme () returned 0 [0155.139] GetSystemMetrics (nIndex=46) returned 2 [0155.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.139] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.139] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.139] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.152] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.152] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.152] GetLastError () returned 0x578 [0155.152] CanUserWritePwrScheme () returned 0 [0155.153] GetSystemMetrics (nIndex=46) returned 2 [0155.153] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.153] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.153] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.153] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.189] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.189] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.189] GetLastError () returned 0x578 [0155.189] CanUserWritePwrScheme () returned 0 [0155.190] GetSystemMetrics (nIndex=46) returned 2 [0155.190] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.190] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.190] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.190] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.201] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.201] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.201] GetLastError () returned 0x578 [0155.201] CanUserWritePwrScheme () returned 0 [0155.202] GetSystemMetrics (nIndex=46) returned 2 [0155.202] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.202] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.202] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.202] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.213] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.213] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.213] GetLastError () returned 0x578 [0155.213] CanUserWritePwrScheme () returned 0 [0155.214] GetSystemMetrics (nIndex=46) returned 2 [0155.214] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.214] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.214] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.214] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.226] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.226] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.226] GetLastError () returned 0x578 [0155.226] CanUserWritePwrScheme () returned 0 [0155.227] GetSystemMetrics (nIndex=46) returned 2 [0155.227] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.227] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.227] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.227] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.237] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.237] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.237] GetLastError () returned 0x578 [0155.237] CanUserWritePwrScheme () returned 0 [0155.238] GetSystemMetrics (nIndex=46) returned 2 [0155.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.238] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.238] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.238] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.249] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.249] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.249] GetLastError () returned 0x578 [0155.249] CanUserWritePwrScheme () returned 0 [0155.250] GetSystemMetrics (nIndex=46) returned 2 [0155.250] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.250] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.250] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.250] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.261] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.261] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.261] GetLastError () returned 0x578 [0155.261] CanUserWritePwrScheme () returned 0 [0155.262] GetSystemMetrics (nIndex=46) returned 2 [0155.262] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.262] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.262] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.262] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.274] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.274] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.274] GetLastError () returned 0x578 [0155.274] CanUserWritePwrScheme () returned 0 [0155.275] GetSystemMetrics (nIndex=46) returned 2 [0155.275] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.275] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.275] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.275] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.285] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.285] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.285] GetLastError () returned 0x578 [0155.285] CanUserWritePwrScheme () returned 0 [0155.286] GetSystemMetrics (nIndex=46) returned 2 [0155.286] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.286] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.286] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.286] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.297] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.297] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.297] GetLastError () returned 0x578 [0155.297] CanUserWritePwrScheme () returned 0 [0155.298] GetSystemMetrics (nIndex=46) returned 2 [0155.298] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.298] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.298] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.298] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.310] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.310] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.310] GetLastError () returned 0x578 [0155.310] CanUserWritePwrScheme () returned 0 [0155.311] GetSystemMetrics (nIndex=46) returned 2 [0155.311] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.311] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.311] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.311] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.323] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.323] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.323] GetLastError () returned 0x578 [0155.323] CanUserWritePwrScheme () returned 0 [0155.324] GetSystemMetrics (nIndex=46) returned 2 [0155.324] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.324] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.324] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.324] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.334] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.335] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.335] GetLastError () returned 0x578 [0155.335] CanUserWritePwrScheme () returned 0 [0155.335] GetSystemMetrics (nIndex=46) returned 2 [0155.335] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.336] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.336] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.336] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.346] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.346] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.346] GetLastError () returned 0x578 [0155.346] CanUserWritePwrScheme () returned 0 [0155.347] GetSystemMetrics (nIndex=46) returned 2 [0155.347] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.347] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.347] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.347] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.360] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.360] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.360] GetLastError () returned 0x578 [0155.360] CanUserWritePwrScheme () returned 0 [0155.361] GetSystemMetrics (nIndex=46) returned 2 [0155.361] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.361] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.361] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.361] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.371] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.371] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.371] GetLastError () returned 0x578 [0155.371] CanUserWritePwrScheme () returned 0 [0155.372] GetSystemMetrics (nIndex=46) returned 2 [0155.372] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.372] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.372] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.372] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.383] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.383] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.383] GetLastError () returned 0x578 [0155.383] CanUserWritePwrScheme () returned 0 [0155.384] GetSystemMetrics (nIndex=46) returned 2 [0155.384] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.384] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.384] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.384] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.394] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.394] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.394] GetLastError () returned 0x578 [0155.394] CanUserWritePwrScheme () returned 0 [0155.403] GetSystemMetrics (nIndex=46) returned 2 [0155.403] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.403] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.403] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.403] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.413] GetLastError () returned 0x578 [0155.413] CanUserWritePwrScheme () returned 0 [0155.414] GetSystemMetrics (nIndex=46) returned 2 [0155.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.414] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.414] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.414] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.425] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.425] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.425] GetLastError () returned 0x578 [0155.425] CanUserWritePwrScheme () returned 0 [0155.426] GetSystemMetrics (nIndex=46) returned 2 [0155.426] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.426] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.426] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.426] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.436] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.437] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.437] GetLastError () returned 0x578 [0155.437] CanUserWritePwrScheme () returned 0 [0155.437] GetSystemMetrics (nIndex=46) returned 2 [0155.437] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.437] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.450] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.450] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.450] GetLastError () returned 0x578 [0155.450] CanUserWritePwrScheme () returned 0 [0155.451] GetSystemMetrics (nIndex=46) returned 2 [0155.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.451] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.451] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.451] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.463] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.463] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.463] GetLastError () returned 0x578 [0155.463] CanUserWritePwrScheme () returned 0 [0155.464] GetSystemMetrics (nIndex=46) returned 2 [0155.464] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.464] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.464] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.464] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.475] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.475] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.475] GetLastError () returned 0x578 [0155.475] CanUserWritePwrScheme () returned 0 [0155.476] GetSystemMetrics (nIndex=46) returned 2 [0155.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.476] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.476] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.476] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.486] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.487] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.487] GetLastError () returned 0x578 [0155.487] CanUserWritePwrScheme () returned 0 [0155.487] GetSystemMetrics (nIndex=46) returned 2 [0155.487] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.488] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.488] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.488] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.500] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.500] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.500] GetLastError () returned 0x578 [0155.500] CanUserWritePwrScheme () returned 0 [0155.501] GetSystemMetrics (nIndex=46) returned 2 [0155.501] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.501] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.501] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.501] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.512] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.512] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.512] GetLastError () returned 0x578 [0155.512] CanUserWritePwrScheme () returned 0 [0155.513] GetSystemMetrics (nIndex=46) returned 2 [0155.513] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.513] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.513] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.513] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.524] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.524] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.524] GetLastError () returned 0x578 [0155.524] CanUserWritePwrScheme () returned 0 [0155.525] GetSystemMetrics (nIndex=46) returned 2 [0155.525] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.525] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.525] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.525] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.535] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.535] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.535] GetLastError () returned 0x578 [0155.535] CanUserWritePwrScheme () returned 0 [0155.536] GetSystemMetrics (nIndex=46) returned 2 [0155.536] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.536] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.536] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.536] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.550] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.550] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.550] GetLastError () returned 0x578 [0155.550] CanUserWritePwrScheme () returned 0 [0155.551] GetSystemMetrics (nIndex=46) returned 2 [0155.551] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.551] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.551] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.551] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.562] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.562] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.562] GetLastError () returned 0x578 [0155.562] CanUserWritePwrScheme () returned 0 [0155.563] GetSystemMetrics (nIndex=46) returned 2 [0155.563] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.563] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.563] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.563] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.574] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.574] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.574] GetLastError () returned 0x578 [0155.574] CanUserWritePwrScheme () returned 0 [0155.575] GetSystemMetrics (nIndex=46) returned 2 [0155.575] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.575] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.575] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.575] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.585] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.585] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.585] GetLastError () returned 0x578 [0155.585] CanUserWritePwrScheme () returned 0 [0155.586] GetSystemMetrics (nIndex=46) returned 2 [0155.586] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.586] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.586] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.586] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.599] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.600] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.600] GetLastError () returned 0x578 [0155.600] CanUserWritePwrScheme () returned 0 [0155.600] GetSystemMetrics (nIndex=46) returned 2 [0155.600] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.611] GetLastError () returned 0x578 [0155.611] CanUserWritePwrScheme () returned 0 [0155.612] GetSystemMetrics (nIndex=46) returned 2 [0155.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.612] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.623] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.623] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.623] GetLastError () returned 0x578 [0155.623] CanUserWritePwrScheme () returned 0 [0155.624] GetSystemMetrics (nIndex=46) returned 2 [0155.624] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.624] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.624] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.624] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.636] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.636] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.636] GetLastError () returned 0x578 [0155.636] CanUserWritePwrScheme () returned 0 [0155.637] GetSystemMetrics (nIndex=46) returned 2 [0155.637] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.637] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.637] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.637] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.650] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.650] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.650] GetLastError () returned 0x578 [0155.651] CanUserWritePwrScheme () returned 0 [0155.651] GetSystemMetrics (nIndex=46) returned 2 [0155.651] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.651] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.651] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.651] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.662] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.662] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.663] GetLastError () returned 0x578 [0155.663] CanUserWritePwrScheme () returned 0 [0155.663] GetSystemMetrics (nIndex=46) returned 2 [0155.663] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.663] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.664] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.664] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.674] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.674] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.674] GetLastError () returned 0x578 [0155.674] CanUserWritePwrScheme () returned 0 [0155.675] GetSystemMetrics (nIndex=46) returned 2 [0155.675] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.675] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.675] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.675] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.686] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.686] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.686] GetLastError () returned 0x578 [0155.686] CanUserWritePwrScheme () returned 0 [0155.687] GetSystemMetrics (nIndex=46) returned 2 [0155.687] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.687] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.687] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.687] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.700] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.700] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.700] GetLastError () returned 0x578 [0155.700] CanUserWritePwrScheme () returned 0 [0155.701] GetSystemMetrics (nIndex=46) returned 2 [0155.701] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.701] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.701] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.701] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.712] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.712] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.712] GetLastError () returned 0x578 [0155.712] CanUserWritePwrScheme () returned 0 [0155.713] GetSystemMetrics (nIndex=46) returned 2 [0155.713] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.713] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.713] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.713] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.724] GetLastError () returned 0x578 [0155.724] CanUserWritePwrScheme () returned 0 [0155.725] GetSystemMetrics (nIndex=46) returned 2 [0155.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.725] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.725] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.725] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.736] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.736] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.736] GetLastError () returned 0x578 [0155.736] CanUserWritePwrScheme () returned 0 [0155.736] GetSystemMetrics (nIndex=46) returned 2 [0155.737] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.737] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.737] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.737] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.747] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.747] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.747] GetLastError () returned 0x578 [0155.748] CanUserWritePwrScheme () returned 0 [0155.748] GetSystemMetrics (nIndex=46) returned 2 [0155.749] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.749] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.749] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.749] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.761] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.761] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.761] GetLastError () returned 0x578 [0155.761] CanUserWritePwrScheme () returned 0 [0155.762] GetSystemMetrics (nIndex=46) returned 2 [0155.762] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.762] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.762] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.762] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.774] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.774] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.774] GetLastError () returned 0x578 [0155.774] CanUserWritePwrScheme () returned 0 [0155.775] GetSystemMetrics (nIndex=46) returned 2 [0155.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.775] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.775] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.775] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.785] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.785] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.786] GetLastError () returned 0x578 [0155.786] CanUserWritePwrScheme () returned 0 [0155.786] GetSystemMetrics (nIndex=46) returned 2 [0155.786] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.797] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.797] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.797] GetLastError () returned 0x578 [0155.797] CanUserWritePwrScheme () returned 0 [0155.798] GetSystemMetrics (nIndex=46) returned 2 [0155.798] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.798] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.798] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.798] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.811] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.811] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.811] GetLastError () returned 0x578 [0155.812] CanUserWritePwrScheme () returned 0 [0155.812] GetSystemMetrics (nIndex=46) returned 2 [0155.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.812] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.812] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.812] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.823] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.823] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.823] GetLastError () returned 0x578 [0155.823] CanUserWritePwrScheme () returned 0 [0155.824] GetSystemMetrics (nIndex=46) returned 2 [0155.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.824] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.824] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.824] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.835] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.835] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.835] GetLastError () returned 0x578 [0155.835] CanUserWritePwrScheme () returned 0 [0155.836] GetSystemMetrics (nIndex=46) returned 2 [0155.836] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.836] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.836] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.836] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.846] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.846] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.846] GetLastError () returned 0x578 [0155.846] CanUserWritePwrScheme () returned 0 [0155.847] GetSystemMetrics (nIndex=46) returned 2 [0155.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.847] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.847] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.847] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.857] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.857] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.857] GetLastError () returned 0x578 [0155.858] CanUserWritePwrScheme () returned 0 [0155.860] GetSystemMetrics (nIndex=46) returned 2 [0155.860] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.860] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.860] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.860] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.871] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.871] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.871] GetLastError () returned 0x578 [0155.871] CanUserWritePwrScheme () returned 0 [0155.872] GetSystemMetrics (nIndex=46) returned 2 [0155.872] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.872] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.872] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.872] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.883] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.883] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.883] GetLastError () returned 0x578 [0155.883] CanUserWritePwrScheme () returned 0 [0155.884] GetSystemMetrics (nIndex=46) returned 2 [0155.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.884] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.884] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.884] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.894] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.895] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.895] GetLastError () returned 0x578 [0155.895] CanUserWritePwrScheme () returned 0 [0155.897] GetSystemMetrics (nIndex=46) returned 2 [0155.897] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.897] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.897] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.897] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.909] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.909] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.909] GetLastError () returned 0x578 [0155.909] CanUserWritePwrScheme () returned 0 [0155.910] GetSystemMetrics (nIndex=46) returned 2 [0155.910] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.910] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.910] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.910] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.923] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.923] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.923] GetLastError () returned 0x578 [0155.923] CanUserWritePwrScheme () returned 0 [0155.924] GetSystemMetrics (nIndex=46) returned 2 [0155.924] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.924] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.924] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.924] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.934] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.934] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.934] GetLastError () returned 0x578 [0155.934] CanUserWritePwrScheme () returned 0 [0155.935] GetSystemMetrics (nIndex=46) returned 2 [0155.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.946] GetLastError () returned 0x578 [0155.946] CanUserWritePwrScheme () returned 0 [0155.947] GetSystemMetrics (nIndex=46) returned 2 [0155.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.947] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.947] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.947] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.958] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.958] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.958] GetLastError () returned 0x578 [0155.958] CanUserWritePwrScheme () returned 0 [0155.959] GetSystemMetrics (nIndex=46) returned 2 [0155.959] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.959] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.959] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.959] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.969] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.970] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.970] GetLastError () returned 0x578 [0155.970] CanUserWritePwrScheme () returned 0 [0155.970] GetSystemMetrics (nIndex=46) returned 2 [0155.970] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.971] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.971] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.971] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.984] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.984] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.984] GetLastError () returned 0x578 [0155.984] CanUserWritePwrScheme () returned 0 [0155.984] GetSystemMetrics (nIndex=46) returned 2 [0155.985] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.985] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.985] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.985] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0155.995] GetWindowTextLengthA (hWnd=0x0) returned 0 [0155.995] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0155.995] GetLastError () returned 0x578 [0155.995] CanUserWritePwrScheme () returned 0 [0155.996] GetSystemMetrics (nIndex=46) returned 2 [0155.996] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0155.996] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0155.996] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0155.996] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.007] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.007] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.008] GetLastError () returned 0x578 [0156.008] CanUserWritePwrScheme () returned 0 [0156.008] GetSystemMetrics (nIndex=46) returned 2 [0156.008] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.008] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.009] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.009] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.019] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.020] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.020] GetLastError () returned 0x578 [0156.020] CanUserWritePwrScheme () returned 0 [0156.021] GetSystemMetrics (nIndex=46) returned 2 [0156.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.021] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.021] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.021] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.034] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.034] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.034] GetLastError () returned 0x578 [0156.034] CanUserWritePwrScheme () returned 0 [0156.035] GetSystemMetrics (nIndex=46) returned 2 [0156.035] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.035] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.035] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.035] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.046] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.046] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.046] GetLastError () returned 0x578 [0156.046] CanUserWritePwrScheme () returned 0 [0156.047] GetSystemMetrics (nIndex=46) returned 2 [0156.047] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.047] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.047] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.047] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.058] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.058] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.058] GetLastError () returned 0x578 [0156.058] CanUserWritePwrScheme () returned 0 [0156.059] GetSystemMetrics (nIndex=46) returned 2 [0156.059] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.059] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.059] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.059] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.070] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.070] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.070] GetLastError () returned 0x578 [0156.070] CanUserWritePwrScheme () returned 0 [0156.071] GetSystemMetrics (nIndex=46) returned 2 [0156.071] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.071] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.071] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.071] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.083] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.083] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.083] GetLastError () returned 0x578 [0156.083] CanUserWritePwrScheme () returned 0 [0156.084] GetSystemMetrics (nIndex=46) returned 2 [0156.084] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.084] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.084] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.084] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.089] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.089] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.089] GetLastError () returned 0x578 [0156.089] CanUserWritePwrScheme () returned 0 [0156.090] GetSystemMetrics (nIndex=46) returned 2 [0156.090] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.090] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.090] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.090] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.097] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.097] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.097] GetLastError () returned 0x578 [0156.097] CanUserWritePwrScheme () returned 0 [0156.098] GetSystemMetrics (nIndex=46) returned 2 [0156.098] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.098] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.098] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.098] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.103] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.103] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.103] GetLastError () returned 0x578 [0156.103] CanUserWritePwrScheme () returned 0 [0156.104] GetSystemMetrics (nIndex=46) returned 2 [0156.104] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.104] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.104] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.104] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.109] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.109] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.109] GetLastError () returned 0x578 [0156.109] CanUserWritePwrScheme () returned 0 [0156.110] GetSystemMetrics (nIndex=46) returned 2 [0156.110] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.110] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.110] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.110] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.115] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.115] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.115] GetLastError () returned 0x578 [0156.115] CanUserWritePwrScheme () returned 0 [0156.116] GetSystemMetrics (nIndex=46) returned 2 [0156.116] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.116] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.116] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.116] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.121] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.121] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.121] GetLastError () returned 0x578 [0156.121] CanUserWritePwrScheme () returned 0 [0156.122] GetSystemMetrics (nIndex=46) returned 2 [0156.122] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.122] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.122] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.122] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.126] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.127] GetLastError () returned 0x578 [0156.127] CanUserWritePwrScheme () returned 0 [0156.127] GetSystemMetrics (nIndex=46) returned 2 [0156.127] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.128] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.128] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.128] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.133] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.133] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.133] GetLastError () returned 0x578 [0156.133] CanUserWritePwrScheme () returned 0 [0156.133] GetSystemMetrics (nIndex=46) returned 2 [0156.134] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.134] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.134] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.134] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.138] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.138] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.138] GetLastError () returned 0x578 [0156.138] CanUserWritePwrScheme () returned 0 [0156.139] GetSystemMetrics (nIndex=46) returned 2 [0156.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.139] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.139] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.139] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.144] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.144] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.144] GetLastError () returned 0x578 [0156.144] CanUserWritePwrScheme () returned 0 [0156.145] GetSystemMetrics (nIndex=46) returned 2 [0156.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.145] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.145] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.145] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.150] GetLastError () returned 0x578 [0156.150] CanUserWritePwrScheme () returned 0 [0156.151] GetSystemMetrics (nIndex=46) returned 2 [0156.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.151] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.151] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.151] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.158] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.158] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.158] GetLastError () returned 0x578 [0156.158] CanUserWritePwrScheme () returned 0 [0156.159] GetSystemMetrics (nIndex=46) returned 2 [0156.159] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.159] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.159] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.159] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.164] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.164] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.164] GetLastError () returned 0x578 [0156.164] CanUserWritePwrScheme () returned 0 [0156.165] GetSystemMetrics (nIndex=46) returned 2 [0156.165] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.165] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.165] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.165] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.170] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.170] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.170] GetLastError () returned 0x578 [0156.170] CanUserWritePwrScheme () returned 0 [0156.171] GetSystemMetrics (nIndex=46) returned 2 [0156.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.171] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.171] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.171] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.182] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.182] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.182] GetLastError () returned 0x578 [0156.182] CanUserWritePwrScheme () returned 0 [0156.183] GetSystemMetrics (nIndex=46) returned 2 [0156.183] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.183] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.183] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.183] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.194] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.194] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.194] GetLastError () returned 0x578 [0156.194] CanUserWritePwrScheme () returned 0 [0156.195] GetSystemMetrics (nIndex=46) returned 2 [0156.195] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.195] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.195] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.195] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.206] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.206] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.206] GetLastError () returned 0x578 [0156.206] CanUserWritePwrScheme () returned 0 [0156.207] GetSystemMetrics (nIndex=46) returned 2 [0156.207] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.207] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.207] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.207] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.220] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.220] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.220] GetLastError () returned 0x578 [0156.220] CanUserWritePwrScheme () returned 0 [0156.221] GetSystemMetrics (nIndex=46) returned 2 [0156.221] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.221] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.221] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.221] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.232] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.232] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.232] GetLastError () returned 0x578 [0156.232] CanUserWritePwrScheme () returned 0 [0156.233] GetSystemMetrics (nIndex=46) returned 2 [0156.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.233] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.233] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.233] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.244] GetLastError () returned 0x578 [0156.244] CanUserWritePwrScheme () returned 0 [0156.245] GetSystemMetrics (nIndex=46) returned 2 [0156.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.256] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.256] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.256] GetLastError () returned 0x578 [0156.256] CanUserWritePwrScheme () returned 0 [0156.257] GetSystemMetrics (nIndex=46) returned 2 [0156.257] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.257] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.257] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.268] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.268] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.268] GetLastError () returned 0x578 [0156.268] CanUserWritePwrScheme () returned 0 [0156.269] GetSystemMetrics (nIndex=46) returned 2 [0156.269] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.269] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.269] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.269] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.283] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.283] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.283] GetLastError () returned 0x578 [0156.283] CanUserWritePwrScheme () returned 0 [0156.284] GetSystemMetrics (nIndex=46) returned 2 [0156.284] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.284] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.284] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.284] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.295] GetLastError () returned 0x578 [0156.295] CanUserWritePwrScheme () returned 0 [0156.296] GetSystemMetrics (nIndex=46) returned 2 [0156.296] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.296] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.296] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.296] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.306] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.306] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.306] GetLastError () returned 0x578 [0156.306] CanUserWritePwrScheme () returned 0 [0156.307] GetSystemMetrics (nIndex=46) returned 2 [0156.307] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.307] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.307] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.307] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.318] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.318] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.318] GetLastError () returned 0x578 [0156.318] CanUserWritePwrScheme () returned 0 [0156.319] GetSystemMetrics (nIndex=46) returned 2 [0156.319] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.319] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.319] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.319] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.330] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.330] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.330] GetLastError () returned 0x578 [0156.330] CanUserWritePwrScheme () returned 0 [0156.331] GetSystemMetrics (nIndex=46) returned 2 [0156.331] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.331] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.331] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.331] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.345] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.345] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.345] GetLastError () returned 0x578 [0156.345] CanUserWritePwrScheme () returned 0 [0156.346] GetSystemMetrics (nIndex=46) returned 2 [0156.346] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.346] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.346] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.346] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.357] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.357] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.357] GetLastError () returned 0x578 [0156.357] CanUserWritePwrScheme () returned 0 [0156.358] GetSystemMetrics (nIndex=46) returned 2 [0156.358] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.358] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.358] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.358] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.369] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.369] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.369] GetLastError () returned 0x578 [0156.369] CanUserWritePwrScheme () returned 0 [0156.370] GetSystemMetrics (nIndex=46) returned 2 [0156.370] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.370] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.370] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.370] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.381] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.381] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.381] GetLastError () returned 0x578 [0156.381] CanUserWritePwrScheme () returned 0 [0156.382] GetSystemMetrics (nIndex=46) returned 2 [0156.382] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.382] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.382] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.382] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.393] GetLastError () returned 0x578 [0156.393] CanUserWritePwrScheme () returned 0 [0156.394] GetSystemMetrics (nIndex=46) returned 2 [0156.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.394] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.394] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.394] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.414] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.414] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.414] GetLastError () returned 0x578 [0156.414] CanUserWritePwrScheme () returned 0 [0156.415] GetSystemMetrics (nIndex=46) returned 2 [0156.415] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.415] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.415] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.415] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.426] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.426] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.426] GetLastError () returned 0x578 [0156.426] CanUserWritePwrScheme () returned 0 [0156.427] GetSystemMetrics (nIndex=46) returned 2 [0156.427] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.427] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.427] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.427] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.437] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.438] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.438] GetLastError () returned 0x578 [0156.438] CanUserWritePwrScheme () returned 0 [0156.438] GetSystemMetrics (nIndex=46) returned 2 [0156.439] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.439] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.439] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.439] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.449] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.450] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.450] GetLastError () returned 0x578 [0156.450] CanUserWritePwrScheme () returned 0 [0156.450] GetSystemMetrics (nIndex=46) returned 2 [0156.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.451] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.451] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.451] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.461] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.461] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.461] GetLastError () returned 0x578 [0156.461] CanUserWritePwrScheme () returned 0 [0156.462] GetSystemMetrics (nIndex=46) returned 2 [0156.462] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.462] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.462] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.462] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.476] GetLastError () returned 0x578 [0156.476] CanUserWritePwrScheme () returned 0 [0156.477] GetSystemMetrics (nIndex=46) returned 2 [0156.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.488] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.489] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.489] GetLastError () returned 0x578 [0156.489] CanUserWritePwrScheme () returned 0 [0156.489] GetSystemMetrics (nIndex=46) returned 2 [0156.490] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.490] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.490] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.490] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.500] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.500] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.500] GetLastError () returned 0x578 [0156.500] CanUserWritePwrScheme () returned 0 [0156.501] GetSystemMetrics (nIndex=46) returned 2 [0156.501] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.501] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.501] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.501] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.512] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.512] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.512] GetLastError () returned 0x578 [0156.512] CanUserWritePwrScheme () returned 0 [0156.513] GetSystemMetrics (nIndex=46) returned 2 [0156.513] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.513] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.513] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.513] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.524] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.524] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.524] GetLastError () returned 0x578 [0156.524] CanUserWritePwrScheme () returned 0 [0156.525] GetSystemMetrics (nIndex=46) returned 2 [0156.525] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.525] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.525] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.525] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.539] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.539] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.539] GetLastError () returned 0x578 [0156.539] CanUserWritePwrScheme () returned 0 [0156.540] GetSystemMetrics (nIndex=46) returned 2 [0156.540] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.540] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.540] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.540] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.551] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.551] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.551] GetLastError () returned 0x578 [0156.551] CanUserWritePwrScheme () returned 0 [0156.552] GetSystemMetrics (nIndex=46) returned 2 [0156.552] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.552] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.552] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.552] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.563] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.563] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.563] GetLastError () returned 0x578 [0156.563] CanUserWritePwrScheme () returned 0 [0156.564] GetSystemMetrics (nIndex=46) returned 2 [0156.564] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.564] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.564] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.564] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.575] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.575] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.575] GetLastError () returned 0x578 [0156.575] CanUserWritePwrScheme () returned 0 [0156.576] GetSystemMetrics (nIndex=46) returned 2 [0156.576] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.576] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.576] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.576] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.586] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.586] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.586] GetLastError () returned 0x578 [0156.586] CanUserWritePwrScheme () returned 0 [0156.587] GetSystemMetrics (nIndex=46) returned 2 [0156.587] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.587] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.587] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.587] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.598] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.598] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.598] GetLastError () returned 0x578 [0156.598] CanUserWritePwrScheme () returned 0 [0156.599] GetSystemMetrics (nIndex=46) returned 2 [0156.599] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.599] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.599] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.599] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.613] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.613] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.613] GetLastError () returned 0x578 [0156.613] CanUserWritePwrScheme () returned 0 [0156.614] GetSystemMetrics (nIndex=46) returned 2 [0156.614] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.614] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.614] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.614] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.625] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.625] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.625] GetLastError () returned 0x578 [0156.625] CanUserWritePwrScheme () returned 0 [0156.626] GetSystemMetrics (nIndex=46) returned 2 [0156.626] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.626] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.626] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.626] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.638] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.638] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.638] GetLastError () returned 0x578 [0156.638] CanUserWritePwrScheme () returned 0 [0156.639] GetSystemMetrics (nIndex=46) returned 2 [0156.639] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.639] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.639] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.639] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.651] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.651] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.651] GetLastError () returned 0x578 [0156.651] CanUserWritePwrScheme () returned 0 [0156.652] GetSystemMetrics (nIndex=46) returned 2 [0156.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.652] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.652] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.652] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.663] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.663] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.663] GetLastError () returned 0x578 [0156.663] CanUserWritePwrScheme () returned 0 [0156.664] GetSystemMetrics (nIndex=46) returned 2 [0156.664] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.664] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.664] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.664] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.689] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.689] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.689] GetLastError () returned 0x578 [0156.689] CanUserWritePwrScheme () returned 0 [0156.690] GetSystemMetrics (nIndex=46) returned 2 [0156.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.690] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.690] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.690] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.701] GetLastError () returned 0x578 [0156.701] CanUserWritePwrScheme () returned 0 [0156.702] GetSystemMetrics (nIndex=46) returned 2 [0156.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.713] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.713] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.713] GetLastError () returned 0x578 [0156.713] CanUserWritePwrScheme () returned 0 [0156.714] GetSystemMetrics (nIndex=46) returned 2 [0156.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.714] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.714] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.714] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.725] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.725] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.725] GetLastError () returned 0x578 [0156.725] CanUserWritePwrScheme () returned 0 [0156.726] GetSystemMetrics (nIndex=46) returned 2 [0156.726] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.726] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.726] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.726] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.739] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.739] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.739] GetLastError () returned 0x578 [0156.739] CanUserWritePwrScheme () returned 0 [0156.740] GetSystemMetrics (nIndex=46) returned 2 [0156.740] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.740] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.740] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.740] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.751] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.751] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.751] GetLastError () returned 0x578 [0156.751] CanUserWritePwrScheme () returned 0 [0156.752] GetSystemMetrics (nIndex=46) returned 2 [0156.752] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.752] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.752] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.752] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.763] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.763] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.763] GetLastError () returned 0x578 [0156.763] CanUserWritePwrScheme () returned 0 [0156.764] GetSystemMetrics (nIndex=46) returned 2 [0156.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.764] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.764] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.764] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.775] GetLastError () returned 0x578 [0156.775] CanUserWritePwrScheme () returned 0 [0156.776] GetSystemMetrics (nIndex=46) returned 2 [0156.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.776] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.776] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.776] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.787] GetLastError () returned 0x578 [0156.787] CanUserWritePwrScheme () returned 0 [0156.788] GetSystemMetrics (nIndex=46) returned 2 [0156.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.788] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.788] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.801] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.801] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.801] GetLastError () returned 0x578 [0156.801] CanUserWritePwrScheme () returned 0 [0156.802] GetSystemMetrics (nIndex=46) returned 2 [0156.802] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.802] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.802] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.802] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.811] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.811] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.811] GetLastError () returned 0x578 [0156.811] CanUserWritePwrScheme () returned 0 [0156.812] GetSystemMetrics (nIndex=46) returned 2 [0156.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.812] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.812] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.812] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.817] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.817] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.817] GetLastError () returned 0x578 [0156.817] CanUserWritePwrScheme () returned 0 [0156.818] GetSystemMetrics (nIndex=46) returned 2 [0156.818] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.818] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.818] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.818] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.823] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.823] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.823] GetLastError () returned 0x578 [0156.823] CanUserWritePwrScheme () returned 0 [0156.824] GetSystemMetrics (nIndex=46) returned 2 [0156.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.824] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.824] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.824] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.829] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.829] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.829] GetLastError () returned 0x578 [0156.829] CanUserWritePwrScheme () returned 0 [0156.830] GetSystemMetrics (nIndex=46) returned 2 [0156.830] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.830] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.830] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.830] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.835] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.835] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.835] GetLastError () returned 0x578 [0156.835] CanUserWritePwrScheme () returned 0 [0156.836] GetSystemMetrics (nIndex=46) returned 2 [0156.836] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.836] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.836] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.836] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.840] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.841] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.841] GetLastError () returned 0x578 [0156.841] CanUserWritePwrScheme () returned 0 [0156.841] GetSystemMetrics (nIndex=46) returned 2 [0156.841] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.842] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.842] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.842] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.846] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.846] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.846] GetLastError () returned 0x578 [0156.846] CanUserWritePwrScheme () returned 0 [0156.848] GetSystemMetrics (nIndex=46) returned 2 [0156.848] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.848] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.848] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.848] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.853] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.853] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.853] GetLastError () returned 0x578 [0156.853] CanUserWritePwrScheme () returned 0 [0156.854] GetSystemMetrics (nIndex=46) returned 2 [0156.854] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.854] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.854] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.854] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.859] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.859] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.859] GetLastError () returned 0x578 [0156.859] CanUserWritePwrScheme () returned 0 [0156.860] GetSystemMetrics (nIndex=46) returned 2 [0156.860] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.860] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.860] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.860] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.870] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.870] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.870] GetLastError () returned 0x578 [0156.870] CanUserWritePwrScheme () returned 0 [0156.871] GetSystemMetrics (nIndex=46) returned 2 [0156.871] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.871] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.871] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.871] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.882] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.882] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.882] GetLastError () returned 0x578 [0156.882] CanUserWritePwrScheme () returned 0 [0156.883] GetSystemMetrics (nIndex=46) returned 2 [0156.883] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.883] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.883] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.883] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.941] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.941] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.941] GetLastError () returned 0x578 [0156.941] CanUserWritePwrScheme () returned 0 [0156.942] GetSystemMetrics (nIndex=46) returned 2 [0156.942] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.942] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.942] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.942] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.953] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.953] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.953] GetLastError () returned 0x578 [0156.953] CanUserWritePwrScheme () returned 0 [0156.954] GetSystemMetrics (nIndex=46) returned 2 [0156.954] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.954] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.954] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.954] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.965] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.965] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.965] GetLastError () returned 0x578 [0156.965] CanUserWritePwrScheme () returned 0 [0156.966] GetSystemMetrics (nIndex=46) returned 2 [0156.966] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.966] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.966] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.966] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.977] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.977] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.977] GetLastError () returned 0x578 [0156.977] CanUserWritePwrScheme () returned 0 [0156.978] GetSystemMetrics (nIndex=46) returned 2 [0156.978] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.978] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.978] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.978] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0156.989] GetWindowTextLengthA (hWnd=0x0) returned 0 [0156.989] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0156.989] GetLastError () returned 0x578 [0156.989] CanUserWritePwrScheme () returned 0 [0156.990] GetSystemMetrics (nIndex=46) returned 2 [0156.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0156.990] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0156.990] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0156.990] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.005] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.005] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.005] GetLastError () returned 0x578 [0157.005] CanUserWritePwrScheme () returned 0 [0157.006] GetSystemMetrics (nIndex=46) returned 2 [0157.006] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.006] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.006] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.006] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.016] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.016] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.016] GetLastError () returned 0x578 [0157.016] CanUserWritePwrScheme () returned 0 [0157.017] GetSystemMetrics (nIndex=46) returned 2 [0157.017] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.017] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.017] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.017] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.040] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.040] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.040] GetLastError () returned 0x578 [0157.041] CanUserWritePwrScheme () returned 0 [0157.041] GetSystemMetrics (nIndex=46) returned 2 [0157.041] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.041] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.041] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.041] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.052] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.052] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.052] GetLastError () returned 0x578 [0157.053] CanUserWritePwrScheme () returned 0 [0157.053] GetSystemMetrics (nIndex=46) returned 2 [0157.053] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.053] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.053] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.053] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.068] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.068] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.068] GetLastError () returned 0x578 [0157.068] CanUserWritePwrScheme () returned 0 [0157.069] GetSystemMetrics (nIndex=46) returned 2 [0157.069] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.069] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.069] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.069] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.079] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.079] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.079] GetLastError () returned 0x578 [0157.079] CanUserWritePwrScheme () returned 0 [0157.080] GetSystemMetrics (nIndex=46) returned 2 [0157.080] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.080] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.080] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.080] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.092] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.092] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.092] GetLastError () returned 0x578 [0157.092] CanUserWritePwrScheme () returned 0 [0157.092] GetSystemMetrics (nIndex=46) returned 2 [0157.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.093] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.093] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.093] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.104] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.104] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.104] GetLastError () returned 0x578 [0157.104] CanUserWritePwrScheme () returned 0 [0157.105] GetSystemMetrics (nIndex=46) returned 2 [0157.105] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.105] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.105] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.105] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.116] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.116] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.116] GetLastError () returned 0x578 [0157.116] CanUserWritePwrScheme () returned 0 [0157.117] GetSystemMetrics (nIndex=46) returned 2 [0157.117] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.117] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.117] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.117] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.130] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.130] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.130] GetLastError () returned 0x578 [0157.130] CanUserWritePwrScheme () returned 0 [0157.131] GetSystemMetrics (nIndex=46) returned 2 [0157.131] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.131] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.131] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.131] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.142] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.142] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.142] GetLastError () returned 0x578 [0157.142] CanUserWritePwrScheme () returned 0 [0157.143] GetSystemMetrics (nIndex=46) returned 2 [0157.143] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.143] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.143] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.143] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.159] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.159] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.159] GetLastError () returned 0x578 [0157.159] CanUserWritePwrScheme () returned 0 [0157.160] GetSystemMetrics (nIndex=46) returned 2 [0157.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.160] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.160] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.160] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.171] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.171] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.171] GetLastError () returned 0x578 [0157.171] CanUserWritePwrScheme () returned 0 [0157.172] GetSystemMetrics (nIndex=46) returned 2 [0157.172] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.172] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.172] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.172] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.183] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.183] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.183] GetLastError () returned 0x578 [0157.183] CanUserWritePwrScheme () returned 0 [0157.184] GetSystemMetrics (nIndex=46) returned 2 [0157.184] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.184] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.184] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.184] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.197] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.197] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.197] GetLastError () returned 0x578 [0157.197] CanUserWritePwrScheme () returned 0 [0157.198] GetSystemMetrics (nIndex=46) returned 2 [0157.198] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.198] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.198] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.198] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.209] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.209] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.209] GetLastError () returned 0x578 [0157.209] CanUserWritePwrScheme () returned 0 [0157.210] GetSystemMetrics (nIndex=46) returned 2 [0157.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.210] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.210] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.210] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.221] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.221] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.221] GetLastError () returned 0x578 [0157.221] CanUserWritePwrScheme () returned 0 [0157.222] GetSystemMetrics (nIndex=46) returned 2 [0157.222] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.222] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.222] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.222] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.233] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.233] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.233] GetLastError () returned 0x578 [0157.233] CanUserWritePwrScheme () returned 0 [0157.234] GetSystemMetrics (nIndex=46) returned 2 [0157.234] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.234] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.234] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.234] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.245] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.245] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.245] GetLastError () returned 0x578 [0157.245] CanUserWritePwrScheme () returned 0 [0157.245] GetSystemMetrics (nIndex=46) returned 2 [0157.246] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.246] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.246] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.246] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.259] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.259] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.259] GetLastError () returned 0x578 [0157.259] CanUserWritePwrScheme () returned 0 [0157.260] GetSystemMetrics (nIndex=46) returned 2 [0157.260] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.260] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.260] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.260] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.271] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.271] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.271] GetLastError () returned 0x578 [0157.271] CanUserWritePwrScheme () returned 0 [0157.272] GetSystemMetrics (nIndex=46) returned 2 [0157.272] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.272] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.272] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.272] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.282] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.282] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.282] GetLastError () returned 0x578 [0157.282] CanUserWritePwrScheme () returned 0 [0157.283] GetSystemMetrics (nIndex=46) returned 2 [0157.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.283] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.283] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.283] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.294] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.294] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.294] GetLastError () returned 0x578 [0157.294] CanUserWritePwrScheme () returned 0 [0157.295] GetSystemMetrics (nIndex=46) returned 2 [0157.295] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.306] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.306] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.306] GetLastError () returned 0x578 [0157.306] CanUserWritePwrScheme () returned 0 [0157.307] GetSystemMetrics (nIndex=46) returned 2 [0157.307] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.307] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.307] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.307] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.318] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.318] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.318] GetLastError () returned 0x578 [0157.318] CanUserWritePwrScheme () returned 0 [0157.319] GetSystemMetrics (nIndex=46) returned 2 [0157.319] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.319] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.319] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.319] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.332] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.332] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.332] GetLastError () returned 0x578 [0157.332] CanUserWritePwrScheme () returned 0 [0157.333] GetSystemMetrics (nIndex=46) returned 2 [0157.333] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.333] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.333] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.333] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.344] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.344] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.344] GetLastError () returned 0x578 [0157.344] CanUserWritePwrScheme () returned 0 [0157.345] GetSystemMetrics (nIndex=46) returned 2 [0157.345] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.345] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.345] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.345] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.356] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.356] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.356] GetLastError () returned 0x578 [0157.356] CanUserWritePwrScheme () returned 0 [0157.357] GetSystemMetrics (nIndex=46) returned 2 [0157.357] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.357] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.357] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.357] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.372] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.372] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.372] GetLastError () returned 0x578 [0157.372] CanUserWritePwrScheme () returned 0 [0157.373] GetSystemMetrics (nIndex=46) returned 2 [0157.373] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.373] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.373] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.373] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.384] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.384] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.384] GetLastError () returned 0x578 [0157.384] CanUserWritePwrScheme () returned 0 [0157.387] GetSystemMetrics (nIndex=46) returned 2 [0157.388] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.388] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.388] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.388] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.405] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.405] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.405] GetLastError () returned 0x578 [0157.405] CanUserWritePwrScheme () returned 0 [0157.406] GetSystemMetrics (nIndex=46) returned 2 [0157.406] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.406] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.406] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.406] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.417] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.417] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.417] GetLastError () returned 0x578 [0157.417] CanUserWritePwrScheme () returned 0 [0157.418] GetSystemMetrics (nIndex=46) returned 2 [0157.418] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.418] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.418] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.418] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.429] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.429] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.429] GetLastError () returned 0x578 [0157.429] CanUserWritePwrScheme () returned 0 [0157.430] GetSystemMetrics (nIndex=46) returned 2 [0157.430] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.430] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.430] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.430] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.441] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.441] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.441] GetLastError () returned 0x578 [0157.441] CanUserWritePwrScheme () returned 0 [0157.442] GetSystemMetrics (nIndex=46) returned 2 [0157.442] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.442] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.442] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.442] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.455] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.455] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.455] GetLastError () returned 0x578 [0157.455] CanUserWritePwrScheme () returned 0 [0157.456] GetSystemMetrics (nIndex=46) returned 2 [0157.456] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.456] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.456] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.456] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.467] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.467] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.467] GetLastError () returned 0x578 [0157.467] CanUserWritePwrScheme () returned 0 [0157.468] GetSystemMetrics (nIndex=46) returned 2 [0157.468] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.468] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.468] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.468] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.478] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.478] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.478] GetLastError () returned 0x578 [0157.478] CanUserWritePwrScheme () returned 0 [0157.480] GetSystemMetrics (nIndex=46) returned 2 [0157.480] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.480] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.480] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.480] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.491] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.491] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.491] GetLastError () returned 0x578 [0157.491] CanUserWritePwrScheme () returned 0 [0157.492] GetSystemMetrics (nIndex=46) returned 2 [0157.492] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.492] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.492] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.492] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.503] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.503] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.503] GetLastError () returned 0x578 [0157.503] CanUserWritePwrScheme () returned 0 [0157.504] GetSystemMetrics (nIndex=46) returned 2 [0157.504] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.504] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.504] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.504] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.514] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.514] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.514] GetLastError () returned 0x578 [0157.514] CanUserWritePwrScheme () returned 0 [0157.517] GetSystemMetrics (nIndex=46) returned 2 [0157.517] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.517] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.518] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.518] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.528] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.528] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.528] GetLastError () returned 0x578 [0157.528] CanUserWritePwrScheme () returned 0 [0157.529] GetSystemMetrics (nIndex=46) returned 2 [0157.529] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.529] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.529] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.529] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.539] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.539] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.539] GetLastError () returned 0x578 [0157.539] CanUserWritePwrScheme () returned 0 [0157.540] GetSystemMetrics (nIndex=46) returned 2 [0157.540] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.540] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.540] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.540] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.551] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.551] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.551] GetLastError () returned 0x578 [0157.551] CanUserWritePwrScheme () returned 0 [0157.552] GetSystemMetrics (nIndex=46) returned 2 [0157.552] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.552] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.552] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.552] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.562] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.562] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.562] GetLastError () returned 0x578 [0157.562] CanUserWritePwrScheme () returned 0 [0157.563] GetSystemMetrics (nIndex=46) returned 2 [0157.563] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.563] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.563] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.563] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.574] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.574] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.574] GetLastError () returned 0x578 [0157.574] CanUserWritePwrScheme () returned 0 [0157.575] GetSystemMetrics (nIndex=46) returned 2 [0157.575] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.575] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.575] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.575] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.588] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.588] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.589] GetLastError () returned 0x578 [0157.589] CanUserWritePwrScheme () returned 0 [0157.589] GetSystemMetrics (nIndex=46) returned 2 [0157.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.590] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.590] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.600] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.600] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.600] GetLastError () returned 0x578 [0157.600] CanUserWritePwrScheme () returned 0 [0157.601] GetSystemMetrics (nIndex=46) returned 2 [0157.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.612] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.612] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.612] GetLastError () returned 0x578 [0157.612] CanUserWritePwrScheme () returned 0 [0157.613] GetSystemMetrics (nIndex=46) returned 2 [0157.613] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.613] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.613] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.613] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.634] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.634] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.634] GetLastError () returned 0x578 [0157.634] CanUserWritePwrScheme () returned 0 [0157.636] GetSystemMetrics (nIndex=46) returned 2 [0157.636] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.636] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.636] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.636] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.650] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.650] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.650] GetLastError () returned 0x578 [0157.650] CanUserWritePwrScheme () returned 0 [0157.651] GetSystemMetrics (nIndex=46) returned 2 [0157.651] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.651] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.651] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.651] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.661] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.662] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.662] GetLastError () returned 0x578 [0157.662] CanUserWritePwrScheme () returned 0 [0157.662] GetSystemMetrics (nIndex=46) returned 2 [0157.663] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.663] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.663] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.663] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.673] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.673] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.673] GetLastError () returned 0x578 [0157.673] CanUserWritePwrScheme () returned 0 [0157.674] GetSystemMetrics (nIndex=46) returned 2 [0157.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.674] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.674] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.674] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.685] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.685] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.685] GetLastError () returned 0x578 [0157.685] CanUserWritePwrScheme () returned 0 [0157.686] GetSystemMetrics (nIndex=46) returned 2 [0157.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.686] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.686] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.686] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.699] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.699] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.699] GetLastError () returned 0x578 [0157.699] CanUserWritePwrScheme () returned 0 [0157.700] GetSystemMetrics (nIndex=46) returned 2 [0157.700] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.700] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.700] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.700] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.713] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.713] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.713] GetLastError () returned 0x578 [0157.713] CanUserWritePwrScheme () returned 0 [0157.714] GetSystemMetrics (nIndex=46) returned 2 [0157.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.714] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.714] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.714] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.725] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.725] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.725] GetLastError () returned 0x578 [0157.725] CanUserWritePwrScheme () returned 0 [0157.726] GetSystemMetrics (nIndex=46) returned 2 [0157.726] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.726] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.726] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.726] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.737] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.737] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.737] GetLastError () returned 0x578 [0157.737] CanUserWritePwrScheme () returned 0 [0157.738] GetSystemMetrics (nIndex=46) returned 2 [0157.738] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.738] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.738] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.738] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.749] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.749] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.749] GetLastError () returned 0x578 [0157.749] CanUserWritePwrScheme () returned 0 [0157.749] GetSystemMetrics (nIndex=46) returned 2 [0157.749] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.750] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.750] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.750] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.760] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.760] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.760] GetLastError () returned 0x578 [0157.761] CanUserWritePwrScheme () returned 0 [0157.761] GetSystemMetrics (nIndex=46) returned 2 [0157.761] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.761] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.761] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.761] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.772] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.772] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.772] GetLastError () returned 0x578 [0157.772] CanUserWritePwrScheme () returned 0 [0157.773] GetSystemMetrics (nIndex=46) returned 2 [0157.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.773] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.773] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.787] GetLastError () returned 0x578 [0157.787] CanUserWritePwrScheme () returned 0 [0157.788] GetSystemMetrics (nIndex=46) returned 2 [0157.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.788] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.788] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.799] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.799] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.799] GetLastError () returned 0x578 [0157.799] CanUserWritePwrScheme () returned 0 [0157.800] GetSystemMetrics (nIndex=46) returned 2 [0157.800] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.800] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.800] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.800] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.811] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.811] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.811] GetLastError () returned 0x578 [0157.811] CanUserWritePwrScheme () returned 0 [0157.812] GetSystemMetrics (nIndex=46) returned 2 [0157.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.812] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.812] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.812] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.822] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.822] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.822] GetLastError () returned 0x578 [0157.823] CanUserWritePwrScheme () returned 0 [0157.823] GetSystemMetrics (nIndex=46) returned 2 [0157.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.824] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.824] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.834] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.834] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.834] GetLastError () returned 0x578 [0157.834] CanUserWritePwrScheme () returned 0 [0157.835] GetSystemMetrics (nIndex=46) returned 2 [0157.835] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.835] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.835] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.835] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.848] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.848] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.848] GetLastError () returned 0x578 [0157.849] CanUserWritePwrScheme () returned 0 [0157.849] GetSystemMetrics (nIndex=46) returned 2 [0157.849] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.849] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.849] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.850] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.866] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.866] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.866] GetLastError () returned 0x578 [0157.866] CanUserWritePwrScheme () returned 0 [0157.867] GetSystemMetrics (nIndex=46) returned 2 [0157.867] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.867] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.867] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.867] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.878] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.878] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.878] GetLastError () returned 0x578 [0157.878] CanUserWritePwrScheme () returned 0 [0157.879] GetSystemMetrics (nIndex=46) returned 2 [0157.879] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.879] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.879] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.879] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.890] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.890] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.890] GetLastError () returned 0x578 [0157.890] CanUserWritePwrScheme () returned 0 [0157.891] GetSystemMetrics (nIndex=46) returned 2 [0157.891] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.891] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.891] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.891] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.909] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.909] GetLastError () returned 0x578 [0157.909] CanUserWritePwrScheme () returned 0 [0157.909] GetSystemMetrics (nIndex=46) returned 2 [0157.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.910] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.910] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.910] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.920] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.920] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.920] GetLastError () returned 0x578 [0157.920] CanUserWritePwrScheme () returned 0 [0157.921] GetSystemMetrics (nIndex=46) returned 2 [0157.921] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.921] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.921] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.921] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.932] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.932] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.932] GetLastError () returned 0x578 [0157.932] CanUserWritePwrScheme () returned 0 [0157.933] GetSystemMetrics (nIndex=46) returned 2 [0157.933] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.933] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.933] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.933] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.943] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.943] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.943] GetLastError () returned 0x578 [0157.943] CanUserWritePwrScheme () returned 0 [0157.944] GetSystemMetrics (nIndex=46) returned 2 [0157.944] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.944] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.944] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.944] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.955] GetLastError () returned 0x578 [0157.955] CanUserWritePwrScheme () returned 0 [0157.956] GetSystemMetrics (nIndex=46) returned 2 [0157.956] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.956] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.956] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.956] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.967] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.967] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.967] GetLastError () returned 0x578 [0157.967] CanUserWritePwrScheme () returned 0 [0157.968] GetSystemMetrics (nIndex=46) returned 2 [0157.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.981] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.981] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.981] GetLastError () returned 0x578 [0157.981] CanUserWritePwrScheme () returned 0 [0157.982] GetSystemMetrics (nIndex=46) returned 2 [0157.982] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.982] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.982] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.982] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0157.993] GetWindowTextLengthA (hWnd=0x0) returned 0 [0157.993] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0157.993] GetLastError () returned 0x578 [0157.993] CanUserWritePwrScheme () returned 0 [0157.994] GetSystemMetrics (nIndex=46) returned 2 [0157.994] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0157.994] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0157.994] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0157.994] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.005] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.005] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.005] GetLastError () returned 0x578 [0158.005] CanUserWritePwrScheme () returned 0 [0158.006] GetSystemMetrics (nIndex=46) returned 2 [0158.006] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.006] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.006] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.006] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.016] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.016] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.016] GetLastError () returned 0x578 [0158.016] CanUserWritePwrScheme () returned 0 [0158.017] GetSystemMetrics (nIndex=46) returned 2 [0158.017] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.017] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.017] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.017] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.028] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.028] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.028] GetLastError () returned 0x578 [0158.028] CanUserWritePwrScheme () returned 0 [0158.029] GetSystemMetrics (nIndex=46) returned 2 [0158.029] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.029] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.029] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.029] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.044] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.044] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.044] GetLastError () returned 0x578 [0158.045] CanUserWritePwrScheme () returned 0 [0158.045] GetSystemMetrics (nIndex=46) returned 2 [0158.045] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.045] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.045] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.046] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.056] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.056] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.056] GetLastError () returned 0x578 [0158.056] CanUserWritePwrScheme () returned 0 [0158.057] GetSystemMetrics (nIndex=46) returned 2 [0158.057] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.057] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.057] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.057] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.068] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.068] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.068] GetLastError () returned 0x578 [0158.068] CanUserWritePwrScheme () returned 0 [0158.069] GetSystemMetrics (nIndex=46) returned 2 [0158.069] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.069] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.069] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.069] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.079] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.079] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.079] GetLastError () returned 0x578 [0158.079] CanUserWritePwrScheme () returned 0 [0158.080] GetSystemMetrics (nIndex=46) returned 2 [0158.080] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.080] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.080] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.080] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.134] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.134] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.134] GetLastError () returned 0x578 [0158.134] CanUserWritePwrScheme () returned 0 [0158.135] GetSystemMetrics (nIndex=46) returned 2 [0158.135] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.135] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.135] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.135] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.144] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.144] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.144] GetLastError () returned 0x578 [0158.144] CanUserWritePwrScheme () returned 0 [0158.145] GetSystemMetrics (nIndex=46) returned 2 [0158.145] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.145] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.145] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.145] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.156] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.156] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.156] GetLastError () returned 0x578 [0158.156] CanUserWritePwrScheme () returned 0 [0158.157] GetSystemMetrics (nIndex=46) returned 2 [0158.157] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.157] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.157] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.157] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.170] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.170] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.170] GetLastError () returned 0x578 [0158.170] CanUserWritePwrScheme () returned 0 [0158.171] GetSystemMetrics (nIndex=46) returned 2 [0158.171] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.171] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.171] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.171] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.182] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.182] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.182] GetLastError () returned 0x578 [0158.182] CanUserWritePwrScheme () returned 0 [0158.183] GetSystemMetrics (nIndex=46) returned 2 [0158.183] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.183] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.183] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.183] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.194] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.194] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.194] GetLastError () returned 0x578 [0158.194] CanUserWritePwrScheme () returned 0 [0158.195] GetSystemMetrics (nIndex=46) returned 2 [0158.195] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.195] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.195] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.195] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.205] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.205] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.205] GetLastError () returned 0x578 [0158.206] CanUserWritePwrScheme () returned 0 [0158.206] GetSystemMetrics (nIndex=46) returned 2 [0158.206] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.206] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.206] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.207] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.217] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.217] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.217] GetLastError () returned 0x578 [0158.217] CanUserWritePwrScheme () returned 0 [0158.218] GetSystemMetrics (nIndex=46) returned 2 [0158.218] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.218] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.218] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.218] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.230] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.230] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.230] GetLastError () returned 0x578 [0158.230] CanUserWritePwrScheme () returned 0 [0158.231] GetSystemMetrics (nIndex=46) returned 2 [0158.231] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.231] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.231] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.231] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.244] GetLastError () returned 0x578 [0158.244] CanUserWritePwrScheme () returned 0 [0158.245] GetSystemMetrics (nIndex=46) returned 2 [0158.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.256] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.256] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.256] GetLastError () returned 0x578 [0158.256] CanUserWritePwrScheme () returned 0 [0158.257] GetSystemMetrics (nIndex=46) returned 2 [0158.257] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.257] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.257] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.268] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.268] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.268] GetLastError () returned 0x578 [0158.268] CanUserWritePwrScheme () returned 0 [0158.269] GetSystemMetrics (nIndex=46) returned 2 [0158.269] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.269] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.269] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.269] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.279] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.279] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.279] GetLastError () returned 0x578 [0158.279] CanUserWritePwrScheme () returned 0 [0158.280] GetSystemMetrics (nIndex=46) returned 2 [0158.280] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.280] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.280] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.280] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.285] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.285] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.285] GetLastError () returned 0x578 [0158.285] CanUserWritePwrScheme () returned 0 [0158.286] GetSystemMetrics (nIndex=46) returned 2 [0158.286] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.286] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.286] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.286] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.291] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.291] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.291] GetLastError () returned 0x578 [0158.291] CanUserWritePwrScheme () returned 0 [0158.292] GetSystemMetrics (nIndex=46) returned 2 [0158.292] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.292] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.292] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.292] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.300] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.300] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.300] GetLastError () returned 0x578 [0158.300] CanUserWritePwrScheme () returned 0 [0158.301] GetSystemMetrics (nIndex=46) returned 2 [0158.301] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.301] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.301] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.301] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.312] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.312] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.312] GetLastError () returned 0x578 [0158.312] CanUserWritePwrScheme () returned 0 [0158.313] GetSystemMetrics (nIndex=46) returned 2 [0158.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.313] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.313] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.313] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.324] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.324] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.324] GetLastError () returned 0x578 [0158.324] CanUserWritePwrScheme () returned 0 [0158.325] GetSystemMetrics (nIndex=46) returned 2 [0158.325] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.325] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.325] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.325] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.391] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.391] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.391] GetLastError () returned 0x578 [0158.391] CanUserWritePwrScheme () returned 0 [0158.392] GetSystemMetrics (nIndex=46) returned 2 [0158.392] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.392] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.392] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.392] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.410] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.410] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.410] GetLastError () returned 0x578 [0158.410] CanUserWritePwrScheme () returned 0 [0158.411] GetSystemMetrics (nIndex=46) returned 2 [0158.411] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.411] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.411] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.411] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.422] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.422] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.422] GetLastError () returned 0x578 [0158.422] CanUserWritePwrScheme () returned 0 [0158.423] GetSystemMetrics (nIndex=46) returned 2 [0158.423] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.423] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.423] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.423] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.437] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.437] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.437] GetLastError () returned 0x578 [0158.437] CanUserWritePwrScheme () returned 0 [0158.438] GetSystemMetrics (nIndex=46) returned 2 [0158.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.438] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.449] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.449] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.449] GetLastError () returned 0x578 [0158.449] CanUserWritePwrScheme () returned 0 [0158.450] GetSystemMetrics (nIndex=46) returned 2 [0158.450] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.450] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.450] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.450] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.460] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.460] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.461] GetLastError () returned 0x578 [0158.461] CanUserWritePwrScheme () returned 0 [0158.461] GetSystemMetrics (nIndex=46) returned 2 [0158.461] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.461] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.461] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.462] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.472] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.472] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.472] GetLastError () returned 0x578 [0158.472] CanUserWritePwrScheme () returned 0 [0158.473] GetSystemMetrics (nIndex=46) returned 2 [0158.473] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.473] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.473] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.473] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.478] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.478] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.478] GetLastError () returned 0x578 [0158.478] CanUserWritePwrScheme () returned 0 [0158.479] GetSystemMetrics (nIndex=46) returned 2 [0158.479] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.479] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.479] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.479] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.484] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.484] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.484] GetLastError () returned 0x578 [0158.484] CanUserWritePwrScheme () returned 0 [0158.485] GetSystemMetrics (nIndex=46) returned 2 [0158.485] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.485] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.485] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.485] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.489] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.489] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.490] GetLastError () returned 0x578 [0158.490] CanUserWritePwrScheme () returned 0 [0158.490] GetSystemMetrics (nIndex=46) returned 2 [0158.490] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.491] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.491] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.491] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.498] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.498] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.498] GetLastError () returned 0x578 [0158.498] CanUserWritePwrScheme () returned 0 [0158.499] GetSystemMetrics (nIndex=46) returned 2 [0158.499] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.499] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.499] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.499] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.504] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.504] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.505] GetLastError () returned 0x578 [0158.505] CanUserWritePwrScheme () returned 0 [0158.505] GetSystemMetrics (nIndex=46) returned 2 [0158.505] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.505] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.505] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.506] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.510] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.510] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.510] GetLastError () returned 0x578 [0158.510] CanUserWritePwrScheme () returned 0 [0158.511] GetSystemMetrics (nIndex=46) returned 2 [0158.511] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.511] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.511] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.511] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.517] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.517] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.517] GetLastError () returned 0x578 [0158.517] CanUserWritePwrScheme () returned 0 [0158.518] GetSystemMetrics (nIndex=46) returned 2 [0158.518] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.518] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.518] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.518] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.522] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.522] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.522] GetLastError () returned 0x578 [0158.522] CanUserWritePwrScheme () returned 0 [0158.523] GetSystemMetrics (nIndex=46) returned 2 [0158.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.523] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.523] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.523] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.528] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.528] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.528] GetLastError () returned 0x578 [0158.528] CanUserWritePwrScheme () returned 0 [0158.529] GetSystemMetrics (nIndex=46) returned 2 [0158.529] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.529] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.529] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.529] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.534] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.534] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.534] GetLastError () returned 0x578 [0158.534] CanUserWritePwrScheme () returned 0 [0158.535] GetSystemMetrics (nIndex=46) returned 2 [0158.535] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.535] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.535] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.535] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.540] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.540] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.540] GetLastError () returned 0x578 [0158.540] CanUserWritePwrScheme () returned 0 [0158.541] GetSystemMetrics (nIndex=46) returned 2 [0158.541] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.541] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.541] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.541] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.546] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.546] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.546] GetLastError () returned 0x578 [0158.546] CanUserWritePwrScheme () returned 0 [0158.547] GetSystemMetrics (nIndex=46) returned 2 [0158.547] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.547] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.547] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.547] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.553] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.553] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.553] GetLastError () returned 0x578 [0158.553] CanUserWritePwrScheme () returned 0 [0158.554] GetSystemMetrics (nIndex=46) returned 2 [0158.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.554] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.554] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.554] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.568] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.568] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.568] GetLastError () returned 0x578 [0158.568] CanUserWritePwrScheme () returned 0 [0158.569] GetSystemMetrics (nIndex=46) returned 2 [0158.569] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.569] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.569] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.569] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.580] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.580] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.580] GetLastError () returned 0x578 [0158.580] CanUserWritePwrScheme () returned 0 [0158.581] GetSystemMetrics (nIndex=46) returned 2 [0158.581] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.581] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.581] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.581] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.591] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.591] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.591] GetLastError () returned 0x578 [0158.592] CanUserWritePwrScheme () returned 0 [0158.592] GetSystemMetrics (nIndex=46) returned 2 [0158.592] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.592] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.593] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.593] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.603] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.603] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.603] GetLastError () returned 0x578 [0158.603] CanUserWritePwrScheme () returned 0 [0158.604] GetSystemMetrics (nIndex=46) returned 2 [0158.604] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.604] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.604] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.604] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.615] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.615] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.615] GetLastError () returned 0x578 [0158.615] CanUserWritePwrScheme () returned 0 [0158.616] GetSystemMetrics (nIndex=46) returned 2 [0158.616] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.616] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.616] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.616] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.630] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.630] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.630] GetLastError () returned 0x578 [0158.630] CanUserWritePwrScheme () returned 0 [0158.631] GetSystemMetrics (nIndex=46) returned 2 [0158.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.643] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.643] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.643] GetLastError () returned 0x578 [0158.643] CanUserWritePwrScheme () returned 0 [0158.644] GetSystemMetrics (nIndex=46) returned 2 [0158.644] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.644] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.644] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.644] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.655] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.655] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.655] GetLastError () returned 0x578 [0158.655] CanUserWritePwrScheme () returned 0 [0158.656] GetSystemMetrics (nIndex=46) returned 2 [0158.656] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.656] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.656] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.656] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.667] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.667] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.667] GetLastError () returned 0x578 [0158.667] CanUserWritePwrScheme () returned 0 [0158.668] GetSystemMetrics (nIndex=46) returned 2 [0158.668] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.668] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.668] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.668] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.678] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.678] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.678] GetLastError () returned 0x578 [0158.678] CanUserWritePwrScheme () returned 0 [0158.679] GetSystemMetrics (nIndex=46) returned 2 [0158.679] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.679] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.679] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.679] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.693] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.693] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.693] GetLastError () returned 0x578 [0158.693] CanUserWritePwrScheme () returned 0 [0158.694] GetSystemMetrics (nIndex=46) returned 2 [0158.694] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.694] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.694] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.694] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.705] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.705] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.705] GetLastError () returned 0x578 [0158.705] CanUserWritePwrScheme () returned 0 [0158.706] GetSystemMetrics (nIndex=46) returned 2 [0158.706] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.706] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.706] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.706] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.717] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.717] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.717] GetLastError () returned 0x578 [0158.717] CanUserWritePwrScheme () returned 0 [0158.717] GetSystemMetrics (nIndex=46) returned 2 [0158.718] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.718] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.718] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.718] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.728] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.728] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.728] GetLastError () returned 0x578 [0158.728] CanUserWritePwrScheme () returned 0 [0158.729] GetSystemMetrics (nIndex=46) returned 2 [0158.729] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.729] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.729] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.729] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.740] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.740] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.740] GetLastError () returned 0x578 [0158.740] CanUserWritePwrScheme () returned 0 [0158.741] GetSystemMetrics (nIndex=46) returned 2 [0158.741] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.741] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.741] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.741] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.755] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.755] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.755] GetLastError () returned 0x578 [0158.755] CanUserWritePwrScheme () returned 0 [0158.756] GetSystemMetrics (nIndex=46) returned 2 [0158.756] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.756] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.756] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.756] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.764] GetLastError () returned 0x578 [0158.764] CanUserWritePwrScheme () returned 0 [0158.765] GetSystemMetrics (nIndex=46) returned 2 [0158.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.765] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.765] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.765] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.770] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.770] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.770] GetLastError () returned 0x578 [0158.770] CanUserWritePwrScheme () returned 0 [0158.771] GetSystemMetrics (nIndex=46) returned 2 [0158.771] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.771] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.771] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.771] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.775] GetLastError () returned 0x578 [0158.776] CanUserWritePwrScheme () returned 0 [0158.776] GetSystemMetrics (nIndex=46) returned 2 [0158.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.776] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.776] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.777] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.782] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.782] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.782] GetLastError () returned 0x578 [0158.782] CanUserWritePwrScheme () returned 0 [0158.783] GetSystemMetrics (nIndex=46) returned 2 [0158.783] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.783] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.783] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.783] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.787] GetLastError () returned 0x578 [0158.787] CanUserWritePwrScheme () returned 0 [0158.788] GetSystemMetrics (nIndex=46) returned 2 [0158.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.788] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.788] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.793] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.793] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.793] GetLastError () returned 0x578 [0158.793] CanUserWritePwrScheme () returned 0 [0158.794] GetSystemMetrics (nIndex=46) returned 2 [0158.794] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.794] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.794] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.794] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.799] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.799] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.799] GetLastError () returned 0x578 [0158.799] CanUserWritePwrScheme () returned 0 [0158.800] GetSystemMetrics (nIndex=46) returned 2 [0158.800] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.800] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.800] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.800] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.807] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.807] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.807] GetLastError () returned 0x578 [0158.807] CanUserWritePwrScheme () returned 0 [0158.808] GetSystemMetrics (nIndex=46) returned 2 [0158.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.808] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.808] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.808] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.821] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.821] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.822] GetLastError () returned 0x578 [0158.822] CanUserWritePwrScheme () returned 0 [0158.822] GetSystemMetrics (nIndex=46) returned 2 [0158.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.833] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.833] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.833] GetLastError () returned 0x578 [0158.833] CanUserWritePwrScheme () returned 0 [0158.834] GetSystemMetrics (nIndex=46) returned 2 [0158.834] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.834] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.834] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.834] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.845] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.845] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.845] GetLastError () returned 0x578 [0158.845] CanUserWritePwrScheme () returned 0 [0158.846] GetSystemMetrics (nIndex=46) returned 2 [0158.846] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.846] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.846] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.846] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.857] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.857] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.857] GetLastError () returned 0x578 [0158.857] CanUserWritePwrScheme () returned 0 [0158.858] GetSystemMetrics (nIndex=46) returned 2 [0158.858] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.858] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.858] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.858] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.869] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.869] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.869] GetLastError () returned 0x578 [0158.869] CanUserWritePwrScheme () returned 0 [0158.870] GetSystemMetrics (nIndex=46) returned 2 [0158.870] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.870] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.870] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.870] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.880] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.880] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.881] GetLastError () returned 0x578 [0158.881] CanUserWritePwrScheme () returned 0 [0158.881] GetSystemMetrics (nIndex=46) returned 2 [0158.881] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.882] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.882] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.882] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.895] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.895] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.895] GetLastError () returned 0x578 [0158.895] CanUserWritePwrScheme () returned 0 [0158.896] GetSystemMetrics (nIndex=46) returned 2 [0158.896] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.896] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.896] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.896] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.908] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.908] GetLastError () returned 0x578 [0158.908] CanUserWritePwrScheme () returned 0 [0158.909] GetSystemMetrics (nIndex=46) returned 2 [0158.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.909] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.909] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.909] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.919] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.920] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.920] GetLastError () returned 0x578 [0158.920] CanUserWritePwrScheme () returned 0 [0158.920] GetSystemMetrics (nIndex=46) returned 2 [0158.921] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.921] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.921] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.921] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.932] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.932] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.932] GetLastError () returned 0x578 [0158.932] CanUserWritePwrScheme () returned 0 [0158.933] GetSystemMetrics (nIndex=46) returned 2 [0158.933] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.933] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.933] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.933] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.976] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.976] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.976] GetLastError () returned 0x578 [0158.977] CanUserWritePwrScheme () returned 0 [0158.977] GetSystemMetrics (nIndex=46) returned 2 [0158.977] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.977] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.977] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.978] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.988] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.988] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.988] GetLastError () returned 0x578 [0158.988] CanUserWritePwrScheme () returned 0 [0158.989] GetSystemMetrics (nIndex=46) returned 2 [0158.989] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.989] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.989] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.989] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0158.998] GetWindowTextLengthA (hWnd=0x0) returned 0 [0158.998] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0158.998] GetLastError () returned 0x578 [0158.998] CanUserWritePwrScheme () returned 0 [0158.999] GetSystemMetrics (nIndex=46) returned 2 [0158.999] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0158.999] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0158.999] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0158.999] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.004] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.004] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.004] GetLastError () returned 0x578 [0159.004] CanUserWritePwrScheme () returned 0 [0159.005] GetSystemMetrics (nIndex=46) returned 2 [0159.005] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.005] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.005] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.005] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.010] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.010] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.010] GetLastError () returned 0x578 [0159.010] CanUserWritePwrScheme () returned 0 [0159.011] GetSystemMetrics (nIndex=46) returned 2 [0159.011] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.011] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.011] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.011] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.018] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.018] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.018] GetLastError () returned 0x578 [0159.018] CanUserWritePwrScheme () returned 0 [0159.019] GetSystemMetrics (nIndex=46) returned 2 [0159.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.019] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.024] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.024] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.024] GetLastError () returned 0x578 [0159.024] CanUserWritePwrScheme () returned 0 [0159.025] GetSystemMetrics (nIndex=46) returned 2 [0159.025] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.025] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.025] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.025] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.030] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.030] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.030] GetLastError () returned 0x578 [0159.030] CanUserWritePwrScheme () returned 0 [0159.031] GetSystemMetrics (nIndex=46) returned 2 [0159.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.031] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.031] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.031] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.036] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.036] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.036] GetLastError () returned 0x578 [0159.036] CanUserWritePwrScheme () returned 0 [0159.037] GetSystemMetrics (nIndex=46) returned 2 [0159.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.037] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.037] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.037] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.042] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.042] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.042] GetLastError () returned 0x578 [0159.042] CanUserWritePwrScheme () returned 0 [0159.043] GetSystemMetrics (nIndex=46) returned 2 [0159.043] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.043] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.043] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.043] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.047] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.047] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.048] GetLastError () returned 0x578 [0159.048] CanUserWritePwrScheme () returned 0 [0159.048] GetSystemMetrics (nIndex=46) returned 2 [0159.048] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.048] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.048] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.049] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.053] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.053] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.053] GetLastError () returned 0x578 [0159.053] CanUserWritePwrScheme () returned 0 [0159.054] GetSystemMetrics (nIndex=46) returned 2 [0159.054] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.054] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.054] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.054] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.059] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.059] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.059] GetLastError () returned 0x578 [0159.059] CanUserWritePwrScheme () returned 0 [0159.060] GetSystemMetrics (nIndex=46) returned 2 [0159.060] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.060] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.060] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.060] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.067] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.067] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.067] GetLastError () returned 0x578 [0159.067] CanUserWritePwrScheme () returned 0 [0159.068] GetSystemMetrics (nIndex=46) returned 2 [0159.068] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.068] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.068] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.068] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.081] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.081] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.081] GetLastError () returned 0x578 [0159.081] CanUserWritePwrScheme () returned 0 [0159.082] GetSystemMetrics (nIndex=46) returned 2 [0159.082] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.082] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.082] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.082] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.093] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.093] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.093] GetLastError () returned 0x578 [0159.094] CanUserWritePwrScheme () returned 0 [0159.094] GetSystemMetrics (nIndex=46) returned 2 [0159.094] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.094] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.094] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.095] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.105] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.105] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.105] GetLastError () returned 0x578 [0159.105] CanUserWritePwrScheme () returned 0 [0159.106] GetSystemMetrics (nIndex=46) returned 2 [0159.106] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.106] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.106] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.106] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.117] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.117] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.117] GetLastError () returned 0x578 [0159.117] CanUserWritePwrScheme () returned 0 [0159.118] GetSystemMetrics (nIndex=46) returned 2 [0159.118] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.118] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.118] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.118] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.159] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.159] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.159] GetLastError () returned 0x578 [0159.159] CanUserWritePwrScheme () returned 0 [0159.160] GetSystemMetrics (nIndex=46) returned 2 [0159.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.160] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.160] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.160] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.171] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.171] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.171] GetLastError () returned 0x578 [0159.171] CanUserWritePwrScheme () returned 0 [0159.172] GetSystemMetrics (nIndex=46) returned 2 [0159.172] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.172] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.172] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.172] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.182] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.182] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.182] GetLastError () returned 0x578 [0159.182] CanUserWritePwrScheme () returned 0 [0159.183] GetSystemMetrics (nIndex=46) returned 2 [0159.183] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.183] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.183] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.183] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.194] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.194] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.194] GetLastError () returned 0x578 [0159.194] CanUserWritePwrScheme () returned 0 [0159.195] GetSystemMetrics (nIndex=46) returned 2 [0159.195] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.195] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.195] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.195] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.205] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.205] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.205] GetLastError () returned 0x578 [0159.205] CanUserWritePwrScheme () returned 0 [0159.206] GetSystemMetrics (nIndex=46) returned 2 [0159.206] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.206] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.206] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.206] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.219] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.219] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.219] GetLastError () returned 0x578 [0159.219] CanUserWritePwrScheme () returned 0 [0159.220] GetSystemMetrics (nIndex=46) returned 2 [0159.220] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.220] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.220] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.220] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.231] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.231] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.231] GetLastError () returned 0x578 [0159.231] CanUserWritePwrScheme () returned 0 [0159.232] GetSystemMetrics (nIndex=46) returned 2 [0159.232] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.232] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.232] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.232] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.242] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.242] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.243] GetLastError () returned 0x578 [0159.243] CanUserWritePwrScheme () returned 0 [0159.243] GetSystemMetrics (nIndex=46) returned 2 [0159.243] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.244] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.244] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.244] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.255] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.255] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.255] GetLastError () returned 0x578 [0159.255] CanUserWritePwrScheme () returned 0 [0159.256] GetSystemMetrics (nIndex=46) returned 2 [0159.256] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.256] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.256] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.267] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.267] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.267] GetLastError () returned 0x578 [0159.267] CanUserWritePwrScheme () returned 0 [0159.268] GetSystemMetrics (nIndex=46) returned 2 [0159.268] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.268] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.268] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.268] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.281] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.282] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.282] GetLastError () returned 0x578 [0159.282] CanUserWritePwrScheme () returned 0 [0159.282] GetSystemMetrics (nIndex=46) returned 2 [0159.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.283] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.283] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.283] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.293] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.293] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.293] GetLastError () returned 0x578 [0159.293] CanUserWritePwrScheme () returned 0 [0159.294] GetSystemMetrics (nIndex=46) returned 2 [0159.294] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.294] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.294] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.294] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.305] GetLastError () returned 0x578 [0159.305] CanUserWritePwrScheme () returned 0 [0159.306] GetSystemMetrics (nIndex=46) returned 2 [0159.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.306] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.306] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.306] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.316] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.316] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.316] GetLastError () returned 0x578 [0159.317] CanUserWritePwrScheme () returned 0 [0159.317] GetSystemMetrics (nIndex=46) returned 2 [0159.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.328] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.328] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.328] GetLastError () returned 0x578 [0159.328] CanUserWritePwrScheme () returned 0 [0159.329] GetSystemMetrics (nIndex=46) returned 2 [0159.329] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.329] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.329] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.329] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.342] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.342] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.342] GetLastError () returned 0x578 [0159.342] CanUserWritePwrScheme () returned 0 [0159.343] GetSystemMetrics (nIndex=46) returned 2 [0159.343] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.343] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.343] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.343] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.354] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.354] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.354] GetLastError () returned 0x578 [0159.354] CanUserWritePwrScheme () returned 0 [0159.355] GetSystemMetrics (nIndex=46) returned 2 [0159.355] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.355] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.355] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.355] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.366] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.366] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.366] GetLastError () returned 0x578 [0159.366] CanUserWritePwrScheme () returned 0 [0159.367] GetSystemMetrics (nIndex=46) returned 2 [0159.367] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.367] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.367] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.367] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.412] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.412] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.412] GetLastError () returned 0x578 [0159.412] CanUserWritePwrScheme () returned 0 [0159.413] GetSystemMetrics (nIndex=46) returned 2 [0159.413] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.413] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.413] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.413] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.424] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.424] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.424] GetLastError () returned 0x578 [0159.424] CanUserWritePwrScheme () returned 0 [0159.425] GetSystemMetrics (nIndex=46) returned 2 [0159.425] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.425] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.425] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.425] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.436] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.436] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.436] GetLastError () returned 0x578 [0159.436] CanUserWritePwrScheme () returned 0 [0159.437] GetSystemMetrics (nIndex=46) returned 2 [0159.437] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.437] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.437] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.437] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.447] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.447] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.447] GetLastError () returned 0x578 [0159.447] CanUserWritePwrScheme () returned 0 [0159.448] GetSystemMetrics (nIndex=46) returned 2 [0159.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.448] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.448] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.448] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.459] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.459] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.459] GetLastError () returned 0x578 [0159.459] CanUserWritePwrScheme () returned 0 [0159.460] GetSystemMetrics (nIndex=46) returned 2 [0159.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.460] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.460] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.460] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.473] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.473] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.474] GetLastError () returned 0x578 [0159.474] CanUserWritePwrScheme () returned 0 [0159.474] GetSystemMetrics (nIndex=46) returned 2 [0159.474] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.474] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.475] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.475] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.485] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.485] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.485] GetLastError () returned 0x578 [0159.485] CanUserWritePwrScheme () returned 0 [0159.486] GetSystemMetrics (nIndex=46) returned 2 [0159.486] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.486] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.486] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.486] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.497] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.497] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.497] GetLastError () returned 0x578 [0159.497] CanUserWritePwrScheme () returned 0 [0159.498] GetSystemMetrics (nIndex=46) returned 2 [0159.498] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.498] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.498] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.498] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.509] GetLastError () returned 0x578 [0159.510] CanUserWritePwrScheme () returned 0 [0159.510] GetSystemMetrics (nIndex=46) returned 2 [0159.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.510] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.510] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.510] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.522] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.522] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.522] GetLastError () returned 0x578 [0159.522] CanUserWritePwrScheme () returned 0 [0159.522] GetSystemMetrics (nIndex=46) returned 2 [0159.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.523] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.523] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.523] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.536] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.536] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.536] GetLastError () returned 0x578 [0159.536] CanUserWritePwrScheme () returned 0 [0159.537] GetSystemMetrics (nIndex=46) returned 2 [0159.537] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.537] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.537] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.537] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.547] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.547] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.548] GetLastError () returned 0x578 [0159.548] CanUserWritePwrScheme () returned 0 [0159.548] GetSystemMetrics (nIndex=46) returned 2 [0159.548] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.548] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.549] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.549] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.559] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.559] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.559] GetLastError () returned 0x578 [0159.559] CanUserWritePwrScheme () returned 0 [0159.560] GetSystemMetrics (nIndex=46) returned 2 [0159.560] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.560] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.560] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.560] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.571] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.571] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.571] GetLastError () returned 0x578 [0159.571] CanUserWritePwrScheme () returned 0 [0159.572] GetSystemMetrics (nIndex=46) returned 2 [0159.572] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.572] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.572] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.572] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.582] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.582] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.582] GetLastError () returned 0x578 [0159.582] CanUserWritePwrScheme () returned 0 [0159.583] GetSystemMetrics (nIndex=46) returned 2 [0159.583] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.583] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.583] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.583] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.594] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.594] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.594] GetLastError () returned 0x578 [0159.594] CanUserWritePwrScheme () returned 0 [0159.595] GetSystemMetrics (nIndex=46) returned 2 [0159.595] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.595] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.595] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.595] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.608] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.608] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.608] GetLastError () returned 0x578 [0159.608] CanUserWritePwrScheme () returned 0 [0159.609] GetSystemMetrics (nIndex=46) returned 2 [0159.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.609] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.609] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.609] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.620] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.620] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.620] GetLastError () returned 0x578 [0159.620] CanUserWritePwrScheme () returned 0 [0159.621] GetSystemMetrics (nIndex=46) returned 2 [0159.621] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.621] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.621] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.621] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.632] GetLastError () returned 0x578 [0159.632] CanUserWritePwrScheme () returned 0 [0159.633] GetSystemMetrics (nIndex=46) returned 2 [0159.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.689] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.689] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.689] GetLastError () returned 0x578 [0159.689] CanUserWritePwrScheme () returned 0 [0159.690] GetSystemMetrics (nIndex=46) returned 2 [0159.690] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.690] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.690] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.690] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.701] GetLastError () returned 0x578 [0159.701] CanUserWritePwrScheme () returned 0 [0159.702] GetSystemMetrics (nIndex=46) returned 2 [0159.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.712] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.712] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.712] GetLastError () returned 0x578 [0159.712] CanUserWritePwrScheme () returned 0 [0159.713] GetSystemMetrics (nIndex=46) returned 2 [0159.713] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.713] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.713] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.713] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.724] GetLastError () returned 0x578 [0159.724] CanUserWritePwrScheme () returned 0 [0159.725] GetSystemMetrics (nIndex=46) returned 2 [0159.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.725] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.725] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.725] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.738] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.738] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.739] GetLastError () returned 0x578 [0159.739] CanUserWritePwrScheme () returned 0 [0159.739] GetSystemMetrics (nIndex=46) returned 2 [0159.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.739] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.739] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.740] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.750] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.750] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.750] GetLastError () returned 0x578 [0159.750] CanUserWritePwrScheme () returned 0 [0159.751] GetSystemMetrics (nIndex=46) returned 2 [0159.751] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.751] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.751] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.751] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.762] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.762] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.762] GetLastError () returned 0x578 [0159.762] CanUserWritePwrScheme () returned 0 [0159.763] GetSystemMetrics (nIndex=46) returned 2 [0159.763] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.763] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.763] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.763] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.773] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.773] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.773] GetLastError () returned 0x578 [0159.773] CanUserWritePwrScheme () returned 0 [0159.774] GetSystemMetrics (nIndex=46) returned 2 [0159.774] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.774] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.774] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.774] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.785] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.785] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.785] GetLastError () returned 0x578 [0159.785] CanUserWritePwrScheme () returned 0 [0159.786] GetSystemMetrics (nIndex=46) returned 2 [0159.786] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.786] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.786] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.786] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.799] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.799] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.799] GetLastError () returned 0x578 [0159.799] CanUserWritePwrScheme () returned 0 [0159.800] GetSystemMetrics (nIndex=46) returned 2 [0159.800] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.800] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.800] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.800] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.811] GetLastError () returned 0x578 [0159.811] CanUserWritePwrScheme () returned 0 [0159.812] GetSystemMetrics (nIndex=46) returned 2 [0159.812] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.812] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.812] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.812] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.822] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.822] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.822] GetLastError () returned 0x578 [0159.822] CanUserWritePwrScheme () returned 0 [0159.823] GetSystemMetrics (nIndex=46) returned 2 [0159.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.834] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.834] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.834] GetLastError () returned 0x578 [0159.834] CanUserWritePwrScheme () returned 0 [0159.835] GetSystemMetrics (nIndex=46) returned 2 [0159.835] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.835] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.835] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.835] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.845] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.845] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.845] GetLastError () returned 0x578 [0159.845] CanUserWritePwrScheme () returned 0 [0159.846] GetSystemMetrics (nIndex=46) returned 2 [0159.846] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.846] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.846] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.846] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.857] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.857] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.857] GetLastError () returned 0x578 [0159.857] CanUserWritePwrScheme () returned 0 [0159.858] GetSystemMetrics (nIndex=46) returned 2 [0159.858] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.858] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.858] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.858] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.865] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.865] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.865] GetLastError () returned 0x578 [0159.865] CanUserWritePwrScheme () returned 0 [0159.866] GetSystemMetrics (nIndex=46) returned 2 [0159.866] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.866] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.866] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.866] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.871] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.871] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.871] GetLastError () returned 0x578 [0159.871] CanUserWritePwrScheme () returned 0 [0159.872] GetSystemMetrics (nIndex=46) returned 2 [0159.872] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.872] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.872] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.872] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.877] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.877] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.877] GetLastError () returned 0x578 [0159.877] CanUserWritePwrScheme () returned 0 [0159.878] GetSystemMetrics (nIndex=46) returned 2 [0159.878] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.878] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.878] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.878] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.883] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.883] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.883] GetLastError () returned 0x578 [0159.883] CanUserWritePwrScheme () returned 0 [0159.884] GetSystemMetrics (nIndex=46) returned 2 [0159.884] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.884] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.884] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.884] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.888] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.888] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.888] GetLastError () returned 0x578 [0159.888] CanUserWritePwrScheme () returned 0 [0159.889] GetSystemMetrics (nIndex=46) returned 2 [0159.889] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.889] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.889] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.889] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.894] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.894] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.894] GetLastError () returned 0x578 [0159.894] CanUserWritePwrScheme () returned 0 [0159.895] GetSystemMetrics (nIndex=46) returned 2 [0159.895] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.895] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.895] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.895] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.900] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.900] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.900] GetLastError () returned 0x578 [0159.900] CanUserWritePwrScheme () returned 0 [0159.901] GetSystemMetrics (nIndex=46) returned 2 [0159.901] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.901] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.901] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.901] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.906] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.906] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.906] GetLastError () returned 0x578 [0159.906] CanUserWritePwrScheme () returned 0 [0159.907] GetSystemMetrics (nIndex=46) returned 2 [0159.907] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.907] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.907] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.907] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.912] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.912] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.912] GetLastError () returned 0x578 [0159.912] CanUserWritePwrScheme () returned 0 [0159.913] GetSystemMetrics (nIndex=46) returned 2 [0159.913] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.913] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.913] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.913] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.917] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.917] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.917] GetLastError () returned 0x578 [0159.917] CanUserWritePwrScheme () returned 0 [0159.918] GetSystemMetrics (nIndex=46) returned 2 [0159.918] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.918] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.918] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.918] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.926] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.926] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.926] GetLastError () returned 0x578 [0159.926] CanUserWritePwrScheme () returned 0 [0159.927] GetSystemMetrics (nIndex=46) returned 2 [0159.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.927] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.927] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.927] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.932] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.932] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.932] GetLastError () returned 0x578 [0159.932] CanUserWritePwrScheme () returned 0 [0159.933] GetSystemMetrics (nIndex=46) returned 2 [0159.933] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.933] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.933] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.933] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.937] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.938] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.938] GetLastError () returned 0x578 [0159.938] CanUserWritePwrScheme () returned 0 [0159.939] GetSystemMetrics (nIndex=46) returned 2 [0159.939] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.939] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.939] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.939] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.944] GetLastError () returned 0x578 [0159.944] CanUserWritePwrScheme () returned 0 [0159.944] GetSystemMetrics (nIndex=46) returned 2 [0159.945] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.945] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.945] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.945] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.955] GetLastError () returned 0x578 [0159.955] CanUserWritePwrScheme () returned 0 [0159.956] GetSystemMetrics (nIndex=46) returned 2 [0159.956] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.956] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.956] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.956] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.967] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.967] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.967] GetLastError () returned 0x578 [0159.967] CanUserWritePwrScheme () returned 0 [0159.968] GetSystemMetrics (nIndex=46) returned 2 [0159.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.979] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.979] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.979] GetLastError () returned 0x578 [0159.979] CanUserWritePwrScheme () returned 0 [0159.980] GetSystemMetrics (nIndex=46) returned 2 [0159.980] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.980] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.980] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.980] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0159.993] GetWindowTextLengthA (hWnd=0x0) returned 0 [0159.993] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0159.993] GetLastError () returned 0x578 [0159.993] CanUserWritePwrScheme () returned 0 [0159.994] GetSystemMetrics (nIndex=46) returned 2 [0159.994] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0159.994] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0159.994] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0159.994] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.005] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.005] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.005] GetLastError () returned 0x578 [0160.005] CanUserWritePwrScheme () returned 0 [0160.006] GetSystemMetrics (nIndex=46) returned 2 [0160.006] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.006] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.006] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.006] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.016] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.016] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.016] GetLastError () returned 0x578 [0160.017] CanUserWritePwrScheme () returned 0 [0160.017] GetSystemMetrics (nIndex=46) returned 2 [0160.017] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.017] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.017] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.017] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.028] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.028] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.028] GetLastError () returned 0x578 [0160.028] CanUserWritePwrScheme () returned 0 [0160.110] GetSystemMetrics (nIndex=46) returned 2 [0160.110] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.110] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.110] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.110] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.122] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.122] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.122] GetLastError () returned 0x578 [0160.122] CanUserWritePwrScheme () returned 0 [0160.123] GetSystemMetrics (nIndex=46) returned 2 [0160.123] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.123] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.123] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.123] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.134] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.134] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.134] GetLastError () returned 0x578 [0160.134] CanUserWritePwrScheme () returned 0 [0160.135] GetSystemMetrics (nIndex=46) returned 2 [0160.135] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.135] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.135] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.135] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.145] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.145] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.145] GetLastError () returned 0x578 [0160.145] CanUserWritePwrScheme () returned 0 [0160.146] GetSystemMetrics (nIndex=46) returned 2 [0160.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.146] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.146] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.146] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.160] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.160] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.160] GetLastError () returned 0x578 [0160.160] CanUserWritePwrScheme () returned 0 [0160.161] GetSystemMetrics (nIndex=46) returned 2 [0160.161] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.161] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.161] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.161] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.172] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.172] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.172] GetLastError () returned 0x578 [0160.172] CanUserWritePwrScheme () returned 0 [0160.173] GetSystemMetrics (nIndex=46) returned 2 [0160.173] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.173] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.173] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.173] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.183] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.183] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.183] GetLastError () returned 0x578 [0160.183] CanUserWritePwrScheme () returned 0 [0160.184] GetSystemMetrics (nIndex=46) returned 2 [0160.184] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.184] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.184] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.184] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.198] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.198] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.198] GetLastError () returned 0x578 [0160.198] CanUserWritePwrScheme () returned 0 [0160.199] GetSystemMetrics (nIndex=46) returned 2 [0160.199] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.199] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.199] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.199] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.209] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.209] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.209] GetLastError () returned 0x578 [0160.209] CanUserWritePwrScheme () returned 0 [0160.210] GetSystemMetrics (nIndex=46) returned 2 [0160.210] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.210] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.210] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.210] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.221] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.221] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.221] GetLastError () returned 0x578 [0160.221] CanUserWritePwrScheme () returned 0 [0160.222] GetSystemMetrics (nIndex=46) returned 2 [0160.222] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.222] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.222] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.222] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.232] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.232] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.232] GetLastError () returned 0x578 [0160.232] CanUserWritePwrScheme () returned 0 [0160.233] GetSystemMetrics (nIndex=46) returned 2 [0160.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.233] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.233] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.233] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.244] GetLastError () returned 0x578 [0160.244] CanUserWritePwrScheme () returned 0 [0160.245] GetSystemMetrics (nIndex=46) returned 2 [0160.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.258] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.259] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.259] GetLastError () returned 0x578 [0160.259] CanUserWritePwrScheme () returned 0 [0160.259] GetSystemMetrics (nIndex=46) returned 2 [0160.260] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.260] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.260] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.260] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.270] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.270] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.270] GetLastError () returned 0x578 [0160.270] CanUserWritePwrScheme () returned 0 [0160.271] GetSystemMetrics (nIndex=46) returned 2 [0160.271] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.271] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.271] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.271] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.282] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.282] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.282] GetLastError () returned 0x578 [0160.282] CanUserWritePwrScheme () returned 0 [0160.283] GetSystemMetrics (nIndex=46) returned 2 [0160.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.283] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.283] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.283] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.295] GetLastError () returned 0x578 [0160.295] CanUserWritePwrScheme () returned 0 [0160.296] GetSystemMetrics (nIndex=46) returned 2 [0160.296] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.296] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.296] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.296] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.305] GetLastError () returned 0x578 [0160.305] CanUserWritePwrScheme () returned 0 [0160.306] GetSystemMetrics (nIndex=46) returned 2 [0160.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.306] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.306] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.306] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.311] GetLastError () returned 0x578 [0160.311] CanUserWritePwrScheme () returned 0 [0160.312] GetSystemMetrics (nIndex=46) returned 2 [0160.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.319] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.319] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.320] GetLastError () returned 0x578 [0160.320] CanUserWritePwrScheme () returned 0 [0160.320] GetSystemMetrics (nIndex=46) returned 2 [0160.320] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.320] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.321] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.321] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.325] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.326] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.326] GetLastError () returned 0x578 [0160.326] CanUserWritePwrScheme () returned 0 [0160.327] GetSystemMetrics (nIndex=46) returned 2 [0160.327] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.327] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.327] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.327] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.331] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.331] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.331] GetLastError () returned 0x578 [0160.331] CanUserWritePwrScheme () returned 0 [0160.332] GetSystemMetrics (nIndex=46) returned 2 [0160.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.337] GetLastError () returned 0x578 [0160.337] CanUserWritePwrScheme () returned 0 [0160.338] GetSystemMetrics (nIndex=46) returned 2 [0160.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.338] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.338] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.338] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.343] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.343] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.343] GetLastError () returned 0x578 [0160.343] CanUserWritePwrScheme () returned 0 [0160.344] GetSystemMetrics (nIndex=46) returned 2 [0160.344] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.344] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.344] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.344] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.349] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.349] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.349] GetLastError () returned 0x578 [0160.349] CanUserWritePwrScheme () returned 0 [0160.350] GetSystemMetrics (nIndex=46) returned 2 [0160.350] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.350] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.350] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.350] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.355] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.355] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.355] GetLastError () returned 0x578 [0160.355] CanUserWritePwrScheme () returned 0 [0160.356] GetSystemMetrics (nIndex=46) returned 2 [0160.356] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.356] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.356] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.356] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.361] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.361] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.361] GetLastError () returned 0x578 [0160.361] CanUserWritePwrScheme () returned 0 [0160.362] GetSystemMetrics (nIndex=46) returned 2 [0160.362] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.362] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.362] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.362] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.366] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.366] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.366] GetLastError () returned 0x578 [0160.366] CanUserWritePwrScheme () returned 0 [0160.367] GetSystemMetrics (nIndex=46) returned 2 [0160.367] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.367] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.367] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.367] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.372] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.372] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.372] GetLastError () returned 0x578 [0160.372] CanUserWritePwrScheme () returned 0 [0160.373] GetSystemMetrics (nIndex=46) returned 2 [0160.373] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.373] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.373] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.373] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.379] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.379] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.379] GetLastError () returned 0x578 [0160.380] CanUserWritePwrScheme () returned 0 [0160.380] GetSystemMetrics (nIndex=46) returned 2 [0160.380] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.380] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.380] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.380] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.394] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.394] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.394] GetLastError () returned 0x578 [0160.394] CanUserWritePwrScheme () returned 0 [0160.402] GetSystemMetrics (nIndex=46) returned 2 [0160.402] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.402] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.402] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.402] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.413] GetLastError () returned 0x578 [0160.413] CanUserWritePwrScheme () returned 0 [0160.414] GetSystemMetrics (nIndex=46) returned 2 [0160.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.414] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.414] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.414] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.425] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.425] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.425] GetLastError () returned 0x578 [0160.425] CanUserWritePwrScheme () returned 0 [0160.426] GetSystemMetrics (nIndex=46) returned 2 [0160.426] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.426] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.426] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.426] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.437] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.437] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.437] GetLastError () returned 0x578 [0160.437] CanUserWritePwrScheme () returned 0 [0160.438] GetSystemMetrics (nIndex=46) returned 2 [0160.438] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.438] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.438] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.438] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.451] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.451] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.452] GetLastError () returned 0x578 [0160.452] CanUserWritePwrScheme () returned 0 [0160.452] GetSystemMetrics (nIndex=46) returned 2 [0160.452] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.453] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.453] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.453] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.463] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.463] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.463] GetLastError () returned 0x578 [0160.463] CanUserWritePwrScheme () returned 0 [0160.464] GetSystemMetrics (nIndex=46) returned 2 [0160.464] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.464] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.464] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.464] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.475] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.475] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.475] GetLastError () returned 0x578 [0160.475] CanUserWritePwrScheme () returned 0 [0160.476] GetSystemMetrics (nIndex=46) returned 2 [0160.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.476] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.476] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.476] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.486] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.487] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.487] GetLastError () returned 0x578 [0160.487] CanUserWritePwrScheme () returned 0 [0160.487] GetSystemMetrics (nIndex=46) returned 2 [0160.488] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.488] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.488] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.488] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.561] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.561] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.561] GetLastError () returned 0x578 [0160.561] CanUserWritePwrScheme () returned 0 [0160.562] GetSystemMetrics (nIndex=46) returned 2 [0160.562] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.562] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.562] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.562] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.573] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.573] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.573] GetLastError () returned 0x578 [0160.573] CanUserWritePwrScheme () returned 0 [0160.574] GetSystemMetrics (nIndex=46) returned 2 [0160.574] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.574] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.574] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.574] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.587] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.587] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.587] GetLastError () returned 0x578 [0160.587] CanUserWritePwrScheme () returned 0 [0160.588] GetSystemMetrics (nIndex=46) returned 2 [0160.588] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.588] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.588] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.588] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.599] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.599] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.599] GetLastError () returned 0x578 [0160.599] CanUserWritePwrScheme () returned 0 [0160.600] GetSystemMetrics (nIndex=46) returned 2 [0160.600] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.600] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.600] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.600] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.611] GetLastError () returned 0x578 [0160.611] CanUserWritePwrScheme () returned 0 [0160.612] GetSystemMetrics (nIndex=46) returned 2 [0160.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.612] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.623] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.623] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.623] GetLastError () returned 0x578 [0160.623] CanUserWritePwrScheme () returned 0 [0160.624] GetSystemMetrics (nIndex=46) returned 2 [0160.624] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.624] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.624] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.624] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.634] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.634] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.635] GetLastError () returned 0x578 [0160.635] CanUserWritePwrScheme () returned 0 [0160.636] GetSystemMetrics (nIndex=46) returned 2 [0160.636] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.636] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.636] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.636] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.651] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.651] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.651] GetLastError () returned 0x578 [0160.651] CanUserWritePwrScheme () returned 0 [0160.652] GetSystemMetrics (nIndex=46) returned 2 [0160.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.652] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.652] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.652] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.663] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.663] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.663] GetLastError () returned 0x578 [0160.663] CanUserWritePwrScheme () returned 0 [0160.664] GetSystemMetrics (nIndex=46) returned 2 [0160.664] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.664] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.664] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.664] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.675] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.675] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.675] GetLastError () returned 0x578 [0160.675] CanUserWritePwrScheme () returned 0 [0160.676] GetSystemMetrics (nIndex=46) returned 2 [0160.676] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.676] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.676] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.676] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.687] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.687] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.687] GetLastError () returned 0x578 [0160.687] CanUserWritePwrScheme () returned 0 [0160.688] GetSystemMetrics (nIndex=46) returned 2 [0160.688] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.688] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.688] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.688] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.698] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.698] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.698] GetLastError () returned 0x578 [0160.699] CanUserWritePwrScheme () returned 0 [0160.699] GetSystemMetrics (nIndex=46) returned 2 [0160.699] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.699] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.699] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.700] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.713] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.713] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.713] GetLastError () returned 0x578 [0160.713] CanUserWritePwrScheme () returned 0 [0160.714] GetSystemMetrics (nIndex=46) returned 2 [0160.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.714] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.714] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.714] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.724] GetLastError () returned 0x578 [0160.724] CanUserWritePwrScheme () returned 0 [0160.725] GetSystemMetrics (nIndex=46) returned 2 [0160.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.725] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.725] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.725] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.736] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.736] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.736] GetLastError () returned 0x578 [0160.736] CanUserWritePwrScheme () returned 0 [0160.737] GetSystemMetrics (nIndex=46) returned 2 [0160.737] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.737] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.737] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.737] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.748] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.748] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.748] GetLastError () returned 0x578 [0160.748] CanUserWritePwrScheme () returned 0 [0160.749] GetSystemMetrics (nIndex=46) returned 2 [0160.749] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.749] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.749] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.749] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.760] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.760] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.760] GetLastError () returned 0x578 [0160.760] CanUserWritePwrScheme () returned 0 [0160.761] GetSystemMetrics (nIndex=46) returned 2 [0160.761] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.761] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.761] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.761] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.771] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.771] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.771] GetLastError () returned 0x578 [0160.771] CanUserWritePwrScheme () returned 0 [0160.775] GetSystemMetrics (nIndex=46) returned 2 [0160.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.775] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.775] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.775] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.781] GetLastError () returned 0x578 [0160.781] CanUserWritePwrScheme () returned 0 [0160.781] GetSystemMetrics (nIndex=46) returned 2 [0160.782] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.782] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.782] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.782] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.786] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.786] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.786] GetLastError () returned 0x578 [0160.786] CanUserWritePwrScheme () returned 0 [0160.787] GetSystemMetrics (nIndex=46) returned 2 [0160.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.792] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.792] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.792] GetLastError () returned 0x578 [0160.792] CanUserWritePwrScheme () returned 0 [0160.793] GetSystemMetrics (nIndex=46) returned 2 [0160.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.793] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.793] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.793] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.798] GetLastError () returned 0x578 [0160.798] CanUserWritePwrScheme () returned 0 [0160.799] GetSystemMetrics (nIndex=46) returned 2 [0160.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.799] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.799] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.799] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.804] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.804] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.804] GetLastError () returned 0x578 [0160.804] CanUserWritePwrScheme () returned 0 [0160.805] GetSystemMetrics (nIndex=46) returned 2 [0160.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.810] GetLastError () returned 0x578 [0160.810] CanUserWritePwrScheme () returned 0 [0160.811] GetSystemMetrics (nIndex=46) returned 2 [0160.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.815] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.815] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.815] GetLastError () returned 0x578 [0160.816] CanUserWritePwrScheme () returned 0 [0160.816] GetSystemMetrics (nIndex=46) returned 2 [0160.816] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.816] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.816] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.816] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.821] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.821] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.821] GetLastError () returned 0x578 [0160.821] CanUserWritePwrScheme () returned 0 [0160.822] GetSystemMetrics (nIndex=46) returned 2 [0160.822] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.822] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.822] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.822] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.831] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.831] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.831] GetLastError () returned 0x578 [0160.831] CanUserWritePwrScheme () returned 0 [0160.832] GetSystemMetrics (nIndex=46) returned 2 [0160.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.832] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.832] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.832] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.846] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.846] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.846] GetLastError () returned 0x578 [0160.846] CanUserWritePwrScheme () returned 0 [0160.847] GetSystemMetrics (nIndex=46) returned 2 [0160.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.847] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.847] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.847] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.857] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.858] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.858] GetLastError () returned 0x578 [0160.858] CanUserWritePwrScheme () returned 0 [0160.859] GetSystemMetrics (nIndex=46) returned 2 [0160.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.859] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.859] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.859] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.869] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.869] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.869] GetLastError () returned 0x578 [0160.869] CanUserWritePwrScheme () returned 0 [0160.870] GetSystemMetrics (nIndex=46) returned 2 [0160.870] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.870] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.870] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.870] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.881] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.881] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.881] GetLastError () returned 0x578 [0160.881] CanUserWritePwrScheme () returned 0 [0160.882] GetSystemMetrics (nIndex=46) returned 2 [0160.882] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.882] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.882] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.882] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.892] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.892] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.892] GetLastError () returned 0x578 [0160.892] CanUserWritePwrScheme () returned 0 [0160.893] GetSystemMetrics (nIndex=46) returned 2 [0160.893] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.893] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.893] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.893] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.908] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.908] GetLastError () returned 0x578 [0160.908] CanUserWritePwrScheme () returned 0 [0160.909] GetSystemMetrics (nIndex=46) returned 2 [0160.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.909] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.909] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.909] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.921] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.921] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.921] GetLastError () returned 0x578 [0160.921] CanUserWritePwrScheme () returned 0 [0160.922] GetSystemMetrics (nIndex=46) returned 2 [0160.922] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.922] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.922] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.922] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.933] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.933] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.933] GetLastError () returned 0x578 [0160.933] CanUserWritePwrScheme () returned 0 [0160.934] GetSystemMetrics (nIndex=46) returned 2 [0160.934] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.934] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.934] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.934] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0160.945] GetWindowTextLengthA (hWnd=0x0) returned 0 [0160.945] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0160.945] GetLastError () returned 0x578 [0160.945] CanUserWritePwrScheme () returned 0 [0160.946] GetSystemMetrics (nIndex=46) returned 2 [0160.946] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0160.946] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0160.946] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0160.946] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.274] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.274] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.274] GetLastError () returned 0x578 [0161.274] CanUserWritePwrScheme () returned 0 [0161.275] GetSystemMetrics (nIndex=46) returned 2 [0161.275] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.275] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.275] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.275] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.286] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.286] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.286] GetLastError () returned 0x578 [0161.286] CanUserWritePwrScheme () returned 0 [0161.287] GetSystemMetrics (nIndex=46) returned 2 [0161.287] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.287] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.287] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.287] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.300] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.300] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.300] GetLastError () returned 0x578 [0161.300] CanUserWritePwrScheme () returned 0 [0161.301] GetSystemMetrics (nIndex=46) returned 2 [0161.301] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.301] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.301] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.301] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.312] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.312] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.312] GetLastError () returned 0x578 [0161.312] CanUserWritePwrScheme () returned 0 [0161.313] GetSystemMetrics (nIndex=46) returned 2 [0161.313] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.313] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.313] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.313] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.323] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.323] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.323] GetLastError () returned 0x578 [0161.323] CanUserWritePwrScheme () returned 0 [0161.325] GetSystemMetrics (nIndex=46) returned 2 [0161.325] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.325] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.325] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.325] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.335] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.335] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.335] GetLastError () returned 0x578 [0161.335] CanUserWritePwrScheme () returned 0 [0161.336] GetSystemMetrics (nIndex=46) returned 2 [0161.336] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.336] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.336] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.336] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.347] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.347] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.347] GetLastError () returned 0x578 [0161.347] CanUserWritePwrScheme () returned 0 [0161.348] GetSystemMetrics (nIndex=46) returned 2 [0161.348] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.348] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.348] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.348] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.959] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.959] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.959] GetLastError () returned 0x578 [0161.959] CanUserWritePwrScheme () returned 0 [0161.960] GetSystemMetrics (nIndex=46) returned 2 [0161.960] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.960] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.960] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.960] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.971] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.971] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.971] GetLastError () returned 0x578 [0161.971] CanUserWritePwrScheme () returned 0 [0161.972] GetSystemMetrics (nIndex=46) returned 2 [0161.972] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.972] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.972] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.972] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.983] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.983] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.983] GetLastError () returned 0x578 [0161.983] CanUserWritePwrScheme () returned 0 [0161.984] GetSystemMetrics (nIndex=46) returned 2 [0161.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0161.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0161.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0161.995] GetLastError () returned 0x578 [0161.995] CanUserWritePwrScheme () returned 0 [0161.995] GetSystemMetrics (nIndex=46) returned 2 [0161.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0161.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0161.996] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0161.996] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.009] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.009] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.009] GetLastError () returned 0x578 [0162.009] CanUserWritePwrScheme () returned 0 [0162.012] GetSystemMetrics (nIndex=46) returned 2 [0162.012] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.012] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.012] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.012] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.023] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.023] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.023] GetLastError () returned 0x578 [0162.023] CanUserWritePwrScheme () returned 0 [0162.024] GetSystemMetrics (nIndex=46) returned 2 [0162.024] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.024] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.024] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.024] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.035] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.035] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.035] GetLastError () returned 0x578 [0162.035] CanUserWritePwrScheme () returned 0 [0162.036] GetSystemMetrics (nIndex=46) returned 2 [0162.036] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.036] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.036] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.036] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.117] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.117] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.117] GetLastError () returned 0x578 [0162.117] CanUserWritePwrScheme () returned 0 [0162.118] GetSystemMetrics (nIndex=46) returned 2 [0162.118] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.118] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.118] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.118] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.129] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.129] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.129] GetLastError () returned 0x578 [0162.129] CanUserWritePwrScheme () returned 0 [0162.130] GetSystemMetrics (nIndex=46) returned 2 [0162.130] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.130] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.130] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.130] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.143] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.143] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.143] GetLastError () returned 0x578 [0162.143] CanUserWritePwrScheme () returned 0 [0162.144] GetSystemMetrics (nIndex=46) returned 2 [0162.144] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.144] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.144] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.144] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.155] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.155] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.155] GetLastError () returned 0x578 [0162.155] CanUserWritePwrScheme () returned 0 [0162.156] GetSystemMetrics (nIndex=46) returned 2 [0162.156] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.156] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.156] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.156] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.167] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.167] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.167] GetLastError () returned 0x578 [0162.167] CanUserWritePwrScheme () returned 0 [0162.168] GetSystemMetrics (nIndex=46) returned 2 [0162.168] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.168] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.168] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.168] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.178] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.178] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.178] GetLastError () returned 0x578 [0162.178] CanUserWritePwrScheme () returned 0 [0162.179] GetSystemMetrics (nIndex=46) returned 2 [0162.179] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.179] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.179] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.179] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.190] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.190] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.190] GetLastError () returned 0x578 [0162.190] CanUserWritePwrScheme () returned 0 [0162.191] GetSystemMetrics (nIndex=46) returned 2 [0162.191] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.191] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.191] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.191] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.201] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.201] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.201] GetLastError () returned 0x578 [0162.201] CanUserWritePwrScheme () returned 0 [0162.202] GetSystemMetrics (nIndex=46) returned 2 [0162.202] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.202] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.202] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.202] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.219] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.219] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.219] GetLastError () returned 0x578 [0162.219] CanUserWritePwrScheme () returned 0 [0162.220] GetSystemMetrics (nIndex=46) returned 2 [0162.220] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.220] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.220] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.220] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.231] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.231] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.231] GetLastError () returned 0x578 [0162.231] CanUserWritePwrScheme () returned 0 [0162.232] GetSystemMetrics (nIndex=46) returned 2 [0162.232] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.232] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.232] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.232] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.243] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.243] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.243] GetLastError () returned 0x578 [0162.243] CanUserWritePwrScheme () returned 0 [0162.244] GetSystemMetrics (nIndex=46) returned 2 [0162.244] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.244] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.244] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.244] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.254] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.254] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.254] GetLastError () returned 0x578 [0162.254] CanUserWritePwrScheme () returned 0 [0162.255] GetSystemMetrics (nIndex=46) returned 2 [0162.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.255] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.255] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.266] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.266] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.266] GetLastError () returned 0x578 [0162.266] CanUserWritePwrScheme () returned 0 [0162.267] GetSystemMetrics (nIndex=46) returned 2 [0162.267] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.267] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.267] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.267] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.280] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.280] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.280] GetLastError () returned 0x578 [0162.280] CanUserWritePwrScheme () returned 0 [0162.281] GetSystemMetrics (nIndex=46) returned 2 [0162.281] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.281] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.281] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.281] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.292] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.292] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.292] GetLastError () returned 0x578 [0162.292] CanUserWritePwrScheme () returned 0 [0162.293] GetSystemMetrics (nIndex=46) returned 2 [0162.293] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.293] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.293] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.293] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.304] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.304] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.304] GetLastError () returned 0x578 [0162.304] CanUserWritePwrScheme () returned 0 [0162.304] GetSystemMetrics (nIndex=46) returned 2 [0162.304] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.305] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.305] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.305] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.462] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.462] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.462] GetLastError () returned 0x578 [0162.462] CanUserWritePwrScheme () returned 0 [0162.463] GetSystemMetrics (nIndex=46) returned 2 [0162.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.463] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.463] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.463] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.476] GetLastError () returned 0x578 [0162.476] CanUserWritePwrScheme () returned 0 [0162.477] GetSystemMetrics (nIndex=46) returned 2 [0162.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.488] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.488] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.488] GetLastError () returned 0x578 [0162.488] CanUserWritePwrScheme () returned 0 [0162.489] GetSystemMetrics (nIndex=46) returned 2 [0162.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.489] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.489] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.489] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.499] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.499] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.499] GetLastError () returned 0x578 [0162.499] CanUserWritePwrScheme () returned 0 [0162.500] GetSystemMetrics (nIndex=46) returned 2 [0162.500] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.500] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.500] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.500] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.511] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.511] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.511] GetLastError () returned 0x578 [0162.511] CanUserWritePwrScheme () returned 0 [0162.512] GetSystemMetrics (nIndex=46) returned 2 [0162.512] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.512] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.512] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.512] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.522] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.522] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.522] GetLastError () returned 0x578 [0162.522] CanUserWritePwrScheme () returned 0 [0162.523] GetSystemMetrics (nIndex=46) returned 2 [0162.523] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.523] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.523] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.523] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.536] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.536] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.536] GetLastError () returned 0x578 [0162.536] CanUserWritePwrScheme () returned 0 [0162.537] GetSystemMetrics (nIndex=46) returned 2 [0162.537] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.537] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.537] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.537] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.569] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.569] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.569] GetLastError () returned 0x578 [0162.569] CanUserWritePwrScheme () returned 0 [0162.570] GetSystemMetrics (nIndex=46) returned 2 [0162.570] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.570] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.570] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.570] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.580] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.581] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.581] GetLastError () returned 0x578 [0162.581] CanUserWritePwrScheme () returned 0 [0162.581] GetSystemMetrics (nIndex=46) returned 2 [0162.581] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.581] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.582] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.582] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.592] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.592] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.592] GetLastError () returned 0x578 [0162.592] CanUserWritePwrScheme () returned 0 [0162.593] GetSystemMetrics (nIndex=46) returned 2 [0162.593] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.593] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.593] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.593] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.606] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.606] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.606] GetLastError () returned 0x578 [0162.606] CanUserWritePwrScheme () returned 0 [0162.607] GetSystemMetrics (nIndex=46) returned 2 [0162.607] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.607] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.607] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.607] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.618] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.618] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.618] GetLastError () returned 0x578 [0162.618] CanUserWritePwrScheme () returned 0 [0162.619] GetSystemMetrics (nIndex=46) returned 2 [0162.619] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.619] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.619] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.619] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.630] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.630] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.630] GetLastError () returned 0x578 [0162.630] CanUserWritePwrScheme () returned 0 [0162.630] GetSystemMetrics (nIndex=46) returned 2 [0162.631] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.631] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.631] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.643] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.643] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.643] GetLastError () returned 0x578 [0162.643] CanUserWritePwrScheme () returned 0 [0162.644] GetSystemMetrics (nIndex=46) returned 2 [0162.644] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.644] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.644] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.644] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.768] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.768] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.768] GetLastError () returned 0x578 [0162.768] CanUserWritePwrScheme () returned 0 [0162.769] GetSystemMetrics (nIndex=46) returned 2 [0162.769] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.769] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.769] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.769] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.780] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.780] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.780] GetLastError () returned 0x578 [0162.780] CanUserWritePwrScheme () returned 0 [0162.781] GetSystemMetrics (nIndex=46) returned 2 [0162.781] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.781] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.781] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.781] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.794] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.794] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.794] GetLastError () returned 0x578 [0162.794] CanUserWritePwrScheme () returned 0 [0162.795] GetSystemMetrics (nIndex=46) returned 2 [0162.795] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.795] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.795] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.795] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.806] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.806] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.806] GetLastError () returned 0x578 [0162.806] CanUserWritePwrScheme () returned 0 [0162.807] GetSystemMetrics (nIndex=46) returned 2 [0162.807] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.807] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.807] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.807] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.822] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.822] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.822] GetLastError () returned 0x578 [0162.822] CanUserWritePwrScheme () returned 0 [0162.823] GetSystemMetrics (nIndex=46) returned 2 [0162.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.834] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.834] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.834] GetLastError () returned 0x578 [0162.834] CanUserWritePwrScheme () returned 0 [0162.835] GetSystemMetrics (nIndex=46) returned 2 [0162.835] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.835] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.835] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.835] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.846] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.846] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.846] GetLastError () returned 0x578 [0162.846] CanUserWritePwrScheme () returned 0 [0162.847] GetSystemMetrics (nIndex=46) returned 2 [0162.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.847] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.847] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.847] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0162.985] GetWindowTextLengthA (hWnd=0x0) returned 0 [0162.985] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0162.985] GetLastError () returned 0x578 [0162.985] CanUserWritePwrScheme () returned 0 [0162.986] GetSystemMetrics (nIndex=46) returned 2 [0162.986] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0162.986] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0162.986] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0162.986] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.000] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.000] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.000] GetLastError () returned 0x578 [0163.000] CanUserWritePwrScheme () returned 0 [0163.001] GetSystemMetrics (nIndex=46) returned 2 [0163.001] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.001] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.001] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.001] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.012] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.012] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.012] GetLastError () returned 0x578 [0163.012] CanUserWritePwrScheme () returned 0 [0163.013] GetSystemMetrics (nIndex=46) returned 2 [0163.013] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.013] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.013] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.013] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.024] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.024] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.024] GetLastError () returned 0x578 [0163.024] CanUserWritePwrScheme () returned 0 [0163.025] GetSystemMetrics (nIndex=46) returned 2 [0163.025] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.025] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.025] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.026] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.036] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.036] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.036] GetLastError () returned 0x578 [0163.036] CanUserWritePwrScheme () returned 0 [0163.037] GetSystemMetrics (nIndex=46) returned 2 [0163.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.037] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.037] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.037] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.048] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.048] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.048] GetLastError () returned 0x578 [0163.048] CanUserWritePwrScheme () returned 0 [0163.049] GetSystemMetrics (nIndex=46) returned 2 [0163.049] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.049] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.049] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.049] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.063] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.063] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.063] GetLastError () returned 0x578 [0163.063] CanUserWritePwrScheme () returned 0 [0163.064] GetSystemMetrics (nIndex=46) returned 2 [0163.064] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.064] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.064] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.064] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.099] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.099] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.099] GetLastError () returned 0x578 [0163.099] CanUserWritePwrScheme () returned 0 [0163.100] GetSystemMetrics (nIndex=46) returned 2 [0163.100] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.100] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.100] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.100] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.111] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.111] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.111] GetLastError () returned 0x578 [0163.111] CanUserWritePwrScheme () returned 0 [0163.112] GetSystemMetrics (nIndex=46) returned 2 [0163.112] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.112] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.112] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.112] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.125] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.125] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.125] GetLastError () returned 0x578 [0163.125] CanUserWritePwrScheme () returned 0 [0163.126] GetSystemMetrics (nIndex=46) returned 2 [0163.126] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.126] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.126] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.126] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.137] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.137] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.137] GetLastError () returned 0x578 [0163.137] CanUserWritePwrScheme () returned 0 [0163.138] GetSystemMetrics (nIndex=46) returned 2 [0163.138] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.138] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.138] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.138] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.148] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.148] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.148] GetLastError () returned 0x578 [0163.148] CanUserWritePwrScheme () returned 0 [0163.149] GetSystemMetrics (nIndex=46) returned 2 [0163.149] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.149] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.149] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.149] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.159] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.159] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.159] GetLastError () returned 0x578 [0163.160] CanUserWritePwrScheme () returned 0 [0163.160] GetSystemMetrics (nIndex=46) returned 2 [0163.160] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.160] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.160] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.160] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.171] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.171] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.171] GetLastError () returned 0x578 [0163.171] CanUserWritePwrScheme () returned 0 [0163.172] GetSystemMetrics (nIndex=46) returned 2 [0163.172] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.172] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.172] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.172] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.197] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.197] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.197] GetLastError () returned 0x578 [0163.197] CanUserWritePwrScheme () returned 0 [0163.198] GetSystemMetrics (nIndex=46) returned 2 [0163.198] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.198] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.198] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.198] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.208] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.208] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.208] GetLastError () returned 0x578 [0163.208] CanUserWritePwrScheme () returned 0 [0163.209] GetSystemMetrics (nIndex=46) returned 2 [0163.209] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.209] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.209] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.209] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.219] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.220] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.220] GetLastError () returned 0x578 [0163.220] CanUserWritePwrScheme () returned 0 [0163.220] GetSystemMetrics (nIndex=46) returned 2 [0163.220] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.220] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.221] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.221] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.231] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.231] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.231] GetLastError () returned 0x578 [0163.231] CanUserWritePwrScheme () returned 0 [0163.232] GetSystemMetrics (nIndex=46) returned 2 [0163.232] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.232] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.232] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.232] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.242] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.242] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.242] GetLastError () returned 0x578 [0163.242] CanUserWritePwrScheme () returned 0 [0163.243] GetSystemMetrics (nIndex=46) returned 2 [0163.243] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.243] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.243] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.243] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.256] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.257] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.257] GetLastError () returned 0x578 [0163.257] CanUserWritePwrScheme () returned 0 [0163.257] GetSystemMetrics (nIndex=46) returned 2 [0163.257] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.257] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.258] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.258] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.268] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.268] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.268] GetLastError () returned 0x578 [0163.268] CanUserWritePwrScheme () returned 0 [0163.269] GetSystemMetrics (nIndex=46) returned 2 [0163.269] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.269] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.269] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.269] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.530] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.530] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.530] GetLastError () returned 0x578 [0163.530] CanUserWritePwrScheme () returned 0 [0163.531] GetSystemMetrics (nIndex=46) returned 2 [0163.531] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.531] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.531] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.531] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.542] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.542] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.542] GetLastError () returned 0x578 [0163.542] CanUserWritePwrScheme () returned 0 [0163.543] GetSystemMetrics (nIndex=46) returned 2 [0163.543] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.543] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.543] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.543] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.553] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.553] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.554] GetLastError () returned 0x578 [0163.554] CanUserWritePwrScheme () returned 0 [0163.554] GetSystemMetrics (nIndex=46) returned 2 [0163.554] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.554] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.554] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.555] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.565] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.565] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.565] GetLastError () returned 0x578 [0163.565] CanUserWritePwrScheme () returned 0 [0163.566] GetSystemMetrics (nIndex=46) returned 2 [0163.566] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.566] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.566] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.566] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.580] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.580] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.580] GetLastError () returned 0x578 [0163.580] CanUserWritePwrScheme () returned 0 [0163.581] GetSystemMetrics (nIndex=46) returned 2 [0163.581] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.581] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.581] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.581] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.591] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.592] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.592] GetLastError () returned 0x578 [0163.592] CanUserWritePwrScheme () returned 0 [0163.592] GetSystemMetrics (nIndex=46) returned 2 [0163.593] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.593] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.593] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.593] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.603] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.603] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.603] GetLastError () returned 0x578 [0163.603] CanUserWritePwrScheme () returned 0 [0163.604] GetSystemMetrics (nIndex=46) returned 2 [0163.604] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.604] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.604] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.604] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.615] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.615] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.615] GetLastError () returned 0x578 [0163.615] CanUserWritePwrScheme () returned 0 [0163.616] GetSystemMetrics (nIndex=46) returned 2 [0163.616] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.616] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.616] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.616] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.629] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.629] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.629] GetLastError () returned 0x578 [0163.630] CanUserWritePwrScheme () returned 0 [0163.630] GetSystemMetrics (nIndex=46) returned 2 [0163.630] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.630] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.630] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.631] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.645] GetLastError () returned 0x578 [0163.645] CanUserWritePwrScheme () returned 0 [0163.646] GetSystemMetrics (nIndex=46) returned 2 [0163.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.656] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.656] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.656] GetLastError () returned 0x578 [0163.656] CanUserWritePwrScheme () returned 0 [0163.657] GetSystemMetrics (nIndex=46) returned 2 [0163.657] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.657] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.657] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.657] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.668] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.668] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.668] GetLastError () returned 0x578 [0163.668] CanUserWritePwrScheme () returned 0 [0163.669] GetSystemMetrics (nIndex=46) returned 2 [0163.669] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.669] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.669] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.669] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.680] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.680] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.680] GetLastError () returned 0x578 [0163.680] CanUserWritePwrScheme () returned 0 [0163.681] GetSystemMetrics (nIndex=46) returned 2 [0163.681] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.681] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.681] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.681] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.691] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.691] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.691] GetLastError () returned 0x578 [0163.691] CanUserWritePwrScheme () returned 0 [0163.692] GetSystemMetrics (nIndex=46) returned 2 [0163.692] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.692] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.692] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.692] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.708] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.708] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.708] GetLastError () returned 0x578 [0163.708] CanUserWritePwrScheme () returned 0 [0163.709] GetSystemMetrics (nIndex=46) returned 2 [0163.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.709] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.719] GetLastError () returned 0x578 [0163.719] CanUserWritePwrScheme () returned 0 [0163.720] GetSystemMetrics (nIndex=46) returned 2 [0163.720] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.720] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.720] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.720] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.731] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.731] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.731] GetLastError () returned 0x578 [0163.731] CanUserWritePwrScheme () returned 0 [0163.732] GetSystemMetrics (nIndex=46) returned 2 [0163.732] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.732] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.732] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.732] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.742] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.743] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.743] GetLastError () returned 0x578 [0163.743] CanUserWritePwrScheme () returned 0 [0163.743] GetSystemMetrics (nIndex=46) returned 2 [0163.744] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.744] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.744] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.744] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.754] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.754] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.754] GetLastError () returned 0x578 [0163.754] CanUserWritePwrScheme () returned 0 [0163.755] GetSystemMetrics (nIndex=46) returned 2 [0163.755] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.755] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.755] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.755] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.761] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.761] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.761] GetLastError () returned 0x578 [0163.761] CanUserWritePwrScheme () returned 0 [0163.762] GetSystemMetrics (nIndex=46) returned 2 [0163.762] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.762] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.762] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.762] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.767] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.767] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.767] GetLastError () returned 0x578 [0163.767] CanUserWritePwrScheme () returned 0 [0163.770] GetSystemMetrics (nIndex=46) returned 2 [0163.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.775] GetLastError () returned 0x578 [0163.775] CanUserWritePwrScheme () returned 0 [0163.776] GetSystemMetrics (nIndex=46) returned 2 [0163.776] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.776] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.776] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.776] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.781] GetLastError () returned 0x578 [0163.781] CanUserWritePwrScheme () returned 0 [0163.782] GetSystemMetrics (nIndex=46) returned 2 [0163.782] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.782] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.782] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.782] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.787] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.787] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.787] GetLastError () returned 0x578 [0163.787] CanUserWritePwrScheme () returned 0 [0163.788] GetSystemMetrics (nIndex=46) returned 2 [0163.788] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.788] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.788] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.788] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.793] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.793] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.793] GetLastError () returned 0x578 [0163.793] CanUserWritePwrScheme () returned 0 [0163.793] GetSystemMetrics (nIndex=46) returned 2 [0163.793] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.794] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.794] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.794] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.798] GetLastError () returned 0x578 [0163.798] CanUserWritePwrScheme () returned 0 [0163.799] GetSystemMetrics (nIndex=46) returned 2 [0163.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.799] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.799] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.799] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.825] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.825] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.825] GetLastError () returned 0x578 [0163.825] CanUserWritePwrScheme () returned 0 [0163.826] GetSystemMetrics (nIndex=46) returned 2 [0163.826] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.826] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.826] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.826] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.839] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.839] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.839] GetLastError () returned 0x578 [0163.839] CanUserWritePwrScheme () returned 0 [0163.840] GetSystemMetrics (nIndex=46) returned 2 [0163.840] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.840] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.840] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.840] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.851] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.851] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.851] GetLastError () returned 0x578 [0163.851] CanUserWritePwrScheme () returned 0 [0163.852] GetSystemMetrics (nIndex=46) returned 2 [0163.852] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.852] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.852] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.852] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.862] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.862] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.863] GetLastError () returned 0x578 [0163.863] CanUserWritePwrScheme () returned 0 [0163.863] GetSystemMetrics (nIndex=46) returned 2 [0163.863] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.863] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.864] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.864] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.874] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.874] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.874] GetLastError () returned 0x578 [0163.874] CanUserWritePwrScheme () returned 0 [0163.875] GetSystemMetrics (nIndex=46) returned 2 [0163.875] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.875] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.875] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.875] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.886] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.886] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.886] GetLastError () returned 0x578 [0163.886] CanUserWritePwrScheme () returned 0 [0163.887] GetSystemMetrics (nIndex=46) returned 2 [0163.887] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.887] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.887] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.887] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.897] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.897] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.897] GetLastError () returned 0x578 [0163.897] CanUserWritePwrScheme () returned 0 [0163.904] GetSystemMetrics (nIndex=46) returned 2 [0163.904] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.904] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.904] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.904] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.914] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.914] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.914] GetLastError () returned 0x578 [0163.915] CanUserWritePwrScheme () returned 0 [0163.915] GetSystemMetrics (nIndex=46) returned 2 [0163.915] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.915] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.915] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.915] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.928] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.928] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.928] GetLastError () returned 0x578 [0163.928] CanUserWritePwrScheme () returned 0 [0163.929] GetSystemMetrics (nIndex=46) returned 2 [0163.929] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.929] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.929] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.929] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.940] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.940] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.940] GetLastError () returned 0x578 [0163.940] CanUserWritePwrScheme () returned 0 [0163.941] GetSystemMetrics (nIndex=46) returned 2 [0163.941] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.941] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.941] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.941] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.951] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.951] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.951] GetLastError () returned 0x578 [0163.952] CanUserWritePwrScheme () returned 0 [0163.952] GetSystemMetrics (nIndex=46) returned 2 [0163.952] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.952] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.952] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.952] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.965] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.965] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.965] GetLastError () returned 0x578 [0163.965] CanUserWritePwrScheme () returned 0 [0163.966] GetSystemMetrics (nIndex=46) returned 2 [0163.966] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.966] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.966] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.966] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.977] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.977] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.977] GetLastError () returned 0x578 [0163.977] CanUserWritePwrScheme () returned 0 [0163.978] GetSystemMetrics (nIndex=46) returned 2 [0163.978] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.978] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.978] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.978] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0163.989] GetWindowTextLengthA (hWnd=0x0) returned 0 [0163.989] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0163.989] GetLastError () returned 0x578 [0163.989] CanUserWritePwrScheme () returned 0 [0163.990] GetSystemMetrics (nIndex=46) returned 2 [0163.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0163.990] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0163.990] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0163.990] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.001] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.001] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.001] GetLastError () returned 0x578 [0164.001] CanUserWritePwrScheme () returned 0 [0164.002] GetSystemMetrics (nIndex=46) returned 2 [0164.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.002] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.002] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.002] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.034] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.034] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.034] GetLastError () returned 0x578 [0164.034] CanUserWritePwrScheme () returned 0 [0164.035] GetSystemMetrics (nIndex=46) returned 2 [0164.035] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.035] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.035] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.035] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.046] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.046] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.046] GetLastError () returned 0x578 [0164.046] CanUserWritePwrScheme () returned 0 [0164.047] GetSystemMetrics (nIndex=46) returned 2 [0164.047] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.047] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.047] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.047] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.435] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.435] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.435] GetLastError () returned 0x578 [0164.435] CanUserWritePwrScheme () returned 0 [0164.436] GetSystemMetrics (nIndex=46) returned 2 [0164.436] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.436] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.436] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.436] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.447] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.447] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.447] GetLastError () returned 0x578 [0164.447] CanUserWritePwrScheme () returned 0 [0164.448] GetSystemMetrics (nIndex=46) returned 2 [0164.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.448] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.448] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.448] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.459] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.459] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.459] GetLastError () returned 0x578 [0164.459] CanUserWritePwrScheme () returned 0 [0164.460] GetSystemMetrics (nIndex=46) returned 2 [0164.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.460] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.460] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.460] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.471] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.471] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.471] GetLastError () returned 0x578 [0164.471] CanUserWritePwrScheme () returned 0 [0164.472] GetSystemMetrics (nIndex=46) returned 2 [0164.472] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.472] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.472] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.472] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.483] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.483] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.483] GetLastError () returned 0x578 [0164.483] CanUserWritePwrScheme () returned 0 [0164.484] GetSystemMetrics (nIndex=46) returned 2 [0164.484] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.484] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.484] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.484] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.496] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.496] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.496] GetLastError () returned 0x578 [0164.496] CanUserWritePwrScheme () returned 0 [0164.497] GetSystemMetrics (nIndex=46) returned 2 [0164.497] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.497] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.497] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.497] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.509] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.509] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.509] GetLastError () returned 0x578 [0164.509] CanUserWritePwrScheme () returned 0 [0164.510] GetSystemMetrics (nIndex=46) returned 2 [0164.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.510] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.510] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.510] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.645] GetLastError () returned 0x578 [0164.645] CanUserWritePwrScheme () returned 0 [0164.646] GetSystemMetrics (nIndex=46) returned 2 [0164.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.657] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.658] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.658] GetLastError () returned 0x578 [0164.658] CanUserWritePwrScheme () returned 0 [0164.658] GetSystemMetrics (nIndex=46) returned 2 [0164.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.659] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.659] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.659] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.670] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.670] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.670] GetLastError () returned 0x578 [0164.670] CanUserWritePwrScheme () returned 0 [0164.671] GetSystemMetrics (nIndex=46) returned 2 [0164.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.671] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.671] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.671] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.682] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.682] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.682] GetLastError () returned 0x578 [0164.683] CanUserWritePwrScheme () returned 0 [0164.683] GetSystemMetrics (nIndex=46) returned 2 [0164.683] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.683] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.683] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.684] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.694] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.694] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.694] GetLastError () returned 0x578 [0164.694] CanUserWritePwrScheme () returned 0 [0164.695] GetSystemMetrics (nIndex=46) returned 2 [0164.695] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.695] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.695] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.695] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.707] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.707] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.707] GetLastError () returned 0x578 [0164.707] CanUserWritePwrScheme () returned 0 [0164.708] GetSystemMetrics (nIndex=46) returned 2 [0164.708] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.708] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.708] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.708] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.719] GetLastError () returned 0x578 [0164.719] CanUserWritePwrScheme () returned 0 [0164.720] GetSystemMetrics (nIndex=46) returned 2 [0164.720] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.720] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.720] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.720] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.769] GetLastError () returned 0x578 [0164.769] CanUserWritePwrScheme () returned 0 [0164.770] GetSystemMetrics (nIndex=46) returned 2 [0164.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.782] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.782] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.782] GetLastError () returned 0x578 [0164.782] CanUserWritePwrScheme () returned 0 [0164.783] GetSystemMetrics (nIndex=46) returned 2 [0164.783] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.783] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.783] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.783] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.794] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.794] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.794] GetLastError () returned 0x578 [0164.794] CanUserWritePwrScheme () returned 0 [0164.795] GetSystemMetrics (nIndex=46) returned 2 [0164.795] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.795] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.795] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.795] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.807] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.807] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.807] GetLastError () returned 0x578 [0164.807] CanUserWritePwrScheme () returned 0 [0164.808] GetSystemMetrics (nIndex=46) returned 2 [0164.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.808] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.808] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.808] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.818] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.818] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.818] GetLastError () returned 0x578 [0164.818] CanUserWritePwrScheme () returned 0 [0164.819] GetSystemMetrics (nIndex=46) returned 2 [0164.819] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.819] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.819] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.820] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.831] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.831] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.831] GetLastError () returned 0x578 [0164.831] CanUserWritePwrScheme () returned 0 [0164.832] GetSystemMetrics (nIndex=46) returned 2 [0164.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.832] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.832] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.832] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.843] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.843] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.843] GetLastError () returned 0x578 [0164.843] CanUserWritePwrScheme () returned 0 [0164.844] GetSystemMetrics (nIndex=46) returned 2 [0164.844] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.844] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.844] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.844] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.933] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.933] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.933] GetLastError () returned 0x578 [0164.934] CanUserWritePwrScheme () returned 0 [0164.934] GetSystemMetrics (nIndex=46) returned 2 [0164.934] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.934] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.945] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.945] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.945] GetLastError () returned 0x578 [0164.945] CanUserWritePwrScheme () returned 0 [0164.946] GetSystemMetrics (nIndex=46) returned 2 [0164.946] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.946] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.946] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.946] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.958] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.958] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.958] GetLastError () returned 0x578 [0164.958] CanUserWritePwrScheme () returned 0 [0164.959] GetSystemMetrics (nIndex=46) returned 2 [0164.959] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.959] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.959] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.959] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.970] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.970] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.970] GetLastError () returned 0x578 [0164.970] CanUserWritePwrScheme () returned 0 [0164.971] GetSystemMetrics (nIndex=46) returned 2 [0164.971] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.971] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.971] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.971] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.982] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.982] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.982] GetLastError () returned 0x578 [0164.982] CanUserWritePwrScheme () returned 0 [0164.984] GetSystemMetrics (nIndex=46) returned 2 [0164.984] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.984] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.984] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.984] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0164.995] GetWindowTextLengthA (hWnd=0x0) returned 0 [0164.995] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0164.995] GetLastError () returned 0x578 [0164.995] CanUserWritePwrScheme () returned 0 [0164.996] GetSystemMetrics (nIndex=46) returned 2 [0164.996] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0164.996] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0164.996] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0164.996] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.007] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.007] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.007] GetLastError () returned 0x578 [0165.007] CanUserWritePwrScheme () returned 0 [0165.008] GetSystemMetrics (nIndex=46) returned 2 [0165.008] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.008] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.008] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.008] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.021] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.021] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.021] GetLastError () returned 0x578 [0165.021] CanUserWritePwrScheme () returned 0 [0165.022] GetSystemMetrics (nIndex=46) returned 2 [0165.022] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.022] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.022] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.022] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.039] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.039] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.039] GetLastError () returned 0x578 [0165.039] CanUserWritePwrScheme () returned 0 [0165.040] GetSystemMetrics (nIndex=46) returned 2 [0165.040] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.040] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.040] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.040] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.051] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.051] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.051] GetLastError () returned 0x578 [0165.051] CanUserWritePwrScheme () returned 0 [0165.052] GetSystemMetrics (nIndex=46) returned 2 [0165.052] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.052] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.052] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.052] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.064] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.064] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.064] GetLastError () returned 0x578 [0165.064] CanUserWritePwrScheme () returned 0 [0165.065] GetSystemMetrics (nIndex=46) returned 2 [0165.065] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.065] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.065] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.065] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.076] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.076] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.076] GetLastError () returned 0x578 [0165.076] CanUserWritePwrScheme () returned 0 [0165.077] GetSystemMetrics (nIndex=46) returned 2 [0165.077] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.077] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.077] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.077] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.087] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.087] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.087] GetLastError () returned 0x578 [0165.088] CanUserWritePwrScheme () returned 0 [0165.089] GetSystemMetrics (nIndex=46) returned 2 [0165.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.090] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.090] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.090] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.100] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.100] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.100] GetLastError () returned 0x578 [0165.100] CanUserWritePwrScheme () returned 0 [0165.101] GetSystemMetrics (nIndex=46) returned 2 [0165.101] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.101] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.101] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.101] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.112] GetLastError () returned 0x578 [0165.112] CanUserWritePwrScheme () returned 0 [0165.113] GetSystemMetrics (nIndex=46) returned 2 [0165.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.273] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.273] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.273] GetLastError () returned 0x578 [0165.273] CanUserWritePwrScheme () returned 0 [0165.274] GetSystemMetrics (nIndex=46) returned 2 [0165.274] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.274] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.274] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.274] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.285] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.285] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.285] GetLastError () returned 0x578 [0165.285] CanUserWritePwrScheme () returned 0 [0165.288] GetSystemMetrics (nIndex=46) returned 2 [0165.288] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.288] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.288] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.288] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.299] GetLastError () returned 0x578 [0165.299] CanUserWritePwrScheme () returned 0 [0165.300] GetSystemMetrics (nIndex=46) returned 2 [0165.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.311] GetLastError () returned 0x578 [0165.311] CanUserWritePwrScheme () returned 0 [0165.311] GetSystemMetrics (nIndex=46) returned 2 [0165.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.322] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.322] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.322] GetLastError () returned 0x578 [0165.322] CanUserWritePwrScheme () returned 0 [0165.323] GetSystemMetrics (nIndex=46) returned 2 [0165.323] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.323] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.323] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.323] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.337] GetLastError () returned 0x578 [0165.337] CanUserWritePwrScheme () returned 0 [0165.338] GetSystemMetrics (nIndex=46) returned 2 [0165.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.338] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.338] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.338] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.348] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.348] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.348] GetLastError () returned 0x578 [0165.348] CanUserWritePwrScheme () returned 0 [0165.349] GetSystemMetrics (nIndex=46) returned 2 [0165.349] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.349] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.349] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.349] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.394] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.394] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.394] GetLastError () returned 0x578 [0165.394] CanUserWritePwrScheme () returned 0 [0165.395] GetSystemMetrics (nIndex=46) returned 2 [0165.395] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.395] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.395] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.395] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.413] GetLastError () returned 0x578 [0165.413] CanUserWritePwrScheme () returned 0 [0165.414] GetSystemMetrics (nIndex=46) returned 2 [0165.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.414] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.414] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.414] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.427] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.427] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.427] GetLastError () returned 0x578 [0165.427] CanUserWritePwrScheme () returned 0 [0165.428] GetSystemMetrics (nIndex=46) returned 2 [0165.428] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.428] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.428] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.428] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.438] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.438] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.439] GetLastError () returned 0x578 [0165.439] CanUserWritePwrScheme () returned 0 [0165.439] GetSystemMetrics (nIndex=46) returned 2 [0165.439] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.439] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.440] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.440] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.450] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.450] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.450] GetLastError () returned 0x578 [0165.450] CanUserWritePwrScheme () returned 0 [0165.451] GetSystemMetrics (nIndex=46) returned 2 [0165.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.451] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.451] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.451] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.462] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.462] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.462] GetLastError () returned 0x578 [0165.462] CanUserWritePwrScheme () returned 0 [0165.463] GetSystemMetrics (nIndex=46) returned 2 [0165.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.463] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.463] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.463] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.476] GetLastError () returned 0x578 [0165.476] CanUserWritePwrScheme () returned 0 [0165.477] GetSystemMetrics (nIndex=46) returned 2 [0165.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.487] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.488] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.488] GetLastError () returned 0x578 [0165.488] CanUserWritePwrScheme () returned 0 [0165.488] GetSystemMetrics (nIndex=46) returned 2 [0165.488] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.489] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.489] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.489] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.502] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.502] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.502] GetLastError () returned 0x578 [0165.502] CanUserWritePwrScheme () returned 0 [0165.503] GetSystemMetrics (nIndex=46) returned 2 [0165.503] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.503] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.503] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.503] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.516] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.516] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.516] GetLastError () returned 0x578 [0165.516] CanUserWritePwrScheme () returned 0 [0165.517] GetSystemMetrics (nIndex=46) returned 2 [0165.517] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.517] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.517] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.517] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.527] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.527] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.527] GetLastError () returned 0x578 [0165.527] CanUserWritePwrScheme () returned 0 [0165.528] GetSystemMetrics (nIndex=46) returned 2 [0165.528] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.528] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.528] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.528] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.539] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.539] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.539] GetLastError () returned 0x578 [0165.539] CanUserWritePwrScheme () returned 0 [0165.540] GetSystemMetrics (nIndex=46) returned 2 [0165.540] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.540] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.540] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.540] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.550] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.551] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.551] GetLastError () returned 0x578 [0165.551] CanUserWritePwrScheme () returned 0 [0165.552] GetSystemMetrics (nIndex=46) returned 2 [0165.552] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.552] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.552] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.552] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.564] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.564] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.564] GetLastError () returned 0x578 [0165.564] CanUserWritePwrScheme () returned 0 [0165.565] GetSystemMetrics (nIndex=46) returned 2 [0165.565] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.565] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.565] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.565] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.576] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.576] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.576] GetLastError () returned 0x578 [0165.576] CanUserWritePwrScheme () returned 0 [0165.577] GetSystemMetrics (nIndex=46) returned 2 [0165.577] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.577] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.577] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.577] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.597] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.597] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.597] GetLastError () returned 0x578 [0165.597] CanUserWritePwrScheme () returned 0 [0165.599] GetSystemMetrics (nIndex=46) returned 2 [0165.599] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.599] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.599] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.599] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.611] GetLastError () returned 0x578 [0165.611] CanUserWritePwrScheme () returned 0 [0165.612] GetSystemMetrics (nIndex=46) returned 2 [0165.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.612] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.623] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.623] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.623] GetLastError () returned 0x578 [0165.624] CanUserWritePwrScheme () returned 0 [0165.624] GetSystemMetrics (nIndex=46) returned 2 [0165.624] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.624] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.624] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.624] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.633] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.633] GetLastError () returned 0x578 [0165.633] CanUserWritePwrScheme () returned 0 [0165.633] GetSystemMetrics (nIndex=46) returned 2 [0165.634] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.634] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.634] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.634] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.639] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.639] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.639] GetLastError () returned 0x578 [0165.640] CanUserWritePwrScheme () returned 0 [0165.640] GetSystemMetrics (nIndex=46) returned 2 [0165.640] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.640] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.640] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.640] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.645] GetLastError () returned 0x578 [0165.645] CanUserWritePwrScheme () returned 0 [0165.646] GetSystemMetrics (nIndex=46) returned 2 [0165.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.651] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.651] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.651] GetLastError () returned 0x578 [0165.651] CanUserWritePwrScheme () returned 0 [0165.652] GetSystemMetrics (nIndex=46) returned 2 [0165.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.652] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.652] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.652] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.657] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.657] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.657] GetLastError () returned 0x578 [0165.657] CanUserWritePwrScheme () returned 0 [0165.658] GetSystemMetrics (nIndex=46) returned 2 [0165.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.658] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.658] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.658] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.665] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.665] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.665] GetLastError () returned 0x578 [0165.665] CanUserWritePwrScheme () returned 0 [0165.666] GetSystemMetrics (nIndex=46) returned 2 [0165.666] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.666] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.666] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.666] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.671] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.671] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.671] GetLastError () returned 0x578 [0165.671] CanUserWritePwrScheme () returned 0 [0165.672] GetSystemMetrics (nIndex=46) returned 2 [0165.672] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.672] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.672] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.672] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.677] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.677] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.677] GetLastError () returned 0x578 [0165.677] CanUserWritePwrScheme () returned 0 [0165.678] GetSystemMetrics (nIndex=46) returned 2 [0165.678] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.678] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.678] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.678] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.685] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.685] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.685] GetLastError () returned 0x578 [0165.685] CanUserWritePwrScheme () returned 0 [0165.686] GetSystemMetrics (nIndex=46) returned 2 [0165.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.686] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.686] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.686] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.701] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.701] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.701] GetLastError () returned 0x578 [0165.701] CanUserWritePwrScheme () returned 0 [0165.702] GetSystemMetrics (nIndex=46) returned 2 [0165.702] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.702] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.702] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.702] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.715] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.715] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.715] GetLastError () returned 0x578 [0165.715] CanUserWritePwrScheme () returned 0 [0165.716] GetSystemMetrics (nIndex=46) returned 2 [0165.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.716] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.716] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.716] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.726] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.726] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.726] GetLastError () returned 0x578 [0165.727] CanUserWritePwrScheme () returned 0 [0165.727] GetSystemMetrics (nIndex=46) returned 2 [0165.727] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.727] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.727] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.727] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.738] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.738] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.738] GetLastError () returned 0x578 [0165.738] CanUserWritePwrScheme () returned 0 [0165.739] GetSystemMetrics (nIndex=46) returned 2 [0165.739] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.739] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.739] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.739] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.750] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.750] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.750] GetLastError () returned 0x578 [0165.750] CanUserWritePwrScheme () returned 0 [0165.751] GetSystemMetrics (nIndex=46) returned 2 [0165.751] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.751] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.751] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.751] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.764] GetLastError () returned 0x578 [0165.764] CanUserWritePwrScheme () returned 0 [0165.765] GetSystemMetrics (nIndex=46) returned 2 [0165.765] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.765] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.765] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.765] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.776] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.776] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.776] GetLastError () returned 0x578 [0165.776] CanUserWritePwrScheme () returned 0 [0165.777] GetSystemMetrics (nIndex=46) returned 2 [0165.777] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.777] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.777] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.777] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.868] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.868] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.868] GetLastError () returned 0x578 [0165.868] CanUserWritePwrScheme () returned 0 [0165.871] GetSystemMetrics (nIndex=46) returned 2 [0165.871] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.871] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.871] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.871] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.882] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.882] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.882] GetLastError () returned 0x578 [0165.882] CanUserWritePwrScheme () returned 0 [0165.883] GetSystemMetrics (nIndex=46) returned 2 [0165.883] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.883] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.883] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.883] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.894] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.894] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.894] GetLastError () returned 0x578 [0165.894] CanUserWritePwrScheme () returned 0 [0165.897] GetSystemMetrics (nIndex=46) returned 2 [0165.897] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.897] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.897] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.897] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.908] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.908] GetLastError () returned 0x578 [0165.908] CanUserWritePwrScheme () returned 0 [0165.909] GetSystemMetrics (nIndex=46) returned 2 [0165.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.909] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.909] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.909] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.920] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.920] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.920] GetLastError () returned 0x578 [0165.920] CanUserWritePwrScheme () returned 0 [0165.921] GetSystemMetrics (nIndex=46) returned 2 [0165.921] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.921] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.921] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.921] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.934] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.934] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.934] GetLastError () returned 0x578 [0165.934] CanUserWritePwrScheme () returned 0 [0165.935] GetSystemMetrics (nIndex=46) returned 2 [0165.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.946] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.946] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.946] GetLastError () returned 0x578 [0165.946] CanUserWritePwrScheme () returned 0 [0165.947] GetSystemMetrics (nIndex=46) returned 2 [0165.947] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.947] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.947] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.947] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.975] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.975] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.975] GetLastError () returned 0x578 [0165.975] CanUserWritePwrScheme () returned 0 [0165.976] GetSystemMetrics (nIndex=46) returned 2 [0165.976] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.976] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.976] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.976] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0165.989] GetWindowTextLengthA (hWnd=0x0) returned 0 [0165.989] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0165.989] GetLastError () returned 0x578 [0165.989] CanUserWritePwrScheme () returned 0 [0165.990] GetSystemMetrics (nIndex=46) returned 2 [0165.990] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0165.990] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0165.990] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0165.990] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.001] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.001] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.001] GetLastError () returned 0x578 [0166.001] CanUserWritePwrScheme () returned 0 [0166.002] GetSystemMetrics (nIndex=46) returned 2 [0166.002] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.002] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.002] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.002] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.013] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.013] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.013] GetLastError () returned 0x578 [0166.013] CanUserWritePwrScheme () returned 0 [0166.014] GetSystemMetrics (nIndex=46) returned 2 [0166.014] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.014] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.014] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.014] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.025] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.025] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.025] GetLastError () returned 0x578 [0166.025] CanUserWritePwrScheme () returned 0 [0166.026] GetSystemMetrics (nIndex=46) returned 2 [0166.026] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.026] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.026] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.026] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.037] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.037] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.037] GetLastError () returned 0x578 [0166.037] CanUserWritePwrScheme () returned 0 [0166.040] GetSystemMetrics (nIndex=46) returned 2 [0166.040] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.040] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.040] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.040] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.050] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.050] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.051] GetLastError () returned 0x578 [0166.051] CanUserWritePwrScheme () returned 0 [0166.052] GetSystemMetrics (nIndex=46) returned 2 [0166.052] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.052] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.052] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.052] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.066] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.066] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.066] GetLastError () returned 0x578 [0166.066] CanUserWritePwrScheme () returned 0 [0166.068] GetSystemMetrics (nIndex=46) returned 2 [0166.068] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.068] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.068] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.068] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.079] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.079] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.079] GetLastError () returned 0x578 [0166.079] CanUserWritePwrScheme () returned 0 [0166.080] GetSystemMetrics (nIndex=46) returned 2 [0166.080] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.080] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.080] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.080] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.091] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.091] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.091] GetLastError () returned 0x578 [0166.091] CanUserWritePwrScheme () returned 0 [0166.092] GetSystemMetrics (nIndex=46) returned 2 [0166.092] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.092] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.092] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.092] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.106] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.106] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.106] GetLastError () returned 0x578 [0166.106] CanUserWritePwrScheme () returned 0 [0166.107] GetSystemMetrics (nIndex=46) returned 2 [0166.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.107] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.117] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.117] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.117] GetLastError () returned 0x578 [0166.117] CanUserWritePwrScheme () returned 0 [0166.118] GetSystemMetrics (nIndex=46) returned 2 [0166.118] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.118] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.118] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.118] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.129] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.129] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.129] GetLastError () returned 0x578 [0166.129] CanUserWritePwrScheme () returned 0 [0166.130] GetSystemMetrics (nIndex=46) returned 2 [0166.130] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.130] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.130] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.130] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.141] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.141] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.141] GetLastError () returned 0x578 [0166.141] CanUserWritePwrScheme () returned 0 [0166.142] GetSystemMetrics (nIndex=46) returned 2 [0166.142] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.142] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.142] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.142] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.153] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.153] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.153] GetLastError () returned 0x578 [0166.153] CanUserWritePwrScheme () returned 0 [0166.156] GetSystemMetrics (nIndex=46) returned 2 [0166.156] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.157] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.157] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.157] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.167] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.167] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.167] GetLastError () returned 0x578 [0166.168] CanUserWritePwrScheme () returned 0 [0166.168] GetSystemMetrics (nIndex=46) returned 2 [0166.168] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.168] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.169] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.169] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.179] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.179] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.179] GetLastError () returned 0x578 [0166.179] CanUserWritePwrScheme () returned 0 [0166.180] GetSystemMetrics (nIndex=46) returned 2 [0166.180] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.180] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.180] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.181] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.191] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.191] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.191] GetLastError () returned 0x578 [0166.191] CanUserWritePwrScheme () returned 0 [0166.192] GetSystemMetrics (nIndex=46) returned 2 [0166.192] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.192] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.192] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.192] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.254] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.254] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.254] GetLastError () returned 0x578 [0166.254] CanUserWritePwrScheme () returned 0 [0166.255] GetSystemMetrics (nIndex=46) returned 2 [0166.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.255] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.255] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.266] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.266] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.266] GetLastError () returned 0x578 [0166.266] CanUserWritePwrScheme () returned 0 [0166.267] GetSystemMetrics (nIndex=46) returned 2 [0166.267] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.267] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.267] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.267] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.283] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.283] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.283] GetLastError () returned 0x578 [0166.284] CanUserWritePwrScheme () returned 0 [0166.284] GetSystemMetrics (nIndex=46) returned 2 [0166.284] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.284] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.284] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.284] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.295] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.295] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.295] GetLastError () returned 0x578 [0166.296] CanUserWritePwrScheme () returned 0 [0166.296] GetSystemMetrics (nIndex=46) returned 2 [0166.296] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.296] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.296] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.296] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.308] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.308] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.308] GetLastError () returned 0x578 [0166.308] CanUserWritePwrScheme () returned 0 [0166.308] GetSystemMetrics (nIndex=46) returned 2 [0166.308] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.309] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.309] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.309] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.319] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.319] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.319] GetLastError () returned 0x578 [0166.319] CanUserWritePwrScheme () returned 0 [0166.320] GetSystemMetrics (nIndex=46) returned 2 [0166.320] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.320] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.320] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.320] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.331] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.331] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.331] GetLastError () returned 0x578 [0166.331] CanUserWritePwrScheme () returned 0 [0166.332] GetSystemMetrics (nIndex=46) returned 2 [0166.332] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.332] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.332] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.332] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.346] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.346] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.346] GetLastError () returned 0x578 [0166.346] CanUserWritePwrScheme () returned 0 [0166.347] GetSystemMetrics (nIndex=46) returned 2 [0166.347] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.347] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.347] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.347] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.357] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.357] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.357] GetLastError () returned 0x578 [0166.357] CanUserWritePwrScheme () returned 0 [0166.358] GetSystemMetrics (nIndex=46) returned 2 [0166.358] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.358] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.358] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.358] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.369] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.369] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.369] GetLastError () returned 0x578 [0166.369] CanUserWritePwrScheme () returned 0 [0166.370] GetSystemMetrics (nIndex=46) returned 2 [0166.370] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.370] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.370] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.370] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.380] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.380] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.380] GetLastError () returned 0x578 [0166.381] CanUserWritePwrScheme () returned 0 [0166.381] GetSystemMetrics (nIndex=46) returned 2 [0166.381] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.381] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.381] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.381] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.386] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.386] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.386] GetLastError () returned 0x578 [0166.386] CanUserWritePwrScheme () returned 0 [0166.387] GetSystemMetrics (nIndex=46) returned 2 [0166.387] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.387] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.387] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.387] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.392] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.392] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.392] GetLastError () returned 0x578 [0166.392] CanUserWritePwrScheme () returned 0 [0166.393] GetSystemMetrics (nIndex=46) returned 2 [0166.393] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.393] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.393] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.393] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.398] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.398] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.398] GetLastError () returned 0x578 [0166.398] CanUserWritePwrScheme () returned 0 [0166.399] GetSystemMetrics (nIndex=46) returned 2 [0166.399] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.399] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.399] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.399] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.411] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.411] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.411] GetLastError () returned 0x578 [0166.411] CanUserWritePwrScheme () returned 0 [0166.412] GetSystemMetrics (nIndex=46) returned 2 [0166.412] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.412] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.412] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.412] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.416] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.416] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.417] GetLastError () returned 0x578 [0166.417] CanUserWritePwrScheme () returned 0 [0166.417] GetSystemMetrics (nIndex=46) returned 2 [0166.417] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.417] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.417] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.418] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.422] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.422] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.422] GetLastError () returned 0x578 [0166.422] CanUserWritePwrScheme () returned 0 [0166.423] GetSystemMetrics (nIndex=46) returned 2 [0166.423] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.423] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.423] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.423] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.430] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.430] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.430] GetLastError () returned 0x578 [0166.430] CanUserWritePwrScheme () returned 0 [0166.431] GetSystemMetrics (nIndex=46) returned 2 [0166.431] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.431] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.431] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.431] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.524] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.524] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.524] GetLastError () returned 0x578 [0166.524] CanUserWritePwrScheme () returned 0 [0166.525] GetSystemMetrics (nIndex=46) returned 2 [0166.525] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.525] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.525] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.525] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.539] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.539] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.539] GetLastError () returned 0x578 [0166.539] CanUserWritePwrScheme () returned 0 [0166.540] GetSystemMetrics (nIndex=46) returned 2 [0166.540] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.540] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.540] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.540] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.550] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.551] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.551] GetLastError () returned 0x578 [0166.551] CanUserWritePwrScheme () returned 0 [0166.551] GetSystemMetrics (nIndex=46) returned 2 [0166.551] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.552] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.552] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.552] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.557] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.557] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.557] GetLastError () returned 0x578 [0166.557] CanUserWritePwrScheme () returned 0 [0166.558] GetSystemMetrics (nIndex=46) returned 2 [0166.558] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.558] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.558] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.558] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.563] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.563] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.563] GetLastError () returned 0x578 [0166.563] CanUserWritePwrScheme () returned 0 [0166.564] GetSystemMetrics (nIndex=46) returned 2 [0166.564] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.564] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.564] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.564] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.568] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.568] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.568] GetLastError () returned 0x578 [0166.568] CanUserWritePwrScheme () returned 0 [0166.569] GetSystemMetrics (nIndex=46) returned 2 [0166.569] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.569] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.569] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.569] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.574] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.574] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.574] GetLastError () returned 0x578 [0166.574] CanUserWritePwrScheme () returned 0 [0166.575] GetSystemMetrics (nIndex=46) returned 2 [0166.575] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.575] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.575] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.575] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.580] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.580] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.580] GetLastError () returned 0x578 [0166.580] CanUserWritePwrScheme () returned 0 [0166.581] GetSystemMetrics (nIndex=46) returned 2 [0166.581] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.581] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.581] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.581] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.586] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.586] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.586] GetLastError () returned 0x578 [0166.586] CanUserWritePwrScheme () returned 0 [0166.587] GetSystemMetrics (nIndex=46) returned 2 [0166.587] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.587] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.587] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.587] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.592] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.592] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.592] GetLastError () returned 0x578 [0166.592] CanUserWritePwrScheme () returned 0 [0166.592] GetSystemMetrics (nIndex=46) returned 2 [0166.593] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.593] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.593] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.593] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.598] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.598] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.598] GetLastError () returned 0x578 [0166.598] CanUserWritePwrScheme () returned 0 [0166.599] GetSystemMetrics (nIndex=46) returned 2 [0166.599] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.599] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.599] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.599] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.646] GetLastError () returned 0x578 [0166.647] CanUserWritePwrScheme () returned 0 [0166.647] GetSystemMetrics (nIndex=46) returned 2 [0166.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.647] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.647] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.658] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.658] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.658] GetLastError () returned 0x578 [0166.658] CanUserWritePwrScheme () returned 0 [0166.659] GetSystemMetrics (nIndex=46) returned 2 [0166.659] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.659] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.659] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.659] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.673] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.673] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.673] GetLastError () returned 0x578 [0166.673] CanUserWritePwrScheme () returned 0 [0166.674] GetSystemMetrics (nIndex=46) returned 2 [0166.674] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.674] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.674] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.674] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.685] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.685] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.685] GetLastError () returned 0x578 [0166.685] CanUserWritePwrScheme () returned 0 [0166.686] GetSystemMetrics (nIndex=46) returned 2 [0166.686] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.686] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.686] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.686] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.697] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.697] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.697] GetLastError () returned 0x578 [0166.697] CanUserWritePwrScheme () returned 0 [0166.698] GetSystemMetrics (nIndex=46) returned 2 [0166.698] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.698] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.698] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.698] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.708] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.708] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.708] GetLastError () returned 0x578 [0166.708] CanUserWritePwrScheme () returned 0 [0166.709] GetSystemMetrics (nIndex=46) returned 2 [0166.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.709] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.720] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.720] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.720] GetLastError () returned 0x578 [0166.720] CanUserWritePwrScheme () returned 0 [0166.721] GetSystemMetrics (nIndex=46) returned 2 [0166.721] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.721] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.721] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.721] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.736] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.736] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.736] GetLastError () returned 0x578 [0166.736] CanUserWritePwrScheme () returned 0 [0166.737] GetSystemMetrics (nIndex=46) returned 2 [0166.737] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.737] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.737] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.737] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.748] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.748] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.748] GetLastError () returned 0x578 [0166.748] CanUserWritePwrScheme () returned 0 [0166.749] GetSystemMetrics (nIndex=46) returned 2 [0166.749] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.749] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.749] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.749] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.760] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.760] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.760] GetLastError () returned 0x578 [0166.760] CanUserWritePwrScheme () returned 0 [0166.761] GetSystemMetrics (nIndex=46) returned 2 [0166.761] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.761] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.761] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.761] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.772] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.772] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.772] GetLastError () returned 0x578 [0166.772] CanUserWritePwrScheme () returned 0 [0166.773] GetSystemMetrics (nIndex=46) returned 2 [0166.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.773] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.773] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.783] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.783] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.783] GetLastError () returned 0x578 [0166.783] CanUserWritePwrScheme () returned 0 [0166.784] GetSystemMetrics (nIndex=46) returned 2 [0166.784] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.784] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.784] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.784] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.798] GetLastError () returned 0x578 [0166.798] CanUserWritePwrScheme () returned 0 [0166.799] GetSystemMetrics (nIndex=46) returned 2 [0166.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.800] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.800] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.800] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.810] GetLastError () returned 0x578 [0166.810] CanUserWritePwrScheme () returned 0 [0166.811] GetSystemMetrics (nIndex=46) returned 2 [0166.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.823] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.823] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.823] GetLastError () returned 0x578 [0166.823] CanUserWritePwrScheme () returned 0 [0166.824] GetSystemMetrics (nIndex=46) returned 2 [0166.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.824] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.824] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.824] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.834] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.834] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.834] GetLastError () returned 0x578 [0166.835] CanUserWritePwrScheme () returned 0 [0166.835] GetSystemMetrics (nIndex=46) returned 2 [0166.835] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.835] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.835] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.835] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.846] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.846] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.846] GetLastError () returned 0x578 [0166.846] CanUserWritePwrScheme () returned 0 [0166.847] GetSystemMetrics (nIndex=46) returned 2 [0166.847] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.847] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.847] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.847] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0166.858] GetWindowTextLengthA (hWnd=0x0) returned 0 [0166.858] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0166.858] GetLastError () returned 0x578 [0166.858] CanUserWritePwrScheme () returned 0 [0166.859] GetSystemMetrics (nIndex=46) returned 2 [0166.859] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0166.859] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0166.859] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0166.859] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.393] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.393] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.393] GetLastError () returned 0x578 [0167.393] CanUserWritePwrScheme () returned 0 [0167.394] GetSystemMetrics (nIndex=46) returned 2 [0167.394] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.394] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.394] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.394] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.412] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.412] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.412] GetLastError () returned 0x578 [0167.412] CanUserWritePwrScheme () returned 0 [0167.413] GetSystemMetrics (nIndex=46) returned 2 [0167.413] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.413] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.413] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.413] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.424] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.424] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.424] GetLastError () returned 0x578 [0167.424] CanUserWritePwrScheme () returned 0 [0167.425] GetSystemMetrics (nIndex=46) returned 2 [0167.425] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.425] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.425] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.425] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.435] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.435] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.435] GetLastError () returned 0x578 [0167.436] CanUserWritePwrScheme () returned 0 [0167.436] GetSystemMetrics (nIndex=46) returned 2 [0167.436] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.436] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.436] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.436] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.450] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.450] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.450] GetLastError () returned 0x578 [0167.450] CanUserWritePwrScheme () returned 0 [0167.451] GetSystemMetrics (nIndex=46) returned 2 [0167.451] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.451] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.451] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.451] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.461] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.461] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.462] GetLastError () returned 0x578 [0167.462] CanUserWritePwrScheme () returned 0 [0167.462] GetSystemMetrics (nIndex=46) returned 2 [0167.463] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.463] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.463] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.463] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.473] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.473] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.473] GetLastError () returned 0x578 [0167.473] CanUserWritePwrScheme () returned 0 [0167.474] GetSystemMetrics (nIndex=46) returned 2 [0167.474] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.474] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.474] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.474] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.485] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.485] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.485] GetLastError () returned 0x578 [0167.485] CanUserWritePwrScheme () returned 0 [0167.486] GetSystemMetrics (nIndex=46) returned 2 [0167.486] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.486] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.486] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.486] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.499] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.499] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.499] GetLastError () returned 0x578 [0167.499] CanUserWritePwrScheme () returned 0 [0167.500] GetSystemMetrics (nIndex=46) returned 2 [0167.500] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.500] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.500] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.500] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.511] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.511] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.511] GetLastError () returned 0x578 [0167.511] CanUserWritePwrScheme () returned 0 [0167.515] GetSystemMetrics (nIndex=46) returned 2 [0167.515] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.515] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.515] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.515] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.525] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.525] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.525] GetLastError () returned 0x578 [0167.526] CanUserWritePwrScheme () returned 0 [0167.526] GetSystemMetrics (nIndex=46) returned 2 [0167.526] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.526] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.526] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.527] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.537] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.537] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.537] GetLastError () returned 0x578 [0167.537] CanUserWritePwrScheme () returned 0 [0167.538] GetSystemMetrics (nIndex=46) returned 2 [0167.538] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.538] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.538] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.538] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.549] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.549] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.549] GetLastError () returned 0x578 [0167.549] CanUserWritePwrScheme () returned 0 [0167.550] GetSystemMetrics (nIndex=46) returned 2 [0167.550] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.550] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.550] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.550] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.560] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.560] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.560] GetLastError () returned 0x578 [0167.560] CanUserWritePwrScheme () returned 0 [0167.561] GetSystemMetrics (nIndex=46) returned 2 [0167.561] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.561] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.561] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.561] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.572] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.572] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.572] GetLastError () returned 0x578 [0167.572] CanUserWritePwrScheme () returned 0 [0167.573] GetSystemMetrics (nIndex=46) returned 2 [0167.573] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.573] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.573] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.573] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.587] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.587] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.587] GetLastError () returned 0x578 [0167.587] CanUserWritePwrScheme () returned 0 [0167.588] GetSystemMetrics (nIndex=46) returned 2 [0167.588] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.588] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.588] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.588] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.599] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.599] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.599] GetLastError () returned 0x578 [0167.599] CanUserWritePwrScheme () returned 0 [0167.600] GetSystemMetrics (nIndex=46) returned 2 [0167.600] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.600] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.600] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.600] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.611] GetLastError () returned 0x578 [0167.611] CanUserWritePwrScheme () returned 0 [0167.612] GetSystemMetrics (nIndex=46) returned 2 [0167.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.612] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.694] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.694] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.694] GetLastError () returned 0x578 [0167.694] CanUserWritePwrScheme () returned 0 [0167.695] GetSystemMetrics (nIndex=46) returned 2 [0167.695] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.695] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.695] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.695] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.706] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.706] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.706] GetLastError () returned 0x578 [0167.706] CanUserWritePwrScheme () returned 0 [0167.709] GetSystemMetrics (nIndex=46) returned 2 [0167.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.709] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.720] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.720] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.720] GetLastError () returned 0x578 [0167.720] CanUserWritePwrScheme () returned 0 [0167.721] GetSystemMetrics (nIndex=46) returned 2 [0167.721] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.721] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.721] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.721] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.732] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.732] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.732] GetLastError () returned 0x578 [0167.732] CanUserWritePwrScheme () returned 0 [0167.733] GetSystemMetrics (nIndex=46) returned 2 [0167.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.733] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.733] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.733] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.744] GetLastError () returned 0x578 [0167.744] CanUserWritePwrScheme () returned 0 [0167.745] GetSystemMetrics (nIndex=46) returned 2 [0167.745] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.745] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.745] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.745] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.756] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.756] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.756] GetLastError () returned 0x578 [0167.756] CanUserWritePwrScheme () returned 0 [0167.757] GetSystemMetrics (nIndex=46) returned 2 [0167.757] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.757] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.757] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.757] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.767] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.767] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.767] GetLastError () returned 0x578 [0167.767] CanUserWritePwrScheme () returned 0 [0167.768] GetSystemMetrics (nIndex=46) returned 2 [0167.768] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.768] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.768] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.768] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.782] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.782] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.782] GetLastError () returned 0x578 [0167.782] CanUserWritePwrScheme () returned 0 [0167.783] GetSystemMetrics (nIndex=46) returned 2 [0167.783] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.783] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.783] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.783] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.788] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.788] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.788] GetLastError () returned 0x578 [0167.788] CanUserWritePwrScheme () returned 0 [0167.789] GetSystemMetrics (nIndex=46) returned 2 [0167.789] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.789] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.789] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.789] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.794] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.794] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.794] GetLastError () returned 0x578 [0167.794] CanUserWritePwrScheme () returned 0 [0167.795] GetSystemMetrics (nIndex=46) returned 2 [0167.795] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.795] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.795] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.795] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.800] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.800] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.800] GetLastError () returned 0x578 [0167.800] CanUserWritePwrScheme () returned 0 [0167.801] GetSystemMetrics (nIndex=46) returned 2 [0167.801] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.801] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.801] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.801] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.806] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.806] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.806] GetLastError () returned 0x578 [0167.806] CanUserWritePwrScheme () returned 0 [0167.807] GetSystemMetrics (nIndex=46) returned 2 [0167.807] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.807] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.807] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.807] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.812] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.812] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.812] GetLastError () returned 0x578 [0167.812] CanUserWritePwrScheme () returned 0 [0167.813] GetSystemMetrics (nIndex=46) returned 2 [0167.813] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.813] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.813] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.813] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.818] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.818] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.818] GetLastError () returned 0x578 [0167.818] CanUserWritePwrScheme () returned 0 [0167.819] GetSystemMetrics (nIndex=46) returned 2 [0167.819] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.819] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.819] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.819] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.824] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.824] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.824] GetLastError () returned 0x578 [0167.824] CanUserWritePwrScheme () returned 0 [0167.825] GetSystemMetrics (nIndex=46) returned 2 [0167.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.825] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.825] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.825] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.830] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.830] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.830] GetLastError () returned 0x578 [0167.830] CanUserWritePwrScheme () returned 0 [0167.831] GetSystemMetrics (nIndex=46) returned 2 [0167.831] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.831] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.831] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.831] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.835] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.835] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.836] GetLastError () returned 0x578 [0167.836] CanUserWritePwrScheme () returned 0 [0167.836] GetSystemMetrics (nIndex=46) returned 2 [0167.836] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.836] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.837] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.837] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0167.844] GetWindowTextLengthA (hWnd=0x0) returned 0 [0167.844] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0167.844] GetLastError () returned 0x578 [0167.844] CanUserWritePwrScheme () returned 0 [0167.845] GetSystemMetrics (nIndex=46) returned 2 [0167.845] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0167.845] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0167.845] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0167.845] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.076] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.076] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.076] GetLastError () returned 0x578 [0168.076] CanUserWritePwrScheme () returned 0 [0168.077] GetSystemMetrics (nIndex=46) returned 2 [0168.077] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.077] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.077] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.077] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.088] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.088] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.088] GetLastError () returned 0x578 [0168.088] CanUserWritePwrScheme () returned 0 [0168.089] GetSystemMetrics (nIndex=46) returned 2 [0168.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.089] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.089] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.089] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.103] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.103] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.103] GetLastError () returned 0x578 [0168.103] CanUserWritePwrScheme () returned 0 [0168.104] GetSystemMetrics (nIndex=46) returned 2 [0168.104] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.104] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.104] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.104] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.115] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.115] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.115] GetLastError () returned 0x578 [0168.115] CanUserWritePwrScheme () returned 0 [0168.116] GetSystemMetrics (nIndex=46) returned 2 [0168.116] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.116] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.116] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.116] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.126] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.127] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.127] GetLastError () returned 0x578 [0168.127] CanUserWritePwrScheme () returned 0 [0168.127] GetSystemMetrics (nIndex=46) returned 2 [0168.127] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.128] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.128] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.128] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.138] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.138] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.138] GetLastError () returned 0x578 [0168.138] CanUserWritePwrScheme () returned 0 [0168.139] GetSystemMetrics (nIndex=46) returned 2 [0168.139] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.139] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.139] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.139] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.150] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.150] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.150] GetLastError () returned 0x578 [0168.150] CanUserWritePwrScheme () returned 0 [0168.151] GetSystemMetrics (nIndex=46) returned 2 [0168.151] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.151] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.151] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.151] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.164] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.165] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.165] GetLastError () returned 0x578 [0168.165] CanUserWritePwrScheme () returned 0 [0168.166] GetSystemMetrics (nIndex=46) returned 2 [0168.166] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.166] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.166] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.166] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.232] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.232] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.232] GetLastError () returned 0x578 [0168.232] CanUserWritePwrScheme () returned 0 [0168.233] GetSystemMetrics (nIndex=46) returned 2 [0168.233] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.233] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.233] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.233] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.244] GetLastError () returned 0x578 [0168.244] CanUserWritePwrScheme () returned 0 [0168.245] GetSystemMetrics (nIndex=46) returned 2 [0168.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.256] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.256] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.256] GetLastError () returned 0x578 [0168.256] CanUserWritePwrScheme () returned 0 [0168.257] GetSystemMetrics (nIndex=46) returned 2 [0168.257] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.257] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.257] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.257] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.268] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.268] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.268] GetLastError () returned 0x578 [0168.268] CanUserWritePwrScheme () returned 0 [0168.269] GetSystemMetrics (nIndex=46) returned 2 [0168.269] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.269] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.269] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.269] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.279] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.279] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.279] GetLastError () returned 0x578 [0168.279] CanUserWritePwrScheme () returned 0 [0168.280] GetSystemMetrics (nIndex=46) returned 2 [0168.280] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.280] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.280] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.280] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.291] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.291] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.291] GetLastError () returned 0x578 [0168.291] CanUserWritePwrScheme () returned 0 [0168.294] GetSystemMetrics (nIndex=46) returned 2 [0168.294] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.295] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.295] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.295] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.305] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.305] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.305] GetLastError () returned 0x578 [0168.305] CanUserWritePwrScheme () returned 0 [0168.306] GetSystemMetrics (nIndex=46) returned 2 [0168.306] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.306] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.306] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.306] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.317] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.317] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.317] GetLastError () returned 0x578 [0168.317] CanUserWritePwrScheme () returned 0 [0168.318] GetSystemMetrics (nIndex=46) returned 2 [0168.318] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.318] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.318] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.318] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.332] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.332] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.332] GetLastError () returned 0x578 [0168.332] CanUserWritePwrScheme () returned 0 [0168.333] GetSystemMetrics (nIndex=46) returned 2 [0168.333] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.333] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.333] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.333] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.343] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.343] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.343] GetLastError () returned 0x578 [0168.343] CanUserWritePwrScheme () returned 0 [0168.344] GetSystemMetrics (nIndex=46) returned 2 [0168.344] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.344] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.344] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.344] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.355] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.355] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.355] GetLastError () returned 0x578 [0168.355] CanUserWritePwrScheme () returned 0 [0168.356] GetSystemMetrics (nIndex=46) returned 2 [0168.356] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.356] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.356] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.356] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.370] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.370] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.370] GetLastError () returned 0x578 [0168.370] CanUserWritePwrScheme () returned 0 [0168.371] GetSystemMetrics (nIndex=46) returned 2 [0168.371] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.371] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.371] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.371] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.382] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.382] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.382] GetLastError () returned 0x578 [0168.382] CanUserWritePwrScheme () returned 0 [0168.383] GetSystemMetrics (nIndex=46) returned 2 [0168.383] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.383] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.383] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.383] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.394] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.394] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.394] GetLastError () returned 0x578 [0168.394] CanUserWritePwrScheme () returned 0 [0168.395] GetSystemMetrics (nIndex=46) returned 2 [0168.395] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.395] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.395] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.395] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.413] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.413] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.413] GetLastError () returned 0x578 [0168.414] CanUserWritePwrScheme () returned 0 [0168.414] GetSystemMetrics (nIndex=46) returned 2 [0168.414] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.414] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.414] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.415] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.447] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.447] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.447] GetLastError () returned 0x578 [0168.447] CanUserWritePwrScheme () returned 0 [0168.448] GetSystemMetrics (nIndex=46) returned 2 [0168.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.448] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.448] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.448] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.459] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.459] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.459] GetLastError () returned 0x578 [0168.459] CanUserWritePwrScheme () returned 0 [0168.460] GetSystemMetrics (nIndex=46) returned 2 [0168.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.460] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.460] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.460] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.470] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.470] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.470] GetLastError () returned 0x578 [0168.470] CanUserWritePwrScheme () returned 0 [0168.471] GetSystemMetrics (nIndex=46) returned 2 [0168.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.482] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.482] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.482] GetLastError () returned 0x578 [0168.482] CanUserWritePwrScheme () returned 0 [0168.483] GetSystemMetrics (nIndex=46) returned 2 [0168.483] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.483] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.483] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.483] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.496] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.496] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.496] GetLastError () returned 0x578 [0168.496] CanUserWritePwrScheme () returned 0 [0168.496] GetSystemMetrics (nIndex=46) returned 2 [0168.497] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.497] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.497] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.497] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.508] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.508] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.508] GetLastError () returned 0x578 [0168.508] CanUserWritePwrScheme () returned 0 [0168.509] GetSystemMetrics (nIndex=46) returned 2 [0168.509] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.509] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.509] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.509] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.520] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.520] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.520] GetLastError () returned 0x578 [0168.520] CanUserWritePwrScheme () returned 0 [0168.521] GetSystemMetrics (nIndex=46) returned 2 [0168.521] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.521] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.521] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.521] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.578] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.578] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.578] GetLastError () returned 0x578 [0168.579] CanUserWritePwrScheme () returned 0 [0168.579] GetSystemMetrics (nIndex=46) returned 2 [0168.579] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.579] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.579] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.580] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.590] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.590] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.590] GetLastError () returned 0x578 [0168.590] CanUserWritePwrScheme () returned 0 [0168.591] GetSystemMetrics (nIndex=46) returned 2 [0168.591] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.591] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.591] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.591] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.602] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.602] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.602] GetLastError () returned 0x578 [0168.602] CanUserWritePwrScheme () returned 0 [0168.603] GetSystemMetrics (nIndex=46) returned 2 [0168.603] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.603] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.603] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.603] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.614] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.614] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.614] GetLastError () returned 0x578 [0168.614] CanUserWritePwrScheme () returned 0 [0168.615] GetSystemMetrics (nIndex=46) returned 2 [0168.615] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.615] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.615] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.615] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.628] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.628] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.628] GetLastError () returned 0x578 [0168.628] CanUserWritePwrScheme () returned 0 [0168.629] GetSystemMetrics (nIndex=46) returned 2 [0168.629] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.629] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.629] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.629] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.640] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.640] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.640] GetLastError () returned 0x578 [0168.641] CanUserWritePwrScheme () returned 0 [0168.641] GetSystemMetrics (nIndex=46) returned 2 [0168.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.641] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.641] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.641] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.652] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.652] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.652] GetLastError () returned 0x578 [0168.652] CanUserWritePwrScheme () returned 0 [0168.653] GetSystemMetrics (nIndex=46) returned 2 [0168.653] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.653] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.653] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.653] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.664] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.664] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.664] GetLastError () returned 0x578 [0168.664] CanUserWritePwrScheme () returned 0 [0168.665] GetSystemMetrics (nIndex=46) returned 2 [0168.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.665] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.665] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.665] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.680] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.680] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.680] GetLastError () returned 0x578 [0168.681] CanUserWritePwrScheme () returned 0 [0168.681] GetSystemMetrics (nIndex=46) returned 2 [0168.681] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.681] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.681] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.681] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.695] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.695] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.695] GetLastError () returned 0x578 [0168.695] CanUserWritePwrScheme () returned 0 [0168.696] GetSystemMetrics (nIndex=46) returned 2 [0168.696] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.696] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.696] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.696] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.707] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.707] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.707] GetLastError () returned 0x578 [0168.707] CanUserWritePwrScheme () returned 0 [0168.708] GetSystemMetrics (nIndex=46) returned 2 [0168.708] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.708] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.708] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.708] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.719] GetLastError () returned 0x578 [0168.719] CanUserWritePwrScheme () returned 0 [0168.720] GetSystemMetrics (nIndex=46) returned 2 [0168.720] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.720] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.720] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.720] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.731] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.731] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.731] GetLastError () returned 0x578 [0168.731] CanUserWritePwrScheme () returned 0 [0168.732] GetSystemMetrics (nIndex=46) returned 2 [0168.732] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.732] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.732] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.732] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.742] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.742] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.743] GetLastError () returned 0x578 [0168.743] CanUserWritePwrScheme () returned 0 [0168.743] GetSystemMetrics (nIndex=46) returned 2 [0168.743] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.744] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.744] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.744] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.762] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.762] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.762] GetLastError () returned 0x578 [0168.762] CanUserWritePwrScheme () returned 0 [0168.763] GetSystemMetrics (nIndex=46) returned 2 [0168.763] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.763] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.763] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.763] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.774] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.774] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.774] GetLastError () returned 0x578 [0168.774] CanUserWritePwrScheme () returned 0 [0168.775] GetSystemMetrics (nIndex=46) returned 2 [0168.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.775] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.775] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.775] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.786] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.786] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.786] GetLastError () returned 0x578 [0168.786] CanUserWritePwrScheme () returned 0 [0168.787] GetSystemMetrics (nIndex=46) returned 2 [0168.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.798] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.798] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.798] GetLastError () returned 0x578 [0168.798] CanUserWritePwrScheme () returned 0 [0168.799] GetSystemMetrics (nIndex=46) returned 2 [0168.799] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.799] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.799] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.799] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.810] GetLastError () returned 0x578 [0168.810] CanUserWritePwrScheme () returned 0 [0168.811] GetSystemMetrics (nIndex=46) returned 2 [0168.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.824] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.824] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.825] GetLastError () returned 0x578 [0168.825] CanUserWritePwrScheme () returned 0 [0168.825] GetSystemMetrics (nIndex=46) returned 2 [0168.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.826] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.826] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.826] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.836] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.836] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.836] GetLastError () returned 0x578 [0168.836] CanUserWritePwrScheme () returned 0 [0168.837] GetSystemMetrics (nIndex=46) returned 2 [0168.837] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.837] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.837] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.837] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.934] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.934] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.934] GetLastError () returned 0x578 [0168.934] CanUserWritePwrScheme () returned 0 [0168.935] GetSystemMetrics (nIndex=46) returned 2 [0168.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.949] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.949] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.949] GetLastError () returned 0x578 [0168.949] CanUserWritePwrScheme () returned 0 [0168.950] GetSystemMetrics (nIndex=46) returned 2 [0168.950] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.950] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.950] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.950] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.960] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.960] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.960] GetLastError () returned 0x578 [0168.960] CanUserWritePwrScheme () returned 0 [0168.961] GetSystemMetrics (nIndex=46) returned 2 [0168.961] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.961] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.961] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.961] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.972] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.972] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.972] GetLastError () returned 0x578 [0168.972] CanUserWritePwrScheme () returned 0 [0168.973] GetSystemMetrics (nIndex=46) returned 2 [0168.973] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.973] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.973] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.973] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.984] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.984] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.984] GetLastError () returned 0x578 [0168.984] CanUserWritePwrScheme () returned 0 [0168.985] GetSystemMetrics (nIndex=46) returned 2 [0168.985] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.985] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.985] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.985] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0168.995] GetWindowTextLengthA (hWnd=0x0) returned 0 [0168.995] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0168.995] GetLastError () returned 0x578 [0168.995] CanUserWritePwrScheme () returned 0 [0168.996] GetSystemMetrics (nIndex=46) returned 2 [0168.996] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0168.996] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0168.996] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0168.996] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.007] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.007] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.007] GetLastError () returned 0x578 [0169.007] CanUserWritePwrScheme () returned 0 [0169.008] GetSystemMetrics (nIndex=46) returned 2 [0169.008] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.008] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.008] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.008] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.142] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.142] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.142] GetLastError () returned 0x578 [0169.142] CanUserWritePwrScheme () returned 0 [0169.143] GetSystemMetrics (nIndex=46) returned 2 [0169.143] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.143] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.143] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.143] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.154] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.154] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.154] GetLastError () returned 0x578 [0169.154] CanUserWritePwrScheme () returned 0 [0169.155] GetSystemMetrics (nIndex=46) returned 2 [0169.155] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.155] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.155] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.155] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.166] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.166] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.166] GetLastError () returned 0x578 [0169.166] CanUserWritePwrScheme () returned 0 [0169.167] GetSystemMetrics (nIndex=46) returned 2 [0169.167] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.167] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.167] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.167] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.178] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.178] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.178] GetLastError () returned 0x578 [0169.178] CanUserWritePwrScheme () returned 0 [0169.179] GetSystemMetrics (nIndex=46) returned 2 [0169.179] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.179] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.179] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.179] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.190] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.190] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.190] GetLastError () returned 0x578 [0169.190] CanUserWritePwrScheme () returned 0 [0169.191] GetSystemMetrics (nIndex=46) returned 2 [0169.191] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.191] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.191] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.191] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.201] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.201] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.201] GetLastError () returned 0x578 [0169.201] CanUserWritePwrScheme () returned 0 [0169.202] GetSystemMetrics (nIndex=46) returned 2 [0169.202] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.202] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.202] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.202] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.264] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.264] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.264] GetLastError () returned 0x578 [0169.264] CanUserWritePwrScheme () returned 0 [0169.265] GetSystemMetrics (nIndex=46) returned 2 [0169.265] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.265] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.265] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.265] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.279] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.279] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.279] GetLastError () returned 0x578 [0169.279] CanUserWritePwrScheme () returned 0 [0169.280] GetSystemMetrics (nIndex=46) returned 2 [0169.280] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.280] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.280] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.280] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.291] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.291] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.291] GetLastError () returned 0x578 [0169.291] CanUserWritePwrScheme () returned 0 [0169.292] GetSystemMetrics (nIndex=46) returned 2 [0169.292] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.292] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.292] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.292] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.303] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.303] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.303] GetLastError () returned 0x578 [0169.303] CanUserWritePwrScheme () returned 0 [0169.304] GetSystemMetrics (nIndex=46) returned 2 [0169.304] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.304] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.304] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.304] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.315] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.315] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.315] GetLastError () returned 0x578 [0169.315] CanUserWritePwrScheme () returned 0 [0169.316] GetSystemMetrics (nIndex=46) returned 2 [0169.316] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.316] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.316] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.316] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.326] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.326] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.326] GetLastError () returned 0x578 [0169.326] CanUserWritePwrScheme () returned 0 [0169.327] GetSystemMetrics (nIndex=46) returned 2 [0169.327] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.327] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.327] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.327] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.341] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.341] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.341] GetLastError () returned 0x578 [0169.341] CanUserWritePwrScheme () returned 0 [0169.342] GetSystemMetrics (nIndex=46) returned 2 [0169.342] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.342] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.342] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.342] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.461] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.461] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.461] GetLastError () returned 0x578 [0169.461] CanUserWritePwrScheme () returned 0 [0169.462] GetSystemMetrics (nIndex=46) returned 2 [0169.462] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.462] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.462] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.462] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.476] GetLastError () returned 0x578 [0169.476] CanUserWritePwrScheme () returned 0 [0169.477] GetSystemMetrics (nIndex=46) returned 2 [0169.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.488] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.488] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.488] GetLastError () returned 0x578 [0169.488] CanUserWritePwrScheme () returned 0 [0169.489] GetSystemMetrics (nIndex=46) returned 2 [0169.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.489] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.489] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.489] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.500] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.500] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.500] GetLastError () returned 0x578 [0169.500] CanUserWritePwrScheme () returned 0 [0169.501] GetSystemMetrics (nIndex=46) returned 2 [0169.501] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.501] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.501] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.501] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.513] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.513] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.513] GetLastError () returned 0x578 [0169.513] CanUserWritePwrScheme () returned 0 [0169.514] GetSystemMetrics (nIndex=46) returned 2 [0169.515] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.515] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.515] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.515] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.526] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.526] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.526] GetLastError () returned 0x578 [0169.526] CanUserWritePwrScheme () returned 0 [0169.527] GetSystemMetrics (nIndex=46) returned 2 [0169.527] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.527] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.527] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.527] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.541] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.541] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.541] GetLastError () returned 0x578 [0169.541] CanUserWritePwrScheme () returned 0 [0169.542] GetSystemMetrics (nIndex=46) returned 2 [0169.542] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.542] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.542] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.542] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.608] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.608] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.608] GetLastError () returned 0x578 [0169.608] CanUserWritePwrScheme () returned 0 [0169.609] GetSystemMetrics (nIndex=46) returned 2 [0169.609] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.609] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.609] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.609] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.620] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.620] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.620] GetLastError () returned 0x578 [0169.620] CanUserWritePwrScheme () returned 0 [0169.621] GetSystemMetrics (nIndex=46) returned 2 [0169.621] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.621] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.621] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.621] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.632] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.632] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.632] GetLastError () returned 0x578 [0169.632] CanUserWritePwrScheme () returned 0 [0169.633] GetSystemMetrics (nIndex=46) returned 2 [0169.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.633] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.633] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.633] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.645] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.645] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.645] GetLastError () returned 0x578 [0169.645] CanUserWritePwrScheme () returned 0 [0169.646] GetSystemMetrics (nIndex=46) returned 2 [0169.646] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.646] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.646] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.646] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.657] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.657] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.657] GetLastError () returned 0x578 [0169.657] CanUserWritePwrScheme () returned 0 [0169.658] GetSystemMetrics (nIndex=46) returned 2 [0169.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.658] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.658] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.658] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.672] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.672] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.672] GetLastError () returned 0x578 [0169.672] CanUserWritePwrScheme () returned 0 [0169.673] GetSystemMetrics (nIndex=46) returned 2 [0169.673] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.673] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.673] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.673] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.684] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.684] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.684] GetLastError () returned 0x578 [0169.684] CanUserWritePwrScheme () returned 0 [0169.685] GetSystemMetrics (nIndex=46) returned 2 [0169.685] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.685] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.685] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.685] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.744] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.744] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.744] GetLastError () returned 0x578 [0169.744] CanUserWritePwrScheme () returned 0 [0169.745] GetSystemMetrics (nIndex=46) returned 2 [0169.745] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.745] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.745] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.745] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.757] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.757] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.757] GetLastError () returned 0x578 [0169.757] CanUserWritePwrScheme () returned 0 [0169.757] GetSystemMetrics (nIndex=46) returned 2 [0169.758] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.758] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.758] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.758] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.769] GetLastError () returned 0x578 [0169.769] CanUserWritePwrScheme () returned 0 [0169.770] GetSystemMetrics (nIndex=46) returned 2 [0169.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.781] GetLastError () returned 0x578 [0169.781] CanUserWritePwrScheme () returned 0 [0169.782] GetSystemMetrics (nIndex=46) returned 2 [0169.782] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.782] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.782] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.782] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.796] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.796] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.796] GetLastError () returned 0x578 [0169.796] CanUserWritePwrScheme () returned 0 [0169.796] GetSystemMetrics (nIndex=46) returned 2 [0169.797] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.797] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.797] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.797] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.807] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.807] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.807] GetLastError () returned 0x578 [0169.807] CanUserWritePwrScheme () returned 0 [0169.808] GetSystemMetrics (nIndex=46) returned 2 [0169.808] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.808] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.808] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.808] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.819] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.819] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.819] GetLastError () returned 0x578 [0169.819] CanUserWritePwrScheme () returned 0 [0169.820] GetSystemMetrics (nIndex=46) returned 2 [0169.820] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.820] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.820] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.820] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.842] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.842] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.842] GetLastError () returned 0x578 [0169.842] CanUserWritePwrScheme () returned 0 [0169.843] GetSystemMetrics (nIndex=46) returned 2 [0169.843] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.843] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.843] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.843] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.854] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.854] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.854] GetLastError () returned 0x578 [0169.854] CanUserWritePwrScheme () returned 0 [0169.855] GetSystemMetrics (nIndex=46) returned 2 [0169.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.855] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.855] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.855] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.869] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.869] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.869] GetLastError () returned 0x578 [0169.869] CanUserWritePwrScheme () returned 0 [0169.870] GetSystemMetrics (nIndex=46) returned 2 [0169.870] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.870] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.870] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.870] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.881] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.881] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.881] GetLastError () returned 0x578 [0169.881] CanUserWritePwrScheme () returned 0 [0169.882] GetSystemMetrics (nIndex=46) returned 2 [0169.882] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.882] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.882] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.882] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.893] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.893] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.893] GetLastError () returned 0x578 [0169.893] CanUserWritePwrScheme () returned 0 [0169.894] GetSystemMetrics (nIndex=46) returned 2 [0169.894] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.894] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.894] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.894] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.908] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.908] GetLastError () returned 0x578 [0169.908] CanUserWritePwrScheme () returned 0 [0169.909] GetSystemMetrics (nIndex=46) returned 2 [0169.909] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.909] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.909] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.909] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.980] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.980] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.980] GetLastError () returned 0x578 [0169.980] CanUserWritePwrScheme () returned 0 [0169.981] GetSystemMetrics (nIndex=46) returned 2 [0169.981] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.981] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.981] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.981] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0169.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0169.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0169.994] GetLastError () returned 0x578 [0169.994] CanUserWritePwrScheme () returned 0 [0169.995] GetSystemMetrics (nIndex=46) returned 2 [0169.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0169.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0169.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0169.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.006] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.006] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.006] GetLastError () returned 0x578 [0170.006] CanUserWritePwrScheme () returned 0 [0170.007] GetSystemMetrics (nIndex=46) returned 2 [0170.007] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.007] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.007] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.007] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.018] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.018] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.018] GetLastError () returned 0x578 [0170.018] CanUserWritePwrScheme () returned 0 [0170.019] GetSystemMetrics (nIndex=46) returned 2 [0170.019] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.019] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.019] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.019] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.030] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.030] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.030] GetLastError () returned 0x578 [0170.030] CanUserWritePwrScheme () returned 0 [0170.031] GetSystemMetrics (nIndex=46) returned 2 [0170.031] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.031] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.031] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.031] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.042] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.042] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.042] GetLastError () returned 0x578 [0170.042] CanUserWritePwrScheme () returned 0 [0170.043] GetSystemMetrics (nIndex=46) returned 2 [0170.043] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.043] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.043] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.043] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.056] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.056] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.056] GetLastError () returned 0x578 [0170.056] CanUserWritePwrScheme () returned 0 [0170.057] GetSystemMetrics (nIndex=46) returned 2 [0170.057] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.057] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.057] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.057] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.106] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.107] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.107] GetLastError () returned 0x578 [0170.107] CanUserWritePwrScheme () returned 0 [0170.108] GetSystemMetrics (nIndex=46) returned 2 [0170.108] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.108] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.108] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.108] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.121] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.121] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.121] GetLastError () returned 0x578 [0170.121] CanUserWritePwrScheme () returned 0 [0170.122] GetSystemMetrics (nIndex=46) returned 2 [0170.122] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.122] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.122] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.122] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.133] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.133] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.133] GetLastError () returned 0x578 [0170.133] CanUserWritePwrScheme () returned 0 [0170.134] GetSystemMetrics (nIndex=46) returned 2 [0170.134] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.134] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.134] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.134] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.145] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.145] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.145] GetLastError () returned 0x578 [0170.145] CanUserWritePwrScheme () returned 0 [0170.146] GetSystemMetrics (nIndex=46) returned 2 [0170.146] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.146] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.146] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.146] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.157] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.157] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.157] GetLastError () returned 0x578 [0170.157] CanUserWritePwrScheme () returned 0 [0170.158] GetSystemMetrics (nIndex=46) returned 2 [0170.158] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.158] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.158] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.158] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.169] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.169] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.169] GetLastError () returned 0x578 [0170.169] CanUserWritePwrScheme () returned 0 [0170.170] GetSystemMetrics (nIndex=46) returned 2 [0170.170] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.170] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.170] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.170] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.185] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.185] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.185] GetLastError () returned 0x578 [0170.185] CanUserWritePwrScheme () returned 0 [0170.186] GetSystemMetrics (nIndex=46) returned 2 [0170.186] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.186] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.186] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.186] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.275] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.276] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.276] GetLastError () returned 0x578 [0170.276] CanUserWritePwrScheme () returned 0 [0170.276] GetSystemMetrics (nIndex=46) returned 2 [0170.277] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.277] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.277] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.277] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.287] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.287] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.287] GetLastError () returned 0x578 [0170.288] CanUserWritePwrScheme () returned 0 [0170.288] GetSystemMetrics (nIndex=46) returned 2 [0170.288] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.288] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.288] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.289] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.299] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.299] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.299] GetLastError () returned 0x578 [0170.299] CanUserWritePwrScheme () returned 0 [0170.300] GetSystemMetrics (nIndex=46) returned 2 [0170.300] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.300] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.300] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.300] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.311] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.311] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.311] GetLastError () returned 0x578 [0170.311] CanUserWritePwrScheme () returned 0 [0170.312] GetSystemMetrics (nIndex=46) returned 2 [0170.312] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.312] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.312] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.312] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.325] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.325] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.325] GetLastError () returned 0x578 [0170.325] CanUserWritePwrScheme () returned 0 [0170.326] GetSystemMetrics (nIndex=46) returned 2 [0170.326] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.326] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.326] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.326] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.337] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.337] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.337] GetLastError () returned 0x578 [0170.337] CanUserWritePwrScheme () returned 0 [0170.338] GetSystemMetrics (nIndex=46) returned 2 [0170.338] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.338] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.338] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.338] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.348] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.348] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.349] GetLastError () returned 0x578 [0170.349] CanUserWritePwrScheme () returned 0 [0170.349] GetSystemMetrics (nIndex=46) returned 2 [0170.349] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.349] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.350] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.350] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.543] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.544] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.544] GetLastError () returned 0x578 [0170.544] CanUserWritePwrScheme () returned 0 [0170.545] GetSystemMetrics (nIndex=46) returned 2 [0170.545] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0170.545] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0170.545] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0170.545] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0170.556] GetWindowTextLengthA (hWnd=0x0) returned 0 [0170.556] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0170.556] GetLastError () returned 0x578 [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.556] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.557] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.558] timeGetTime () returned 0x11388de [0170.559] PdhCollectQueryData (in: hQuery=0x0 | out: hQuery=0x0) returned 0xc0000bbc [0170.560] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8) returned 0x602e80 [0170.560] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x20) returned 0x6101f0 [0170.560] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x10) returned 0x60e370 [0170.560] GetLocalTime (in: lpSystemTime=0x18f410 | out: lpSystemTime=0x18f410*(wYear=0x7e3, wMonth=0xa, wDayOfWeek=0x1, wDay=0x15, wHour=0x5, wMinute=0x1a, wSecond=0x21, wMilliseconds=0x390)) [0170.560] SystemTimeToVariantTime (in: lpSystemTime=0x18f410, pvtime=0x18f428 | out: pvtime=0x18f428) returned 1 [0170.568] SystemTimeToVariantTime (in: lpSystemTime=0x18f410, pvtime=0x18f3d0 | out: pvtime=0x18f3d0) returned 1 [0170.568] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60e370 | out: hHeap=0x5e0000) returned 1 [0170.568] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6101f0 | out: hHeap=0x5e0000) returned 1 [0170.568] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x602e80 | out: hHeap=0x5e0000) returned 1 [0170.568] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x8, Size=0x38) returned 0x60e518 [0170.568] AreFileApisANSI () returned 1 [0170.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x18f930, cbMultiByte=-1, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 3 [0170.568] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x602e80 [0170.568] MultiByteToWideChar (in: CodePage=0x0, dwFlags=0x9, lpMultiByteStr=0x18f930, cbMultiByte=-1, lpWideCharStr=0x602e80, cchWideChar=3 | out: lpWideCharStr="š\x07") returned 3 [0170.569] CreateFileW (lpFileName="š\x07" (normalized: "c:\\windows\\system32\\š\x07"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x18f20c, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x80, hTemplateFile=0x0) returned 0xffffffff [0170.569] GetLastError () returned 0x7b [0170.569] GetLastError () returned 0x7b [0170.569] CharToOemBuffA (in: lpszSrc="", lpszDst=0x4461f0, cchDstLength=0x0 | out: lpszDst="") returned 1 [0170.569] CallMsgFilterA (lpMsg=0x18f388, nCode=0) returned 0 [0170.569] D2D1CreateFactory () returned 0x0 [0170.570] DWriteCreateFactory () returned 0x0 [0179.048] LoadLibraryA (lpLibFileName="kernel32") returned 0x74d80000 [0179.048] GetClientRect (in: hWnd=0x0, lpRect=0x18f438 | out: lpRect=0x18f438) returned 0 [0179.049] GetProcAddress (hModule=0x74d80000, lpProcName="VirtualAlloc") returned 0x74d91856 [0179.049] VirtualAlloc (lpAddress=0x0, dwSize=0x33000, flAllocationType=0x3000, flProtect=0x40) returned 0xa870000 [0179.051] SetRect (in: lprc=0x18f438, xLeft=0, yTop=0, xRight=0, yBottom=0 | out: lprc=0x18f438) returned 1 [0179.051] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x60e430 [0179.051] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x60e448 [0179.051] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x60e418 [0179.051] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x60e400 [0179.051] GetCursorPos (in: lpPoint=0x18f3c8 | out: lpPoint=0x18f3c8*(x=239, y=462)) returned 1 [0179.051] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName="alerts") returned 0x478 [0179.051] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60e448 | out: hHeap=0x5e0000) returned 1 [0179.051] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60e418 | out: hHeap=0x5e0000) returned 1 [0179.051] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60e400 | out: hHeap=0x5e0000) returned 1 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.051] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0179.052] GetCursorPos (in: lpPoint=0x18f3a8 | out: lpPoint=0x18f3a8*(x=239, y=462)) returned 1 [0179.052] CreateRectRgnIndirect (lprect=0x18f3f0) returned 0xd040724 [0179.052] WaitForSingleObject (hHandle=0x478, dwMilliseconds=0xbb6) returned 0x102 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.072] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] LoadStringA (in: hInstance=0x0, uID=0x36a98e0, lpBuffer=0x18fa38, cchBufferMax=200 | out: lpBuffer="") returned 0x0 [0182.073] GetCursorPos (in: lpPoint=0x18f3a8 | out: lpPoint=0x18f3a8*(x=239, y=462)) returned 1 [0182.073] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.073] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.073] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.073] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.073] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.073] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.073] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.073] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.073] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.073] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.073] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.073] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.074] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.074] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.075] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.075] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.075] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.075] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.075] wsprintfA (in: param_1=0x18fb40, param_2="ID GUID" | out: param_1="ID GUID") returned 7 [0182.075] SetConsoleTitleA (lpConsoleTitle="ID GUID") returned 0 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60e430 | out: hHeap=0x5e0000) returned 1 [0182.075] CreateAcceleratorTableA (paccel=0x18f430, cAccel=4) returned 0x1000bf [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x60e430 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x60e400 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x60e418 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x60e448 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xc) returned 0x60e460 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60e460 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1) returned 0x602e90 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x2) returned 0x602ea0 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x602e90 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x3) returned 0x602e90 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x602ea0 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x4) returned 0x602ea0 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x602e90 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x6) returned 0x602e90 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x602ea0 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x9) returned 0x60e460 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x602e90 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xd) returned 0x60e4a8 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60e460 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x13) returned 0x5f8508 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60e4a8 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1c) returned 0x610308 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f8508 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x2a) returned 0x60df48 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x610308 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x3f) returned 0x5f2a48 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60df48 | out: hHeap=0x5e0000) returned 1 [0182.075] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x5e) returned 0x60f390 [0182.075] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5f2a48 | out: hHeap=0x5e0000) returned 1 [0182.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x8d) returned 0x60f630 [0182.076] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60f390 | out: hHeap=0x5e0000) returned 1 [0182.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xd3) returned 0x60fa68 [0182.076] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60f630 | out: hHeap=0x5e0000) returned 1 [0182.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x13c) returned 0x6138e0 [0182.076] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60fa68 | out: hHeap=0x5e0000) returned 1 [0182.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1da) returned 0x60fa68 [0182.076] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6138e0 | out: hHeap=0x5e0000) returned 1 [0182.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x2c7) returned 0x618ad8 [0182.076] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x60fa68 | out: hHeap=0x5e0000) returned 1 [0182.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x42a) returned 0x618da8 [0182.076] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x618ad8 | out: hHeap=0x5e0000) returned 1 [0182.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x63f) returned 0x6191e0 [0182.076] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x618da8 | out: hHeap=0x5e0000) returned 1 [0182.076] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x95e) returned 0x619828 [0182.076] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x6191e0 | out: hHeap=0x5e0000) returned 1 [0182.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0xe0d) returned 0x61a190 [0182.077] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x619828 | out: hHeap=0x5e0000) returned 1 [0182.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1536) returned 0x618ad8 [0182.077] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x61a190 | out: hHeap=0x5e0000) returned 1 [0182.077] RtlAllocateHeap (HeapHandle=0x5e0000, Flags=0x0, Size=0x1fbf) returned 0x61a018 [0182.077] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x618ad8 | out: hHeap=0x5e0000) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.077] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.078] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.079] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.079] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.079] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.079] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.079] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.079] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.079] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.079] FreeEnvironmentStringsA (penv=0x0) returned 1 [0182.079] SetConsoleCtrlHandler (HandlerRoutine=0x0, Add=1) returned 1 [0182.079] GetLastError () returned 0x715 [0182.080] GetFileVersionInfoW (in: lptstrFilename="", dwHandle=0x7fffffff, dwLen=0x0, lpData=0x445df0 | out: lpData=0x445df0) returned 0 [0182.178] GetModuleHandleA (lpModuleName="ntdll") returned 0x76f30000 [0182.179] GetModuleHandleA (lpModuleName=0x0) returned 0x400000 [0182.625] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18f074, nSize=0x104 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe")) returned 0x66 [0182.625] CreateProcessW (in: lpApplicationName=0x0, lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=0, dwCreationFlags=0x4, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18f01c*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x18f2a0 | out: lpCommandLine="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpProcessInformation=0x18f2a0*(hProcess=0x484, hThread=0x480, dwProcessId=0x5d8, dwThreadId=0x610)) returned 1 [0182.651] GetThreadContext (in: hThread=0x480, lpContext=0x18ed44 | out: lpContext=0x18ed44*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x2dd2380, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40d5db, Ebp=0x0, Eip=0x76f401c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0182.651] LoadLibraryA (lpLibFileName="ntdll") returned 0x76f30000 [0182.652] NtQueryInformationProcess (in: ProcessHandle=0x484, ProcessInformationClass=0x0, ProcessInformation=0x18eaf0, ProcessInformationLength=0x18, ReturnLength=0x0 | out: ProcessInformation=0x18eaf0, ReturnLength=0x0) returned 0x0 [0182.652] ReadProcessMemory (in: hProcess=0x484, lpBaseAddress=0x7efde000, lpBuffer=0x18eb3c, nSize=0x1e8, lpNumberOfBytesRead=0x18ed30 | out: lpBuffer=0x18eb3c*, lpNumberOfBytesRead=0x18ed30*=0x1e8) returned 1 [0182.652] VirtualProtectEx (in: hProcess=0x484, lpAddress=0x400000, dwSize=0x19000, flNewProtect=0x4, lpflOldProtect=0x18ed3c | out: lpflOldProtect=0x18ed3c*=0x2) returned 1 [0182.652] WriteProcessMemory (in: hProcess=0x484, lpBaseAddress=0x400000, lpBuffer=0x618ad8*, nSize=0x19000, lpNumberOfBytesWritten=0x18ed24 | out: lpBuffer=0x618ad8*, lpNumberOfBytesWritten=0x18ed24*=0x19000) returned 1 [0182.655] VirtualProtectEx (in: hProcess=0x484, lpAddress=0x400000, dwSize=0x400, flNewProtect=0x2, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0182.655] VirtualProtectEx (in: hProcess=0x484, lpAddress=0x401000, dwSize=0x9c25, flNewProtect=0x20, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0182.656] VirtualProtectEx (in: hProcess=0x484, lpAddress=0x40b000, dwSize=0x2636, flNewProtect=0x2, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0182.656] VirtualProtectEx (in: hProcess=0x484, lpAddress=0x40e000, dwSize=0xaad5, flNewProtect=0x4, lpflOldProtect=0x18eb30 | out: lpflOldProtect=0x18eb30*=0x4) returned 1 [0182.656] SetThreadContext (hThread=0x480, lpContext=0x18ed44*(ContextFlags=0x1003f, Dr0=0x0, Dr1=0x0, Dr2=0x0, Dr3=0x0, Dr6=0x0, Dr7=0x0, FloatSave.ControlWord=0x27f, FloatSave.StatusWord=0x0, FloatSave.TagWord=0xffff, FloatSave.ErrorOffset=0x0, FloatSave.ErrorSelector=0x0, FloatSave.DataOffset=0x0, FloatSave.DataSelector=0x0, FloatSave.RegisterArea=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x0, [25]=0x0, [26]=0x0, [27]=0x0, [28]=0x0, [29]=0x0, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0), FloatSave.Cr0NpxState=0x2dd2380, SegGs=0x2b, SegFs=0x53, SegEs=0x2b, SegDs=0x2b, Edi=0x0, Esi=0x0, Ebx=0x7efde000, Edx=0x0, Ecx=0x0, Eax=0x40a9d0, Ebp=0x0, Eip=0x76f401c4, SegCs=0x23, EFlags=0x202, Esp=0x18fff0, SegSs=0x2b, ExtendedRegisters=([0]=0x7f, [1]=0x2, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0, [8]=0x0, [9]=0x0, [10]=0x0, [11]=0x0, [12]=0x0, [13]=0x0, [14]=0x0, [15]=0x0, [16]=0x0, [17]=0x0, [18]=0x0, [19]=0x0, [20]=0x0, [21]=0x0, [22]=0x0, [23]=0x0, [24]=0x80, [25]=0x1f, [26]=0x0, [27]=0x0, [28]=0xff, [29]=0xff, [30]=0x0, [31]=0x0, [32]=0x0, [33]=0x0, [34]=0x0, [35]=0x0, [36]=0x0, [37]=0x0, [38]=0x0, [39]=0x0, [40]=0x0, [41]=0x0, [42]=0x0, [43]=0x0, [44]=0x0, [45]=0x0, [46]=0x0, [47]=0x0, [48]=0x0, [49]=0x0, [50]=0x0, [51]=0x0, [52]=0x0, [53]=0x0, [54]=0x0, [55]=0x0, [56]=0x0, [57]=0x0, [58]=0x0, [59]=0x0, [60]=0x0, [61]=0x0, [62]=0x0, [63]=0x0, [64]=0x0, [65]=0x0, [66]=0x0, [67]=0x0, [68]=0x0, [69]=0x0, [70]=0x0, [71]=0x0, [72]=0x0, [73]=0x0, [74]=0x0, [75]=0x0, [76]=0x0, [77]=0x0, [78]=0x0, [79]=0x0, [80]=0x0, [81]=0x0, [82]=0x0, [83]=0x0, [84]=0x0, [85]=0x0, [86]=0x0, [87]=0x0, [88]=0x0, [89]=0x0, [90]=0x0, [91]=0x0, [92]=0x0, [93]=0x0, [94]=0x0, [95]=0x0, [96]=0x0, [97]=0x0, [98]=0x0, [99]=0x0, [100]=0x0, [101]=0x0, [102]=0x0, [103]=0x0, [104]=0x0, [105]=0x0, [106]=0x0, [107]=0x0, [108]=0x0, [109]=0x0, [110]=0x0, [111]=0x0, [112]=0x0, [113]=0x0, [114]=0x0, [115]=0x0, [116]=0x0, [117]=0x0, [118]=0x0, [119]=0x0, [120]=0x0, [121]=0x0, [122]=0x0, [123]=0x0, [124]=0x0, [125]=0x0, [126]=0x0, [127]=0x0, [128]=0x0, [129]=0x0, [130]=0x0, [131]=0x0, [132]=0x0, [133]=0x0, [134]=0x0, [135]=0x0, [136]=0x0, [137]=0x0, [138]=0x0, [139]=0x0, [140]=0x0, [141]=0x0, [142]=0x0, [143]=0x0, [144]=0x0, [145]=0x0, [146]=0x0, [147]=0x0, [148]=0x0, [149]=0x0, [150]=0x0, [151]=0x0, [152]=0x0, [153]=0x0, [154]=0x0, [155]=0x0, [156]=0x0, [157]=0x0, [158]=0x0, [159]=0x0, [160]=0x0, [161]=0x0, [162]=0x0, [163]=0x0, [164]=0x0, [165]=0x0, [166]=0x0, [167]=0x0, [168]=0x0, [169]=0x0, [170]=0x0, [171]=0x0, [172]=0x0, [173]=0x0, [174]=0x0, [175]=0x0, [176]=0x0, [177]=0x0, [178]=0x0, [179]=0x0, [180]=0x0, [181]=0x0, [182]=0x0, [183]=0x0, [184]=0x0, [185]=0x0, [186]=0x0, [187]=0x0, [188]=0x0, [189]=0x0, [190]=0x0, [191]=0x0, [192]=0x0, [193]=0x0, [194]=0x0, [195]=0x0, [196]=0x0, [197]=0x0, [198]=0x0, [199]=0x0, [200]=0x0, [201]=0x0, [202]=0x0, [203]=0x0, [204]=0x0, [205]=0x0, [206]=0x0, [207]=0x0, [208]=0x0, [209]=0x0, [210]=0x0, [211]=0x0, [212]=0x0, [213]=0x0, [214]=0x0, [215]=0x0, [216]=0x0, [217]=0x0, [218]=0x0, [219]=0x0, [220]=0x0, [221]=0x0, [222]=0x0, [223]=0x0, [224]=0x0, [225]=0x0, [226]=0x0, [227]=0x0, [228]=0x0, [229]=0x0, [230]=0x0, [231]=0x0, [232]=0x0, [233]=0x0, [234]=0x0, [235]=0x0, [236]=0x0, [237]=0x0, [238]=0x0, [239]=0x0, [240]=0x0, [241]=0x0, [242]=0x0, [243]=0x0, [244]=0x0, [245]=0x0, [246]=0x0, [247]=0x0, [248]=0x0, [249]=0x0, [250]=0x0, [251]=0x0, [252]=0x0, [253]=0x0, [254]=0x0, [255]=0x0, [256]=0x0, [257]=0x0, [258]=0x0, [259]=0x0, [260]=0x0, [261]=0x0, [262]=0x0, [263]=0x0, [264]=0x0, [265]=0x0, [266]=0x0, [267]=0x0, [268]=0x0, [269]=0x0, [270]=0x0, [271]=0x0, [272]=0x0, [273]=0x0, [274]=0x0, [275]=0x0, [276]=0x0, [277]=0x0, [278]=0x0, [279]=0x0, [280]=0x0, [281]=0x0, [282]=0x0, [283]=0x0, [284]=0x0, [285]=0x0, [286]=0x0, [287]=0x0, [288]=0x0, [289]=0x0, [290]=0x0, [291]=0x0, [292]=0x0, [293]=0x0, [294]=0x0, [295]=0x0, [296]=0x0, [297]=0x0, [298]=0x0, [299]=0x0, [300]=0x0, [301]=0x0, [302]=0x0, [303]=0x0, [304]=0x0, [305]=0x0, [306]=0x0, [307]=0x0, [308]=0x0, [309]=0x0, [310]=0x0, [311]=0x0, [312]=0x0, [313]=0x0, [314]=0x0, [315]=0x0, [316]=0x0, [317]=0x0, [318]=0x0, [319]=0x0, [320]=0x0, [321]=0x0, [322]=0x0, [323]=0x0, [324]=0x0, [325]=0x0, [326]=0x0, [327]=0x0, [328]=0x0, [329]=0x0, [330]=0x0, [331]=0x0, [332]=0x0, [333]=0x0, [334]=0x0, [335]=0x0, [336]=0x0, [337]=0x0, [338]=0x0, [339]=0x0, [340]=0x0, [341]=0x0, [342]=0x0, [343]=0x0, [344]=0x0, [345]=0x0, [346]=0x0, [347]=0x0, [348]=0x0, [349]=0x0, [350]=0x0, [351]=0x0, [352]=0x0, [353]=0x0, [354]=0x0, [355]=0x0, [356]=0x0, [357]=0x0, [358]=0x0, [359]=0x0, [360]=0x0, [361]=0x0, [362]=0x0, [363]=0x0, [364]=0x0, [365]=0x0, [366]=0x0, [367]=0x0, [368]=0x0, [369]=0x0, [370]=0x0, [371]=0x0, [372]=0x0, [373]=0x0, [374]=0x0, [375]=0x0, [376]=0x0, [377]=0x0, [378]=0x0, [379]=0x0, [380]=0x0, [381]=0x0, [382]=0x0, [383]=0x0, [384]=0x0, [385]=0x0, [386]=0x0, [387]=0x0, [388]=0x0, [389]=0x0, [390]=0x0, [391]=0x0, [392]=0x0, [393]=0x0, [394]=0x0, [395]=0x0, [396]=0x0, [397]=0x0, [398]=0x0, [399]=0x0, [400]=0x0, [401]=0x0, [402]=0x0, [403]=0x0, [404]=0x0, [405]=0x0, [406]=0x0, [407]=0x0, [408]=0x0, [409]=0x0, [410]=0x0, [411]=0x0, [412]=0x0, [413]=0x0, [414]=0x0, [415]=0x0, [416]=0x0, [417]=0x0, [418]=0x0, [419]=0x0, [420]=0x0, [421]=0x0, [422]=0x0, [423]=0x0, [424]=0x0, [425]=0x0, [426]=0x0, [427]=0x0, [428]=0x0, [429]=0x0, [430]=0x0, [431]=0x0, [432]=0x0, [433]=0x0, [434]=0x0, [435]=0x0, [436]=0x0, [437]=0x0, [438]=0x0, [439]=0x0, [440]=0x0, [441]=0x0, [442]=0x0, [443]=0x0, [444]=0x0, [445]=0x0, [446]=0x0, [447]=0x0, [448]=0x0, [449]=0x0, [450]=0x0, [451]=0x0, [452]=0x0, [453]=0x0, [454]=0x0, [455]=0x0, [456]=0x0, [457]=0x0, [458]=0x0, [459]=0x0, [460]=0x0, [461]=0x0, [462]=0x0, [463]=0x0, [464]=0x0, [465]=0x0, [466]=0x0, [467]=0x0, [468]=0x0, [469]=0x0, [470]=0x0, [471]=0x0, [472]=0x0, [473]=0x0, [474]=0x0, [475]=0x0, [476]=0x0, [477]=0x0, [478]=0x0, [479]=0x0, [480]=0x0, [481]=0x0, [482]=0x0, [483]=0x0, [484]=0x0, [485]=0x0, [486]=0x0, [487]=0x0, [488]=0x0, [489]=0x0, [490]=0x0, [491]=0x0, [492]=0x0, [493]=0x0, [494]=0x0, [495]=0x0, [496]=0x0, [497]=0x0, [498]=0x0, [499]=0x0, [500]=0x0, [501]=0x0, [502]=0x0, [503]=0x0, [504]=0x0, [505]=0x0, [506]=0x0, [507]=0x0, [508]=0x0, [509]=0x0, [510]=0x0, [511]=0x0))) returned 1 [0182.656] ResumeThread (hThread=0x480) returned 0x1 [0182.724] ExitProcess (uExitCode=0x0) [0182.725] HeapFree (in: hHeap=0x5e0000, dwFlags=0x0, lpMem=0x5faf60 | out: hHeap=0x5e0000) returned 1 Thread: id = 50 os_tid = 0x688 Thread: id = 52 os_tid = 0x4d0 Thread: id = 53 os_tid = 0x508 Process: id = "10" image_name = "1black.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe" page_root = "0x622ec000" os_pid = "0x690" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "8" os_parent_pid = "0x4f8" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e003" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 56 os_tid = 0x678 [0182.748] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74d80000 [0182.764] GetProcAddress (hModule=0x74d80000, lpProcName="GetProcAddress") returned 0x74d91222 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="GetModuleHandleW") returned 0x74d934b0 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="FindNextFileW") returned 0x74d954ee [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="FindClose") returned 0x74d94442 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="MoveFileW") returned 0x74da9af0 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="GetFileSizeEx") returned 0x74d959e2 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="GetModuleFileNameW") returned 0x74d94950 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="GetFileAttributesW") returned 0x74d91b18 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="ExitProcess") returned 0x74d97a10 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="GetCommandLineW") returned 0x74d95223 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="GetComputerNameW") returned 0x74d9dd0e [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="GetComputerNameA") returned 0x74dab6e0 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="CreateMutexW") returned 0x74d9424c [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="lstrlenW") returned 0x74d91700 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="lstrlenA") returned 0x74d95a4b [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="GetCurrentProcess") returned 0x74d91809 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="WaitForSingleObject") returned 0x74d91136 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="GetLogicalDrives") returned 0x74d95371 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="GetTickCount") returned 0x74d9110c [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="DeleteFileW") returned 0x74d989b3 [0182.765] GetProcAddress (hModule=0x74d80000, lpProcName="WideCharToMultiByte") returned 0x74d9170d [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x74d91916 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="Sleep") returned 0x74d910ff [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="LeaveCriticalSection") returned 0x76f52270 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="ReadFile") returned 0x74d93ed3 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="CreateFileW") returned 0x74d93f5c [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="OpenMutexW") returned 0x74d95151 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="EnterCriticalSection") returned 0x76f522b0 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="WaitForMultipleObjects") returned 0x74d94220 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="lstrcmpiW") returned 0x74dad5cd [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="lstrcmpiA") returned 0x74d93e8e [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="DeleteCriticalSection") returned 0x76f645f5 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="ReleaseMutex") returned 0x74d9111e [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="CloseHandle") returned 0x74d91410 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="GetVersion") returned 0x74d94467 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="CreateThread") returned 0x74d934d5 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="ExpandEnvironmentStringsW") returned 0x74d94173 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="QueryPerformanceCounter") returned 0x74d91725 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="QueryPerformanceFrequency") returned 0x74d941f0 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="GetCurrentProcessId") returned 0x74d911f8 [0182.766] GetProcAddress (hModule=0x74d80000, lpProcName="SetFileAttributesW") returned 0x74dad4f7 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="GetVolumeInformationW") returned 0x74dac860 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="WriteFile") returned 0x74d91282 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="SetFilePointerEx") returned 0x74dac807 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="SetEndOfFile") returned 0x74dace2e [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="FindFirstFileW") returned 0x74d94435 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="GetProcessHeap") returned 0x74d914e9 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="HeapReAlloc") returned 0x76f71f6e [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="HeapAlloc") returned 0x76f5e026 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="HeapFree") returned 0x74d914c9 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="CreatePipe") returned 0x74e1415b [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="SetHandleInformation") returned 0x74da195c [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="CreateProcessW") returned 0x74d9103d [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="CompareStringW") returned 0x74d93bca [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="CompareStringA") returned 0x74d93c5a [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="OpenProcess") returned 0x74d91986 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="TerminateProcess") returned 0x74dad802 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="GetSystemTime") returned 0x74d95a96 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="SystemTimeToFileTime") returned 0x74d95a7e [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="GetLastError") returned 0x74d911c0 [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="CreateToolhelp32Snapshot") returned 0x74db735f [0182.767] GetProcAddress (hModule=0x74d80000, lpProcName="Process32NextW") returned 0x74db896c [0182.768] GetProcAddress (hModule=0x74d80000, lpProcName="Process32FirstW") returned 0x74db8baf [0182.768] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x755b0000 [0182.778] GetProcAddress (hModule=0x755b0000, lpProcName="RegOpenKeyExW") returned 0x755c468d [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="RegQueryValueExW") returned 0x755c46ad [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="RegSetValueExW") returned 0x755c14d6 [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="RegCloseKey") returned 0x755c469d [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="OpenProcessToken") returned 0x755c4304 [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="GetTokenInformation") returned 0x755c431c [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="OpenSCManagerW") returned 0x755bca64 [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="OpenServiceW") returned 0x755bca4c [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="CloseServiceHandle") returned 0x755c369c [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="ControlService") returned 0x755d7144 [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="QueryServiceStatus") returned 0x755c2a86 [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="EnumDependentServicesW") returned 0x755b1e3a [0182.779] GetProcAddress (hModule=0x755b0000, lpProcName="EnumServicesStatusExW") returned 0x755bb466 [0182.779] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75650000 [0182.802] GetProcAddress (hModule=0x75650000, lpProcName="SystemParametersInfoW") returned 0x756690d3 [0182.802] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75a10000 [0182.806] GetProcAddress (hModule=0x75a10000, lpProcName="ShellExecuteExW") returned 0x75a31e46 [0182.806] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x76f30000 [0182.806] GetProcAddress (hModule=0x76f30000, lpProcName="NtQuerySystemInformation") returned 0x76f4fda0 [0182.806] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x746c0000 [0182.840] GetProcAddress (hModule=0x746c0000, lpProcName="WNetCloseEnum") returned 0x746c2dd6 [0182.840] GetProcAddress (hModule=0x746c0000, lpProcName="WNetOpenEnumW") returned 0x746c2f06 [0182.840] GetProcAddress (hModule=0x746c0000, lpProcName="WNetEnumResourceW") returned 0x746c3058 [0182.840] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74c10000 [0182.842] GetProcAddress (hModule=0x74c10000, lpProcName="WSAStartup") returned 0x74c13ab2 [0182.842] GetProcAddress (hModule=0x74c10000, lpProcName="socket") returned 0x74c13eb8 [0182.842] GetProcAddress (hModule=0x74c10000, lpProcName="send") returned 0x74c16f01 [0182.843] GetProcAddress (hModule=0x74c10000, lpProcName="recv") returned 0x74c16b0e [0182.843] GetProcAddress (hModule=0x74c10000, lpProcName="connect") returned 0x74c16bdd [0182.843] GetProcAddress (hModule=0x74c10000, lpProcName="closesocket") returned 0x74c13918 [0182.843] GetProcAddress (hModule=0x74c10000, lpProcName="gethostbyname") returned 0x74c27673 [0182.843] GetProcAddress (hModule=0x74c10000, lpProcName="inet_addr") returned 0x74c1311b [0182.843] GetProcAddress (hModule=0x74c10000, lpProcName="ntohl") returned 0x74c12d57 [0182.843] GetProcAddress (hModule=0x74c10000, lpProcName="htonl") returned 0x74c12d57 [0182.843] GetProcAddress (hModule=0x74c10000, lpProcName="htons") returned 0x74c12d8b [0182.843] GetProcessHeap () returned 0x270000 [0182.843] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20) returned 0x284280 [0182.843] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=11382482494) returned 1 [0182.843] GetTickCount () returned 0x113b8e4 [0182.843] GetCurrentProcessId () returned 0x690 [0182.844] GetTickCount () returned 0x113b8e4 [0182.844] GetTickCount () returned 0x113b8e4 [0182.844] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20) returned 0x2842a8 [0182.844] GetVersion () returned 0x1db10106 [0182.844] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x7) returned 0x273868 [0182.844] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x280d88 [0182.844] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x280d88, Size=0x20) returned 0x2842f8 [0182.844] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2842f8, Size=0x40) returned 0x284868 [0182.844] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x284ae0 [0182.844] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3A") returned 0x84 [0182.844] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x273868 | out: hHeap=0x270000) returned 1 [0182.844] lstrlenW (lpString="Global\\syncronize_") returned 18 [0182.844] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284868 | out: hHeap=0x270000) returned 1 [0182.844] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x7) returned 0x273868 [0182.844] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x280d88 [0182.845] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x280d88, Size=0x20) returned 0x2842f8 [0182.845] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2842f8, Size=0x40) returned 0x284868 [0182.845] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x294ae8 [0182.845] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3U") returned 0x88 [0182.845] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x273868 | out: hHeap=0x270000) returned 1 [0182.845] lstrlenW (lpString="Global\\syncronize_") returned 18 [0182.845] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284868 | out: hHeap=0x270000) returned 1 [0182.845] GetVersion () returned 0x1db10106 [0182.845] GetCurrentProcess () returned 0xffffffff [0182.845] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0182.845] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0182.845] CloseHandle (hObject=0x8c) returned 1 [0182.845] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0182.845] ExitProcess (uExitCode=0x0) Process: id = "11" image_name = "1black.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe" page_root = "0x6fdc1000" os_pid = "0x5d8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x500" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e003" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 57 os_tid = 0x610 [0182.680] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x74d80000 [0182.693] GetProcAddress (hModule=0x74d80000, lpProcName="GetProcAddress") returned 0x74d91222 [0182.693] GetProcAddress (hModule=0x74d80000, lpProcName="GetModuleHandleW") returned 0x74d934b0 [0182.693] GetProcAddress (hModule=0x74d80000, lpProcName="FindNextFileW") returned 0x74d954ee [0182.693] GetProcAddress (hModule=0x74d80000, lpProcName="FindClose") returned 0x74d94442 [0182.693] GetProcAddress (hModule=0x74d80000, lpProcName="MoveFileW") returned 0x74da9af0 [0182.693] GetProcAddress (hModule=0x74d80000, lpProcName="GetFileSizeEx") returned 0x74d959e2 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="GetModuleFileNameW") returned 0x74d94950 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="GetFileAttributesW") returned 0x74d91b18 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="ExitProcess") returned 0x74d97a10 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="GetCommandLineW") returned 0x74d95223 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="GetComputerNameW") returned 0x74d9dd0e [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="GetComputerNameA") returned 0x74dab6e0 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="CreateMutexW") returned 0x74d9424c [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="lstrlenW") returned 0x74d91700 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="lstrlenA") returned 0x74d95a4b [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="GetCurrentProcess") returned 0x74d91809 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="WaitForSingleObject") returned 0x74d91136 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="GetLogicalDrives") returned 0x74d95371 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="GetTickCount") returned 0x74d9110c [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="DeleteFileW") returned 0x74d989b3 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="WideCharToMultiByte") returned 0x74d9170d [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x74d91916 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="Sleep") returned 0x74d910ff [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="LeaveCriticalSection") returned 0x76f52270 [0182.694] GetProcAddress (hModule=0x74d80000, lpProcName="ReadFile") returned 0x74d93ed3 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="CreateFileW") returned 0x74d93f5c [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="OpenMutexW") returned 0x74d95151 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="EnterCriticalSection") returned 0x76f522b0 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="WaitForMultipleObjects") returned 0x74d94220 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="lstrcmpiW") returned 0x74dad5cd [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="lstrcmpiA") returned 0x74d93e8e [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="DeleteCriticalSection") returned 0x76f645f5 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="ReleaseMutex") returned 0x74d9111e [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="CloseHandle") returned 0x74d91410 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="GetVersion") returned 0x74d94467 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="CreateThread") returned 0x74d934d5 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="ExpandEnvironmentStringsW") returned 0x74d94173 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="QueryPerformanceCounter") returned 0x74d91725 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="QueryPerformanceFrequency") returned 0x74d941f0 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="GetCurrentProcessId") returned 0x74d911f8 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="SetFileAttributesW") returned 0x74dad4f7 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="GetVolumeInformationW") returned 0x74dac860 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="WriteFile") returned 0x74d91282 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="SetFilePointerEx") returned 0x74dac807 [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="SetEndOfFile") returned 0x74dace2e [0182.695] GetProcAddress (hModule=0x74d80000, lpProcName="FindFirstFileW") returned 0x74d94435 [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="GetProcessHeap") returned 0x74d914e9 [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="HeapReAlloc") returned 0x76f71f6e [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="HeapAlloc") returned 0x76f5e026 [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="HeapFree") returned 0x74d914c9 [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="CreatePipe") returned 0x74e1415b [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="SetHandleInformation") returned 0x74da195c [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="CreateProcessW") returned 0x74d9103d [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="CompareStringW") returned 0x74d93bca [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="CompareStringA") returned 0x74d93c5a [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="OpenProcess") returned 0x74d91986 [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="TerminateProcess") returned 0x74dad802 [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="GetSystemTime") returned 0x74d95a96 [0182.696] GetProcAddress (hModule=0x74d80000, lpProcName="SystemTimeToFileTime") returned 0x74d95a7e [0182.697] GetProcAddress (hModule=0x74d80000, lpProcName="GetLastError") returned 0x74d911c0 [0182.697] GetProcAddress (hModule=0x74d80000, lpProcName="CreateToolhelp32Snapshot") returned 0x74db735f [0182.697] GetProcAddress (hModule=0x74d80000, lpProcName="Process32NextW") returned 0x74db896c [0182.697] GetProcAddress (hModule=0x74d80000, lpProcName="Process32FirstW") returned 0x74db8baf [0182.697] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x755b0000 [0182.709] GetProcAddress (hModule=0x755b0000, lpProcName="RegOpenKeyExW") returned 0x755c468d [0182.709] GetProcAddress (hModule=0x755b0000, lpProcName="RegQueryValueExW") returned 0x755c46ad [0182.709] GetProcAddress (hModule=0x755b0000, lpProcName="RegSetValueExW") returned 0x755c14d6 [0182.710] GetProcAddress (hModule=0x755b0000, lpProcName="RegCloseKey") returned 0x755c469d [0182.710] GetProcAddress (hModule=0x755b0000, lpProcName="OpenProcessToken") returned 0x755c4304 [0182.710] GetProcAddress (hModule=0x755b0000, lpProcName="GetTokenInformation") returned 0x755c431c [0182.710] GetProcAddress (hModule=0x755b0000, lpProcName="OpenSCManagerW") returned 0x755bca64 [0182.710] GetProcAddress (hModule=0x755b0000, lpProcName="OpenServiceW") returned 0x755bca4c [0182.710] GetProcAddress (hModule=0x755b0000, lpProcName="CloseServiceHandle") returned 0x755c369c [0182.710] GetProcAddress (hModule=0x755b0000, lpProcName="ControlService") returned 0x755d7144 [0182.710] GetProcAddress (hModule=0x755b0000, lpProcName="QueryServiceStatus") returned 0x755c2a86 [0182.710] GetProcAddress (hModule=0x755b0000, lpProcName="EnumDependentServicesW") returned 0x755b1e3a [0182.710] GetProcAddress (hModule=0x755b0000, lpProcName="EnumServicesStatusExW") returned 0x755bb466 [0182.710] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75650000 [0182.795] GetProcAddress (hModule=0x75650000, lpProcName="SystemParametersInfoW") returned 0x756690d3 [0182.795] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x75a10000 [0182.799] GetProcAddress (hModule=0x75a10000, lpProcName="ShellExecuteExW") returned 0x75a31e46 [0182.799] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x76f30000 [0182.800] GetProcAddress (hModule=0x76f30000, lpProcName="NtQuerySystemInformation") returned 0x76f4fda0 [0182.800] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x746c0000 [0182.821] GetProcAddress (hModule=0x746c0000, lpProcName="WNetCloseEnum") returned 0x746c2dd6 [0182.821] GetProcAddress (hModule=0x746c0000, lpProcName="WNetOpenEnumW") returned 0x746c2f06 [0182.821] GetProcAddress (hModule=0x746c0000, lpProcName="WNetEnumResourceW") returned 0x746c3058 [0182.821] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x74c10000 [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="WSAStartup") returned 0x74c13ab2 [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="socket") returned 0x74c13eb8 [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="send") returned 0x74c16f01 [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="recv") returned 0x74c16b0e [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="connect") returned 0x74c16bdd [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="closesocket") returned 0x74c13918 [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="gethostbyname") returned 0x74c27673 [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="inet_addr") returned 0x74c1311b [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="ntohl") returned 0x74c12d57 [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="htonl") returned 0x74c12d57 [0182.824] GetProcAddress (hModule=0x74c10000, lpProcName="htons") returned 0x74c12d8b [0182.824] GetProcessHeap () returned 0x270000 [0182.824] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20) returned 0x2843d8 [0182.825] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=11380620139) returned 1 [0182.825] GetTickCount () returned 0x113b8d4 [0182.825] GetCurrentProcessId () returned 0x5d8 [0182.825] GetTickCount () returned 0x113b8d4 [0182.825] GetTickCount () returned 0x113b8d4 [0182.825] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x20) returned 0x284400 [0182.825] GetVersion () returned 0x1db10106 [0182.825] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x7) returned 0x2739c0 [0182.825] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x280ee0 [0182.825] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x280ee0, Size=0x20) returned 0x284450 [0182.825] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284450, Size=0x40) returned 0x2849c0 [0182.825] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x284c70 [0182.826] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3A") returned 0x0 [0182.826] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_261OR3A") returned 0x84 [0182.826] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2739c0 | out: hHeap=0x270000) returned 1 [0182.826] lstrlenW (lpString="Global\\syncronize_") returned 18 [0182.826] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2849c0 | out: hHeap=0x270000) returned 1 [0182.826] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x7) returned 0x2739c0 [0182.826] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x280ee0 [0182.826] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x280ee0, Size=0x20) returned 0x284450 [0182.826] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284450, Size=0x40) returned 0x2849c0 [0182.826] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x294c78 [0182.826] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_261OR3U") returned 0x0 [0182.826] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_261OR3U") returned 0x88 [0182.826] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2739c0 | out: hHeap=0x270000) returned 1 [0182.826] lstrlenW (lpString="Global\\syncronize_") returned 18 [0182.827] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2849c0 | out: hHeap=0x270000) returned 1 [0182.827] GetVersion () returned 0x1db10106 [0182.827] GetCurrentProcess () returned 0xffffffff [0182.827] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0182.827] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0182.827] CloseHandle (hObject=0x8c) returned 1 [0182.827] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x14) returned 0x2739c0 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x280ee0 [0182.827] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x280ee0, Size=0x20) returned 0x284450 [0182.827] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284450, Size=0x40) returned 0x2849c0 [0182.827] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2849c0, Size=0x80) returned 0x2849c0 [0182.827] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2849c0, Size=0x100) returned 0x2849c0 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x34) returned 0x284ac8 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x280ad0 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x280ae0 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x280af0 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x280ee0 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x284b08 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x280ef8 [0182.827] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b08, Size=0x8) returned 0x284b08 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x280f10 [0182.827] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b08, Size=0x10) returned 0x284b08 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x280f28 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x280f40 [0182.827] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b08, Size=0x20) returned 0x284b08 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x280f58 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x280f70 [0182.827] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x280ad0, Size=0x8) returned 0x280ad0 [0182.827] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x280ae0, Size=0x8) returned 0x280ae0 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x284b30 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x280f88 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x284b40 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x280fa0 [0182.827] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b40, Size=0x8) returned 0x284b40 [0182.827] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4c98 [0182.828] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b40, Size=0x10) returned 0x284b40 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4cb0 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x284b58 [0182.828] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b40, Size=0x20) returned 0x284b68 [0182.828] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x280ad0, Size=0x10) returned 0x284b40 [0182.828] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x280ae0, Size=0x10) returned 0x284b90 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x280ad0 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a4cc8 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x280ae0 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4ce0 [0182.828] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x280ae0, Size=0x8) returned 0x280ae0 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x284ba8 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a4cf8 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x284bb8 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4d10 [0182.828] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284bb8, Size=0x8) returned 0x284bb8 [0182.828] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b40, Size=0x20) returned 0x284bc8 [0182.828] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b90, Size=0x20) returned 0x284bf0 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x284b90 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a4d28 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x284c18 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4d40 [0182.828] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284c18, Size=0x8) returned 0x284c18 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x14) returned 0x2a5080 [0182.828] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x14) returned 0x2a50a0 [0182.828] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0182.828] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2849c0 | out: hHeap=0x270000) returned 1 [0182.828] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0182.836] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d58 [0182.836] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d58, Size=0x20) returned 0x284658 [0182.836] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284658, Size=0x40) returned 0x284a18 [0182.836] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284a18, Size=0x80) returned 0x284a18 [0182.836] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284a18, Size=0x100) returned 0x2a5378 [0182.836] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d58 [0182.836] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d58, Size=0x20) returned 0x284658 [0182.836] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284658, Size=0x40) returned 0x284a18 [0182.836] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284a18, Size=0x80) returned 0x284a18 [0182.836] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284a18, Size=0x100) returned 0x2a5480 [0182.836] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a4d58 [0182.836] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x284b40 [0182.836] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.837] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b40, Size=0x8) returned 0x284b40 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x14) returned 0x284a18 [0182.837] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b40, Size=0x10) returned 0x284b40 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x18) returned 0x284a38 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1a) returned 0x284658 [0182.837] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b40, Size=0x20) returned 0x284a58 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1c) returned 0x284680 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x16) returned 0x284a80 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1a) returned 0x2846a8 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a4d88 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x284b40 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40) returned 0x2a5588 [0182.837] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b40, Size=0x8) returned 0x284b40 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x3c) returned 0x2a55d0 [0182.837] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b40, Size=0x10) returned 0x284b40 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x14) returned 0x284aa0 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x18) returned 0x2a5618 [0182.837] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284b40, Size=0x20) returned 0x2a5638 [0182.837] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x24) returned 0x2a5660 [0182.837] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0182.837] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5378 | out: hHeap=0x270000) returned 1 [0182.837] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0182.837] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5480 | out: hHeap=0x270000) returned 1 [0182.837] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2a5be0 [0182.858] EnumServicesStatusExW (in: hSCManager=0x2a5be0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0182.858] GetLastError () returned 0xea [0182.858] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x11ee) returned 0x2a94e0 [0182.858] EnumServicesStatusExW (in: hSCManager=0x2a5be0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2a94e0, cbBufSize=0x11ee, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x2a94e0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0182.859] CloseServiceHandle (hSCObject=0x2a5be0) returned 1 [0182.964] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0182.964] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.964] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0182.964] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0182.964] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0182.964] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0182.964] lstrlenW (lpString="AudioSrv") returned 8 [0182.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0182.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0182.965] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0182.965] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0182.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0182.965] lstrlenW (lpString="BFE") returned 3 [0182.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0182.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0182.965] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0182.965] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0182.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0182.965] lstrlenW (lpString="CryptSvc") returned 8 [0182.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0182.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0182.965] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0182.965] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0182.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0182.965] lstrlenW (lpString="CscService") returned 10 [0182.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0182.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0182.965] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0182.965] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0182.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0182.965] lstrlenW (lpString="DcomLaunch") returned 10 [0182.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0182.965] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0182.965] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0182.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0182.965] lstrlenW (lpString="Dhcp") returned 4 [0182.965] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0182.965] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0182.965] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0182.965] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0182.965] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0182.965] lstrlenW (lpString="Dnscache") returned 8 [0182.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0182.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0182.966] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0182.966] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0182.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0182.966] lstrlenW (lpString="DPS") returned 3 [0182.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0182.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0182.966] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0182.966] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0182.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0182.966] lstrlenW (lpString="eventlog") returned 8 [0182.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0182.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0182.966] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0182.966] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0182.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0182.966] lstrlenW (lpString="EventSystem") returned 11 [0182.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0182.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0182.966] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0182.966] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0182.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0182.966] lstrlenW (lpString="FontCache") returned 9 [0182.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0182.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0182.966] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0182.966] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0182.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0182.966] lstrlenW (lpString="gpsvc") returned 5 [0182.966] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0182.966] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0182.966] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0182.966] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0182.966] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0182.966] lstrlenW (lpString="iphlpsvc") returned 8 [0182.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0182.967] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0182.967] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0182.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0182.967] lstrlenW (lpString="LanmanServer") returned 12 [0182.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0182.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0182.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0182.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0182.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0182.967] lstrlenW (lpString="LanmanWorkstation") returned 17 [0182.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0182.967] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0182.967] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0182.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0182.967] lstrlenW (lpString="lmhosts") returned 7 [0182.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0182.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0182.967] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0182.967] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0182.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0182.967] lstrlenW (lpString="MMCSS") returned 5 [0182.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0182.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0182.967] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0182.967] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0182.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0182.967] lstrlenW (lpString="MpsSvc") returned 6 [0182.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0182.967] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0182.967] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0182.967] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0182.967] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0182.967] lstrlenW (lpString="Netman") returned 6 [0182.967] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0182.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0182.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0182.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0182.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0182.968] lstrlenW (lpString="netprofm") returned 8 [0182.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0182.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0182.968] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0182.968] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0182.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0182.968] lstrlenW (lpString="NlaSvc") returned 6 [0182.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0182.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0182.968] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0182.968] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0182.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0182.968] lstrlenW (lpString="nsi") returned 3 [0182.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0182.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0182.968] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0182.968] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0182.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0182.968] lstrlenW (lpString="PcaSvc") returned 6 [0182.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0182.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0182.968] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0182.968] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0182.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0182.968] lstrlenW (lpString="PlugPlay") returned 8 [0182.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0182.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0182.968] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0182.968] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0182.968] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0182.968] lstrlenW (lpString="Power") returned 5 [0182.968] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0182.968] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0182.968] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0182.968] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0182.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0182.969] lstrlenW (lpString="ProfSvc") returned 7 [0182.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0182.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0182.969] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0182.969] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0182.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0182.969] lstrlenW (lpString="RpcEptMapper") returned 12 [0182.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0182.969] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0182.969] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0182.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0182.969] lstrlenW (lpString="RpcSs") returned 5 [0182.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0182.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0182.969] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0182.969] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0182.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0182.969] lstrlenW (lpString="SamSs") returned 5 [0182.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0182.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0182.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0182.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0182.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0182.969] lstrlenW (lpString="Schedule") returned 8 [0182.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0182.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0182.969] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0182.969] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0182.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0182.969] lstrlenW (lpString="SENS") returned 4 [0182.969] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0182.969] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0182.969] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0182.969] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0182.969] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0182.970] lstrlenW (lpString="ShellHWDetection") returned 16 [0182.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0182.970] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0182.970] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0182.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0182.970] lstrlenW (lpString="Spooler") returned 7 [0182.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0182.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0182.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0182.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0182.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0182.970] lstrlenW (lpString="SysMain") returned 7 [0182.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0182.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0182.970] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0182.970] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0182.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0182.970] lstrlenW (lpString="Themes") returned 6 [0182.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0182.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0182.970] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0182.970] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0182.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0182.970] lstrlenW (lpString="TrkWks") returned 6 [0182.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0182.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0182.970] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0182.970] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0182.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0182.970] lstrlenW (lpString="UxSms") returned 5 [0182.970] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0182.970] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0182.970] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0182.970] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0182.970] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0182.970] lstrlenW (lpString="WdiServiceHost") returned 14 [0182.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0182.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0182.971] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0182.971] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0182.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0182.971] lstrlenW (lpString="WdiSystemHost") returned 13 [0182.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0182.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0182.971] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0182.971] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0182.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0182.971] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0182.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0182.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0182.971] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0182.971] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0182.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0182.971] lstrlenW (lpString="Winmgmt") returned 7 [0182.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0182.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0182.971] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0182.971] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0182.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0182.971] lstrlenW (lpString="WPDBusEnum") returned 10 [0182.971] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0182.971] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0182.971] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0182.971] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0182.971] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0182.971] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a94e0 | out: hHeap=0x270000) returned 1 [0182.971] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0182.973] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0182.973] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0182.974] lstrlenW (lpString="System") returned 6 [0182.974] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0182.974] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0182.974] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0182.974] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0182.974] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0182.974] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0182.974] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0182.974] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0182.974] lstrlenW (lpString="smss.exe") returned 8 [0182.974] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0182.974] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0182.974] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0182.974] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0182.974] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0182.974] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0182.974] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0182.974] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.975] lstrlenW (lpString="csrss.exe") returned 9 [0182.975] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0182.975] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0182.975] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0182.975] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0182.975] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0182.975] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0182.975] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0182.975] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0182.975] lstrlenW (lpString="wininit.exe") returned 11 [0182.975] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0182.975] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0182.975] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0182.975] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0182.975] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0182.975] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0182.975] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0182.975] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0182.976] lstrlenW (lpString="csrss.exe") returned 9 [0182.976] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0182.976] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0182.976] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0182.976] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0182.976] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0182.976] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0182.976] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0182.976] lstrlenW (lpString="winlogon.exe") returned 12 [0182.976] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0182.976] lstrlenW (lpString="services.exe") returned 12 [0182.976] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0182.979] lstrlenW (lpString="lsass.exe") returned 9 [0182.979] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0182.979] lstrlenW (lpString="lsm.exe") returned 7 [0182.979] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.980] lstrlenW (lpString="svchost.exe") returned 11 [0182.980] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.980] lstrlenW (lpString="svchost.exe") returned 11 [0182.980] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.980] lstrlenW (lpString="svchost.exe") returned 11 [0182.980] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.981] lstrlenW (lpString="svchost.exe") returned 11 [0182.981] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.981] lstrlenW (lpString="svchost.exe") returned 11 [0182.981] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0182.981] lstrlenW (lpString="audiodg.exe") returned 11 [0182.981] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.981] lstrlenW (lpString="svchost.exe") returned 11 [0182.981] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0182.982] lstrlenW (lpString="explorer.exe") returned 12 [0182.982] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0182.982] lstrlenW (lpString="dwm.exe") returned 7 [0182.982] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.982] lstrlenW (lpString="svchost.exe") returned 11 [0182.982] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0182.983] lstrlenW (lpString="spoolsv.exe") returned 11 [0182.983] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0182.983] lstrlenW (lpString="reader_sl.exe") returned 13 [0182.983] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.983] lstrlenW (lpString="svchost.exe") returned 11 [0182.983] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0182.984] lstrlenW (lpString="taskhost.exe") returned 12 [0182.984] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0182.984] lstrlenW (lpString="svchost.exe") returned 11 [0182.984] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0182.984] lstrlenW (lpString="rundll32.exe") returned 12 [0182.984] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0182.984] lstrlenW (lpString="dinotify.exe") returned 12 [0182.985] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0182.985] lstrlenW (lpString="1Black.exe") returned 10 [0182.985] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0182.985] CloseHandle (hObject=0xe0) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5588 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a55d0 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284aa0 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5618 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5660 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a4d70 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284a18 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284a38 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284658 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284680 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284a80 | out: hHeap=0x270000) returned 1 [0182.985] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2846a8 | out: hHeap=0x270000) returned 1 [0182.985] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2ab730 [0182.986] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2bb738 [0182.986] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.986] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2846a8 [0182.986] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2846a8, Size=0x40) returned 0x2a6ca8 [0182.986] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.986] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2846a8 [0182.986] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.986] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x284680 [0182.986] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.986] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x284658 [0182.986] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284658, Size=0x40) returned 0x2a6cf0 [0182.986] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2bb738, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe")) returned 0x66 [0182.986] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2cb740 [0182.987] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2db748 [0182.987] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.987] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x284658 [0182.987] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284658, Size=0x40) returned 0x2a6d38 [0182.987] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6d38, Size=0x80) returned 0x2a5588 [0182.987] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5588, Size=0x100) returned 0x2a7eb0 [0182.987] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0182.987] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a7eb0 | out: hHeap=0x270000) returned 1 [0182.987] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\1Black.exe", lpDst=0x2cb740, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\1Black.exe") returned 0x1f [0182.987] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2db748 | out: hHeap=0x270000) returned 1 [0182.987] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2cb740 | out: hHeap=0x270000) returned 1 [0182.987] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x2060020 [0182.987] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.987] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x284658 [0182.987] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.987] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2a5c30 [0182.988] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0182.988] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0182.988] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0182.988] lstrlenW (lpString="kernel32.dll") returned 12 [0182.988] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284658 | out: hHeap=0x270000) returned 1 [0182.988] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.988] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5c30 | out: hHeap=0x270000) returned 1 [0182.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0182.988] CreateFileW (lpFileName="C:\\Windows\\System32\\1Black.exe" (normalized: "c:\\windows\\system32\\1black.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0182.989] CloseHandle (hObject=0xe0) returned 1 [0182.989] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.989] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2a5c30 [0182.989] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.989] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2a5be0 [0182.990] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0182.990] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0182.990] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0182.990] lstrlenW (lpString="kernel32.dll") returned 12 [0182.990] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5be0 | out: hHeap=0x270000) returned 1 [0182.990] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.990] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5c30 | out: hHeap=0x270000) returned 1 [0182.990] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2060020 | out: hHeap=0x270000) returned 1 [0182.990] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2cb740 [0182.990] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2db748 [0182.990] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.990] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2a5c30 [0182.990] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5c30, Size=0x40) returned 0x2a6d38 [0182.990] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6d38, Size=0x80) returned 0x2eb768 [0182.990] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb768, Size=0x100) returned 0x2a7eb0 [0182.990] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0182.990] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a7eb0 | out: hHeap=0x270000) returned 1 [0182.990] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\1Black.exe", lpDst=0x2cb740, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Black.exe") returned 0x39 [0182.990] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2db748 | out: hHeap=0x270000) returned 1 [0182.990] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2cb740 | out: hHeap=0x270000) returned 1 [0182.990] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x2060020 [0182.990] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.990] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2a5c30 [0182.990] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0182.991] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2a5be0 [0182.991] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0182.991] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0182.991] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0182.991] lstrlenW (lpString="kernel32.dll") returned 12 [0182.991] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5c30 | out: hHeap=0x270000) returned 1 [0182.991] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0182.991] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5be0 | out: hHeap=0x270000) returned 1 [0182.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0182.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\1black.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0182.995] ReadFile (in: hFile=0xe0, lpBuffer=0x2060020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2060020*, lpNumberOfBytesRead=0x18fd98*=0x81000, lpOverlapped=0x0) returned 1 [0183.005] WriteFile (in: hFile=0xe4, lpBuffer=0x2060020*, nNumberOfBytesToWrite=0x81000, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2060020*, lpNumberOfBytesWritten=0x18fd98*=0x81000, lpOverlapped=0x0) returned 1 [0183.015] ReadFile (in: hFile=0xe0, lpBuffer=0x2060020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x2060020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0183.015] CloseHandle (hObject=0xe4) returned 1 [0183.015] CloseHandle (hObject=0xe0) returned 1 [0183.015] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0183.015] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2a5be0 [0183.015] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0183.015] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2a5c30 [0183.015] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.015] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.016] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0183.016] lstrlenW (lpString="kernel32.dll") returned 12 [0183.016] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5c30 | out: hHeap=0x270000) returned 1 [0183.016] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.016] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5be0 | out: hHeap=0x270000) returned 1 [0183.016] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2060020 | out: hHeap=0x270000) returned 1 [0183.020] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4d70 [0183.020] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4d70, Size=0x20) returned 0x2a5be0 [0183.020] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5be0, Size=0x40) returned 0x2a6d38 [0183.020] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6d38, Size=0x80) returned 0x2eb768 [0183.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Black.exe") returned 56 [0183.020] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0183.020] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x5c) returned 0x2a5588 [0183.020] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0x0) returned 0x5 [0183.021] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5588 | out: hHeap=0x270000) returned 1 [0183.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Black.exe") returned 56 [0183.021] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0183.021] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x5c) returned 0x2a5588 [0183.021] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0 [0183.021] RegSetValueExW (in: hKey=0xe4, lpValueName="1Black.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Black.exe", cbData=0x70 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\1Black.exe") returned 0x0 [0183.021] RegCloseKey (hKey=0xe4) returned 0x0 [0183.021] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5588 | out: hHeap=0x270000) returned 1 [0183.022] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0183.022] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eb768 | out: hHeap=0x270000) returned 1 [0183.022] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2cb740 [0183.022] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2db748 [0183.022] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.022] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2a5be0 [0183.022] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5be0, Size=0x40) returned 0x2a6d38 [0183.022] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6d38, Size=0x80) returned 0x2eb768 [0183.022] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb768, Size=0x100) returned 0x2a7eb0 [0183.022] lstrlenW (lpString="") returned 0 [0183.022] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0183.022] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8c) returned 0x2a5588 [0183.022] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0183.022] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x2db748, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x2db748*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0183.022] RegCloseKey (hKey=0xe4) returned 0x0 [0183.022] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5588 | out: hHeap=0x270000) returned 1 [0183.022] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0183.022] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8c) returned 0x2a5588 [0183.022] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0183.022] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x2db748, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0183.022] RegCloseKey (hKey=0xe4) returned 0x0 [0183.022] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5588 | out: hHeap=0x270000) returned 1 [0183.022] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0183.022] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0183.022] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a7eb0 | out: hHeap=0x270000) returned 1 [0183.022] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpDst=0x2cb740, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe") returned 0x67 [0183.022] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2db748 | out: hHeap=0x270000) returned 1 [0183.022] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2cb740 | out: hHeap=0x270000) returned 1 [0183.023] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x2060020 [0183.023] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.023] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2a5be0 [0183.023] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.023] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2a5c30 [0183.023] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.023] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.023] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0183.023] lstrlenW (lpString="kernel32.dll") returned 12 [0183.023] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5be0 | out: hHeap=0x270000) returned 1 [0183.023] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.023] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5c30 | out: hHeap=0x270000) returned 1 [0183.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0183.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.024] CloseHandle (hObject=0xe4) returned 1 [0183.024] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.024] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2a5c30 [0183.024] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.024] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2a5be0 [0183.024] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.024] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.024] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0183.024] lstrlenW (lpString="kernel32.dll") returned 12 [0183.024] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5be0 | out: hHeap=0x270000) returned 1 [0183.024] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.024] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5c30 | out: hHeap=0x270000) returned 1 [0183.024] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2060020 | out: hHeap=0x270000) returned 1 [0183.024] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2cb740 [0183.024] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2db748 [0183.024] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.025] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2a5c30 [0183.025] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5c30, Size=0x40) returned 0x2a6d38 [0183.025] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6d38, Size=0x80) returned 0x2eb768 [0183.025] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb768, Size=0x100) returned 0x2a7eb0 [0183.025] lstrlenW (lpString="") returned 0 [0183.025] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0183.025] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8c) returned 0x2a5588 [0183.025] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0183.025] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x2db748, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0183.025] RegCloseKey (hKey=0xe4) returned 0x0 [0183.025] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5588 | out: hHeap=0x270000) returned 1 [0183.025] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0183.025] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0183.025] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a7eb0 | out: hHeap=0x270000) returned 1 [0183.025] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpDst=0x2cb740, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe") returned 0x48 [0183.025] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2db748 | out: hHeap=0x270000) returned 1 [0183.025] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2cb740 | out: hHeap=0x270000) returned 1 [0183.025] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x2060020 [0183.025] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.025] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2a5c30 [0183.025] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.025] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2a5be0 [0183.025] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.025] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.025] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0183.026] lstrlenW (lpString="kernel32.dll") returned 12 [0183.026] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5c30 | out: hHeap=0x270000) returned 1 [0183.026] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.026] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5be0 | out: hHeap=0x270000) returned 1 [0183.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0183.026] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.026] CloseHandle (hObject=0xe4) returned 1 [0183.026] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.026] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2a5be0 [0183.026] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.026] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2a5c30 [0183.026] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.026] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.026] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0183.026] lstrlenW (lpString="kernel32.dll") returned 12 [0183.026] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5c30 | out: hHeap=0x270000) returned 1 [0183.027] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5be0 | out: hHeap=0x270000) returned 1 [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2060020 | out: hHeap=0x270000) returned 1 [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2ab730 | out: hHeap=0x270000) returned 1 [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2bb738 | out: hHeap=0x270000) returned 1 [0183.027] lstrlenW (lpString="%windir%\\System32") returned 17 [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a6ca8 | out: hHeap=0x270000) returned 1 [0183.027] lstrlenW (lpString="%appdata%") returned 9 [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2846a8 | out: hHeap=0x270000) returned 1 [0183.027] lstrlenW (lpString="%sh(Startup)%") returned 13 [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284680 | out: hHeap=0x270000) returned 1 [0183.027] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a6cf0 | out: hHeap=0x270000) returned 1 [0183.027] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.027] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x284680 [0183.027] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284680, Size=0x40) returned 0x2a6cf0 [0183.027] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6cf0, Size=0x80) returned 0x2eb768 [0183.027] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.027] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x284680 [0183.027] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1fffc) returned 0x2ab730 [0183.027] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2cb738 [0183.027] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2db740 [0183.027] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4da0 [0183.027] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4da0, Size=0x20) returned 0x2846a8 [0183.027] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2846a8, Size=0x40) returned 0x2a6cf0 [0183.027] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6cf0, Size=0x80) returned 0x2eb7f0 [0183.027] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb7f0, Size=0x100) returned 0x2a7eb0 [0183.027] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a7eb0 | out: hHeap=0x270000) returned 1 [0183.027] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x2cb738, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2db740 | out: hHeap=0x270000) returned 1 [0183.027] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2cb738 | out: hHeap=0x270000) returned 1 [0183.027] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0183.028] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0183.028] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0183.028] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0183.028] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x5d4, dwThreadId=0x5ec)) returned 1 [0183.042] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0183.042] WriteFile (in: hFile=0xec, lpBuffer=0x2eb768*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x2eb768*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0183.042] CloseHandle (hObject=0xfc) returned 1 [0183.042] CloseHandle (hObject=0xf8) returned 1 [0183.042] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2ab730 | out: hHeap=0x270000) returned 1 [0183.042] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0183.042] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eb768 | out: hHeap=0x270000) returned 1 [0183.042] lstrlenW (lpString="%comspec%") returned 9 [0183.042] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284680 | out: hHeap=0x270000) returned 1 [0183.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0183.042] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a4da0 [0183.042] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x2a4da0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0183.043] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a7dd0 [0183.043] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x2a7dd0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4db8 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4db8, Size=0x20) returned 0x284680 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284680, Size=0x40) returned 0x2a6cf0 [0183.044] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xd0) returned 0x2a7f28 [0183.044] GetLogicalDrives () returned 0x4 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10014) returned 0x2ab730 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4db8 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a4db8, Size=0x20) returned 0x284680 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284680, Size=0x40) returned 0x2a6d80 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6d80, Size=0x80) returned 0x2eb768 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb768, Size=0x100) returned 0x2a9498 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9498, Size=0x200) returned 0x2a9498 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9498, Size=0x400) returned 0x2a9498 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9498, Size=0x800) returned 0x2a9ab0 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9ab0, Size=0x1000) returned 0x2ed750 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x2bb750 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a4db8 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a4e90 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x2a55f8 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a4ea8 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x2a5608 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4ec0 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5608, Size=0x8) returned 0x2a5608 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4ed8 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5608, Size=0x10) returned 0x2a5608 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4ef0 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4f08 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5608, Size=0x20) returned 0x2a5608 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4f20 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a94b0 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2a4f38 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2a4f50 [0183.044] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5608, Size=0x40) returned 0x284a80 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2a4f68 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2a4f80 [0183.044] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2a4f98 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2a4fb0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4fc8 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4fe0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a94c0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a4ff8 [0183.045] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284a80, Size=0x80) returned 0x2a9ab0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a5010 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a5028 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a5040 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a5058 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9b50 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a9b68 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9b80 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a94d0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9b98 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9bb0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a9bc8 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9be0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a9bf8 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9c10 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a9c28 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9c40 [0183.045] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9ab0, Size=0x100) returned 0x2a9f38 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9c58 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9c70 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9c88 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a9ca0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9cb8 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9cd0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a94e0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9ce8 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9d00 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9d18 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6) returned 0x2a94f0 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9d30 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9d48 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a9500 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9d60 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9d78 [0183.045] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2a9d90 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9da8 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9dc0 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9dd8 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2a9df0 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9e08 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2a9e20 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9e38 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9e50 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9e68 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9e80 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a9510 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9e98 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9eb0 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9ec8 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9ee0 [0183.046] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9f38, Size=0x200) returned 0x2a9f38 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9ef8 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a9520 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2a9f10 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa158 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa170 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa188 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa1a0 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa1b8 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa1d0 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa1e8 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa200 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2aa218 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2aa230 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa248 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa260 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2aa278 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2aa290 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa2a8 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2aa2c0 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2aa2d8 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa2f0 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa308 [0183.046] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa320 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a9530 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa338 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa350 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa368 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a9540 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa380 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2aa398 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa3b0 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa3c8 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa3e0 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa3f8 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa410 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa428 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2aa440 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2aa458 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa470 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa488 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa4a0 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2aa4b8 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa4d0 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa4e8 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa500 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2aa518 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee770 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee788 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee7a0 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a9550 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6) returned 0x2a9560 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee7b8 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee7d0 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee7e8 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee800 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee818 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ee830 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee848 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee860 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee878 [0183.047] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee890 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ee8a8 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee8c0 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee8d8 [0183.048] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9f38, Size=0x400) returned 0x2eeb58 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee8f0 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee908 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ee920 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee938 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee950 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee968 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ee980 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee998 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee9b0 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee9c8 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a9570 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ee9e0 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ee9f8 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eea10 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eea28 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eea40 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eea58 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2eea70 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eea88 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eeaa0 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eeab8 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eead0 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eeae8 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eeb00 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eeb18 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eeb30 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a9580 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eef78 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eef90 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eefa8 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eefc0 [0183.048] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eefd8 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2eeff0 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef008 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef020 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef038 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2ef050 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef068 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2ef080 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef098 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef0b0 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef0c8 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef0e0 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef0f8 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef110 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef128 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef140 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef158 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef170 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef188 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef1a0 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef1b8 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef1d0 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef1e8 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef200 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef218 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef230 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef248 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef260 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef278 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef290 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef2a8 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2ef2c0 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x12) returned 0x2a6200 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef2d8 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef2f0 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef308 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef320 [0183.049] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef338 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef378 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef390 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef3a8 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef3c0 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef3d8 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef3f0 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef408 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef420 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef438 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef450 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef468 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef480 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef498 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef4b0 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef4c8 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef4e0 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef4f8 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef510 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xe) returned 0x2ef528 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef540 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a9590 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef558 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a95a0 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef570 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef588 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef5a0 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef5b8 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef5d0 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef5e8 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef600 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef618 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef630 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef648 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef660 [0183.050] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef678 [0183.051] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ef690 [0183.051] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef6a8 [0183.051] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x8) returned 0x2a95b0 [0183.051] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef6c0 [0183.051] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xa) returned 0x2ef6d8 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eeb58, Size=0x800) returned 0x2cb758 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a55f8, Size=0x8) returned 0x2a55f8 [0183.051] lstrlenW (lpString=".wiki") returned 5 [0183.051] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2efc98 | out: hHeap=0x270000) returned 1 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efcc8, Size=0x20) returned 0x284680 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284680, Size=0x40) returned 0x2a6d80 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6d80, Size=0x80) returned 0x2eb768 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9620, Size=0x8) returned 0x2a9630 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9630, Size=0x10) returned 0x2efcc8 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efcc8, Size=0x20) returned 0x284658 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efcf8, Size=0x20) returned 0x2a5be0 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5be0, Size=0x40) returned 0x2a6d80 [0183.051] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efcf8, Size=0x20) returned 0x2a5be0 [0183.051] lstrlenW (lpString="Info.hta") returned 8 [0183.051] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2cbf60, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe")) returned 0x66 [0183.051] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2cbf60 | out: hHeap=0x270000) returned 1 [0183.051] lstrlenW (lpString="1Black.exe") returned 10 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284658, Size=0x40) returned 0x2a6d80 [0183.051] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efcf8, Size=0x20) returned 0x284658 [0183.052] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efcf8, Size=0x20) returned 0x2a5be0 [0183.052] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5be0, Size=0x40) returned 0x2a6dc8 [0183.052] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6dc8, Size=0x80) returned 0x2eb768 [0183.052] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb768, Size=0x100) returned 0x2aa540 [0183.052] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0183.052] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2aa540 | out: hHeap=0x270000) returned 1 [0183.052] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x2cbf60, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0183.052] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eff60 | out: hHeap=0x270000) returned 1 [0183.052] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2cbf60 | out: hHeap=0x270000) returned 1 [0183.052] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9630, Size=0x8) returned 0x2a9620 [0183.052] lstrlenW (lpString="%windir%;") returned 9 [0183.052] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x284658 | out: hHeap=0x270000) returned 1 [0183.052] lstrlenW (lpString="C:\\Windows;") returned 11 [0183.052] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2bb750 | out: hHeap=0x270000) returned 1 [0183.052] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efd10, Size=0x20) returned 0x284658 [0183.052] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x284658, Size=0x40) returned 0x2a6dc8 [0183.052] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6dc8, Size=0x80) returned 0x2eb768 [0183.052] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb768, Size=0x100) returned 0x2aa540 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9660, Size=0x8) returned 0x2a9670 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9670, Size=0x10) returned 0x2efd58 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efd58, Size=0x20) returned 0x284658 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9630, Size=0x8) returned 0x2a9670 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9640, Size=0x8) returned 0x2a9630 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9660, Size=0x8) returned 0x2a9680 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9680, Size=0x10) returned 0x2efe00 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efe00, Size=0x20) returned 0x2a5be0 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9670, Size=0x10) returned 0x2efe00 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9630, Size=0x10) returned 0x2efe30 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9670, Size=0x8) returned 0x2a9660 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9690, Size=0x8) returned 0x2a96a0 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efe00, Size=0x20) returned 0x2a5c30 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efe30, Size=0x20) returned 0x2a5b40 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a96b0, Size=0x8) returned 0x2a96c0 [0183.053] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efea8, Size=0x20) returned 0x2a5c58 [0183.053] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x2bb750, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0183.053] lstrlenW (lpString="C:\\") returned 3 [0183.053] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0183.053] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2bb750 | out: hHeap=0x270000) returned 1 [0183.054] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a96f0, Size=0x82) returned 0x2a9f38 [0183.054] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9710, Size=0x100) returned 0x2a9fc8 [0183.054] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2edb50, Size=0x104) returned 0x2edc70 [0183.054] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb878, Size=0x100) returned 0x2edd80 [0183.054] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9f38, Size=0x104) returned 0x2ede88 [0183.054] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9fc8, Size=0x200) returned 0x2edf98 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a9700 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2edf98 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2ed768 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eb900 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eff08 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eb988 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eff38 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2ede88 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eff20 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2edc70 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2ed780 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2edbe0 | out: hHeap=0x270000) returned 1 [0183.105] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2ed798 | out: hHeap=0x270000) returned 1 [0183.105] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2ed798, Size=0x20) returned 0x2a5e10 [0183.105] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5e10, Size=0x40) returned 0x2a6f30 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2efef0, Size=0x20) returned 0x2a5c58 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5c58, Size=0x40) returned 0x2a6f78 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6f78, Size=0x80) returned 0x2eb768 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb768, Size=0x100) returned 0x2edbd0 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2edbd0, Size=0x200) returned 0x2edbd0 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2edbd0, Size=0x400) returned 0x2edbd0 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2edbd0, Size=0x800) returned 0x310a38 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310a38, Size=0x1000) returned 0x310a38 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a96b0, Size=0x8) returned 0x2a96d0 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a96d0, Size=0x10) returned 0x2eff38 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eff38, Size=0x20) returned 0x2a5c58 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5c58, Size=0x40) returned 0x2a6f78 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6f78, Size=0x80) returned 0x2eb768 [0183.107] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb768, Size=0x100) returned 0x2c1ce8 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2c1ce8, Size=0x200) returned 0x321a48 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x321a48, Size=0x400) returned 0x322050 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x322050, Size=0x800) returned 0x2c40d0 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2c5040, Size=0x20) returned 0x2a5c58 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5c58, Size=0x40) returned 0x2a6f78 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6f78, Size=0x80) returned 0x2eb768 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9870, Size=0x8) returned 0x2a9880 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9880, Size=0x10) returned 0x2c5040 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2c5040, Size=0x20) returned 0x2a5d48 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2c5070, Size=0x20) returned 0x2a5e38 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5e38, Size=0x40) returned 0x2a6f78 [0183.108] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0183.108] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2c5070, Size=0x20) returned 0x2a5e38 [0183.108] lstrlenW (lpString="Info.hta") returned 8 [0183.108] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x322c58, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe")) returned 0x66 [0183.383] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x322c58 | out: hHeap=0x270000) returned 1 [0183.383] lstrlenW (lpString="1Black.exe") returned 10 [0183.383] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5d48, Size=0x40) returned 0x2a7008 [0183.383] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310ab0, Size=0x20) returned 0x2a5d48 [0183.383] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310ab0, Size=0x20) returned 0x2a5f28 [0183.383] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5f28, Size=0x40) returned 0x2a7050 [0183.383] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a7050, Size=0x80) returned 0x2eb768 [0183.383] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb768, Size=0x100) returned 0x2c1ce8 [0183.383] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0183.383] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2c1ce8 | out: hHeap=0x270000) returned 1 [0183.383] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x322c58, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0183.383] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x332c60 | out: hHeap=0x270000) returned 1 [0183.383] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x322c58 | out: hHeap=0x270000) returned 1 [0183.383] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9880, Size=0x8) returned 0x2a9870 [0183.383] lstrlenW (lpString="%windir%;") returned 9 [0183.383] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5d48 | out: hHeap=0x270000) returned 1 [0183.383] lstrlenW (lpString="C:\\Windows;") returned 11 [0183.383] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x311a40 | out: hHeap=0x270000) returned 1 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310ac8, Size=0x20) returned 0x2a5d48 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5d48, Size=0x40) returned 0x2a7050 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a7050, Size=0x80) returned 0x2eb768 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb768, Size=0x100) returned 0x2c1ce8 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x322088, Size=0x8) returned 0x322098 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x322098, Size=0x10) returned 0x310b10 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310b10, Size=0x20) returned 0x2a5d48 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9880, Size=0x8) returned 0x322098 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x322068, Size=0x8) returned 0x2a9880 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x322088, Size=0x8) returned 0x3220a8 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x3220a8, Size=0x10) returned 0x310bb8 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310bb8, Size=0x20) returned 0x2a5f28 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x322098, Size=0x10) returned 0x310bb8 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9880, Size=0x10) returned 0x310be8 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x322098, Size=0x8) returned 0x322088 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x3220b8, Size=0x8) returned 0x3220c8 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310bb8, Size=0x20) returned 0x2a5f50 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310be8, Size=0x20) returned 0x2a5f78 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x3220d8, Size=0x8) returned 0x3220e8 [0183.385] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310c60, Size=0x20) returned 0x2a5fc8 [0183.385] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x311238, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0183.385] lstrlenW (lpString="C:\\") returned 3 [0183.385] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0183.386] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x311238 | out: hHeap=0x270000) returned 1 [0183.386] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x322118, Size=0x82) returned 0x300880 [0183.386] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x322138, Size=0x100) returned 0x2c1ce8 [0183.386] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x300910, Size=0x104) returned 0x2c5168 [0183.386] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb988, Size=0x100) returned 0x2c1df0 [0183.386] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x300880, Size=0x104) returned 0x300880 [0183.386] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2c1ce8, Size=0x200) returned 0x2c5290 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x322128 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2c5290 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x310d08 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eb900 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x310cc0 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eb878 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x310cf0 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x300880 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x310cd8 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2c5168 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x310d20 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2c50d8 | out: hHeap=0x270000) returned 1 [0183.387] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x310d38 | out: hHeap=0x270000) returned 1 [0183.388] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310d38, Size=0x20) returned 0x2a5ff0 [0183.388] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5ff0, Size=0x40) returned 0x2a7050 [0183.395] WaitForMultipleObjects (nCount=0x2, lpHandles=0x2a7f28*=0x128, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 58 os_tid = 0x60c Thread: id = 60 os_tid = 0x608 [0183.073] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2ed7b0 [0183.073] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2ed7b0, Size=0x20) returned 0x2a5c80 [0183.073] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5c80, Size=0x40) returned 0x2a6dc8 [0183.073] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6dc8, Size=0x80) returned 0x2eb878 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb878, Size=0x100) returned 0x2a9f38 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2ed7b0 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2ed7b0, Size=0x20) returned 0x2a5c80 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5c80, Size=0x40) returned 0x2a6dc8 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a6dc8, Size=0x80) returned 0x2eb878 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2eb878, Size=0x100) returned 0x2ee3b0 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ed7b0 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x2a9710 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2ed7c8 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9710, Size=0x8) returned 0x2a96f0 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x14) returned 0x2a6320 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a96f0, Size=0x10) returned 0x2ed7e0 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x18) returned 0x2a6340 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1a) returned 0x2a5c80 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2ed7e0, Size=0x20) returned 0x2a5ca8 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1c) returned 0x2a5cd0 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x16) returned 0x2a6360 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1a) returned 0x2a5cf8 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xc) returned 0x2ed7e0 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x4) returned 0x2a96f0 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40) returned 0x2a6dc8 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a96f0, Size=0x8) returned 0x2a9710 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x3c) returned 0x2a6e10 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a9710, Size=0x10) returned 0x2ed7f8 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x14) returned 0x2a6380 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x18) returned 0x2a63a0 [0183.074] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2ed7f8, Size=0x20) returned 0x2a5d20 [0183.074] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x24) returned 0x2aa6a8 [0183.074] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0183.074] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a9f38 | out: hHeap=0x270000) returned 1 [0183.074] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0183.074] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2ee3b0 | out: hHeap=0x270000) returned 1 [0183.074] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x2a5dc0 [0183.075] EnumServicesStatusExW (in: hSCManager=0x2a5dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0183.075] GetLastError () returned 0xea [0183.075] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x11ee) returned 0x2bc8d8 [0183.075] EnumServicesStatusExW (in: hSCManager=0x2a5dc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2bc8d8, cbBufSize=0x11ee, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x2bc8d8, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0183.076] CloseServiceHandle (hSCObject=0x2a5dc0) returned 1 [0183.076] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0183.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.076] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0183.076] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0183.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0183.076] lstrlenW (lpString="AudioSrv") returned 8 [0183.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0183.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0183.076] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0183.076] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0183.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0183.076] lstrlenW (lpString="BFE") returned 3 [0183.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0183.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0183.076] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0183.076] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0183.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0183.076] lstrlenW (lpString="CryptSvc") returned 8 [0183.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0183.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0183.076] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0183.076] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0183.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0183.077] lstrlenW (lpString="CscService") returned 10 [0183.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0183.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0183.077] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0183.077] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0183.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0183.077] lstrlenW (lpString="DcomLaunch") returned 10 [0183.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.077] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0183.077] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0183.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0183.077] lstrlenW (lpString="Dhcp") returned 4 [0183.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0183.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0183.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0183.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0183.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0183.077] lstrlenW (lpString="Dnscache") returned 8 [0183.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0183.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0183.077] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0183.077] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0183.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0183.077] lstrlenW (lpString="DPS") returned 3 [0183.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0183.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0183.077] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0183.077] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0183.077] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0183.077] lstrlenW (lpString="eventlog") returned 8 [0183.077] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0183.077] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0183.077] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0183.077] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0183.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0183.078] lstrlenW (lpString="EventSystem") returned 11 [0183.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0183.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0183.078] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0183.078] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0183.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0183.078] lstrlenW (lpString="FontCache") returned 9 [0183.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0183.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0183.078] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0183.078] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0183.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0183.078] lstrlenW (lpString="gpsvc") returned 5 [0183.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0183.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0183.078] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0183.078] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0183.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0183.078] lstrlenW (lpString="iphlpsvc") returned 8 [0183.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.078] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0183.078] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0183.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0183.078] lstrlenW (lpString="LanmanServer") returned 12 [0183.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0183.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0183.078] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0183.078] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0183.078] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0183.078] lstrlenW (lpString="LanmanWorkstation") returned 17 [0183.078] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.078] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.079] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0183.079] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0183.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0183.079] lstrlenW (lpString="lmhosts") returned 7 [0183.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0183.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0183.079] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0183.079] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0183.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0183.079] lstrlenW (lpString="MMCSS") returned 5 [0183.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0183.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0183.079] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0183.079] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0183.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0183.079] lstrlenW (lpString="MpsSvc") returned 6 [0183.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0183.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0183.079] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0183.079] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0183.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0183.079] lstrlenW (lpString="Netman") returned 6 [0183.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0183.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0183.079] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0183.079] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0183.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0183.079] lstrlenW (lpString="netprofm") returned 8 [0183.079] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0183.079] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0183.079] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0183.079] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0183.079] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0183.079] lstrlenW (lpString="NlaSvc") returned 6 [0183.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0183.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0183.080] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0183.080] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0183.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0183.080] lstrlenW (lpString="nsi") returned 3 [0183.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0183.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0183.080] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0183.080] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0183.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0183.080] lstrlenW (lpString="PcaSvc") returned 6 [0183.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0183.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0183.080] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0183.080] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0183.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0183.080] lstrlenW (lpString="PlugPlay") returned 8 [0183.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0183.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0183.080] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0183.080] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0183.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0183.080] lstrlenW (lpString="Power") returned 5 [0183.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0183.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0183.080] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0183.080] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0183.080] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0183.080] lstrlenW (lpString="ProfSvc") returned 7 [0183.080] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0183.080] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0183.080] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0183.080] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0183.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0183.081] lstrlenW (lpString="RpcEptMapper") returned 12 [0183.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.081] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0183.081] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0183.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0183.081] lstrlenW (lpString="RpcSs") returned 5 [0183.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0183.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0183.081] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0183.081] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0183.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0183.081] lstrlenW (lpString="SamSs") returned 5 [0183.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0183.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0183.081] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0183.081] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0183.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0183.081] lstrlenW (lpString="Schedule") returned 8 [0183.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0183.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0183.081] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0183.081] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0183.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0183.081] lstrlenW (lpString="SENS") returned 4 [0183.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0183.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0183.081] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0183.081] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0183.081] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0183.081] lstrlenW (lpString="ShellHWDetection") returned 16 [0183.081] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.081] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.082] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0183.082] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0183.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0183.082] lstrlenW (lpString="Spooler") returned 7 [0183.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0183.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0183.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0183.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0183.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0183.082] lstrlenW (lpString="SysMain") returned 7 [0183.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0183.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0183.082] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0183.082] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0183.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0183.082] lstrlenW (lpString="Themes") returned 6 [0183.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0183.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0183.082] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0183.082] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0183.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0183.082] lstrlenW (lpString="TrkWks") returned 6 [0183.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0183.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0183.082] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0183.082] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0183.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0183.082] lstrlenW (lpString="UxSms") returned 5 [0183.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0183.082] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0183.082] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0183.082] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0183.082] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0183.082] lstrlenW (lpString="WdiServiceHost") returned 14 [0183.082] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0183.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0183.083] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0183.083] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0183.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0183.083] lstrlenW (lpString="WdiSystemHost") returned 13 [0183.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0183.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0183.083] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0183.083] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0183.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0183.083] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0183.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0183.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0183.083] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0183.083] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0183.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0183.083] lstrlenW (lpString="Winmgmt") returned 7 [0183.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0183.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0183.083] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0183.083] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0183.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0183.083] lstrlenW (lpString="WPDBusEnum") returned 10 [0183.083] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0183.083] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0183.083] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0183.083] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0183.083] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0183.083] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2bc8d8 | out: hHeap=0x270000) returned 1 [0183.083] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x110 [0183.085] Process32FirstW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.085] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0183.085] lstrlenW (lpString="System") returned 6 [0183.085] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0183.085] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0183.085] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0183.086] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0183.086] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0183.086] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0183.086] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0183.086] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0183.086] lstrlenW (lpString="smss.exe") returned 8 [0183.086] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0183.086] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0183.086] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0183.086] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0183.086] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0183.086] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0183.086] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0183.087] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.087] lstrlenW (lpString="csrss.exe") returned 9 [0183.087] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0183.087] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0183.087] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0183.087] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0183.087] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0183.087] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0183.087] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0183.087] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0183.087] lstrlenW (lpString="wininit.exe") returned 11 [0183.087] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0183.087] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0183.087] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0183.087] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0183.087] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0183.087] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0183.087] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0183.088] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.088] lstrlenW (lpString="csrss.exe") returned 9 [0183.088] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0183.088] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0183.088] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0183.088] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0183.088] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0183.088] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0183.088] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0183.088] lstrlenW (lpString="winlogon.exe") returned 12 [0183.088] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0183.089] lstrlenW (lpString="services.exe") returned 12 [0183.089] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0183.089] lstrlenW (lpString="lsass.exe") returned 9 [0183.089] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0183.089] lstrlenW (lpString="lsm.exe") returned 7 [0183.089] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.090] lstrlenW (lpString="svchost.exe") returned 11 [0183.090] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.090] lstrlenW (lpString="svchost.exe") returned 11 [0183.090] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.090] lstrlenW (lpString="svchost.exe") returned 11 [0183.090] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.091] lstrlenW (lpString="svchost.exe") returned 11 [0183.091] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.091] lstrlenW (lpString="svchost.exe") returned 11 [0183.091] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0183.091] lstrlenW (lpString="audiodg.exe") returned 11 [0183.091] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.092] lstrlenW (lpString="svchost.exe") returned 11 [0183.092] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0183.092] lstrlenW (lpString="explorer.exe") returned 12 [0183.092] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0183.092] lstrlenW (lpString="dwm.exe") returned 7 [0183.092] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.092] lstrlenW (lpString="svchost.exe") returned 11 [0183.093] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0183.093] lstrlenW (lpString="spoolsv.exe") returned 11 [0183.093] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0183.093] lstrlenW (lpString="reader_sl.exe") returned 13 [0183.093] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.093] lstrlenW (lpString="svchost.exe") returned 11 [0183.093] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0183.094] lstrlenW (lpString="taskhost.exe") returned 12 [0183.094] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.094] lstrlenW (lpString="svchost.exe") returned 11 [0183.094] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0183.094] lstrlenW (lpString="rundll32.exe") returned 12 [0183.094] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0183.095] lstrlenW (lpString="dinotify.exe") returned 12 [0183.095] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0183.095] lstrlenW (lpString="1Black.exe") returned 10 [0183.095] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0183.095] lstrlenW (lpString="cmd.exe") returned 7 [0183.095] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.096] lstrlenW (lpString="conhost.exe") returned 11 [0183.096] Process32NextW (in: hSnapshot=0x110, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0183.096] CloseHandle (hObject=0x110) returned 1 [0183.096] Sleep (dwMilliseconds=0x1f4) [0183.607] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x365618 [0183.607] EnumServicesStatusExW (in: hSCManager=0x365618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0183.608] GetLastError () returned 0xea [0183.608] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x11ee) returned 0x2e3fa0 [0183.608] EnumServicesStatusExW (in: hSCManager=0x365618, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x2e3fa0, cbBufSize=0x11ee, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x2e3fa0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0183.608] CloseServiceHandle (hSCObject=0x365618) returned 1 [0183.608] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0183.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0183.609] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0183.609] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0183.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0183.609] lstrlenW (lpString="AudioSrv") returned 8 [0183.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0183.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0183.609] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0183.609] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0183.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0183.609] lstrlenW (lpString="BFE") returned 3 [0183.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0183.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0183.609] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0183.609] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0183.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0183.609] lstrlenW (lpString="CryptSvc") returned 8 [0183.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0183.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0183.609] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0183.609] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0183.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0183.609] lstrlenW (lpString="CscService") returned 10 [0183.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0183.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0183.609] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0183.609] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0183.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0183.609] lstrlenW (lpString="DcomLaunch") returned 10 [0183.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0183.609] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0183.609] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0183.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0183.610] lstrlenW (lpString="Dhcp") returned 4 [0183.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0183.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0183.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0183.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0183.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0183.610] lstrlenW (lpString="Dnscache") returned 8 [0183.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0183.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0183.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0183.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0183.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0183.610] lstrlenW (lpString="DPS") returned 3 [0183.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0183.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0183.610] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0183.610] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0183.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0183.610] lstrlenW (lpString="eventlog") returned 8 [0183.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0183.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0183.610] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0183.610] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0183.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0183.610] lstrlenW (lpString="EventSystem") returned 11 [0183.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0183.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0183.610] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0183.610] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0183.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0183.610] lstrlenW (lpString="FontCache") returned 9 [0183.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0183.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0183.610] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0183.611] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0183.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0183.611] lstrlenW (lpString="gpsvc") returned 5 [0183.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0183.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0183.611] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0183.611] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0183.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0183.611] lstrlenW (lpString="iphlpsvc") returned 8 [0183.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0183.611] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0183.611] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0183.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0183.611] lstrlenW (lpString="LanmanServer") returned 12 [0183.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0183.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0183.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0183.611] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0183.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0183.611] lstrlenW (lpString="LanmanWorkstation") returned 17 [0183.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0183.611] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0183.611] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0183.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0183.611] lstrlenW (lpString="lmhosts") returned 7 [0183.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0183.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0183.611] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0183.611] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0183.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0183.611] lstrlenW (lpString="MMCSS") returned 5 [0183.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0183.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0183.612] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0183.612] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0183.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0183.612] lstrlenW (lpString="MpsSvc") returned 6 [0183.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0183.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0183.612] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0183.612] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0183.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0183.612] lstrlenW (lpString="Netman") returned 6 [0183.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0183.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0183.612] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0183.612] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0183.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0183.612] lstrlenW (lpString="netprofm") returned 8 [0183.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0183.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0183.612] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0183.612] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0183.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0183.612] lstrlenW (lpString="NlaSvc") returned 6 [0183.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0183.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0183.612] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0183.612] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0183.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0183.612] lstrlenW (lpString="nsi") returned 3 [0183.612] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0183.612] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0183.612] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0183.612] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0183.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0183.613] lstrlenW (lpString="PcaSvc") returned 6 [0183.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0183.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0183.613] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0183.613] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0183.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0183.613] lstrlenW (lpString="PlugPlay") returned 8 [0183.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0183.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0183.613] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0183.613] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0183.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0183.613] lstrlenW (lpString="Power") returned 5 [0183.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0183.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0183.613] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0183.613] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0183.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0183.613] lstrlenW (lpString="ProfSvc") returned 7 [0183.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0183.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0183.613] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0183.613] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0183.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0183.613] lstrlenW (lpString="RpcEptMapper") returned 12 [0183.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0183.613] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0183.613] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0183.613] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0183.613] lstrlenW (lpString="RpcSs") returned 5 [0183.613] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0183.613] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0183.614] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0183.614] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0183.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0183.614] lstrlenW (lpString="SamSs") returned 5 [0183.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0183.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0183.614] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0183.614] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0183.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0183.614] lstrlenW (lpString="Schedule") returned 8 [0183.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0183.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0183.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0183.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0183.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0183.614] lstrlenW (lpString="SENS") returned 4 [0183.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0183.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0183.614] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0183.614] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0183.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0183.614] lstrlenW (lpString="ShellHWDetection") returned 16 [0183.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0183.614] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0183.614] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0183.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0183.614] lstrlenW (lpString="Spooler") returned 7 [0183.614] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0183.614] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0183.614] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0183.614] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0183.614] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0183.614] lstrlenW (lpString="SysMain") returned 7 [0183.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0183.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0183.615] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0183.615] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0183.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0183.615] lstrlenW (lpString="Themes") returned 6 [0183.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0183.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0183.615] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0183.615] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0183.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0183.615] lstrlenW (lpString="TrkWks") returned 6 [0183.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0183.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0183.615] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0183.615] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0183.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0183.615] lstrlenW (lpString="UxSms") returned 5 [0183.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0183.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0183.615] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0183.615] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0183.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0183.615] lstrlenW (lpString="WdiServiceHost") returned 14 [0183.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0183.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0183.615] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0183.615] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0183.615] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0183.615] lstrlenW (lpString="WdiSystemHost") returned 13 [0183.615] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0183.615] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0183.615] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0183.615] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0183.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0183.616] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0183.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0183.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0183.616] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0183.616] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0183.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0183.616] lstrlenW (lpString="Winmgmt") returned 7 [0183.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0183.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0183.616] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0183.616] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0183.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0183.616] lstrlenW (lpString="WPDBusEnum") returned 10 [0183.616] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0183.616] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0183.616] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0183.616] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0183.616] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0183.616] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2e3fa0 | out: hHeap=0x270000) returned 1 [0183.616] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1dc [0183.618] Process32FirstW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0183.618] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0183.619] lstrlenW (lpString="System") returned 6 [0183.619] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0183.619] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0183.619] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0183.619] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0183.619] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0183.619] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0183.619] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0183.619] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0183.619] lstrlenW (lpString="smss.exe") returned 8 [0183.619] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0183.619] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0183.619] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0183.619] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0183.619] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0183.619] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0183.619] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0183.619] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.620] lstrlenW (lpString="csrss.exe") returned 9 [0183.620] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0183.620] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0183.620] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0183.620] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0183.620] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0183.620] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0183.620] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0183.620] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0183.620] lstrlenW (lpString="wininit.exe") returned 11 [0183.620] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0183.620] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0183.620] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0183.620] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0183.620] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0183.621] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0183.621] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0183.621] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0183.621] lstrlenW (lpString="csrss.exe") returned 9 [0183.621] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0183.621] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0183.621] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0183.621] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0183.621] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0183.621] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0183.621] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0183.621] lstrlenW (lpString="winlogon.exe") returned 12 [0183.621] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0183.622] lstrlenW (lpString="services.exe") returned 12 [0183.622] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0183.622] lstrlenW (lpString="lsass.exe") returned 9 [0183.622] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0183.623] lstrlenW (lpString="lsm.exe") returned 7 [0183.623] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.623] lstrlenW (lpString="svchost.exe") returned 11 [0183.623] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.623] lstrlenW (lpString="svchost.exe") returned 11 [0183.623] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.624] lstrlenW (lpString="svchost.exe") returned 11 [0183.624] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.624] lstrlenW (lpString="svchost.exe") returned 11 [0183.624] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.624] lstrlenW (lpString="svchost.exe") returned 11 [0183.624] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0183.625] lstrlenW (lpString="audiodg.exe") returned 11 [0183.625] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.625] lstrlenW (lpString="svchost.exe") returned 11 [0183.625] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0183.625] lstrlenW (lpString="explorer.exe") returned 12 [0183.625] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0183.626] lstrlenW (lpString="dwm.exe") returned 7 [0183.626] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.626] lstrlenW (lpString="svchost.exe") returned 11 [0183.626] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0183.627] lstrlenW (lpString="spoolsv.exe") returned 11 [0183.627] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0183.627] lstrlenW (lpString="reader_sl.exe") returned 13 [0183.627] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.627] lstrlenW (lpString="svchost.exe") returned 11 [0183.627] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0183.628] lstrlenW (lpString="taskhost.exe") returned 12 [0183.628] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0183.628] lstrlenW (lpString="svchost.exe") returned 11 [0183.628] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0183.628] lstrlenW (lpString="rundll32.exe") returned 12 [0183.628] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0183.629] lstrlenW (lpString="dinotify.exe") returned 12 [0183.629] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0183.629] lstrlenW (lpString="1Black.exe") returned 10 [0183.629] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0183.629] lstrlenW (lpString="cmd.exe") returned 7 [0183.629] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0183.630] lstrlenW (lpString="conhost.exe") returned 11 [0183.630] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0183.630] lstrlenW (lpString="vssadmin.exe") returned 12 [0183.630] Process32NextW (in: hSnapshot=0x1dc, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0183.631] CloseHandle (hObject=0x1dc) returned 1 [0183.631] Sleep (dwMilliseconds=0x1f4) [0184.246] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39565e0 [0184.247] EnumServicesStatusExW (in: hSCManager=0x39565e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0184.247] GetLastError () returned 0xea [0184.247] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x11ee) returned 0x41aa310 [0184.247] EnumServicesStatusExW (in: hSCManager=0x39565e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41aa310, cbBufSize=0x11ee, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41aa310, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0184.247] CloseServiceHandle (hSCObject=0x39565e0) returned 1 [0184.248] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0184.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.248] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0184.248] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0184.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0184.248] lstrlenW (lpString="AudioSrv") returned 8 [0184.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0184.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0184.248] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0184.248] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0184.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0184.248] lstrlenW (lpString="BFE") returned 3 [0184.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0184.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0184.248] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0184.248] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0184.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0184.248] lstrlenW (lpString="CryptSvc") returned 8 [0184.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0184.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0184.248] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0184.248] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0184.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0184.248] lstrlenW (lpString="CscService") returned 10 [0184.248] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0184.248] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0184.248] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0184.248] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0184.248] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0184.248] lstrlenW (lpString="DcomLaunch") returned 10 [0184.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.249] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0184.249] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0184.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0184.249] lstrlenW (lpString="Dhcp") returned 4 [0184.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0184.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0184.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0184.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0184.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0184.249] lstrlenW (lpString="Dnscache") returned 8 [0184.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0184.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0184.249] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0184.249] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0184.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0184.249] lstrlenW (lpString="DPS") returned 3 [0184.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0184.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0184.249] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0184.249] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0184.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0184.249] lstrlenW (lpString="eventlog") returned 8 [0184.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0184.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0184.249] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0184.249] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0184.249] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0184.249] lstrlenW (lpString="EventSystem") returned 11 [0184.249] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0184.249] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0184.249] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0184.249] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0184.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0184.250] lstrlenW (lpString="FontCache") returned 9 [0184.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0184.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0184.250] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0184.250] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0184.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0184.250] lstrlenW (lpString="gpsvc") returned 5 [0184.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0184.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0184.250] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0184.250] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0184.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0184.250] lstrlenW (lpString="iphlpsvc") returned 8 [0184.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.250] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0184.250] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0184.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0184.250] lstrlenW (lpString="LanmanServer") returned 12 [0184.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0184.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0184.250] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0184.250] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0184.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0184.250] lstrlenW (lpString="LanmanWorkstation") returned 17 [0184.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.250] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0184.250] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0184.250] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0184.250] lstrlenW (lpString="lmhosts") returned 7 [0184.250] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0184.250] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0184.251] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0184.251] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0184.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0184.251] lstrlenW (lpString="MMCSS") returned 5 [0184.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0184.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0184.251] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0184.251] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0184.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0184.251] lstrlenW (lpString="MpsSvc") returned 6 [0184.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0184.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0184.251] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0184.251] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0184.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0184.251] lstrlenW (lpString="Netman") returned 6 [0184.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0184.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0184.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0184.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0184.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0184.251] lstrlenW (lpString="netprofm") returned 8 [0184.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0184.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0184.251] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0184.251] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0184.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0184.251] lstrlenW (lpString="NlaSvc") returned 6 [0184.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0184.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0184.251] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0184.251] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0184.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0184.251] lstrlenW (lpString="nsi") returned 3 [0184.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0184.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0184.252] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0184.252] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0184.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0184.252] lstrlenW (lpString="PcaSvc") returned 6 [0184.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0184.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0184.252] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0184.252] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0184.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0184.252] lstrlenW (lpString="PlugPlay") returned 8 [0184.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0184.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0184.252] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0184.252] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0184.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0184.252] lstrlenW (lpString="Power") returned 5 [0184.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0184.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0184.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0184.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0184.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0184.252] lstrlenW (lpString="ProfSvc") returned 7 [0184.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0184.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0184.252] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0184.252] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0184.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0184.252] lstrlenW (lpString="RpcEptMapper") returned 12 [0184.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.252] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0184.252] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0184.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0184.253] lstrlenW (lpString="RpcSs") returned 5 [0184.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0184.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0184.253] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0184.253] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0184.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0184.253] lstrlenW (lpString="SamSs") returned 5 [0184.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0184.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0184.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0184.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0184.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0184.253] lstrlenW (lpString="Schedule") returned 8 [0184.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0184.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0184.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0184.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0184.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0184.253] lstrlenW (lpString="SENS") returned 4 [0184.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0184.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0184.253] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0184.253] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0184.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0184.253] lstrlenW (lpString="ShellHWDetection") returned 16 [0184.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.253] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0184.253] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0184.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0184.253] lstrlenW (lpString="Spooler") returned 7 [0184.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0184.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0184.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0184.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0184.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0184.254] lstrlenW (lpString="SysMain") returned 7 [0184.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0184.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0184.254] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0184.254] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0184.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0184.254] lstrlenW (lpString="Themes") returned 6 [0184.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0184.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0184.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0184.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0184.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0184.254] lstrlenW (lpString="TrkWks") returned 6 [0184.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0184.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0184.254] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0184.254] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0184.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0184.254] lstrlenW (lpString="UxSms") returned 5 [0184.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0184.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0184.254] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0184.254] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0184.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0184.254] lstrlenW (lpString="WdiServiceHost") returned 14 [0184.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0184.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0184.254] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0184.254] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0184.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0184.254] lstrlenW (lpString="WdiSystemHost") returned 13 [0184.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0184.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0184.255] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0184.255] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0184.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0184.255] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0184.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0184.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0184.255] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0184.255] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0184.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0184.255] lstrlenW (lpString="Winmgmt") returned 7 [0184.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0184.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0184.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0184.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0184.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0184.255] lstrlenW (lpString="WPDBusEnum") returned 10 [0184.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0184.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0184.255] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0184.255] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0184.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0184.255] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41aa310 | out: hHeap=0x270000) returned 1 [0184.255] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x310 [0184.257] Process32FirstW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.257] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0184.258] lstrlenW (lpString="System") returned 6 [0184.258] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0184.258] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0184.258] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0184.258] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0184.258] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0184.258] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0184.258] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0184.258] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0184.258] lstrlenW (lpString="smss.exe") returned 8 [0184.258] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0184.258] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0184.258] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0184.258] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0184.258] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0184.258] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0184.258] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0184.258] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.259] lstrlenW (lpString="csrss.exe") returned 9 [0184.259] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0184.259] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0184.259] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0184.259] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0184.259] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0184.259] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0184.259] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0184.259] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0184.259] lstrlenW (lpString="wininit.exe") returned 11 [0184.259] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0184.259] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0184.259] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0184.259] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0184.259] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0184.259] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0184.259] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0184.260] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.260] lstrlenW (lpString="csrss.exe") returned 9 [0184.260] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0184.260] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0184.260] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0184.260] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0184.260] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0184.260] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0184.260] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0184.260] lstrlenW (lpString="winlogon.exe") returned 12 [0184.260] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0184.261] lstrlenW (lpString="services.exe") returned 12 [0184.261] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0184.261] lstrlenW (lpString="lsass.exe") returned 9 [0184.261] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0184.261] lstrlenW (lpString="lsm.exe") returned 7 [0184.261] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.262] lstrlenW (lpString="svchost.exe") returned 11 [0184.262] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.262] lstrlenW (lpString="svchost.exe") returned 11 [0184.262] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.262] lstrlenW (lpString="svchost.exe") returned 11 [0184.262] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.263] lstrlenW (lpString="svchost.exe") returned 11 [0184.263] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2c, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.263] lstrlenW (lpString="svchost.exe") returned 11 [0184.263] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0184.263] lstrlenW (lpString="audiodg.exe") returned 11 [0184.263] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.264] lstrlenW (lpString="svchost.exe") returned 11 [0184.264] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0184.264] lstrlenW (lpString="explorer.exe") returned 12 [0184.264] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0184.264] lstrlenW (lpString="dwm.exe") returned 7 [0184.264] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.265] lstrlenW (lpString="svchost.exe") returned 11 [0184.265] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0184.265] lstrlenW (lpString="spoolsv.exe") returned 11 [0184.265] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0184.265] lstrlenW (lpString="reader_sl.exe") returned 13 [0184.265] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.265] lstrlenW (lpString="svchost.exe") returned 11 [0184.266] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0184.266] lstrlenW (lpString="taskhost.exe") returned 12 [0184.266] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.266] lstrlenW (lpString="svchost.exe") returned 11 [0184.266] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0184.266] lstrlenW (lpString="rundll32.exe") returned 12 [0184.266] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0184.267] lstrlenW (lpString="dinotify.exe") returned 12 [0184.267] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0184.267] lstrlenW (lpString="1Black.exe") returned 10 [0184.267] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0184.267] lstrlenW (lpString="cmd.exe") returned 7 [0184.267] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0184.268] lstrlenW (lpString="conhost.exe") returned 11 [0184.268] Process32NextW (in: hSnapshot=0x310, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 0 [0184.268] CloseHandle (hObject=0x310) returned 1 [0184.268] Sleep (dwMilliseconds=0x1f4) [0184.939] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3956810 [0184.939] EnumServicesStatusExW (in: hSCManager=0x3956810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0184.940] GetLastError () returned 0xea [0184.940] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x11ee) returned 0x41ab350 [0184.940] EnumServicesStatusExW (in: hSCManager=0x3956810, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41ab350, cbBufSize=0x11ee, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41ab350, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0184.940] CloseServiceHandle (hSCObject=0x3956810) returned 1 [0184.940] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0184.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0184.941] lstrlenW (lpString="AudioSrv") returned 8 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0184.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0184.941] lstrlenW (lpString="BFE") returned 3 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0184.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0184.941] lstrlenW (lpString="CryptSvc") returned 8 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0184.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0184.941] lstrlenW (lpString="CscService") returned 10 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0184.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0184.941] lstrlenW (lpString="DcomLaunch") returned 10 [0184.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0184.941] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0184.941] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0184.942] lstrlenW (lpString="Dhcp") returned 4 [0184.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0184.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0184.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0184.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0184.942] lstrlenW (lpString="Dnscache") returned 8 [0184.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0184.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0184.942] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0184.942] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0184.942] lstrlenW (lpString="DPS") returned 3 [0184.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0184.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0184.942] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0184.942] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0184.942] lstrlenW (lpString="eventlog") returned 8 [0184.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0184.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0184.942] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0184.942] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0184.942] lstrlenW (lpString="EventSystem") returned 11 [0184.942] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0184.942] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0184.942] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0184.942] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0184.942] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0184.943] lstrlenW (lpString="FontCache") returned 9 [0184.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0184.943] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0184.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0184.943] lstrlenW (lpString="gpsvc") returned 5 [0184.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0184.943] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0184.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0184.943] lstrlenW (lpString="iphlpsvc") returned 8 [0184.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0184.943] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0184.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0184.943] lstrlenW (lpString="LanmanServer") returned 12 [0184.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0184.943] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0184.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0184.943] lstrlenW (lpString="LanmanWorkstation") returned 17 [0184.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0184.943] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0184.943] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0184.943] lstrlenW (lpString="lmhosts") returned 7 [0184.943] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0184.943] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0184.943] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0184.944] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0184.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0184.944] lstrlenW (lpString="MMCSS") returned 5 [0184.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0184.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0184.944] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0184.944] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0184.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0184.944] lstrlenW (lpString="MpsSvc") returned 6 [0184.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0184.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0184.944] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0184.944] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0184.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0184.944] lstrlenW (lpString="Netman") returned 6 [0184.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0184.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0184.944] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0184.944] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0184.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0184.944] lstrlenW (lpString="netprofm") returned 8 [0184.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0184.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0184.944] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0184.944] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0184.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0184.944] lstrlenW (lpString="NlaSvc") returned 6 [0184.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0184.944] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0184.944] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0184.944] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0184.944] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0184.944] lstrlenW (lpString="nsi") returned 3 [0184.944] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0184.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0184.945] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0184.945] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0184.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0184.945] lstrlenW (lpString="PcaSvc") returned 6 [0184.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0184.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0184.945] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0184.945] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0184.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0184.945] lstrlenW (lpString="PlugPlay") returned 8 [0184.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0184.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0184.945] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0184.945] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0184.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0184.945] lstrlenW (lpString="Power") returned 5 [0184.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0184.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0184.945] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0184.945] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0184.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0184.945] lstrlenW (lpString="ProfSvc") returned 7 [0184.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0184.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0184.945] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0184.945] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0184.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0184.945] lstrlenW (lpString="RpcEptMapper") returned 12 [0184.945] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.945] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0184.945] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0184.945] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0184.945] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0184.946] lstrlenW (lpString="RpcSs") returned 5 [0184.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0184.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0184.946] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0184.946] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0184.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0184.946] lstrlenW (lpString="SamSs") returned 5 [0184.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0184.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0184.946] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0184.946] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0184.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0184.946] lstrlenW (lpString="Schedule") returned 8 [0184.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0184.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0184.946] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0184.946] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0184.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0184.946] lstrlenW (lpString="SENS") returned 4 [0184.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0184.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0184.946] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0184.946] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0184.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0184.946] lstrlenW (lpString="ShellHWDetection") returned 16 [0184.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0184.946] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0184.946] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0184.946] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0184.946] lstrlenW (lpString="Spooler") returned 7 [0184.946] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0184.946] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0184.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0184.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0184.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0184.947] lstrlenW (lpString="SysMain") returned 7 [0184.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0184.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0184.947] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0184.947] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0184.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0184.947] lstrlenW (lpString="Themes") returned 6 [0184.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0184.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0184.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0184.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0184.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0184.947] lstrlenW (lpString="TrkWks") returned 6 [0184.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0184.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0184.947] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0184.947] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0184.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0184.947] lstrlenW (lpString="UxSms") returned 5 [0184.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0184.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0184.947] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0184.947] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0184.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0184.947] lstrlenW (lpString="WdiServiceHost") returned 14 [0184.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0184.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0184.947] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0184.947] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0184.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0184.947] lstrlenW (lpString="WdiSystemHost") returned 13 [0184.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0184.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0184.948] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0184.948] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0184.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0184.948] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0184.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0184.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0184.948] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0184.948] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0184.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0184.948] lstrlenW (lpString="Winmgmt") returned 7 [0184.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0184.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0184.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0184.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0184.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0184.948] lstrlenW (lpString="WPDBusEnum") returned 10 [0184.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0184.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0184.948] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0184.948] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0184.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0184.948] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41ab350 | out: hHeap=0x270000) returned 1 [0184.948] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x25c [0184.950] Process32FirstW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0184.950] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0184.950] lstrlenW (lpString="System") returned 6 [0184.950] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0184.951] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0184.951] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0184.951] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0184.951] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0184.951] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0184.951] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0184.951] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0184.951] lstrlenW (lpString="smss.exe") returned 8 [0184.951] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0184.951] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0184.951] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0184.951] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0184.951] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0184.951] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0184.951] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0184.951] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.951] lstrlenW (lpString="csrss.exe") returned 9 [0184.952] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0184.952] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0184.952] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0184.952] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0184.952] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0184.952] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0184.952] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0184.952] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0184.952] lstrlenW (lpString="wininit.exe") returned 11 [0184.952] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0184.952] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0184.952] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0184.952] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0184.952] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0184.952] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0184.952] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0184.952] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0184.953] lstrlenW (lpString="csrss.exe") returned 9 [0184.953] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0184.953] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0184.953] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0184.953] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0184.953] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0184.953] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0184.953] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0184.953] lstrlenW (lpString="winlogon.exe") returned 12 [0184.953] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0184.953] lstrlenW (lpString="services.exe") returned 12 [0184.953] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0184.954] lstrlenW (lpString="lsass.exe") returned 9 [0184.954] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0184.954] lstrlenW (lpString="lsm.exe") returned 7 [0184.954] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.954] lstrlenW (lpString="svchost.exe") returned 11 [0184.954] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.955] lstrlenW (lpString="svchost.exe") returned 11 [0184.955] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.955] lstrlenW (lpString="svchost.exe") returned 11 [0184.955] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.955] lstrlenW (lpString="svchost.exe") returned 11 [0184.955] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.956] lstrlenW (lpString="svchost.exe") returned 11 [0184.956] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0184.956] lstrlenW (lpString="audiodg.exe") returned 11 [0184.956] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.956] lstrlenW (lpString="svchost.exe") returned 11 [0184.956] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0184.957] lstrlenW (lpString="explorer.exe") returned 12 [0184.957] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0184.957] lstrlenW (lpString="dwm.exe") returned 7 [0184.957] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.957] lstrlenW (lpString="svchost.exe") returned 11 [0184.957] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0184.958] lstrlenW (lpString="spoolsv.exe") returned 11 [0184.958] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0184.958] lstrlenW (lpString="reader_sl.exe") returned 13 [0184.958] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.958] lstrlenW (lpString="svchost.exe") returned 11 [0184.958] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0184.959] lstrlenW (lpString="taskhost.exe") returned 12 [0184.959] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0184.959] lstrlenW (lpString="svchost.exe") returned 11 [0184.959] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0184.959] lstrlenW (lpString="rundll32.exe") returned 12 [0184.959] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0184.960] lstrlenW (lpString="dinotify.exe") returned 12 [0184.960] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0184.960] lstrlenW (lpString="1Black.exe") returned 10 [0184.960] Process32NextW (in: hSnapshot=0x25c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0184.960] CloseHandle (hObject=0x25c) returned 1 [0184.960] Sleep (dwMilliseconds=0x1f4) [0185.490] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x38c9e98 [0185.490] EnumServicesStatusExW (in: hSCManager=0x38c9e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0185.490] GetLastError () returned 0xea [0185.490] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x38e5890 [0185.490] EnumServicesStatusExW (in: hSCManager=0x38c9e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x38e5890, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x38e5890, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0185.491] CloseServiceHandle (hSCObject=0x38c9e98) returned 1 [0185.491] lstrlenW (lpString="Appinfo") returned 7 [0185.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0185.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0185.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0185.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0185.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0185.491] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0185.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0185.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0185.491] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0185.492] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0185.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0185.492] lstrlenW (lpString="AudioSrv") returned 8 [0185.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0185.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0185.492] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0185.492] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0185.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0185.492] lstrlenW (lpString="BFE") returned 3 [0185.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0185.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0185.492] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0185.492] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0185.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0185.492] lstrlenW (lpString="CryptSvc") returned 8 [0185.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0185.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0185.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0185.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0185.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0185.492] lstrlenW (lpString="CscService") returned 10 [0185.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0185.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0185.492] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0185.492] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0185.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0185.492] lstrlenW (lpString="DcomLaunch") returned 10 [0185.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0185.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0185.492] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0185.492] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0185.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0185.492] lstrlenW (lpString="Dhcp") returned 4 [0185.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0185.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0185.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0185.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0185.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0185.493] lstrlenW (lpString="Dnscache") returned 8 [0185.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0185.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0185.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0185.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0185.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0185.493] lstrlenW (lpString="DPS") returned 3 [0185.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0185.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0185.493] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0185.493] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0185.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0185.493] lstrlenW (lpString="eventlog") returned 8 [0185.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0185.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0185.493] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0185.493] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0185.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0185.493] lstrlenW (lpString="EventSystem") returned 11 [0185.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0185.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0185.493] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0185.493] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0185.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0185.493] lstrlenW (lpString="FontCache") returned 9 [0185.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0185.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0185.493] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0185.493] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0185.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0185.494] lstrlenW (lpString="gpsvc") returned 5 [0185.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0185.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0185.494] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0185.494] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0185.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0185.494] lstrlenW (lpString="iphlpsvc") returned 8 [0185.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0185.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0185.494] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0185.494] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0185.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0185.494] lstrlenW (lpString="LanmanServer") returned 12 [0185.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0185.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0185.494] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0185.494] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0185.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0185.494] lstrlenW (lpString="LanmanWorkstation") returned 17 [0185.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0185.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0185.494] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0185.494] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0185.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0185.494] lstrlenW (lpString="lmhosts") returned 7 [0185.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0185.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0185.494] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0185.494] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0185.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0185.494] lstrlenW (lpString="MMCSS") returned 5 [0185.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0185.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0185.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0185.495] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0185.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0185.495] lstrlenW (lpString="MpsSvc") returned 6 [0185.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0185.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0185.495] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0185.495] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0185.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0185.495] lstrlenW (lpString="Netman") returned 6 [0185.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0185.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0185.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0185.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0185.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0185.495] lstrlenW (lpString="netprofm") returned 8 [0185.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0185.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0185.495] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0185.495] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0185.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0185.495] lstrlenW (lpString="NlaSvc") returned 6 [0185.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0185.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0185.495] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0185.495] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0185.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0185.495] lstrlenW (lpString="nsi") returned 3 [0185.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0185.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0185.495] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0185.495] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0185.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0185.496] lstrlenW (lpString="PcaSvc") returned 6 [0185.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0185.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0185.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0185.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0185.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0185.496] lstrlenW (lpString="PlugPlay") returned 8 [0185.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0185.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0185.496] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0185.496] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0185.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0185.496] lstrlenW (lpString="Power") returned 5 [0185.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0185.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0185.496] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0185.496] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0185.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0185.496] lstrlenW (lpString="ProfSvc") returned 7 [0185.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0185.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0185.496] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0185.496] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0185.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0185.496] lstrlenW (lpString="RpcEptMapper") returned 12 [0185.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0185.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0185.496] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0185.496] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0185.496] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0185.496] lstrlenW (lpString="RpcSs") returned 5 [0185.496] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0185.496] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0185.497] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0185.497] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0185.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0185.497] lstrlenW (lpString="SamSs") returned 5 [0185.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0185.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0185.497] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0185.497] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0185.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0185.497] lstrlenW (lpString="Schedule") returned 8 [0185.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0185.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0185.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0185.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0185.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0185.497] lstrlenW (lpString="SENS") returned 4 [0185.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0185.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0185.497] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0185.497] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0185.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0185.497] lstrlenW (lpString="ShellHWDetection") returned 16 [0185.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0185.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0185.497] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0185.497] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0185.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0185.497] lstrlenW (lpString="Spooler") returned 7 [0185.497] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0185.497] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0185.497] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0185.497] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0185.497] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0185.498] lstrlenW (lpString="SysMain") returned 7 [0185.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0185.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0185.498] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0185.498] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0185.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0185.498] lstrlenW (lpString="Themes") returned 6 [0185.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0185.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0185.498] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0185.498] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0185.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0185.498] lstrlenW (lpString="TrkWks") returned 6 [0185.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0185.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0185.498] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0185.498] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0185.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0185.498] lstrlenW (lpString="UxSms") returned 5 [0185.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0185.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0185.498] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0185.498] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0185.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0185.498] lstrlenW (lpString="WdiServiceHost") returned 14 [0185.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0185.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0185.498] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0185.498] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0185.498] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0185.498] lstrlenW (lpString="WdiSystemHost") returned 13 [0185.498] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0185.498] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0185.499] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0185.499] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0185.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0185.499] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0185.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0185.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0185.499] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0185.499] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0185.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0185.499] lstrlenW (lpString="Winmgmt") returned 7 [0185.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0185.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0185.499] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0185.499] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0185.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0185.499] lstrlenW (lpString="WPDBusEnum") returned 10 [0185.499] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0185.499] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0185.499] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0185.499] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0185.499] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0185.499] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x38e5890 | out: hHeap=0x270000) returned 1 [0185.499] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0185.503] Process32FirstW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0185.503] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0185.503] lstrlenW (lpString="System") returned 6 [0185.503] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0185.504] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0185.504] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0185.504] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0185.504] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0185.504] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0185.505] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0185.505] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0185.505] lstrlenW (lpString="smss.exe") returned 8 [0185.505] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0185.505] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0185.505] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0185.505] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0185.505] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0185.505] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0185.505] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0185.506] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.506] lstrlenW (lpString="csrss.exe") returned 9 [0185.506] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0185.506] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0185.506] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0185.506] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0185.506] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0185.506] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0185.506] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0185.506] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0185.506] lstrlenW (lpString="wininit.exe") returned 11 [0185.506] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0185.506] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0185.506] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0185.506] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0185.506] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0185.506] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0185.507] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0185.507] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0185.507] lstrlenW (lpString="csrss.exe") returned 9 [0185.507] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0185.507] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0185.507] lstrlenW (lpString="winlogon.exe") returned 12 [0185.507] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0185.508] lstrlenW (lpString="services.exe") returned 12 [0185.508] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0185.508] lstrlenW (lpString="lsass.exe") returned 9 [0185.508] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0185.508] lstrlenW (lpString="lsm.exe") returned 7 [0185.508] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.509] lstrlenW (lpString="svchost.exe") returned 11 [0185.509] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.509] lstrlenW (lpString="svchost.exe") returned 11 [0185.509] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.509] lstrlenW (lpString="svchost.exe") returned 11 [0185.509] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.509] lstrlenW (lpString="svchost.exe") returned 11 [0185.509] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.510] lstrlenW (lpString="svchost.exe") returned 11 [0185.510] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0185.510] lstrlenW (lpString="audiodg.exe") returned 11 [0185.510] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.510] lstrlenW (lpString="svchost.exe") returned 11 [0185.510] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0185.511] lstrlenW (lpString="explorer.exe") returned 12 [0185.511] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0185.511] lstrlenW (lpString="dwm.exe") returned 7 [0185.511] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.511] lstrlenW (lpString="svchost.exe") returned 11 [0185.511] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0185.512] lstrlenW (lpString="spoolsv.exe") returned 11 [0185.512] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0185.512] lstrlenW (lpString="reader_sl.exe") returned 13 [0185.512] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.512] lstrlenW (lpString="svchost.exe") returned 11 [0185.512] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0185.513] lstrlenW (lpString="taskhost.exe") returned 12 [0185.513] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0185.513] lstrlenW (lpString="svchost.exe") returned 11 [0185.513] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0185.513] lstrlenW (lpString="rundll32.exe") returned 12 [0185.513] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0185.514] lstrlenW (lpString="dinotify.exe") returned 12 [0185.514] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0185.514] lstrlenW (lpString="1Black.exe") returned 10 [0185.514] Process32NextW (in: hSnapshot=0x380, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0185.514] CloseHandle (hObject=0x380) returned 1 [0185.514] Sleep (dwMilliseconds=0x1f4) [0186.058] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x38c9e20 [0186.059] EnumServicesStatusExW (in: hSCManager=0x38c9e20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0186.059] GetLastError () returned 0xea [0186.059] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x3902bc0 [0186.059] EnumServicesStatusExW (in: hSCManager=0x38c9e20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3902bc0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3902bc0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0186.060] CloseServiceHandle (hSCObject=0x38c9e20) returned 1 [0186.060] lstrlenW (lpString="Appinfo") returned 7 [0186.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0186.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0186.060] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0186.060] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0186.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0186.060] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0186.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.060] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0186.060] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0186.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0186.060] lstrlenW (lpString="AudioSrv") returned 8 [0186.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0186.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0186.060] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0186.060] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0186.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0186.060] lstrlenW (lpString="BFE") returned 3 [0186.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0186.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0186.060] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0186.060] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0186.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0186.061] lstrlenW (lpString="CryptSvc") returned 8 [0186.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0186.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0186.061] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0186.061] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0186.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0186.061] lstrlenW (lpString="CscService") returned 10 [0186.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0186.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0186.061] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0186.061] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0186.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0186.061] lstrlenW (lpString="DcomLaunch") returned 10 [0186.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.061] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0186.061] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0186.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0186.061] lstrlenW (lpString="Dhcp") returned 4 [0186.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0186.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0186.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0186.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0186.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0186.061] lstrlenW (lpString="Dnscache") returned 8 [0186.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0186.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0186.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0186.061] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0186.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0186.061] lstrlenW (lpString="DPS") returned 3 [0186.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0186.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0186.061] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0186.061] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0186.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0186.062] lstrlenW (lpString="eventlog") returned 8 [0186.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0186.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0186.062] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0186.062] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0186.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0186.062] lstrlenW (lpString="EventSystem") returned 11 [0186.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0186.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0186.062] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0186.062] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0186.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0186.062] lstrlenW (lpString="FontCache") returned 9 [0186.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0186.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0186.062] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0186.062] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0186.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0186.062] lstrlenW (lpString="gpsvc") returned 5 [0186.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0186.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0186.062] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0186.062] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0186.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0186.062] lstrlenW (lpString="iphlpsvc") returned 8 [0186.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.062] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0186.062] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0186.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0186.062] lstrlenW (lpString="LanmanServer") returned 12 [0186.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0186.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0186.062] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0186.063] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0186.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0186.063] lstrlenW (lpString="LanmanWorkstation") returned 17 [0186.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.063] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0186.063] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0186.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0186.063] lstrlenW (lpString="lmhosts") returned 7 [0186.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0186.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0186.063] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0186.063] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0186.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0186.063] lstrlenW (lpString="MMCSS") returned 5 [0186.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0186.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0186.063] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0186.063] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0186.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0186.063] lstrlenW (lpString="MpsSvc") returned 6 [0186.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0186.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0186.063] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0186.063] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0186.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0186.063] lstrlenW (lpString="Netman") returned 6 [0186.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0186.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0186.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0186.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0186.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0186.063] lstrlenW (lpString="netprofm") returned 8 [0186.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0186.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0186.064] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0186.064] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0186.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0186.064] lstrlenW (lpString="NlaSvc") returned 6 [0186.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0186.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0186.064] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0186.064] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0186.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0186.064] lstrlenW (lpString="nsi") returned 3 [0186.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0186.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0186.064] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0186.064] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0186.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0186.064] lstrlenW (lpString="PcaSvc") returned 6 [0186.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0186.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0186.064] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0186.064] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0186.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0186.064] lstrlenW (lpString="PlugPlay") returned 8 [0186.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0186.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0186.064] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0186.064] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0186.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0186.064] lstrlenW (lpString="Power") returned 5 [0186.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0186.064] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0186.064] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0186.064] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0186.064] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0186.064] lstrlenW (lpString="ProfSvc") returned 7 [0186.064] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0186.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0186.065] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0186.065] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0186.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0186.065] lstrlenW (lpString="RpcEptMapper") returned 12 [0186.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.065] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0186.065] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0186.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0186.065] lstrlenW (lpString="RpcSs") returned 5 [0186.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0186.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0186.065] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0186.065] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0186.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0186.065] lstrlenW (lpString="SamSs") returned 5 [0186.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0186.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0186.065] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0186.065] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0186.065] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0186.065] lstrlenW (lpString="Schedule") returned 8 [0186.065] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0186.065] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0186.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0186.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0186.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0186.066] lstrlenW (lpString="SENS") returned 4 [0186.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0186.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0186.066] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0186.066] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0186.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0186.066] lstrlenW (lpString="ShellHWDetection") returned 16 [0186.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.066] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0186.066] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0186.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0186.066] lstrlenW (lpString="Spooler") returned 7 [0186.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0186.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0186.066] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0186.066] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0186.066] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0186.066] lstrlenW (lpString="SysMain") returned 7 [0186.066] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0186.066] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0186.066] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0186.067] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0186.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0186.067] lstrlenW (lpString="Themes") returned 6 [0186.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0186.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0186.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0186.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0186.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0186.067] lstrlenW (lpString="TrkWks") returned 6 [0186.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0186.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0186.067] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0186.067] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0186.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0186.067] lstrlenW (lpString="UxSms") returned 5 [0186.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0186.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0186.067] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0186.067] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0186.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0186.067] lstrlenW (lpString="WdiServiceHost") returned 14 [0186.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0186.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0186.067] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0186.067] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0186.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0186.067] lstrlenW (lpString="WdiSystemHost") returned 13 [0186.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0186.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0186.067] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0186.067] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0186.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0186.067] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0186.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0186.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0186.068] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0186.068] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0186.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0186.068] lstrlenW (lpString="Winmgmt") returned 7 [0186.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0186.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0186.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0186.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0186.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0186.068] lstrlenW (lpString="WPDBusEnum") returned 10 [0186.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0186.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0186.068] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0186.068] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0186.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0186.068] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x3902bc0 | out: hHeap=0x270000) returned 1 [0186.068] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x368 [0186.070] Process32FirstW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.070] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0186.070] lstrlenW (lpString="System") returned 6 [0186.070] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0186.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0186.071] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0186.071] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0186.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0186.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0186.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0186.071] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0186.071] lstrlenW (lpString="smss.exe") returned 8 [0186.071] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0186.071] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0186.071] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0186.071] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0186.071] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0186.071] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0186.071] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0186.071] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.071] lstrlenW (lpString="csrss.exe") returned 9 [0186.072] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0186.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0186.072] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0186.072] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0186.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0186.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0186.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0186.072] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0186.072] lstrlenW (lpString="wininit.exe") returned 11 [0186.072] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0186.072] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0186.072] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0186.072] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0186.072] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0186.072] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0186.072] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0186.072] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.073] lstrlenW (lpString="csrss.exe") returned 9 [0186.073] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0186.073] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0186.073] lstrlenW (lpString="winlogon.exe") returned 12 [0186.073] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0186.073] lstrlenW (lpString="services.exe") returned 12 [0186.073] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0186.074] lstrlenW (lpString="lsass.exe") returned 9 [0186.074] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0186.074] lstrlenW (lpString="lsm.exe") returned 7 [0186.074] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.074] lstrlenW (lpString="svchost.exe") returned 11 [0186.074] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.075] lstrlenW (lpString="svchost.exe") returned 11 [0186.075] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.075] lstrlenW (lpString="svchost.exe") returned 11 [0186.075] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.075] lstrlenW (lpString="svchost.exe") returned 11 [0186.075] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.076] lstrlenW (lpString="svchost.exe") returned 11 [0186.076] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0186.076] lstrlenW (lpString="audiodg.exe") returned 11 [0186.076] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.076] lstrlenW (lpString="svchost.exe") returned 11 [0186.076] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0186.077] lstrlenW (lpString="explorer.exe") returned 12 [0186.077] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0186.077] lstrlenW (lpString="dwm.exe") returned 7 [0186.077] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.077] lstrlenW (lpString="svchost.exe") returned 11 [0186.077] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0186.077] lstrlenW (lpString="spoolsv.exe") returned 11 [0186.077] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0186.078] lstrlenW (lpString="reader_sl.exe") returned 13 [0186.078] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.078] lstrlenW (lpString="svchost.exe") returned 11 [0186.078] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0186.078] lstrlenW (lpString="taskhost.exe") returned 12 [0186.078] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.079] lstrlenW (lpString="svchost.exe") returned 11 [0186.079] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0186.079] lstrlenW (lpString="rundll32.exe") returned 12 [0186.079] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0186.079] lstrlenW (lpString="dinotify.exe") returned 12 [0186.079] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0186.080] lstrlenW (lpString="1Black.exe") returned 10 [0186.080] Process32NextW (in: hSnapshot=0x368, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0186.080] CloseHandle (hObject=0x368) returned 1 [0186.080] Sleep (dwMilliseconds=0x1f4) [0186.651] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x38c9e20 [0186.652] EnumServicesStatusExW (in: hSCManager=0x38c9e20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0186.652] GetLastError () returned 0xea [0186.652] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x3902e50 [0186.652] EnumServicesStatusExW (in: hSCManager=0x38c9e20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3902e50, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3902e50, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0186.652] CloseServiceHandle (hSCObject=0x38c9e20) returned 1 [0186.653] lstrlenW (lpString="Appinfo") returned 7 [0186.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0186.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0186.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0186.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0186.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0186.653] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0186.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0186.653] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0186.653] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0186.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0186.653] lstrlenW (lpString="AudioSrv") returned 8 [0186.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0186.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0186.653] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0186.653] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0186.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0186.653] lstrlenW (lpString="BFE") returned 3 [0186.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0186.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0186.653] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0186.653] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0186.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0186.653] lstrlenW (lpString="CryptSvc") returned 8 [0186.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0186.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0186.653] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0186.653] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0186.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0186.653] lstrlenW (lpString="CscService") returned 10 [0186.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0186.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0186.654] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0186.654] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0186.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0186.654] lstrlenW (lpString="DcomLaunch") returned 10 [0186.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0186.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0186.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0186.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0186.654] lstrlenW (lpString="Dhcp") returned 4 [0186.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0186.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0186.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0186.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0186.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0186.654] lstrlenW (lpString="Dnscache") returned 8 [0186.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0186.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0186.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0186.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0186.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0186.654] lstrlenW (lpString="DPS") returned 3 [0186.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0186.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0186.654] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0186.654] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0186.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0186.654] lstrlenW (lpString="eventlog") returned 8 [0186.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0186.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0186.654] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0186.654] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0186.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0186.654] lstrlenW (lpString="EventSystem") returned 11 [0186.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0186.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0186.655] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0186.655] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0186.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0186.655] lstrlenW (lpString="FontCache") returned 9 [0186.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0186.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0186.655] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0186.655] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0186.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0186.655] lstrlenW (lpString="gpsvc") returned 5 [0186.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0186.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0186.655] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0186.655] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0186.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0186.655] lstrlenW (lpString="iphlpsvc") returned 8 [0186.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0186.655] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0186.655] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0186.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0186.655] lstrlenW (lpString="LanmanServer") returned 12 [0186.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0186.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0186.655] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0186.655] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0186.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0186.655] lstrlenW (lpString="LanmanWorkstation") returned 17 [0186.655] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.655] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0186.655] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0186.655] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0186.655] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0186.655] lstrlenW (lpString="lmhosts") returned 7 [0186.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0186.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0186.656] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0186.656] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0186.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0186.656] lstrlenW (lpString="MMCSS") returned 5 [0186.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0186.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0186.656] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0186.656] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0186.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0186.656] lstrlenW (lpString="MpsSvc") returned 6 [0186.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0186.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0186.656] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0186.656] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0186.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0186.656] lstrlenW (lpString="Netman") returned 6 [0186.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0186.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0186.656] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0186.656] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0186.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0186.656] lstrlenW (lpString="netprofm") returned 8 [0186.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0186.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0186.656] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0186.656] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0186.656] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0186.656] lstrlenW (lpString="NlaSvc") returned 6 [0186.656] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0186.656] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0186.656] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0186.656] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0186.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0186.657] lstrlenW (lpString="nsi") returned 3 [0186.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0186.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0186.657] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0186.657] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0186.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0186.657] lstrlenW (lpString="PcaSvc") returned 6 [0186.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0186.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0186.657] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0186.657] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0186.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0186.657] lstrlenW (lpString="PlugPlay") returned 8 [0186.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0186.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0186.657] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0186.657] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0186.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0186.657] lstrlenW (lpString="Power") returned 5 [0186.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0186.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0186.657] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0186.657] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0186.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0186.657] lstrlenW (lpString="ProfSvc") returned 7 [0186.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0186.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0186.657] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0186.657] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0186.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0186.657] lstrlenW (lpString="RpcEptMapper") returned 12 [0186.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0186.657] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0186.658] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0186.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0186.658] lstrlenW (lpString="RpcSs") returned 5 [0186.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0186.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0186.658] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0186.658] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0186.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0186.658] lstrlenW (lpString="SamSs") returned 5 [0186.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0186.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0186.658] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0186.658] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0186.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0186.658] lstrlenW (lpString="Schedule") returned 8 [0186.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0186.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0186.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0186.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0186.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0186.658] lstrlenW (lpString="SENS") returned 4 [0186.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0186.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0186.659] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0186.659] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0186.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0186.659] lstrlenW (lpString="ShellHWDetection") returned 16 [0186.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0186.659] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0186.659] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0186.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0186.659] lstrlenW (lpString="Spooler") returned 7 [0186.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0186.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0186.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0186.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0186.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0186.660] lstrlenW (lpString="SysMain") returned 7 [0186.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0186.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0186.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0186.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0186.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0186.660] lstrlenW (lpString="Themes") returned 6 [0186.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0186.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0186.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0186.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0186.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0186.660] lstrlenW (lpString="TrkWks") returned 6 [0186.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0186.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0186.660] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0186.660] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0186.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0186.660] lstrlenW (lpString="UxSms") returned 5 [0186.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0186.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0186.660] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0186.660] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0186.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0186.660] lstrlenW (lpString="WdiServiceHost") returned 14 [0186.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0186.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0186.660] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0186.660] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0186.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0186.660] lstrlenW (lpString="WdiSystemHost") returned 13 [0186.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0186.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0186.661] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0186.661] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0186.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0186.661] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0186.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0186.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0186.661] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0186.661] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0186.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0186.661] lstrlenW (lpString="Winmgmt") returned 7 [0186.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0186.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0186.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0186.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0186.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0186.661] lstrlenW (lpString="WPDBusEnum") returned 10 [0186.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0186.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0186.661] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0186.661] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0186.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0186.661] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x3902e50 | out: hHeap=0x270000) returned 1 [0186.661] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0186.663] Process32FirstW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0186.663] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0186.664] lstrlenW (lpString="System") returned 6 [0186.664] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0186.664] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0186.664] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0186.664] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0186.664] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0186.664] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0186.664] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0186.664] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0186.664] lstrlenW (lpString="smss.exe") returned 8 [0186.664] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0186.664] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0186.664] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0186.664] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0186.664] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0186.664] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0186.664] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0186.664] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.665] lstrlenW (lpString="csrss.exe") returned 9 [0186.665] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0186.665] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0186.665] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0186.665] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0186.665] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0186.665] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0186.665] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0186.665] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0186.665] lstrlenW (lpString="wininit.exe") returned 11 [0186.665] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0186.665] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0186.665] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0186.665] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0186.665] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0186.665] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0186.665] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0186.665] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0186.666] lstrlenW (lpString="csrss.exe") returned 9 [0186.666] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0186.666] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0186.666] lstrlenW (lpString="winlogon.exe") returned 12 [0186.666] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0186.666] lstrlenW (lpString="services.exe") returned 12 [0186.666] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0186.667] lstrlenW (lpString="lsass.exe") returned 9 [0186.667] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0186.667] lstrlenW (lpString="lsm.exe") returned 7 [0186.667] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.667] lstrlenW (lpString="svchost.exe") returned 11 [0186.667] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.668] lstrlenW (lpString="svchost.exe") returned 11 [0186.668] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.668] lstrlenW (lpString="svchost.exe") returned 11 [0186.668] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.668] lstrlenW (lpString="svchost.exe") returned 11 [0186.668] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.669] lstrlenW (lpString="svchost.exe") returned 11 [0186.669] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0186.669] lstrlenW (lpString="audiodg.exe") returned 11 [0186.669] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.669] lstrlenW (lpString="svchost.exe") returned 11 [0186.669] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0186.670] lstrlenW (lpString="explorer.exe") returned 12 [0186.670] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0186.670] lstrlenW (lpString="dwm.exe") returned 7 [0186.670] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.670] lstrlenW (lpString="svchost.exe") returned 11 [0186.670] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0186.671] lstrlenW (lpString="spoolsv.exe") returned 11 [0186.671] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0186.671] lstrlenW (lpString="reader_sl.exe") returned 13 [0186.671] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.671] lstrlenW (lpString="svchost.exe") returned 11 [0186.671] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0186.672] lstrlenW (lpString="taskhost.exe") returned 12 [0186.672] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0186.672] lstrlenW (lpString="svchost.exe") returned 11 [0186.672] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0186.672] lstrlenW (lpString="rundll32.exe") returned 12 [0186.672] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0186.673] lstrlenW (lpString="dinotify.exe") returned 12 [0186.673] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0186.673] lstrlenW (lpString="1Black.exe") returned 10 [0186.673] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0186.673] lstrlenW (lpString="consent.exe") returned 11 [0186.673] Process32NextW (in: hSnapshot=0x394, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x368, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0186.673] CloseHandle (hObject=0x394) returned 1 [0186.674] Sleep (dwMilliseconds=0x1f4) [0187.201] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x38c9e98 [0187.201] EnumServicesStatusExW (in: hSCManager=0x38c9e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0187.201] GetLastError () returned 0xea [0187.201] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x39029f0 [0187.202] EnumServicesStatusExW (in: hSCManager=0x38c9e98, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39029f0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39029f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0187.202] CloseServiceHandle (hSCObject=0x38c9e98) returned 1 [0187.203] lstrlenW (lpString="Appinfo") returned 7 [0187.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0187.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0187.203] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0187.203] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0187.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0187.203] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0187.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.203] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0187.203] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0187.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0187.203] lstrlenW (lpString="AudioSrv") returned 8 [0187.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0187.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0187.203] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0187.203] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0187.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0187.203] lstrlenW (lpString="BFE") returned 3 [0187.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0187.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0187.203] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0187.203] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0187.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0187.203] lstrlenW (lpString="CryptSvc") returned 8 [0187.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0187.203] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0187.203] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0187.203] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0187.203] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0187.203] lstrlenW (lpString="CscService") returned 10 [0187.203] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0187.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0187.204] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0187.204] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0187.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0187.204] lstrlenW (lpString="DcomLaunch") returned 10 [0187.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.204] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0187.204] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0187.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0187.204] lstrlenW (lpString="Dhcp") returned 4 [0187.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0187.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0187.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0187.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0187.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0187.204] lstrlenW (lpString="Dnscache") returned 8 [0187.204] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0187.204] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0187.204] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0187.204] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0187.204] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0187.205] lstrlenW (lpString="DPS") returned 3 [0187.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0187.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0187.205] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0187.205] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0187.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0187.205] lstrlenW (lpString="eventlog") returned 8 [0187.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0187.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0187.205] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0187.205] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0187.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0187.205] lstrlenW (lpString="EventSystem") returned 11 [0187.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0187.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0187.205] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0187.205] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0187.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0187.205] lstrlenW (lpString="FontCache") returned 9 [0187.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0187.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0187.205] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0187.205] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0187.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0187.205] lstrlenW (lpString="gpsvc") returned 5 [0187.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0187.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0187.205] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0187.205] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0187.205] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0187.205] lstrlenW (lpString="iphlpsvc") returned 8 [0187.205] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.205] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.206] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0187.206] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0187.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0187.206] lstrlenW (lpString="LanmanServer") returned 12 [0187.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0187.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0187.206] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0187.206] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0187.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0187.206] lstrlenW (lpString="LanmanWorkstation") returned 17 [0187.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.206] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0187.206] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0187.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0187.206] lstrlenW (lpString="lmhosts") returned 7 [0187.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0187.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0187.206] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0187.206] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0187.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0187.206] lstrlenW (lpString="MMCSS") returned 5 [0187.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0187.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0187.206] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0187.206] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0187.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0187.206] lstrlenW (lpString="MpsSvc") returned 6 [0187.206] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0187.206] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0187.206] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0187.206] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0187.206] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0187.206] lstrlenW (lpString="Netman") returned 6 [0187.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0187.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0187.207] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0187.207] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0187.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0187.207] lstrlenW (lpString="netprofm") returned 8 [0187.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0187.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0187.207] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0187.207] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0187.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0187.207] lstrlenW (lpString="NlaSvc") returned 6 [0187.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0187.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0187.207] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0187.207] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0187.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0187.207] lstrlenW (lpString="nsi") returned 3 [0187.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0187.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0187.207] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0187.207] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0187.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0187.207] lstrlenW (lpString="PcaSvc") returned 6 [0187.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0187.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0187.207] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0187.207] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0187.207] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0187.207] lstrlenW (lpString="PlugPlay") returned 8 [0187.207] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0187.207] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0187.207] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0187.207] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0187.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0187.208] lstrlenW (lpString="Power") returned 5 [0187.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0187.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0187.208] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0187.208] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0187.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0187.208] lstrlenW (lpString="ProfSvc") returned 7 [0187.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0187.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0187.208] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0187.208] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0187.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0187.208] lstrlenW (lpString="RpcEptMapper") returned 12 [0187.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.208] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0187.208] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0187.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0187.208] lstrlenW (lpString="RpcSs") returned 5 [0187.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0187.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0187.208] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0187.208] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0187.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0187.208] lstrlenW (lpString="SamSs") returned 5 [0187.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0187.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0187.208] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0187.208] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0187.208] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0187.208] lstrlenW (lpString="Schedule") returned 8 [0187.208] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0187.208] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0187.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0187.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0187.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0187.209] lstrlenW (lpString="SENS") returned 4 [0187.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0187.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0187.209] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0187.209] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0187.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0187.209] lstrlenW (lpString="ShellHWDetection") returned 16 [0187.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.209] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0187.209] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0187.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0187.209] lstrlenW (lpString="Spooler") returned 7 [0187.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0187.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0187.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0187.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0187.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0187.209] lstrlenW (lpString="SysMain") returned 7 [0187.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0187.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0187.209] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0187.209] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0187.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0187.209] lstrlenW (lpString="Themes") returned 6 [0187.209] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0187.209] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0187.209] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0187.209] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0187.209] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0187.210] lstrlenW (lpString="TrkWks") returned 6 [0187.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0187.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0187.210] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0187.210] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0187.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0187.210] lstrlenW (lpString="UxSms") returned 5 [0187.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0187.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0187.210] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0187.210] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0187.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0187.210] lstrlenW (lpString="WdiServiceHost") returned 14 [0187.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0187.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0187.210] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0187.210] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0187.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0187.210] lstrlenW (lpString="WdiSystemHost") returned 13 [0187.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0187.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0187.210] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0187.210] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0187.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0187.210] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0187.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0187.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0187.210] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0187.210] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0187.210] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0187.210] lstrlenW (lpString="Winmgmt") returned 7 [0187.210] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0187.210] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0187.210] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0187.211] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0187.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0187.211] lstrlenW (lpString="WPDBusEnum") returned 10 [0187.211] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0187.211] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0187.211] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0187.211] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0187.211] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0187.211] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x39029f0 | out: hHeap=0x270000) returned 1 [0187.211] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a8 [0187.213] Process32FirstW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.213] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0187.213] lstrlenW (lpString="System") returned 6 [0187.213] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0187.213] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0187.213] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0187.213] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0187.213] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0187.213] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0187.213] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0187.213] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0187.214] lstrlenW (lpString="smss.exe") returned 8 [0187.214] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0187.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0187.214] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0187.214] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0187.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0187.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0187.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0187.214] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.214] lstrlenW (lpString="csrss.exe") returned 9 [0187.214] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0187.214] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0187.214] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0187.214] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0187.214] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0187.214] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0187.214] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0187.215] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0187.215] lstrlenW (lpString="wininit.exe") returned 11 [0187.215] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0187.215] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0187.215] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0187.215] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0187.215] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0187.215] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0187.215] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0187.215] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.215] lstrlenW (lpString="csrss.exe") returned 9 [0187.215] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0187.215] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0187.216] lstrlenW (lpString="winlogon.exe") returned 12 [0187.216] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0187.216] lstrlenW (lpString="services.exe") returned 12 [0187.216] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0187.216] lstrlenW (lpString="lsass.exe") returned 9 [0187.216] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0187.217] lstrlenW (lpString="lsm.exe") returned 7 [0187.217] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.217] lstrlenW (lpString="svchost.exe") returned 11 [0187.217] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.217] lstrlenW (lpString="svchost.exe") returned 11 [0187.217] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.218] lstrlenW (lpString="svchost.exe") returned 11 [0187.218] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.218] lstrlenW (lpString="svchost.exe") returned 11 [0187.218] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.218] lstrlenW (lpString="svchost.exe") returned 11 [0187.218] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0187.219] lstrlenW (lpString="audiodg.exe") returned 11 [0187.219] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.219] lstrlenW (lpString="svchost.exe") returned 11 [0187.219] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0187.219] lstrlenW (lpString="explorer.exe") returned 12 [0187.219] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0187.220] lstrlenW (lpString="dwm.exe") returned 7 [0187.220] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.220] lstrlenW (lpString="svchost.exe") returned 11 [0187.220] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0187.221] lstrlenW (lpString="spoolsv.exe") returned 11 [0187.221] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0187.221] lstrlenW (lpString="reader_sl.exe") returned 13 [0187.221] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.221] lstrlenW (lpString="svchost.exe") returned 11 [0187.221] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0187.222] lstrlenW (lpString="taskhost.exe") returned 12 [0187.222] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.222] lstrlenW (lpString="svchost.exe") returned 11 [0187.222] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0187.222] lstrlenW (lpString="rundll32.exe") returned 12 [0187.222] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0187.223] lstrlenW (lpString="dinotify.exe") returned 12 [0187.223] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0187.223] lstrlenW (lpString="1Black.exe") returned 10 [0187.223] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0187.223] lstrlenW (lpString="consent.exe") returned 11 [0187.223] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0187.224] CloseHandle (hObject=0x3a8) returned 1 [0187.224] Sleep (dwMilliseconds=0x1f4) [0187.784] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x38c9f10 [0187.785] EnumServicesStatusExW (in: hSCManager=0x38c9f10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0187.785] GetLastError () returned 0xea [0187.785] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x3902e50 [0187.785] EnumServicesStatusExW (in: hSCManager=0x38c9f10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3902e50, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3902e50, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0187.786] CloseServiceHandle (hSCObject=0x38c9f10) returned 1 [0187.786] lstrlenW (lpString="Appinfo") returned 7 [0187.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0187.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0187.786] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0187.786] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0187.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0187.786] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0187.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0187.786] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0187.786] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0187.786] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0187.786] lstrlenW (lpString="AudioSrv") returned 8 [0187.786] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0187.786] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0187.786] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0187.787] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0187.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0187.787] lstrlenW (lpString="BFE") returned 3 [0187.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0187.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0187.787] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0187.787] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0187.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0187.787] lstrlenW (lpString="CryptSvc") returned 8 [0187.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0187.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0187.787] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0187.787] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0187.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0187.787] lstrlenW (lpString="CscService") returned 10 [0187.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0187.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0187.787] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0187.787] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0187.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0187.787] lstrlenW (lpString="DcomLaunch") returned 10 [0187.787] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.787] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0187.787] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0187.787] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0187.787] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0187.788] lstrlenW (lpString="Dhcp") returned 4 [0187.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0187.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0187.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0187.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0187.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0187.788] lstrlenW (lpString="Dnscache") returned 8 [0187.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0187.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0187.788] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0187.788] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0187.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0187.788] lstrlenW (lpString="DPS") returned 3 [0187.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0187.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0187.788] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0187.788] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0187.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0187.788] lstrlenW (lpString="eventlog") returned 8 [0187.788] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0187.788] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0187.788] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0187.788] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0187.788] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0187.788] lstrlenW (lpString="EventSystem") returned 11 [0187.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0187.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0187.789] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0187.789] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0187.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0187.789] lstrlenW (lpString="FontCache") returned 9 [0187.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0187.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0187.789] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0187.789] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0187.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0187.789] lstrlenW (lpString="gpsvc") returned 5 [0187.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0187.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0187.789] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0187.789] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0187.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0187.789] lstrlenW (lpString="iphlpsvc") returned 8 [0187.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0187.789] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0187.789] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0187.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0187.789] lstrlenW (lpString="LanmanServer") returned 12 [0187.789] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0187.789] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0187.789] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0187.789] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0187.789] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0187.789] lstrlenW (lpString="LanmanWorkstation") returned 17 [0187.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0187.790] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0187.790] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0187.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0187.790] lstrlenW (lpString="lmhosts") returned 7 [0187.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0187.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0187.790] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0187.790] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0187.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0187.790] lstrlenW (lpString="MMCSS") returned 5 [0187.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0187.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0187.790] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0187.790] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0187.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0187.790] lstrlenW (lpString="MpsSvc") returned 6 [0187.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0187.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0187.790] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0187.790] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0187.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0187.790] lstrlenW (lpString="Netman") returned 6 [0187.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0187.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0187.790] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0187.790] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0187.790] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0187.790] lstrlenW (lpString="netprofm") returned 8 [0187.790] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0187.790] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0187.790] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0187.791] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0187.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0187.791] lstrlenW (lpString="NlaSvc") returned 6 [0187.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0187.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0187.791] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0187.791] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0187.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0187.791] lstrlenW (lpString="nsi") returned 3 [0187.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0187.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0187.791] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0187.791] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0187.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0187.791] lstrlenW (lpString="PcaSvc") returned 6 [0187.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0187.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0187.791] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0187.791] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0187.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0187.791] lstrlenW (lpString="PlugPlay") returned 8 [0187.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0187.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0187.791] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0187.791] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0187.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0187.791] lstrlenW (lpString="Power") returned 5 [0187.791] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0187.791] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0187.791] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0187.791] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0187.791] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0187.791] lstrlenW (lpString="ProfSvc") returned 7 [0187.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0187.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0187.792] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0187.792] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0187.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0187.792] lstrlenW (lpString="RpcEptMapper") returned 12 [0187.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0187.792] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0187.792] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0187.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0187.792] lstrlenW (lpString="RpcSs") returned 5 [0187.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0187.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0187.792] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0187.792] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0187.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0187.792] lstrlenW (lpString="SamSs") returned 5 [0187.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0187.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0187.792] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0187.792] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0187.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0187.792] lstrlenW (lpString="Schedule") returned 8 [0187.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0187.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0187.792] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0187.792] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0187.792] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0187.792] lstrlenW (lpString="SENS") returned 4 [0187.792] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0187.792] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0187.792] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0187.793] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0187.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0187.793] lstrlenW (lpString="ShellHWDetection") returned 16 [0187.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0187.793] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0187.793] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0187.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0187.793] lstrlenW (lpString="Spooler") returned 7 [0187.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0187.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0187.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0187.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0187.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0187.793] lstrlenW (lpString="SysMain") returned 7 [0187.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0187.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0187.793] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0187.793] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0187.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0187.793] lstrlenW (lpString="Themes") returned 6 [0187.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0187.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0187.793] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0187.793] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0187.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0187.793] lstrlenW (lpString="TrkWks") returned 6 [0187.793] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0187.793] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0187.793] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0187.793] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0187.793] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0187.793] lstrlenW (lpString="UxSms") returned 5 [0187.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0187.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0187.794] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0187.794] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0187.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0187.794] lstrlenW (lpString="WdiServiceHost") returned 14 [0187.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0187.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0187.794] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0187.794] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0187.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0187.794] lstrlenW (lpString="WdiSystemHost") returned 13 [0187.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0187.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0187.794] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0187.794] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0187.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0187.794] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0187.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0187.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0187.794] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0187.794] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0187.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0187.794] lstrlenW (lpString="Winmgmt") returned 7 [0187.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0187.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0187.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0187.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0187.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0187.794] lstrlenW (lpString="WPDBusEnum") returned 10 [0187.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0187.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0187.794] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0187.795] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0187.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0187.795] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x3902e50 | out: hHeap=0x270000) returned 1 [0187.795] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0187.796] Process32FirstW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0187.799] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0187.799] lstrlenW (lpString="System") returned 6 [0187.799] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0187.799] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0187.799] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0187.799] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0187.799] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0187.799] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0187.799] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0187.799] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0187.799] lstrlenW (lpString="smss.exe") returned 8 [0187.800] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0187.800] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0187.800] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0187.800] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0187.800] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0187.800] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0187.800] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0187.800] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.800] lstrlenW (lpString="csrss.exe") returned 9 [0187.800] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0187.800] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0187.800] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0187.800] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0187.800] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0187.800] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0187.800] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0187.801] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0187.801] lstrlenW (lpString="wininit.exe") returned 11 [0187.801] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0187.801] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0187.801] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0187.801] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0187.801] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0187.801] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0187.801] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0187.801] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0187.801] lstrlenW (lpString="csrss.exe") returned 9 [0187.801] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0187.802] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0187.802] lstrlenW (lpString="winlogon.exe") returned 12 [0187.802] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0187.802] lstrlenW (lpString="services.exe") returned 12 [0187.802] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0187.802] lstrlenW (lpString="lsass.exe") returned 9 [0187.803] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0187.803] lstrlenW (lpString="lsm.exe") returned 7 [0187.803] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.803] lstrlenW (lpString="svchost.exe") returned 11 [0187.803] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.804] lstrlenW (lpString="svchost.exe") returned 11 [0187.804] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.804] lstrlenW (lpString="svchost.exe") returned 11 [0187.804] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.804] lstrlenW (lpString="svchost.exe") returned 11 [0187.804] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.805] lstrlenW (lpString="svchost.exe") returned 11 [0187.805] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0187.805] lstrlenW (lpString="audiodg.exe") returned 11 [0187.805] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.805] lstrlenW (lpString="svchost.exe") returned 11 [0187.806] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0187.806] lstrlenW (lpString="explorer.exe") returned 12 [0187.806] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0187.806] lstrlenW (lpString="dwm.exe") returned 7 [0187.806] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.806] lstrlenW (lpString="svchost.exe") returned 11 [0187.807] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0187.807] lstrlenW (lpString="spoolsv.exe") returned 11 [0187.807] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0187.807] lstrlenW (lpString="reader_sl.exe") returned 13 [0187.807] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.808] lstrlenW (lpString="svchost.exe") returned 11 [0187.808] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0187.808] lstrlenW (lpString="taskhost.exe") returned 12 [0187.808] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0187.809] lstrlenW (lpString="svchost.exe") returned 11 [0187.809] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0187.809] lstrlenW (lpString="rundll32.exe") returned 12 [0187.809] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0187.812] lstrlenW (lpString="dinotify.exe") returned 12 [0187.812] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0187.812] lstrlenW (lpString="1Black.exe") returned 10 [0187.812] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0187.813] lstrlenW (lpString="consent.exe") returned 11 [0187.813] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0187.813] CloseHandle (hObject=0x39c) returned 1 [0187.813] Sleep (dwMilliseconds=0x1f4) [0188.339] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x365528 [0188.340] EnumServicesStatusExW (in: hSCManager=0x365528, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0188.340] GetLastError () returned 0xea [0188.340] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x39029f0 [0188.340] EnumServicesStatusExW (in: hSCManager=0x365528, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39029f0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39029f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0188.341] CloseServiceHandle (hSCObject=0x365528) returned 1 [0188.341] lstrlenW (lpString="Appinfo") returned 7 [0188.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0188.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0188.341] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0188.341] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0188.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0188.341] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0188.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.341] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0188.341] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0188.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0188.341] lstrlenW (lpString="AudioSrv") returned 8 [0188.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0188.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0188.341] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0188.341] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0188.341] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0188.341] lstrlenW (lpString="BFE") returned 3 [0188.341] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0188.341] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0188.341] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0188.341] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0188.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0188.342] lstrlenW (lpString="CryptSvc") returned 8 [0188.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0188.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0188.342] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0188.342] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0188.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0188.342] lstrlenW (lpString="CscService") returned 10 [0188.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0188.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0188.342] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0188.342] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0188.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0188.342] lstrlenW (lpString="DcomLaunch") returned 10 [0188.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.342] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0188.342] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0188.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0188.342] lstrlenW (lpString="Dhcp") returned 4 [0188.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0188.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0188.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0188.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0188.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0188.342] lstrlenW (lpString="Dnscache") returned 8 [0188.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0188.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0188.342] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0188.342] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0188.342] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0188.342] lstrlenW (lpString="DPS") returned 3 [0188.342] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0188.342] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0188.343] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0188.343] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0188.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0188.343] lstrlenW (lpString="eventlog") returned 8 [0188.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0188.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0188.343] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0188.343] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0188.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0188.343] lstrlenW (lpString="EventSystem") returned 11 [0188.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0188.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0188.343] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0188.343] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0188.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0188.343] lstrlenW (lpString="FontCache") returned 9 [0188.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0188.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0188.343] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0188.343] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0188.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0188.343] lstrlenW (lpString="gpsvc") returned 5 [0188.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0188.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0188.343] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0188.343] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0188.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0188.343] lstrlenW (lpString="iphlpsvc") returned 8 [0188.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.343] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0188.343] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0188.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0188.343] lstrlenW (lpString="LanmanServer") returned 12 [0188.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0188.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0188.344] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0188.344] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0188.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0188.344] lstrlenW (lpString="LanmanWorkstation") returned 17 [0188.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.344] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0188.344] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0188.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0188.344] lstrlenW (lpString="lmhosts") returned 7 [0188.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0188.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0188.344] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0188.344] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0188.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0188.344] lstrlenW (lpString="MMCSS") returned 5 [0188.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0188.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0188.344] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0188.344] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0188.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0188.344] lstrlenW (lpString="MpsSvc") returned 6 [0188.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0188.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0188.344] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0188.344] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0188.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0188.344] lstrlenW (lpString="Netman") returned 6 [0188.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0188.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0188.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0188.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0188.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0188.345] lstrlenW (lpString="netprofm") returned 8 [0188.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0188.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0188.345] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0188.345] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0188.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0188.345] lstrlenW (lpString="NlaSvc") returned 6 [0188.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0188.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0188.345] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0188.345] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0188.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0188.345] lstrlenW (lpString="nsi") returned 3 [0188.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0188.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0188.345] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0188.345] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0188.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0188.345] lstrlenW (lpString="PcaSvc") returned 6 [0188.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0188.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0188.345] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0188.345] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0188.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0188.345] lstrlenW (lpString="PlugPlay") returned 8 [0188.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0188.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0188.345] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0188.345] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0188.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0188.345] lstrlenW (lpString="Power") returned 5 [0188.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0188.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0188.345] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0188.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0188.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0188.346] lstrlenW (lpString="ProfSvc") returned 7 [0188.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0188.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0188.346] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0188.346] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0188.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0188.346] lstrlenW (lpString="RpcEptMapper") returned 12 [0188.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.346] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0188.346] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0188.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0188.346] lstrlenW (lpString="RpcSs") returned 5 [0188.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0188.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0188.346] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0188.346] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0188.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0188.346] lstrlenW (lpString="SamSs") returned 5 [0188.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0188.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0188.346] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0188.346] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0188.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0188.346] lstrlenW (lpString="Schedule") returned 8 [0188.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0188.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0188.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0188.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0188.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0188.346] lstrlenW (lpString="SENS") returned 4 [0188.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0188.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0188.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0188.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0188.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0188.347] lstrlenW (lpString="ShellHWDetection") returned 16 [0188.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.347] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0188.347] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0188.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0188.347] lstrlenW (lpString="Spooler") returned 7 [0188.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0188.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0188.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0188.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0188.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0188.347] lstrlenW (lpString="SysMain") returned 7 [0188.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0188.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0188.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0188.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0188.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0188.347] lstrlenW (lpString="Themes") returned 6 [0188.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0188.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0188.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0188.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0188.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0188.347] lstrlenW (lpString="TrkWks") returned 6 [0188.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0188.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0188.347] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0188.347] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0188.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0188.348] lstrlenW (lpString="UxSms") returned 5 [0188.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0188.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0188.348] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0188.348] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0188.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0188.348] lstrlenW (lpString="WdiServiceHost") returned 14 [0188.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0188.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0188.348] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0188.348] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0188.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0188.348] lstrlenW (lpString="WdiSystemHost") returned 13 [0188.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0188.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0188.348] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0188.348] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0188.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0188.348] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0188.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0188.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0188.348] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0188.348] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0188.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0188.348] lstrlenW (lpString="Winmgmt") returned 7 [0188.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0188.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0188.348] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0188.348] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0188.348] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0188.348] lstrlenW (lpString="WPDBusEnum") returned 10 [0188.348] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0188.348] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0188.348] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0188.348] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0188.349] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0188.349] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x39029f0 | out: hHeap=0x270000) returned 1 [0188.349] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0188.350] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.351] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0188.351] lstrlenW (lpString="System") returned 6 [0188.351] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0188.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0188.351] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0188.351] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0188.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0188.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0188.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0188.351] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0188.352] lstrlenW (lpString="smss.exe") returned 8 [0188.352] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0188.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0188.352] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0188.352] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0188.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0188.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0188.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0188.352] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.352] lstrlenW (lpString="csrss.exe") returned 9 [0188.352] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0188.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0188.352] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0188.352] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0188.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0188.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0188.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0188.352] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0188.353] lstrlenW (lpString="wininit.exe") returned 11 [0188.353] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0188.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0188.353] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0188.353] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0188.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0188.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0188.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0188.353] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.353] lstrlenW (lpString="csrss.exe") returned 9 [0188.353] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0188.353] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0188.353] lstrlenW (lpString="winlogon.exe") returned 12 [0188.354] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0188.354] lstrlenW (lpString="services.exe") returned 12 [0188.354] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0188.354] lstrlenW (lpString="lsass.exe") returned 9 [0188.354] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0188.354] lstrlenW (lpString="lsm.exe") returned 7 [0188.355] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.355] lstrlenW (lpString="svchost.exe") returned 11 [0188.355] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.355] lstrlenW (lpString="svchost.exe") returned 11 [0188.355] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.355] lstrlenW (lpString="svchost.exe") returned 11 [0188.355] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.356] lstrlenW (lpString="svchost.exe") returned 11 [0188.356] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.356] lstrlenW (lpString="svchost.exe") returned 11 [0188.356] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0188.356] lstrlenW (lpString="audiodg.exe") returned 11 [0188.356] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.357] lstrlenW (lpString="svchost.exe") returned 11 [0188.357] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0188.357] lstrlenW (lpString="explorer.exe") returned 12 [0188.357] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0188.357] lstrlenW (lpString="dwm.exe") returned 7 [0188.357] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.358] lstrlenW (lpString="svchost.exe") returned 11 [0188.358] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0188.358] lstrlenW (lpString="spoolsv.exe") returned 11 [0188.358] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0188.358] lstrlenW (lpString="reader_sl.exe") returned 13 [0188.358] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.359] lstrlenW (lpString="svchost.exe") returned 11 [0188.359] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0188.359] lstrlenW (lpString="taskhost.exe") returned 12 [0188.359] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.359] lstrlenW (lpString="svchost.exe") returned 11 [0188.359] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0188.360] lstrlenW (lpString="rundll32.exe") returned 12 [0188.360] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0188.360] lstrlenW (lpString="dinotify.exe") returned 12 [0188.360] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0188.360] lstrlenW (lpString="1Black.exe") returned 10 [0188.360] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0188.361] lstrlenW (lpString="consent.exe") returned 11 [0188.361] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0188.361] lstrlenW (lpString="dllhost.exe") returned 11 [0188.361] Process32NextW (in: hSnapshot=0x3a0, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0188.361] CloseHandle (hObject=0x3a0) returned 1 [0188.362] Sleep (dwMilliseconds=0x1f4) [0188.883] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x38c9f10 [0188.884] EnumServicesStatusExW (in: hSCManager=0x38c9f10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0188.885] GetLastError () returned 0xea [0188.885] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x39029f0 [0188.885] EnumServicesStatusExW (in: hSCManager=0x38c9f10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39029f0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39029f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0188.886] CloseServiceHandle (hSCObject=0x38c9f10) returned 1 [0188.886] lstrlenW (lpString="Appinfo") returned 7 [0188.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0188.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0188.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0188.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0188.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0188.886] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0188.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0188.886] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0188.886] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0188.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0188.886] lstrlenW (lpString="AudioSrv") returned 8 [0188.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0188.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0188.887] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0188.887] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0188.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0188.887] lstrlenW (lpString="BFE") returned 3 [0188.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0188.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0188.887] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0188.887] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0188.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0188.887] lstrlenW (lpString="CryptSvc") returned 8 [0188.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0188.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0188.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0188.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0188.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0188.887] lstrlenW (lpString="CscService") returned 10 [0188.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0188.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0188.887] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0188.887] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0188.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0188.887] lstrlenW (lpString="DcomLaunch") returned 10 [0188.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0188.887] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0188.887] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0188.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0188.887] lstrlenW (lpString="Dhcp") returned 4 [0188.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0188.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0188.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0188.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0188.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0188.887] lstrlenW (lpString="Dnscache") returned 8 [0188.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0188.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0188.888] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0188.888] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0188.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0188.888] lstrlenW (lpString="DPS") returned 3 [0188.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0188.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0188.888] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0188.888] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0188.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0188.888] lstrlenW (lpString="eventlog") returned 8 [0188.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0188.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0188.888] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0188.888] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0188.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0188.888] lstrlenW (lpString="EventSystem") returned 11 [0188.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0188.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0188.888] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0188.888] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0188.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0188.888] lstrlenW (lpString="FontCache") returned 9 [0188.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0188.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0188.888] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0188.888] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0188.888] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0188.888] lstrlenW (lpString="gpsvc") returned 5 [0188.888] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0188.888] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0188.888] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0188.888] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0188.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0188.889] lstrlenW (lpString="iphlpsvc") returned 8 [0188.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0188.889] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0188.889] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0188.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0188.889] lstrlenW (lpString="LanmanServer") returned 12 [0188.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0188.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0188.889] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0188.889] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0188.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0188.889] lstrlenW (lpString="LanmanWorkstation") returned 17 [0188.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0188.889] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0188.889] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0188.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0188.889] lstrlenW (lpString="lmhosts") returned 7 [0188.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0188.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0188.889] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0188.889] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0188.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0188.889] lstrlenW (lpString="MMCSS") returned 5 [0188.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0188.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0188.889] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0188.889] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0188.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0188.889] lstrlenW (lpString="MpsSvc") returned 6 [0188.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0188.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0188.890] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0188.890] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0188.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0188.890] lstrlenW (lpString="Netman") returned 6 [0188.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0188.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0188.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0188.890] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0188.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0188.890] lstrlenW (lpString="netprofm") returned 8 [0188.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0188.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0188.890] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0188.890] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0188.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0188.890] lstrlenW (lpString="NlaSvc") returned 6 [0188.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0188.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0188.890] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0188.890] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0188.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0188.890] lstrlenW (lpString="nsi") returned 3 [0188.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0188.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0188.890] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0188.890] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0188.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0188.890] lstrlenW (lpString="PcaSvc") returned 6 [0188.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0188.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0188.890] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0188.890] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0188.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0188.890] lstrlenW (lpString="PlugPlay") returned 8 [0188.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0188.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0188.891] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0188.891] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0188.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0188.891] lstrlenW (lpString="Power") returned 5 [0188.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0188.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0188.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0188.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0188.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0188.891] lstrlenW (lpString="ProfSvc") returned 7 [0188.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0188.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0188.891] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0188.891] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0188.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0188.891] lstrlenW (lpString="RpcEptMapper") returned 12 [0188.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0188.891] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0188.891] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0188.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0188.891] lstrlenW (lpString="RpcSs") returned 5 [0188.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0188.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0188.891] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0188.891] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0188.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0188.891] lstrlenW (lpString="SamSs") returned 5 [0188.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0188.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0188.891] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0188.891] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0188.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0188.892] lstrlenW (lpString="Schedule") returned 8 [0188.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0188.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0188.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0188.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0188.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0188.892] lstrlenW (lpString="SENS") returned 4 [0188.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0188.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0188.892] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0188.892] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0188.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0188.892] lstrlenW (lpString="ShellHWDetection") returned 16 [0188.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0188.892] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0188.892] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0188.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0188.892] lstrlenW (lpString="Spooler") returned 7 [0188.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0188.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0188.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0188.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0188.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0188.892] lstrlenW (lpString="SysMain") returned 7 [0188.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0188.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0188.892] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0188.892] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0188.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0188.892] lstrlenW (lpString="Themes") returned 6 [0188.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0188.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0188.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0188.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0188.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0188.893] lstrlenW (lpString="TrkWks") returned 6 [0188.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0188.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0188.893] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0188.893] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0188.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0188.893] lstrlenW (lpString="UxSms") returned 5 [0188.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0188.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0188.893] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0188.893] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0188.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0188.893] lstrlenW (lpString="WdiServiceHost") returned 14 [0188.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0188.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0188.893] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0188.893] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0188.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0188.893] lstrlenW (lpString="WdiSystemHost") returned 13 [0188.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0188.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0188.893] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0188.893] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0188.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0188.893] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0188.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0188.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0188.893] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0188.893] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0188.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0188.893] lstrlenW (lpString="Winmgmt") returned 7 [0188.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0188.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0188.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0188.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0188.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0188.894] lstrlenW (lpString="WPDBusEnum") returned 10 [0188.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0188.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0188.894] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0188.894] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0188.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0188.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x39029f0 | out: hHeap=0x270000) returned 1 [0188.894] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a8 [0188.896] Process32FirstW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0188.896] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0188.896] lstrlenW (lpString="System") returned 6 [0188.896] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0188.896] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0188.896] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0188.896] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0188.896] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0188.896] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0188.896] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0188.896] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0188.897] lstrlenW (lpString="smss.exe") returned 8 [0188.897] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0188.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0188.897] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0188.897] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0188.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0188.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0188.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0188.897] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.897] lstrlenW (lpString="csrss.exe") returned 9 [0188.897] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0188.897] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0188.897] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0188.897] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0188.897] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0188.897] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0188.897] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0188.897] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0188.898] lstrlenW (lpString="wininit.exe") returned 11 [0188.898] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0188.898] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0188.898] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0188.898] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0188.898] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0188.898] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0188.898] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0188.898] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0188.898] lstrlenW (lpString="csrss.exe") returned 9 [0188.898] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0188.898] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0188.899] lstrlenW (lpString="winlogon.exe") returned 12 [0188.899] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0188.899] lstrlenW (lpString="services.exe") returned 12 [0188.899] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0188.899] lstrlenW (lpString="lsass.exe") returned 9 [0188.899] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0188.900] lstrlenW (lpString="lsm.exe") returned 7 [0188.900] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.900] lstrlenW (lpString="svchost.exe") returned 11 [0188.900] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.900] lstrlenW (lpString="svchost.exe") returned 11 [0188.900] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.901] lstrlenW (lpString="svchost.exe") returned 11 [0188.901] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.901] lstrlenW (lpString="svchost.exe") returned 11 [0188.901] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.901] lstrlenW (lpString="svchost.exe") returned 11 [0188.901] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0188.902] lstrlenW (lpString="audiodg.exe") returned 11 [0188.902] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.902] lstrlenW (lpString="svchost.exe") returned 11 [0188.902] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0188.902] lstrlenW (lpString="explorer.exe") returned 12 [0188.902] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0188.903] lstrlenW (lpString="dwm.exe") returned 7 [0188.903] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.903] lstrlenW (lpString="svchost.exe") returned 11 [0188.903] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0188.903] lstrlenW (lpString="spoolsv.exe") returned 11 [0188.903] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0188.904] lstrlenW (lpString="reader_sl.exe") returned 13 [0188.904] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.904] lstrlenW (lpString="svchost.exe") returned 11 [0188.904] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0188.904] lstrlenW (lpString="taskhost.exe") returned 12 [0188.904] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0188.905] lstrlenW (lpString="svchost.exe") returned 11 [0188.905] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0188.905] lstrlenW (lpString="rundll32.exe") returned 12 [0188.905] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0188.905] lstrlenW (lpString="dinotify.exe") returned 12 [0188.905] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0188.905] lstrlenW (lpString="1Black.exe") returned 10 [0188.906] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0188.906] lstrlenW (lpString="consent.exe") returned 11 [0188.906] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0188.906] lstrlenW (lpString="dllhost.exe") returned 11 [0188.906] Process32NextW (in: hSnapshot=0x3a8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0188.907] CloseHandle (hObject=0x3a8) returned 1 [0188.907] Sleep (dwMilliseconds=0x1f4) [0189.569] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x39567c0 [0189.569] EnumServicesStatusExW (in: hSCManager=0x39567c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0189.570] GetLastError () returned 0xea [0189.570] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x39029f0 [0189.570] EnumServicesStatusExW (in: hSCManager=0x39567c0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39029f0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39029f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0189.571] CloseServiceHandle (hSCObject=0x39567c0) returned 1 [0189.571] lstrlenW (lpString="Appinfo") returned 7 [0189.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0189.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0189.571] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0189.571] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0189.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0189.571] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0189.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0189.571] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0189.571] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0189.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0189.571] lstrlenW (lpString="AudioSrv") returned 8 [0189.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0189.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0189.571] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0189.571] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0189.571] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0189.571] lstrlenW (lpString="BFE") returned 3 [0189.571] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0189.571] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0189.571] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0189.571] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0189.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0189.572] lstrlenW (lpString="CryptSvc") returned 8 [0189.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0189.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0189.572] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0189.572] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0189.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0189.572] lstrlenW (lpString="CscService") returned 10 [0189.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0189.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0189.572] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0189.572] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0189.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0189.572] lstrlenW (lpString="DcomLaunch") returned 10 [0189.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0189.572] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0189.572] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0189.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0189.572] lstrlenW (lpString="Dhcp") returned 4 [0189.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0189.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0189.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0189.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0189.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0189.572] lstrlenW (lpString="Dnscache") returned 8 [0189.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0189.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0189.572] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0189.572] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0189.572] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0189.572] lstrlenW (lpString="DPS") returned 3 [0189.572] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0189.572] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0189.572] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0189.573] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0189.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0189.573] lstrlenW (lpString="eventlog") returned 8 [0189.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0189.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0189.573] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0189.573] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0189.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0189.573] lstrlenW (lpString="EventSystem") returned 11 [0189.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0189.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0189.573] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0189.573] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0189.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0189.573] lstrlenW (lpString="FontCache") returned 9 [0189.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0189.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0189.573] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0189.573] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0189.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0189.573] lstrlenW (lpString="gpsvc") returned 5 [0189.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0189.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0189.573] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0189.573] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0189.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0189.573] lstrlenW (lpString="iphlpsvc") returned 8 [0189.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0189.573] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0189.573] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0189.573] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0189.573] lstrlenW (lpString="LanmanServer") returned 12 [0189.573] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0189.573] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0189.573] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0189.574] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0189.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0189.574] lstrlenW (lpString="LanmanWorkstation") returned 17 [0189.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0189.574] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0189.574] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0189.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0189.574] lstrlenW (lpString="lmhosts") returned 7 [0189.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0189.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0189.574] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0189.574] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0189.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0189.574] lstrlenW (lpString="MMCSS") returned 5 [0189.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0189.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0189.574] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0189.574] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0189.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0189.574] lstrlenW (lpString="MpsSvc") returned 6 [0189.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0189.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0189.574] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0189.574] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0189.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0189.574] lstrlenW (lpString="Netman") returned 6 [0189.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0189.574] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0189.574] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0189.574] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0189.574] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0189.574] lstrlenW (lpString="netprofm") returned 8 [0189.574] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0189.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0189.575] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0189.575] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0189.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0189.575] lstrlenW (lpString="NlaSvc") returned 6 [0189.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0189.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0189.575] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0189.575] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0189.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0189.575] lstrlenW (lpString="nsi") returned 3 [0189.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0189.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0189.575] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0189.575] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0189.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0189.575] lstrlenW (lpString="PcaSvc") returned 6 [0189.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0189.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0189.575] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0189.575] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0189.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0189.575] lstrlenW (lpString="PlugPlay") returned 8 [0189.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0189.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0189.575] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0189.575] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0189.575] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0189.575] lstrlenW (lpString="Power") returned 5 [0189.575] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0189.575] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0189.575] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0189.575] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0189.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0189.576] lstrlenW (lpString="ProfSvc") returned 7 [0189.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0189.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0189.576] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0189.576] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0189.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0189.576] lstrlenW (lpString="RpcEptMapper") returned 12 [0189.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0189.576] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0189.576] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0189.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0189.576] lstrlenW (lpString="RpcSs") returned 5 [0189.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0189.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0189.576] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0189.576] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0189.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0189.576] lstrlenW (lpString="SamSs") returned 5 [0189.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0189.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0189.576] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0189.576] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0189.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0189.576] lstrlenW (lpString="Schedule") returned 8 [0189.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0189.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0189.576] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0189.576] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0189.576] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0189.576] lstrlenW (lpString="SENS") returned 4 [0189.576] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0189.576] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0189.576] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0189.576] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0189.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0189.577] lstrlenW (lpString="ShellHWDetection") returned 16 [0189.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0189.577] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0189.577] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0189.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0189.577] lstrlenW (lpString="Spooler") returned 7 [0189.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0189.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0189.577] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0189.577] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0189.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0189.577] lstrlenW (lpString="SysMain") returned 7 [0189.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0189.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0189.577] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0189.577] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0189.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0189.577] lstrlenW (lpString="Themes") returned 6 [0189.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0189.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0189.577] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0189.577] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0189.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0189.577] lstrlenW (lpString="TrkWks") returned 6 [0189.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0189.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0189.577] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0189.577] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0189.577] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0189.577] lstrlenW (lpString="UxSms") returned 5 [0189.577] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0189.577] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0189.577] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0189.578] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0189.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0189.578] lstrlenW (lpString="WdiServiceHost") returned 14 [0189.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0189.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0189.578] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0189.578] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0189.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0189.578] lstrlenW (lpString="WdiSystemHost") returned 13 [0189.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0189.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0189.578] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0189.578] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0189.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0189.578] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0189.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0189.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0189.578] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0189.578] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0189.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0189.578] lstrlenW (lpString="Winmgmt") returned 7 [0189.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0189.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0189.578] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0189.578] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0189.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0189.578] lstrlenW (lpString="WPDBusEnum") returned 10 [0189.578] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0189.578] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0189.578] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0189.578] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0189.578] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0189.578] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x39029f0 | out: hHeap=0x270000) returned 1 [0189.579] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0189.580] Process32FirstW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0189.581] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0189.581] lstrlenW (lpString="System") returned 6 [0189.581] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0189.581] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0189.581] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0189.581] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0189.581] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0189.581] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0189.581] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0189.581] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0189.581] lstrlenW (lpString="smss.exe") returned 8 [0189.581] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0189.581] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0189.581] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0189.581] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0189.581] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0189.582] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0189.582] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0189.582] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.582] lstrlenW (lpString="csrss.exe") returned 9 [0189.582] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0189.582] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0189.582] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0189.582] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0189.582] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0189.582] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0189.582] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0189.582] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0189.582] lstrlenW (lpString="wininit.exe") returned 11 [0189.582] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0189.582] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0189.582] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0189.582] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0189.583] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0189.583] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0189.583] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0189.583] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0189.583] lstrlenW (lpString="csrss.exe") returned 9 [0189.583] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0189.583] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0189.583] lstrlenW (lpString="winlogon.exe") returned 12 [0189.583] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0189.584] lstrlenW (lpString="services.exe") returned 12 [0189.584] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0189.584] lstrlenW (lpString="lsass.exe") returned 9 [0189.584] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0189.584] lstrlenW (lpString="lsm.exe") returned 7 [0189.584] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.585] lstrlenW (lpString="svchost.exe") returned 11 [0189.585] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.585] lstrlenW (lpString="svchost.exe") returned 11 [0189.585] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.585] lstrlenW (lpString="svchost.exe") returned 11 [0189.585] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.586] lstrlenW (lpString="svchost.exe") returned 11 [0189.586] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.586] lstrlenW (lpString="svchost.exe") returned 11 [0189.586] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0189.586] lstrlenW (lpString="audiodg.exe") returned 11 [0189.586] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.586] lstrlenW (lpString="svchost.exe") returned 11 [0189.587] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0189.587] lstrlenW (lpString="explorer.exe") returned 12 [0189.587] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0189.587] lstrlenW (lpString="dwm.exe") returned 7 [0189.587] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.587] lstrlenW (lpString="svchost.exe") returned 11 [0189.588] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0189.588] lstrlenW (lpString="spoolsv.exe") returned 11 [0189.588] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0189.588] lstrlenW (lpString="reader_sl.exe") returned 13 [0189.588] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.588] lstrlenW (lpString="svchost.exe") returned 11 [0189.588] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0189.589] lstrlenW (lpString="taskhost.exe") returned 12 [0189.589] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0189.589] lstrlenW (lpString="svchost.exe") returned 11 [0189.589] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0189.589] lstrlenW (lpString="rundll32.exe") returned 12 [0189.589] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0189.590] lstrlenW (lpString="dinotify.exe") returned 12 [0189.590] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0189.590] lstrlenW (lpString="1Black.exe") returned 10 [0189.590] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0189.590] lstrlenW (lpString="consent.exe") returned 11 [0189.590] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0189.591] lstrlenW (lpString="dllhost.exe") returned 11 [0189.591] Process32NextW (in: hSnapshot=0x39c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0189.591] CloseHandle (hObject=0x39c) returned 1 [0189.591] Sleep (dwMilliseconds=0x1f4) [0190.106] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x38c9ec0 [0190.106] EnumServicesStatusExW (in: hSCManager=0x38c9ec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0190.107] GetLastError () returned 0xea [0190.107] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x39029f0 [0190.107] EnumServicesStatusExW (in: hSCManager=0x38c9ec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39029f0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39029f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0190.108] CloseServiceHandle (hSCObject=0x38c9ec0) returned 1 [0190.108] lstrlenW (lpString="Appinfo") returned 7 [0190.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0190.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0190.108] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0190.108] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0190.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0190.108] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0190.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.108] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0190.108] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0190.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0190.108] lstrlenW (lpString="AudioSrv") returned 8 [0190.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0190.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0190.108] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0190.108] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0190.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0190.108] lstrlenW (lpString="BFE") returned 3 [0190.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0190.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0190.109] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0190.109] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0190.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0190.109] lstrlenW (lpString="CryptSvc") returned 8 [0190.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0190.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0190.109] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0190.109] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0190.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0190.109] lstrlenW (lpString="CscService") returned 10 [0190.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0190.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0190.109] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0190.109] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0190.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0190.109] lstrlenW (lpString="DcomLaunch") returned 10 [0190.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.109] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0190.109] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0190.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0190.109] lstrlenW (lpString="Dhcp") returned 4 [0190.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0190.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0190.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0190.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0190.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0190.109] lstrlenW (lpString="Dnscache") returned 8 [0190.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0190.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0190.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0190.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0190.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0190.110] lstrlenW (lpString="DPS") returned 3 [0190.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0190.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0190.110] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0190.110] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0190.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0190.110] lstrlenW (lpString="eventlog") returned 8 [0190.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0190.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0190.110] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0190.110] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0190.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0190.110] lstrlenW (lpString="EventSystem") returned 11 [0190.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0190.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0190.110] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0190.110] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0190.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0190.110] lstrlenW (lpString="FontCache") returned 9 [0190.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0190.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0190.110] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0190.110] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0190.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0190.110] lstrlenW (lpString="gpsvc") returned 5 [0190.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0190.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0190.110] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0190.110] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0190.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0190.110] lstrlenW (lpString="iphlpsvc") returned 8 [0190.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.110] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0190.111] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0190.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0190.111] lstrlenW (lpString="LanmanServer") returned 12 [0190.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0190.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0190.111] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0190.111] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0190.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0190.111] lstrlenW (lpString="LanmanWorkstation") returned 17 [0190.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.111] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0190.111] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0190.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0190.111] lstrlenW (lpString="lmhosts") returned 7 [0190.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0190.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0190.111] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0190.111] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0190.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0190.111] lstrlenW (lpString="MMCSS") returned 5 [0190.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0190.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0190.111] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0190.111] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0190.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0190.111] lstrlenW (lpString="MpsSvc") returned 6 [0190.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0190.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0190.111] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0190.111] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0190.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0190.111] lstrlenW (lpString="Netman") returned 6 [0190.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0190.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0190.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0190.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0190.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0190.112] lstrlenW (lpString="netprofm") returned 8 [0190.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0190.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0190.112] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0190.112] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0190.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0190.112] lstrlenW (lpString="NlaSvc") returned 6 [0190.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0190.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0190.112] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0190.112] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0190.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0190.112] lstrlenW (lpString="nsi") returned 3 [0190.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0190.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0190.112] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0190.112] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0190.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0190.112] lstrlenW (lpString="PcaSvc") returned 6 [0190.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0190.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0190.112] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0190.112] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0190.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0190.112] lstrlenW (lpString="PlugPlay") returned 8 [0190.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0190.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0190.112] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0190.112] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0190.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0190.113] lstrlenW (lpString="Power") returned 5 [0190.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0190.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0190.113] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0190.113] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0190.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0190.113] lstrlenW (lpString="ProfSvc") returned 7 [0190.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0190.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0190.113] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0190.113] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0190.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0190.113] lstrlenW (lpString="RpcEptMapper") returned 12 [0190.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.113] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0190.113] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0190.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0190.113] lstrlenW (lpString="RpcSs") returned 5 [0190.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0190.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0190.113] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0190.113] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0190.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0190.113] lstrlenW (lpString="SamSs") returned 5 [0190.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0190.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0190.113] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0190.113] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0190.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0190.113] lstrlenW (lpString="Schedule") returned 8 [0190.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0190.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0190.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0190.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0190.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0190.114] lstrlenW (lpString="SENS") returned 4 [0190.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0190.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0190.114] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0190.114] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0190.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0190.114] lstrlenW (lpString="ShellHWDetection") returned 16 [0190.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.114] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0190.114] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0190.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0190.114] lstrlenW (lpString="Spooler") returned 7 [0190.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0190.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0190.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0190.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0190.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0190.114] lstrlenW (lpString="SysMain") returned 7 [0190.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0190.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0190.114] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0190.114] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0190.114] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0190.114] lstrlenW (lpString="Themes") returned 6 [0190.114] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0190.114] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0190.114] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0190.114] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0190.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0190.115] lstrlenW (lpString="TrkWks") returned 6 [0190.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0190.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0190.115] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0190.115] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0190.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0190.115] lstrlenW (lpString="UxSms") returned 5 [0190.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0190.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0190.115] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0190.115] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0190.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0190.115] lstrlenW (lpString="WdiServiceHost") returned 14 [0190.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0190.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0190.115] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0190.115] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0190.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0190.115] lstrlenW (lpString="WdiSystemHost") returned 13 [0190.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0190.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0190.115] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0190.115] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0190.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0190.115] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0190.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0190.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0190.115] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0190.115] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0190.115] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0190.115] lstrlenW (lpString="Winmgmt") returned 7 [0190.115] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0190.115] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0190.116] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0190.116] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0190.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0190.116] lstrlenW (lpString="WPDBusEnum") returned 10 [0190.116] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0190.116] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0190.116] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0190.116] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0190.116] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0190.116] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x39029f0 | out: hHeap=0x270000) returned 1 [0190.116] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0190.118] Process32FirstW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.118] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.118] lstrlenW (lpString="System") returned 6 [0190.118] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0190.118] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0190.118] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0190.118] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0190.118] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0190.118] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0190.118] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0190.118] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.119] lstrlenW (lpString="smss.exe") returned 8 [0190.119] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0190.119] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0190.119] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0190.119] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0190.119] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0190.119] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0190.119] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0190.119] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.119] lstrlenW (lpString="csrss.exe") returned 9 [0190.119] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0190.119] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0190.119] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0190.119] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0190.119] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0190.119] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0190.119] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0190.119] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.120] lstrlenW (lpString="wininit.exe") returned 11 [0190.120] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0190.120] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0190.120] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0190.120] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0190.120] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0190.120] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0190.120] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0190.120] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.120] lstrlenW (lpString="csrss.exe") returned 9 [0190.120] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0190.120] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.121] lstrlenW (lpString="winlogon.exe") returned 12 [0190.121] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.121] lstrlenW (lpString="services.exe") returned 12 [0190.121] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0190.121] lstrlenW (lpString="lsass.exe") returned 9 [0190.121] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0190.122] lstrlenW (lpString="lsm.exe") returned 7 [0190.122] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.122] lstrlenW (lpString="svchost.exe") returned 11 [0190.122] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.122] lstrlenW (lpString="svchost.exe") returned 11 [0190.122] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.123] lstrlenW (lpString="svchost.exe") returned 11 [0190.123] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.123] lstrlenW (lpString="svchost.exe") returned 11 [0190.123] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.123] lstrlenW (lpString="svchost.exe") returned 11 [0190.123] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0190.124] lstrlenW (lpString="audiodg.exe") returned 11 [0190.124] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.124] lstrlenW (lpString="svchost.exe") returned 11 [0190.124] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0190.124] lstrlenW (lpString="explorer.exe") returned 12 [0190.124] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0190.125] lstrlenW (lpString="dwm.exe") returned 7 [0190.125] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.125] lstrlenW (lpString="svchost.exe") returned 11 [0190.125] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0190.125] lstrlenW (lpString="spoolsv.exe") returned 11 [0190.125] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0190.126] lstrlenW (lpString="reader_sl.exe") returned 13 [0190.126] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.126] lstrlenW (lpString="svchost.exe") returned 11 [0190.126] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0190.126] lstrlenW (lpString="taskhost.exe") returned 12 [0190.126] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.127] lstrlenW (lpString="svchost.exe") returned 11 [0190.127] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0190.127] lstrlenW (lpString="rundll32.exe") returned 12 [0190.127] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0190.127] lstrlenW (lpString="dinotify.exe") returned 12 [0190.127] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0190.128] lstrlenW (lpString="1Black.exe") returned 10 [0190.128] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0190.128] lstrlenW (lpString="consent.exe") returned 11 [0190.128] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0190.128] lstrlenW (lpString="dllhost.exe") returned 11 [0190.128] Process32NextW (in: hSnapshot=0x1d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0190.129] CloseHandle (hObject=0x1d4) returned 1 [0190.129] Sleep (dwMilliseconds=0x1f4) [0190.687] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x363d60 [0190.710] EnumServicesStatusExW (in: hSCManager=0x363d60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0190.711] GetLastError () returned 0xea [0190.713] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x39029f0 [0190.726] EnumServicesStatusExW (in: hSCManager=0x363d60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39029f0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39029f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0190.727] CloseServiceHandle (hSCObject=0x363d60) returned 1 [0190.729] lstrlenW (lpString="Appinfo") returned 7 [0190.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0190.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0190.729] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0190.729] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0190.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0190.729] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0190.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.729] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0190.729] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0190.729] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0190.729] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0190.729] lstrlenW (lpString="AudioSrv") returned 8 [0190.729] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0190.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0190.730] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0190.730] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0190.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0190.730] lstrlenW (lpString="BFE") returned 3 [0190.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0190.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0190.730] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0190.730] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0190.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0190.730] lstrlenW (lpString="CryptSvc") returned 8 [0190.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0190.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0190.730] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0190.730] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0190.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0190.730] lstrlenW (lpString="CscService") returned 10 [0190.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0190.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0190.730] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0190.730] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0190.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0190.730] lstrlenW (lpString="DcomLaunch") returned 10 [0190.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0190.730] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0190.730] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0190.730] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0190.730] lstrlenW (lpString="Dhcp") returned 4 [0190.730] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0190.730] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0190.730] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0190.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0190.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0190.731] lstrlenW (lpString="Dnscache") returned 8 [0190.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0190.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0190.731] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0190.731] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0190.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0190.731] lstrlenW (lpString="DPS") returned 3 [0190.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0190.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0190.731] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0190.731] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0190.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0190.731] lstrlenW (lpString="eventlog") returned 8 [0190.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0190.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0190.731] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0190.731] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0190.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0190.731] lstrlenW (lpString="EventSystem") returned 11 [0190.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0190.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0190.731] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0190.731] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0190.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0190.731] lstrlenW (lpString="FontCache") returned 9 [0190.731] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0190.731] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0190.731] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0190.731] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0190.731] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0190.731] lstrlenW (lpString="gpsvc") returned 5 [0190.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0190.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0190.732] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0190.732] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0190.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0190.732] lstrlenW (lpString="iphlpsvc") returned 8 [0190.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0190.732] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0190.732] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0190.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0190.732] lstrlenW (lpString="LanmanServer") returned 12 [0190.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0190.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0190.732] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0190.732] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0190.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0190.732] lstrlenW (lpString="LanmanWorkstation") returned 17 [0190.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0190.732] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0190.732] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0190.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0190.732] lstrlenW (lpString="lmhosts") returned 7 [0190.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0190.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0190.732] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0190.732] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0190.732] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0190.732] lstrlenW (lpString="MMCSS") returned 5 [0190.732] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0190.732] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0190.732] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0190.732] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0190.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0190.733] lstrlenW (lpString="MpsSvc") returned 6 [0190.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0190.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0190.733] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0190.733] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0190.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0190.733] lstrlenW (lpString="Netman") returned 6 [0190.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0190.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0190.733] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0190.733] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0190.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0190.733] lstrlenW (lpString="netprofm") returned 8 [0190.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0190.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0190.733] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0190.733] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0190.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0190.733] lstrlenW (lpString="NlaSvc") returned 6 [0190.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0190.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0190.733] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0190.733] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0190.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0190.733] lstrlenW (lpString="nsi") returned 3 [0190.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0190.733] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0190.733] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0190.733] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0190.733] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0190.733] lstrlenW (lpString="PcaSvc") returned 6 [0190.733] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0190.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0190.734] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0190.734] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0190.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0190.734] lstrlenW (lpString="PlugPlay") returned 8 [0190.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0190.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0190.734] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0190.734] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0190.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0190.734] lstrlenW (lpString="Power") returned 5 [0190.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0190.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0190.734] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0190.734] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0190.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0190.734] lstrlenW (lpString="ProfSvc") returned 7 [0190.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0190.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0190.734] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0190.734] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0190.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0190.734] lstrlenW (lpString="RpcEptMapper") returned 12 [0190.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0190.734] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0190.734] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0190.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0190.734] lstrlenW (lpString="RpcSs") returned 5 [0190.734] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0190.734] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0190.734] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0190.734] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0190.734] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0190.735] lstrlenW (lpString="SamSs") returned 5 [0190.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0190.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0190.735] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0190.735] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0190.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0190.735] lstrlenW (lpString="Schedule") returned 8 [0190.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0190.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0190.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0190.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0190.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0190.735] lstrlenW (lpString="SENS") returned 4 [0190.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0190.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0190.735] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0190.735] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0190.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0190.735] lstrlenW (lpString="ShellHWDetection") returned 16 [0190.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0190.735] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0190.735] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0190.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0190.735] lstrlenW (lpString="Spooler") returned 7 [0190.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0190.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0190.735] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0190.735] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0190.735] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0190.735] lstrlenW (lpString="SysMain") returned 7 [0190.735] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0190.735] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0190.736] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0190.736] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0190.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0190.736] lstrlenW (lpString="Themes") returned 6 [0190.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0190.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0190.736] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0190.736] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0190.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0190.736] lstrlenW (lpString="TrkWks") returned 6 [0190.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0190.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0190.736] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0190.736] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0190.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0190.736] lstrlenW (lpString="UxSms") returned 5 [0190.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0190.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0190.736] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0190.736] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0190.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0190.736] lstrlenW (lpString="WdiServiceHost") returned 14 [0190.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0190.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0190.736] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0190.736] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0190.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0190.736] lstrlenW (lpString="WdiSystemHost") returned 13 [0190.736] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0190.736] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0190.736] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0190.736] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0190.736] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0190.736] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0190.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0190.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0190.737] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0190.737] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0190.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0190.737] lstrlenW (lpString="Winmgmt") returned 7 [0190.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0190.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0190.737] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0190.737] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0190.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0190.737] lstrlenW (lpString="WPDBusEnum") returned 10 [0190.737] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0190.737] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0190.737] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0190.737] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0190.737] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0190.737] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x39029f0 | out: hHeap=0x270000) returned 1 [0190.737] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3c4 [0190.739] Process32FirstW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0190.740] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0190.740] lstrlenW (lpString="System") returned 6 [0190.740] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0190.740] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0190.740] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0190.740] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0190.740] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0190.740] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0190.740] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0190.740] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0190.740] lstrlenW (lpString="smss.exe") returned 8 [0190.740] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0190.740] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0190.740] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0190.740] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0190.741] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0190.741] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0190.741] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0190.741] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.741] lstrlenW (lpString="csrss.exe") returned 9 [0190.741] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0190.741] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0190.741] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0190.741] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0190.741] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0190.741] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0190.741] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0190.741] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0190.741] lstrlenW (lpString="wininit.exe") returned 11 [0190.741] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0190.741] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0190.742] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0190.742] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0190.742] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0190.742] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0190.742] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0190.742] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0190.742] lstrlenW (lpString="csrss.exe") returned 9 [0190.742] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0190.742] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0190.742] lstrlenW (lpString="winlogon.exe") returned 12 [0190.742] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0190.743] lstrlenW (lpString="services.exe") returned 12 [0190.743] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0190.743] lstrlenW (lpString="lsass.exe") returned 9 [0190.743] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0190.743] lstrlenW (lpString="lsm.exe") returned 7 [0190.743] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.744] lstrlenW (lpString="svchost.exe") returned 11 [0190.744] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.744] lstrlenW (lpString="svchost.exe") returned 11 [0190.744] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.744] lstrlenW (lpString="svchost.exe") returned 11 [0190.744] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.745] lstrlenW (lpString="svchost.exe") returned 11 [0190.745] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.745] lstrlenW (lpString="svchost.exe") returned 11 [0190.745] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0190.745] lstrlenW (lpString="audiodg.exe") returned 11 [0190.745] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.746] lstrlenW (lpString="svchost.exe") returned 11 [0190.746] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0190.746] lstrlenW (lpString="explorer.exe") returned 12 [0190.746] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0190.746] lstrlenW (lpString="dwm.exe") returned 7 [0190.746] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.747] lstrlenW (lpString="svchost.exe") returned 11 [0190.747] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0190.747] lstrlenW (lpString="spoolsv.exe") returned 11 [0190.747] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0190.747] lstrlenW (lpString="reader_sl.exe") returned 13 [0190.747] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.748] lstrlenW (lpString="svchost.exe") returned 11 [0190.748] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0190.748] lstrlenW (lpString="taskhost.exe") returned 12 [0190.748] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0190.748] lstrlenW (lpString="svchost.exe") returned 11 [0190.748] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0190.749] lstrlenW (lpString="rundll32.exe") returned 12 [0190.749] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x670, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x63c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dinotify.exe")) returned 1 [0190.749] lstrlenW (lpString="dinotify.exe") returned 12 [0190.749] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0190.749] lstrlenW (lpString="1Black.exe") returned 10 [0190.749] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x680, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x368, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0190.750] lstrlenW (lpString="consent.exe") returned 11 [0190.750] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0190.750] lstrlenW (lpString="dllhost.exe") returned 11 [0190.750] Process32NextW (in: hSnapshot=0x3c4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0190.750] CloseHandle (hObject=0x3c4) returned 1 [0190.750] Sleep (dwMilliseconds=0x1f4) [0191.296] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x38c9f10 [0191.297] EnumServicesStatusExW (in: hSCManager=0x38c9f10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0191.297] GetLastError () returned 0xea [0191.297] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x39029f0 [0191.297] EnumServicesStatusExW (in: hSCManager=0x38c9f10, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39029f0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39029f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0191.298] CloseServiceHandle (hSCObject=0x38c9f10) returned 1 [0191.298] lstrlenW (lpString="Appinfo") returned 7 [0191.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0191.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0191.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0191.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0191.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0191.298] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0191.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.298] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0191.298] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0191.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0191.298] lstrlenW (lpString="AudioSrv") returned 8 [0191.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0191.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0191.299] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0191.299] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0191.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0191.299] lstrlenW (lpString="BFE") returned 3 [0191.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0191.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0191.299] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0191.299] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0191.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0191.299] lstrlenW (lpString="CryptSvc") returned 8 [0191.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0191.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0191.299] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0191.299] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0191.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0191.299] lstrlenW (lpString="CscService") returned 10 [0191.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0191.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0191.299] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0191.299] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0191.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0191.299] lstrlenW (lpString="DcomLaunch") returned 10 [0191.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.299] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0191.299] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0191.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0191.299] lstrlenW (lpString="Dhcp") returned 4 [0191.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0191.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0191.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0191.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0191.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0191.300] lstrlenW (lpString="Dnscache") returned 8 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0191.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0191.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0191.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0191.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0191.300] lstrlenW (lpString="DPS") returned 3 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0191.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0191.300] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0191.300] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0191.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0191.300] lstrlenW (lpString="eventlog") returned 8 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0191.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0191.300] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0191.300] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0191.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0191.300] lstrlenW (lpString="EventSystem") returned 11 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0191.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0191.300] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0191.300] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0191.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0191.300] lstrlenW (lpString="FontCache") returned 9 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0191.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0191.300] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0191.300] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0191.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0191.300] lstrlenW (lpString="gpsvc") returned 5 [0191.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0191.301] lstrlenW (lpString="iphlpsvc") returned 8 [0191.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0191.301] lstrlenW (lpString="LanmanServer") returned 12 [0191.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0191.301] lstrlenW (lpString="LanmanWorkstation") returned 17 [0191.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0191.301] lstrlenW (lpString="lmhosts") returned 7 [0191.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0191.301] lstrlenW (lpString="MMCSS") returned 5 [0191.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0191.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0191.301] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0191.301] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0191.301] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0191.302] lstrlenW (lpString="MpsSvc") returned 6 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0191.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0191.302] lstrlenW (lpString="Netman") returned 6 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0191.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0191.302] lstrlenW (lpString="netprofm") returned 8 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0191.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0191.302] lstrlenW (lpString="NlaSvc") returned 6 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0191.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0191.302] lstrlenW (lpString="nsi") returned 3 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0191.302] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0191.302] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0191.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0191.302] lstrlenW (lpString="PcaSvc") returned 6 [0191.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0191.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0191.303] lstrlenW (lpString="PlugPlay") returned 8 [0191.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0191.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0191.303] lstrlenW (lpString="Power") returned 5 [0191.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0191.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0191.303] lstrlenW (lpString="ProfSvc") returned 7 [0191.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0191.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0191.303] lstrlenW (lpString="RpcEptMapper") returned 12 [0191.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0191.303] lstrlenW (lpString="RpcSs") returned 5 [0191.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0191.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0191.303] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0191.303] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0191.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0191.303] lstrlenW (lpString="SamSs") returned 5 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0191.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0191.304] lstrlenW (lpString="Schedule") returned 8 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0191.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0191.304] lstrlenW (lpString="SENS") returned 4 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0191.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0191.304] lstrlenW (lpString="ShellHWDetection") returned 16 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0191.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0191.304] lstrlenW (lpString="Spooler") returned 7 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0191.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0191.304] lstrlenW (lpString="SysMain") returned 7 [0191.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0191.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0191.304] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0191.304] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0191.305] lstrlenW (lpString="Themes") returned 6 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0191.305] lstrlenW (lpString="TrkWks") returned 6 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0191.305] lstrlenW (lpString="UxSms") returned 5 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0191.305] lstrlenW (lpString="WdiServiceHost") returned 14 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0191.305] lstrlenW (lpString="WdiSystemHost") returned 13 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0191.305] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0191.305] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0191.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0191.305] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0191.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.306] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0191.306] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0191.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0191.306] lstrlenW (lpString="Winmgmt") returned 7 [0191.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0191.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0191.306] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0191.306] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0191.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0191.306] lstrlenW (lpString="WPDBusEnum") returned 10 [0191.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0191.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0191.306] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0191.306] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0191.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0191.306] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x39029f0 | out: hHeap=0x270000) returned 1 [0191.306] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x320 [0191.308] Process32FirstW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.308] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.309] lstrlenW (lpString="System") returned 6 [0191.309] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0191.309] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0191.309] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0191.309] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0191.309] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0191.309] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0191.309] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0191.309] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.309] lstrlenW (lpString="smss.exe") returned 8 [0191.309] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0191.309] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0191.309] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0191.309] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0191.309] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0191.309] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0191.309] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0191.309] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.310] lstrlenW (lpString="csrss.exe") returned 9 [0191.310] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0191.310] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0191.310] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0191.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0191.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0191.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0191.310] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.310] lstrlenW (lpString="wininit.exe") returned 11 [0191.310] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0191.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0191.310] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0191.310] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0191.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0191.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0191.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0191.310] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.311] lstrlenW (lpString="csrss.exe") returned 9 [0191.311] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.311] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.311] lstrlenW (lpString="winlogon.exe") returned 12 [0191.311] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.311] lstrlenW (lpString="services.exe") returned 12 [0191.311] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.312] lstrlenW (lpString="lsass.exe") returned 9 [0191.312] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0191.312] lstrlenW (lpString="lsm.exe") returned 7 [0191.312] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.312] lstrlenW (lpString="svchost.exe") returned 11 [0191.312] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.313] lstrlenW (lpString="svchost.exe") returned 11 [0191.313] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.313] lstrlenW (lpString="svchost.exe") returned 11 [0191.313] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.313] lstrlenW (lpString="svchost.exe") returned 11 [0191.313] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.314] lstrlenW (lpString="svchost.exe") returned 11 [0191.314] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.314] lstrlenW (lpString="audiodg.exe") returned 11 [0191.314] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.314] lstrlenW (lpString="svchost.exe") returned 11 [0191.314] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.315] lstrlenW (lpString="explorer.exe") returned 12 [0191.315] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.315] lstrlenW (lpString="dwm.exe") returned 7 [0191.315] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.315] lstrlenW (lpString="svchost.exe") returned 11 [0191.315] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.316] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.316] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0191.316] lstrlenW (lpString="reader_sl.exe") returned 13 [0191.316] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.316] lstrlenW (lpString="svchost.exe") returned 11 [0191.316] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0191.317] lstrlenW (lpString="taskhost.exe") returned 12 [0191.317] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.317] lstrlenW (lpString="svchost.exe") returned 11 [0191.317] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0191.317] lstrlenW (lpString="rundll32.exe") returned 12 [0191.317] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0191.318] lstrlenW (lpString="1Black.exe") returned 10 [0191.318] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.318] lstrlenW (lpString="dllhost.exe") returned 11 [0191.318] Process32NextW (in: hSnapshot=0x320, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0191.318] CloseHandle (hObject=0x320) returned 1 [0191.318] Sleep (dwMilliseconds=0x1f4) [0191.887] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x365528 [0191.887] EnumServicesStatusExW (in: hSCManager=0x365528, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0191.888] GetLastError () returned 0xea [0191.888] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x39029f0 [0191.888] EnumServicesStatusExW (in: hSCManager=0x365528, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39029f0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39029f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0191.889] CloseServiceHandle (hSCObject=0x365528) returned 1 [0191.889] lstrlenW (lpString="Appinfo") returned 7 [0191.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0191.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0191.889] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0191.889] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0191.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0191.889] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0191.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0191.889] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0191.889] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0191.889] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0191.889] lstrlenW (lpString="AudioSrv") returned 8 [0191.889] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0191.889] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0191.889] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0191.889] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0191.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0191.890] lstrlenW (lpString="BFE") returned 3 [0191.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0191.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0191.890] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0191.890] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0191.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0191.890] lstrlenW (lpString="CryptSvc") returned 8 [0191.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0191.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0191.890] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0191.890] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0191.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0191.890] lstrlenW (lpString="CscService") returned 10 [0191.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0191.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0191.890] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0191.890] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0191.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0191.890] lstrlenW (lpString="DcomLaunch") returned 10 [0191.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0191.890] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0191.890] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0191.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0191.890] lstrlenW (lpString="Dhcp") returned 4 [0191.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0191.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0191.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0191.890] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0191.890] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0191.890] lstrlenW (lpString="Dnscache") returned 8 [0191.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0191.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0191.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0191.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0191.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0191.891] lstrlenW (lpString="DPS") returned 3 [0191.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0191.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0191.891] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0191.891] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0191.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0191.891] lstrlenW (lpString="eventlog") returned 8 [0191.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0191.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0191.891] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0191.891] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0191.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0191.891] lstrlenW (lpString="EventSystem") returned 11 [0191.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0191.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0191.891] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0191.891] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0191.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0191.891] lstrlenW (lpString="FontCache") returned 9 [0191.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0191.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0191.891] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0191.891] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0191.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0191.891] lstrlenW (lpString="gpsvc") returned 5 [0191.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0191.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0191.891] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0191.891] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0191.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0191.892] lstrlenW (lpString="iphlpsvc") returned 8 [0191.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0191.892] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0191.892] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0191.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0191.892] lstrlenW (lpString="LanmanServer") returned 12 [0191.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0191.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0191.892] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0191.892] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0191.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0191.892] lstrlenW (lpString="LanmanWorkstation") returned 17 [0191.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0191.892] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0191.892] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0191.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0191.892] lstrlenW (lpString="lmhosts") returned 7 [0191.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0191.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0191.892] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0191.892] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0191.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0191.892] lstrlenW (lpString="MMCSS") returned 5 [0191.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0191.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0191.892] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0191.892] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0191.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0191.892] lstrlenW (lpString="MpsSvc") returned 6 [0191.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0191.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0191.893] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0191.893] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0191.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0191.893] lstrlenW (lpString="Netman") returned 6 [0191.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0191.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0191.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0191.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0191.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0191.893] lstrlenW (lpString="netprofm") returned 8 [0191.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0191.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0191.893] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0191.893] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0191.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0191.893] lstrlenW (lpString="NlaSvc") returned 6 [0191.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0191.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0191.893] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0191.893] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0191.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0191.893] lstrlenW (lpString="nsi") returned 3 [0191.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0191.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0191.893] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0191.893] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0191.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0191.893] lstrlenW (lpString="PcaSvc") returned 6 [0191.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0191.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0191.893] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0191.894] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0191.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0191.894] lstrlenW (lpString="PlugPlay") returned 8 [0191.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0191.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0191.894] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0191.894] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0191.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0191.894] lstrlenW (lpString="Power") returned 5 [0191.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0191.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0191.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0191.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0191.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0191.894] lstrlenW (lpString="ProfSvc") returned 7 [0191.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0191.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0191.894] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0191.894] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0191.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0191.894] lstrlenW (lpString="RpcEptMapper") returned 12 [0191.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0191.894] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0191.894] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0191.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0191.894] lstrlenW (lpString="RpcSs") returned 5 [0191.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0191.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0191.894] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0191.894] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0191.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0191.894] lstrlenW (lpString="SamSs") returned 5 [0191.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0191.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0191.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0191.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0191.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0191.895] lstrlenW (lpString="Schedule") returned 8 [0191.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0191.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0191.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0191.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0191.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0191.895] lstrlenW (lpString="SENS") returned 4 [0191.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0191.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0191.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0191.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0191.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0191.895] lstrlenW (lpString="ShellHWDetection") returned 16 [0191.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0191.895] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0191.895] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0191.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0191.895] lstrlenW (lpString="Spooler") returned 7 [0191.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0191.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0191.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0191.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0191.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0191.895] lstrlenW (lpString="SysMain") returned 7 [0191.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0191.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0191.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0191.896] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0191.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0191.896] lstrlenW (lpString="Themes") returned 6 [0191.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0191.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0191.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0191.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0191.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0191.896] lstrlenW (lpString="TrkWks") returned 6 [0191.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0191.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0191.896] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0191.896] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0191.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0191.896] lstrlenW (lpString="UxSms") returned 5 [0191.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0191.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0191.896] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0191.896] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0191.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0191.896] lstrlenW (lpString="WdiServiceHost") returned 14 [0191.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0191.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0191.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0191.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0191.896] lstrlenW (lpString="WdiSystemHost") returned 13 [0191.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0191.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0191.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0191.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0191.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0191.896] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0191.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0191.897] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0191.897] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0191.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0191.897] lstrlenW (lpString="Winmgmt") returned 7 [0191.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0191.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0191.897] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0191.897] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0191.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0191.897] lstrlenW (lpString="WPDBusEnum") returned 10 [0191.897] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0191.897] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0191.897] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0191.897] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0191.897] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0191.897] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x39029f0 | out: hHeap=0x270000) returned 1 [0191.897] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d8 [0191.899] Process32FirstW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0191.899] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0191.899] lstrlenW (lpString="System") returned 6 [0191.899] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0191.899] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0191.899] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0191.900] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0191.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0191.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0191.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0191.900] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0191.900] lstrlenW (lpString="smss.exe") returned 8 [0191.900] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0191.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0191.900] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0191.900] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0191.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0191.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0191.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0191.900] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.900] lstrlenW (lpString="csrss.exe") returned 9 [0191.900] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0191.901] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0191.901] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0191.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0191.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0191.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0191.901] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0191.901] lstrlenW (lpString="wininit.exe") returned 11 [0191.901] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0191.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0191.901] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0191.901] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0191.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0191.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0191.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0191.901] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0191.901] lstrlenW (lpString="csrss.exe") returned 9 [0191.901] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0191.902] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0191.902] lstrlenW (lpString="winlogon.exe") returned 12 [0191.902] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0191.902] lstrlenW (lpString="services.exe") returned 12 [0191.902] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0191.903] lstrlenW (lpString="lsass.exe") returned 9 [0191.903] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0191.903] lstrlenW (lpString="lsm.exe") returned 7 [0191.903] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.903] lstrlenW (lpString="svchost.exe") returned 11 [0191.903] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.904] lstrlenW (lpString="svchost.exe") returned 11 [0191.904] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.904] lstrlenW (lpString="svchost.exe") returned 11 [0191.904] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.904] lstrlenW (lpString="svchost.exe") returned 11 [0191.904] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.904] lstrlenW (lpString="svchost.exe") returned 11 [0191.905] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0191.905] lstrlenW (lpString="audiodg.exe") returned 11 [0191.905] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.905] lstrlenW (lpString="svchost.exe") returned 11 [0191.905] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0191.905] lstrlenW (lpString="explorer.exe") returned 12 [0191.905] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0191.906] lstrlenW (lpString="dwm.exe") returned 7 [0191.906] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.906] lstrlenW (lpString="svchost.exe") returned 11 [0191.906] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0191.906] lstrlenW (lpString="spoolsv.exe") returned 11 [0191.906] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0191.907] lstrlenW (lpString="reader_sl.exe") returned 13 [0191.907] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.907] lstrlenW (lpString="svchost.exe") returned 11 [0191.907] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0191.909] lstrlenW (lpString="taskhost.exe") returned 12 [0191.909] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0191.910] lstrlenW (lpString="svchost.exe") returned 11 [0191.910] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0191.910] lstrlenW (lpString="rundll32.exe") returned 12 [0191.910] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0191.910] lstrlenW (lpString="1Black.exe") returned 10 [0191.910] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.911] lstrlenW (lpString="dllhost.exe") returned 11 [0191.911] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0191.911] lstrlenW (lpString="dllhost.exe") returned 11 [0191.911] Process32NextW (in: hSnapshot=0x1d8, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0191.911] CloseHandle (hObject=0x1d8) returned 1 [0191.911] Sleep (dwMilliseconds=0x1f4) [0192.501] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3656e0 [0192.501] EnumServicesStatusExW (in: hSCManager=0x3656e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0192.501] GetLastError () returned 0xea [0192.501] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x39029f0 [0192.502] EnumServicesStatusExW (in: hSCManager=0x3656e0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x39029f0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x39029f0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0192.502] CloseServiceHandle (hSCObject=0x3656e0) returned 1 [0192.503] lstrlenW (lpString="Appinfo") returned 7 [0192.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0192.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0192.503] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0192.503] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0192.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0192.503] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0192.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0192.503] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0192.503] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0192.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0192.503] lstrlenW (lpString="AudioSrv") returned 8 [0192.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0192.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0192.503] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0192.503] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0192.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0192.503] lstrlenW (lpString="BFE") returned 3 [0192.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0192.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0192.503] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0192.503] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0192.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0192.503] lstrlenW (lpString="CryptSvc") returned 8 [0192.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0192.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0192.503] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0192.503] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0192.503] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0192.503] lstrlenW (lpString="CscService") returned 10 [0192.503] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0192.503] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0192.504] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0192.504] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0192.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0192.504] lstrlenW (lpString="DcomLaunch") returned 10 [0192.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0192.504] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0192.504] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0192.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0192.504] lstrlenW (lpString="Dhcp") returned 4 [0192.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0192.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0192.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0192.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0192.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0192.504] lstrlenW (lpString="Dnscache") returned 8 [0192.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0192.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0192.504] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0192.504] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0192.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0192.504] lstrlenW (lpString="DPS") returned 3 [0192.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0192.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0192.504] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0192.504] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0192.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0192.504] lstrlenW (lpString="eventlog") returned 8 [0192.504] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0192.504] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0192.504] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0192.504] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0192.504] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0192.504] lstrlenW (lpString="EventSystem") returned 11 [0192.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0192.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0192.505] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0192.505] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0192.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0192.505] lstrlenW (lpString="FontCache") returned 9 [0192.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0192.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0192.505] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0192.505] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0192.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0192.505] lstrlenW (lpString="gpsvc") returned 5 [0192.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0192.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0192.505] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0192.505] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0192.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0192.505] lstrlenW (lpString="iphlpsvc") returned 8 [0192.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0192.505] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0192.505] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0192.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0192.505] lstrlenW (lpString="LanmanServer") returned 12 [0192.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0192.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0192.505] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0192.505] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0192.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0192.505] lstrlenW (lpString="LanmanWorkstation") returned 17 [0192.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0192.505] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0192.505] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0192.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0192.506] lstrlenW (lpString="lmhosts") returned 7 [0192.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0192.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0192.506] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0192.506] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0192.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0192.506] lstrlenW (lpString="MMCSS") returned 5 [0192.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0192.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0192.506] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0192.506] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0192.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0192.506] lstrlenW (lpString="MpsSvc") returned 6 [0192.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0192.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0192.506] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0192.506] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0192.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0192.506] lstrlenW (lpString="Netman") returned 6 [0192.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0192.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0192.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0192.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0192.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0192.506] lstrlenW (lpString="netprofm") returned 8 [0192.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0192.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0192.506] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0192.506] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0192.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0192.506] lstrlenW (lpString="NlaSvc") returned 6 [0192.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0192.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0192.507] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0192.507] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0192.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0192.507] lstrlenW (lpString="nsi") returned 3 [0192.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0192.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0192.507] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0192.507] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0192.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0192.507] lstrlenW (lpString="PcaSvc") returned 6 [0192.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0192.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0192.507] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0192.507] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0192.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0192.507] lstrlenW (lpString="PlugPlay") returned 8 [0192.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0192.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0192.507] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0192.507] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0192.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0192.507] lstrlenW (lpString="Power") returned 5 [0192.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0192.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0192.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0192.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0192.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0192.507] lstrlenW (lpString="ProfSvc") returned 7 [0192.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0192.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0192.507] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0192.507] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0192.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0192.508] lstrlenW (lpString="RpcEptMapper") returned 12 [0192.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0192.508] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0192.508] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0192.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0192.508] lstrlenW (lpString="RpcSs") returned 5 [0192.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0192.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0192.508] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0192.508] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0192.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0192.508] lstrlenW (lpString="SamSs") returned 5 [0192.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0192.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0192.508] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0192.508] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0192.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0192.508] lstrlenW (lpString="Schedule") returned 8 [0192.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0192.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0192.508] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0192.508] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0192.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0192.508] lstrlenW (lpString="SENS") returned 4 [0192.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0192.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0192.508] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0192.508] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0192.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0192.508] lstrlenW (lpString="ShellHWDetection") returned 16 [0192.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0192.508] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0192.509] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0192.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0192.509] lstrlenW (lpString="Spooler") returned 7 [0192.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0192.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0192.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0192.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0192.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0192.509] lstrlenW (lpString="SysMain") returned 7 [0192.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0192.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0192.509] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0192.509] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0192.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0192.509] lstrlenW (lpString="Themes") returned 6 [0192.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0192.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0192.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0192.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0192.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0192.509] lstrlenW (lpString="TrkWks") returned 6 [0192.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0192.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0192.509] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0192.509] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0192.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0192.509] lstrlenW (lpString="UxSms") returned 5 [0192.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0192.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0192.509] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0192.509] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0192.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0192.509] lstrlenW (lpString="WdiServiceHost") returned 14 [0192.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0192.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0192.510] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0192.510] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0192.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0192.510] lstrlenW (lpString="WdiSystemHost") returned 13 [0192.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0192.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0192.510] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0192.510] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0192.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0192.510] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0192.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0192.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0192.510] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0192.510] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0192.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0192.510] lstrlenW (lpString="Winmgmt") returned 7 [0192.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0192.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0192.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0192.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0192.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0192.510] lstrlenW (lpString="WPDBusEnum") returned 10 [0192.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0192.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0192.510] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0192.510] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0192.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0192.510] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x39029f0 | out: hHeap=0x270000) returned 1 [0192.510] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e4 [0192.512] Process32FirstW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0192.512] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0192.513] lstrlenW (lpString="System") returned 6 [0192.513] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0192.513] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0192.513] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0192.513] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0192.513] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0192.513] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0192.513] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0192.513] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0192.513] lstrlenW (lpString="smss.exe") returned 8 [0192.513] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0192.513] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0192.513] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0192.513] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0192.513] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0192.513] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0192.513] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0192.513] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.514] lstrlenW (lpString="csrss.exe") returned 9 [0192.514] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0192.514] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0192.514] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0192.514] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0192.514] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0192.514] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0192.514] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0192.514] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0192.514] lstrlenW (lpString="wininit.exe") returned 11 [0192.514] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0192.514] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0192.514] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0192.514] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0192.514] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0192.514] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0192.514] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0192.514] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0192.515] lstrlenW (lpString="csrss.exe") returned 9 [0192.515] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0192.515] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0192.515] lstrlenW (lpString="winlogon.exe") returned 12 [0192.515] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0192.515] lstrlenW (lpString="services.exe") returned 12 [0192.516] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0192.516] lstrlenW (lpString="lsass.exe") returned 9 [0192.516] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0192.516] lstrlenW (lpString="lsm.exe") returned 7 [0192.516] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.517] lstrlenW (lpString="svchost.exe") returned 11 [0192.517] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.517] lstrlenW (lpString="svchost.exe") returned 11 [0192.517] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.517] lstrlenW (lpString="svchost.exe") returned 11 [0192.517] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.518] lstrlenW (lpString="svchost.exe") returned 11 [0192.518] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.518] lstrlenW (lpString="svchost.exe") returned 11 [0192.518] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0192.518] lstrlenW (lpString="audiodg.exe") returned 11 [0192.518] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.518] lstrlenW (lpString="svchost.exe") returned 11 [0192.519] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0192.519] lstrlenW (lpString="explorer.exe") returned 12 [0192.519] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0192.519] lstrlenW (lpString="dwm.exe") returned 7 [0192.519] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.519] lstrlenW (lpString="svchost.exe") returned 11 [0192.519] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0192.520] lstrlenW (lpString="spoolsv.exe") returned 11 [0192.520] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0192.520] lstrlenW (lpString="reader_sl.exe") returned 13 [0192.520] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.520] lstrlenW (lpString="svchost.exe") returned 11 [0192.520] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0192.521] lstrlenW (lpString="taskhost.exe") returned 12 [0192.521] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0192.521] lstrlenW (lpString="svchost.exe") returned 11 [0192.521] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0192.521] lstrlenW (lpString="rundll32.exe") returned 12 [0192.521] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0192.522] lstrlenW (lpString="1Black.exe") returned 10 [0192.522] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.522] lstrlenW (lpString="dllhost.exe") returned 11 [0192.522] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0192.522] lstrlenW (lpString="dllhost.exe") returned 11 [0192.522] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0192.523] lstrlenW (lpString="1Black.exe") returned 10 [0192.523] Process32NextW (in: hSnapshot=0x1e4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0192.523] CloseHandle (hObject=0x1e4) returned 1 [0192.523] Sleep (dwMilliseconds=0x1f4) [0193.224] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x36f698 [0193.225] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0193.225] GetLastError () returned 0xea [0193.225] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0193.225] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0193.226] CloseServiceHandle (hSCObject=0x36f698) returned 1 [0193.226] lstrlenW (lpString="Appinfo") returned 7 [0193.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0193.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0193.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0193.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0193.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0193.226] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0193.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0193.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0193.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0193.226] lstrlenW (lpString="AudioSrv") returned 8 [0193.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0193.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0193.226] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0193.226] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0193.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0193.226] lstrlenW (lpString="BFE") returned 3 [0193.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0193.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0193.227] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0193.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0193.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0193.227] lstrlenW (lpString="CryptSvc") returned 8 [0193.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0193.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0193.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0193.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0193.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0193.227] lstrlenW (lpString="CscService") returned 10 [0193.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0193.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0193.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0193.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0193.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0193.227] lstrlenW (lpString="DcomLaunch") returned 10 [0193.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.227] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0193.227] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0193.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0193.227] lstrlenW (lpString="Dhcp") returned 4 [0193.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0193.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0193.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0193.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0193.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0193.227] lstrlenW (lpString="Dnscache") returned 8 [0193.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0193.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0193.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0193.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0193.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0193.227] lstrlenW (lpString="DPS") returned 3 [0193.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0193.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0193.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0193.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0193.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0193.228] lstrlenW (lpString="eventlog") returned 8 [0193.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0193.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0193.228] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0193.228] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0193.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0193.228] lstrlenW (lpString="EventSystem") returned 11 [0193.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0193.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0193.228] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0193.228] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0193.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0193.228] lstrlenW (lpString="FontCache") returned 9 [0193.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0193.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0193.228] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0193.228] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0193.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0193.228] lstrlenW (lpString="gpsvc") returned 5 [0193.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0193.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0193.228] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0193.228] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0193.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0193.228] lstrlenW (lpString="iphlpsvc") returned 8 [0193.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0193.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0193.228] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0193.229] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0193.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0193.229] lstrlenW (lpString="LanmanServer") returned 12 [0193.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0193.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0193.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0193.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0193.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0193.229] lstrlenW (lpString="LanmanWorkstation") returned 17 [0193.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0193.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0193.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0193.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0193.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0193.229] lstrlenW (lpString="lmhosts") returned 7 [0193.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0193.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0193.229] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0193.229] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0193.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0193.229] lstrlenW (lpString="MMCSS") returned 5 [0193.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0193.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0193.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0193.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0193.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0193.229] lstrlenW (lpString="MpsSvc") returned 6 [0193.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0193.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0193.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0193.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0193.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0193.229] lstrlenW (lpString="Netman") returned 6 [0193.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0193.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0193.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0193.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0193.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0193.230] lstrlenW (lpString="netprofm") returned 8 [0193.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0193.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0193.230] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0193.230] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0193.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0193.230] lstrlenW (lpString="NlaSvc") returned 6 [0193.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0193.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0193.230] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0193.230] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0193.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0193.230] lstrlenW (lpString="nsi") returned 3 [0193.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0193.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0193.230] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0193.230] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0193.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0193.230] lstrlenW (lpString="PcaSvc") returned 6 [0193.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0193.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0193.230] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0193.230] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0193.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0193.230] lstrlenW (lpString="PlugPlay") returned 8 [0193.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0193.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0193.230] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0193.230] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0193.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0193.231] lstrlenW (lpString="Power") returned 5 [0193.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0193.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0193.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0193.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0193.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0193.231] lstrlenW (lpString="ProfSvc") returned 7 [0193.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0193.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0193.231] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0193.231] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0193.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0193.231] lstrlenW (lpString="RpcEptMapper") returned 12 [0193.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.231] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0193.231] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0193.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0193.231] lstrlenW (lpString="RpcSs") returned 5 [0193.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0193.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0193.231] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0193.231] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0193.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0193.231] lstrlenW (lpString="SamSs") returned 5 [0193.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0193.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0193.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0193.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0193.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0193.231] lstrlenW (lpString="Schedule") returned 8 [0193.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0193.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0193.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0193.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0193.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0193.232] lstrlenW (lpString="SENS") returned 4 [0193.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0193.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0193.232] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0193.232] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0193.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0193.232] lstrlenW (lpString="ShellHWDetection") returned 16 [0193.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.232] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0193.232] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0193.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0193.232] lstrlenW (lpString="Spooler") returned 7 [0193.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0193.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0193.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0193.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0193.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0193.232] lstrlenW (lpString="SysMain") returned 7 [0193.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0193.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0193.232] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0193.232] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0193.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0193.232] lstrlenW (lpString="Themes") returned 6 [0193.232] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0193.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0193.232] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0193.232] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0193.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0193.233] lstrlenW (lpString="TrkWks") returned 6 [0193.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0193.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0193.233] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0193.233] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0193.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0193.233] lstrlenW (lpString="UxSms") returned 5 [0193.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0193.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0193.233] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0193.233] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0193.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0193.233] lstrlenW (lpString="WdiServiceHost") returned 14 [0193.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0193.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0193.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0193.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0193.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0193.233] lstrlenW (lpString="WdiSystemHost") returned 13 [0193.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0193.233] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0193.233] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0193.233] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0193.233] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0193.233] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0193.233] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0193.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0193.245] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0193.246] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0193.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0193.246] lstrlenW (lpString="Winmgmt") returned 7 [0193.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0193.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0193.246] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0193.246] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0193.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0193.246] lstrlenW (lpString="WPDBusEnum") returned 10 [0193.246] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0193.246] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0193.246] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0193.246] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0193.246] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0193.246] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0193.246] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x114 [0193.248] Process32FirstW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.248] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0193.248] lstrlenW (lpString="System") returned 6 [0193.248] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0193.248] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0193.248] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0193.249] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0193.249] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0193.249] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0193.249] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0193.249] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0193.249] lstrlenW (lpString="smss.exe") returned 8 [0193.249] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0193.249] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0193.250] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0193.250] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0193.250] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0193.250] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0193.250] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0193.250] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.250] lstrlenW (lpString="csrss.exe") returned 9 [0193.250] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0193.250] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0193.250] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0193.250] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0193.250] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0193.250] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0193.250] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0193.250] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0193.250] lstrlenW (lpString="wininit.exe") returned 11 [0193.251] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0193.251] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0193.251] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0193.251] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0193.251] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0193.251] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0193.251] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0193.251] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.251] lstrlenW (lpString="csrss.exe") returned 9 [0193.251] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0193.251] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0193.251] lstrlenW (lpString="winlogon.exe") returned 12 [0193.251] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0193.252] lstrlenW (lpString="services.exe") returned 12 [0193.252] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0193.252] lstrlenW (lpString="lsass.exe") returned 9 [0193.252] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0193.252] lstrlenW (lpString="lsm.exe") returned 7 [0193.252] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.253] lstrlenW (lpString="svchost.exe") returned 11 [0193.253] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.253] lstrlenW (lpString="svchost.exe") returned 11 [0193.253] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.253] lstrlenW (lpString="svchost.exe") returned 11 [0193.253] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.254] lstrlenW (lpString="svchost.exe") returned 11 [0193.254] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.254] lstrlenW (lpString="svchost.exe") returned 11 [0193.254] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0193.254] lstrlenW (lpString="audiodg.exe") returned 11 [0193.254] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.255] lstrlenW (lpString="svchost.exe") returned 11 [0193.255] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0193.255] lstrlenW (lpString="explorer.exe") returned 12 [0193.255] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0193.255] lstrlenW (lpString="dwm.exe") returned 7 [0193.255] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.256] lstrlenW (lpString="svchost.exe") returned 11 [0193.256] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0193.256] lstrlenW (lpString="spoolsv.exe") returned 11 [0193.256] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0193.256] lstrlenW (lpString="reader_sl.exe") returned 13 [0193.256] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.257] lstrlenW (lpString="svchost.exe") returned 11 [0193.257] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0193.257] lstrlenW (lpString="taskhost.exe") returned 12 [0193.257] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.257] lstrlenW (lpString="svchost.exe") returned 11 [0193.257] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0193.258] lstrlenW (lpString="rundll32.exe") returned 12 [0193.258] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0193.258] lstrlenW (lpString="1Black.exe") returned 10 [0193.258] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0193.258] lstrlenW (lpString="dllhost.exe") returned 11 [0193.258] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0193.259] lstrlenW (lpString="dllhost.exe") returned 11 [0193.259] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0193.259] lstrlenW (lpString="1Black.exe") returned 10 [0193.259] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0193.259] CloseHandle (hObject=0x114) returned 1 [0193.259] Sleep (dwMilliseconds=0x1f4) [0193.923] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x36f698 [0193.923] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0193.924] GetLastError () returned 0xea [0193.924] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0193.924] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0193.924] CloseServiceHandle (hSCObject=0x36f698) returned 1 [0193.925] lstrlenW (lpString="Appinfo") returned 7 [0193.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0193.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0193.925] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0193.925] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0193.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0193.925] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0193.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0193.925] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0193.925] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0193.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0193.925] lstrlenW (lpString="AudioSrv") returned 8 [0193.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0193.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0193.925] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0193.925] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0193.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0193.925] lstrlenW (lpString="BFE") returned 3 [0193.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0193.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0193.925] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0193.925] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0193.925] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0193.925] lstrlenW (lpString="CryptSvc") returned 8 [0193.925] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0193.925] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0193.926] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0193.926] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0193.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0193.926] lstrlenW (lpString="CscService") returned 10 [0193.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0193.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0193.926] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0193.926] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0193.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0193.926] lstrlenW (lpString="DcomLaunch") returned 10 [0193.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0193.926] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0193.926] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0193.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0193.926] lstrlenW (lpString="Dhcp") returned 4 [0193.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0193.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0193.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0193.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0193.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0193.926] lstrlenW (lpString="Dnscache") returned 8 [0193.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0193.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0193.926] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0193.926] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0193.926] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0193.926] lstrlenW (lpString="DPS") returned 3 [0193.926] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0193.926] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0193.927] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0193.927] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0193.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0193.927] lstrlenW (lpString="eventlog") returned 8 [0193.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0193.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0193.927] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0193.927] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0193.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0193.927] lstrlenW (lpString="EventSystem") returned 11 [0193.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0193.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0193.927] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0193.927] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0193.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0193.927] lstrlenW (lpString="FontCache") returned 9 [0193.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0193.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0193.927] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0193.927] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0193.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0193.927] lstrlenW (lpString="gpsvc") returned 5 [0193.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0193.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0193.927] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0193.927] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0193.927] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0193.927] lstrlenW (lpString="iphlpsvc") returned 8 [0193.927] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0193.927] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0193.928] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0193.928] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0193.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0193.928] lstrlenW (lpString="LanmanServer") returned 12 [0193.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0193.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0193.928] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0193.928] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0193.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0193.928] lstrlenW (lpString="LanmanWorkstation") returned 17 [0193.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0193.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0193.928] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0193.928] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0193.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0193.928] lstrlenW (lpString="lmhosts") returned 7 [0193.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0193.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0193.928] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0193.928] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0193.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0193.928] lstrlenW (lpString="MMCSS") returned 5 [0193.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0193.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0193.928] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0193.928] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0193.928] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0193.928] lstrlenW (lpString="MpsSvc") returned 6 [0193.928] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0193.928] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0193.928] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0193.929] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0193.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0193.929] lstrlenW (lpString="Netman") returned 6 [0193.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0193.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0193.929] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0193.929] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0193.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0193.929] lstrlenW (lpString="netprofm") returned 8 [0193.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0193.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0193.929] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0193.929] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0193.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0193.929] lstrlenW (lpString="NlaSvc") returned 6 [0193.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0193.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0193.929] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0193.929] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0193.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0193.929] lstrlenW (lpString="nsi") returned 3 [0193.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0193.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0193.929] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0193.929] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0193.929] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0193.929] lstrlenW (lpString="PcaSvc") returned 6 [0193.929] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0193.929] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0193.929] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0193.929] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0193.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0193.930] lstrlenW (lpString="PlugPlay") returned 8 [0193.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0193.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0193.930] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0193.930] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0193.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0193.930] lstrlenW (lpString="Power") returned 5 [0193.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0193.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0193.930] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0193.930] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0193.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0193.930] lstrlenW (lpString="ProfSvc") returned 7 [0193.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0193.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0193.930] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0193.930] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0193.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0193.930] lstrlenW (lpString="RpcEptMapper") returned 12 [0193.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0193.930] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0193.930] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0193.930] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0193.930] lstrlenW (lpString="RpcSs") returned 5 [0193.930] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0193.930] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0193.930] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0193.930] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0193.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0193.931] lstrlenW (lpString="SamSs") returned 5 [0193.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0193.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0193.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0193.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0193.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0193.931] lstrlenW (lpString="Schedule") returned 8 [0193.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0193.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0193.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0193.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0193.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0193.931] lstrlenW (lpString="SENS") returned 4 [0193.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0193.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0193.931] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0193.931] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0193.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0193.931] lstrlenW (lpString="ShellHWDetection") returned 16 [0193.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0193.931] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0193.931] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0193.931] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0193.931] lstrlenW (lpString="Spooler") returned 7 [0193.931] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0193.931] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0193.931] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0193.931] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0193.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0193.932] lstrlenW (lpString="SysMain") returned 7 [0193.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0193.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0193.932] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0193.932] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0193.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0193.932] lstrlenW (lpString="Themes") returned 6 [0193.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0193.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0193.932] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0193.932] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0193.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0193.932] lstrlenW (lpString="TrkWks") returned 6 [0193.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0193.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0193.932] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0193.932] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0193.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0193.932] lstrlenW (lpString="UxSms") returned 5 [0193.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0193.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0193.932] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0193.932] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0193.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0193.932] lstrlenW (lpString="WdiServiceHost") returned 14 [0193.932] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0193.932] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0193.932] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0193.932] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0193.932] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0193.933] lstrlenW (lpString="WdiSystemHost") returned 13 [0193.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0193.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0193.933] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0193.933] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0193.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0193.933] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0193.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0193.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0193.933] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0193.933] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0193.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0193.933] lstrlenW (lpString="Winmgmt") returned 7 [0193.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0193.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0193.933] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0193.933] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0193.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0193.933] lstrlenW (lpString="WPDBusEnum") returned 10 [0193.933] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0193.933] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0193.933] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0193.933] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0193.933] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0193.933] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0193.933] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15c [0193.935] Process32FirstW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0193.938] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0193.938] lstrlenW (lpString="System") returned 6 [0193.938] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0193.938] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0193.938] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0193.938] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0193.938] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0193.938] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0193.938] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0193.938] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0193.938] lstrlenW (lpString="smss.exe") returned 8 [0193.938] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0193.938] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0193.939] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0193.939] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0193.939] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0193.939] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0193.939] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0193.939] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.939] lstrlenW (lpString="csrss.exe") returned 9 [0193.939] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0193.939] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0193.939] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0193.939] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0193.939] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0193.939] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0193.939] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0193.939] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0193.940] lstrlenW (lpString="wininit.exe") returned 11 [0193.940] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0193.940] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0193.940] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0193.940] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0193.940] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0193.940] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0193.940] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0193.940] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0193.940] lstrlenW (lpString="csrss.exe") returned 9 [0193.940] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0193.940] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0193.940] lstrlenW (lpString="winlogon.exe") returned 12 [0193.941] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0193.941] lstrlenW (lpString="services.exe") returned 12 [0193.941] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0193.941] lstrlenW (lpString="lsass.exe") returned 9 [0193.941] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0193.941] lstrlenW (lpString="lsm.exe") returned 7 [0193.941] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.942] lstrlenW (lpString="svchost.exe") returned 11 [0193.942] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.942] lstrlenW (lpString="svchost.exe") returned 11 [0193.942] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.942] lstrlenW (lpString="svchost.exe") returned 11 [0193.942] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.943] lstrlenW (lpString="svchost.exe") returned 11 [0193.943] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.943] lstrlenW (lpString="svchost.exe") returned 11 [0193.943] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0193.943] lstrlenW (lpString="audiodg.exe") returned 11 [0193.943] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.944] lstrlenW (lpString="svchost.exe") returned 11 [0193.944] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0193.944] lstrlenW (lpString="explorer.exe") returned 12 [0193.944] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0193.944] lstrlenW (lpString="dwm.exe") returned 7 [0193.944] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.945] lstrlenW (lpString="svchost.exe") returned 11 [0193.945] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0193.945] lstrlenW (lpString="spoolsv.exe") returned 11 [0193.945] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0193.945] lstrlenW (lpString="reader_sl.exe") returned 13 [0193.945] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.946] lstrlenW (lpString="svchost.exe") returned 11 [0193.946] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0193.946] lstrlenW (lpString="taskhost.exe") returned 12 [0193.946] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0193.946] lstrlenW (lpString="svchost.exe") returned 11 [0193.946] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x63c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="rundll32.exe")) returned 1 [0193.947] lstrlenW (lpString="rundll32.exe") returned 12 [0193.947] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0193.947] lstrlenW (lpString="1Black.exe") returned 10 [0193.947] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0193.947] lstrlenW (lpString="dllhost.exe") returned 11 [0193.947] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0193.948] lstrlenW (lpString="dllhost.exe") returned 11 [0193.948] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0193.948] lstrlenW (lpString="1Black.exe") returned 10 [0193.948] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0193.948] CloseHandle (hObject=0x15c) returned 1 [0193.948] Sleep (dwMilliseconds=0x1f4) [0194.770] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x36f698 [0194.771] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0194.771] GetLastError () returned 0xea [0194.771] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0194.771] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0194.772] CloseServiceHandle (hSCObject=0x36f698) returned 1 [0194.772] lstrlenW (lpString="Appinfo") returned 7 [0194.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0194.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0194.772] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0194.772] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0194.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0194.772] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0194.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0194.772] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0194.772] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0194.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0194.772] lstrlenW (lpString="AudioSrv") returned 8 [0194.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0194.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0194.772] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0194.773] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0194.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0194.773] lstrlenW (lpString="BFE") returned 3 [0194.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0194.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0194.773] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0194.773] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0194.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0194.773] lstrlenW (lpString="CryptSvc") returned 8 [0194.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0194.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0194.773] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0194.773] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0194.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0194.773] lstrlenW (lpString="CscService") returned 10 [0194.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0194.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0194.773] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0194.773] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0194.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0194.773] lstrlenW (lpString="DcomLaunch") returned 10 [0194.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0194.773] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0194.773] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0194.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0194.773] lstrlenW (lpString="Dhcp") returned 4 [0194.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0194.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0194.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0194.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0194.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0194.774] lstrlenW (lpString="Dnscache") returned 8 [0194.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0194.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0194.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0194.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0194.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0194.774] lstrlenW (lpString="DPS") returned 3 [0194.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0194.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0194.774] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0194.774] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0194.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0194.774] lstrlenW (lpString="eventlog") returned 8 [0194.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0194.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0194.774] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0194.774] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0194.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0194.774] lstrlenW (lpString="EventSystem") returned 11 [0194.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0194.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0194.774] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0194.774] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0194.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0194.774] lstrlenW (lpString="FontCache") returned 9 [0194.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0194.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0194.775] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0194.775] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0194.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0194.775] lstrlenW (lpString="gpsvc") returned 5 [0194.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0194.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0194.775] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0194.775] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0194.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0194.775] lstrlenW (lpString="iphlpsvc") returned 8 [0194.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0194.775] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0194.775] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0194.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0194.775] lstrlenW (lpString="LanmanServer") returned 12 [0194.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0194.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0194.775] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0194.775] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0194.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0194.775] lstrlenW (lpString="LanmanWorkstation") returned 17 [0194.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0194.775] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0194.775] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0194.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0194.775] lstrlenW (lpString="lmhosts") returned 7 [0194.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0194.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0194.776] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0194.776] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0194.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0194.776] lstrlenW (lpString="MMCSS") returned 5 [0194.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0194.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0194.776] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0194.776] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0194.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0194.776] lstrlenW (lpString="MpsSvc") returned 6 [0194.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0194.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0194.776] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0194.776] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0194.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0194.776] lstrlenW (lpString="Netman") returned 6 [0194.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0194.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0194.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0194.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0194.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0194.776] lstrlenW (lpString="netprofm") returned 8 [0194.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0194.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0194.776] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0194.776] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0194.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0194.776] lstrlenW (lpString="NlaSvc") returned 6 [0194.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0194.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0194.776] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0194.777] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0194.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0194.777] lstrlenW (lpString="nsi") returned 3 [0194.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0194.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0194.777] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0194.777] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0194.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0194.777] lstrlenW (lpString="PcaSvc") returned 6 [0194.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0194.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0194.777] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0194.777] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0194.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0194.777] lstrlenW (lpString="PlugPlay") returned 8 [0194.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0194.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0194.777] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0194.777] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0194.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0194.777] lstrlenW (lpString="Power") returned 5 [0194.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0194.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0194.777] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0194.777] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0194.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0194.777] lstrlenW (lpString="ProfSvc") returned 7 [0194.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0194.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0194.777] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0194.778] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0194.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0194.778] lstrlenW (lpString="RpcEptMapper") returned 12 [0194.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0194.778] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0194.778] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0194.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0194.778] lstrlenW (lpString="RpcSs") returned 5 [0194.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0194.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0194.778] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0194.778] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0194.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0194.778] lstrlenW (lpString="SamSs") returned 5 [0194.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0194.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0194.778] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0194.778] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0194.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0194.778] lstrlenW (lpString="Schedule") returned 8 [0194.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0194.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0194.778] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0194.778] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0194.778] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0194.778] lstrlenW (lpString="SENS") returned 4 [0194.778] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0194.778] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0194.779] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0194.779] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0194.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0194.779] lstrlenW (lpString="ShellHWDetection") returned 16 [0194.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0194.779] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0194.779] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0194.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0194.779] lstrlenW (lpString="Spooler") returned 7 [0194.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0194.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0194.779] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0194.779] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0194.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0194.779] lstrlenW (lpString="SysMain") returned 7 [0194.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0194.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0194.779] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0194.779] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0194.779] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0194.779] lstrlenW (lpString="Themes") returned 6 [0194.779] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0194.779] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0194.780] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0194.780] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0194.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0194.780] lstrlenW (lpString="TrkWks") returned 6 [0194.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0194.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0194.780] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0194.780] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0194.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0194.780] lstrlenW (lpString="UxSms") returned 5 [0194.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0194.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0194.780] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0194.780] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0194.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0194.780] lstrlenW (lpString="WdiServiceHost") returned 14 [0194.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0194.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0194.780] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0194.780] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0194.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0194.780] lstrlenW (lpString="WdiSystemHost") returned 13 [0194.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0194.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0194.780] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0194.780] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0194.780] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0194.780] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0194.780] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0194.780] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0194.780] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0194.781] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0194.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0194.781] lstrlenW (lpString="Winmgmt") returned 7 [0194.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0194.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0194.781] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0194.781] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0194.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0194.781] lstrlenW (lpString="WPDBusEnum") returned 10 [0194.781] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0194.781] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0194.781] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0194.781] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0194.781] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0194.781] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0194.781] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x114 [0194.783] Process32FirstW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0194.783] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0194.783] lstrlenW (lpString="System") returned 6 [0194.783] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0194.783] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0194.783] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0194.783] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0194.784] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0194.784] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0194.784] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0194.784] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0194.784] lstrlenW (lpString="smss.exe") returned 8 [0194.784] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0194.784] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0194.784] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0194.784] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0194.784] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0194.784] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0194.784] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0194.784] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.785] lstrlenW (lpString="csrss.exe") returned 9 [0194.785] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0194.785] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0194.785] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0194.785] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0194.785] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0194.785] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0194.785] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0194.785] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0194.785] lstrlenW (lpString="wininit.exe") returned 11 [0194.785] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0194.785] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0194.785] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0194.785] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0194.785] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0194.785] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0194.785] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0194.785] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0194.786] lstrlenW (lpString="csrss.exe") returned 9 [0194.786] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0194.786] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0194.786] lstrlenW (lpString="winlogon.exe") returned 12 [0194.786] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0194.786] lstrlenW (lpString="services.exe") returned 12 [0194.787] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0194.787] lstrlenW (lpString="lsass.exe") returned 9 [0194.787] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0194.787] lstrlenW (lpString="lsm.exe") returned 7 [0194.787] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.787] lstrlenW (lpString="svchost.exe") returned 11 [0194.788] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.788] lstrlenW (lpString="svchost.exe") returned 11 [0194.788] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.788] lstrlenW (lpString="svchost.exe") returned 11 [0194.788] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.788] lstrlenW (lpString="svchost.exe") returned 11 [0194.789] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.789] lstrlenW (lpString="svchost.exe") returned 11 [0194.789] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0194.789] lstrlenW (lpString="audiodg.exe") returned 11 [0194.789] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.790] lstrlenW (lpString="svchost.exe") returned 11 [0194.790] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0194.790] lstrlenW (lpString="explorer.exe") returned 12 [0194.790] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0194.790] lstrlenW (lpString="dwm.exe") returned 7 [0194.790] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.791] lstrlenW (lpString="svchost.exe") returned 11 [0194.791] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0194.791] lstrlenW (lpString="spoolsv.exe") returned 11 [0194.791] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0194.791] lstrlenW (lpString="reader_sl.exe") returned 13 [0194.792] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.792] lstrlenW (lpString="svchost.exe") returned 11 [0194.792] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0194.792] lstrlenW (lpString="taskhost.exe") returned 12 [0194.792] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0194.793] lstrlenW (lpString="svchost.exe") returned 11 [0194.793] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0194.793] lstrlenW (lpString="1Black.exe") returned 10 [0194.793] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.793] lstrlenW (lpString="dllhost.exe") returned 11 [0194.793] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0194.794] lstrlenW (lpString="dllhost.exe") returned 11 [0194.794] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0194.794] lstrlenW (lpString="1Black.exe") returned 10 [0194.794] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0194.794] CloseHandle (hObject=0x114) returned 1 [0194.794] Sleep (dwMilliseconds=0x1f4) [0195.424] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x36f698 [0195.424] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0195.424] GetLastError () returned 0xea [0195.424] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0195.424] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0195.425] CloseServiceHandle (hSCObject=0x36f698) returned 1 [0195.425] lstrlenW (lpString="Appinfo") returned 7 [0195.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0195.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0195.425] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0195.425] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0195.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0195.425] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0195.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0195.425] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0195.425] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0195.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0195.425] lstrlenW (lpString="AudioSrv") returned 8 [0195.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0195.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0195.426] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0195.426] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0195.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0195.426] lstrlenW (lpString="BFE") returned 3 [0195.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0195.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0195.426] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0195.426] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0195.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0195.426] lstrlenW (lpString="CryptSvc") returned 8 [0195.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0195.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0195.426] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0195.426] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0195.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0195.426] lstrlenW (lpString="CscService") returned 10 [0195.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0195.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0195.426] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0195.426] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0195.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0195.426] lstrlenW (lpString="DcomLaunch") returned 10 [0195.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0195.426] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0195.426] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0195.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0195.426] lstrlenW (lpString="Dhcp") returned 4 [0195.426] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0195.426] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0195.426] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0195.426] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0195.426] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0195.427] lstrlenW (lpString="Dnscache") returned 8 [0195.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0195.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0195.427] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0195.427] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0195.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0195.427] lstrlenW (lpString="DPS") returned 3 [0195.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0195.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0195.427] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0195.427] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0195.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0195.427] lstrlenW (lpString="eventlog") returned 8 [0195.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0195.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0195.427] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0195.427] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0195.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0195.427] lstrlenW (lpString="EventSystem") returned 11 [0195.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0195.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0195.427] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0195.427] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0195.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0195.427] lstrlenW (lpString="FontCache") returned 9 [0195.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0195.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0195.427] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0195.427] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0195.427] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0195.427] lstrlenW (lpString="gpsvc") returned 5 [0195.427] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0195.427] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0195.428] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0195.428] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0195.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0195.428] lstrlenW (lpString="iphlpsvc") returned 8 [0195.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0195.428] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0195.428] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0195.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0195.428] lstrlenW (lpString="LanmanServer") returned 12 [0195.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0195.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0195.428] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0195.428] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0195.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0195.428] lstrlenW (lpString="LanmanWorkstation") returned 17 [0195.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0195.428] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0195.428] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0195.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0195.428] lstrlenW (lpString="lmhosts") returned 7 [0195.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0195.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0195.428] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0195.428] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0195.428] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0195.428] lstrlenW (lpString="MMCSS") returned 5 [0195.428] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0195.428] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0195.428] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0195.428] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0195.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0195.429] lstrlenW (lpString="MpsSvc") returned 6 [0195.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0195.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0195.429] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0195.429] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0195.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0195.429] lstrlenW (lpString="Netman") returned 6 [0195.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0195.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0195.429] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0195.429] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0195.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0195.429] lstrlenW (lpString="netprofm") returned 8 [0195.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0195.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0195.429] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0195.429] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0195.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0195.429] lstrlenW (lpString="NlaSvc") returned 6 [0195.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0195.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0195.429] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0195.429] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0195.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0195.429] lstrlenW (lpString="nsi") returned 3 [0195.429] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0195.429] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0195.429] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0195.429] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0195.429] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0195.430] lstrlenW (lpString="PcaSvc") returned 6 [0195.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0195.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0195.430] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0195.430] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0195.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0195.430] lstrlenW (lpString="PlugPlay") returned 8 [0195.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0195.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0195.430] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0195.430] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0195.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0195.430] lstrlenW (lpString="Power") returned 5 [0195.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0195.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0195.430] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0195.430] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0195.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0195.430] lstrlenW (lpString="ProfSvc") returned 7 [0195.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0195.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0195.430] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0195.430] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0195.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0195.430] lstrlenW (lpString="RpcEptMapper") returned 12 [0195.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0195.430] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0195.430] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0195.430] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0195.430] lstrlenW (lpString="RpcSs") returned 5 [0195.430] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0195.430] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0195.431] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0195.431] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0195.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0195.431] lstrlenW (lpString="SamSs") returned 5 [0195.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0195.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0195.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0195.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0195.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0195.431] lstrlenW (lpString="Schedule") returned 8 [0195.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0195.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0195.431] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0195.431] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0195.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0195.431] lstrlenW (lpString="SENS") returned 4 [0195.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0195.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0195.431] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0195.431] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0195.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0195.431] lstrlenW (lpString="ShellHWDetection") returned 16 [0195.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0195.431] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0195.431] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0195.431] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0195.431] lstrlenW (lpString="Spooler") returned 7 [0195.431] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0195.431] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0195.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0195.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0195.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0195.432] lstrlenW (lpString="SysMain") returned 7 [0195.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0195.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0195.432] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0195.432] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0195.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0195.432] lstrlenW (lpString="Themes") returned 6 [0195.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0195.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0195.432] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0195.432] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0195.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0195.432] lstrlenW (lpString="TrkWks") returned 6 [0195.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0195.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0195.432] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0195.432] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0195.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0195.432] lstrlenW (lpString="UxSms") returned 5 [0195.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0195.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0195.432] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0195.432] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0195.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0195.432] lstrlenW (lpString="WdiServiceHost") returned 14 [0195.432] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0195.432] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0195.432] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0195.432] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0195.432] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0195.433] lstrlenW (lpString="WdiSystemHost") returned 13 [0195.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0195.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0195.433] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0195.433] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0195.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0195.433] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0195.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0195.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0195.433] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0195.433] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0195.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0195.433] lstrlenW (lpString="Winmgmt") returned 7 [0195.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0195.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0195.433] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0195.433] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0195.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0195.433] lstrlenW (lpString="WPDBusEnum") returned 10 [0195.433] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0195.433] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0195.433] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0195.433] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0195.433] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0195.434] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0195.434] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x35c [0195.435] Process32FirstW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0195.436] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0195.436] lstrlenW (lpString="System") returned 6 [0195.436] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0195.436] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0195.436] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0195.436] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0195.436] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0195.436] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0195.436] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0195.436] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0195.436] lstrlenW (lpString="smss.exe") returned 8 [0195.436] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0195.437] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0195.437] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0195.437] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0195.437] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0195.437] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0195.437] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0195.437] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.437] lstrlenW (lpString="csrss.exe") returned 9 [0195.437] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0195.437] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0195.437] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0195.437] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0195.437] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0195.437] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0195.437] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0195.437] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0195.438] lstrlenW (lpString="wininit.exe") returned 11 [0195.438] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0195.438] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0195.438] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0195.438] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0195.438] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0195.438] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0195.438] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0195.438] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0195.438] lstrlenW (lpString="csrss.exe") returned 9 [0195.438] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0195.438] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0195.439] lstrlenW (lpString="winlogon.exe") returned 12 [0195.439] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0195.439] lstrlenW (lpString="services.exe") returned 12 [0195.439] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0195.439] lstrlenW (lpString="lsass.exe") returned 9 [0195.439] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0195.440] lstrlenW (lpString="lsm.exe") returned 7 [0195.440] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.440] lstrlenW (lpString="svchost.exe") returned 11 [0195.440] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.440] lstrlenW (lpString="svchost.exe") returned 11 [0195.440] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.441] lstrlenW (lpString="svchost.exe") returned 11 [0195.441] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.441] lstrlenW (lpString="svchost.exe") returned 11 [0195.441] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.441] lstrlenW (lpString="svchost.exe") returned 11 [0195.441] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0195.442] lstrlenW (lpString="audiodg.exe") returned 11 [0195.442] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.442] lstrlenW (lpString="svchost.exe") returned 11 [0195.442] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0195.442] lstrlenW (lpString="explorer.exe") returned 12 [0195.442] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0195.443] lstrlenW (lpString="dwm.exe") returned 7 [0195.443] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.443] lstrlenW (lpString="svchost.exe") returned 11 [0195.443] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0195.443] lstrlenW (lpString="spoolsv.exe") returned 11 [0195.443] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0195.444] lstrlenW (lpString="reader_sl.exe") returned 13 [0195.444] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.444] lstrlenW (lpString="svchost.exe") returned 11 [0195.444] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0195.444] lstrlenW (lpString="taskhost.exe") returned 12 [0195.444] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0195.445] lstrlenW (lpString="svchost.exe") returned 11 [0195.445] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0195.445] lstrlenW (lpString="1Black.exe") returned 10 [0195.445] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0195.445] lstrlenW (lpString="dllhost.exe") returned 11 [0195.445] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0195.445] lstrlenW (lpString="dllhost.exe") returned 11 [0195.446] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0195.446] lstrlenW (lpString="1Black.exe") returned 10 [0195.446] Process32NextW (in: hSnapshot=0x35c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0195.446] CloseHandle (hObject=0x35c) returned 1 [0195.446] Sleep (dwMilliseconds=0x1f4) [0196.081] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x36f698 [0196.104] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0196.104] GetLastError () returned 0xea [0196.104] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0196.104] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0196.105] CloseServiceHandle (hSCObject=0x36f698) returned 1 [0196.105] lstrlenW (lpString="Appinfo") returned 7 [0196.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0196.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0196.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0196.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0196.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0196.105] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0196.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0196.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0196.105] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0196.105] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0196.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0196.105] lstrlenW (lpString="AudioSrv") returned 8 [0196.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0196.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0196.105] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0196.106] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0196.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0196.106] lstrlenW (lpString="BFE") returned 3 [0196.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0196.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0196.106] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0196.106] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0196.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0196.106] lstrlenW (lpString="CryptSvc") returned 8 [0196.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0196.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0196.106] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0196.106] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0196.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0196.106] lstrlenW (lpString="CscService") returned 10 [0196.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0196.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0196.106] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0196.106] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0196.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0196.106] lstrlenW (lpString="DcomLaunch") returned 10 [0196.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0196.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0196.106] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0196.106] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0196.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0196.106] lstrlenW (lpString="Dhcp") returned 4 [0196.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0196.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0196.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0196.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0196.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0196.106] lstrlenW (lpString="Dnscache") returned 8 [0196.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0196.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0196.107] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0196.107] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0196.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0196.107] lstrlenW (lpString="DPS") returned 3 [0196.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0196.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0196.107] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0196.107] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0196.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0196.107] lstrlenW (lpString="eventlog") returned 8 [0196.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0196.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0196.107] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0196.107] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0196.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0196.107] lstrlenW (lpString="EventSystem") returned 11 [0196.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0196.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0196.107] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0196.107] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0196.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0196.107] lstrlenW (lpString="FontCache") returned 9 [0196.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0196.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0196.107] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0196.107] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0196.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0196.107] lstrlenW (lpString="gpsvc") returned 5 [0196.107] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0196.107] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0196.107] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0196.107] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0196.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0196.108] lstrlenW (lpString="iphlpsvc") returned 8 [0196.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0196.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0196.108] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0196.108] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0196.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0196.108] lstrlenW (lpString="LanmanServer") returned 12 [0196.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0196.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0196.108] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0196.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0196.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0196.108] lstrlenW (lpString="LanmanWorkstation") returned 17 [0196.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0196.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0196.108] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0196.108] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0196.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0196.108] lstrlenW (lpString="lmhosts") returned 7 [0196.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0196.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0196.108] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0196.108] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0196.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0196.108] lstrlenW (lpString="MMCSS") returned 5 [0196.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0196.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0196.108] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0196.108] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0196.108] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0196.108] lstrlenW (lpString="MpsSvc") returned 6 [0196.108] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0196.108] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0196.109] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0196.109] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0196.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0196.109] lstrlenW (lpString="Netman") returned 6 [0196.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0196.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0196.109] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0196.109] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0196.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0196.109] lstrlenW (lpString="netprofm") returned 8 [0196.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0196.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0196.109] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0196.109] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0196.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0196.109] lstrlenW (lpString="NlaSvc") returned 6 [0196.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0196.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0196.109] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0196.109] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0196.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0196.109] lstrlenW (lpString="nsi") returned 3 [0196.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0196.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0196.109] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0196.109] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0196.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0196.109] lstrlenW (lpString="PcaSvc") returned 6 [0196.109] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0196.109] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0196.109] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0196.109] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0196.109] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0196.109] lstrlenW (lpString="PlugPlay") returned 8 [0196.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0196.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0196.110] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0196.110] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0196.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0196.110] lstrlenW (lpString="Power") returned 5 [0196.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0196.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0196.110] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0196.110] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0196.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0196.110] lstrlenW (lpString="ProfSvc") returned 7 [0196.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0196.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0196.110] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0196.110] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0196.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0196.110] lstrlenW (lpString="RpcEptMapper") returned 12 [0196.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0196.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0196.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0196.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0196.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0196.110] lstrlenW (lpString="RpcSs") returned 5 [0196.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0196.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0196.110] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0196.110] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0196.110] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0196.110] lstrlenW (lpString="SamSs") returned 5 [0196.110] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0196.110] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0196.110] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0196.110] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0196.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0196.111] lstrlenW (lpString="Schedule") returned 8 [0196.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0196.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0196.111] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0196.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0196.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0196.111] lstrlenW (lpString="SENS") returned 4 [0196.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0196.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0196.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0196.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0196.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0196.111] lstrlenW (lpString="ShellHWDetection") returned 16 [0196.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0196.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0196.111] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0196.111] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0196.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0196.111] lstrlenW (lpString="Spooler") returned 7 [0196.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0196.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0196.111] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0196.111] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0196.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0196.111] lstrlenW (lpString="SysMain") returned 7 [0196.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0196.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0196.111] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0196.111] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0196.111] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0196.111] lstrlenW (lpString="Themes") returned 6 [0196.111] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0196.111] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0196.112] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0196.112] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0196.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0196.112] lstrlenW (lpString="TrkWks") returned 6 [0196.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0196.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0196.112] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0196.112] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0196.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0196.112] lstrlenW (lpString="UxSms") returned 5 [0196.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0196.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0196.112] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0196.112] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0196.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0196.112] lstrlenW (lpString="WdiServiceHost") returned 14 [0196.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0196.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0196.112] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0196.112] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0196.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0196.112] lstrlenW (lpString="WdiSystemHost") returned 13 [0196.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0196.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0196.112] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0196.112] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0196.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0196.112] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0196.112] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0196.112] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0196.112] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0196.112] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0196.112] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0196.112] lstrlenW (lpString="Winmgmt") returned 7 [0196.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0196.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0196.113] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0196.113] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0196.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0196.113] lstrlenW (lpString="WPDBusEnum") returned 10 [0196.113] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0196.113] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0196.113] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0196.113] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0196.113] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0196.113] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0196.113] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x114 [0196.115] Process32FirstW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.115] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0196.115] lstrlenW (lpString="System") returned 6 [0196.115] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0196.115] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0196.115] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0196.115] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0196.115] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0196.115] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0196.115] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0196.115] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0196.116] lstrlenW (lpString="smss.exe") returned 8 [0196.116] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0196.116] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0196.116] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0196.116] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0196.116] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0196.116] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0196.116] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0196.116] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.116] lstrlenW (lpString="csrss.exe") returned 9 [0196.116] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0196.116] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0196.116] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0196.116] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0196.116] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0196.116] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0196.116] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0196.116] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0196.117] lstrlenW (lpString="wininit.exe") returned 11 [0196.117] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0196.117] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0196.117] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0196.117] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0196.117] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0196.117] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0196.117] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0196.117] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.117] lstrlenW (lpString="csrss.exe") returned 9 [0196.117] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0196.117] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0196.118] lstrlenW (lpString="winlogon.exe") returned 12 [0196.118] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0196.118] lstrlenW (lpString="services.exe") returned 12 [0196.118] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0196.118] lstrlenW (lpString="lsass.exe") returned 9 [0196.118] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0196.119] lstrlenW (lpString="lsm.exe") returned 7 [0196.119] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.119] lstrlenW (lpString="svchost.exe") returned 11 [0196.119] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.119] lstrlenW (lpString="svchost.exe") returned 11 [0196.119] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.120] lstrlenW (lpString="svchost.exe") returned 11 [0196.120] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.120] lstrlenW (lpString="svchost.exe") returned 11 [0196.120] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.120] lstrlenW (lpString="svchost.exe") returned 11 [0196.120] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.121] lstrlenW (lpString="audiodg.exe") returned 11 [0196.121] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.121] lstrlenW (lpString="svchost.exe") returned 11 [0196.121] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.121] lstrlenW (lpString="explorer.exe") returned 12 [0196.121] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.122] lstrlenW (lpString="dwm.exe") returned 7 [0196.122] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.122] lstrlenW (lpString="svchost.exe") returned 11 [0196.122] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.122] lstrlenW (lpString="spoolsv.exe") returned 11 [0196.122] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0196.123] lstrlenW (lpString="reader_sl.exe") returned 13 [0196.123] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.123] lstrlenW (lpString="svchost.exe") returned 11 [0196.123] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0196.123] lstrlenW (lpString="taskhost.exe") returned 12 [0196.123] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.123] lstrlenW (lpString="svchost.exe") returned 11 [0196.124] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0196.124] lstrlenW (lpString="1Black.exe") returned 10 [0196.124] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0196.124] lstrlenW (lpString="dllhost.exe") returned 11 [0196.124] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0196.124] lstrlenW (lpString="dllhost.exe") returned 11 [0196.124] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0196.125] lstrlenW (lpString="1Black.exe") returned 10 [0196.125] Process32NextW (in: hSnapshot=0x114, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0196.125] CloseHandle (hObject=0x114) returned 1 [0196.125] Sleep (dwMilliseconds=0x1f4) [0196.753] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x36f698 [0196.754] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0196.754] GetLastError () returned 0xea [0196.754] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0196.754] EnumServicesStatusExW (in: hSCManager=0x36f698, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0196.754] CloseServiceHandle (hSCObject=0x36f698) returned 1 [0196.755] lstrlenW (lpString="Appinfo") returned 7 [0196.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0196.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0196.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0196.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0196.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0196.755] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0196.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0196.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0196.755] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0196.755] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0196.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0196.755] lstrlenW (lpString="AudioSrv") returned 8 [0196.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0196.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0196.755] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0196.755] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0196.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0196.755] lstrlenW (lpString="BFE") returned 3 [0196.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0196.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0196.755] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0196.755] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0196.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0196.755] lstrlenW (lpString="CryptSvc") returned 8 [0196.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0196.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0196.755] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0196.755] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0196.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0196.756] lstrlenW (lpString="CscService") returned 10 [0196.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0196.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0196.756] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0196.756] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0196.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0196.756] lstrlenW (lpString="DcomLaunch") returned 10 [0196.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0196.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0196.756] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0196.756] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0196.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0196.756] lstrlenW (lpString="Dhcp") returned 4 [0196.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0196.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0196.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0196.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0196.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0196.756] lstrlenW (lpString="Dnscache") returned 8 [0196.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0196.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0196.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0196.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0196.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0196.756] lstrlenW (lpString="DPS") returned 3 [0196.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0196.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0196.756] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0196.756] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0196.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0196.756] lstrlenW (lpString="eventlog") returned 8 [0196.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0196.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0196.757] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0196.757] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0196.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0196.757] lstrlenW (lpString="EventSystem") returned 11 [0196.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0196.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0196.757] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0196.757] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0196.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0196.757] lstrlenW (lpString="FontCache") returned 9 [0196.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0196.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0196.757] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0196.757] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0196.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0196.757] lstrlenW (lpString="gpsvc") returned 5 [0196.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0196.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0196.757] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0196.757] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0196.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0196.757] lstrlenW (lpString="iphlpsvc") returned 8 [0196.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0196.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0196.757] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0196.757] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0196.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0196.757] lstrlenW (lpString="LanmanServer") returned 12 [0196.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0196.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0196.757] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0196.757] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0196.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0196.757] lstrlenW (lpString="LanmanWorkstation") returned 17 [0196.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0196.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0196.758] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0196.758] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0196.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0196.758] lstrlenW (lpString="lmhosts") returned 7 [0196.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0196.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0196.758] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0196.758] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0196.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0196.758] lstrlenW (lpString="MMCSS") returned 5 [0196.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0196.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0196.758] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0196.758] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0196.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0196.758] lstrlenW (lpString="MpsSvc") returned 6 [0196.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0196.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0196.758] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0196.758] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0196.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0196.758] lstrlenW (lpString="Netman") returned 6 [0196.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0196.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0196.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0196.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0196.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0196.758] lstrlenW (lpString="netprofm") returned 8 [0196.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0196.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0196.758] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0196.758] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0196.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0196.758] lstrlenW (lpString="NlaSvc") returned 6 [0196.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0196.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0196.759] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0196.759] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0196.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0196.759] lstrlenW (lpString="nsi") returned 3 [0196.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0196.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0196.759] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0196.759] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0196.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0196.759] lstrlenW (lpString="PcaSvc") returned 6 [0196.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0196.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0196.759] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0196.759] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0196.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0196.759] lstrlenW (lpString="PlugPlay") returned 8 [0196.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0196.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0196.759] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0196.759] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0196.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0196.759] lstrlenW (lpString="Power") returned 5 [0196.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0196.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0196.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0196.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0196.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0196.760] lstrlenW (lpString="ProfSvc") returned 7 [0196.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0196.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0196.760] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0196.760] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0196.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0196.760] lstrlenW (lpString="RpcEptMapper") returned 12 [0196.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0196.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0196.760] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0196.760] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0196.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0196.760] lstrlenW (lpString="RpcSs") returned 5 [0196.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0196.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0196.760] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0196.760] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0196.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0196.760] lstrlenW (lpString="SamSs") returned 5 [0196.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0196.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0196.760] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0196.760] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0196.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0196.760] lstrlenW (lpString="Schedule") returned 8 [0196.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0196.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0196.760] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0196.760] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0196.760] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0196.760] lstrlenW (lpString="SENS") returned 4 [0196.760] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0196.760] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0196.760] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0196.761] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0196.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0196.761] lstrlenW (lpString="ShellHWDetection") returned 16 [0196.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0196.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0196.761] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0196.761] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0196.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0196.761] lstrlenW (lpString="Spooler") returned 7 [0196.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0196.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0196.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0196.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0196.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0196.761] lstrlenW (lpString="SysMain") returned 7 [0196.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0196.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0196.761] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0196.761] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0196.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0196.761] lstrlenW (lpString="Themes") returned 6 [0196.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0196.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0196.761] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0196.761] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0196.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0196.761] lstrlenW (lpString="TrkWks") returned 6 [0196.761] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0196.761] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0196.761] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0196.761] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0196.761] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0196.761] lstrlenW (lpString="UxSms") returned 5 [0196.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0196.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0196.762] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0196.762] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0196.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0196.762] lstrlenW (lpString="WdiServiceHost") returned 14 [0196.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0196.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0196.762] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0196.762] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0196.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0196.762] lstrlenW (lpString="WdiSystemHost") returned 13 [0196.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0196.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0196.762] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0196.762] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0196.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0196.762] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0196.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0196.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0196.762] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0196.762] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0196.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0196.762] lstrlenW (lpString="Winmgmt") returned 7 [0196.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0196.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0196.762] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0196.762] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0196.762] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0196.762] lstrlenW (lpString="WPDBusEnum") returned 10 [0196.762] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0196.762] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0196.762] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0196.762] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0196.763] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0196.763] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0196.763] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0196.764] Process32FirstW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0196.764] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0196.765] lstrlenW (lpString="System") returned 6 [0196.765] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0196.765] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0196.765] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0196.765] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0196.765] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0196.765] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0196.765] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0196.765] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0196.765] lstrlenW (lpString="smss.exe") returned 8 [0196.765] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0196.765] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0196.765] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0196.765] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0196.765] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0196.765] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0196.765] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0196.765] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.766] lstrlenW (lpString="csrss.exe") returned 9 [0196.766] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0196.766] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0196.766] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0196.766] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0196.766] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0196.766] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0196.766] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0196.766] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0196.766] lstrlenW (lpString="wininit.exe") returned 11 [0196.766] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0196.766] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0196.766] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0196.766] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0196.766] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0196.766] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0196.766] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0196.766] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0196.767] lstrlenW (lpString="csrss.exe") returned 9 [0196.767] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0196.767] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0196.767] lstrlenW (lpString="winlogon.exe") returned 12 [0196.767] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0196.768] lstrlenW (lpString="services.exe") returned 12 [0196.768] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0196.768] lstrlenW (lpString="lsass.exe") returned 9 [0196.768] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0196.768] lstrlenW (lpString="lsm.exe") returned 7 [0196.768] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.768] lstrlenW (lpString="svchost.exe") returned 11 [0196.769] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.769] lstrlenW (lpString="svchost.exe") returned 11 [0196.769] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.769] lstrlenW (lpString="svchost.exe") returned 11 [0196.769] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.769] lstrlenW (lpString="svchost.exe") returned 11 [0196.769] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.770] lstrlenW (lpString="svchost.exe") returned 11 [0196.770] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0196.770] lstrlenW (lpString="audiodg.exe") returned 11 [0196.770] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.770] lstrlenW (lpString="svchost.exe") returned 11 [0196.770] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0196.771] lstrlenW (lpString="explorer.exe") returned 12 [0196.771] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0196.771] lstrlenW (lpString="dwm.exe") returned 7 [0196.771] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.771] lstrlenW (lpString="svchost.exe") returned 11 [0196.771] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0196.772] lstrlenW (lpString="spoolsv.exe") returned 11 [0196.772] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0196.772] lstrlenW (lpString="reader_sl.exe") returned 13 [0196.772] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.772] lstrlenW (lpString="svchost.exe") returned 11 [0196.772] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0196.773] lstrlenW (lpString="taskhost.exe") returned 12 [0196.773] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0196.773] lstrlenW (lpString="svchost.exe") returned 11 [0196.773] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0196.773] lstrlenW (lpString="1Black.exe") returned 10 [0196.773] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0196.774] lstrlenW (lpString="dllhost.exe") returned 11 [0196.774] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0196.774] lstrlenW (lpString="1Black.exe") returned 10 [0196.774] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0196.774] CloseHandle (hObject=0x358) returned 1 [0196.774] Sleep (dwMilliseconds=0x1f4) [0197.364] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0197.373] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0197.373] GetLastError () returned 0xea [0197.373] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0197.374] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0197.374] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0197.374] lstrlenW (lpString="Appinfo") returned 7 [0197.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0197.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0197.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0197.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0197.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0197.374] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0197.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0197.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0197.375] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0197.375] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0197.375] lstrlenW (lpString="AudioSrv") returned 8 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0197.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0197.375] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0197.375] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0197.375] lstrlenW (lpString="BFE") returned 3 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0197.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0197.375] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0197.375] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0197.375] lstrlenW (lpString="CryptSvc") returned 8 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0197.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0197.375] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0197.375] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0197.375] lstrlenW (lpString="CscService") returned 10 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0197.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0197.375] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0197.375] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0197.375] lstrlenW (lpString="DcomLaunch") returned 10 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0197.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0197.375] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0197.375] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0197.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0197.375] lstrlenW (lpString="Dhcp") returned 4 [0197.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0197.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0197.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0197.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0197.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0197.376] lstrlenW (lpString="Dnscache") returned 8 [0197.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0197.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0197.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0197.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0197.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0197.376] lstrlenW (lpString="DPS") returned 3 [0197.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0197.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0197.376] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0197.376] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0197.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0197.376] lstrlenW (lpString="eventlog") returned 8 [0197.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0197.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0197.376] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0197.376] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0197.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0197.376] lstrlenW (lpString="EventSystem") returned 11 [0197.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0197.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0197.376] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0197.376] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0197.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0197.376] lstrlenW (lpString="FontCache") returned 9 [0197.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0197.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0197.376] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0197.376] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0197.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0197.377] lstrlenW (lpString="gpsvc") returned 5 [0197.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0197.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0197.377] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0197.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0197.377] lstrlenW (lpString="iphlpsvc") returned 8 [0197.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0197.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0197.377] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0197.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0197.377] lstrlenW (lpString="LanmanServer") returned 12 [0197.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0197.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0197.377] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0197.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0197.377] lstrlenW (lpString="LanmanWorkstation") returned 17 [0197.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0197.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0197.377] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0197.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0197.377] lstrlenW (lpString="lmhosts") returned 7 [0197.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0197.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0197.377] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0197.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0197.377] lstrlenW (lpString="MMCSS") returned 5 [0197.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0197.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0197.377] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0197.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0197.378] lstrlenW (lpString="MpsSvc") returned 6 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0197.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0197.378] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0197.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0197.378] lstrlenW (lpString="Netman") returned 6 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0197.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0197.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0197.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0197.378] lstrlenW (lpString="netprofm") returned 8 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0197.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0197.378] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0197.378] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0197.378] lstrlenW (lpString="NlaSvc") returned 6 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0197.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0197.378] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0197.378] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0197.378] lstrlenW (lpString="nsi") returned 3 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0197.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0197.378] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0197.378] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0197.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0197.378] lstrlenW (lpString="PcaSvc") returned 6 [0197.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0197.379] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0197.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0197.379] lstrlenW (lpString="PlugPlay") returned 8 [0197.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0197.379] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0197.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0197.379] lstrlenW (lpString="Power") returned 5 [0197.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0197.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0197.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0197.379] lstrlenW (lpString="ProfSvc") returned 7 [0197.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0197.379] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0197.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0197.379] lstrlenW (lpString="RpcEptMapper") returned 12 [0197.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0197.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0197.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0197.379] lstrlenW (lpString="RpcSs") returned 5 [0197.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0197.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0197.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0197.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0197.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0197.379] lstrlenW (lpString="SamSs") returned 5 [0197.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0197.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0197.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0197.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0197.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0197.380] lstrlenW (lpString="Schedule") returned 8 [0197.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0197.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0197.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0197.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0197.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0197.380] lstrlenW (lpString="SENS") returned 4 [0197.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0197.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0197.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0197.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0197.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0197.380] lstrlenW (lpString="ShellHWDetection") returned 16 [0197.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0197.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0197.380] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0197.380] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0197.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0197.380] lstrlenW (lpString="Spooler") returned 7 [0197.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0197.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0197.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0197.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0197.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0197.380] lstrlenW (lpString="SysMain") returned 7 [0197.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0197.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0197.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0197.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0197.381] lstrlenW (lpString="Themes") returned 6 [0197.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0197.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0197.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0197.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0197.381] lstrlenW (lpString="TrkWks") returned 6 [0197.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0197.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0197.381] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0197.381] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0197.381] lstrlenW (lpString="UxSms") returned 5 [0197.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0197.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0197.381] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0197.381] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0197.381] lstrlenW (lpString="WdiServiceHost") returned 14 [0197.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0197.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0197.381] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0197.381] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0197.381] lstrlenW (lpString="WdiSystemHost") returned 13 [0197.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0197.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0197.381] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0197.381] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0197.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0197.381] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0197.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0197.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0197.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0197.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0197.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0197.382] lstrlenW (lpString="Winmgmt") returned 7 [0197.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0197.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0197.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0197.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0197.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0197.382] lstrlenW (lpString="WPDBusEnum") returned 10 [0197.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0197.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0197.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0197.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0197.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0197.382] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0197.382] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x150 [0197.384] Process32FirstW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0197.384] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0197.385] lstrlenW (lpString="System") returned 6 [0197.385] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0197.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0197.385] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0197.385] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0197.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0197.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0197.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0197.385] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0197.385] lstrlenW (lpString="smss.exe") returned 8 [0197.385] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0197.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0197.385] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0197.385] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0197.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0197.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0197.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0197.385] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.386] lstrlenW (lpString="csrss.exe") returned 9 [0197.386] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0197.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0197.386] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0197.386] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0197.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0197.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0197.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0197.386] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0197.386] lstrlenW (lpString="wininit.exe") returned 11 [0197.386] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0197.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0197.386] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0197.386] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0197.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0197.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0197.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0197.386] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0197.387] lstrlenW (lpString="csrss.exe") returned 9 [0197.387] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0197.387] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0197.387] lstrlenW (lpString="winlogon.exe") returned 12 [0197.387] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0197.387] lstrlenW (lpString="services.exe") returned 12 [0197.387] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0197.388] lstrlenW (lpString="lsass.exe") returned 9 [0197.388] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0197.388] lstrlenW (lpString="lsm.exe") returned 7 [0197.388] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.388] lstrlenW (lpString="svchost.exe") returned 11 [0197.388] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.389] lstrlenW (lpString="svchost.exe") returned 11 [0197.389] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.389] lstrlenW (lpString="svchost.exe") returned 11 [0197.389] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.389] lstrlenW (lpString="svchost.exe") returned 11 [0197.389] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.390] lstrlenW (lpString="svchost.exe") returned 11 [0197.390] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0197.390] lstrlenW (lpString="audiodg.exe") returned 11 [0197.390] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.390] lstrlenW (lpString="svchost.exe") returned 11 [0197.390] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0197.390] lstrlenW (lpString="explorer.exe") returned 12 [0197.390] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0197.391] lstrlenW (lpString="dwm.exe") returned 7 [0197.391] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.391] lstrlenW (lpString="svchost.exe") returned 11 [0197.391] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0197.391] lstrlenW (lpString="spoolsv.exe") returned 11 [0197.391] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0197.392] lstrlenW (lpString="reader_sl.exe") returned 13 [0197.392] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.392] lstrlenW (lpString="svchost.exe") returned 11 [0197.392] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0197.392] lstrlenW (lpString="taskhost.exe") returned 12 [0197.392] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0197.393] lstrlenW (lpString="svchost.exe") returned 11 [0197.393] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0197.393] lstrlenW (lpString="1Black.exe") returned 10 [0197.393] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x258, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0197.393] lstrlenW (lpString="dllhost.exe") returned 11 [0197.393] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0197.394] lstrlenW (lpString="1Black.exe") returned 10 [0197.394] Process32NextW (in: hSnapshot=0x150, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0197.394] CloseHandle (hObject=0x150) returned 1 [0197.394] Sleep (dwMilliseconds=0x1f4) [0198.087] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0198.087] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0198.088] GetLastError () returned 0xea [0198.088] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0198.088] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0198.088] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0198.088] lstrlenW (lpString="Appinfo") returned 7 [0198.088] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0198.088] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0198.088] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0198.089] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0198.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0198.089] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0198.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.089] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0198.089] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0198.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0198.089] lstrlenW (lpString="AudioSrv") returned 8 [0198.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0198.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0198.089] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0198.089] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0198.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0198.089] lstrlenW (lpString="BFE") returned 3 [0198.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0198.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0198.089] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0198.089] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0198.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0198.089] lstrlenW (lpString="CryptSvc") returned 8 [0198.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0198.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0198.089] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0198.089] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0198.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0198.089] lstrlenW (lpString="CscService") returned 10 [0198.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0198.089] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0198.089] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0198.089] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0198.089] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0198.089] lstrlenW (lpString="DcomLaunch") returned 10 [0198.089] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0198.090] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0198.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0198.090] lstrlenW (lpString="Dhcp") returned 4 [0198.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0198.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0198.090] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0198.090] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0198.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0198.090] lstrlenW (lpString="Dnscache") returned 8 [0198.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0198.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0198.090] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0198.090] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0198.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0198.090] lstrlenW (lpString="DPS") returned 3 [0198.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0198.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0198.090] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0198.090] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0198.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0198.090] lstrlenW (lpString="eventlog") returned 8 [0198.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0198.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0198.090] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0198.090] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0198.090] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0198.090] lstrlenW (lpString="EventSystem") returned 11 [0198.090] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0198.090] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0198.090] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0198.090] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0198.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0198.091] lstrlenW (lpString="FontCache") returned 9 [0198.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0198.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0198.091] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0198.091] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0198.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0198.091] lstrlenW (lpString="gpsvc") returned 5 [0198.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0198.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0198.091] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0198.091] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0198.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0198.091] lstrlenW (lpString="iphlpsvc") returned 8 [0198.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.091] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0198.091] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0198.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0198.091] lstrlenW (lpString="LanmanServer") returned 12 [0198.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0198.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0198.091] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0198.091] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0198.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0198.091] lstrlenW (lpString="LanmanWorkstation") returned 17 [0198.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.091] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0198.091] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0198.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0198.091] lstrlenW (lpString="lmhosts") returned 7 [0198.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0198.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0198.092] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0198.092] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0198.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0198.092] lstrlenW (lpString="MMCSS") returned 5 [0198.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0198.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0198.092] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0198.092] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0198.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0198.092] lstrlenW (lpString="MpsSvc") returned 6 [0198.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0198.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0198.092] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0198.092] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0198.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0198.092] lstrlenW (lpString="Netman") returned 6 [0198.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0198.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0198.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0198.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0198.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0198.092] lstrlenW (lpString="netprofm") returned 8 [0198.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0198.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0198.092] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0198.092] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0198.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0198.092] lstrlenW (lpString="NlaSvc") returned 6 [0198.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0198.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0198.092] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0198.092] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0198.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0198.093] lstrlenW (lpString="nsi") returned 3 [0198.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0198.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0198.093] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0198.093] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0198.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0198.093] lstrlenW (lpString="PcaSvc") returned 6 [0198.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0198.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0198.093] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0198.093] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0198.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0198.093] lstrlenW (lpString="PlugPlay") returned 8 [0198.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0198.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0198.093] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0198.093] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0198.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0198.093] lstrlenW (lpString="Power") returned 5 [0198.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0198.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0198.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0198.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0198.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0198.093] lstrlenW (lpString="ProfSvc") returned 7 [0198.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0198.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0198.093] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0198.093] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0198.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0198.093] lstrlenW (lpString="RpcEptMapper") returned 12 [0198.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0198.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0198.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0198.094] lstrlenW (lpString="RpcSs") returned 5 [0198.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0198.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0198.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0198.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0198.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0198.094] lstrlenW (lpString="SamSs") returned 5 [0198.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0198.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0198.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0198.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0198.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0198.094] lstrlenW (lpString="Schedule") returned 8 [0198.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0198.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0198.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0198.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0198.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0198.094] lstrlenW (lpString="SENS") returned 4 [0198.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0198.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0198.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0198.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0198.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0198.094] lstrlenW (lpString="ShellHWDetection") returned 16 [0198.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.094] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0198.094] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0198.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0198.095] lstrlenW (lpString="Spooler") returned 7 [0198.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0198.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0198.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0198.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0198.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0198.095] lstrlenW (lpString="SysMain") returned 7 [0198.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0198.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0198.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0198.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0198.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0198.095] lstrlenW (lpString="Themes") returned 6 [0198.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0198.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0198.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0198.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0198.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0198.095] lstrlenW (lpString="TrkWks") returned 6 [0198.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0198.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0198.095] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0198.095] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0198.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0198.095] lstrlenW (lpString="UxSms") returned 5 [0198.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0198.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0198.095] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0198.095] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0198.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0198.095] lstrlenW (lpString="WdiServiceHost") returned 14 [0198.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0198.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0198.096] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0198.096] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0198.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0198.096] lstrlenW (lpString="WdiSystemHost") returned 13 [0198.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0198.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0198.096] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0198.096] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0198.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0198.096] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0198.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0198.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0198.096] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0198.096] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0198.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0198.096] lstrlenW (lpString="Winmgmt") returned 7 [0198.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0198.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0198.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0198.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0198.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0198.096] lstrlenW (lpString="WPDBusEnum") returned 10 [0198.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0198.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0198.096] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0198.096] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0198.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0198.096] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0198.096] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0198.098] Process32FirstW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.098] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0198.099] lstrlenW (lpString="System") returned 6 [0198.099] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0198.099] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0198.099] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0198.099] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0198.099] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0198.099] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0198.099] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0198.099] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0198.099] lstrlenW (lpString="smss.exe") returned 8 [0198.099] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0198.099] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0198.099] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0198.099] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0198.099] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0198.099] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0198.099] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0198.099] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.100] lstrlenW (lpString="csrss.exe") returned 9 [0198.100] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0198.100] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0198.100] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0198.100] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0198.100] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0198.100] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0198.100] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0198.100] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0198.100] lstrlenW (lpString="wininit.exe") returned 11 [0198.100] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0198.100] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0198.100] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0198.100] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0198.100] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0198.100] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0198.100] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0198.100] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.101] lstrlenW (lpString="csrss.exe") returned 9 [0198.101] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0198.101] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0198.102] lstrlenW (lpString="winlogon.exe") returned 12 [0198.102] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0198.102] lstrlenW (lpString="services.exe") returned 12 [0198.102] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0198.102] lstrlenW (lpString="lsass.exe") returned 9 [0198.102] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0198.103] lstrlenW (lpString="lsm.exe") returned 7 [0198.103] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.103] lstrlenW (lpString="svchost.exe") returned 11 [0198.103] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.103] lstrlenW (lpString="svchost.exe") returned 11 [0198.103] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.104] lstrlenW (lpString="svchost.exe") returned 11 [0198.104] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.104] lstrlenW (lpString="svchost.exe") returned 11 [0198.104] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.104] lstrlenW (lpString="svchost.exe") returned 11 [0198.104] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0198.104] lstrlenW (lpString="audiodg.exe") returned 11 [0198.105] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.105] lstrlenW (lpString="svchost.exe") returned 11 [0198.105] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0198.105] lstrlenW (lpString="explorer.exe") returned 12 [0198.105] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0198.105] lstrlenW (lpString="dwm.exe") returned 7 [0198.106] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.106] lstrlenW (lpString="svchost.exe") returned 11 [0198.106] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0198.106] lstrlenW (lpString="spoolsv.exe") returned 11 [0198.106] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0198.106] lstrlenW (lpString="reader_sl.exe") returned 13 [0198.107] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.107] lstrlenW (lpString="svchost.exe") returned 11 [0198.107] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0198.107] lstrlenW (lpString="taskhost.exe") returned 12 [0198.107] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.107] lstrlenW (lpString="svchost.exe") returned 11 [0198.108] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0198.108] lstrlenW (lpString="1Black.exe") returned 10 [0198.108] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0198.108] lstrlenW (lpString="1Black.exe") returned 10 [0198.108] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0198.108] CloseHandle (hObject=0x378) returned 1 [0198.108] Sleep (dwMilliseconds=0x1f4) [0198.767] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0198.768] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0198.768] GetLastError () returned 0xea [0198.768] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0198.768] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0198.769] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0198.769] lstrlenW (lpString="Appinfo") returned 7 [0198.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0198.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0198.769] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0198.769] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0198.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0198.769] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0198.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0198.769] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0198.769] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0198.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0198.769] lstrlenW (lpString="AudioSrv") returned 8 [0198.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0198.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0198.769] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0198.769] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0198.769] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0198.769] lstrlenW (lpString="BFE") returned 3 [0198.769] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0198.769] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0198.769] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0198.769] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0198.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0198.770] lstrlenW (lpString="CryptSvc") returned 8 [0198.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0198.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0198.770] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0198.770] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0198.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0198.770] lstrlenW (lpString="CscService") returned 10 [0198.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0198.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0198.770] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0198.770] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0198.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0198.770] lstrlenW (lpString="DcomLaunch") returned 10 [0198.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0198.770] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0198.770] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0198.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0198.770] lstrlenW (lpString="Dhcp") returned 4 [0198.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0198.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0198.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0198.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0198.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0198.770] lstrlenW (lpString="Dnscache") returned 8 [0198.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0198.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0198.770] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0198.770] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0198.770] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0198.770] lstrlenW (lpString="DPS") returned 3 [0198.770] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0198.770] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0198.771] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0198.771] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0198.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0198.771] lstrlenW (lpString="eventlog") returned 8 [0198.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0198.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0198.771] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0198.771] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0198.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0198.771] lstrlenW (lpString="EventSystem") returned 11 [0198.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0198.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0198.771] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0198.771] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0198.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0198.771] lstrlenW (lpString="FontCache") returned 9 [0198.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0198.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0198.771] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0198.771] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0198.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0198.771] lstrlenW (lpString="gpsvc") returned 5 [0198.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0198.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0198.771] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0198.771] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0198.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0198.771] lstrlenW (lpString="iphlpsvc") returned 8 [0198.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.771] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0198.771] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0198.771] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0198.771] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0198.771] lstrlenW (lpString="LanmanServer") returned 12 [0198.771] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0198.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0198.772] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0198.772] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0198.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0198.772] lstrlenW (lpString="LanmanWorkstation") returned 17 [0198.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0198.772] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0198.772] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0198.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0198.772] lstrlenW (lpString="lmhosts") returned 7 [0198.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0198.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0198.772] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0198.772] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0198.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0198.772] lstrlenW (lpString="MMCSS") returned 5 [0198.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0198.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0198.772] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0198.772] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0198.772] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0198.772] lstrlenW (lpString="MpsSvc") returned 6 [0198.772] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0198.772] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0198.772] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0198.772] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0198.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0198.773] lstrlenW (lpString="Netman") returned 6 [0198.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0198.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0198.773] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0198.773] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0198.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0198.773] lstrlenW (lpString="netprofm") returned 8 [0198.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0198.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0198.773] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0198.773] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0198.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0198.773] lstrlenW (lpString="NlaSvc") returned 6 [0198.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0198.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0198.773] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0198.773] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0198.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0198.773] lstrlenW (lpString="nsi") returned 3 [0198.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0198.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0198.773] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0198.773] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0198.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0198.773] lstrlenW (lpString="PcaSvc") returned 6 [0198.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0198.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0198.773] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0198.773] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0198.773] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0198.773] lstrlenW (lpString="PlugPlay") returned 8 [0198.773] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0198.773] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0198.774] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0198.774] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0198.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0198.774] lstrlenW (lpString="Power") returned 5 [0198.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0198.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0198.774] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0198.774] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0198.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0198.774] lstrlenW (lpString="ProfSvc") returned 7 [0198.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0198.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0198.774] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0198.774] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0198.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0198.774] lstrlenW (lpString="RpcEptMapper") returned 12 [0198.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0198.774] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0198.774] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0198.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0198.774] lstrlenW (lpString="RpcSs") returned 5 [0198.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0198.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0198.774] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0198.774] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0198.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0198.774] lstrlenW (lpString="SamSs") returned 5 [0198.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0198.774] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0198.774] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0198.774] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0198.774] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0198.774] lstrlenW (lpString="Schedule") returned 8 [0198.774] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0198.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0198.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0198.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0198.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0198.775] lstrlenW (lpString="SENS") returned 4 [0198.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0198.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0198.775] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0198.775] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0198.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0198.775] lstrlenW (lpString="ShellHWDetection") returned 16 [0198.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0198.775] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0198.775] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0198.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0198.775] lstrlenW (lpString="Spooler") returned 7 [0198.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0198.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0198.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0198.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0198.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0198.775] lstrlenW (lpString="SysMain") returned 7 [0198.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0198.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0198.775] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0198.775] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0198.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0198.775] lstrlenW (lpString="Themes") returned 6 [0198.775] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0198.775] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0198.775] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0198.775] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0198.775] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0198.776] lstrlenW (lpString="TrkWks") returned 6 [0198.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0198.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0198.776] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0198.776] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0198.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0198.776] lstrlenW (lpString="UxSms") returned 5 [0198.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0198.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0198.776] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0198.776] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0198.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0198.776] lstrlenW (lpString="WdiServiceHost") returned 14 [0198.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0198.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0198.776] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0198.776] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0198.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0198.776] lstrlenW (lpString="WdiSystemHost") returned 13 [0198.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0198.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0198.776] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0198.776] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0198.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0198.776] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0198.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0198.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0198.776] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0198.776] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0198.776] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0198.776] lstrlenW (lpString="Winmgmt") returned 7 [0198.776] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0198.776] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0198.776] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0198.776] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0198.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0198.777] lstrlenW (lpString="WPDBusEnum") returned 10 [0198.777] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0198.777] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0198.777] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0198.777] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0198.777] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0198.777] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0198.777] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x388 [0198.778] Process32FirstW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0198.779] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0198.779] lstrlenW (lpString="System") returned 6 [0198.779] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0198.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0198.779] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0198.779] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0198.779] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0198.779] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0198.779] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0198.779] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0198.779] lstrlenW (lpString="smss.exe") returned 8 [0198.779] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0198.779] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0198.779] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0198.779] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0198.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0198.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0198.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0198.780] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.780] lstrlenW (lpString="csrss.exe") returned 9 [0198.780] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0198.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0198.780] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0198.780] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0198.780] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0198.780] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0198.780] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0198.780] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0198.780] lstrlenW (lpString="wininit.exe") returned 11 [0198.780] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0198.780] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0198.780] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0198.780] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0198.781] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0198.781] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0198.781] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0198.781] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0198.781] lstrlenW (lpString="csrss.exe") returned 9 [0198.781] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0198.781] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0198.781] lstrlenW (lpString="winlogon.exe") returned 12 [0198.781] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0198.782] lstrlenW (lpString="services.exe") returned 12 [0198.782] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0198.782] lstrlenW (lpString="lsass.exe") returned 9 [0198.782] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0198.782] lstrlenW (lpString="lsm.exe") returned 7 [0198.782] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.783] lstrlenW (lpString="svchost.exe") returned 11 [0198.783] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.783] lstrlenW (lpString="svchost.exe") returned 11 [0198.783] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.783] lstrlenW (lpString="svchost.exe") returned 11 [0198.783] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.784] lstrlenW (lpString="svchost.exe") returned 11 [0198.784] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.784] lstrlenW (lpString="svchost.exe") returned 11 [0198.784] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0198.784] lstrlenW (lpString="audiodg.exe") returned 11 [0198.784] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.784] lstrlenW (lpString="svchost.exe") returned 11 [0198.785] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0198.785] lstrlenW (lpString="explorer.exe") returned 12 [0198.785] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0198.785] lstrlenW (lpString="dwm.exe") returned 7 [0198.785] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.785] lstrlenW (lpString="svchost.exe") returned 11 [0198.785] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0198.786] lstrlenW (lpString="spoolsv.exe") returned 11 [0198.786] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0198.786] lstrlenW (lpString="reader_sl.exe") returned 13 [0198.786] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.786] lstrlenW (lpString="svchost.exe") returned 11 [0198.786] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0198.787] lstrlenW (lpString="taskhost.exe") returned 12 [0198.787] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0198.787] lstrlenW (lpString="svchost.exe") returned 11 [0198.787] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0198.787] lstrlenW (lpString="1Black.exe") returned 10 [0198.787] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0198.788] lstrlenW (lpString="1Black.exe") returned 10 [0198.788] Process32NextW (in: hSnapshot=0x388, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0198.788] CloseHandle (hObject=0x388) returned 1 [0198.788] Sleep (dwMilliseconds=0x1f4) [0199.373] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0199.373] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0199.373] GetLastError () returned 0xea [0199.373] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0199.373] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0199.374] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0199.374] lstrlenW (lpString="Appinfo") returned 7 [0199.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0199.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0199.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0199.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0199.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0199.374] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0199.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0199.374] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0199.374] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0199.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0199.374] lstrlenW (lpString="AudioSrv") returned 8 [0199.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0199.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0199.375] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0199.375] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0199.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0199.375] lstrlenW (lpString="BFE") returned 3 [0199.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0199.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0199.375] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0199.375] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0199.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0199.375] lstrlenW (lpString="CryptSvc") returned 8 [0199.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0199.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0199.375] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0199.375] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0199.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0199.375] lstrlenW (lpString="CscService") returned 10 [0199.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0199.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0199.375] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0199.375] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0199.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0199.375] lstrlenW (lpString="DcomLaunch") returned 10 [0199.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0199.375] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0199.375] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0199.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0199.375] lstrlenW (lpString="Dhcp") returned 4 [0199.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0199.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0199.375] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0199.375] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0199.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0199.376] lstrlenW (lpString="Dnscache") returned 8 [0199.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0199.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0199.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0199.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0199.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0199.376] lstrlenW (lpString="DPS") returned 3 [0199.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0199.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0199.376] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0199.376] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0199.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0199.376] lstrlenW (lpString="eventlog") returned 8 [0199.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0199.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0199.376] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0199.376] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0199.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0199.376] lstrlenW (lpString="EventSystem") returned 11 [0199.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0199.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0199.376] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0199.376] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0199.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0199.376] lstrlenW (lpString="FontCache") returned 9 [0199.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0199.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0199.376] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0199.376] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0199.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0199.376] lstrlenW (lpString="gpsvc") returned 5 [0199.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0199.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0199.376] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0199.377] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0199.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0199.377] lstrlenW (lpString="iphlpsvc") returned 8 [0199.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0199.377] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0199.377] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0199.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0199.377] lstrlenW (lpString="LanmanServer") returned 12 [0199.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0199.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0199.377] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0199.377] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0199.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0199.377] lstrlenW (lpString="LanmanWorkstation") returned 17 [0199.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0199.377] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0199.377] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0199.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0199.377] lstrlenW (lpString="lmhosts") returned 7 [0199.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0199.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0199.377] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0199.377] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0199.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0199.377] lstrlenW (lpString="MMCSS") returned 5 [0199.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0199.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0199.377] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0199.377] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0199.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0199.377] lstrlenW (lpString="MpsSvc") returned 6 [0199.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0199.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0199.378] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0199.378] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0199.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0199.378] lstrlenW (lpString="Netman") returned 6 [0199.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0199.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0199.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0199.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0199.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0199.378] lstrlenW (lpString="netprofm") returned 8 [0199.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0199.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0199.378] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0199.378] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0199.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0199.378] lstrlenW (lpString="NlaSvc") returned 6 [0199.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0199.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0199.378] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0199.378] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0199.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0199.378] lstrlenW (lpString="nsi") returned 3 [0199.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0199.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0199.378] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0199.378] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0199.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0199.378] lstrlenW (lpString="PcaSvc") returned 6 [0199.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0199.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0199.378] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0199.378] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0199.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0199.379] lstrlenW (lpString="PlugPlay") returned 8 [0199.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0199.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0199.379] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0199.379] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0199.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0199.379] lstrlenW (lpString="Power") returned 5 [0199.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0199.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0199.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0199.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0199.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0199.379] lstrlenW (lpString="ProfSvc") returned 7 [0199.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0199.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0199.379] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0199.379] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0199.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0199.379] lstrlenW (lpString="RpcEptMapper") returned 12 [0199.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0199.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0199.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0199.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0199.379] lstrlenW (lpString="RpcSs") returned 5 [0199.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0199.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0199.379] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0199.379] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0199.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0199.379] lstrlenW (lpString="SamSs") returned 5 [0199.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0199.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0199.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0199.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0199.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0199.380] lstrlenW (lpString="Schedule") returned 8 [0199.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0199.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0199.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0199.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0199.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0199.380] lstrlenW (lpString="SENS") returned 4 [0199.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0199.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0199.380] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0199.380] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0199.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0199.380] lstrlenW (lpString="ShellHWDetection") returned 16 [0199.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0199.380] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0199.380] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0199.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0199.380] lstrlenW (lpString="Spooler") returned 7 [0199.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0199.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0199.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0199.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0199.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0199.380] lstrlenW (lpString="SysMain") returned 7 [0199.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0199.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0199.381] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0199.381] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0199.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0199.381] lstrlenW (lpString="Themes") returned 6 [0199.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0199.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0199.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0199.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0199.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0199.381] lstrlenW (lpString="TrkWks") returned 6 [0199.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0199.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0199.381] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0199.381] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0199.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0199.381] lstrlenW (lpString="UxSms") returned 5 [0199.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0199.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0199.381] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0199.381] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0199.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0199.381] lstrlenW (lpString="WdiServiceHost") returned 14 [0199.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0199.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0199.381] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0199.381] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0199.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0199.381] lstrlenW (lpString="WdiSystemHost") returned 13 [0199.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0199.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0199.381] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0199.381] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0199.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0199.382] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0199.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0199.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0199.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0199.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0199.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0199.382] lstrlenW (lpString="Winmgmt") returned 7 [0199.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0199.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0199.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0199.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0199.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0199.382] lstrlenW (lpString="WPDBusEnum") returned 10 [0199.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0199.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0199.382] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0199.382] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0199.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0199.382] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0199.382] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d4 [0199.384] Process32FirstW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0199.384] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0199.384] lstrlenW (lpString="System") returned 6 [0199.384] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0199.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0199.384] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0199.384] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0199.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0199.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0199.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0199.384] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0199.385] lstrlenW (lpString="smss.exe") returned 8 [0199.385] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0199.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0199.385] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0199.385] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0199.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0199.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0199.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0199.385] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.385] lstrlenW (lpString="csrss.exe") returned 9 [0199.385] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0199.385] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0199.385] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0199.385] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0199.385] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0199.385] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0199.385] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0199.385] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0199.386] lstrlenW (lpString="wininit.exe") returned 11 [0199.386] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0199.386] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0199.386] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0199.386] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0199.386] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0199.386] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0199.386] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0199.386] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0199.386] lstrlenW (lpString="csrss.exe") returned 9 [0199.386] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0199.386] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0199.387] lstrlenW (lpString="winlogon.exe") returned 12 [0199.387] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0199.387] lstrlenW (lpString="services.exe") returned 12 [0199.387] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0199.387] lstrlenW (lpString="lsass.exe") returned 9 [0199.387] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0199.388] lstrlenW (lpString="lsm.exe") returned 7 [0199.388] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.388] lstrlenW (lpString="svchost.exe") returned 11 [0199.388] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.388] lstrlenW (lpString="svchost.exe") returned 11 [0199.388] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.389] lstrlenW (lpString="svchost.exe") returned 11 [0199.389] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.389] lstrlenW (lpString="svchost.exe") returned 11 [0199.389] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.389] lstrlenW (lpString="svchost.exe") returned 11 [0199.389] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0199.390] lstrlenW (lpString="audiodg.exe") returned 11 [0199.390] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.390] lstrlenW (lpString="svchost.exe") returned 11 [0199.390] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0199.390] lstrlenW (lpString="explorer.exe") returned 12 [0199.390] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0199.391] lstrlenW (lpString="dwm.exe") returned 7 [0199.391] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.391] lstrlenW (lpString="svchost.exe") returned 11 [0199.391] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0199.391] lstrlenW (lpString="spoolsv.exe") returned 11 [0199.391] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0199.392] lstrlenW (lpString="reader_sl.exe") returned 13 [0199.392] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.392] lstrlenW (lpString="svchost.exe") returned 11 [0199.392] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0199.392] lstrlenW (lpString="taskhost.exe") returned 12 [0199.392] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0199.393] lstrlenW (lpString="svchost.exe") returned 11 [0199.393] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0199.393] lstrlenW (lpString="1Black.exe") returned 10 [0199.393] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0199.393] lstrlenW (lpString="1Black.exe") returned 10 [0199.393] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0199.394] CloseHandle (hObject=0x2d4) returned 1 [0199.394] Sleep (dwMilliseconds=0x1f4) [0200.036] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0200.055] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0200.064] GetLastError () returned 0xea [0200.064] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0200.064] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0200.067] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0200.067] lstrlenW (lpString="Appinfo") returned 7 [0200.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0200.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0200.067] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0200.067] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0200.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0200.067] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0200.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.067] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0200.067] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0200.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0200.067] lstrlenW (lpString="AudioSrv") returned 8 [0200.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0200.067] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0200.067] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0200.067] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0200.067] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0200.067] lstrlenW (lpString="BFE") returned 3 [0200.067] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0200.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0200.068] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0200.068] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0200.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0200.068] lstrlenW (lpString="CryptSvc") returned 8 [0200.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0200.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0200.068] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0200.068] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0200.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0200.068] lstrlenW (lpString="CscService") returned 10 [0200.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0200.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0200.068] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0200.068] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0200.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0200.068] lstrlenW (lpString="DcomLaunch") returned 10 [0200.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.068] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0200.068] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0200.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0200.068] lstrlenW (lpString="Dhcp") returned 4 [0200.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0200.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0200.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0200.068] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0200.068] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0200.068] lstrlenW (lpString="Dnscache") returned 8 [0200.068] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0200.068] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0200.068] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0200.069] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0200.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0200.069] lstrlenW (lpString="DPS") returned 3 [0200.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0200.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0200.069] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0200.069] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0200.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0200.069] lstrlenW (lpString="eventlog") returned 8 [0200.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0200.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0200.069] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0200.069] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0200.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0200.069] lstrlenW (lpString="EventSystem") returned 11 [0200.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0200.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0200.069] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0200.069] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0200.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0200.069] lstrlenW (lpString="FontCache") returned 9 [0200.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0200.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0200.069] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0200.069] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0200.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0200.069] lstrlenW (lpString="gpsvc") returned 5 [0200.069] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0200.069] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0200.069] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0200.069] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0200.069] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0200.069] lstrlenW (lpString="iphlpsvc") returned 8 [0200.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.070] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0200.070] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0200.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0200.070] lstrlenW (lpString="LanmanServer") returned 12 [0200.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0200.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0200.070] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0200.070] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0200.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0200.070] lstrlenW (lpString="LanmanWorkstation") returned 17 [0200.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.070] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0200.070] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0200.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0200.070] lstrlenW (lpString="lmhosts") returned 7 [0200.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0200.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0200.070] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0200.070] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0200.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0200.070] lstrlenW (lpString="MMCSS") returned 5 [0200.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0200.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0200.070] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0200.070] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0200.070] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0200.070] lstrlenW (lpString="MpsSvc") returned 6 [0200.070] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0200.070] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0200.070] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0200.071] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0200.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0200.071] lstrlenW (lpString="Netman") returned 6 [0200.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0200.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0200.071] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0200.071] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0200.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0200.071] lstrlenW (lpString="netprofm") returned 8 [0200.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0200.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0200.071] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0200.071] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0200.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0200.071] lstrlenW (lpString="NlaSvc") returned 6 [0200.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0200.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0200.071] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0200.071] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0200.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0200.071] lstrlenW (lpString="nsi") returned 3 [0200.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0200.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0200.071] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0200.071] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0200.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0200.071] lstrlenW (lpString="PcaSvc") returned 6 [0200.071] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0200.071] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0200.071] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0200.071] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0200.071] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0200.072] lstrlenW (lpString="PlugPlay") returned 8 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0200.072] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0200.072] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0200.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0200.072] lstrlenW (lpString="Power") returned 5 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0200.072] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0200.072] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0200.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0200.072] lstrlenW (lpString="ProfSvc") returned 7 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0200.072] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0200.072] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0200.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0200.072] lstrlenW (lpString="RpcEptMapper") returned 12 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.072] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0200.072] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0200.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0200.072] lstrlenW (lpString="RpcSs") returned 5 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0200.072] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0200.072] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0200.072] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0200.072] lstrlenW (lpString="SamSs") returned 5 [0200.072] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0200.072] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0200.073] lstrlenW (lpString="Schedule") returned 8 [0200.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0200.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0200.073] lstrlenW (lpString="SENS") returned 4 [0200.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0200.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0200.073] lstrlenW (lpString="ShellHWDetection") returned 16 [0200.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0200.073] lstrlenW (lpString="Spooler") returned 7 [0200.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0200.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0200.073] lstrlenW (lpString="SysMain") returned 7 [0200.073] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0200.073] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0200.073] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0200.073] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0200.073] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0200.074] lstrlenW (lpString="Themes") returned 6 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0200.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0200.074] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0200.074] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0200.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0200.074] lstrlenW (lpString="TrkWks") returned 6 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0200.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0200.074] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0200.074] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0200.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0200.074] lstrlenW (lpString="UxSms") returned 5 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0200.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0200.074] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0200.074] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0200.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0200.074] lstrlenW (lpString="WdiServiceHost") returned 14 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0200.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0200.074] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0200.074] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0200.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0200.074] lstrlenW (lpString="WdiSystemHost") returned 13 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0200.074] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0200.074] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0200.074] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0200.074] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0200.074] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0200.074] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0200.075] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0200.075] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0200.075] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0200.075] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0200.076] lstrlenW (lpString="Winmgmt") returned 7 [0200.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0200.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0200.076] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0200.076] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0200.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0200.076] lstrlenW (lpString="WPDBusEnum") returned 10 [0200.076] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0200.076] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0200.076] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0200.076] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0200.076] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0200.076] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0200.076] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x358 [0200.078] Process32FirstW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.078] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.079] lstrlenW (lpString="System") returned 6 [0200.079] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0200.079] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0200.079] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0200.079] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0200.079] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0200.079] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0200.079] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0200.079] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.079] lstrlenW (lpString="smss.exe") returned 8 [0200.079] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0200.079] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0200.079] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0200.079] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0200.079] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0200.079] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0200.079] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0200.079] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.080] lstrlenW (lpString="csrss.exe") returned 9 [0200.080] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0200.080] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0200.080] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0200.080] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0200.080] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0200.080] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0200.080] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0200.080] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.080] lstrlenW (lpString="wininit.exe") returned 11 [0200.080] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0200.080] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0200.080] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0200.080] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0200.080] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0200.080] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0200.080] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0200.080] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.081] lstrlenW (lpString="csrss.exe") returned 9 [0200.081] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0200.081] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.081] lstrlenW (lpString="winlogon.exe") returned 12 [0200.081] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.081] lstrlenW (lpString="services.exe") returned 12 [0200.081] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0200.082] lstrlenW (lpString="lsass.exe") returned 9 [0200.082] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0200.082] lstrlenW (lpString="lsm.exe") returned 7 [0200.082] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.083] lstrlenW (lpString="svchost.exe") returned 11 [0200.083] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.083] lstrlenW (lpString="svchost.exe") returned 11 [0200.083] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.083] lstrlenW (lpString="svchost.exe") returned 11 [0200.083] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.084] lstrlenW (lpString="svchost.exe") returned 11 [0200.084] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.084] lstrlenW (lpString="svchost.exe") returned 11 [0200.084] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0200.084] lstrlenW (lpString="audiodg.exe") returned 11 [0200.084] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.085] lstrlenW (lpString="svchost.exe") returned 11 [0200.085] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0200.085] lstrlenW (lpString="explorer.exe") returned 12 [0200.085] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0200.085] lstrlenW (lpString="dwm.exe") returned 7 [0200.085] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.086] lstrlenW (lpString="svchost.exe") returned 11 [0200.086] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0200.086] lstrlenW (lpString="spoolsv.exe") returned 11 [0200.086] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0200.086] lstrlenW (lpString="reader_sl.exe") returned 13 [0200.086] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.087] lstrlenW (lpString="svchost.exe") returned 11 [0200.087] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0200.087] lstrlenW (lpString="taskhost.exe") returned 12 [0200.087] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.087] lstrlenW (lpString="svchost.exe") returned 11 [0200.087] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0200.088] lstrlenW (lpString="1Black.exe") returned 10 [0200.088] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0200.088] lstrlenW (lpString="1Black.exe") returned 10 [0200.088] Process32NextW (in: hSnapshot=0x358, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0200.088] CloseHandle (hObject=0x358) returned 1 [0200.088] Sleep (dwMilliseconds=0x1f4) [0200.750] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0200.750] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0200.751] GetLastError () returned 0xea [0200.751] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0200.751] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0200.751] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0200.751] lstrlenW (lpString="Appinfo") returned 7 [0200.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0200.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0200.752] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0200.752] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0200.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0200.752] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0200.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0200.752] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0200.752] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0200.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0200.752] lstrlenW (lpString="AudioSrv") returned 8 [0200.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0200.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0200.752] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0200.752] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0200.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0200.752] lstrlenW (lpString="BFE") returned 3 [0200.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0200.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0200.752] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0200.752] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0200.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0200.752] lstrlenW (lpString="CryptSvc") returned 8 [0200.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0200.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0200.752] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0200.752] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0200.752] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0200.752] lstrlenW (lpString="CscService") returned 10 [0200.752] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0200.752] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0200.752] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0200.752] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0200.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0200.753] lstrlenW (lpString="DcomLaunch") returned 10 [0200.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0200.753] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0200.753] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0200.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0200.753] lstrlenW (lpString="Dhcp") returned 4 [0200.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0200.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0200.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0200.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0200.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0200.753] lstrlenW (lpString="Dnscache") returned 8 [0200.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0200.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0200.753] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0200.753] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0200.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0200.753] lstrlenW (lpString="DPS") returned 3 [0200.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0200.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0200.753] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0200.753] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0200.753] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0200.753] lstrlenW (lpString="eventlog") returned 8 [0200.753] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0200.753] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0200.754] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0200.754] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0200.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0200.754] lstrlenW (lpString="EventSystem") returned 11 [0200.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0200.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0200.754] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0200.754] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0200.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0200.754] lstrlenW (lpString="FontCache") returned 9 [0200.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0200.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0200.754] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0200.754] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0200.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0200.754] lstrlenW (lpString="gpsvc") returned 5 [0200.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0200.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0200.754] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0200.754] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0200.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0200.754] lstrlenW (lpString="iphlpsvc") returned 8 [0200.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0200.754] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0200.754] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0200.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0200.754] lstrlenW (lpString="LanmanServer") returned 12 [0200.754] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0200.754] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0200.754] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0200.754] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0200.754] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0200.755] lstrlenW (lpString="LanmanWorkstation") returned 17 [0200.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0200.755] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0200.755] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0200.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0200.755] lstrlenW (lpString="lmhosts") returned 7 [0200.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0200.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0200.755] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0200.755] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0200.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0200.755] lstrlenW (lpString="MMCSS") returned 5 [0200.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0200.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0200.755] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0200.755] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0200.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0200.755] lstrlenW (lpString="MpsSvc") returned 6 [0200.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0200.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0200.755] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0200.755] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0200.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0200.755] lstrlenW (lpString="Netman") returned 6 [0200.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0200.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0200.755] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0200.755] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0200.755] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0200.755] lstrlenW (lpString="netprofm") returned 8 [0200.755] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0200.755] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0200.756] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0200.756] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0200.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0200.756] lstrlenW (lpString="NlaSvc") returned 6 [0200.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0200.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0200.756] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0200.756] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0200.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0200.756] lstrlenW (lpString="nsi") returned 3 [0200.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0200.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0200.756] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0200.756] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0200.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0200.756] lstrlenW (lpString="PcaSvc") returned 6 [0200.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0200.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0200.756] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0200.756] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0200.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0200.756] lstrlenW (lpString="PlugPlay") returned 8 [0200.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0200.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0200.756] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0200.756] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0200.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0200.756] lstrlenW (lpString="Power") returned 5 [0200.756] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0200.756] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0200.756] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0200.756] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0200.756] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0200.756] lstrlenW (lpString="ProfSvc") returned 7 [0200.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0200.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0200.757] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0200.757] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0200.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0200.757] lstrlenW (lpString="RpcEptMapper") returned 12 [0200.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0200.757] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0200.757] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0200.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0200.757] lstrlenW (lpString="RpcSs") returned 5 [0200.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0200.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0200.757] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0200.757] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0200.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0200.757] lstrlenW (lpString="SamSs") returned 5 [0200.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0200.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0200.757] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0200.757] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0200.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0200.757] lstrlenW (lpString="Schedule") returned 8 [0200.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0200.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0200.757] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0200.757] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0200.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0200.757] lstrlenW (lpString="SENS") returned 4 [0200.757] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0200.757] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0200.757] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0200.757] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0200.757] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0200.758] lstrlenW (lpString="ShellHWDetection") returned 16 [0200.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0200.758] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0200.758] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0200.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0200.758] lstrlenW (lpString="Spooler") returned 7 [0200.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0200.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0200.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0200.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0200.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0200.758] lstrlenW (lpString="SysMain") returned 7 [0200.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0200.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0200.758] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0200.758] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0200.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0200.758] lstrlenW (lpString="Themes") returned 6 [0200.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0200.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0200.758] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0200.758] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0200.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0200.758] lstrlenW (lpString="TrkWks") returned 6 [0200.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0200.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0200.758] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0200.758] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0200.758] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0200.758] lstrlenW (lpString="UxSms") returned 5 [0200.758] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0200.758] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0200.759] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0200.759] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0200.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0200.759] lstrlenW (lpString="WdiServiceHost") returned 14 [0200.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0200.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0200.759] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0200.759] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0200.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0200.759] lstrlenW (lpString="WdiSystemHost") returned 13 [0200.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0200.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0200.759] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0200.759] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0200.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0200.759] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0200.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0200.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0200.759] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0200.759] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0200.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0200.759] lstrlenW (lpString="Winmgmt") returned 7 [0200.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0200.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0200.759] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0200.759] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0200.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0200.759] lstrlenW (lpString="WPDBusEnum") returned 10 [0200.759] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0200.759] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0200.759] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0200.759] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0200.759] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0200.760] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0200.760] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x2d4 [0200.761] Process32FirstW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0200.761] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0200.762] lstrlenW (lpString="System") returned 6 [0200.762] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0200.762] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0200.762] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0200.762] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0200.762] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0200.762] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0200.762] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0200.762] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0200.762] lstrlenW (lpString="smss.exe") returned 8 [0200.762] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0200.762] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0200.762] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0200.762] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0200.762] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0200.762] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0200.762] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0200.763] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.763] lstrlenW (lpString="csrss.exe") returned 9 [0200.763] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0200.763] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0200.763] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0200.763] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0200.763] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0200.763] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0200.763] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0200.763] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0200.763] lstrlenW (lpString="wininit.exe") returned 11 [0200.763] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0200.763] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0200.763] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0200.763] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0200.763] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0200.763] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0200.764] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0200.764] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0200.764] lstrlenW (lpString="csrss.exe") returned 9 [0200.764] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0200.764] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0200.764] lstrlenW (lpString="winlogon.exe") returned 12 [0200.764] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0200.765] lstrlenW (lpString="services.exe") returned 12 [0200.765] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0200.765] lstrlenW (lpString="lsass.exe") returned 9 [0200.765] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0200.765] lstrlenW (lpString="lsm.exe") returned 7 [0200.765] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.766] lstrlenW (lpString="svchost.exe") returned 11 [0200.766] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.766] lstrlenW (lpString="svchost.exe") returned 11 [0200.766] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.766] lstrlenW (lpString="svchost.exe") returned 11 [0200.766] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.767] lstrlenW (lpString="svchost.exe") returned 11 [0200.767] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.767] lstrlenW (lpString="svchost.exe") returned 11 [0200.767] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0200.767] lstrlenW (lpString="audiodg.exe") returned 11 [0200.767] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.768] lstrlenW (lpString="svchost.exe") returned 11 [0200.768] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0200.768] lstrlenW (lpString="explorer.exe") returned 12 [0200.768] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0200.769] lstrlenW (lpString="dwm.exe") returned 7 [0200.769] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.769] lstrlenW (lpString="svchost.exe") returned 11 [0200.769] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0200.770] lstrlenW (lpString="spoolsv.exe") returned 11 [0200.770] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0200.770] lstrlenW (lpString="reader_sl.exe") returned 13 [0200.770] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.770] lstrlenW (lpString="svchost.exe") returned 11 [0200.770] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0200.771] lstrlenW (lpString="taskhost.exe") returned 12 [0200.771] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0200.771] lstrlenW (lpString="svchost.exe") returned 11 [0200.771] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0200.771] lstrlenW (lpString="1Black.exe") returned 10 [0200.771] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0200.772] lstrlenW (lpString="1Black.exe") returned 10 [0200.772] Process32NextW (in: hSnapshot=0x2d4, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0200.772] CloseHandle (hObject=0x2d4) returned 1 [0200.772] Sleep (dwMilliseconds=0x1f4) [0201.555] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0201.565] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0201.575] GetLastError () returned 0xea [0201.575] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0201.575] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0201.619] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0201.619] lstrlenW (lpString="Appinfo") returned 7 [0201.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0201.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0201.619] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0201.619] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0201.619] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0201.619] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0201.619] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0201.619] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0201.619] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0201.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0201.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0201.620] lstrlenW (lpString="AudioSrv") returned 8 [0201.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0201.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0201.620] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0201.620] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0201.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0201.620] lstrlenW (lpString="BFE") returned 3 [0201.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0201.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0201.620] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0201.620] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0201.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0201.620] lstrlenW (lpString="CryptSvc") returned 8 [0201.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0201.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0201.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0201.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0201.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0201.620] lstrlenW (lpString="CscService") returned 10 [0201.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0201.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0201.620] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0201.620] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0201.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0201.620] lstrlenW (lpString="DcomLaunch") returned 10 [0201.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0201.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0201.620] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0201.620] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0201.620] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0201.620] lstrlenW (lpString="Dhcp") returned 4 [0201.620] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0201.620] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0201.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0201.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0201.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0201.621] lstrlenW (lpString="Dnscache") returned 8 [0201.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0201.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0201.621] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0201.621] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0201.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0201.621] lstrlenW (lpString="DPS") returned 3 [0201.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0201.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0201.621] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0201.621] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0201.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0201.621] lstrlenW (lpString="eventlog") returned 8 [0201.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0201.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0201.621] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0201.621] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0201.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0201.621] lstrlenW (lpString="EventSystem") returned 11 [0201.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0201.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0201.621] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0201.621] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0201.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0201.621] lstrlenW (lpString="FontCache") returned 9 [0201.621] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0201.621] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0201.621] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0201.621] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0201.621] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0201.621] lstrlenW (lpString="gpsvc") returned 5 [0201.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0201.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0201.622] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0201.622] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0201.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0201.622] lstrlenW (lpString="iphlpsvc") returned 8 [0201.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0201.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0201.622] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0201.622] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0201.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0201.622] lstrlenW (lpString="LanmanServer") returned 12 [0201.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0201.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0201.622] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0201.622] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0201.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0201.622] lstrlenW (lpString="LanmanWorkstation") returned 17 [0201.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0201.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0201.622] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0201.622] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0201.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0201.622] lstrlenW (lpString="lmhosts") returned 7 [0201.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0201.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0201.622] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0201.622] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0201.622] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0201.622] lstrlenW (lpString="MMCSS") returned 5 [0201.622] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0201.622] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0201.622] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0201.622] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0201.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0201.623] lstrlenW (lpString="MpsSvc") returned 6 [0201.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0201.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0201.623] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0201.623] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0201.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0201.623] lstrlenW (lpString="Netman") returned 6 [0201.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0201.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0201.623] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0201.623] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0201.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0201.623] lstrlenW (lpString="netprofm") returned 8 [0201.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0201.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0201.623] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0201.623] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0201.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0201.623] lstrlenW (lpString="NlaSvc") returned 6 [0201.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0201.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0201.623] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0201.623] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0201.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0201.623] lstrlenW (lpString="nsi") returned 3 [0201.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0201.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0201.623] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0201.623] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0201.623] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0201.623] lstrlenW (lpString="PcaSvc") returned 6 [0201.623] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0201.623] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0201.624] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0201.624] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0201.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0201.624] lstrlenW (lpString="PlugPlay") returned 8 [0201.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0201.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0201.624] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0201.624] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0201.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0201.624] lstrlenW (lpString="Power") returned 5 [0201.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0201.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0201.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0201.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0201.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0201.624] lstrlenW (lpString="ProfSvc") returned 7 [0201.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0201.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0201.624] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0201.624] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0201.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0201.624] lstrlenW (lpString="RpcEptMapper") returned 12 [0201.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0201.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0201.624] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0201.624] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0201.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0201.624] lstrlenW (lpString="RpcSs") returned 5 [0201.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0201.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0201.624] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0201.624] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0201.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0201.624] lstrlenW (lpString="SamSs") returned 5 [0201.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0201.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0201.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0201.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0201.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0201.625] lstrlenW (lpString="Schedule") returned 8 [0201.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0201.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0201.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0201.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0201.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0201.625] lstrlenW (lpString="SENS") returned 4 [0201.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0201.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0201.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0201.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0201.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0201.625] lstrlenW (lpString="ShellHWDetection") returned 16 [0201.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0201.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0201.625] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0201.625] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0201.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0201.625] lstrlenW (lpString="Spooler") returned 7 [0201.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0201.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0201.625] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0201.625] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0201.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0201.625] lstrlenW (lpString="SysMain") returned 7 [0201.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0201.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0201.625] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0201.625] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0201.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0201.626] lstrlenW (lpString="Themes") returned 6 [0201.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0201.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0201.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0201.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0201.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0201.626] lstrlenW (lpString="TrkWks") returned 6 [0201.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0201.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0201.626] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0201.626] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0201.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0201.626] lstrlenW (lpString="UxSms") returned 5 [0201.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0201.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0201.626] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0201.626] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0201.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0201.626] lstrlenW (lpString="WdiServiceHost") returned 14 [0201.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0201.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0201.626] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0201.626] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0201.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0201.626] lstrlenW (lpString="WdiSystemHost") returned 13 [0201.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0201.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0201.626] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0201.626] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0201.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0201.627] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0201.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0201.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0201.627] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0201.627] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0201.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0201.627] lstrlenW (lpString="Winmgmt") returned 7 [0201.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0201.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0201.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0201.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0201.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0201.627] lstrlenW (lpString="WPDBusEnum") returned 10 [0201.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0201.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0201.627] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0201.627] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0201.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0201.627] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0201.627] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x15c [0201.629] Process32FirstW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0201.629] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0201.629] lstrlenW (lpString="System") returned 6 [0201.629] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0201.629] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0201.629] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0201.629] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0201.629] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0201.630] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0201.630] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0201.630] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0201.630] lstrlenW (lpString="smss.exe") returned 8 [0201.630] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0201.630] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0201.630] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0201.630] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0201.630] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0201.630] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0201.630] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0201.630] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.630] lstrlenW (lpString="csrss.exe") returned 9 [0201.630] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0201.630] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0201.630] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0201.630] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0201.631] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0201.631] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0201.631] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0201.631] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0201.631] lstrlenW (lpString="wininit.exe") returned 11 [0201.631] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0201.631] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0201.631] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0201.631] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0201.631] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0201.631] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0201.631] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0201.631] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0201.631] lstrlenW (lpString="csrss.exe") returned 9 [0201.631] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0201.632] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0201.632] lstrlenW (lpString="winlogon.exe") returned 12 [0201.632] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0201.632] lstrlenW (lpString="services.exe") returned 12 [0201.632] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0201.632] lstrlenW (lpString="lsass.exe") returned 9 [0201.633] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0201.633] lstrlenW (lpString="lsm.exe") returned 7 [0201.633] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.633] lstrlenW (lpString="svchost.exe") returned 11 [0201.633] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.633] lstrlenW (lpString="svchost.exe") returned 11 [0201.633] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.634] lstrlenW (lpString="svchost.exe") returned 11 [0201.634] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.635] lstrlenW (lpString="svchost.exe") returned 11 [0201.635] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.635] lstrlenW (lpString="svchost.exe") returned 11 [0201.636] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0201.636] lstrlenW (lpString="audiodg.exe") returned 11 [0201.636] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.636] lstrlenW (lpString="svchost.exe") returned 11 [0201.636] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0201.636] lstrlenW (lpString="explorer.exe") returned 12 [0201.636] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0201.637] lstrlenW (lpString="dwm.exe") returned 7 [0201.637] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.637] lstrlenW (lpString="svchost.exe") returned 11 [0201.637] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0201.637] lstrlenW (lpString="spoolsv.exe") returned 11 [0201.637] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0201.638] lstrlenW (lpString="reader_sl.exe") returned 13 [0201.638] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.638] lstrlenW (lpString="svchost.exe") returned 11 [0201.638] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0201.638] lstrlenW (lpString="taskhost.exe") returned 12 [0201.638] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0201.639] lstrlenW (lpString="svchost.exe") returned 11 [0201.639] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0201.639] lstrlenW (lpString="1Black.exe") returned 10 [0201.639] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0201.639] lstrlenW (lpString="1Black.exe") returned 10 [0201.639] Process32NextW (in: hSnapshot=0x15c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0201.640] CloseHandle (hObject=0x15c) returned 1 [0201.640] Sleep (dwMilliseconds=0x1f4) [0202.291] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0202.291] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0202.291] GetLastError () returned 0xea [0202.291] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0202.292] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0202.292] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0202.292] lstrlenW (lpString="Appinfo") returned 7 [0202.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0202.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0202.292] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0202.292] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0202.292] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0202.292] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0202.292] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.292] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.292] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0202.292] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0202.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0202.293] lstrlenW (lpString="AudioSrv") returned 8 [0202.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0202.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0202.293] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0202.293] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0202.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0202.293] lstrlenW (lpString="BFE") returned 3 [0202.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0202.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0202.293] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0202.293] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0202.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0202.293] lstrlenW (lpString="CryptSvc") returned 8 [0202.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0202.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0202.293] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0202.293] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0202.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0202.293] lstrlenW (lpString="CscService") returned 10 [0202.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0202.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0202.293] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0202.293] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0202.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0202.293] lstrlenW (lpString="DcomLaunch") returned 10 [0202.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.293] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0202.293] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0202.293] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0202.293] lstrlenW (lpString="Dhcp") returned 4 [0202.293] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0202.293] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0202.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0202.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0202.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0202.294] lstrlenW (lpString="Dnscache") returned 8 [0202.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0202.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0202.294] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0202.294] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0202.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0202.294] lstrlenW (lpString="DPS") returned 3 [0202.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0202.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0202.294] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0202.294] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0202.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0202.294] lstrlenW (lpString="eventlog") returned 8 [0202.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0202.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0202.294] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0202.294] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0202.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0202.294] lstrlenW (lpString="EventSystem") returned 11 [0202.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0202.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0202.294] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0202.294] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0202.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0202.294] lstrlenW (lpString="FontCache") returned 9 [0202.294] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0202.294] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0202.294] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0202.294] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0202.294] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0202.294] lstrlenW (lpString="gpsvc") returned 5 [0202.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0202.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0202.295] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0202.295] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0202.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0202.295] lstrlenW (lpString="iphlpsvc") returned 8 [0202.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.295] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0202.295] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0202.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0202.295] lstrlenW (lpString="LanmanServer") returned 12 [0202.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0202.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0202.295] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0202.295] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0202.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0202.295] lstrlenW (lpString="LanmanWorkstation") returned 17 [0202.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.295] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0202.295] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0202.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0202.295] lstrlenW (lpString="lmhosts") returned 7 [0202.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0202.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0202.295] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0202.295] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0202.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0202.295] lstrlenW (lpString="MMCSS") returned 5 [0202.295] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0202.295] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0202.295] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0202.295] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0202.295] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0202.296] lstrlenW (lpString="MpsSvc") returned 6 [0202.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0202.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0202.296] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0202.296] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0202.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0202.296] lstrlenW (lpString="Netman") returned 6 [0202.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0202.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0202.296] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0202.296] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0202.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0202.296] lstrlenW (lpString="netprofm") returned 8 [0202.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0202.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0202.296] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0202.296] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0202.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0202.296] lstrlenW (lpString="NlaSvc") returned 6 [0202.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0202.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0202.296] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0202.296] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0202.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0202.296] lstrlenW (lpString="nsi") returned 3 [0202.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0202.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0202.296] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0202.296] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0202.296] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0202.296] lstrlenW (lpString="PcaSvc") returned 6 [0202.296] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0202.296] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0202.296] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0202.297] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0202.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0202.297] lstrlenW (lpString="PlugPlay") returned 8 [0202.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0202.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0202.297] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0202.297] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0202.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0202.297] lstrlenW (lpString="Power") returned 5 [0202.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0202.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0202.297] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0202.297] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0202.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0202.297] lstrlenW (lpString="ProfSvc") returned 7 [0202.297] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0202.297] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0202.297] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0202.297] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0202.297] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0202.297] lstrlenW (lpString="RpcEptMapper") returned 12 [0202.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.298] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0202.298] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0202.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0202.298] lstrlenW (lpString="RpcSs") returned 5 [0202.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0202.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0202.298] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0202.298] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0202.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0202.298] lstrlenW (lpString="SamSs") returned 5 [0202.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0202.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0202.298] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0202.298] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0202.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0202.298] lstrlenW (lpString="Schedule") returned 8 [0202.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0202.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0202.298] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0202.298] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0202.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0202.298] lstrlenW (lpString="SENS") returned 4 [0202.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0202.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0202.298] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0202.298] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0202.298] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0202.298] lstrlenW (lpString="ShellHWDetection") returned 16 [0202.298] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.298] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.298] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0202.298] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0202.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0202.299] lstrlenW (lpString="Spooler") returned 7 [0202.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0202.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0202.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0202.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0202.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0202.299] lstrlenW (lpString="SysMain") returned 7 [0202.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0202.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0202.299] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0202.299] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0202.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0202.299] lstrlenW (lpString="Themes") returned 6 [0202.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0202.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0202.299] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0202.299] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0202.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0202.299] lstrlenW (lpString="TrkWks") returned 6 [0202.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0202.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0202.299] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0202.299] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0202.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0202.299] lstrlenW (lpString="UxSms") returned 5 [0202.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0202.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0202.299] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0202.299] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0202.299] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0202.299] lstrlenW (lpString="WdiServiceHost") returned 14 [0202.299] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0202.299] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0202.299] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0202.300] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0202.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0202.300] lstrlenW (lpString="WdiSystemHost") returned 13 [0202.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0202.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0202.300] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0202.300] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0202.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0202.300] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0202.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0202.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0202.300] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0202.300] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0202.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0202.300] lstrlenW (lpString="Winmgmt") returned 7 [0202.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0202.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0202.300] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0202.300] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0202.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0202.300] lstrlenW (lpString="WPDBusEnum") returned 10 [0202.300] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0202.300] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0202.300] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0202.300] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0202.300] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0202.300] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0202.300] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x378 [0202.302] Process32FirstW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.302] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0202.303] lstrlenW (lpString="System") returned 6 [0202.303] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0202.303] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0202.303] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0202.303] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0202.303] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0202.303] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0202.303] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0202.303] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0202.303] lstrlenW (lpString="smss.exe") returned 8 [0202.303] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0202.303] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0202.303] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0202.303] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0202.303] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0202.303] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0202.303] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0202.303] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.304] lstrlenW (lpString="csrss.exe") returned 9 [0202.304] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0202.304] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0202.304] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0202.304] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0202.304] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0202.304] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0202.304] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0202.304] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0202.304] lstrlenW (lpString="wininit.exe") returned 11 [0202.304] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0202.304] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0202.304] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0202.304] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0202.304] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0202.304] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0202.304] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0202.304] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.305] lstrlenW (lpString="csrss.exe") returned 9 [0202.305] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0202.305] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0202.305] lstrlenW (lpString="winlogon.exe") returned 12 [0202.305] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0202.305] lstrlenW (lpString="services.exe") returned 12 [0202.305] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0202.306] lstrlenW (lpString="lsass.exe") returned 9 [0202.306] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0202.306] lstrlenW (lpString="lsm.exe") returned 7 [0202.306] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.306] lstrlenW (lpString="svchost.exe") returned 11 [0202.306] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.307] lstrlenW (lpString="svchost.exe") returned 11 [0202.307] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.307] lstrlenW (lpString="svchost.exe") returned 11 [0202.307] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.307] lstrlenW (lpString="svchost.exe") returned 11 [0202.307] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.308] lstrlenW (lpString="svchost.exe") returned 11 [0202.308] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0202.308] lstrlenW (lpString="audiodg.exe") returned 11 [0202.308] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.308] lstrlenW (lpString="svchost.exe") returned 11 [0202.308] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0202.309] lstrlenW (lpString="explorer.exe") returned 12 [0202.309] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0202.309] lstrlenW (lpString="dwm.exe") returned 7 [0202.309] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.309] lstrlenW (lpString="svchost.exe") returned 11 [0202.309] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0202.310] lstrlenW (lpString="spoolsv.exe") returned 11 [0202.310] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0202.310] lstrlenW (lpString="reader_sl.exe") returned 13 [0202.310] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.310] lstrlenW (lpString="svchost.exe") returned 11 [0202.310] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0202.311] lstrlenW (lpString="taskhost.exe") returned 12 [0202.311] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.311] lstrlenW (lpString="svchost.exe") returned 11 [0202.311] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0202.311] lstrlenW (lpString="1Black.exe") returned 10 [0202.311] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0202.312] lstrlenW (lpString="1Black.exe") returned 10 [0202.312] Process32NextW (in: hSnapshot=0x378, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0202.312] CloseHandle (hObject=0x378) returned 1 [0202.312] Sleep (dwMilliseconds=0x1f4) [0202.878] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0202.879] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0202.879] GetLastError () returned 0xea [0202.879] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0202.879] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0202.879] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0202.880] lstrlenW (lpString="Appinfo") returned 7 [0202.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0202.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0202.880] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0202.880] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0202.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0202.880] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0202.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0202.880] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0202.880] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0202.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0202.880] lstrlenW (lpString="AudioSrv") returned 8 [0202.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0202.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0202.880] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0202.880] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0202.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0202.880] lstrlenW (lpString="BFE") returned 3 [0202.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0202.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0202.880] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0202.880] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0202.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0202.880] lstrlenW (lpString="CryptSvc") returned 8 [0202.880] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0202.880] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0202.880] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0202.880] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0202.880] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0202.881] lstrlenW (lpString="CscService") returned 10 [0202.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0202.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0202.881] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0202.881] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0202.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0202.881] lstrlenW (lpString="DcomLaunch") returned 10 [0202.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0202.881] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0202.881] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0202.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0202.881] lstrlenW (lpString="Dhcp") returned 4 [0202.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0202.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0202.881] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0202.881] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0202.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0202.881] lstrlenW (lpString="Dnscache") returned 8 [0202.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0202.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0202.881] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0202.881] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0202.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0202.881] lstrlenW (lpString="DPS") returned 3 [0202.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0202.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0202.881] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0202.881] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0202.881] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0202.881] lstrlenW (lpString="eventlog") returned 8 [0202.881] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0202.881] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0202.881] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0202.882] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0202.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0202.882] lstrlenW (lpString="EventSystem") returned 11 [0202.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0202.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0202.882] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0202.882] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0202.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0202.882] lstrlenW (lpString="FontCache") returned 9 [0202.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0202.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0202.882] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0202.882] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0202.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0202.882] lstrlenW (lpString="gpsvc") returned 5 [0202.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0202.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0202.882] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0202.882] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0202.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0202.882] lstrlenW (lpString="iphlpsvc") returned 8 [0202.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0202.882] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0202.882] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0202.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0202.882] lstrlenW (lpString="LanmanServer") returned 12 [0202.882] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0202.882] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0202.882] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0202.882] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0202.882] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0202.882] lstrlenW (lpString="LanmanWorkstation") returned 17 [0202.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0202.883] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0202.883] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0202.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0202.883] lstrlenW (lpString="lmhosts") returned 7 [0202.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0202.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0202.883] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0202.883] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0202.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0202.883] lstrlenW (lpString="MMCSS") returned 5 [0202.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0202.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0202.883] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0202.883] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0202.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0202.883] lstrlenW (lpString="MpsSvc") returned 6 [0202.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0202.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0202.883] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0202.883] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0202.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0202.883] lstrlenW (lpString="Netman") returned 6 [0202.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0202.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0202.883] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0202.883] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0202.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0202.883] lstrlenW (lpString="netprofm") returned 8 [0202.883] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0202.883] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0202.883] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0202.883] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0202.883] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0202.884] lstrlenW (lpString="NlaSvc") returned 6 [0202.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0202.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0202.884] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0202.884] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0202.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0202.884] lstrlenW (lpString="nsi") returned 3 [0202.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0202.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0202.884] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0202.884] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0202.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0202.884] lstrlenW (lpString="PcaSvc") returned 6 [0202.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0202.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0202.884] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0202.884] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0202.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0202.884] lstrlenW (lpString="PlugPlay") returned 8 [0202.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0202.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0202.884] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0202.884] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0202.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0202.884] lstrlenW (lpString="Power") returned 5 [0202.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0202.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0202.884] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0202.884] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0202.884] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0202.884] lstrlenW (lpString="ProfSvc") returned 7 [0202.884] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0202.884] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0202.884] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0202.885] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0202.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0202.885] lstrlenW (lpString="RpcEptMapper") returned 12 [0202.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0202.885] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0202.885] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0202.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0202.885] lstrlenW (lpString="RpcSs") returned 5 [0202.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0202.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0202.885] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0202.885] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0202.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0202.885] lstrlenW (lpString="SamSs") returned 5 [0202.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0202.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0202.885] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0202.885] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0202.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0202.885] lstrlenW (lpString="Schedule") returned 8 [0202.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0202.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0202.885] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0202.885] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0202.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0202.885] lstrlenW (lpString="SENS") returned 4 [0202.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0202.885] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0202.885] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0202.885] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0202.885] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0202.885] lstrlenW (lpString="ShellHWDetection") returned 16 [0202.885] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0202.886] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0202.886] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0202.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0202.886] lstrlenW (lpString="Spooler") returned 7 [0202.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0202.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0202.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0202.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0202.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0202.886] lstrlenW (lpString="SysMain") returned 7 [0202.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0202.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0202.886] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0202.886] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0202.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0202.886] lstrlenW (lpString="Themes") returned 6 [0202.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0202.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0202.886] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0202.886] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0202.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0202.886] lstrlenW (lpString="TrkWks") returned 6 [0202.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0202.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0202.886] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0202.886] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0202.886] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0202.886] lstrlenW (lpString="UxSms") returned 5 [0202.886] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0202.886] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0202.886] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0202.886] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0202.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0202.887] lstrlenW (lpString="WdiServiceHost") returned 14 [0202.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0202.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0202.887] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0202.887] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0202.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0202.887] lstrlenW (lpString="WdiSystemHost") returned 13 [0202.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0202.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0202.887] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0202.887] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0202.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0202.887] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0202.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0202.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0202.887] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0202.887] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0202.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0202.887] lstrlenW (lpString="Winmgmt") returned 7 [0202.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0202.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0202.887] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0202.887] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0202.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0202.887] lstrlenW (lpString="WPDBusEnum") returned 10 [0202.887] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0202.887] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0202.887] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0202.887] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0202.887] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0202.887] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0202.887] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0202.889] Process32FirstW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0202.889] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0202.890] lstrlenW (lpString="System") returned 6 [0202.890] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0202.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0202.890] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0202.890] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0202.890] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0202.890] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0202.890] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0202.890] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0202.890] lstrlenW (lpString="smss.exe") returned 8 [0202.890] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0202.890] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0202.890] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0202.890] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0202.890] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0202.890] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0202.890] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0202.891] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.891] lstrlenW (lpString="csrss.exe") returned 9 [0202.891] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0202.891] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0202.891] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0202.891] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0202.891] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0202.891] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0202.891] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0202.891] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0202.891] lstrlenW (lpString="wininit.exe") returned 11 [0202.891] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0202.891] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0202.891] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0202.891] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0202.891] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0202.892] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0202.892] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0202.892] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0202.892] lstrlenW (lpString="csrss.exe") returned 9 [0202.892] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0202.892] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0202.892] lstrlenW (lpString="winlogon.exe") returned 12 [0202.892] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0202.893] lstrlenW (lpString="services.exe") returned 12 [0202.893] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0202.893] lstrlenW (lpString="lsass.exe") returned 9 [0202.893] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0202.893] lstrlenW (lpString="lsm.exe") returned 7 [0202.893] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.894] lstrlenW (lpString="svchost.exe") returned 11 [0202.894] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.894] lstrlenW (lpString="svchost.exe") returned 11 [0202.894] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.894] lstrlenW (lpString="svchost.exe") returned 11 [0202.894] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.895] lstrlenW (lpString="svchost.exe") returned 11 [0202.895] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.895] lstrlenW (lpString="svchost.exe") returned 11 [0202.895] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0202.895] lstrlenW (lpString="audiodg.exe") returned 11 [0202.895] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.896] lstrlenW (lpString="svchost.exe") returned 11 [0202.896] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0202.896] lstrlenW (lpString="explorer.exe") returned 12 [0202.896] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0202.896] lstrlenW (lpString="dwm.exe") returned 7 [0202.896] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.896] lstrlenW (lpString="svchost.exe") returned 11 [0202.897] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0202.897] lstrlenW (lpString="spoolsv.exe") returned 11 [0202.897] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0202.897] lstrlenW (lpString="reader_sl.exe") returned 13 [0202.897] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.897] lstrlenW (lpString="svchost.exe") returned 11 [0202.897] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0202.898] lstrlenW (lpString="taskhost.exe") returned 12 [0202.898] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0202.898] lstrlenW (lpString="svchost.exe") returned 11 [0202.898] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0202.898] lstrlenW (lpString="1Black.exe") returned 10 [0202.898] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0202.899] lstrlenW (lpString="1Black.exe") returned 10 [0202.899] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0202.899] CloseHandle (hObject=0x350) returned 1 [0202.899] Sleep (dwMilliseconds=0x1f4) [0203.497] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0203.504] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0203.504] GetLastError () returned 0xea [0203.504] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0203.504] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0203.505] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0203.505] lstrlenW (lpString="Appinfo") returned 7 [0203.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0203.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0203.505] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0203.505] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0203.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0203.505] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0203.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0203.505] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0203.505] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0203.505] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0203.505] lstrlenW (lpString="AudioSrv") returned 8 [0203.505] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0203.505] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0203.506] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0203.506] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0203.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0203.506] lstrlenW (lpString="BFE") returned 3 [0203.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0203.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0203.506] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0203.506] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0203.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0203.506] lstrlenW (lpString="CryptSvc") returned 8 [0203.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0203.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0203.506] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0203.506] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0203.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0203.506] lstrlenW (lpString="CscService") returned 10 [0203.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0203.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0203.506] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0203.506] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0203.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0203.506] lstrlenW (lpString="DcomLaunch") returned 10 [0203.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0203.506] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0203.506] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0203.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0203.506] lstrlenW (lpString="Dhcp") returned 4 [0203.506] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0203.506] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0203.506] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0203.506] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0203.506] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0203.507] lstrlenW (lpString="Dnscache") returned 8 [0203.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0203.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0203.507] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0203.507] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0203.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0203.507] lstrlenW (lpString="DPS") returned 3 [0203.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0203.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0203.507] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0203.507] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0203.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0203.507] lstrlenW (lpString="eventlog") returned 8 [0203.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0203.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0203.507] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0203.507] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0203.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0203.507] lstrlenW (lpString="EventSystem") returned 11 [0203.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0203.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0203.507] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0203.507] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0203.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0203.507] lstrlenW (lpString="FontCache") returned 9 [0203.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0203.507] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0203.507] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0203.507] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0203.507] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0203.507] lstrlenW (lpString="gpsvc") returned 5 [0203.507] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0203.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0203.508] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0203.508] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0203.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0203.508] lstrlenW (lpString="iphlpsvc") returned 8 [0203.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0203.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0203.508] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0203.508] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0203.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0203.508] lstrlenW (lpString="LanmanServer") returned 12 [0203.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0203.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0203.508] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0203.508] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0203.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0203.508] lstrlenW (lpString="LanmanWorkstation") returned 17 [0203.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0203.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0203.508] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0203.508] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0203.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0203.508] lstrlenW (lpString="lmhosts") returned 7 [0203.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0203.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0203.508] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0203.508] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0203.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0203.508] lstrlenW (lpString="MMCSS") returned 5 [0203.508] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0203.508] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0203.508] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0203.508] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0203.508] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0203.509] lstrlenW (lpString="MpsSvc") returned 6 [0203.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0203.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0203.509] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0203.509] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0203.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0203.509] lstrlenW (lpString="Netman") returned 6 [0203.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0203.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0203.509] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0203.509] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0203.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0203.509] lstrlenW (lpString="netprofm") returned 8 [0203.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0203.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0203.509] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0203.509] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0203.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0203.509] lstrlenW (lpString="NlaSvc") returned 6 [0203.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0203.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0203.509] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0203.509] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0203.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0203.509] lstrlenW (lpString="nsi") returned 3 [0203.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0203.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0203.509] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0203.509] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0203.509] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0203.509] lstrlenW (lpString="PcaSvc") returned 6 [0203.509] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0203.509] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0203.509] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0203.510] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0203.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0203.510] lstrlenW (lpString="PlugPlay") returned 8 [0203.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0203.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0203.510] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0203.510] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0203.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0203.510] lstrlenW (lpString="Power") returned 5 [0203.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0203.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0203.510] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0203.510] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0203.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0203.510] lstrlenW (lpString="ProfSvc") returned 7 [0203.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0203.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0203.510] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0203.510] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0203.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0203.510] lstrlenW (lpString="RpcEptMapper") returned 12 [0203.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0203.510] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0203.510] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0203.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0203.510] lstrlenW (lpString="RpcSs") returned 5 [0203.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0203.510] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0203.510] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0203.510] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0203.510] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0203.510] lstrlenW (lpString="SamSs") returned 5 [0203.510] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0203.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0203.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0203.511] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0203.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0203.511] lstrlenW (lpString="Schedule") returned 8 [0203.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0203.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0203.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0203.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0203.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0203.511] lstrlenW (lpString="SENS") returned 4 [0203.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0203.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0203.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0203.511] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0203.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0203.511] lstrlenW (lpString="ShellHWDetection") returned 16 [0203.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0203.511] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0203.511] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0203.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0203.511] lstrlenW (lpString="Spooler") returned 7 [0203.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0203.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0203.511] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0203.511] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0203.511] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0203.511] lstrlenW (lpString="SysMain") returned 7 [0203.511] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0203.511] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0203.511] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0203.512] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0203.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0203.512] lstrlenW (lpString="Themes") returned 6 [0203.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0203.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0203.512] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0203.512] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0203.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0203.512] lstrlenW (lpString="TrkWks") returned 6 [0203.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0203.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0203.512] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0203.512] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0203.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0203.512] lstrlenW (lpString="UxSms") returned 5 [0203.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0203.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0203.512] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0203.512] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0203.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0203.512] lstrlenW (lpString="WdiServiceHost") returned 14 [0203.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0203.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0203.512] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0203.512] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0203.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0203.512] lstrlenW (lpString="WdiSystemHost") returned 13 [0203.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0203.512] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0203.512] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0203.512] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0203.512] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0203.512] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0203.512] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0203.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0203.513] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0203.513] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0203.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0203.513] lstrlenW (lpString="Winmgmt") returned 7 [0203.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0203.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0203.513] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0203.513] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0203.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0203.513] lstrlenW (lpString="WPDBusEnum") returned 10 [0203.513] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0203.513] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0203.513] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0203.513] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0203.513] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0203.513] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0203.513] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x350 [0203.515] Process32FirstW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0203.515] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0203.515] lstrlenW (lpString="System") returned 6 [0203.515] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0203.515] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0203.515] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0203.515] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0203.515] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0203.516] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0203.516] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0203.516] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0203.516] lstrlenW (lpString="smss.exe") returned 8 [0203.516] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0203.516] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0203.516] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0203.516] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0203.516] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0203.516] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0203.516] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0203.516] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.516] lstrlenW (lpString="csrss.exe") returned 9 [0203.516] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0203.516] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0203.516] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0203.516] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0203.517] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0203.517] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0203.517] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0203.517] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0203.517] lstrlenW (lpString="wininit.exe") returned 11 [0203.517] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0203.517] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0203.517] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0203.517] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0203.517] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0203.517] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0203.517] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0203.517] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0203.517] lstrlenW (lpString="csrss.exe") returned 9 [0203.517] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0203.518] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0203.518] lstrlenW (lpString="winlogon.exe") returned 12 [0203.518] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0203.518] lstrlenW (lpString="services.exe") returned 12 [0203.518] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0203.518] lstrlenW (lpString="lsass.exe") returned 9 [0203.518] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0203.519] lstrlenW (lpString="lsm.exe") returned 7 [0203.519] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.519] lstrlenW (lpString="svchost.exe") returned 11 [0203.519] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.519] lstrlenW (lpString="svchost.exe") returned 11 [0203.519] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.520] lstrlenW (lpString="svchost.exe") returned 11 [0203.520] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.520] lstrlenW (lpString="svchost.exe") returned 11 [0203.520] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.520] lstrlenW (lpString="svchost.exe") returned 11 [0203.520] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0203.521] lstrlenW (lpString="audiodg.exe") returned 11 [0203.521] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.521] lstrlenW (lpString="svchost.exe") returned 11 [0203.521] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0203.521] lstrlenW (lpString="explorer.exe") returned 12 [0203.521] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0203.522] lstrlenW (lpString="dwm.exe") returned 7 [0203.522] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.522] lstrlenW (lpString="svchost.exe") returned 11 [0203.522] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0203.522] lstrlenW (lpString="spoolsv.exe") returned 11 [0203.522] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0203.523] lstrlenW (lpString="reader_sl.exe") returned 13 [0203.523] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.523] lstrlenW (lpString="svchost.exe") returned 11 [0203.523] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0203.523] lstrlenW (lpString="taskhost.exe") returned 12 [0203.523] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0203.524] lstrlenW (lpString="svchost.exe") returned 11 [0203.524] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0203.524] lstrlenW (lpString="1Black.exe") returned 10 [0203.524] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0203.524] lstrlenW (lpString="1Black.exe") returned 10 [0203.524] Process32NextW (in: hSnapshot=0x350, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0203.525] CloseHandle (hObject=0x350) returned 1 [0203.525] Sleep (dwMilliseconds=0x1f4) [0204.339] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0204.346] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0204.347] GetLastError () returned 0xea [0204.354] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0204.354] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0204.371] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0204.372] lstrlenW (lpString="Appinfo") returned 7 [0204.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0204.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0204.372] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0204.372] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0204.372] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0204.372] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0204.372] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.372] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.373] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0204.373] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0204.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0204.373] lstrlenW (lpString="AudioSrv") returned 8 [0204.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0204.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0204.373] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0204.373] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0204.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0204.373] lstrlenW (lpString="BFE") returned 3 [0204.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0204.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0204.373] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0204.373] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0204.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0204.373] lstrlenW (lpString="CryptSvc") returned 8 [0204.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0204.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0204.373] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0204.373] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0204.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0204.373] lstrlenW (lpString="CscService") returned 10 [0204.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0204.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0204.373] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0204.373] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0204.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0204.373] lstrlenW (lpString="DcomLaunch") returned 10 [0204.373] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.373] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.373] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0204.373] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0204.373] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0204.374] lstrlenW (lpString="Dhcp") returned 4 [0204.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0204.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0204.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0204.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0204.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0204.374] lstrlenW (lpString="Dnscache") returned 8 [0204.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0204.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0204.374] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0204.374] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0204.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0204.374] lstrlenW (lpString="DPS") returned 3 [0204.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0204.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0204.374] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0204.374] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0204.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0204.374] lstrlenW (lpString="eventlog") returned 8 [0204.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0204.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0204.374] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0204.374] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0204.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0204.374] lstrlenW (lpString="EventSystem") returned 11 [0204.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0204.374] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0204.374] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0204.374] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0204.374] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0204.374] lstrlenW (lpString="FontCache") returned 9 [0204.374] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0204.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0204.375] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0204.375] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0204.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0204.375] lstrlenW (lpString="gpsvc") returned 5 [0204.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0204.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0204.375] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0204.375] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0204.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0204.375] lstrlenW (lpString="iphlpsvc") returned 8 [0204.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.375] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0204.375] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0204.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0204.375] lstrlenW (lpString="LanmanServer") returned 12 [0204.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0204.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0204.375] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0204.375] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0204.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0204.375] lstrlenW (lpString="LanmanWorkstation") returned 17 [0204.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.375] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0204.375] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0204.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0204.375] lstrlenW (lpString="lmhosts") returned 7 [0204.375] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0204.375] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0204.375] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0204.375] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0204.375] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0204.376] lstrlenW (lpString="MMCSS") returned 5 [0204.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0204.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0204.376] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0204.376] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0204.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0204.376] lstrlenW (lpString="MpsSvc") returned 6 [0204.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0204.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0204.376] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0204.376] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0204.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0204.376] lstrlenW (lpString="Netman") returned 6 [0204.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0204.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0204.376] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0204.376] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0204.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0204.376] lstrlenW (lpString="netprofm") returned 8 [0204.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0204.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0204.376] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0204.376] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0204.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0204.376] lstrlenW (lpString="NlaSvc") returned 6 [0204.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0204.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0204.376] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0204.376] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0204.376] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0204.376] lstrlenW (lpString="nsi") returned 3 [0204.376] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0204.376] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0204.376] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0204.377] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0204.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0204.377] lstrlenW (lpString="PcaSvc") returned 6 [0204.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0204.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0204.377] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0204.377] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0204.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0204.377] lstrlenW (lpString="PlugPlay") returned 8 [0204.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0204.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0204.377] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0204.377] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0204.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0204.377] lstrlenW (lpString="Power") returned 5 [0204.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0204.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0204.377] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0204.377] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0204.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0204.377] lstrlenW (lpString="ProfSvc") returned 7 [0204.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0204.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0204.377] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0204.377] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0204.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0204.377] lstrlenW (lpString="RpcEptMapper") returned 12 [0204.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.377] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0204.377] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0204.377] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0204.377] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0204.377] lstrlenW (lpString="RpcSs") returned 5 [0204.377] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0204.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0204.378] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0204.378] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0204.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0204.378] lstrlenW (lpString="SamSs") returned 5 [0204.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0204.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0204.378] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0204.378] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0204.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0204.378] lstrlenW (lpString="Schedule") returned 8 [0204.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0204.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0204.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0204.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0204.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0204.378] lstrlenW (lpString="SENS") returned 4 [0204.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0204.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0204.378] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0204.378] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0204.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0204.378] lstrlenW (lpString="ShellHWDetection") returned 16 [0204.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0204.378] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0204.378] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0204.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0204.378] lstrlenW (lpString="Spooler") returned 7 [0204.378] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0204.378] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0204.378] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0204.378] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0204.378] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0204.379] lstrlenW (lpString="SysMain") returned 7 [0204.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0204.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0204.379] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0204.379] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0204.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0204.379] lstrlenW (lpString="Themes") returned 6 [0204.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0204.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0204.379] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0204.379] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0204.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0204.379] lstrlenW (lpString="TrkWks") returned 6 [0204.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0204.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0204.379] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0204.379] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0204.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0204.379] lstrlenW (lpString="UxSms") returned 5 [0204.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0204.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0204.379] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0204.379] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0204.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0204.379] lstrlenW (lpString="WdiServiceHost") returned 14 [0204.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0204.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0204.379] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0204.379] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0204.379] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0204.379] lstrlenW (lpString="WdiSystemHost") returned 13 [0204.379] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0204.379] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0204.380] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0204.380] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0204.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0204.380] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0204.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0204.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0204.380] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0204.380] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0204.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0204.380] lstrlenW (lpString="Winmgmt") returned 7 [0204.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0204.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0204.380] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0204.380] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0204.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0204.380] lstrlenW (lpString="WPDBusEnum") returned 10 [0204.380] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0204.380] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0204.380] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0204.380] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0204.380] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0204.380] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0204.380] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0204.382] Process32FirstW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0204.382] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0204.382] lstrlenW (lpString="System") returned 6 [0204.382] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0204.382] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0204.382] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0204.382] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0204.382] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0204.382] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0204.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0204.383] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0204.383] lstrlenW (lpString="smss.exe") returned 8 [0204.383] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0204.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0204.383] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0204.383] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0204.383] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0204.383] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0204.383] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0204.383] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.383] lstrlenW (lpString="csrss.exe") returned 9 [0204.383] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0204.383] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0204.383] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0204.383] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0204.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0204.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0204.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0204.384] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0204.384] lstrlenW (lpString="wininit.exe") returned 11 [0204.384] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0204.384] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0204.384] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0204.384] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0204.384] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0204.384] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0204.384] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0204.384] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0204.384] lstrlenW (lpString="csrss.exe") returned 9 [0204.384] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0204.385] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0204.385] lstrlenW (lpString="winlogon.exe") returned 12 [0204.385] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0204.385] lstrlenW (lpString="services.exe") returned 12 [0204.385] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0204.386] lstrlenW (lpString="lsass.exe") returned 9 [0204.386] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0204.386] lstrlenW (lpString="lsm.exe") returned 7 [0204.386] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.386] lstrlenW (lpString="svchost.exe") returned 11 [0204.386] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.386] lstrlenW (lpString="svchost.exe") returned 11 [0204.387] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.387] lstrlenW (lpString="svchost.exe") returned 11 [0204.387] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.387] lstrlenW (lpString="svchost.exe") returned 11 [0204.387] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.388] lstrlenW (lpString="svchost.exe") returned 11 [0204.388] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0204.388] lstrlenW (lpString="audiodg.exe") returned 11 [0204.388] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.388] lstrlenW (lpString="svchost.exe") returned 11 [0204.388] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0204.389] lstrlenW (lpString="explorer.exe") returned 12 [0204.389] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0204.389] lstrlenW (lpString="dwm.exe") returned 7 [0204.389] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.389] lstrlenW (lpString="svchost.exe") returned 11 [0204.389] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0204.390] lstrlenW (lpString="spoolsv.exe") returned 11 [0204.390] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0204.390] lstrlenW (lpString="reader_sl.exe") returned 13 [0204.390] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.390] lstrlenW (lpString="svchost.exe") returned 11 [0204.390] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0204.391] lstrlenW (lpString="taskhost.exe") returned 12 [0204.391] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0204.391] lstrlenW (lpString="svchost.exe") returned 11 [0204.391] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0204.391] lstrlenW (lpString="1Black.exe") returned 10 [0204.391] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0204.392] lstrlenW (lpString="1Black.exe") returned 10 [0204.392] Process32NextW (in: hSnapshot=0x33c, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0204.392] CloseHandle (hObject=0x33c) returned 1 [0204.392] Sleep (dwMilliseconds=0x1f4) [0204.995] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x41b4380 [0204.995] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 0 [0204.995] GetLastError () returned 0xea [0204.995] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x125a) returned 0x41a07a0 [0204.995] EnumServicesStatusExW (in: hSCManager=0x41b4380, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x41a07a0, cbBufSize=0x125a, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x41a07a0, pcbBytesNeeded=0x219ff44, lpServicesReturned=0x219ff5c, lpResumeHandle=0x0) returned 1 [0204.996] CloseServiceHandle (hSCObject=0x41b4380) returned 1 [0204.996] lstrlenW (lpString="Appinfo") returned 7 [0204.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0204.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0204.996] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0204.996] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0204.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0204.996] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0204.996] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.996] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0204.996] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0204.996] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0204.996] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0204.996] lstrlenW (lpString="AudioSrv") returned 8 [0204.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0204.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0204.997] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0204.997] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0204.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0204.997] lstrlenW (lpString="BFE") returned 3 [0204.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0204.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0204.997] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0204.997] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0204.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0204.997] lstrlenW (lpString="CryptSvc") returned 8 [0204.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0204.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0204.997] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0204.997] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0204.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0204.997] lstrlenW (lpString="CscService") returned 10 [0204.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0204.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0204.997] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0204.997] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0204.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0204.997] lstrlenW (lpString="DcomLaunch") returned 10 [0204.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0204.997] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0204.997] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0204.997] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0204.997] lstrlenW (lpString="Dhcp") returned 4 [0204.997] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0204.997] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0204.997] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0204.997] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0204.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0204.998] lstrlenW (lpString="Dnscache") returned 8 [0204.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0204.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0204.998] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0204.998] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0204.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0204.998] lstrlenW (lpString="DPS") returned 3 [0204.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0204.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0204.998] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0204.998] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0204.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0204.998] lstrlenW (lpString="eventlog") returned 8 [0204.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0204.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0204.998] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0204.998] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0204.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0204.998] lstrlenW (lpString="EventSystem") returned 11 [0204.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0204.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0204.998] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0204.998] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0204.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0204.998] lstrlenW (lpString="FontCache") returned 9 [0204.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="FontCache") returned -1 [0204.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="FontCache") returned -1 [0204.998] lstrcmpiW (lpString1="sqlwriter", lpString2="FontCache") returned 1 [0204.998] lstrcmpiW (lpString1="mssqlserver", lpString2="FontCache") returned 1 [0204.998] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="FontCache") returned 1 [0204.998] lstrlenW (lpString="gpsvc") returned 5 [0204.998] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0204.998] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0204.999] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0204.999] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0204.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0204.999] lstrlenW (lpString="iphlpsvc") returned 8 [0204.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0204.999] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0204.999] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0204.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0204.999] lstrlenW (lpString="LanmanServer") returned 12 [0204.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0204.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0204.999] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0204.999] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0204.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0204.999] lstrlenW (lpString="LanmanWorkstation") returned 17 [0204.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0204.999] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0204.999] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0204.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0204.999] lstrlenW (lpString="lmhosts") returned 7 [0204.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0204.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0204.999] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0204.999] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0204.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0204.999] lstrlenW (lpString="MMCSS") returned 5 [0204.999] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0204.999] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0204.999] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0204.999] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0204.999] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0204.999] lstrlenW (lpString="MpsSvc") returned 6 [0205.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0205.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0205.000] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0205.000] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0205.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0205.000] lstrlenW (lpString="Netman") returned 6 [0205.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0205.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0205.000] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0205.000] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0205.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0205.000] lstrlenW (lpString="netprofm") returned 8 [0205.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0205.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0205.000] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0205.000] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0205.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0205.000] lstrlenW (lpString="NlaSvc") returned 6 [0205.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0205.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0205.000] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0205.000] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0205.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0205.000] lstrlenW (lpString="nsi") returned 3 [0205.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0205.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0205.000] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0205.000] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0205.000] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0205.000] lstrlenW (lpString="PcaSvc") returned 6 [0205.000] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0205.000] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0205.000] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0205.000] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0205.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0205.001] lstrlenW (lpString="PlugPlay") returned 8 [0205.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0205.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0205.001] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0205.001] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0205.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0205.001] lstrlenW (lpString="Power") returned 5 [0205.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0205.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0205.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0205.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0205.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0205.001] lstrlenW (lpString="ProfSvc") returned 7 [0205.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0205.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0205.001] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0205.001] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0205.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0205.001] lstrlenW (lpString="RpcEptMapper") returned 12 [0205.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0205.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0205.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0205.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0205.001] lstrlenW (lpString="RpcSs") returned 5 [0205.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0205.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0205.001] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0205.001] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0205.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0205.001] lstrlenW (lpString="SamSs") returned 5 [0205.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0205.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0205.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0205.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0205.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0205.002] lstrlenW (lpString="Schedule") returned 8 [0205.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0205.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0205.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0205.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0205.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0205.002] lstrlenW (lpString="SENS") returned 4 [0205.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0205.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0205.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0205.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0205.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0205.002] lstrlenW (lpString="ShellHWDetection") returned 16 [0205.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0205.002] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0205.002] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0205.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0205.002] lstrlenW (lpString="Spooler") returned 7 [0205.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0205.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0205.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0205.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0205.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0205.002] lstrlenW (lpString="SysMain") returned 7 [0205.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0205.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0205.002] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0205.002] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0205.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0205.002] lstrlenW (lpString="Themes") returned 6 [0205.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0205.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0205.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0205.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0205.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0205.003] lstrlenW (lpString="TrkWks") returned 6 [0205.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0205.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0205.003] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0205.003] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0205.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0205.003] lstrlenW (lpString="UxSms") returned 5 [0205.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0205.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0205.003] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0205.003] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0205.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0205.003] lstrlenW (lpString="WdiServiceHost") returned 14 [0205.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0205.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0205.003] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0205.003] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0205.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0205.003] lstrlenW (lpString="WdiSystemHost") returned 13 [0205.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0205.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0205.003] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0205.003] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0205.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0205.003] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0205.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0205.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0205.003] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0205.003] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0205.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0205.004] lstrlenW (lpString="Winmgmt") returned 7 [0205.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0205.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0205.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0205.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0205.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0205.004] lstrlenW (lpString="WPDBusEnum") returned 10 [0205.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0205.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0205.004] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0205.004] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0205.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0205.004] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x41a07a0 | out: hHeap=0x270000) returned 1 [0205.004] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x348 [0205.005] Process32FirstW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0205.006] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x52, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0205.006] lstrlenW (lpString="System") returned 6 [0205.006] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0205.006] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0205.006] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0205.006] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0205.006] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0205.006] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0205.006] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0205.006] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0205.007] lstrlenW (lpString="smss.exe") returned 8 [0205.007] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0205.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0205.007] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0205.007] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0205.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0205.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0205.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0205.007] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.007] lstrlenW (lpString="csrss.exe") returned 9 [0205.007] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0205.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0205.007] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0205.007] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0205.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0205.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0205.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0205.007] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0205.008] lstrlenW (lpString="wininit.exe") returned 11 [0205.008] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0205.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0205.008] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0205.008] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0205.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0205.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0205.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0205.008] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0205.008] lstrlenW (lpString="csrss.exe") returned 9 [0205.008] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0205.008] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0205.009] lstrlenW (lpString="winlogon.exe") returned 12 [0205.009] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0205.009] lstrlenW (lpString="services.exe") returned 12 [0205.009] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0205.009] lstrlenW (lpString="lsass.exe") returned 9 [0205.009] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0205.010] lstrlenW (lpString="lsm.exe") returned 7 [0205.010] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x258, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.010] lstrlenW (lpString="svchost.exe") returned 11 [0205.010] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x29c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.010] lstrlenW (lpString="svchost.exe") returned 11 [0205.010] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.011] lstrlenW (lpString="svchost.exe") returned 11 [0205.011] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.011] lstrlenW (lpString="svchost.exe") returned 11 [0205.011] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.011] lstrlenW (lpString="svchost.exe") returned 11 [0205.011] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0205.012] lstrlenW (lpString="audiodg.exe") returned 11 [0205.012] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.012] lstrlenW (lpString="svchost.exe") returned 11 [0205.012] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x364, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0205.012] lstrlenW (lpString="explorer.exe") returned 12 [0205.012] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x418, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0205.013] lstrlenW (lpString="dwm.exe") returned 7 [0205.013] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.013] lstrlenW (lpString="svchost.exe") returned 11 [0205.013] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0205.013] lstrlenW (lpString="spoolsv.exe") returned 11 [0205.013] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x4f0, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0205.014] lstrlenW (lpString="reader_sl.exe") returned 13 [0205.014] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.014] lstrlenW (lpString="svchost.exe") returned 11 [0205.014] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x570, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0205.014] lstrlenW (lpString="taskhost.exe") returned 12 [0205.014] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x520, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1dc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0205.015] lstrlenW (lpString="svchost.exe") returned 11 [0205.015] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x500, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0205.015] lstrlenW (lpString="1Black.exe") returned 10 [0205.015] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 1 [0205.015] lstrlenW (lpString="1Black.exe") returned 10 [0205.015] Process32NextW (in: hSnapshot=0x348, lppe=0x219fd34 | out: lppe=0x219fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x70c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5d8, pcPriClassBase=8, dwFlags=0x0, szExeFile="1Black.exe")) returned 0 [0205.016] CloseHandle (hObject=0x348) returned 1 [0205.016] Sleep (dwMilliseconds=0x1f4) Thread: id = 61 os_tid = 0x62c [0183.096] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2ed888 [0183.096] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2eff60 [0183.096] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2ed8a0 [0183.096] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2ed8a0, Size=0x20) returned 0x2a5e10 [0183.097] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2ed8a0 [0183.097] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2ed8a0, Size=0x20) returned 0x2a5dc0 [0183.097] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.097] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.097] Wow64DisableWow64FsRedirection (in: OldValue=0x22dff28 | out: OldValue=0x22dff28*=0x0) returned 1 [0183.097] lstrlenW (lpString="kernel32.dll") returned 12 [0183.097] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5e10 | out: hHeap=0x270000) returned 1 [0183.097] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.097] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2a5dc0 | out: hHeap=0x270000) returned 1 [0183.097] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2eff60, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe")) returned 0x66 [0183.097] ShellExecuteExW (in: pExecInfo=0x22dff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0) | out: pExecInfo=0x22dff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x2a, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) returned 1 [0192.541] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2ed8a0 [0192.541] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2ed8a0, Size=0x20) returned 0x36f6e8 [0192.541] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2ed8a0 [0192.541] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2ed8a0, Size=0x20) returned 0x36f698 [0192.541] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0192.541] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0192.542] Wow64DisableWow64FsRedirection (in: OldValue=0x0 | out: OldValue=0x0) returned 0 [0192.543] lstrlenW (lpString="kernel32.dll") returned 12 [0192.543] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x36f698 | out: hHeap=0x270000) returned 1 [0192.543] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0192.543] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x36f6e8 | out: hHeap=0x270000) returned 1 [0192.543] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2eff60 | out: hHeap=0x270000) returned 1 [0192.546] lstrlenW (lpString="runas") returned 5 [0192.546] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2ed888 | out: hHeap=0x270000) returned 1 [0192.546] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0192.546] ReleaseMutex (hMutex=0x84) returned 1 [0192.546] Sleep (dwMilliseconds=0x1f4) [0193.260] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0193.260] ReleaseMutex (hMutex=0x84) returned 1 [0193.260] Sleep (dwMilliseconds=0x1f4) [0193.949] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0193.949] ReleaseMutex (hMutex=0x84) returned 1 [0193.949] Sleep (dwMilliseconds=0x1f4) [0194.795] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0194.795] ReleaseMutex (hMutex=0x84) returned 1 [0194.795] Sleep (dwMilliseconds=0x1f4) [0195.449] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0195.449] ReleaseMutex (hMutex=0x84) returned 1 [0195.449] Sleep (dwMilliseconds=0x1f4) [0196.125] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0196.125] ReleaseMutex (hMutex=0x84) returned 1 [0196.125] Sleep (dwMilliseconds=0x1f4) [0196.774] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0196.774] ReleaseMutex (hMutex=0x84) returned 1 [0196.775] Sleep (dwMilliseconds=0x1f4) [0197.396] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0197.396] ReleaseMutex (hMutex=0x84) returned 1 [0197.396] Sleep (dwMilliseconds=0x1f4) [0198.109] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0198.109] ReleaseMutex (hMutex=0x84) returned 1 [0198.109] Sleep (dwMilliseconds=0x1f4) [0198.788] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0198.788] ReleaseMutex (hMutex=0x84) returned 1 [0198.788] Sleep (dwMilliseconds=0x1f4) [0199.394] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0199.394] ReleaseMutex (hMutex=0x84) returned 1 [0199.394] Sleep (dwMilliseconds=0x1f4) [0200.088] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0200.088] ReleaseMutex (hMutex=0x84) returned 1 [0200.088] Sleep (dwMilliseconds=0x1f4) [0200.772] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0200.772] ReleaseMutex (hMutex=0x84) returned 1 [0200.772] Sleep (dwMilliseconds=0x1f4) [0201.640] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0201.640] ReleaseMutex (hMutex=0x84) returned 1 [0201.640] Sleep (dwMilliseconds=0x1f4) [0202.312] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0202.312] ReleaseMutex (hMutex=0x84) returned 1 [0202.312] Sleep (dwMilliseconds=0x1f4) [0202.900] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0202.900] ReleaseMutex (hMutex=0x84) returned 1 [0202.900] Sleep (dwMilliseconds=0x1f4) [0203.525] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0203.525] ReleaseMutex (hMutex=0x84) returned 1 [0203.525] Sleep (dwMilliseconds=0x1f4) [0204.392] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0204.392] ReleaseMutex (hMutex=0x84) returned 1 [0204.392] Sleep (dwMilliseconds=0x1f4) [0205.016] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x0) returned 0x0 [0205.016] ReleaseMutex (hMutex=0x84) returned 1 [0205.016] Sleep (dwMilliseconds=0x1f4) Thread: id = 62 os_tid = 0x5cc [0183.100] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2ed870 [0183.100] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2ed870, Size=0x20) returned 0x2a5dc0 [0183.100] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2a5dc0, Size=0x40) returned 0x2a6e58 [0183.100] GetLogicalDrives () returned 0x4 [0183.100] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x2cbf60 [0183.100] GetComputerNameW (in: lpBuffer=0x2cbf64, nSize=0x241ff6c | out: lpBuffer="XDUWTFONO", nSize=0x241ff6c) returned 1 [0183.101] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1000) returned 0x2becc0 [0183.101] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x241ff3c | out: lphEnum=0x241ff3c*=0x2a6440) returned 0x0 [0183.101] WNetEnumResourceW (in: hEnum=0x2a6440, lpcCount=0x241ff38, lpBuffer=0x2becc0, lpBufferSize=0x241ff40 | out: lpcCount=0x241ff38, lpBuffer=0x2becc0, lpBufferSize=0x241ff40) returned 0x103 [0183.101] WNetCloseEnum (hEnum=0x2a6440) returned 0x0 [0183.101] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x241ff3c | out: lphEnum=0x241ff3c*=0x38d3740) returned 0x0 [0183.776] WNetEnumResourceW (in: hEnum=0x38d3740, lpcCount=0x241ff38, lpBuffer=0x2becc0, lpBufferSize=0x241ff40 | out: lpcCount=0x241ff38, lpBuffer=0x2becc0, lpBufferSize=0x241ff40) returned 0x0 [0183.776] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1000) returned 0x419a250 [0183.777] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x2becc0, lphEnum=0x241ff10 | out: lphEnum=0x241ff10*=0x41aebb0) returned 0x0 [0184.038] WNetEnumResourceW (in: hEnum=0x41aebb0, lpcCount=0x241ff0c, lpBuffer=0x419a250, lpBufferSize=0x241ff14 | out: lpcCount=0x241ff0c, lpBuffer=0x419a250, lpBufferSize=0x241ff14) returned 0x103 [0184.038] WNetCloseEnum (hEnum=0x41aebb0) returned 0x0 [0184.038] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1000) returned 0x41c4fd8 [0184.038] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x2bece0, lphEnum=0x241ff10 | out: lphEnum=0x241ff10*=0x0) returned 0x4b8 [0197.515] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x1000) returned 0x41d1008 [0197.515] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x2bed00, lphEnum=0x241ff10 | out: lphEnum=0x241ff10*=0x0) returned 0x4c6 [0197.515] WNetEnumResourceW (in: hEnum=0x38d3740, lpcCount=0x241ff38, lpBuffer=0x2becc0, lpBufferSize=0x241ff40 | out: lpcCount=0x241ff38, lpBuffer=0x2becc0, lpBufferSize=0x241ff40) returned 0x103 [0197.515] WNetCloseEnum (hEnum=0x38d3740) returned 0x0 [0197.515] GetLogicalDrives () returned 0x4 [0197.515] Sleep (dwMilliseconds=0x64) [0197.803] GetLogicalDrives () returned 0x4 [0197.803] Sleep (dwMilliseconds=0x64) [0198.086] GetLogicalDrives () returned 0x4 [0198.087] Sleep (dwMilliseconds=0x64) [0198.429] GetLogicalDrives () returned 0x4 [0198.429] Sleep (dwMilliseconds=0x64) [0198.761] GetLogicalDrives () returned 0x4 [0198.761] Sleep (dwMilliseconds=0x64) [0198.945] GetLogicalDrives () returned 0x4 [0198.945] Sleep (dwMilliseconds=0x64) [0199.222] GetLogicalDrives () returned 0x4 [0199.222] Sleep (dwMilliseconds=0x64) [0199.395] GetLogicalDrives () returned 0x4 [0199.395] Sleep (dwMilliseconds=0x64) [0199.689] GetLogicalDrives () returned 0x4 [0199.689] Sleep (dwMilliseconds=0x64) [0199.824] GetLogicalDrives () returned 0x4 [0199.824] Sleep (dwMilliseconds=0x64) [0200.089] GetLogicalDrives () returned 0x4 [0200.089] Sleep (dwMilliseconds=0x64) [0200.437] GetLogicalDrives () returned 0x4 [0200.437] Sleep (dwMilliseconds=0x64) [0200.733] GetLogicalDrives () returned 0x4 [0200.733] Sleep (dwMilliseconds=0x64) [0200.936] GetLogicalDrives () returned 0x4 [0200.936] Sleep (dwMilliseconds=0x64) [0201.217] GetLogicalDrives () returned 0x4 [0201.217] Sleep (dwMilliseconds=0x64) [0201.640] GetLogicalDrives () returned 0x4 [0201.640] Sleep (dwMilliseconds=0x64) [0201.836] GetLogicalDrives () returned 0x4 [0201.836] Sleep (dwMilliseconds=0x64) [0202.037] GetLogicalDrives () returned 0x4 [0202.037] Sleep (dwMilliseconds=0x64) [0202.285] GetLogicalDrives () returned 0x4 [0202.285] Sleep (dwMilliseconds=0x64) [0202.646] GetLogicalDrives () returned 0x4 [0202.646] Sleep (dwMilliseconds=0x64) [0202.878] GetLogicalDrives () returned 0x4 [0202.878] Sleep (dwMilliseconds=0x64) [0202.986] GetLogicalDrives () returned 0x4 [0202.986] Sleep (dwMilliseconds=0x64) [0203.102] GetLogicalDrives () returned 0x4 [0203.102] Sleep (dwMilliseconds=0x64) [0203.283] GetLogicalDrives () returned 0x4 [0203.283] Sleep (dwMilliseconds=0x64) [0203.496] GetLogicalDrives () returned 0x4 [0203.497] Sleep (dwMilliseconds=0x64) [0203.758] GetLogicalDrives () returned 0x4 [0203.758] Sleep (dwMilliseconds=0x64) [0203.969] GetLogicalDrives () returned 0x4 [0203.969] Sleep (dwMilliseconds=0x64) [0204.404] GetLogicalDrives () returned 0x4 [0204.404] Sleep (dwMilliseconds=0x64) [0204.588] GetLogicalDrives () returned 0x4 [0204.588] Sleep (dwMilliseconds=0x64) [0204.902] GetLogicalDrives () returned 0x4 [0204.902] Sleep (dwMilliseconds=0x64) Thread: id = 63 os_tid = 0x710 Thread: id = 64 os_tid = 0x370 [0183.396] GetTickCount () returned 0x113bb06 [0183.396] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x24) returned 0x2a81c8 [0183.396] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2a81c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x16c [0183.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2a81c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0183.397] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2a81c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x170 [0183.398] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2a81c8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x174 [0183.399] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310dc8 [0183.399] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310dc8, Size=0x20) returned 0x2dc598 [0183.399] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310dc8 [0183.399] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310dc8, Size=0x20) returned 0x2dc5c0 [0183.399] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.399] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.399] Wow64DisableWow64FsRedirection (in: OldValue=0x2a9ff84 | out: OldValue=0x2a9ff84*=0x0) returned 1 [0183.399] lstrlenW (lpString="kernel32.dll") returned 12 [0183.399] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc598 | out: hHeap=0x270000) returned 1 [0183.399] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.399] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc5c0 | out: hHeap=0x270000) returned 1 [0183.399] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x2ab730, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x178 [0183.400] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0183.572] GetTickCount () returned 0x113bbc1 [0183.572] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0183.682] GetTickCount () returned 0x113bc2e [0183.682] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0183.977] GetTickCount () returned 0x113bd57 [0183.977] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0184.205] GetTickCount () returned 0x113be31 [0184.205] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0184.356] GetTickCount () returned 0x113becd [0184.356] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0184.522] GetTickCount () returned 0x113bf79 [0184.522] GetTickCount () returned 0x113bf79 [0184.522] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0184.665] GetTickCount () returned 0x113c005 [0184.665] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0184.939] GetTickCount () returned 0x113c10e [0184.939] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0185.052] GetTickCount () returned 0x113c18b [0185.052] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0185.163] GetTickCount () returned 0x113c1f8 [0185.163] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0185.361] GetTickCount () returned 0x113c2a4 [0185.361] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0185.459] GetTickCount () returned 0x113c311 [0185.459] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0185.570] GetTickCount () returned 0x113c37e [0185.570] GetTickCount () returned 0x113c37e [0185.570] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0185.718] GetTickCount () returned 0x113c40b [0185.718] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0185.820] GetTickCount () returned 0x113c478 [0185.820] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0185.975] GetTickCount () returned 0x113c514 [0185.984] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0186.125] GetTickCount () returned 0x113c5a0 [0186.125] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0186.281] GetTickCount () returned 0x113c67b [0186.338] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0186.495] GetTickCount () returned 0x113c717 [0186.495] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0186.674] GetTickCount () returned 0x113c7d2 [0186.674] GetTickCount () returned 0x113c7d2 [0186.674] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0186.932] GetTickCount () returned 0x113c8cc [0186.932] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0187.167] GetTickCount () returned 0x113c9b6 [0187.167] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0187.312] GetTickCount () returned 0x113ca42 [0187.312] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0187.417] GetTickCount () returned 0x113caaf [0187.417] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0187.558] GetTickCount () returned 0x113cb3c [0187.558] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0187.699] GetTickCount () returned 0x113cbc8 [0187.699] GetTickCount () returned 0x113cbc8 [0187.699] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0187.815] GetTickCount () returned 0x113cc35 [0187.815] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0187.968] GetTickCount () returned 0x113ccd1 [0187.968] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0188.144] GetTickCount () returned 0x113cd7d [0188.144] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0188.337] GetTickCount () returned 0x113ce38 [0188.337] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0188.517] GetTickCount () returned 0x113cee4 [0188.517] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0188.719] GetTickCount () returned 0x113cfae [0188.719] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0188.880] GetTickCount () returned 0x113d04a [0188.880] GetTickCount () returned 0x113d04a [0188.880] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0189.155] GetTickCount () returned 0x113d163 [0189.155] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0189.384] GetTickCount () returned 0x113d24d [0189.384] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0189.592] GetTickCount () returned 0x113d318 [0189.592] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0189.759] GetTickCount () returned 0x113d3c4 [0189.759] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0189.958] GetTickCount () returned 0x113d48e [0189.958] GetTickCount () returned 0x113d48e [0189.958] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0190.104] GetTickCount () returned 0x113d51b [0190.104] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0190.292] GetTickCount () returned 0x113d5d6 [0190.292] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0190.474] GetTickCount () returned 0x113d691 [0190.474] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0190.621] GetTickCount () returned 0x113d71e [0190.621] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0190.855] GetTickCount () returned 0x113d808 [0190.855] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0191.092] GetTickCount () returned 0x113d8f2 [0191.094] GetTickCount () returned 0x113d8f2 [0191.094] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0191.291] GetTickCount () returned 0x113d9bc [0191.291] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0191.504] GetTickCount () returned 0x113da97 [0191.504] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0191.691] GetTickCount () returned 0x113db52 [0191.691] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0191.849] GetTickCount () returned 0x113dbee [0191.852] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0192.014] GetTickCount () returned 0x113dc8a [0192.014] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0192.209] GetTickCount () returned 0x113dd55 [0192.209] GetTickCount () returned 0x113dd55 [0192.209] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x102 [0192.333] GetTickCount () returned 0x113ddd2 [0192.333] WaitForSingleObject (hHandle=0x178, dwMilliseconds=0x64) returned 0x0 [0192.393] GetTickCount () returned 0x113de10 [0192.393] Sleep (dwMilliseconds=0x64) [0192.548] GetTickCount () returned 0x113deac [0192.550] Sleep (dwMilliseconds=0x64) [0192.692] GetTickCount () returned 0x113df38 [0192.692] Sleep (dwMilliseconds=0x64) [0192.851] GetTickCount () returned 0x113dfd4 [0192.851] Sleep (dwMilliseconds=0x64) [0193.002] GetTickCount () returned 0x113e070 [0193.002] Sleep (dwMilliseconds=0x64) [0193.268] GetTickCount () returned 0x113e17a [0193.268] GetTickCount () returned 0x113e17a [0193.268] Sleep (dwMilliseconds=0x64) [0193.504] GetTickCount () returned 0x113e264 [0193.504] Sleep (dwMilliseconds=0x64) [0193.845] GetTickCount () returned 0x113e3bb [0193.845] Sleep (dwMilliseconds=0x64) [0194.128] GetTickCount () returned 0x113e4d4 [0194.128] Sleep (dwMilliseconds=0x64) [0194.360] GetTickCount () returned 0x113e5be [0194.361] GetTickCount () returned 0x113e5be [0194.361] Sleep (dwMilliseconds=0x64) [0194.795] GetTickCount () returned 0x113e772 [0194.795] Sleep (dwMilliseconds=0x64) [0195.098] GetTickCount () returned 0x113e89b [0195.098] Sleep (dwMilliseconds=0x64) [0195.421] GetTickCount () returned 0x113e9e2 [0195.421] GetTickCount () returned 0x113e9e2 [0195.421] Sleep (dwMilliseconds=0x64) [0195.721] GetTickCount () returned 0x113eb0b [0195.721] Sleep (dwMilliseconds=0x64) [0195.981] GetTickCount () returned 0x113ec14 [0195.981] Sleep (dwMilliseconds=0x64) [0196.178] GetTickCount () returned 0x113eccf [0196.178] Sleep (dwMilliseconds=0x64) [0196.471] GetTickCount () returned 0x113edf8 [0196.471] GetTickCount () returned 0x113edf8 [0196.471] Sleep (dwMilliseconds=0x64) [0196.749] GetTickCount () returned 0x113ef10 [0196.749] Sleep (dwMilliseconds=0x64) [0196.921] GetTickCount () returned 0x113efbc [0196.927] Sleep (dwMilliseconds=0x64) [0197.129] GetTickCount () returned 0x113f087 [0197.129] Sleep (dwMilliseconds=0x64) [0197.257] GetTickCount () returned 0x113f104 [0197.257] Sleep (dwMilliseconds=0x64) [0197.401] GetTickCount () returned 0x113f1a0 [0197.401] Sleep (dwMilliseconds=0x64) [0197.518] GetTickCount () returned 0x113f20d [0197.518] GetTickCount () returned 0x113f20d [0197.518] Sleep (dwMilliseconds=0x64) [0197.803] GetTickCount () returned 0x113f326 [0197.803] Sleep (dwMilliseconds=0x64) [0198.069] GetTickCount () returned 0x113f42f [0198.069] Sleep (dwMilliseconds=0x64) [0198.429] GetTickCount () returned 0x113f5a5 [0198.429] Sleep (dwMilliseconds=0x64) [0198.760] GetTickCount () returned 0x113f6ed [0198.760] GetTickCount () returned 0x113f6ed [0198.760] Sleep (dwMilliseconds=0x64) [0198.945] GetTickCount () returned 0x113f7a8 [0198.945] Sleep (dwMilliseconds=0x64) [0199.221] GetTickCount () returned 0x113f8b1 [0199.221] Sleep (dwMilliseconds=0x64) [0199.394] GetTickCount () returned 0x113f95d [0199.394] Sleep (dwMilliseconds=0x64) [0199.689] GetTickCount () returned 0x113fa85 [0199.689] Sleep (dwMilliseconds=0x64) [0199.823] GetTickCount () returned 0x113fb12 [0199.823] GetTickCount () returned 0x113fb12 [0199.823] Sleep (dwMilliseconds=0x64) [0200.089] GetTickCount () returned 0x113fc1b [0200.089] Sleep (dwMilliseconds=0x64) [0200.437] GetTickCount () returned 0x113fd72 [0200.437] Sleep (dwMilliseconds=0x64) [0200.733] GetTickCount () returned 0x113fe9a [0200.733] Sleep (dwMilliseconds=0x64) [0200.937] GetTickCount () returned 0x113ff65 [0200.937] GetTickCount () returned 0x113ff65 [0200.937] Sleep (dwMilliseconds=0x64) [0201.254] GetTickCount () returned 0x11400ad [0201.254] Sleep (dwMilliseconds=0x64) [0201.719] GetTickCount () returned 0x1140271 [0201.719] Sleep (dwMilliseconds=0x64) [0201.897] GetTickCount () returned 0x114032c [0201.897] Sleep (dwMilliseconds=0x64) [0202.203] GetTickCount () returned 0x1140455 [0202.203] GetTickCount () returned 0x1140455 [0202.203] Sleep (dwMilliseconds=0x64) [0202.646] GetTickCount () returned 0x1140619 [0202.646] Sleep (dwMilliseconds=0x64) [0202.878] GetTickCount () returned 0x1140703 [0202.878] Sleep (dwMilliseconds=0x64) [0202.986] GetTickCount () returned 0x1140770 [0202.986] Sleep (dwMilliseconds=0x64) [0203.102] GetTickCount () returned 0x11407de [0203.102] Sleep (dwMilliseconds=0x64) [0203.283] GetTickCount () returned 0x1140899 [0203.283] GetTickCount () returned 0x1140899 [0203.283] Sleep (dwMilliseconds=0x64) [0203.496] GetTickCount () returned 0x1140964 [0203.496] Sleep (dwMilliseconds=0x64) [0203.750] GetTickCount () returned 0x1140a6d [0203.750] Sleep (dwMilliseconds=0x64) [0203.969] GetTickCount () returned 0x1140b47 [0203.969] Sleep (dwMilliseconds=0x64) [0204.403] GetTickCount () returned 0x1140cfc [0204.403] GetTickCount () returned 0x1140cfc [0204.404] Sleep (dwMilliseconds=0x64) [0204.588] GetTickCount () returned 0x1140da8 [0204.588] Sleep (dwMilliseconds=0x64) [0204.902] GetTickCount () returned 0x1140eef [0204.902] Sleep (dwMilliseconds=0x64) Thread: id = 66 os_tid = 0x740 [0183.487] GetTickCount () returned 0x113bb64 [0183.487] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x24) returned 0x2cb710 [0183.487] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2cb710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x184 [0183.489] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2cb710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x188 [0183.491] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2cb710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x18c [0183.494] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x2cb710, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x190 [0183.494] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310eb8 [0183.494] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310eb8, Size=0x20) returned 0x2dc660 [0183.494] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310eb8 [0183.494] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310eb8, Size=0x20) returned 0x2dc638 [0183.495] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.495] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.495] Wow64DisableWow64FsRedirection (in: OldValue=0x2bdff84 | out: OldValue=0x2bdff84*=0x0) returned 1 [0183.495] lstrlenW (lpString="kernel32.dll") returned 12 [0183.495] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc660 | out: hHeap=0x270000) returned 1 [0183.495] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.495] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc638 | out: hHeap=0x270000) returned 1 [0183.495] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x300a18, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x194 [0183.497] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0183.606] GetTickCount () returned 0x113bbe0 [0183.606] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0183.775] GetTickCount () returned 0x113bc8c [0183.775] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0183.999] GetTickCount () returned 0x113bd66 [0183.999] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0184.217] GetTickCount () returned 0x113be41 [0184.217] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0184.358] GetTickCount () returned 0x113becd [0184.358] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0184.522] GetTickCount () returned 0x113bf79 [0184.522] GetTickCount () returned 0x113bf79 [0184.522] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0184.665] GetTickCount () returned 0x113c005 [0184.665] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0184.939] GetTickCount () returned 0x113c10e [0184.939] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0185.051] GetTickCount () returned 0x113c18b [0185.052] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0185.163] GetTickCount () returned 0x113c1f8 [0185.163] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0185.361] GetTickCount () returned 0x113c2a4 [0185.361] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0185.459] GetTickCount () returned 0x113c311 [0185.459] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0185.570] GetTickCount () returned 0x113c37e [0185.571] GetTickCount () returned 0x113c37e [0185.571] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0185.718] GetTickCount () returned 0x113c40b [0185.718] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0185.820] GetTickCount () returned 0x113c478 [0185.820] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0185.968] GetTickCount () returned 0x113c504 [0185.969] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0186.087] GetTickCount () returned 0x113c581 [0186.087] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0186.193] GetTickCount () returned 0x113c5ee [0186.193] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0186.384] GetTickCount () returned 0x113c6aa [0186.384] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0186.544] GetTickCount () returned 0x113c746 [0186.545] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0186.676] GetTickCount () returned 0x113c7d2 [0186.676] GetTickCount () returned 0x113c7d2 [0186.676] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0186.932] GetTickCount () returned 0x113c8cc [0186.932] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0187.167] GetTickCount () returned 0x113c9b6 [0187.167] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0187.312] GetTickCount () returned 0x113ca42 [0187.312] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0187.416] GetTickCount () returned 0x113caaf [0187.416] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0187.558] GetTickCount () returned 0x113cb3c [0187.558] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0187.699] GetTickCount () returned 0x113cbc8 [0187.699] GetTickCount () returned 0x113cbc8 [0187.699] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0187.815] GetTickCount () returned 0x113cc35 [0187.815] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0187.967] GetTickCount () returned 0x113ccd1 [0187.967] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0188.144] GetTickCount () returned 0x113cd7d [0188.144] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0188.337] GetTickCount () returned 0x113ce38 [0188.337] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0188.517] GetTickCount () returned 0x113cee4 [0188.517] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0188.719] GetTickCount () returned 0x113cfae [0188.719] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0188.880] GetTickCount () returned 0x113d04a [0188.880] GetTickCount () returned 0x113d04a [0188.880] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0189.155] GetTickCount () returned 0x113d163 [0189.155] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0189.384] GetTickCount () returned 0x113d24d [0189.384] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0189.592] GetTickCount () returned 0x113d318 [0189.592] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0189.759] GetTickCount () returned 0x113d3c4 [0189.759] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0189.958] GetTickCount () returned 0x113d48e [0189.958] GetTickCount () returned 0x113d48e [0189.958] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0190.104] GetTickCount () returned 0x113d51b [0190.104] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0190.292] GetTickCount () returned 0x113d5d6 [0190.292] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0190.474] GetTickCount () returned 0x113d691 [0190.474] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0190.621] GetTickCount () returned 0x113d71e [0190.621] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0190.855] GetTickCount () returned 0x113d808 [0190.855] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0191.101] GetTickCount () returned 0x113d901 [0191.105] GetTickCount () returned 0x113d901 [0191.108] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0191.291] GetTickCount () returned 0x113d9bc [0191.291] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0191.504] GetTickCount () returned 0x113da97 [0191.504] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0191.691] GetTickCount () returned 0x113db52 [0191.691] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0191.856] GetTickCount () returned 0x113dbee [0191.856] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0192.014] GetTickCount () returned 0x113dc8a [0192.014] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0192.211] GetTickCount () returned 0x113dd55 [0192.211] GetTickCount () returned 0x113dd55 [0192.211] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x102 [0192.333] GetTickCount () returned 0x113ddd2 [0192.333] WaitForSingleObject (hHandle=0x194, dwMilliseconds=0x64) returned 0x0 [0192.393] GetTickCount () returned 0x113de10 [0192.393] Sleep (dwMilliseconds=0x64) [0192.551] GetTickCount () returned 0x113deac [0192.552] Sleep (dwMilliseconds=0x64) [0192.693] GetTickCount () returned 0x113df38 [0192.693] Sleep (dwMilliseconds=0x64) [0192.851] GetTickCount () returned 0x113dfd4 [0192.851] Sleep (dwMilliseconds=0x64) [0193.002] GetTickCount () returned 0x113e070 [0193.002] Sleep (dwMilliseconds=0x64) [0193.268] GetTickCount () returned 0x113e17a [0193.268] GetTickCount () returned 0x113e17a [0193.268] Sleep (dwMilliseconds=0x64) [0193.504] GetTickCount () returned 0x113e264 [0193.504] Sleep (dwMilliseconds=0x64) [0193.844] GetTickCount () returned 0x113e3bb [0193.845] Sleep (dwMilliseconds=0x64) [0194.128] GetTickCount () returned 0x113e4d4 [0194.128] Sleep (dwMilliseconds=0x64) [0194.360] GetTickCount () returned 0x113e5be [0194.360] GetTickCount () returned 0x113e5be [0194.360] Sleep (dwMilliseconds=0x64) [0194.795] GetTickCount () returned 0x113e772 [0194.795] Sleep (dwMilliseconds=0x64) [0195.098] GetTickCount () returned 0x113e89b [0195.098] Sleep (dwMilliseconds=0x64) [0195.422] GetTickCount () returned 0x113e9e2 [0195.422] GetTickCount () returned 0x113e9e2 [0195.422] Sleep (dwMilliseconds=0x64) [0195.745] GetTickCount () returned 0x113eb2a [0195.745] Sleep (dwMilliseconds=0x64) [0196.022] GetTickCount () returned 0x113ec33 [0196.022] Sleep (dwMilliseconds=0x64) [0196.196] GetTickCount () returned 0x113ecdf [0196.196] Sleep (dwMilliseconds=0x64) [0196.480] GetTickCount () returned 0x113ee07 [0196.480] GetTickCount () returned 0x113ee07 [0196.480] Sleep (dwMilliseconds=0x64) [0196.753] GetTickCount () returned 0x113ef10 [0196.753] Sleep (dwMilliseconds=0x64) [0196.942] GetTickCount () returned 0x113efdb [0196.948] Sleep (dwMilliseconds=0x64) [0197.237] GetTickCount () returned 0x113f0f4 [0197.237] Sleep (dwMilliseconds=0x64) [0197.401] GetTickCount () returned 0x113f1a0 [0197.401] Sleep (dwMilliseconds=0x64) [0197.517] GetTickCount () returned 0x113f20d [0197.517] GetTickCount () returned 0x113f20d [0197.517] Sleep (dwMilliseconds=0x64) [0197.803] GetTickCount () returned 0x113f326 [0197.803] Sleep (dwMilliseconds=0x64) [0198.086] GetTickCount () returned 0x113f44e [0198.086] Sleep (dwMilliseconds=0x64) [0198.429] GetTickCount () returned 0x113f5a5 [0198.429] Sleep (dwMilliseconds=0x64) [0198.760] GetTickCount () returned 0x113f6ed [0198.760] GetTickCount () returned 0x113f6ed [0198.761] Sleep (dwMilliseconds=0x64) [0198.945] GetTickCount () returned 0x113f7a8 [0198.945] Sleep (dwMilliseconds=0x64) [0199.221] GetTickCount () returned 0x113f8b1 [0199.221] Sleep (dwMilliseconds=0x64) [0199.395] GetTickCount () returned 0x113f95d [0199.395] Sleep (dwMilliseconds=0x64) [0199.689] GetTickCount () returned 0x113fa85 [0199.689] Sleep (dwMilliseconds=0x64) [0199.824] GetTickCount () returned 0x113fb12 [0199.824] GetTickCount () returned 0x113fb12 [0199.824] Sleep (dwMilliseconds=0x64) [0200.089] GetTickCount () returned 0x113fc1b [0200.089] Sleep (dwMilliseconds=0x64) [0200.437] GetTickCount () returned 0x113fd72 [0200.437] Sleep (dwMilliseconds=0x64) [0200.733] GetTickCount () returned 0x113fe9a [0200.733] Sleep (dwMilliseconds=0x64) [0200.936] GetTickCount () returned 0x113ff65 [0200.936] GetTickCount () returned 0x113ff65 [0200.936] Sleep (dwMilliseconds=0x64) [0201.254] GetTickCount () returned 0x11400ad [0201.254] Sleep (dwMilliseconds=0x64) [0201.719] GetTickCount () returned 0x1140271 [0201.719] Sleep (dwMilliseconds=0x64) [0201.897] GetTickCount () returned 0x114032c [0201.897] Sleep (dwMilliseconds=0x64) [0202.198] GetTickCount () returned 0x1140455 [0202.198] GetTickCount () returned 0x1140455 [0202.203] Sleep (dwMilliseconds=0x64) [0202.646] GetTickCount () returned 0x1140619 [0202.646] Sleep (dwMilliseconds=0x64) [0202.878] GetTickCount () returned 0x1140703 [0202.878] Sleep (dwMilliseconds=0x64) [0202.986] GetTickCount () returned 0x1140770 [0202.986] Sleep (dwMilliseconds=0x64) [0203.102] GetTickCount () returned 0x11407de [0203.102] Sleep (dwMilliseconds=0x64) [0203.283] GetTickCount () returned 0x1140899 [0203.283] GetTickCount () returned 0x1140899 [0203.283] Sleep (dwMilliseconds=0x64) [0203.496] GetTickCount () returned 0x1140964 [0203.496] Sleep (dwMilliseconds=0x64) [0203.733] GetTickCount () returned 0x1140a5d [0203.734] Sleep (dwMilliseconds=0x64) [0203.968] GetTickCount () returned 0x1140b47 [0203.968] Sleep (dwMilliseconds=0x64) [0204.403] GetTickCount () returned 0x1140cfc [0204.403] GetTickCount () returned 0x1140cfc [0204.403] Sleep (dwMilliseconds=0x64) [0204.587] GetTickCount () returned 0x1140da8 [0204.587] Sleep (dwMilliseconds=0x64) [0204.902] GetTickCount () returned 0x1140eef [0204.903] Sleep (dwMilliseconds=0x64) Thread: id = 67 os_tid = 0x744 [0183.487] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x311238 [0183.487] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x322c58 [0183.488] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310e28 [0183.488] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6) returned 0x3220f8 [0183.488] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310e40 [0183.488] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x33c0020 [0183.488] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310e58 [0183.488] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310e58, Size=0x20) returned 0x2dc638 [0183.488] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310e58 [0183.488] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310e58, Size=0x20) returned 0x2dc660 [0183.488] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.488] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.489] Wow64DisableWow64FsRedirection (in: OldValue=0x2d1ff58 | out: OldValue=0x2d1ff58*=0x0) returned 1 [0183.489] lstrlenW (lpString="kernel32.dll") returned 12 [0183.489] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc638 | out: hHeap=0x270000) returned 1 [0183.489] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.489] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc660 | out: hHeap=0x270000) returned 1 [0183.489] Sleep (dwMilliseconds=0x64) [0183.592] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0183.592] lstrlenW (lpString="desktop.ini") returned 11 [0183.592] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1dc [0183.592] GetFileSizeEx (in: hFile=0x1dc, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=129) returned 1 [0183.593] CloseHandle (hObject=0x1dc) returned 1 [0183.593] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0183.593] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0x26 [0183.599] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.599] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.599] lstrlenW (lpString=".doc") returned 4 [0183.599] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0183.599] lstrlenW (lpString=".docx") returned 5 [0183.599] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0183.599] lstrlenW (lpString=".pdf") returned 4 [0183.599] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0183.599] lstrlenW (lpString=".xls") returned 4 [0183.599] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0183.599] lstrlenW (lpString=".xlsx") returned 5 [0183.599] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0183.599] lstrlenW (lpString=".ppt") returned 4 [0183.599] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0183.599] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.599] lstrlenW (lpString=".zip") returned 4 [0183.599] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0183.599] lstrlenW (lpString=".rar") returned 4 [0183.599] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0183.599] lstrlenW (lpString=".bz2") returned 4 [0183.599] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0183.599] lstrlenW (lpString=".7z") returned 3 [0183.599] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0183.599] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.599] lstrlenW (lpString=".dbf") returned 4 [0183.599] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0183.599] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.600] lstrlenW (lpString=".1cd") returned 4 [0183.600] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0183.600] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.600] lstrlenW (lpString=".jpg") returned 4 [0183.600] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0183.600] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.600] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.600] lstrlenW (lpString=".doc") returned 4 [0183.600] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0183.600] lstrlenW (lpString=".docx") returned 5 [0183.600] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0183.600] lstrlenW (lpString=".pdf") returned 4 [0183.600] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0183.600] lstrlenW (lpString=".xls") returned 4 [0183.600] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0183.600] lstrlenW (lpString=".xlsx") returned 5 [0183.600] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0183.600] lstrlenW (lpString=".ppt") returned 4 [0183.600] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0183.600] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.600] lstrlenW (lpString=".zip") returned 4 [0183.600] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0183.600] lstrlenW (lpString=".rar") returned 4 [0183.600] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0183.600] lstrlenW (lpString=".bz2") returned 4 [0183.600] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0183.600] lstrlenW (lpString=".7z") returned 3 [0183.600] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0183.600] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.600] lstrlenW (lpString=".dbf") returned 4 [0183.600] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0183.600] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.600] lstrlenW (lpString=".1cd") returned 4 [0183.600] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0183.601] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.601] lstrlenW (lpString=".jpg") returned 4 [0183.601] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0183.601] Sleep (dwMilliseconds=0x64) [0183.775] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.775] lstrlenW (lpString="Content.xml") returned 11 [0183.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c [0183.789] GetFileSizeEx (in: hFile=0x24c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=27045) returned 1 [0183.789] CloseHandle (hObject=0x24c) returned 1 [0183.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0183.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.790] lstrlenW (lpString=".doc") returned 4 [0183.790] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.790] lstrlenW (lpString=".docx") returned 5 [0183.790] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0183.790] lstrlenW (lpString=".pdf") returned 4 [0183.790] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.790] lstrlenW (lpString=".xls") returned 4 [0183.790] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.790] lstrlenW (lpString=".xlsx") returned 5 [0183.790] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0183.790] lstrlenW (lpString=".ppt") returned 4 [0183.790] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.790] lstrlenW (lpString=".zip") returned 4 [0183.790] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.790] lstrlenW (lpString=".rar") returned 4 [0183.790] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.790] lstrlenW (lpString=".bz2") returned 4 [0183.790] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.790] lstrlenW (lpString=".7z") returned 3 [0183.790] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.790] lstrlenW (lpString=".dbf") returned 4 [0183.790] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.790] lstrlenW (lpString=".1cd") returned 4 [0183.790] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.790] lstrlenW (lpString=".jpg") returned 4 [0183.790] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.790] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.791] lstrlenW (lpString=".doc") returned 4 [0183.791] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.791] lstrlenW (lpString=".docx") returned 5 [0183.791] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0183.791] lstrlenW (lpString=".pdf") returned 4 [0183.791] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.791] lstrlenW (lpString=".xls") returned 4 [0183.791] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.791] lstrlenW (lpString=".xlsx") returned 5 [0183.791] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0183.791] lstrlenW (lpString=".ppt") returned 4 [0183.791] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.791] lstrlenW (lpString=".zip") returned 4 [0183.791] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.791] lstrlenW (lpString=".rar") returned 4 [0183.791] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.791] lstrlenW (lpString=".bz2") returned 4 [0183.791] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.791] lstrlenW (lpString=".7z") returned 3 [0183.791] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.791] lstrlenW (lpString=".dbf") returned 4 [0183.791] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.791] lstrlenW (lpString=".1cd") returned 4 [0183.791] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.791] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0183.791] lstrlenW (lpString=".jpg") returned 4 [0183.791] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.792] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.792] lstrlenW (lpString="boxed-split.avi") returned 15 [0183.792] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.808] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=62976) returned 1 [0183.808] CloseHandle (hObject=0x1d0) returned 1 [0183.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0183.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.809] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.809] lstrlenW (lpString=".doc") returned 4 [0183.809] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.809] lstrlenW (lpString=".docx") returned 5 [0183.809] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0183.809] lstrlenW (lpString=".pdf") returned 4 [0183.809] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.809] lstrlenW (lpString=".xls") returned 4 [0183.809] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.809] lstrlenW (lpString=".xlsx") returned 5 [0183.809] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0183.809] lstrlenW (lpString=".ppt") returned 4 [0183.809] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.809] lstrlenW (lpString=".zip") returned 4 [0183.809] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.809] lstrlenW (lpString=".rar") returned 4 [0183.809] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.809] lstrlenW (lpString=".bz2") returned 4 [0183.809] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.809] lstrlenW (lpString=".7z") returned 3 [0183.809] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.809] lstrlenW (lpString=".dbf") returned 4 [0183.809] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.810] lstrlenW (lpString=".1cd") returned 4 [0183.810] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.810] lstrlenW (lpString=".jpg") returned 4 [0183.810] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.810] lstrlenW (lpString=".doc") returned 4 [0183.810] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.810] lstrlenW (lpString=".docx") returned 5 [0183.810] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0183.810] lstrlenW (lpString=".pdf") returned 4 [0183.810] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.810] lstrlenW (lpString=".xls") returned 4 [0183.810] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.810] lstrlenW (lpString=".xlsx") returned 5 [0183.810] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0183.810] lstrlenW (lpString=".ppt") returned 4 [0183.810] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.810] lstrlenW (lpString=".zip") returned 4 [0183.810] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.810] lstrlenW (lpString=".rar") returned 4 [0183.810] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.810] lstrlenW (lpString=".bz2") returned 4 [0183.810] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.810] lstrlenW (lpString=".7z") returned 3 [0183.810] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.810] lstrlenW (lpString=".dbf") returned 4 [0183.810] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.810] lstrlenW (lpString=".1cd") returned 4 [0183.810] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.811] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0183.811] lstrlenW (lpString=".jpg") returned 4 [0183.811] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.811] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.811] lstrlenW (lpString="auxbase.xml") returned 11 [0183.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.827] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1434) returned 1 [0183.827] CloseHandle (hObject=0x1d0) returned 1 [0183.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0183.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.828] lstrlenW (lpString=".doc") returned 4 [0183.828] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.828] lstrlenW (lpString=".docx") returned 5 [0183.828] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.828] lstrlenW (lpString=".pdf") returned 4 [0183.828] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.828] lstrlenW (lpString=".xls") returned 4 [0183.828] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.828] lstrlenW (lpString=".xlsx") returned 5 [0183.828] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0183.828] lstrlenW (lpString=".ppt") returned 4 [0183.828] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.828] lstrlenW (lpString=".zip") returned 4 [0183.828] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.828] lstrlenW (lpString=".rar") returned 4 [0183.828] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.828] lstrlenW (lpString=".bz2") returned 4 [0183.828] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.828] lstrlenW (lpString=".7z") returned 3 [0183.828] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.828] lstrlenW (lpString=".dbf") returned 4 [0183.828] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.828] lstrlenW (lpString=".1cd") returned 4 [0183.829] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.829] lstrlenW (lpString=".jpg") returned 4 [0183.829] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.829] lstrlenW (lpString=".doc") returned 4 [0183.829] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.829] lstrlenW (lpString=".docx") returned 5 [0183.829] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.829] lstrlenW (lpString=".pdf") returned 4 [0183.829] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.829] lstrlenW (lpString=".xls") returned 4 [0183.829] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.829] lstrlenW (lpString=".xlsx") returned 5 [0183.829] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0183.829] lstrlenW (lpString=".ppt") returned 4 [0183.829] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.829] lstrlenW (lpString=".zip") returned 4 [0183.829] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.829] lstrlenW (lpString=".rar") returned 4 [0183.829] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.829] lstrlenW (lpString=".bz2") returned 4 [0183.829] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.829] lstrlenW (lpString=".7z") returned 3 [0183.829] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.829] lstrlenW (lpString=".dbf") returned 4 [0183.829] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.829] lstrlenW (lpString=".1cd") returned 4 [0183.829] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0183.830] lstrlenW (lpString=".jpg") returned 4 [0183.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.830] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.830] lstrlenW (lpString="baseAltGr_rtl.xml") returned 17 [0183.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.839] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=247) returned 1 [0183.839] CloseHandle (hObject=0x1d0) returned 1 [0183.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml")) returned 0x20 [0183.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.839] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\basealtgr_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.839] lstrlenW (lpString=".doc") returned 4 [0183.839] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.839] lstrlenW (lpString=".docx") returned 5 [0183.839] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0183.839] lstrlenW (lpString=".pdf") returned 4 [0183.839] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.839] lstrlenW (lpString=".xls") returned 4 [0183.839] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.839] lstrlenW (lpString=".xlsx") returned 5 [0183.839] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0183.839] lstrlenW (lpString=".ppt") returned 4 [0183.839] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.839] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.840] lstrlenW (lpString=".zip") returned 4 [0183.840] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.840] lstrlenW (lpString=".rar") returned 4 [0183.840] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.840] lstrlenW (lpString=".bz2") returned 4 [0183.840] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.840] lstrlenW (lpString=".7z") returned 3 [0183.840] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.840] lstrlenW (lpString=".dbf") returned 4 [0183.840] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.840] lstrlenW (lpString=".1cd") returned 4 [0183.840] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.840] lstrlenW (lpString=".jpg") returned 4 [0183.840] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.840] lstrlenW (lpString=".doc") returned 4 [0183.840] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.840] lstrlenW (lpString=".docx") returned 5 [0183.840] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0183.840] lstrlenW (lpString=".pdf") returned 4 [0183.840] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.840] lstrlenW (lpString=".xls") returned 4 [0183.840] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.840] lstrlenW (lpString=".xlsx") returned 5 [0183.840] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0183.840] lstrlenW (lpString=".ppt") returned 4 [0183.840] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.840] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.840] lstrlenW (lpString=".zip") returned 4 [0183.841] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.841] lstrlenW (lpString=".rar") returned 4 [0183.841] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.841] lstrlenW (lpString=".bz2") returned 4 [0183.841] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.841] lstrlenW (lpString=".7z") returned 3 [0183.841] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.841] lstrlenW (lpString=".dbf") returned 4 [0183.841] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.841] lstrlenW (lpString=".1cd") returned 4 [0183.841] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.841] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\baseAltGr_rtl.xml") returned 87 [0183.841] lstrlenW (lpString=".jpg") returned 4 [0183.841] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.841] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.841] lstrlenW (lpString="base_heb.xml") returned 12 [0183.841] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.842] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=738) returned 1 [0183.842] CloseHandle (hObject=0x1d0) returned 1 [0183.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml")) returned 0x20 [0183.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.842] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_heb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.842] lstrlenW (lpString=".doc") returned 4 [0183.842] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.843] lstrlenW (lpString=".docx") returned 5 [0183.843] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0183.843] lstrlenW (lpString=".pdf") returned 4 [0183.843] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.843] lstrlenW (lpString=".xls") returned 4 [0183.843] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.843] lstrlenW (lpString=".xlsx") returned 5 [0183.843] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0183.843] lstrlenW (lpString=".ppt") returned 4 [0183.843] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.843] lstrlenW (lpString=".zip") returned 4 [0183.843] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.843] lstrlenW (lpString=".rar") returned 4 [0183.843] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.843] lstrlenW (lpString=".bz2") returned 4 [0183.843] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.843] lstrlenW (lpString=".7z") returned 3 [0183.843] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.843] lstrlenW (lpString=".dbf") returned 4 [0183.843] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.843] lstrlenW (lpString=".1cd") returned 4 [0183.843] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.843] lstrlenW (lpString=".jpg") returned 4 [0183.843] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.843] lstrlenW (lpString=".doc") returned 4 [0183.843] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.844] lstrlenW (lpString=".docx") returned 5 [0183.844] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0183.844] lstrlenW (lpString=".pdf") returned 4 [0183.844] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.844] lstrlenW (lpString=".xls") returned 4 [0183.844] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.844] lstrlenW (lpString=".xlsx") returned 5 [0183.844] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0183.844] lstrlenW (lpString=".ppt") returned 4 [0183.844] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.844] lstrlenW (lpString=".zip") returned 4 [0183.844] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.844] lstrlenW (lpString=".rar") returned 4 [0183.844] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.844] lstrlenW (lpString=".bz2") returned 4 [0183.844] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.844] lstrlenW (lpString=".7z") returned 3 [0183.844] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.844] lstrlenW (lpString=".dbf") returned 4 [0183.844] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.844] lstrlenW (lpString=".1cd") returned 4 [0183.844] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.844] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_heb.xml") returned 82 [0183.844] lstrlenW (lpString=".jpg") returned 4 [0183.844] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.844] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.845] lstrlenW (lpString="base_jpn.xml") returned 12 [0183.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.845] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=804) returned 1 [0183.845] CloseHandle (hObject=0x1d0) returned 1 [0183.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml")) returned 0x20 [0183.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.845] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_jpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0183.845] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0183.845] lstrlenW (lpString=".doc") returned 4 [0183.845] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.845] lstrlenW (lpString=".docx") returned 5 [0183.845] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0183.845] lstrlenW (lpString=".pdf") returned 4 [0183.845] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.845] lstrlenW (lpString=".xls") returned 4 [0183.845] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.845] lstrlenW (lpString=".xlsx") returned 5 [0183.846] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0183.846] lstrlenW (lpString=".ppt") returned 4 [0183.846] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.846] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_jpn.xml") returned 82 [0183.846] lstrlenW (lpString=".zip") returned 4 [0183.846] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.846] lstrlenW (lpString=".rar") returned 4 [0183.846] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.846] lstrlenW (lpString=".bz2") returned 4 [0183.846] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.846] lstrlenW (lpString=".7z") returned 3 [0183.846] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.917] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.354] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3819) returned 1 [0185.354] CloseHandle (hObject=0x324) returned 1 [0185.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png")) returned 0x20 [0185.355] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.355] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\previousmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.355] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.355] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0185.355] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.355] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.355] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0185.355] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.355] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.355] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.355] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.356] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.356] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.356] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.356] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.356] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77 [0185.356] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77 [0185.356] lstrlenW (lpString=".doc") returned 4 [0185.356] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.356] lstrlenW (lpString=".docx") returned 5 [0185.356] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0185.356] lstrlenW (lpString=".pdf") returned 4 [0185.356] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.356] lstrlenW (lpString=".xls") returned 4 [0185.356] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.356] lstrlenW (lpString=".xlsx") returned 5 [0185.356] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0185.356] lstrlenW (lpString=".ppt") returned 4 [0185.356] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.356] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77 [0185.356] lstrlenW (lpString=".zip") returned 4 [0185.356] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.356] lstrlenW (lpString=".rar") returned 4 [0185.356] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.356] lstrlenW (lpString=".bz2") returned 4 [0185.356] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.356] lstrlenW (lpString=".7z") returned 3 [0185.356] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.356] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77 [0185.356] lstrlenW (lpString=".dbf") returned 4 [0185.356] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.357] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77 [0185.357] lstrlenW (lpString=".1cd") returned 4 [0185.357] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.357] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\PreviousMenuButtonIcon.png") returned 77 [0185.357] lstrlenW (lpString=".jpg") returned 4 [0185.357] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.357] Sleep (dwMilliseconds=0x64) [0185.460] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.460] lstrlenW (lpString="BS00092_.WMF") returned 12 [0185.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0185.561] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=7974) returned 1 [0185.561] CloseHandle (hObject=0x380) returned 1 [0185.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0185.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.563] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.567] lstrlenW (lpString=".doc") returned 4 [0185.567] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.567] lstrlenW (lpString=".docx") returned 5 [0185.567] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.567] lstrlenW (lpString=".pdf") returned 4 [0185.567] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.567] lstrlenW (lpString=".xls") returned 4 [0185.567] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.567] lstrlenW (lpString=".xlsx") returned 5 [0185.567] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.567] lstrlenW (lpString=".ppt") returned 4 [0185.567] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.567] lstrlenW (lpString=".zip") returned 4 [0185.567] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.567] lstrlenW (lpString=".rar") returned 4 [0185.567] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.567] lstrlenW (lpString=".bz2") returned 4 [0185.567] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.567] lstrlenW (lpString=".7z") returned 3 [0185.567] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.567] lstrlenW (lpString=".dbf") returned 4 [0185.567] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.567] lstrlenW (lpString=".1cd") returned 4 [0185.567] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.567] lstrlenW (lpString=".jpg") returned 4 [0185.567] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.568] lstrlenW (lpString=".doc") returned 4 [0185.568] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.568] lstrlenW (lpString=".docx") returned 5 [0185.568] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.568] lstrlenW (lpString=".pdf") returned 4 [0185.568] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.568] lstrlenW (lpString=".xls") returned 4 [0185.568] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.568] lstrlenW (lpString=".xlsx") returned 5 [0185.568] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.568] lstrlenW (lpString=".ppt") returned 4 [0185.568] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.568] lstrlenW (lpString=".zip") returned 4 [0185.568] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.568] lstrlenW (lpString=".rar") returned 4 [0185.568] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.568] lstrlenW (lpString=".bz2") returned 4 [0185.568] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.568] lstrlenW (lpString=".7z") returned 3 [0185.568] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.568] lstrlenW (lpString=".dbf") returned 4 [0185.568] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.568] lstrlenW (lpString=".1cd") returned 4 [0185.568] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0185.568] lstrlenW (lpString=".jpg") returned 4 [0185.568] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.569] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.569] lstrlenW (lpString="BS00135_.WMF") returned 12 [0185.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0185.605] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1044) returned 1 [0185.605] CloseHandle (hObject=0x380) returned 1 [0185.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0185.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.609] lstrlenW (lpString=".doc") returned 4 [0185.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.609] lstrlenW (lpString=".docx") returned 5 [0185.609] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.609] lstrlenW (lpString=".pdf") returned 4 [0185.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.609] lstrlenW (lpString=".xls") returned 4 [0185.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.609] lstrlenW (lpString=".xlsx") returned 5 [0185.609] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.609] lstrlenW (lpString=".ppt") returned 4 [0185.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.609] lstrlenW (lpString=".zip") returned 4 [0185.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.609] lstrlenW (lpString=".rar") returned 4 [0185.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.609] lstrlenW (lpString=".bz2") returned 4 [0185.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.609] lstrlenW (lpString=".7z") returned 3 [0185.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.609] lstrlenW (lpString=".dbf") returned 4 [0185.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.610] lstrlenW (lpString=".1cd") returned 4 [0185.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.610] lstrlenW (lpString=".jpg") returned 4 [0185.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.610] lstrlenW (lpString=".doc") returned 4 [0185.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.610] lstrlenW (lpString=".docx") returned 5 [0185.610] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.610] lstrlenW (lpString=".pdf") returned 4 [0185.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.610] lstrlenW (lpString=".xls") returned 4 [0185.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.610] lstrlenW (lpString=".xlsx") returned 5 [0185.610] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.610] lstrlenW (lpString=".ppt") returned 4 [0185.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.610] lstrlenW (lpString=".zip") returned 4 [0185.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.610] lstrlenW (lpString=".rar") returned 4 [0185.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.610] lstrlenW (lpString=".bz2") returned 4 [0185.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.610] lstrlenW (lpString=".7z") returned 3 [0185.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.610] lstrlenW (lpString=".dbf") returned 4 [0185.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.611] lstrlenW (lpString=".1cd") returned 4 [0185.611] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0185.611] lstrlenW (lpString=".jpg") returned 4 [0185.611] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.611] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.611] lstrlenW (lpString="BS00174_.WMF") returned 12 [0185.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0185.665] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=8366) returned 1 [0185.665] CloseHandle (hObject=0x320) returned 1 [0185.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0185.665] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.669] lstrlenW (lpString=".doc") returned 4 [0185.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.669] lstrlenW (lpString=".docx") returned 5 [0185.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.669] lstrlenW (lpString=".pdf") returned 4 [0185.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.669] lstrlenW (lpString=".xls") returned 4 [0185.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.669] lstrlenW (lpString=".xlsx") returned 5 [0185.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.669] lstrlenW (lpString=".ppt") returned 4 [0185.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.669] lstrlenW (lpString=".zip") returned 4 [0185.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.669] lstrlenW (lpString=".rar") returned 4 [0185.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.669] lstrlenW (lpString=".bz2") returned 4 [0185.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.669] lstrlenW (lpString=".7z") returned 3 [0185.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.670] lstrlenW (lpString=".dbf") returned 4 [0185.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.670] lstrlenW (lpString=".1cd") returned 4 [0185.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.670] lstrlenW (lpString=".jpg") returned 4 [0185.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.670] lstrlenW (lpString=".doc") returned 4 [0185.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.670] lstrlenW (lpString=".docx") returned 5 [0185.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.670] lstrlenW (lpString=".pdf") returned 4 [0185.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.670] lstrlenW (lpString=".xls") returned 4 [0185.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.670] lstrlenW (lpString=".xlsx") returned 5 [0185.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.670] lstrlenW (lpString=".ppt") returned 4 [0185.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.670] lstrlenW (lpString=".zip") returned 4 [0185.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.670] lstrlenW (lpString=".rar") returned 4 [0185.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.670] lstrlenW (lpString=".bz2") returned 4 [0185.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.670] lstrlenW (lpString=".7z") returned 3 [0185.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.671] lstrlenW (lpString=".dbf") returned 4 [0185.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.671] lstrlenW (lpString=".1cd") returned 4 [0185.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0185.671] lstrlenW (lpString=".jpg") returned 4 [0185.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.671] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.671] lstrlenW (lpString="BS00445_.WMF") returned 12 [0185.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0185.883] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3796) returned 1 [0185.883] CloseHandle (hObject=0x310) returned 1 [0185.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0185.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.886] lstrlenW (lpString=".doc") returned 4 [0185.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.886] lstrlenW (lpString=".docx") returned 5 [0185.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.886] lstrlenW (lpString=".pdf") returned 4 [0185.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.886] lstrlenW (lpString=".xls") returned 4 [0185.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.886] lstrlenW (lpString=".xlsx") returned 5 [0185.886] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.886] lstrlenW (lpString=".ppt") returned 4 [0185.886] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.886] lstrlenW (lpString=".zip") returned 4 [0185.886] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.886] lstrlenW (lpString=".rar") returned 4 [0185.886] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.886] lstrlenW (lpString=".bz2") returned 4 [0185.886] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.886] lstrlenW (lpString=".7z") returned 3 [0185.886] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.886] lstrlenW (lpString=".dbf") returned 4 [0185.886] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.886] lstrlenW (lpString=".1cd") returned 4 [0185.886] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.887] lstrlenW (lpString=".jpg") returned 4 [0185.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.887] lstrlenW (lpString=".doc") returned 4 [0185.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.887] lstrlenW (lpString=".docx") returned 5 [0185.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.887] lstrlenW (lpString=".pdf") returned 4 [0185.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.887] lstrlenW (lpString=".xls") returned 4 [0185.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.887] lstrlenW (lpString=".xlsx") returned 5 [0185.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.887] lstrlenW (lpString=".ppt") returned 4 [0185.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.887] lstrlenW (lpString=".zip") returned 4 [0185.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.887] lstrlenW (lpString=".rar") returned 4 [0185.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.887] lstrlenW (lpString=".bz2") returned 4 [0185.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.887] lstrlenW (lpString=".7z") returned 3 [0185.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.887] lstrlenW (lpString=".dbf") returned 4 [0185.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.887] lstrlenW (lpString=".1cd") returned 4 [0185.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0185.887] lstrlenW (lpString=".jpg") returned 4 [0185.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.888] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.888] lstrlenW (lpString="FD02071_.WMF") returned 12 [0185.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0185.898] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2188) returned 1 [0185.898] CloseHandle (hObject=0x310) returned 1 [0185.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0185.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.898] lstrlenW (lpString=".doc") returned 4 [0185.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.898] lstrlenW (lpString=".docx") returned 5 [0185.898] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.899] lstrlenW (lpString=".pdf") returned 4 [0185.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.899] lstrlenW (lpString=".xls") returned 4 [0185.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.899] lstrlenW (lpString=".xlsx") returned 5 [0185.899] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.899] lstrlenW (lpString=".ppt") returned 4 [0185.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.899] lstrlenW (lpString=".zip") returned 4 [0185.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.899] lstrlenW (lpString=".rar") returned 4 [0185.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.899] lstrlenW (lpString=".bz2") returned 4 [0185.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.899] lstrlenW (lpString=".7z") returned 3 [0185.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.899] lstrlenW (lpString=".dbf") returned 4 [0185.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.899] lstrlenW (lpString=".1cd") returned 4 [0185.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.899] lstrlenW (lpString=".jpg") returned 4 [0185.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.899] lstrlenW (lpString=".doc") returned 4 [0185.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.899] lstrlenW (lpString=".docx") returned 5 [0185.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.899] lstrlenW (lpString=".pdf") returned 4 [0185.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.900] lstrlenW (lpString=".xls") returned 4 [0185.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.900] lstrlenW (lpString=".xlsx") returned 5 [0185.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.900] lstrlenW (lpString=".ppt") returned 4 [0185.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.900] lstrlenW (lpString=".zip") returned 4 [0185.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.900] lstrlenW (lpString=".rar") returned 4 [0185.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.900] lstrlenW (lpString=".bz2") returned 4 [0185.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.900] lstrlenW (lpString=".7z") returned 3 [0185.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.900] lstrlenW (lpString=".dbf") returned 4 [0185.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.901] lstrlenW (lpString=".1cd") returned 4 [0185.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0185.901] lstrlenW (lpString=".jpg") returned 4 [0185.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.901] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.901] lstrlenW (lpString="FD02116_.WMF") returned 12 [0185.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0185.902] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3988) returned 1 [0185.902] CloseHandle (hObject=0x310) returned 1 [0185.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0185.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0185.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0185.902] lstrlenW (lpString=".doc") returned 4 [0185.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.902] lstrlenW (lpString=".docx") returned 5 [0185.902] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.902] lstrlenW (lpString=".pdf") returned 4 [0185.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.902] lstrlenW (lpString=".xls") returned 4 [0185.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.902] lstrlenW (lpString=".xlsx") returned 5 [0185.902] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.902] lstrlenW (lpString=".ppt") returned 4 [0185.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0185.903] lstrlenW (lpString=".zip") returned 4 [0185.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.903] lstrlenW (lpString=".rar") returned 4 [0185.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.903] lstrlenW (lpString=".bz2") returned 4 [0185.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.903] lstrlenW (lpString=".7z") returned 3 [0185.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0185.903] lstrlenW (lpString=".dbf") returned 4 [0185.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0185.903] lstrlenW (lpString=".1cd") returned 4 [0185.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0185.903] lstrlenW (lpString=".jpg") returned 4 [0185.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0185.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0185.903] lstrlenW (lpString=".doc") returned 4 [0185.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.903] lstrlenW (lpString=".docx") returned 5 [0185.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.903] lstrlenW (lpString=".pdf") returned 4 [0185.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.903] lstrlenW (lpString=".xls") returned 4 [0185.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.903] lstrlenW (lpString=".xlsx") returned 5 [0185.903] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.903] lstrlenW (lpString=".ppt") returned 4 [0185.903] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0185.903] lstrlenW (lpString=".zip") returned 4 [0185.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.904] lstrlenW (lpString=".rar") returned 4 [0185.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.904] lstrlenW (lpString=".bz2") returned 4 [0185.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.904] lstrlenW (lpString=".7z") returned 3 [0185.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0185.904] lstrlenW (lpString=".dbf") returned 4 [0185.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0188.162] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVZIP.DIC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\advzip.dic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_M.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_m.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WFDEP_U.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\wfdep_u.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Charitable Contributions.accdt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\charitable contributions.accdt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.682] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\Access\\Northwind.accdt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\access\\northwind.accdt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.690] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\AdjacencyReport.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\adjacencyreport.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieLetter.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieletter.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieMergeLetter.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktiemergeletter.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieNewsletter.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktienewsletter.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\BlackTieResume.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\blacktieresume.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.706] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\EquityReport.Dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\equityreport.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\UrbanPhotoAlbum.potx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\urbanphotoalbum.potx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.843] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), lpNewFileName="C:\\Program Files\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.391] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.391] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.392] GetLastError () returned 0x0 [0193.392] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xde, lpOverlapped=0x0) returned 1 [0193.400] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.401] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.401] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.401] SetEndOfFile (hFile=0x388) returned 1 [0193.401] CloseHandle (hObject=0x388) returned 1 [0193.401] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.401] SetEndOfFile (hFile=0x120) returned 1 [0193.402] CloseHandle (hObject=0x120) returned 1 [0193.402] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.402] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0193.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.403] lstrlenW (lpString=".doc") returned 4 [0193.403] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.403] lstrlenW (lpString=".docx") returned 5 [0193.403] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.403] lstrlenW (lpString=".pdf") returned 4 [0193.403] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.403] lstrlenW (lpString=".xls") returned 4 [0193.403] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.403] lstrlenW (lpString=".xlsx") returned 5 [0193.403] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.403] lstrlenW (lpString=".ppt") returned 4 [0193.403] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.403] lstrlenW (lpString=".zip") returned 4 [0193.403] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.403] lstrlenW (lpString=".rar") returned 4 [0193.403] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.403] lstrlenW (lpString=".bz2") returned 4 [0193.403] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.403] lstrlenW (lpString=".7z") returned 3 [0193.403] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.403] lstrlenW (lpString=".dbf") returned 4 [0193.403] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.403] lstrlenW (lpString=".1cd") returned 4 [0193.403] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.404] lstrlenW (lpString=".jpg") returned 4 [0193.404] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.404] lstrlenW (lpString=".doc") returned 4 [0193.404] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.404] lstrlenW (lpString=".docx") returned 5 [0193.404] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.404] lstrlenW (lpString=".pdf") returned 4 [0193.404] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.404] lstrlenW (lpString=".xls") returned 4 [0193.404] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.404] lstrlenW (lpString=".xlsx") returned 5 [0193.404] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.404] lstrlenW (lpString=".ppt") returned 4 [0193.404] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.404] lstrlenW (lpString=".zip") returned 4 [0193.404] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.404] lstrlenW (lpString=".rar") returned 4 [0193.404] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.404] lstrlenW (lpString=".bz2") returned 4 [0193.404] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.404] lstrlenW (lpString=".7z") returned 3 [0193.404] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.404] lstrlenW (lpString=".dbf") returned 4 [0193.404] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.404] lstrlenW (lpString=".1cd") returned 4 [0193.404] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.405] lstrlenW (lpString=".jpg") returned 4 [0193.405] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.405] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.405] lstrlenW (lpString="messages.json") returned 13 [0193.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.406] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=272) returned 1 [0193.406] CloseHandle (hObject=0x120) returned 1 [0193.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 0x2020 [0193.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.406] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.406] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.407] GetLastError () returned 0x0 [0193.407] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x110, lpOverlapped=0x0) returned 1 [0193.408] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x120, lpOverlapped=0x0) returned 1 [0193.408] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.408] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.409] SetEndOfFile (hFile=0x388) returned 1 [0193.409] CloseHandle (hObject=0x388) returned 1 [0193.409] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.409] SetEndOfFile (hFile=0x120) returned 1 [0193.410] CloseHandle (hObject=0x120) returned 1 [0193.410] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.410] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0193.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.410] lstrlenW (lpString=".doc") returned 4 [0193.410] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.410] lstrlenW (lpString=".docx") returned 5 [0193.410] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.410] lstrlenW (lpString=".pdf") returned 4 [0193.410] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.410] lstrlenW (lpString=".xls") returned 4 [0193.410] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.410] lstrlenW (lpString=".xlsx") returned 5 [0193.410] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.410] lstrlenW (lpString=".ppt") returned 4 [0193.410] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.410] lstrlenW (lpString=".zip") returned 4 [0193.410] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.410] lstrlenW (lpString=".rar") returned 4 [0193.411] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.411] lstrlenW (lpString=".bz2") returned 4 [0193.411] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.411] lstrlenW (lpString=".7z") returned 3 [0193.411] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.411] lstrlenW (lpString=".dbf") returned 4 [0193.411] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.411] lstrlenW (lpString=".1cd") returned 4 [0193.411] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.411] lstrlenW (lpString=".jpg") returned 4 [0193.411] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.411] lstrlenW (lpString=".doc") returned 4 [0193.411] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.411] lstrlenW (lpString=".docx") returned 5 [0193.411] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.411] lstrlenW (lpString=".pdf") returned 4 [0193.411] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.411] lstrlenW (lpString=".xls") returned 4 [0193.411] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.411] lstrlenW (lpString=".xlsx") returned 5 [0193.411] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.411] lstrlenW (lpString=".ppt") returned 4 [0193.411] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.411] lstrlenW (lpString=".zip") returned 4 [0193.412] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.412] lstrlenW (lpString=".rar") returned 4 [0193.412] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.412] lstrlenW (lpString=".bz2") returned 4 [0193.412] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.412] lstrlenW (lpString=".7z") returned 3 [0193.412] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.412] lstrlenW (lpString=".dbf") returned 4 [0193.412] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.412] lstrlenW (lpString=".1cd") returned 4 [0193.412] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.412] lstrlenW (lpString=".jpg") returned 4 [0193.412] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.412] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.412] lstrlenW (lpString="messages.json") returned 13 [0193.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.413] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=227) returned 1 [0193.413] CloseHandle (hObject=0x120) returned 1 [0193.413] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 0x2020 [0193.413] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.413] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.413] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.413] GetLastError () returned 0x0 [0193.413] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xe3, lpOverlapped=0x0) returned 1 [0193.414] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.416] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.416] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.416] SetEndOfFile (hFile=0x388) returned 1 [0193.416] CloseHandle (hObject=0x388) returned 1 [0193.416] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.416] SetEndOfFile (hFile=0x120) returned 1 [0193.417] CloseHandle (hObject=0x120) returned 1 [0193.417] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.417] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0193.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.417] lstrlenW (lpString=".doc") returned 4 [0193.417] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.417] lstrlenW (lpString=".docx") returned 5 [0193.417] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.417] lstrlenW (lpString=".pdf") returned 4 [0193.417] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.418] lstrlenW (lpString=".xls") returned 4 [0193.418] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.418] lstrlenW (lpString=".xlsx") returned 5 [0193.418] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.418] lstrlenW (lpString=".ppt") returned 4 [0193.418] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.418] lstrlenW (lpString=".zip") returned 4 [0193.418] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.418] lstrlenW (lpString=".rar") returned 4 [0193.418] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.418] lstrlenW (lpString=".bz2") returned 4 [0193.418] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.418] lstrlenW (lpString=".7z") returned 3 [0193.418] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.418] lstrlenW (lpString=".dbf") returned 4 [0193.418] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.418] lstrlenW (lpString=".1cd") returned 4 [0193.418] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.418] lstrlenW (lpString=".jpg") returned 4 [0193.418] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.418] lstrlenW (lpString=".doc") returned 4 [0193.418] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.418] lstrlenW (lpString=".docx") returned 5 [0193.418] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.419] lstrlenW (lpString=".pdf") returned 4 [0193.419] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.419] lstrlenW (lpString=".xls") returned 4 [0193.419] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.419] lstrlenW (lpString=".xlsx") returned 5 [0193.419] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.419] lstrlenW (lpString=".ppt") returned 4 [0193.419] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.419] lstrlenW (lpString=".zip") returned 4 [0193.419] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.419] lstrlenW (lpString=".rar") returned 4 [0193.419] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.419] lstrlenW (lpString=".bz2") returned 4 [0193.419] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.419] lstrlenW (lpString=".7z") returned 3 [0193.419] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.419] lstrlenW (lpString=".dbf") returned 4 [0193.419] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.419] lstrlenW (lpString=".1cd") returned 4 [0193.419] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.419] lstrlenW (lpString=".jpg") returned 4 [0193.419] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.419] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.420] lstrlenW (lpString="messages.json") returned 13 [0193.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.422] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=223) returned 1 [0193.422] CloseHandle (hObject=0x120) returned 1 [0193.423] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 0x2020 [0193.423] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.423] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.423] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.423] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.423] GetLastError () returned 0x0 [0193.423] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xdf, lpOverlapped=0x0) returned 1 [0193.505] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.506] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.506] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.506] SetEndOfFile (hFile=0x388) returned 1 [0193.506] CloseHandle (hObject=0x388) returned 1 [0193.506] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.506] SetEndOfFile (hFile=0x120) returned 1 [0193.507] CloseHandle (hObject=0x120) returned 1 [0193.507] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.507] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0193.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.507] lstrlenW (lpString=".doc") returned 4 [0193.507] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.507] lstrlenW (lpString=".docx") returned 5 [0193.507] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.507] lstrlenW (lpString=".pdf") returned 4 [0193.507] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.507] lstrlenW (lpString=".xls") returned 4 [0193.507] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.507] lstrlenW (lpString=".xlsx") returned 5 [0193.507] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.507] lstrlenW (lpString=".ppt") returned 4 [0193.508] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.508] lstrlenW (lpString=".zip") returned 4 [0193.508] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.508] lstrlenW (lpString=".rar") returned 4 [0193.508] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.508] lstrlenW (lpString=".bz2") returned 4 [0193.508] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.508] lstrlenW (lpString=".7z") returned 3 [0193.508] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.508] lstrlenW (lpString=".dbf") returned 4 [0193.508] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.508] lstrlenW (lpString=".1cd") returned 4 [0193.508] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.508] lstrlenW (lpString=".jpg") returned 4 [0193.508] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.508] lstrlenW (lpString=".doc") returned 4 [0193.508] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.508] lstrlenW (lpString=".docx") returned 5 [0193.508] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.508] lstrlenW (lpString=".pdf") returned 4 [0193.508] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.508] lstrlenW (lpString=".xls") returned 4 [0193.508] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.508] lstrlenW (lpString=".xlsx") returned 5 [0193.509] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.509] lstrlenW (lpString=".ppt") returned 4 [0193.509] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.509] lstrlenW (lpString=".zip") returned 4 [0193.509] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.509] lstrlenW (lpString=".rar") returned 4 [0193.509] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.509] lstrlenW (lpString=".bz2") returned 4 [0193.509] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.509] lstrlenW (lpString=".7z") returned 3 [0193.509] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.509] lstrlenW (lpString=".dbf") returned 4 [0193.509] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.509] lstrlenW (lpString=".1cd") returned 4 [0193.509] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.509] lstrlenW (lpString=".jpg") returned 4 [0193.509] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.509] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0193.509] lstrlenW (lpString="icon_128.png") returned 12 [0193.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.510] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3213) returned 1 [0193.510] CloseHandle (hObject=0x120) returned 1 [0193.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 0x2020 [0193.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.510] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.510] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.511] GetLastError () returned 0x0 [0193.511] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xc8d, lpOverlapped=0x0) returned 1 [0193.512] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc90, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc90, lpOverlapped=0x0) returned 1 [0193.513] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.513] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0193.513] SetEndOfFile (hFile=0x388) returned 1 [0193.513] CloseHandle (hObject=0x388) returned 1 [0193.516] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.516] SetEndOfFile (hFile=0x120) returned 1 [0193.516] CloseHandle (hObject=0x120) returned 1 [0193.517] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.517] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png")) returned 1 [0193.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.517] lstrlenW (lpString=".doc") returned 4 [0193.517] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0193.517] lstrlenW (lpString=".docx") returned 5 [0193.517] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0193.517] lstrlenW (lpString=".pdf") returned 4 [0193.517] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0193.517] lstrlenW (lpString=".xls") returned 4 [0193.517] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0193.517] lstrlenW (lpString=".xlsx") returned 5 [0193.517] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0193.517] lstrlenW (lpString=".ppt") returned 4 [0193.517] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0193.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.517] lstrlenW (lpString=".zip") returned 4 [0193.517] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0193.517] lstrlenW (lpString=".rar") returned 4 [0193.518] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0193.518] lstrlenW (lpString=".bz2") returned 4 [0193.518] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0193.518] lstrlenW (lpString=".7z") returned 3 [0193.518] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0193.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.518] lstrlenW (lpString=".dbf") returned 4 [0193.518] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0193.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.518] lstrlenW (lpString=".1cd") returned 4 [0193.518] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0193.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.518] lstrlenW (lpString=".jpg") returned 4 [0193.518] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0193.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.518] lstrlenW (lpString=".doc") returned 4 [0193.518] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0193.518] lstrlenW (lpString=".docx") returned 5 [0193.518] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0193.518] lstrlenW (lpString=".pdf") returned 4 [0193.518] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0193.518] lstrlenW (lpString=".xls") returned 4 [0193.518] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0193.518] lstrlenW (lpString=".xlsx") returned 5 [0193.518] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0193.518] lstrlenW (lpString=".ppt") returned 4 [0193.518] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0193.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.519] lstrlenW (lpString=".zip") returned 4 [0193.519] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0193.519] lstrlenW (lpString=".rar") returned 4 [0193.519] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0193.519] lstrlenW (lpString=".bz2") returned 4 [0193.519] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0193.519] lstrlenW (lpString=".7z") returned 3 [0193.519] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0193.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.519] lstrlenW (lpString=".dbf") returned 4 [0193.519] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0193.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.519] lstrlenW (lpString=".1cd") returned 4 [0193.519] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0193.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_128.png") returned 138 [0193.519] lstrlenW (lpString=".jpg") returned 4 [0193.519] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0193.519] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0193.519] lstrlenW (lpString="icon_16.png") returned 11 [0193.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.520] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=143) returned 1 [0193.520] CloseHandle (hObject=0x120) returned 1 [0193.520] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 0x2020 [0193.520] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.520] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.520] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.520] GetLastError () returned 0x0 [0193.520] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x8f, lpOverlapped=0x0) returned 1 [0193.521] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x90, lpOverlapped=0x0) returned 1 [0193.522] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.522] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0193.522] SetEndOfFile (hFile=0x388) returned 1 [0193.522] CloseHandle (hObject=0x388) returned 1 [0193.523] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.523] SetEndOfFile (hFile=0x120) returned 1 [0193.523] CloseHandle (hObject=0x120) returned 1 [0193.523] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.524] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png")) returned 1 [0193.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.524] lstrlenW (lpString=".doc") returned 4 [0193.524] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0193.524] lstrlenW (lpString=".docx") returned 5 [0193.524] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0193.524] lstrlenW (lpString=".pdf") returned 4 [0193.524] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0193.524] lstrlenW (lpString=".xls") returned 4 [0193.524] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0193.524] lstrlenW (lpString=".xlsx") returned 5 [0193.524] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0193.524] lstrlenW (lpString=".ppt") returned 4 [0193.524] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0193.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.524] lstrlenW (lpString=".zip") returned 4 [0193.524] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0193.524] lstrlenW (lpString=".rar") returned 4 [0193.524] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0193.524] lstrlenW (lpString=".bz2") returned 4 [0193.524] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0193.524] lstrlenW (lpString=".7z") returned 3 [0193.524] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0193.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.525] lstrlenW (lpString=".dbf") returned 4 [0193.525] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0193.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.525] lstrlenW (lpString=".1cd") returned 4 [0193.525] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0193.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.525] lstrlenW (lpString=".jpg") returned 4 [0193.525] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0193.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.525] lstrlenW (lpString=".doc") returned 4 [0193.525] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0193.525] lstrlenW (lpString=".docx") returned 5 [0193.525] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0193.525] lstrlenW (lpString=".pdf") returned 4 [0193.525] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0193.525] lstrlenW (lpString=".xls") returned 4 [0193.525] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0193.525] lstrlenW (lpString=".xlsx") returned 5 [0193.525] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0193.525] lstrlenW (lpString=".ppt") returned 4 [0193.525] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0193.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.525] lstrlenW (lpString=".zip") returned 4 [0193.525] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0193.525] lstrlenW (lpString=".rar") returned 4 [0193.525] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0193.525] lstrlenW (lpString=".bz2") returned 4 [0193.525] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0193.525] lstrlenW (lpString=".7z") returned 3 [0193.526] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0193.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.526] lstrlenW (lpString=".dbf") returned 4 [0193.526] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0193.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.526] lstrlenW (lpString=".1cd") returned 4 [0193.526] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0193.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\icon_16.png") returned 137 [0193.526] lstrlenW (lpString=".jpg") returned 4 [0193.526] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0193.526] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0193.526] lstrlenW (lpString="main.html") returned 9 [0193.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.526] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=92) returned 1 [0193.526] CloseHandle (hObject=0x120) returned 1 [0193.526] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 0x2020 [0193.527] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.527] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.527] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.527] GetLastError () returned 0x0 [0193.527] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x5c, lpOverlapped=0x0) returned 1 [0193.528] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x60, lpOverlapped=0x0) returned 1 [0193.529] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.529] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0193.529] SetEndOfFile (hFile=0x388) returned 1 [0193.529] CloseHandle (hObject=0x388) returned 1 [0193.529] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.529] SetEndOfFile (hFile=0x120) returned 1 [0193.530] CloseHandle (hObject=0x120) returned 1 [0193.530] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.530] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html")) returned 1 [0193.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.531] lstrlenW (lpString=".doc") returned 4 [0193.531] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0193.531] lstrlenW (lpString=".docx") returned 5 [0193.531] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0193.531] lstrlenW (lpString=".pdf") returned 4 [0193.531] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0193.531] lstrlenW (lpString=".xls") returned 4 [0193.531] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0193.531] lstrlenW (lpString=".xlsx") returned 5 [0193.531] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0193.531] lstrlenW (lpString=".ppt") returned 4 [0193.531] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0193.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.531] lstrlenW (lpString=".zip") returned 4 [0193.531] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0193.531] lstrlenW (lpString=".rar") returned 4 [0193.531] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0193.531] lstrlenW (lpString=".bz2") returned 4 [0193.531] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0193.531] lstrlenW (lpString=".7z") returned 3 [0193.531] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0193.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.531] lstrlenW (lpString=".dbf") returned 4 [0193.531] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0193.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.532] lstrlenW (lpString=".1cd") returned 4 [0193.532] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0193.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.532] lstrlenW (lpString=".jpg") returned 4 [0193.532] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0193.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.532] lstrlenW (lpString=".doc") returned 4 [0193.532] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0193.532] lstrlenW (lpString=".docx") returned 5 [0193.532] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0193.532] lstrlenW (lpString=".pdf") returned 4 [0193.532] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0193.532] lstrlenW (lpString=".xls") returned 4 [0193.532] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0193.532] lstrlenW (lpString=".xlsx") returned 5 [0193.532] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0193.532] lstrlenW (lpString=".ppt") returned 4 [0193.532] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0193.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.532] lstrlenW (lpString=".zip") returned 4 [0193.532] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0193.532] lstrlenW (lpString=".rar") returned 4 [0193.532] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0193.532] lstrlenW (lpString=".bz2") returned 4 [0193.532] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0193.532] lstrlenW (lpString=".7z") returned 3 [0193.532] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0193.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.532] lstrlenW (lpString=".dbf") returned 4 [0193.532] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0193.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.533] lstrlenW (lpString=".1cd") returned 4 [0193.533] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0193.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.html") returned 135 [0193.533] lstrlenW (lpString=".jpg") returned 4 [0193.533] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0193.533] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0193.533] lstrlenW (lpString="main.js") returned 7 [0193.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.533] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=91) returned 1 [0193.533] CloseHandle (hObject=0x120) returned 1 [0193.533] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 0x2020 [0193.533] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.534] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.534] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.534] GetLastError () returned 0x0 [0193.534] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x5b, lpOverlapped=0x0) returned 1 [0193.535] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x60, lpOverlapped=0x0) returned 1 [0193.536] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.536] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0193.536] SetEndOfFile (hFile=0x388) returned 1 [0193.536] CloseHandle (hObject=0x388) returned 1 [0193.536] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.536] SetEndOfFile (hFile=0x120) returned 1 [0193.537] CloseHandle (hObject=0x120) returned 1 [0193.537] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.537] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js")) returned 1 [0193.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.537] lstrlenW (lpString=".doc") returned 4 [0193.537] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0193.537] lstrlenW (lpString=".docx") returned 5 [0193.537] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0193.538] lstrlenW (lpString=".pdf") returned 4 [0193.538] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0193.538] lstrlenW (lpString=".xls") returned 4 [0193.538] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0193.538] lstrlenW (lpString=".xlsx") returned 5 [0193.538] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0193.538] lstrlenW (lpString=".ppt") returned 4 [0193.538] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0193.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.538] lstrlenW (lpString=".zip") returned 4 [0193.538] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0193.538] lstrlenW (lpString=".rar") returned 4 [0193.538] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0193.538] lstrlenW (lpString=".bz2") returned 4 [0193.538] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0193.538] lstrlenW (lpString=".7z") returned 3 [0193.538] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0193.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.538] lstrlenW (lpString=".dbf") returned 4 [0193.538] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0193.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.538] lstrlenW (lpString=".1cd") returned 4 [0193.538] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0193.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.538] lstrlenW (lpString=".jpg") returned 4 [0193.538] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0193.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.538] lstrlenW (lpString=".doc") returned 4 [0193.538] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0193.539] lstrlenW (lpString=".docx") returned 5 [0193.539] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0193.539] lstrlenW (lpString=".pdf") returned 4 [0193.539] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0193.539] lstrlenW (lpString=".xls") returned 4 [0193.539] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0193.539] lstrlenW (lpString=".xlsx") returned 5 [0193.539] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0193.539] lstrlenW (lpString=".ppt") returned 4 [0193.539] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0193.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.539] lstrlenW (lpString=".zip") returned 4 [0193.539] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0193.539] lstrlenW (lpString=".rar") returned 4 [0193.539] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0193.539] lstrlenW (lpString=".bz2") returned 4 [0193.539] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0193.539] lstrlenW (lpString=".7z") returned 3 [0193.539] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0193.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.539] lstrlenW (lpString=".dbf") returned 4 [0193.539] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0193.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.539] lstrlenW (lpString=".1cd") returned 4 [0193.539] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0193.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\main.js") returned 133 [0193.539] lstrlenW (lpString=".jpg") returned 4 [0193.539] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0193.540] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.540] lstrlenW (lpString="manifest.json") returned 13 [0193.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.540] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=725) returned 1 [0193.540] CloseHandle (hObject=0x120) returned 1 [0193.540] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 0x2020 [0193.540] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.540] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.540] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.541] GetLastError () returned 0x0 [0193.541] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x2d5, lpOverlapped=0x0) returned 1 [0193.619] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0193.620] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.620] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.620] SetEndOfFile (hFile=0x388) returned 1 [0193.620] CloseHandle (hObject=0x388) returned 1 [0193.620] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.620] SetEndOfFile (hFile=0x120) returned 1 [0193.621] CloseHandle (hObject=0x120) returned 1 [0193.621] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.621] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json")) returned 1 [0193.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.621] lstrlenW (lpString=".doc") returned 4 [0193.621] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.621] lstrlenW (lpString=".docx") returned 5 [0193.621] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.621] lstrlenW (lpString=".pdf") returned 4 [0193.621] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.621] lstrlenW (lpString=".xls") returned 4 [0193.621] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.621] lstrlenW (lpString=".xlsx") returned 5 [0193.621] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.621] lstrlenW (lpString=".ppt") returned 4 [0193.622] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.622] lstrlenW (lpString=".zip") returned 4 [0193.622] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.622] lstrlenW (lpString=".rar") returned 4 [0193.622] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.622] lstrlenW (lpString=".bz2") returned 4 [0193.622] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.622] lstrlenW (lpString=".7z") returned 3 [0193.622] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.622] lstrlenW (lpString=".dbf") returned 4 [0193.622] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.622] lstrlenW (lpString=".1cd") returned 4 [0193.622] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.622] lstrlenW (lpString=".jpg") returned 4 [0193.622] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.622] lstrlenW (lpString=".doc") returned 4 [0193.622] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.622] lstrlenW (lpString=".docx") returned 5 [0193.622] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.622] lstrlenW (lpString=".pdf") returned 4 [0193.622] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.622] lstrlenW (lpString=".xls") returned 4 [0193.622] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.622] lstrlenW (lpString=".xlsx") returned 5 [0193.622] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.623] lstrlenW (lpString=".ppt") returned 4 [0193.623] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.623] lstrlenW (lpString=".zip") returned 4 [0193.623] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.623] lstrlenW (lpString=".rar") returned 4 [0193.623] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.623] lstrlenW (lpString=".bz2") returned 4 [0193.623] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.623] lstrlenW (lpString=".7z") returned 3 [0193.623] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.623] lstrlenW (lpString=".dbf") returned 4 [0193.623] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.623] lstrlenW (lpString=".1cd") returned 4 [0193.623] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\manifest.json") returned 139 [0193.623] lstrlenW (lpString=".jpg") returned 4 [0193.623] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.623] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.623] lstrlenW (lpString="messages.json") returned 13 [0193.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.624] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=216) returned 1 [0193.624] CloseHandle (hObject=0x120) returned 1 [0193.624] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 0x2020 [0193.624] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.624] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.624] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.625] GetLastError () returned 0x0 [0193.625] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd8, lpOverlapped=0x0) returned 1 [0193.626] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.627] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.627] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.627] SetEndOfFile (hFile=0x388) returned 1 [0193.627] CloseHandle (hObject=0x388) returned 1 [0193.627] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.627] SetEndOfFile (hFile=0x120) returned 1 [0193.628] CloseHandle (hObject=0x120) returned 1 [0193.628] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.628] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0193.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.629] lstrlenW (lpString=".doc") returned 4 [0193.629] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.629] lstrlenW (lpString=".docx") returned 5 [0193.629] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.629] lstrlenW (lpString=".pdf") returned 4 [0193.629] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.629] lstrlenW (lpString=".xls") returned 4 [0193.629] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.629] lstrlenW (lpString=".xlsx") returned 5 [0193.629] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.629] lstrlenW (lpString=".ppt") returned 4 [0193.629] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.629] lstrlenW (lpString=".zip") returned 4 [0193.629] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.629] lstrlenW (lpString=".rar") returned 4 [0193.629] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.629] lstrlenW (lpString=".bz2") returned 4 [0193.629] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.629] lstrlenW (lpString=".7z") returned 3 [0193.629] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.629] lstrlenW (lpString=".dbf") returned 4 [0193.629] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.630] lstrlenW (lpString=".1cd") returned 4 [0193.630] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.630] lstrlenW (lpString=".jpg") returned 4 [0193.630] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.630] lstrlenW (lpString=".doc") returned 4 [0193.630] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.630] lstrlenW (lpString=".docx") returned 5 [0193.630] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.630] lstrlenW (lpString=".pdf") returned 4 [0193.630] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.630] lstrlenW (lpString=".xls") returned 4 [0193.630] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.630] lstrlenW (lpString=".xlsx") returned 5 [0193.630] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.630] lstrlenW (lpString=".ppt") returned 4 [0193.630] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.630] lstrlenW (lpString=".zip") returned 4 [0193.630] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.630] lstrlenW (lpString=".rar") returned 4 [0193.630] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.630] lstrlenW (lpString=".bz2") returned 4 [0193.630] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.630] lstrlenW (lpString=".7z") returned 3 [0193.630] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.630] lstrlenW (lpString=".dbf") returned 4 [0193.631] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.631] lstrlenW (lpString=".1cd") returned 4 [0193.631] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.631] lstrlenW (lpString=".jpg") returned 4 [0193.631] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.631] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.631] lstrlenW (lpString="messages.json") returned 13 [0193.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.631] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=217) returned 1 [0193.631] CloseHandle (hObject=0x120) returned 1 [0193.631] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 0x2020 [0193.632] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.632] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.632] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.632] GetLastError () returned 0x0 [0193.632] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd9, lpOverlapped=0x0) returned 1 [0193.633] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.634] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.634] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.635] SetEndOfFile (hFile=0x388) returned 1 [0193.635] CloseHandle (hObject=0x388) returned 1 [0193.636] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.636] SetEndOfFile (hFile=0x120) returned 1 [0193.637] CloseHandle (hObject=0x120) returned 1 [0193.638] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.638] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0193.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.638] lstrlenW (lpString=".doc") returned 4 [0193.638] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.638] lstrlenW (lpString=".docx") returned 5 [0193.638] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.638] lstrlenW (lpString=".pdf") returned 4 [0193.638] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.638] lstrlenW (lpString=".xls") returned 4 [0193.638] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.638] lstrlenW (lpString=".xlsx") returned 5 [0193.638] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.638] lstrlenW (lpString=".ppt") returned 4 [0193.638] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.638] lstrlenW (lpString=".zip") returned 4 [0193.638] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.638] lstrlenW (lpString=".rar") returned 4 [0193.638] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.638] lstrlenW (lpString=".bz2") returned 4 [0193.639] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.639] lstrlenW (lpString=".7z") returned 3 [0193.639] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.639] lstrlenW (lpString=".dbf") returned 4 [0193.639] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.639] lstrlenW (lpString=".1cd") returned 4 [0193.639] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.639] lstrlenW (lpString=".jpg") returned 4 [0193.640] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.647] lstrlenW (lpString=".doc") returned 4 [0193.647] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.649] lstrlenW (lpString=".docx") returned 5 [0193.649] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.649] lstrlenW (lpString=".pdf") returned 4 [0193.649] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.649] lstrlenW (lpString=".xls") returned 4 [0193.649] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.649] lstrlenW (lpString=".xlsx") returned 5 [0193.649] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.649] lstrlenW (lpString=".ppt") returned 4 [0193.649] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.649] lstrlenW (lpString=".zip") returned 4 [0193.649] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.649] lstrlenW (lpString=".rar") returned 4 [0193.649] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.649] lstrlenW (lpString=".bz2") returned 4 [0193.649] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.649] lstrlenW (lpString=".7z") returned 3 [0193.649] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.649] lstrlenW (lpString=".dbf") returned 4 [0193.649] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.649] lstrlenW (lpString=".1cd") returned 4 [0193.649] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.649] lstrlenW (lpString=".jpg") returned 4 [0193.649] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.650] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.650] lstrlenW (lpString="messages.json") returned 13 [0193.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.650] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=260) returned 1 [0193.650] CloseHandle (hObject=0x120) returned 1 [0193.650] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 0x2020 [0193.651] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.651] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.651] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.651] GetLastError () returned 0x0 [0193.651] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x104, lpOverlapped=0x0) returned 1 [0193.652] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0193.653] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.653] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.653] SetEndOfFile (hFile=0x388) returned 1 [0193.653] CloseHandle (hObject=0x388) returned 1 [0193.654] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.654] SetEndOfFile (hFile=0x120) returned 1 [0193.654] CloseHandle (hObject=0x120) returned 1 [0193.654] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.655] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0193.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.655] lstrlenW (lpString=".doc") returned 4 [0193.655] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.655] lstrlenW (lpString=".docx") returned 5 [0193.655] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.655] lstrlenW (lpString=".pdf") returned 4 [0193.655] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.655] lstrlenW (lpString=".xls") returned 4 [0193.655] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.655] lstrlenW (lpString=".xlsx") returned 5 [0193.655] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.655] lstrlenW (lpString=".ppt") returned 4 [0193.655] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.655] lstrlenW (lpString=".zip") returned 4 [0193.655] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.656] lstrlenW (lpString=".rar") returned 4 [0193.656] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.656] lstrlenW (lpString=".bz2") returned 4 [0193.656] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.656] lstrlenW (lpString=".7z") returned 3 [0193.656] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.656] lstrlenW (lpString=".dbf") returned 4 [0193.656] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.656] lstrlenW (lpString=".1cd") returned 4 [0193.656] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.656] lstrlenW (lpString=".jpg") returned 4 [0193.656] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.656] lstrlenW (lpString=".doc") returned 4 [0193.656] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.656] lstrlenW (lpString=".docx") returned 5 [0193.656] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.656] lstrlenW (lpString=".pdf") returned 4 [0193.656] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.656] lstrlenW (lpString=".xls") returned 4 [0193.656] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.656] lstrlenW (lpString=".xlsx") returned 5 [0193.656] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.656] lstrlenW (lpString=".ppt") returned 4 [0193.656] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.656] lstrlenW (lpString=".zip") returned 4 [0193.657] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.657] lstrlenW (lpString=".rar") returned 4 [0193.657] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.657] lstrlenW (lpString=".bz2") returned 4 [0193.657] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.657] lstrlenW (lpString=".7z") returned 3 [0193.657] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.657] lstrlenW (lpString=".dbf") returned 4 [0193.657] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.657] lstrlenW (lpString=".1cd") returned 4 [0193.657] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.657] lstrlenW (lpString=".jpg") returned 4 [0193.657] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.657] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.657] lstrlenW (lpString="messages.json") returned 13 [0193.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.658] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=208) returned 1 [0193.658] CloseHandle (hObject=0x120) returned 1 [0193.658] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0193.658] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.658] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.658] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.658] GetLastError () returned 0x0 [0193.658] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd0, lpOverlapped=0x0) returned 1 [0193.845] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.846] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.846] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.846] SetEndOfFile (hFile=0x388) returned 1 [0193.846] CloseHandle (hObject=0x388) returned 1 [0193.846] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.846] SetEndOfFile (hFile=0x120) returned 1 [0193.847] CloseHandle (hObject=0x120) returned 1 [0193.847] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.847] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0193.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.847] lstrlenW (lpString=".doc") returned 4 [0193.848] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.848] lstrlenW (lpString=".docx") returned 5 [0193.848] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.848] lstrlenW (lpString=".pdf") returned 4 [0193.848] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.848] lstrlenW (lpString=".xls") returned 4 [0193.848] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.848] lstrlenW (lpString=".xlsx") returned 5 [0193.848] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.848] lstrlenW (lpString=".ppt") returned 4 [0193.848] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.848] lstrlenW (lpString=".zip") returned 4 [0193.848] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.848] lstrlenW (lpString=".rar") returned 4 [0193.848] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.848] lstrlenW (lpString=".bz2") returned 4 [0193.848] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.848] lstrlenW (lpString=".7z") returned 3 [0193.848] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.848] lstrlenW (lpString=".dbf") returned 4 [0193.848] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.848] lstrlenW (lpString=".1cd") returned 4 [0193.848] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.848] lstrlenW (lpString=".jpg") returned 4 [0193.848] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.848] lstrlenW (lpString=".doc") returned 4 [0193.849] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.849] lstrlenW (lpString=".docx") returned 5 [0193.849] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.849] lstrlenW (lpString=".pdf") returned 4 [0193.849] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.849] lstrlenW (lpString=".xls") returned 4 [0193.849] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.849] lstrlenW (lpString=".xlsx") returned 5 [0193.849] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.849] lstrlenW (lpString=".ppt") returned 4 [0193.849] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.849] lstrlenW (lpString=".zip") returned 4 [0193.849] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.849] lstrlenW (lpString=".rar") returned 4 [0193.849] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.849] lstrlenW (lpString=".bz2") returned 4 [0193.849] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.849] lstrlenW (lpString=".7z") returned 3 [0193.849] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.849] lstrlenW (lpString=".dbf") returned 4 [0193.849] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.849] lstrlenW (lpString=".1cd") returned 4 [0193.849] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.849] lstrlenW (lpString=".jpg") returned 4 [0193.849] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.850] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.850] lstrlenW (lpString="messages.json") returned 13 [0193.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.850] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=221) returned 1 [0193.850] CloseHandle (hObject=0x120) returned 1 [0193.850] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 0x2020 [0193.850] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.850] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.850] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.851] GetLastError () returned 0x0 [0193.851] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xdd, lpOverlapped=0x0) returned 1 [0193.852] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.853] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.853] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.853] SetEndOfFile (hFile=0x388) returned 1 [0193.853] CloseHandle (hObject=0x388) returned 1 [0193.853] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.853] SetEndOfFile (hFile=0x120) returned 1 [0193.854] CloseHandle (hObject=0x120) returned 1 [0193.854] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.854] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json")) returned 1 [0193.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.854] lstrlenW (lpString=".doc") returned 4 [0193.854] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.854] lstrlenW (lpString=".docx") returned 5 [0193.854] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.854] lstrlenW (lpString=".pdf") returned 4 [0193.854] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.855] lstrlenW (lpString=".xls") returned 4 [0193.855] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.855] lstrlenW (lpString=".xlsx") returned 5 [0193.855] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.855] lstrlenW (lpString=".ppt") returned 4 [0193.855] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.855] lstrlenW (lpString=".zip") returned 4 [0193.855] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.855] lstrlenW (lpString=".rar") returned 4 [0193.855] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.855] lstrlenW (lpString=".bz2") returned 4 [0193.855] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.855] lstrlenW (lpString=".7z") returned 3 [0193.855] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.855] lstrlenW (lpString=".dbf") returned 4 [0193.855] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.855] lstrlenW (lpString=".1cd") returned 4 [0193.855] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.855] lstrlenW (lpString=".jpg") returned 4 [0193.855] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.855] lstrlenW (lpString=".doc") returned 4 [0193.855] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.855] lstrlenW (lpString=".docx") returned 5 [0193.855] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.856] lstrlenW (lpString=".pdf") returned 4 [0193.856] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.856] lstrlenW (lpString=".xls") returned 4 [0193.856] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.856] lstrlenW (lpString=".xlsx") returned 5 [0193.856] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.856] lstrlenW (lpString=".ppt") returned 4 [0193.856] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.856] lstrlenW (lpString=".zip") returned 4 [0193.856] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.856] lstrlenW (lpString=".rar") returned 4 [0193.856] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.856] lstrlenW (lpString=".bz2") returned 4 [0193.856] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.856] lstrlenW (lpString=".7z") returned 3 [0193.856] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.856] lstrlenW (lpString=".dbf") returned 4 [0193.856] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.856] lstrlenW (lpString=".1cd") returned 4 [0193.856] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sk\\messages.json") returned 151 [0193.856] lstrlenW (lpString=".jpg") returned 4 [0193.856] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.856] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.856] lstrlenW (lpString="messages.json") returned 13 [0193.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.857] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=218) returned 1 [0193.858] CloseHandle (hObject=0x120) returned 1 [0193.858] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 0x2020 [0193.858] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.858] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.858] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.859] GetLastError () returned 0x0 [0193.859] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xda, lpOverlapped=0x0) returned 1 [0193.860] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.860] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.860] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.861] SetEndOfFile (hFile=0x388) returned 1 [0193.861] CloseHandle (hObject=0x388) returned 1 [0193.861] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.861] SetEndOfFile (hFile=0x120) returned 1 [0193.861] CloseHandle (hObject=0x120) returned 1 [0193.862] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.862] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json")) returned 1 [0193.862] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.862] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.862] lstrlenW (lpString=".doc") returned 4 [0193.862] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.862] lstrlenW (lpString=".docx") returned 5 [0193.862] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.862] lstrlenW (lpString=".pdf") returned 4 [0193.862] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.862] lstrlenW (lpString=".xls") returned 4 [0193.862] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.862] lstrlenW (lpString=".xlsx") returned 5 [0193.862] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.862] lstrlenW (lpString=".ppt") returned 4 [0193.862] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.862] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.862] lstrlenW (lpString=".zip") returned 4 [0193.862] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.862] lstrlenW (lpString=".rar") returned 4 [0193.862] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.862] lstrlenW (lpString=".bz2") returned 4 [0193.862] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.862] lstrlenW (lpString=".7z") returned 3 [0193.863] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.863] lstrlenW (lpString=".dbf") returned 4 [0193.863] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.863] lstrlenW (lpString=".1cd") returned 4 [0193.863] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.863] lstrlenW (lpString=".jpg") returned 4 [0193.863] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.863] lstrlenW (lpString=".doc") returned 4 [0193.863] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.863] lstrlenW (lpString=".docx") returned 5 [0193.863] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.863] lstrlenW (lpString=".pdf") returned 4 [0193.863] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.863] lstrlenW (lpString=".xls") returned 4 [0193.863] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.863] lstrlenW (lpString=".xlsx") returned 5 [0193.863] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.863] lstrlenW (lpString=".ppt") returned 4 [0193.863] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.863] lstrlenW (lpString=".zip") returned 4 [0193.863] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.863] lstrlenW (lpString=".rar") returned 4 [0193.863] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.863] lstrlenW (lpString=".bz2") returned 4 [0193.863] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.864] lstrlenW (lpString=".7z") returned 3 [0193.864] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.864] lstrlenW (lpString=".dbf") returned 4 [0193.864] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.864] lstrlenW (lpString=".1cd") returned 4 [0193.864] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sl\\messages.json") returned 151 [0193.864] lstrlenW (lpString=".jpg") returned 4 [0193.864] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.864] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.864] lstrlenW (lpString="messages.json") returned 13 [0193.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.864] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=248) returned 1 [0193.864] CloseHandle (hObject=0x120) returned 1 [0193.865] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 0x2020 [0193.865] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.865] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.865] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.865] GetLastError () returned 0x0 [0193.865] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xf8, lpOverlapped=0x0) returned 1 [0193.866] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x100, lpOverlapped=0x0) returned 1 [0193.867] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.867] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.867] SetEndOfFile (hFile=0x388) returned 1 [0193.867] CloseHandle (hObject=0x388) returned 1 [0193.867] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.868] SetEndOfFile (hFile=0x120) returned 1 [0193.868] CloseHandle (hObject=0x120) returned 1 [0193.868] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.868] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0193.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.869] lstrlenW (lpString=".doc") returned 4 [0193.869] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.869] lstrlenW (lpString=".docx") returned 5 [0193.869] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.869] lstrlenW (lpString=".pdf") returned 4 [0193.869] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.869] lstrlenW (lpString=".xls") returned 4 [0193.869] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.869] lstrlenW (lpString=".xlsx") returned 5 [0193.869] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.869] lstrlenW (lpString=".ppt") returned 4 [0193.869] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.869] lstrlenW (lpString=".zip") returned 4 [0193.869] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.869] lstrlenW (lpString=".rar") returned 4 [0193.869] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.869] lstrlenW (lpString=".bz2") returned 4 [0193.869] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.869] lstrlenW (lpString=".7z") returned 3 [0193.869] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.869] lstrlenW (lpString=".dbf") returned 4 [0193.869] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.870] lstrlenW (lpString=".1cd") returned 4 [0193.870] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.870] lstrlenW (lpString=".jpg") returned 4 [0193.870] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.870] lstrlenW (lpString=".doc") returned 4 [0193.870] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.870] lstrlenW (lpString=".docx") returned 5 [0193.870] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.870] lstrlenW (lpString=".pdf") returned 4 [0193.870] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.870] lstrlenW (lpString=".xls") returned 4 [0193.870] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.870] lstrlenW (lpString=".xlsx") returned 5 [0193.870] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.870] lstrlenW (lpString=".ppt") returned 4 [0193.870] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.870] lstrlenW (lpString=".zip") returned 4 [0193.870] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.870] lstrlenW (lpString=".rar") returned 4 [0193.870] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.870] lstrlenW (lpString=".bz2") returned 4 [0193.870] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.870] lstrlenW (lpString=".7z") returned 3 [0193.870] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.870] lstrlenW (lpString=".dbf") returned 4 [0193.870] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.871] lstrlenW (lpString=".1cd") returned 4 [0193.871] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.871] lstrlenW (lpString=".jpg") returned 4 [0193.871] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.871] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.871] lstrlenW (lpString="messages.json") returned 13 [0193.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.871] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=214) returned 1 [0193.871] CloseHandle (hObject=0x120) returned 1 [0193.871] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 0x2020 [0193.871] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.872] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.872] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.872] GetLastError () returned 0x0 [0193.872] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd6, lpOverlapped=0x0) returned 1 [0193.873] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.874] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.874] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.874] SetEndOfFile (hFile=0x388) returned 1 [0193.874] CloseHandle (hObject=0x388) returned 1 [0193.874] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.874] SetEndOfFile (hFile=0x120) returned 1 [0193.875] CloseHandle (hObject=0x120) returned 1 [0193.875] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.875] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0193.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.876] lstrlenW (lpString=".doc") returned 4 [0193.876] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.876] lstrlenW (lpString=".docx") returned 5 [0193.876] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.876] lstrlenW (lpString=".pdf") returned 4 [0193.876] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.876] lstrlenW (lpString=".xls") returned 4 [0193.876] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.876] lstrlenW (lpString=".xlsx") returned 5 [0193.876] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.876] lstrlenW (lpString=".ppt") returned 4 [0193.876] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.876] lstrlenW (lpString=".zip") returned 4 [0193.876] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.876] lstrlenW (lpString=".rar") returned 4 [0193.876] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.876] lstrlenW (lpString=".bz2") returned 4 [0193.876] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.876] lstrlenW (lpString=".7z") returned 3 [0193.876] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.876] lstrlenW (lpString=".dbf") returned 4 [0193.876] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.876] lstrlenW (lpString=".1cd") returned 4 [0193.876] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.876] lstrlenW (lpString=".jpg") returned 4 [0193.876] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.877] lstrlenW (lpString=".doc") returned 4 [0193.877] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.877] lstrlenW (lpString=".docx") returned 5 [0193.877] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.877] lstrlenW (lpString=".pdf") returned 4 [0193.877] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.877] lstrlenW (lpString=".xls") returned 4 [0193.877] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.877] lstrlenW (lpString=".xlsx") returned 5 [0193.877] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.877] lstrlenW (lpString=".ppt") returned 4 [0193.877] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.877] lstrlenW (lpString=".zip") returned 4 [0193.877] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.877] lstrlenW (lpString=".rar") returned 4 [0193.877] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.877] lstrlenW (lpString=".bz2") returned 4 [0193.877] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.877] lstrlenW (lpString=".7z") returned 3 [0193.877] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.877] lstrlenW (lpString=".dbf") returned 4 [0193.877] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.877] lstrlenW (lpString=".1cd") returned 4 [0193.877] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.877] lstrlenW (lpString=".jpg") returned 4 [0193.878] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.878] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.878] lstrlenW (lpString="messages.json") returned 13 [0193.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.878] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=254) returned 1 [0193.878] CloseHandle (hObject=0x120) returned 1 [0193.878] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 0x2020 [0193.878] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.878] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.878] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.879] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.879] GetLastError () returned 0x0 [0193.879] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xfe, lpOverlapped=0x0) returned 1 [0193.965] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x100, lpOverlapped=0x0) returned 1 [0193.986] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.986] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.986] SetEndOfFile (hFile=0x388) returned 1 [0193.986] CloseHandle (hObject=0x388) returned 1 [0193.986] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.986] SetEndOfFile (hFile=0x120) returned 1 [0193.987] CloseHandle (hObject=0x120) returned 1 [0193.987] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.987] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0193.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.988] lstrlenW (lpString=".doc") returned 4 [0193.988] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.988] lstrlenW (lpString=".docx") returned 5 [0193.988] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.988] lstrlenW (lpString=".pdf") returned 4 [0193.988] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.988] lstrlenW (lpString=".xls") returned 4 [0193.988] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.988] lstrlenW (lpString=".xlsx") returned 5 [0193.988] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.988] lstrlenW (lpString=".ppt") returned 4 [0193.988] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.988] lstrlenW (lpString=".zip") returned 4 [0193.988] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.988] lstrlenW (lpString=".rar") returned 4 [0193.988] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.988] lstrlenW (lpString=".bz2") returned 4 [0193.988] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.988] lstrlenW (lpString=".7z") returned 3 [0193.988] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.988] lstrlenW (lpString=".dbf") returned 4 [0193.988] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.988] lstrlenW (lpString=".1cd") returned 4 [0193.988] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.988] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.988] lstrlenW (lpString=".jpg") returned 4 [0193.989] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.989] lstrlenW (lpString=".doc") returned 4 [0193.989] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.989] lstrlenW (lpString=".docx") returned 5 [0193.989] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.989] lstrlenW (lpString=".pdf") returned 4 [0193.989] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.989] lstrlenW (lpString=".xls") returned 4 [0193.989] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.989] lstrlenW (lpString=".xlsx") returned 5 [0193.989] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.989] lstrlenW (lpString=".ppt") returned 4 [0193.989] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.989] lstrlenW (lpString=".zip") returned 4 [0193.989] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.989] lstrlenW (lpString=".rar") returned 4 [0193.989] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.989] lstrlenW (lpString=".bz2") returned 4 [0193.989] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.989] lstrlenW (lpString=".7z") returned 3 [0193.989] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.989] lstrlenW (lpString=".dbf") returned 4 [0193.989] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.989] lstrlenW (lpString=".1cd") returned 4 [0193.989] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.989] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.989] lstrlenW (lpString=".jpg") returned 4 [0193.990] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.990] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0193.990] lstrlenW (lpString="128.png") returned 7 [0193.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.990] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=6707) returned 1 [0193.990] CloseHandle (hObject=0x120) returned 1 [0193.990] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 0x2020 [0193.990] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.990] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.991] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.991] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.991] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.991] GetLastError () returned 0x0 [0193.991] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1a33, lpOverlapped=0x0) returned 1 [0193.993] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1a40, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1a40, lpOverlapped=0x0) returned 1 [0193.994] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.994] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0193.994] SetEndOfFile (hFile=0x388) returned 1 [0193.994] CloseHandle (hObject=0x388) returned 1 [0193.994] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.994] SetEndOfFile (hFile=0x120) returned 1 [0193.995] CloseHandle (hObject=0x120) returned 1 [0193.995] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.995] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png")) returned 1 [0193.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.995] lstrlenW (lpString=".doc") returned 4 [0193.995] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0193.995] lstrlenW (lpString=".docx") returned 5 [0193.995] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0193.995] lstrlenW (lpString=".pdf") returned 4 [0193.995] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0193.995] lstrlenW (lpString=".xls") returned 4 [0193.995] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0193.995] lstrlenW (lpString=".xlsx") returned 5 [0193.996] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0193.996] lstrlenW (lpString=".ppt") returned 4 [0193.996] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0193.996] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.996] lstrlenW (lpString=".zip") returned 4 [0193.996] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0193.996] lstrlenW (lpString=".rar") returned 4 [0193.996] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0193.996] lstrlenW (lpString=".bz2") returned 4 [0193.996] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0193.996] lstrlenW (lpString=".7z") returned 3 [0193.996] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0193.996] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.996] lstrlenW (lpString=".dbf") returned 4 [0193.996] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0193.996] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.996] lstrlenW (lpString=".1cd") returned 4 [0193.996] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0193.996] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.996] lstrlenW (lpString=".jpg") returned 4 [0193.996] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0193.996] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.996] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.996] lstrlenW (lpString=".doc") returned 4 [0193.996] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0193.996] lstrlenW (lpString=".docx") returned 5 [0193.996] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0193.996] lstrlenW (lpString=".pdf") returned 4 [0193.996] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0193.996] lstrlenW (lpString=".xls") returned 4 [0193.996] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0193.996] lstrlenW (lpString=".xlsx") returned 5 [0193.997] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0193.997] lstrlenW (lpString=".ppt") returned 4 [0193.997] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0193.997] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.997] lstrlenW (lpString=".zip") returned 4 [0193.997] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0193.997] lstrlenW (lpString=".rar") returned 4 [0193.997] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0193.997] lstrlenW (lpString=".bz2") returned 4 [0193.997] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0193.997] lstrlenW (lpString=".7z") returned 3 [0193.997] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0193.997] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.997] lstrlenW (lpString=".dbf") returned 4 [0193.997] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0193.997] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.997] lstrlenW (lpString=".1cd") returned 4 [0193.997] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0193.997] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\128.png") returned 134 [0193.997] lstrlenW (lpString=".jpg") returned 4 [0193.997] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0193.997] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.997] lstrlenW (lpString="manifest.json") returned 13 [0193.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.998] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1004) returned 1 [0193.998] CloseHandle (hObject=0x120) returned 1 [0193.998] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 0x2020 [0193.998] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0193.998] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.998] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.998] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0193.999] GetLastError () returned 0x0 [0193.999] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x3ec, lpOverlapped=0x0) returned 1 [0194.000] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3f0, lpOverlapped=0x0) returned 1 [0194.001] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.001] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.001] SetEndOfFile (hFile=0x388) returned 1 [0194.001] CloseHandle (hObject=0x388) returned 1 [0194.002] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.002] SetEndOfFile (hFile=0x120) returned 1 [0194.002] CloseHandle (hObject=0x120) returned 1 [0194.002] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.003] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json")) returned 1 [0194.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.003] lstrlenW (lpString=".doc") returned 4 [0194.003] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.003] lstrlenW (lpString=".docx") returned 5 [0194.003] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.003] lstrlenW (lpString=".pdf") returned 4 [0194.003] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.003] lstrlenW (lpString=".xls") returned 4 [0194.003] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.003] lstrlenW (lpString=".xlsx") returned 5 [0194.003] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.003] lstrlenW (lpString=".ppt") returned 4 [0194.003] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.003] lstrlenW (lpString=".zip") returned 4 [0194.003] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.003] lstrlenW (lpString=".rar") returned 4 [0194.003] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.003] lstrlenW (lpString=".bz2") returned 4 [0194.003] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.003] lstrlenW (lpString=".7z") returned 3 [0194.003] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.004] lstrlenW (lpString=".dbf") returned 4 [0194.004] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.004] lstrlenW (lpString=".1cd") returned 4 [0194.004] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.004] lstrlenW (lpString=".jpg") returned 4 [0194.004] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.004] lstrlenW (lpString=".doc") returned 4 [0194.004] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.004] lstrlenW (lpString=".docx") returned 5 [0194.004] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.004] lstrlenW (lpString=".pdf") returned 4 [0194.004] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.004] lstrlenW (lpString=".xls") returned 4 [0194.004] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.004] lstrlenW (lpString=".xlsx") returned 5 [0194.004] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.004] lstrlenW (lpString=".ppt") returned 4 [0194.004] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.004] lstrlenW (lpString=".zip") returned 4 [0194.004] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.004] lstrlenW (lpString=".rar") returned 4 [0194.004] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.004] lstrlenW (lpString=".bz2") returned 4 [0194.004] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.004] lstrlenW (lpString=".7z") returned 3 [0194.005] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.005] lstrlenW (lpString=".dbf") returned 4 [0194.005] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.005] lstrlenW (lpString=".1cd") returned 4 [0194.005] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\manifest.json") returned 140 [0194.005] lstrlenW (lpString=".jpg") returned 4 [0194.005] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.005] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.005] lstrlenW (lpString="messages.json") returned 13 [0194.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.006] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=278) returned 1 [0194.006] CloseHandle (hObject=0x120) returned 1 [0194.006] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 0x2020 [0194.006] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.006] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.007] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.007] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.007] GetLastError () returned 0x0 [0194.007] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x116, lpOverlapped=0x0) returned 1 [0194.008] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x120, lpOverlapped=0x0) returned 1 [0194.009] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.009] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.009] SetEndOfFile (hFile=0x388) returned 1 [0194.009] CloseHandle (hObject=0x388) returned 1 [0194.009] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.009] SetEndOfFile (hFile=0x120) returned 1 [0194.010] CloseHandle (hObject=0x120) returned 1 [0194.010] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.010] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json")) returned 1 [0194.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.011] lstrlenW (lpString=".doc") returned 4 [0194.011] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.011] lstrlenW (lpString=".docx") returned 5 [0194.011] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.011] lstrlenW (lpString=".pdf") returned 4 [0194.011] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.011] lstrlenW (lpString=".xls") returned 4 [0194.011] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.011] lstrlenW (lpString=".xlsx") returned 5 [0194.011] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.011] lstrlenW (lpString=".ppt") returned 4 [0194.011] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.011] lstrlenW (lpString=".zip") returned 4 [0194.011] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.011] lstrlenW (lpString=".rar") returned 4 [0194.011] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.011] lstrlenW (lpString=".bz2") returned 4 [0194.011] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.011] lstrlenW (lpString=".7z") returned 3 [0194.011] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.011] lstrlenW (lpString=".dbf") returned 4 [0194.011] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.011] lstrlenW (lpString=".1cd") returned 4 [0194.011] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.012] lstrlenW (lpString=".jpg") returned 4 [0194.012] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.012] lstrlenW (lpString=".doc") returned 4 [0194.012] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.012] lstrlenW (lpString=".docx") returned 5 [0194.012] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.012] lstrlenW (lpString=".pdf") returned 4 [0194.012] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.012] lstrlenW (lpString=".xls") returned 4 [0194.012] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.012] lstrlenW (lpString=".xlsx") returned 5 [0194.012] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.012] lstrlenW (lpString=".ppt") returned 4 [0194.012] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.012] lstrlenW (lpString=".zip") returned 4 [0194.012] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.012] lstrlenW (lpString=".rar") returned 4 [0194.012] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.012] lstrlenW (lpString=".bz2") returned 4 [0194.012] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.012] lstrlenW (lpString=".7z") returned 3 [0194.012] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.012] lstrlenW (lpString=".dbf") returned 4 [0194.012] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.012] lstrlenW (lpString=".1cd") returned 4 [0194.012] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ar\\messages.json") returned 152 [0194.013] lstrlenW (lpString=".jpg") returned 4 [0194.013] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.013] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.013] lstrlenW (lpString="messages.json") returned 13 [0194.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.014] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=319) returned 1 [0194.014] CloseHandle (hObject=0x120) returned 1 [0194.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 0x2020 [0194.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.015] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.015] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.015] GetLastError () returned 0x0 [0194.015] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x13f, lpOverlapped=0x0) returned 1 [0194.016] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x140, lpOverlapped=0x0) returned 1 [0194.017] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.017] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.017] SetEndOfFile (hFile=0x388) returned 1 [0194.017] CloseHandle (hObject=0x388) returned 1 [0194.017] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.018] SetEndOfFile (hFile=0x120) returned 1 [0194.018] CloseHandle (hObject=0x120) returned 1 [0194.018] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.019] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json")) returned 1 [0194.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.019] lstrlenW (lpString=".doc") returned 4 [0194.019] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.019] lstrlenW (lpString=".docx") returned 5 [0194.019] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.019] lstrlenW (lpString=".pdf") returned 4 [0194.019] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.019] lstrlenW (lpString=".xls") returned 4 [0194.019] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.019] lstrlenW (lpString=".xlsx") returned 5 [0194.019] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.019] lstrlenW (lpString=".ppt") returned 4 [0194.019] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.019] lstrlenW (lpString=".zip") returned 4 [0194.019] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.019] lstrlenW (lpString=".rar") returned 4 [0194.019] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.019] lstrlenW (lpString=".bz2") returned 4 [0194.019] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.019] lstrlenW (lpString=".7z") returned 3 [0194.019] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.019] lstrlenW (lpString=".dbf") returned 4 [0194.020] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.020] lstrlenW (lpString=".1cd") returned 4 [0194.020] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.020] lstrlenW (lpString=".jpg") returned 4 [0194.020] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.020] lstrlenW (lpString=".doc") returned 4 [0194.020] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.020] lstrlenW (lpString=".docx") returned 5 [0194.020] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.020] lstrlenW (lpString=".pdf") returned 4 [0194.020] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.020] lstrlenW (lpString=".xls") returned 4 [0194.020] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.020] lstrlenW (lpString=".xlsx") returned 5 [0194.020] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.020] lstrlenW (lpString=".ppt") returned 4 [0194.020] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.020] lstrlenW (lpString=".zip") returned 4 [0194.020] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.020] lstrlenW (lpString=".rar") returned 4 [0194.020] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.020] lstrlenW (lpString=".bz2") returned 4 [0194.020] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.020] lstrlenW (lpString=".7z") returned 3 [0194.020] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.021] lstrlenW (lpString=".dbf") returned 4 [0194.021] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.021] lstrlenW (lpString=".1cd") returned 4 [0194.021] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\bg\\messages.json") returned 152 [0194.021] lstrlenW (lpString=".jpg") returned 4 [0194.021] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.021] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.021] lstrlenW (lpString="messages.json") returned 13 [0194.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.021] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=265) returned 1 [0194.021] CloseHandle (hObject=0x120) returned 1 [0194.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 0x2020 [0194.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.022] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.022] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.022] GetLastError () returned 0x0 [0194.022] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x109, lpOverlapped=0x0) returned 1 [0194.023] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.024] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.024] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.024] SetEndOfFile (hFile=0x388) returned 1 [0194.024] CloseHandle (hObject=0x388) returned 1 [0194.024] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.024] SetEndOfFile (hFile=0x120) returned 1 [0194.025] CloseHandle (hObject=0x120) returned 1 [0194.025] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.025] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json")) returned 1 [0194.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.026] lstrlenW (lpString=".doc") returned 4 [0194.026] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.026] lstrlenW (lpString=".docx") returned 5 [0194.026] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.026] lstrlenW (lpString=".pdf") returned 4 [0194.026] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.026] lstrlenW (lpString=".xls") returned 4 [0194.026] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.026] lstrlenW (lpString=".xlsx") returned 5 [0194.026] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.026] lstrlenW (lpString=".ppt") returned 4 [0194.026] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.026] lstrlenW (lpString=".zip") returned 4 [0194.026] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.026] lstrlenW (lpString=".rar") returned 4 [0194.026] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.026] lstrlenW (lpString=".bz2") returned 4 [0194.026] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.026] lstrlenW (lpString=".7z") returned 3 [0194.026] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.026] lstrlenW (lpString=".dbf") returned 4 [0194.026] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.027] lstrlenW (lpString=".1cd") returned 4 [0194.027] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.027] lstrlenW (lpString=".jpg") returned 4 [0194.027] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.027] lstrlenW (lpString=".doc") returned 4 [0194.027] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.027] lstrlenW (lpString=".docx") returned 5 [0194.027] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.027] lstrlenW (lpString=".pdf") returned 4 [0194.027] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.027] lstrlenW (lpString=".xls") returned 4 [0194.027] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.027] lstrlenW (lpString=".xlsx") returned 5 [0194.027] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.027] lstrlenW (lpString=".ppt") returned 4 [0194.027] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.027] lstrlenW (lpString=".zip") returned 4 [0194.027] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.027] lstrlenW (lpString=".rar") returned 4 [0194.027] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.027] lstrlenW (lpString=".bz2") returned 4 [0194.027] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.027] lstrlenW (lpString=".7z") returned 3 [0194.027] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.027] lstrlenW (lpString=".dbf") returned 4 [0194.028] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.028] lstrlenW (lpString=".1cd") returned 4 [0194.028] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ca\\messages.json") returned 152 [0194.028] lstrlenW (lpString=".jpg") returned 4 [0194.028] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.028] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.028] lstrlenW (lpString="messages.json") returned 13 [0194.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.028] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=259) returned 1 [0194.028] CloseHandle (hObject=0x120) returned 1 [0194.028] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 0x2020 [0194.029] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.029] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.029] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.030] GetLastError () returned 0x0 [0194.030] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x103, lpOverlapped=0x0) returned 1 [0194.031] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.032] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.032] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.032] SetEndOfFile (hFile=0x388) returned 1 [0194.032] CloseHandle (hObject=0x388) returned 1 [0194.032] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.032] SetEndOfFile (hFile=0x120) returned 1 [0194.033] CloseHandle (hObject=0x120) returned 1 [0194.033] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.033] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json")) returned 1 [0194.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.033] lstrlenW (lpString=".doc") returned 4 [0194.033] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.033] lstrlenW (lpString=".docx") returned 5 [0194.033] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.033] lstrlenW (lpString=".pdf") returned 4 [0194.033] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.033] lstrlenW (lpString=".xls") returned 4 [0194.033] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.033] lstrlenW (lpString=".xlsx") returned 5 [0194.033] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.033] lstrlenW (lpString=".ppt") returned 4 [0194.033] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.034] lstrlenW (lpString=".zip") returned 4 [0194.034] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.034] lstrlenW (lpString=".rar") returned 4 [0194.034] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.034] lstrlenW (lpString=".bz2") returned 4 [0194.034] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.034] lstrlenW (lpString=".7z") returned 3 [0194.034] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.034] lstrlenW (lpString=".dbf") returned 4 [0194.034] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.034] lstrlenW (lpString=".1cd") returned 4 [0194.034] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.034] lstrlenW (lpString=".jpg") returned 4 [0194.034] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.034] lstrlenW (lpString=".doc") returned 4 [0194.034] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.034] lstrlenW (lpString=".docx") returned 5 [0194.034] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.034] lstrlenW (lpString=".pdf") returned 4 [0194.034] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.034] lstrlenW (lpString=".xls") returned 4 [0194.034] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.034] lstrlenW (lpString=".xlsx") returned 5 [0194.034] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.034] lstrlenW (lpString=".ppt") returned 4 [0194.034] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.035] lstrlenW (lpString=".zip") returned 4 [0194.035] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.035] lstrlenW (lpString=".rar") returned 4 [0194.035] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.035] lstrlenW (lpString=".bz2") returned 4 [0194.035] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.035] lstrlenW (lpString=".7z") returned 3 [0194.035] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.035] lstrlenW (lpString=".dbf") returned 4 [0194.035] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.035] lstrlenW (lpString=".1cd") returned 4 [0194.035] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\cs\\messages.json") returned 152 [0194.035] lstrlenW (lpString=".jpg") returned 4 [0194.035] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.035] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.035] lstrlenW (lpString="messages.json") returned 13 [0194.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.036] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=243) returned 1 [0194.036] CloseHandle (hObject=0x120) returned 1 [0194.036] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 0x2020 [0194.036] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.036] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.036] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.036] GetLastError () returned 0x0 [0194.037] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xf3, lpOverlapped=0x0) returned 1 [0194.037] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.038] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.038] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.038] SetEndOfFile (hFile=0x388) returned 1 [0194.038] CloseHandle (hObject=0x388) returned 1 [0194.039] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.039] SetEndOfFile (hFile=0x120) returned 1 [0194.039] CloseHandle (hObject=0x120) returned 1 [0194.039] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.040] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json")) returned 1 [0194.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.040] lstrlenW (lpString=".doc") returned 4 [0194.040] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.040] lstrlenW (lpString=".docx") returned 5 [0194.040] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.040] lstrlenW (lpString=".pdf") returned 4 [0194.040] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.040] lstrlenW (lpString=".xls") returned 4 [0194.040] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.040] lstrlenW (lpString=".xlsx") returned 5 [0194.040] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.040] lstrlenW (lpString=".ppt") returned 4 [0194.040] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.040] lstrlenW (lpString=".zip") returned 4 [0194.040] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.040] lstrlenW (lpString=".rar") returned 4 [0194.040] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.040] lstrlenW (lpString=".bz2") returned 4 [0194.040] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.040] lstrlenW (lpString=".7z") returned 3 [0194.040] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.041] lstrlenW (lpString=".dbf") returned 4 [0194.041] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.041] lstrlenW (lpString=".1cd") returned 4 [0194.041] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.041] lstrlenW (lpString=".jpg") returned 4 [0194.041] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.041] lstrlenW (lpString=".doc") returned 4 [0194.041] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.041] lstrlenW (lpString=".docx") returned 5 [0194.041] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.041] lstrlenW (lpString=".pdf") returned 4 [0194.041] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.041] lstrlenW (lpString=".xls") returned 4 [0194.041] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.041] lstrlenW (lpString=".xlsx") returned 5 [0194.041] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.041] lstrlenW (lpString=".ppt") returned 4 [0194.041] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.041] lstrlenW (lpString=".zip") returned 4 [0194.041] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.041] lstrlenW (lpString=".rar") returned 4 [0194.041] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.041] lstrlenW (lpString=".bz2") returned 4 [0194.041] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.041] lstrlenW (lpString=".7z") returned 3 [0194.041] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.042] lstrlenW (lpString=".dbf") returned 4 [0194.042] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.042] lstrlenW (lpString=".1cd") returned 4 [0194.042] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\da\\messages.json") returned 152 [0194.042] lstrlenW (lpString=".jpg") returned 4 [0194.042] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.042] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.042] lstrlenW (lpString="messages.json") returned 13 [0194.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.042] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=256) returned 1 [0194.042] CloseHandle (hObject=0x120) returned 1 [0194.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 0x2020 [0194.043] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.043] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.043] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.043] GetLastError () returned 0x0 [0194.043] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x100, lpOverlapped=0x0) returned 1 [0194.044] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.045] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.045] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.045] SetEndOfFile (hFile=0x388) returned 1 [0194.045] CloseHandle (hObject=0x388) returned 1 [0194.045] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.046] SetEndOfFile (hFile=0x120) returned 1 [0194.046] CloseHandle (hObject=0x120) returned 1 [0194.046] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.046] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json")) returned 1 [0194.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.047] lstrlenW (lpString=".doc") returned 4 [0194.047] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.047] lstrlenW (lpString=".docx") returned 5 [0194.047] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.047] lstrlenW (lpString=".pdf") returned 4 [0194.047] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.047] lstrlenW (lpString=".xls") returned 4 [0194.047] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.047] lstrlenW (lpString=".xlsx") returned 5 [0194.047] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.047] lstrlenW (lpString=".ppt") returned 4 [0194.047] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.047] lstrlenW (lpString=".zip") returned 4 [0194.047] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.047] lstrlenW (lpString=".rar") returned 4 [0194.047] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.047] lstrlenW (lpString=".bz2") returned 4 [0194.047] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.047] lstrlenW (lpString=".7z") returned 3 [0194.047] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.047] lstrlenW (lpString=".dbf") returned 4 [0194.047] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.047] lstrlenW (lpString=".1cd") returned 4 [0194.047] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.048] lstrlenW (lpString=".jpg") returned 4 [0194.048] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.048] lstrlenW (lpString=".doc") returned 4 [0194.048] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.048] lstrlenW (lpString=".docx") returned 5 [0194.048] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.048] lstrlenW (lpString=".pdf") returned 4 [0194.048] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.048] lstrlenW (lpString=".xls") returned 4 [0194.048] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.048] lstrlenW (lpString=".xlsx") returned 5 [0194.048] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.048] lstrlenW (lpString=".ppt") returned 4 [0194.048] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.048] lstrlenW (lpString=".zip") returned 4 [0194.048] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.048] lstrlenW (lpString=".rar") returned 4 [0194.048] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.048] lstrlenW (lpString=".bz2") returned 4 [0194.048] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.048] lstrlenW (lpString=".7z") returned 3 [0194.048] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.048] lstrlenW (lpString=".dbf") returned 4 [0194.048] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.048] lstrlenW (lpString=".1cd") returned 4 [0194.049] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\de\\messages.json") returned 152 [0194.049] lstrlenW (lpString=".jpg") returned 4 [0194.049] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.049] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.049] lstrlenW (lpString="messages.json") returned 13 [0194.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.049] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=329) returned 1 [0194.049] CloseHandle (hObject=0x120) returned 1 [0194.049] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 0x2020 [0194.049] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.050] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.050] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.050] GetLastError () returned 0x0 [0194.050] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x149, lpOverlapped=0x0) returned 1 [0194.051] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x150, lpOverlapped=0x0) returned 1 [0194.052] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.052] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.052] SetEndOfFile (hFile=0x388) returned 1 [0194.052] CloseHandle (hObject=0x388) returned 1 [0194.052] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.052] SetEndOfFile (hFile=0x120) returned 1 [0194.053] CloseHandle (hObject=0x120) returned 1 [0194.053] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.053] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json")) returned 1 [0194.053] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.053] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.053] lstrlenW (lpString=".doc") returned 4 [0194.053] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.054] lstrlenW (lpString=".docx") returned 5 [0194.054] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.054] lstrlenW (lpString=".pdf") returned 4 [0194.054] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.054] lstrlenW (lpString=".xls") returned 4 [0194.054] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.054] lstrlenW (lpString=".xlsx") returned 5 [0194.054] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.054] lstrlenW (lpString=".ppt") returned 4 [0194.054] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.054] lstrlenW (lpString=".zip") returned 4 [0194.054] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.054] lstrlenW (lpString=".rar") returned 4 [0194.054] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.054] lstrlenW (lpString=".bz2") returned 4 [0194.054] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.054] lstrlenW (lpString=".7z") returned 3 [0194.054] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.054] lstrlenW (lpString=".dbf") returned 4 [0194.054] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.054] lstrlenW (lpString=".1cd") returned 4 [0194.054] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.054] lstrlenW (lpString=".jpg") returned 4 [0194.054] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.054] lstrlenW (lpString=".doc") returned 4 [0194.055] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.055] lstrlenW (lpString=".docx") returned 5 [0194.055] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.055] lstrlenW (lpString=".pdf") returned 4 [0194.055] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.055] lstrlenW (lpString=".xls") returned 4 [0194.055] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.055] lstrlenW (lpString=".xlsx") returned 5 [0194.055] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.055] lstrlenW (lpString=".ppt") returned 4 [0194.055] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.055] lstrlenW (lpString=".zip") returned 4 [0194.055] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.055] lstrlenW (lpString=".rar") returned 4 [0194.055] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.055] lstrlenW (lpString=".bz2") returned 4 [0194.055] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.055] lstrlenW (lpString=".7z") returned 3 [0194.055] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.055] lstrlenW (lpString=".dbf") returned 4 [0194.055] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.055] lstrlenW (lpString=".1cd") returned 4 [0194.055] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\el\\messages.json") returned 152 [0194.055] lstrlenW (lpString=".jpg") returned 4 [0194.055] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.056] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.056] lstrlenW (lpString="messages.json") returned 13 [0194.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.056] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=249) returned 1 [0194.056] CloseHandle (hObject=0x120) returned 1 [0194.056] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0194.056] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.056] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.056] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.057] GetLastError () returned 0x0 [0194.057] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xf9, lpOverlapped=0x0) returned 1 [0194.058] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.059] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.059] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.059] SetEndOfFile (hFile=0x388) returned 1 [0194.059] CloseHandle (hObject=0x388) returned 1 [0194.059] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.059] SetEndOfFile (hFile=0x120) returned 1 [0194.060] CloseHandle (hObject=0x120) returned 1 [0194.060] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.060] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_gb\\messages.json")) returned 1 [0194.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.061] lstrlenW (lpString=".doc") returned 4 [0194.061] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.061] lstrlenW (lpString=".docx") returned 5 [0194.061] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.061] lstrlenW (lpString=".pdf") returned 4 [0194.061] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.061] lstrlenW (lpString=".xls") returned 4 [0194.061] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.061] lstrlenW (lpString=".xlsx") returned 5 [0194.061] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.061] lstrlenW (lpString=".ppt") returned 4 [0194.061] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.061] lstrlenW (lpString=".zip") returned 4 [0194.061] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.061] lstrlenW (lpString=".rar") returned 4 [0194.061] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.061] lstrlenW (lpString=".bz2") returned 4 [0194.061] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.061] lstrlenW (lpString=".7z") returned 3 [0194.061] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.061] lstrlenW (lpString=".dbf") returned 4 [0194.061] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.061] lstrlenW (lpString=".1cd") returned 4 [0194.061] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.061] lstrlenW (lpString=".jpg") returned 4 [0194.061] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.062] lstrlenW (lpString=".doc") returned 4 [0194.062] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.062] lstrlenW (lpString=".docx") returned 5 [0194.062] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.062] lstrlenW (lpString=".pdf") returned 4 [0194.062] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.062] lstrlenW (lpString=".xls") returned 4 [0194.062] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.062] lstrlenW (lpString=".xlsx") returned 5 [0194.062] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.062] lstrlenW (lpString=".ppt") returned 4 [0194.062] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.062] lstrlenW (lpString=".zip") returned 4 [0194.062] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.062] lstrlenW (lpString=".rar") returned 4 [0194.062] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.062] lstrlenW (lpString=".bz2") returned 4 [0194.062] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.062] lstrlenW (lpString=".7z") returned 3 [0194.062] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.062] lstrlenW (lpString=".dbf") returned 4 [0194.062] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.062] lstrlenW (lpString=".1cd") returned 4 [0194.062] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_GB\\messages.json") returned 155 [0194.062] lstrlenW (lpString=".jpg") returned 4 [0194.062] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.063] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.063] lstrlenW (lpString="messages.json") returned 13 [0194.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.063] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=249) returned 1 [0194.063] CloseHandle (hObject=0x120) returned 1 [0194.063] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0194.063] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.063] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.063] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.064] GetLastError () returned 0x0 [0194.064] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xf9, lpOverlapped=0x0) returned 1 [0194.065] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.066] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.066] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.066] SetEndOfFile (hFile=0x388) returned 1 [0194.066] CloseHandle (hObject=0x388) returned 1 [0194.066] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.066] SetEndOfFile (hFile=0x120) returned 1 [0194.067] CloseHandle (hObject=0x120) returned 1 [0194.067] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.067] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_us\\messages.json")) returned 1 [0194.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.067] lstrlenW (lpString=".doc") returned 4 [0194.067] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.067] lstrlenW (lpString=".docx") returned 5 [0194.067] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.067] lstrlenW (lpString=".pdf") returned 4 [0194.067] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.067] lstrlenW (lpString=".xls") returned 4 [0194.067] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.068] lstrlenW (lpString=".xlsx") returned 5 [0194.068] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.068] lstrlenW (lpString=".ppt") returned 4 [0194.068] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.068] lstrlenW (lpString=".zip") returned 4 [0194.068] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.068] lstrlenW (lpString=".rar") returned 4 [0194.068] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.068] lstrlenW (lpString=".bz2") returned 4 [0194.068] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.068] lstrlenW (lpString=".7z") returned 3 [0194.068] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.068] lstrlenW (lpString=".dbf") returned 4 [0194.068] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.068] lstrlenW (lpString=".1cd") returned 4 [0194.068] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.068] lstrlenW (lpString=".jpg") returned 4 [0194.068] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.068] lstrlenW (lpString=".doc") returned 4 [0194.068] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.068] lstrlenW (lpString=".docx") returned 5 [0194.068] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.068] lstrlenW (lpString=".pdf") returned 4 [0194.068] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.068] lstrlenW (lpString=".xls") returned 4 [0194.068] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.069] lstrlenW (lpString=".xlsx") returned 5 [0194.069] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.069] lstrlenW (lpString=".ppt") returned 4 [0194.069] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.069] lstrlenW (lpString=".zip") returned 4 [0194.069] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.069] lstrlenW (lpString=".rar") returned 4 [0194.069] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.069] lstrlenW (lpString=".bz2") returned 4 [0194.069] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.069] lstrlenW (lpString=".7z") returned 3 [0194.069] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.069] lstrlenW (lpString=".dbf") returned 4 [0194.069] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.069] lstrlenW (lpString=".1cd") returned 4 [0194.069] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\en_US\\messages.json") returned 155 [0194.069] lstrlenW (lpString=".jpg") returned 4 [0194.069] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.069] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.069] lstrlenW (lpString="messages.json") returned 13 [0194.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.070] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=259) returned 1 [0194.070] CloseHandle (hObject=0x120) returned 1 [0194.070] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 0x2020 [0194.070] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.070] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.070] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.070] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.071] GetLastError () returned 0x0 [0194.071] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x103, lpOverlapped=0x0) returned 1 [0194.073] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.073] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.073] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.074] SetEndOfFile (hFile=0x388) returned 1 [0194.074] CloseHandle (hObject=0x388) returned 1 [0194.074] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.074] SetEndOfFile (hFile=0x120) returned 1 [0194.074] CloseHandle (hObject=0x120) returned 1 [0194.075] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.075] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json")) returned 1 [0194.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.075] lstrlenW (lpString=".doc") returned 4 [0194.075] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.075] lstrlenW (lpString=".docx") returned 5 [0194.075] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.075] lstrlenW (lpString=".pdf") returned 4 [0194.075] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.075] lstrlenW (lpString=".xls") returned 4 [0194.075] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.075] lstrlenW (lpString=".xlsx") returned 5 [0194.075] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.075] lstrlenW (lpString=".ppt") returned 4 [0194.075] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.075] lstrlenW (lpString=".zip") returned 4 [0194.075] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.075] lstrlenW (lpString=".rar") returned 4 [0194.075] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.075] lstrlenW (lpString=".bz2") returned 4 [0194.075] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.076] lstrlenW (lpString=".7z") returned 3 [0194.076] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.076] lstrlenW (lpString=".dbf") returned 4 [0194.076] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.076] lstrlenW (lpString=".1cd") returned 4 [0194.076] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.076] lstrlenW (lpString=".jpg") returned 4 [0194.076] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.076] lstrlenW (lpString=".doc") returned 4 [0194.076] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.076] lstrlenW (lpString=".docx") returned 5 [0194.076] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.076] lstrlenW (lpString=".pdf") returned 4 [0194.076] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.076] lstrlenW (lpString=".xls") returned 4 [0194.076] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.076] lstrlenW (lpString=".xlsx") returned 5 [0194.076] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.076] lstrlenW (lpString=".ppt") returned 4 [0194.077] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.077] lstrlenW (lpString=".zip") returned 4 [0194.077] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.077] lstrlenW (lpString=".rar") returned 4 [0194.077] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.077] lstrlenW (lpString=".bz2") returned 4 [0194.077] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.077] lstrlenW (lpString=".7z") returned 3 [0194.077] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.077] lstrlenW (lpString=".dbf") returned 4 [0194.077] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.077] lstrlenW (lpString=".1cd") returned 4 [0194.077] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es\\messages.json") returned 152 [0194.077] lstrlenW (lpString=".jpg") returned 4 [0194.077] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.077] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.077] lstrlenW (lpString="messages.json") returned 13 [0194.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.078] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=259) returned 1 [0194.078] CloseHandle (hObject=0x120) returned 1 [0194.078] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0194.078] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.078] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.078] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.079] GetLastError () returned 0x0 [0194.079] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x103, lpOverlapped=0x0) returned 1 [0194.080] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.080] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.080] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.081] SetEndOfFile (hFile=0x388) returned 1 [0194.081] CloseHandle (hObject=0x388) returned 1 [0194.081] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.081] SetEndOfFile (hFile=0x120) returned 1 [0194.081] CloseHandle (hObject=0x120) returned 1 [0194.082] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.082] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json")) returned 1 [0194.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.082] lstrlenW (lpString=".doc") returned 4 [0194.082] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.082] lstrlenW (lpString=".docx") returned 5 [0194.082] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.082] lstrlenW (lpString=".pdf") returned 4 [0194.082] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.082] lstrlenW (lpString=".xls") returned 4 [0194.082] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.082] lstrlenW (lpString=".xlsx") returned 5 [0194.082] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.082] lstrlenW (lpString=".ppt") returned 4 [0194.082] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.082] lstrlenW (lpString=".zip") returned 4 [0194.082] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.082] lstrlenW (lpString=".rar") returned 4 [0194.082] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.082] lstrlenW (lpString=".bz2") returned 4 [0194.082] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.083] lstrlenW (lpString=".7z") returned 3 [0194.083] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.083] lstrlenW (lpString=".dbf") returned 4 [0194.083] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.083] lstrlenW (lpString=".1cd") returned 4 [0194.083] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.083] lstrlenW (lpString=".jpg") returned 4 [0194.083] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.083] lstrlenW (lpString=".doc") returned 4 [0194.083] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.083] lstrlenW (lpString=".docx") returned 5 [0194.083] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.083] lstrlenW (lpString=".pdf") returned 4 [0194.083] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.083] lstrlenW (lpString=".xls") returned 4 [0194.083] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.083] lstrlenW (lpString=".xlsx") returned 5 [0194.083] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.083] lstrlenW (lpString=".ppt") returned 4 [0194.083] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.083] lstrlenW (lpString=".zip") returned 4 [0194.083] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.083] lstrlenW (lpString=".rar") returned 4 [0194.083] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.083] lstrlenW (lpString=".bz2") returned 4 [0194.084] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.084] lstrlenW (lpString=".7z") returned 3 [0194.084] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.084] lstrlenW (lpString=".dbf") returned 4 [0194.084] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.084] lstrlenW (lpString=".1cd") returned 4 [0194.084] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\es_419\\messages.json") returned 156 [0194.084] lstrlenW (lpString=".jpg") returned 4 [0194.084] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.084] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.084] lstrlenW (lpString="messages.json") returned 13 [0194.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.084] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=251) returned 1 [0194.085] CloseHandle (hObject=0x120) returned 1 [0194.085] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 0x2020 [0194.085] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.085] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.085] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.085] GetLastError () returned 0x0 [0194.085] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xfb, lpOverlapped=0x0) returned 1 [0194.086] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.087] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.087] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.087] SetEndOfFile (hFile=0x388) returned 1 [0194.088] CloseHandle (hObject=0x388) returned 1 [0194.088] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.088] SetEndOfFile (hFile=0x120) returned 1 [0194.088] CloseHandle (hObject=0x120) returned 1 [0194.088] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.089] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json")) returned 1 [0194.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.089] lstrlenW (lpString=".doc") returned 4 [0194.089] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.089] lstrlenW (lpString=".docx") returned 5 [0194.089] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.089] lstrlenW (lpString=".pdf") returned 4 [0194.089] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.089] lstrlenW (lpString=".xls") returned 4 [0194.089] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.089] lstrlenW (lpString=".xlsx") returned 5 [0194.089] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.089] lstrlenW (lpString=".ppt") returned 4 [0194.089] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.089] lstrlenW (lpString=".zip") returned 4 [0194.089] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.089] lstrlenW (lpString=".rar") returned 4 [0194.089] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.089] lstrlenW (lpString=".bz2") returned 4 [0194.089] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.089] lstrlenW (lpString=".7z") returned 3 [0194.089] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.089] lstrlenW (lpString=".dbf") returned 4 [0194.089] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.090] lstrlenW (lpString=".1cd") returned 4 [0194.090] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.090] lstrlenW (lpString=".jpg") returned 4 [0194.090] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.090] lstrlenW (lpString=".doc") returned 4 [0194.090] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.090] lstrlenW (lpString=".docx") returned 5 [0194.090] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.090] lstrlenW (lpString=".pdf") returned 4 [0194.090] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.090] lstrlenW (lpString=".xls") returned 4 [0194.090] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.090] lstrlenW (lpString=".xlsx") returned 5 [0194.090] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.090] lstrlenW (lpString=".ppt") returned 4 [0194.090] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.090] lstrlenW (lpString=".zip") returned 4 [0194.090] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.090] lstrlenW (lpString=".rar") returned 4 [0194.090] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.090] lstrlenW (lpString=".bz2") returned 4 [0194.090] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.090] lstrlenW (lpString=".7z") returned 3 [0194.090] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.090] lstrlenW (lpString=".dbf") returned 4 [0194.090] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.091] lstrlenW (lpString=".1cd") returned 4 [0194.091] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\et\\messages.json") returned 152 [0194.091] lstrlenW (lpString=".jpg") returned 4 [0194.091] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.091] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.091] lstrlenW (lpString="messages.json") returned 13 [0194.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.091] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=243) returned 1 [0194.133] CloseHandle (hObject=0x120) returned 1 [0194.133] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 0x2020 [0194.133] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.133] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.133] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.133] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.134] GetLastError () returned 0x0 [0194.134] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xf3, lpOverlapped=0x0) returned 1 [0194.135] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.136] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.136] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.136] SetEndOfFile (hFile=0x388) returned 1 [0194.136] CloseHandle (hObject=0x388) returned 1 [0194.136] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.136] SetEndOfFile (hFile=0x120) returned 1 [0194.137] CloseHandle (hObject=0x120) returned 1 [0194.137] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.137] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json")) returned 1 [0194.137] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.137] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.137] lstrlenW (lpString=".doc") returned 4 [0194.137] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.137] lstrlenW (lpString=".docx") returned 5 [0194.137] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.137] lstrlenW (lpString=".pdf") returned 4 [0194.137] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.138] lstrlenW (lpString=".xls") returned 4 [0194.138] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.138] lstrlenW (lpString=".xlsx") returned 5 [0194.138] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.138] lstrlenW (lpString=".ppt") returned 4 [0194.138] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.138] lstrlenW (lpString=".zip") returned 4 [0194.138] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.138] lstrlenW (lpString=".rar") returned 4 [0194.138] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.138] lstrlenW (lpString=".bz2") returned 4 [0194.138] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.138] lstrlenW (lpString=".7z") returned 3 [0194.138] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.138] lstrlenW (lpString=".dbf") returned 4 [0194.138] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.139] lstrlenW (lpString=".1cd") returned 4 [0194.139] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.139] lstrlenW (lpString=".jpg") returned 4 [0194.139] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.139] lstrlenW (lpString=".doc") returned 4 [0194.139] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.139] lstrlenW (lpString=".docx") returned 5 [0194.139] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.139] lstrlenW (lpString=".pdf") returned 4 [0194.139] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.139] lstrlenW (lpString=".xls") returned 4 [0194.139] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.139] lstrlenW (lpString=".xlsx") returned 5 [0194.139] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.139] lstrlenW (lpString=".ppt") returned 4 [0194.139] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.139] lstrlenW (lpString=".zip") returned 4 [0194.139] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.139] lstrlenW (lpString=".rar") returned 4 [0194.139] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.139] lstrlenW (lpString=".bz2") returned 4 [0194.139] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.140] lstrlenW (lpString=".7z") returned 3 [0194.140] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.140] lstrlenW (lpString=".dbf") returned 4 [0194.140] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.140] lstrlenW (lpString=".1cd") returned 4 [0194.140] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\eu\\messages.json") returned 152 [0194.140] lstrlenW (lpString=".jpg") returned 4 [0194.140] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.140] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.140] lstrlenW (lpString="messages.json") returned 13 [0194.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.141] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=263) returned 1 [0194.141] CloseHandle (hObject=0x120) returned 1 [0194.141] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 0x2020 [0194.141] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.141] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.141] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.141] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.141] GetLastError () returned 0x0 [0194.141] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x107, lpOverlapped=0x0) returned 1 [0194.142] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.143] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.144] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.144] SetEndOfFile (hFile=0x388) returned 1 [0194.147] CloseHandle (hObject=0x388) returned 1 [0194.147] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.148] SetEndOfFile (hFile=0x120) returned 1 [0194.148] CloseHandle (hObject=0x120) returned 1 [0194.148] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.148] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json")) returned 1 [0194.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.149] lstrlenW (lpString=".doc") returned 4 [0194.149] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.149] lstrlenW (lpString=".docx") returned 5 [0194.149] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.149] lstrlenW (lpString=".pdf") returned 4 [0194.149] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.149] lstrlenW (lpString=".xls") returned 4 [0194.149] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.149] lstrlenW (lpString=".xlsx") returned 5 [0194.149] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.149] lstrlenW (lpString=".ppt") returned 4 [0194.149] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.149] lstrlenW (lpString=".zip") returned 4 [0194.149] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.149] lstrlenW (lpString=".rar") returned 4 [0194.149] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.149] lstrlenW (lpString=".bz2") returned 4 [0194.149] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.149] lstrlenW (lpString=".7z") returned 3 [0194.149] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.149] lstrlenW (lpString=".dbf") returned 4 [0194.149] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.149] lstrlenW (lpString=".1cd") returned 4 [0194.149] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.150] lstrlenW (lpString=".jpg") returned 4 [0194.150] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.150] lstrlenW (lpString=".doc") returned 4 [0194.150] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.150] lstrlenW (lpString=".docx") returned 5 [0194.150] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.150] lstrlenW (lpString=".pdf") returned 4 [0194.150] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.150] lstrlenW (lpString=".xls") returned 4 [0194.150] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.150] lstrlenW (lpString=".xlsx") returned 5 [0194.150] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.150] lstrlenW (lpString=".ppt") returned 4 [0194.150] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.150] lstrlenW (lpString=".zip") returned 4 [0194.150] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.150] lstrlenW (lpString=".rar") returned 4 [0194.150] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.150] lstrlenW (lpString=".bz2") returned 4 [0194.150] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.150] lstrlenW (lpString=".7z") returned 3 [0194.150] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.150] lstrlenW (lpString=".dbf") returned 4 [0194.150] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.150] lstrlenW (lpString=".1cd") returned 4 [0194.150] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hr\\messages.json") returned 152 [0194.151] lstrlenW (lpString=".jpg") returned 4 [0194.151] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.151] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.151] lstrlenW (lpString="messages.json") returned 13 [0194.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.151] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=264) returned 1 [0194.151] CloseHandle (hObject=0x120) returned 1 [0194.151] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 0x2020 [0194.151] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.152] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.152] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.152] GetLastError () returned 0x0 [0194.152] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x108, lpOverlapped=0x0) returned 1 [0194.154] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.155] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.155] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.155] SetEndOfFile (hFile=0x388) returned 1 [0194.155] CloseHandle (hObject=0x388) returned 1 [0194.155] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.155] SetEndOfFile (hFile=0x120) returned 1 [0194.156] CloseHandle (hObject=0x120) returned 1 [0194.156] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.156] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json")) returned 1 [0194.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.156] lstrlenW (lpString=".doc") returned 4 [0194.156] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.156] lstrlenW (lpString=".docx") returned 5 [0194.156] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.156] lstrlenW (lpString=".pdf") returned 4 [0194.156] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.156] lstrlenW (lpString=".xls") returned 4 [0194.156] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.156] lstrlenW (lpString=".xlsx") returned 5 [0194.156] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.156] lstrlenW (lpString=".ppt") returned 4 [0194.156] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.157] lstrlenW (lpString=".zip") returned 4 [0194.157] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.157] lstrlenW (lpString=".rar") returned 4 [0194.157] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.157] lstrlenW (lpString=".bz2") returned 4 [0194.157] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.157] lstrlenW (lpString=".7z") returned 3 [0194.157] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.157] lstrlenW (lpString=".dbf") returned 4 [0194.157] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.157] lstrlenW (lpString=".1cd") returned 4 [0194.157] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.157] lstrlenW (lpString=".jpg") returned 4 [0194.157] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.157] lstrlenW (lpString=".doc") returned 4 [0194.157] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.157] lstrlenW (lpString=".docx") returned 5 [0194.157] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.157] lstrlenW (lpString=".pdf") returned 4 [0194.157] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.157] lstrlenW (lpString=".xls") returned 4 [0194.157] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.157] lstrlenW (lpString=".xlsx") returned 5 [0194.157] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.157] lstrlenW (lpString=".ppt") returned 4 [0194.158] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.158] lstrlenW (lpString=".zip") returned 4 [0194.158] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.158] lstrlenW (lpString=".rar") returned 4 [0194.158] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.158] lstrlenW (lpString=".bz2") returned 4 [0194.158] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.158] lstrlenW (lpString=".7z") returned 3 [0194.158] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.158] lstrlenW (lpString=".dbf") returned 4 [0194.158] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.158] lstrlenW (lpString=".1cd") returned 4 [0194.158] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hu\\messages.json") returned 152 [0194.158] lstrlenW (lpString=".jpg") returned 4 [0194.158] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.158] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.158] lstrlenW (lpString="messages.json") returned 13 [0194.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.159] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=261) returned 1 [0194.159] CloseHandle (hObject=0x120) returned 1 [0194.159] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 0x2020 [0194.159] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.159] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.159] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.160] GetLastError () returned 0x0 [0194.160] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x105, lpOverlapped=0x0) returned 1 [0194.161] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.161] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.161] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.162] SetEndOfFile (hFile=0x388) returned 1 [0194.162] CloseHandle (hObject=0x388) returned 1 [0194.162] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.162] SetEndOfFile (hFile=0x120) returned 1 [0194.162] CloseHandle (hObject=0x120) returned 1 [0194.163] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.163] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json")) returned 1 [0194.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.163] lstrlenW (lpString=".doc") returned 4 [0194.163] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.163] lstrlenW (lpString=".docx") returned 5 [0194.163] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.163] lstrlenW (lpString=".pdf") returned 4 [0194.163] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.163] lstrlenW (lpString=".xls") returned 4 [0194.163] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.163] lstrlenW (lpString=".xlsx") returned 5 [0194.163] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.163] lstrlenW (lpString=".ppt") returned 4 [0194.163] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.163] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.163] lstrlenW (lpString=".zip") returned 4 [0194.163] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.163] lstrlenW (lpString=".rar") returned 4 [0194.163] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.163] lstrlenW (lpString=".bz2") returned 4 [0194.164] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.164] lstrlenW (lpString=".7z") returned 3 [0194.164] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.164] lstrlenW (lpString=".dbf") returned 4 [0194.164] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.164] lstrlenW (lpString=".1cd") returned 4 [0194.164] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.164] lstrlenW (lpString=".jpg") returned 4 [0194.164] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.164] lstrlenW (lpString=".doc") returned 4 [0194.164] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.164] lstrlenW (lpString=".docx") returned 5 [0194.164] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.164] lstrlenW (lpString=".pdf") returned 4 [0194.164] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.164] lstrlenW (lpString=".xls") returned 4 [0194.164] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.164] lstrlenW (lpString=".xlsx") returned 5 [0194.164] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.164] lstrlenW (lpString=".ppt") returned 4 [0194.164] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.164] lstrlenW (lpString=".zip") returned 4 [0194.164] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.164] lstrlenW (lpString=".rar") returned 4 [0194.164] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.165] lstrlenW (lpString=".bz2") returned 4 [0194.165] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.165] lstrlenW (lpString=".7z") returned 3 [0194.165] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.165] lstrlenW (lpString=".dbf") returned 4 [0194.165] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.165] lstrlenW (lpString=".1cd") returned 4 [0194.165] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\id\\messages.json") returned 152 [0194.165] lstrlenW (lpString=".jpg") returned 4 [0194.165] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.165] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.165] lstrlenW (lpString="messages.json") returned 13 [0194.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.165] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=258) returned 1 [0194.166] CloseHandle (hObject=0x120) returned 1 [0194.166] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 0x2020 [0194.166] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.166] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.166] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.166] GetLastError () returned 0x0 [0194.166] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x102, lpOverlapped=0x0) returned 1 [0194.284] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.284] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.285] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.285] SetEndOfFile (hFile=0x388) returned 1 [0194.285] CloseHandle (hObject=0x388) returned 1 [0194.285] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.285] SetEndOfFile (hFile=0x120) returned 1 [0194.286] CloseHandle (hObject=0x120) returned 1 [0194.286] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.286] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json")) returned 1 [0194.286] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.286] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.286] lstrlenW (lpString=".doc") returned 4 [0194.286] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.286] lstrlenW (lpString=".docx") returned 5 [0194.286] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.286] lstrlenW (lpString=".pdf") returned 4 [0194.286] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.286] lstrlenW (lpString=".xls") returned 4 [0194.286] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.286] lstrlenW (lpString=".xlsx") returned 5 [0194.286] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.286] lstrlenW (lpString=".ppt") returned 4 [0194.286] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.287] lstrlenW (lpString=".zip") returned 4 [0194.287] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.287] lstrlenW (lpString=".rar") returned 4 [0194.287] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.287] lstrlenW (lpString=".bz2") returned 4 [0194.287] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.287] lstrlenW (lpString=".7z") returned 3 [0194.287] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.287] lstrlenW (lpString=".dbf") returned 4 [0194.287] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.287] lstrlenW (lpString=".1cd") returned 4 [0194.287] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.287] lstrlenW (lpString=".jpg") returned 4 [0194.287] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.287] lstrlenW (lpString=".doc") returned 4 [0194.287] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.287] lstrlenW (lpString=".docx") returned 5 [0194.287] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.287] lstrlenW (lpString=".pdf") returned 4 [0194.287] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.287] lstrlenW (lpString=".xls") returned 4 [0194.287] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.287] lstrlenW (lpString=".xlsx") returned 5 [0194.287] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.287] lstrlenW (lpString=".ppt") returned 4 [0194.288] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.288] lstrlenW (lpString=".zip") returned 4 [0194.288] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.288] lstrlenW (lpString=".rar") returned 4 [0194.288] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.288] lstrlenW (lpString=".bz2") returned 4 [0194.288] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.288] lstrlenW (lpString=".7z") returned 3 [0194.288] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.288] lstrlenW (lpString=".dbf") returned 4 [0194.288] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.288] lstrlenW (lpString=".1cd") returned 4 [0194.288] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\it\\messages.json") returned 152 [0194.288] lstrlenW (lpString=".jpg") returned 4 [0194.288] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.288] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.288] lstrlenW (lpString="messages.json") returned 13 [0194.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.289] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=264) returned 1 [0194.289] CloseHandle (hObject=0x120) returned 1 [0194.289] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0194.289] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.289] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.289] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.290] GetLastError () returned 0x0 [0194.290] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x108, lpOverlapped=0x0) returned 1 [0194.291] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.291] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.291] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.292] SetEndOfFile (hFile=0x388) returned 1 [0194.292] CloseHandle (hObject=0x388) returned 1 [0194.292] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.292] SetEndOfFile (hFile=0x120) returned 1 [0194.293] CloseHandle (hObject=0x120) returned 1 [0194.293] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.293] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0194.293] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.293] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.293] lstrlenW (lpString=".doc") returned 4 [0194.293] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.293] lstrlenW (lpString=".docx") returned 5 [0194.293] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.293] lstrlenW (lpString=".pdf") returned 4 [0194.293] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.293] lstrlenW (lpString=".xls") returned 4 [0194.293] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.293] lstrlenW (lpString=".xlsx") returned 5 [0194.293] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.293] lstrlenW (lpString=".ppt") returned 4 [0194.293] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.293] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.294] lstrlenW (lpString=".zip") returned 4 [0194.294] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.294] lstrlenW (lpString=".rar") returned 4 [0194.294] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.294] lstrlenW (lpString=".bz2") returned 4 [0194.294] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.294] lstrlenW (lpString=".7z") returned 3 [0194.294] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.294] lstrlenW (lpString=".dbf") returned 4 [0194.294] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.294] lstrlenW (lpString=".1cd") returned 4 [0194.294] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.294] lstrlenW (lpString=".jpg") returned 4 [0194.294] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.294] lstrlenW (lpString=".doc") returned 4 [0194.294] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.294] lstrlenW (lpString=".docx") returned 5 [0194.294] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.294] lstrlenW (lpString=".pdf") returned 4 [0194.294] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.294] lstrlenW (lpString=".xls") returned 4 [0194.294] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.294] lstrlenW (lpString=".xlsx") returned 5 [0194.294] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.294] lstrlenW (lpString=".ppt") returned 4 [0194.295] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.295] lstrlenW (lpString=".zip") returned 4 [0194.295] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.295] lstrlenW (lpString=".rar") returned 4 [0194.295] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.295] lstrlenW (lpString=".bz2") returned 4 [0194.295] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.295] lstrlenW (lpString=".7z") returned 3 [0194.295] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.295] lstrlenW (lpString=".dbf") returned 4 [0194.295] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.295] lstrlenW (lpString=".1cd") returned 4 [0194.295] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_PT\\messages.json") returned 155 [0194.295] lstrlenW (lpString=".jpg") returned 4 [0194.295] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.295] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.295] lstrlenW (lpString="messages.json") returned 13 [0194.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.296] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=281) returned 1 [0194.296] CloseHandle (hObject=0x120) returned 1 [0194.296] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 0x2020 [0194.296] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.296] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.296] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.297] GetLastError () returned 0x0 [0194.297] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x119, lpOverlapped=0x0) returned 1 [0194.298] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x120, lpOverlapped=0x0) returned 1 [0194.298] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.298] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.299] SetEndOfFile (hFile=0x388) returned 1 [0194.299] CloseHandle (hObject=0x388) returned 1 [0194.299] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.299] SetEndOfFile (hFile=0x120) returned 1 [0194.300] CloseHandle (hObject=0x120) returned 1 [0194.300] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.300] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json")) returned 1 [0194.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.300] lstrlenW (lpString=".doc") returned 4 [0194.300] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.300] lstrlenW (lpString=".docx") returned 5 [0194.300] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.300] lstrlenW (lpString=".pdf") returned 4 [0194.300] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.300] lstrlenW (lpString=".xls") returned 4 [0194.300] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.300] lstrlenW (lpString=".xlsx") returned 5 [0194.300] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.300] lstrlenW (lpString=".ppt") returned 4 [0194.300] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.300] lstrlenW (lpString=".zip") returned 4 [0194.300] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.301] lstrlenW (lpString=".rar") returned 4 [0194.301] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.301] lstrlenW (lpString=".bz2") returned 4 [0194.301] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.301] lstrlenW (lpString=".7z") returned 3 [0194.301] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.301] lstrlenW (lpString=".dbf") returned 4 [0194.301] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.301] lstrlenW (lpString=".1cd") returned 4 [0194.301] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.301] lstrlenW (lpString=".jpg") returned 4 [0194.301] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.301] lstrlenW (lpString=".doc") returned 4 [0194.301] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.301] lstrlenW (lpString=".docx") returned 5 [0194.301] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.301] lstrlenW (lpString=".pdf") returned 4 [0194.301] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.301] lstrlenW (lpString=".xls") returned 4 [0194.301] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.301] lstrlenW (lpString=".xlsx") returned 5 [0194.301] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.301] lstrlenW (lpString=".ppt") returned 4 [0194.301] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.301] lstrlenW (lpString=".zip") returned 4 [0194.301] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.302] lstrlenW (lpString=".rar") returned 4 [0194.302] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.302] lstrlenW (lpString=".bz2") returned 4 [0194.302] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.302] lstrlenW (lpString=".7z") returned 3 [0194.302] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.302] lstrlenW (lpString=".dbf") returned 4 [0194.302] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.302] lstrlenW (lpString=".1cd") returned 4 [0194.302] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ro\\messages.json") returned 152 [0194.302] lstrlenW (lpString=".jpg") returned 4 [0194.302] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.302] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.302] lstrlenW (lpString="messages.json") returned 13 [0194.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.303] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=338) returned 1 [0194.303] CloseHandle (hObject=0x120) returned 1 [0194.303] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 0x2020 [0194.303] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.303] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.303] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.303] GetLastError () returned 0x0 [0194.303] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x152, lpOverlapped=0x0) returned 1 [0194.304] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x160, lpOverlapped=0x0) returned 1 [0194.305] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.305] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.305] SetEndOfFile (hFile=0x388) returned 1 [0194.306] CloseHandle (hObject=0x388) returned 1 [0194.306] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.306] SetEndOfFile (hFile=0x120) returned 1 [0194.306] CloseHandle (hObject=0x120) returned 1 [0194.306] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.307] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json")) returned 1 [0194.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.307] lstrlenW (lpString=".doc") returned 4 [0194.307] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.307] lstrlenW (lpString=".docx") returned 5 [0194.307] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.307] lstrlenW (lpString=".pdf") returned 4 [0194.307] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.307] lstrlenW (lpString=".xls") returned 4 [0194.307] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.307] lstrlenW (lpString=".xlsx") returned 5 [0194.307] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.307] lstrlenW (lpString=".ppt") returned 4 [0194.307] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.307] lstrlenW (lpString=".zip") returned 4 [0194.307] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.307] lstrlenW (lpString=".rar") returned 4 [0194.307] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.307] lstrlenW (lpString=".bz2") returned 4 [0194.307] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.307] lstrlenW (lpString=".7z") returned 3 [0194.307] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.308] lstrlenW (lpString=".dbf") returned 4 [0194.308] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.308] lstrlenW (lpString=".1cd") returned 4 [0194.308] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.308] lstrlenW (lpString=".jpg") returned 4 [0194.308] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.308] lstrlenW (lpString=".doc") returned 4 [0194.308] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.308] lstrlenW (lpString=".docx") returned 5 [0194.308] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.308] lstrlenW (lpString=".pdf") returned 4 [0194.308] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.308] lstrlenW (lpString=".xls") returned 4 [0194.308] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.308] lstrlenW (lpString=".xlsx") returned 5 [0194.308] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.308] lstrlenW (lpString=".ppt") returned 4 [0194.308] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.308] lstrlenW (lpString=".zip") returned 4 [0194.308] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.308] lstrlenW (lpString=".rar") returned 4 [0194.308] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.308] lstrlenW (lpString=".bz2") returned 4 [0194.308] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.308] lstrlenW (lpString=".7z") returned 3 [0194.309] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.309] lstrlenW (lpString=".dbf") returned 4 [0194.309] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.309] lstrlenW (lpString=".1cd") returned 4 [0194.309] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ru\\messages.json") returned 152 [0194.309] lstrlenW (lpString=".jpg") returned 4 [0194.309] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.309] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.309] lstrlenW (lpString="messages.json") returned 13 [0194.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.309] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=274) returned 1 [0194.309] CloseHandle (hObject=0x120) returned 1 [0194.310] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 0x2020 [0194.310] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.310] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.310] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.310] GetLastError () returned 0x0 [0194.310] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x112, lpOverlapped=0x0) returned 1 [0194.311] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x120, lpOverlapped=0x0) returned 1 [0194.312] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.312] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.312] SetEndOfFile (hFile=0x388) returned 1 [0194.312] CloseHandle (hObject=0x388) returned 1 [0194.312] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.312] SetEndOfFile (hFile=0x120) returned 1 [0194.313] CloseHandle (hObject=0x120) returned 1 [0194.313] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.313] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json")) returned 1 [0194.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.314] lstrlenW (lpString=".doc") returned 4 [0194.314] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.314] lstrlenW (lpString=".docx") returned 5 [0194.314] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.314] lstrlenW (lpString=".pdf") returned 4 [0194.314] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.314] lstrlenW (lpString=".xls") returned 4 [0194.314] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.314] lstrlenW (lpString=".xlsx") returned 5 [0194.314] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.314] lstrlenW (lpString=".ppt") returned 4 [0194.314] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.314] lstrlenW (lpString=".zip") returned 4 [0194.314] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.314] lstrlenW (lpString=".rar") returned 4 [0194.314] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.314] lstrlenW (lpString=".bz2") returned 4 [0194.314] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.314] lstrlenW (lpString=".7z") returned 3 [0194.314] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.314] lstrlenW (lpString=".dbf") returned 4 [0194.314] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.314] lstrlenW (lpString=".1cd") returned 4 [0194.314] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.314] lstrlenW (lpString=".jpg") returned 4 [0194.315] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.315] lstrlenW (lpString=".doc") returned 4 [0194.315] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.315] lstrlenW (lpString=".docx") returned 5 [0194.315] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.315] lstrlenW (lpString=".pdf") returned 4 [0194.315] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.315] lstrlenW (lpString=".xls") returned 4 [0194.315] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.315] lstrlenW (lpString=".xlsx") returned 5 [0194.315] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.315] lstrlenW (lpString=".ppt") returned 4 [0194.315] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.315] lstrlenW (lpString=".zip") returned 4 [0194.315] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.315] lstrlenW (lpString=".rar") returned 4 [0194.315] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.315] lstrlenW (lpString=".bz2") returned 4 [0194.315] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.315] lstrlenW (lpString=".7z") returned 3 [0194.315] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.315] lstrlenW (lpString=".dbf") returned 4 [0194.315] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.315] lstrlenW (lpString=".1cd") returned 4 [0194.315] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sk\\messages.json") returned 152 [0194.316] lstrlenW (lpString=".jpg") returned 4 [0194.316] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.316] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.316] lstrlenW (lpString="messages.json") returned 13 [0194.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.316] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=268) returned 1 [0194.316] CloseHandle (hObject=0x120) returned 1 [0194.316] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 0x2020 [0194.316] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.316] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.317] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.317] GetLastError () returned 0x0 [0194.317] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x10c, lpOverlapped=0x0) returned 1 [0194.398] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.399] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.399] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.399] SetEndOfFile (hFile=0x388) returned 1 [0194.399] CloseHandle (hObject=0x388) returned 1 [0194.399] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.399] SetEndOfFile (hFile=0x120) returned 1 [0194.400] CloseHandle (hObject=0x120) returned 1 [0194.400] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.400] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json")) returned 1 [0194.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.401] lstrlenW (lpString=".doc") returned 4 [0194.401] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.401] lstrlenW (lpString=".docx") returned 5 [0194.401] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.401] lstrlenW (lpString=".pdf") returned 4 [0194.401] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.401] lstrlenW (lpString=".xls") returned 4 [0194.401] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.401] lstrlenW (lpString=".xlsx") returned 5 [0194.401] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.401] lstrlenW (lpString=".ppt") returned 4 [0194.401] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.401] lstrlenW (lpString=".zip") returned 4 [0194.401] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.401] lstrlenW (lpString=".rar") returned 4 [0194.401] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.401] lstrlenW (lpString=".bz2") returned 4 [0194.401] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.401] lstrlenW (lpString=".7z") returned 3 [0194.401] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.401] lstrlenW (lpString=".dbf") returned 4 [0194.401] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.401] lstrlenW (lpString=".1cd") returned 4 [0194.401] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.401] lstrlenW (lpString=".jpg") returned 4 [0194.402] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.402] lstrlenW (lpString=".doc") returned 4 [0194.402] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.402] lstrlenW (lpString=".docx") returned 5 [0194.402] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.402] lstrlenW (lpString=".pdf") returned 4 [0194.402] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.402] lstrlenW (lpString=".xls") returned 4 [0194.402] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.402] lstrlenW (lpString=".xlsx") returned 5 [0194.402] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.402] lstrlenW (lpString=".ppt") returned 4 [0194.402] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.402] lstrlenW (lpString=".zip") returned 4 [0194.402] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.402] lstrlenW (lpString=".rar") returned 4 [0194.402] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.402] lstrlenW (lpString=".bz2") returned 4 [0194.402] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.402] lstrlenW (lpString=".7z") returned 3 [0194.402] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.402] lstrlenW (lpString=".dbf") returned 4 [0194.402] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.402] lstrlenW (lpString=".1cd") returned 4 [0194.402] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sl\\messages.json") returned 152 [0194.403] lstrlenW (lpString=".jpg") returned 4 [0194.403] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.403] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0194.403] lstrlenW (lpString="128.png") returned 7 [0194.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.403] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3406) returned 1 [0194.403] CloseHandle (hObject=0x120) returned 1 [0194.403] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 0x2020 [0194.404] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.404] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.404] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.404] GetLastError () returned 0x0 [0194.404] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd4e, lpOverlapped=0x0) returned 1 [0194.413] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xd50, lpOverlapped=0x0) returned 1 [0194.414] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.415] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0194.415] SetEndOfFile (hFile=0x388) returned 1 [0194.415] CloseHandle (hObject=0x388) returned 1 [0194.415] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.415] SetEndOfFile (hFile=0x120) returned 1 [0194.416] CloseHandle (hObject=0x120) returned 1 [0194.416] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.416] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png")) returned 1 [0194.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.416] lstrlenW (lpString=".doc") returned 4 [0194.416] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0194.416] lstrlenW (lpString=".docx") returned 5 [0194.416] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0194.416] lstrlenW (lpString=".pdf") returned 4 [0194.416] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0194.416] lstrlenW (lpString=".xls") returned 4 [0194.416] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0194.416] lstrlenW (lpString=".xlsx") returned 5 [0194.416] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0194.416] lstrlenW (lpString=".ppt") returned 4 [0194.416] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0194.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.416] lstrlenW (lpString=".zip") returned 4 [0194.417] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0194.417] lstrlenW (lpString=".rar") returned 4 [0194.417] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0194.417] lstrlenW (lpString=".bz2") returned 4 [0194.417] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0194.417] lstrlenW (lpString=".7z") returned 3 [0194.417] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0194.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.417] lstrlenW (lpString=".dbf") returned 4 [0194.417] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0194.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.417] lstrlenW (lpString=".1cd") returned 4 [0194.417] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0194.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.417] lstrlenW (lpString=".jpg") returned 4 [0194.417] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0194.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.417] lstrlenW (lpString=".doc") returned 4 [0194.417] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0194.417] lstrlenW (lpString=".docx") returned 5 [0194.417] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0194.417] lstrlenW (lpString=".pdf") returned 4 [0194.417] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0194.417] lstrlenW (lpString=".xls") returned 4 [0194.417] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0194.417] lstrlenW (lpString=".xlsx") returned 5 [0194.417] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0194.417] lstrlenW (lpString=".ppt") returned 4 [0194.417] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0194.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.418] lstrlenW (lpString=".zip") returned 4 [0194.418] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0194.418] lstrlenW (lpString=".rar") returned 4 [0194.418] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0194.418] lstrlenW (lpString=".bz2") returned 4 [0194.418] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0194.418] lstrlenW (lpString=".7z") returned 3 [0194.418] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0194.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.418] lstrlenW (lpString=".dbf") returned 4 [0194.418] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0194.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.418] lstrlenW (lpString=".1cd") returned 4 [0194.418] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0194.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\128.png") returned 135 [0194.418] lstrlenW (lpString=".jpg") returned 4 [0194.418] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0194.418] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.418] lstrlenW (lpString="messages.json") returned 13 [0194.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.419] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.419] CloseHandle (hObject=0x120) returned 1 [0194.419] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 0x2020 [0194.420] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.420] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.420] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.421] GetLastError () returned 0x0 [0194.421] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.422] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.423] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.423] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.423] SetEndOfFile (hFile=0x388) returned 1 [0194.423] CloseHandle (hObject=0x388) returned 1 [0194.424] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.424] SetEndOfFile (hFile=0x120) returned 1 [0194.424] CloseHandle (hObject=0x120) returned 1 [0194.424] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.425] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json")) returned 1 [0194.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.425] lstrlenW (lpString=".doc") returned 4 [0194.425] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.425] lstrlenW (lpString=".docx") returned 5 [0194.425] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.425] lstrlenW (lpString=".pdf") returned 4 [0194.425] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.425] lstrlenW (lpString=".xls") returned 4 [0194.425] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.425] lstrlenW (lpString=".xlsx") returned 5 [0194.425] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.425] lstrlenW (lpString=".ppt") returned 4 [0194.425] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.425] lstrlenW (lpString=".zip") returned 4 [0194.425] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.425] lstrlenW (lpString=".rar") returned 4 [0194.425] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.425] lstrlenW (lpString=".bz2") returned 4 [0194.425] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.425] lstrlenW (lpString=".7z") returned 3 [0194.425] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.425] lstrlenW (lpString=".dbf") returned 4 [0194.425] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.426] lstrlenW (lpString=".1cd") returned 4 [0194.426] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.426] lstrlenW (lpString=".jpg") returned 4 [0194.426] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.426] lstrlenW (lpString=".doc") returned 4 [0194.426] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.426] lstrlenW (lpString=".docx") returned 5 [0194.426] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.426] lstrlenW (lpString=".pdf") returned 4 [0194.426] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.426] lstrlenW (lpString=".xls") returned 4 [0194.426] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.426] lstrlenW (lpString=".xlsx") returned 5 [0194.426] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.426] lstrlenW (lpString=".ppt") returned 4 [0194.426] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.426] lstrlenW (lpString=".zip") returned 4 [0194.426] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.426] lstrlenW (lpString=".rar") returned 4 [0194.426] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.426] lstrlenW (lpString=".bz2") returned 4 [0194.426] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.426] lstrlenW (lpString=".7z") returned 3 [0194.426] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.427] lstrlenW (lpString=".dbf") returned 4 [0194.427] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.427] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.427] lstrlenW (lpString=".1cd") returned 4 [0194.427] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.427] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ar\\messages.json") returned 153 [0194.427] lstrlenW (lpString=".jpg") returned 4 [0194.427] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.427] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.427] lstrlenW (lpString="messages.json") returned 13 [0194.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.427] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.427] CloseHandle (hObject=0x120) returned 1 [0194.428] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 0x2020 [0194.428] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.428] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.428] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.428] GetLastError () returned 0x0 [0194.428] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.429] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.430] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.430] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.430] SetEndOfFile (hFile=0x388) returned 1 [0194.430] CloseHandle (hObject=0x388) returned 1 [0194.430] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.430] SetEndOfFile (hFile=0x120) returned 1 [0194.431] CloseHandle (hObject=0x120) returned 1 [0194.431] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.431] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json")) returned 1 [0194.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.432] lstrlenW (lpString=".doc") returned 4 [0194.432] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.432] lstrlenW (lpString=".docx") returned 5 [0194.432] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.432] lstrlenW (lpString=".pdf") returned 4 [0194.432] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.432] lstrlenW (lpString=".xls") returned 4 [0194.432] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.432] lstrlenW (lpString=".xlsx") returned 5 [0194.432] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.432] lstrlenW (lpString=".ppt") returned 4 [0194.432] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.432] lstrlenW (lpString=".zip") returned 4 [0194.432] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.432] lstrlenW (lpString=".rar") returned 4 [0194.432] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.432] lstrlenW (lpString=".bz2") returned 4 [0194.432] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.432] lstrlenW (lpString=".7z") returned 3 [0194.432] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.432] lstrlenW (lpString=".dbf") returned 4 [0194.432] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.432] lstrlenW (lpString=".1cd") returned 4 [0194.432] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.432] lstrlenW (lpString=".jpg") returned 4 [0194.432] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.433] lstrlenW (lpString=".doc") returned 4 [0194.433] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.433] lstrlenW (lpString=".docx") returned 5 [0194.433] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.433] lstrlenW (lpString=".pdf") returned 4 [0194.433] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.433] lstrlenW (lpString=".xls") returned 4 [0194.433] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.433] lstrlenW (lpString=".xlsx") returned 5 [0194.433] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.433] lstrlenW (lpString=".ppt") returned 4 [0194.433] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.433] lstrlenW (lpString=".zip") returned 4 [0194.433] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.433] lstrlenW (lpString=".rar") returned 4 [0194.433] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.433] lstrlenW (lpString=".bz2") returned 4 [0194.433] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.433] lstrlenW (lpString=".7z") returned 3 [0194.433] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.433] lstrlenW (lpString=".dbf") returned 4 [0194.433] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.433] lstrlenW (lpString=".1cd") returned 4 [0194.433] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\bg\\messages.json") returned 153 [0194.433] lstrlenW (lpString=".jpg") returned 4 [0194.434] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.434] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.434] lstrlenW (lpString="messages.json") returned 13 [0194.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.434] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.434] CloseHandle (hObject=0x120) returned 1 [0194.434] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 0x2020 [0194.434] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.435] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.435] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.435] GetLastError () returned 0x0 [0194.435] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.436] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.437] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.437] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.437] SetEndOfFile (hFile=0x388) returned 1 [0194.437] CloseHandle (hObject=0x388) returned 1 [0194.437] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.437] SetEndOfFile (hFile=0x120) returned 1 [0194.438] CloseHandle (hObject=0x120) returned 1 [0194.438] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.438] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json")) returned 1 [0194.438] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.438] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.439] lstrlenW (lpString=".doc") returned 4 [0194.439] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.439] lstrlenW (lpString=".docx") returned 5 [0194.439] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.439] lstrlenW (lpString=".pdf") returned 4 [0194.439] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.439] lstrlenW (lpString=".xls") returned 4 [0194.439] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.439] lstrlenW (lpString=".xlsx") returned 5 [0194.439] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.439] lstrlenW (lpString=".ppt") returned 4 [0194.439] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.439] lstrlenW (lpString=".zip") returned 4 [0194.439] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.439] lstrlenW (lpString=".rar") returned 4 [0194.439] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.439] lstrlenW (lpString=".bz2") returned 4 [0194.439] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.439] lstrlenW (lpString=".7z") returned 3 [0194.439] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.439] lstrlenW (lpString=".dbf") returned 4 [0194.439] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.439] lstrlenW (lpString=".1cd") returned 4 [0194.439] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.439] lstrlenW (lpString=".jpg") returned 4 [0194.439] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.440] lstrlenW (lpString=".doc") returned 4 [0194.440] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.440] lstrlenW (lpString=".docx") returned 5 [0194.440] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.440] lstrlenW (lpString=".pdf") returned 4 [0194.440] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.440] lstrlenW (lpString=".xls") returned 4 [0194.440] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.440] lstrlenW (lpString=".xlsx") returned 5 [0194.440] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.440] lstrlenW (lpString=".ppt") returned 4 [0194.440] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.440] lstrlenW (lpString=".zip") returned 4 [0194.440] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.440] lstrlenW (lpString=".rar") returned 4 [0194.440] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.440] lstrlenW (lpString=".bz2") returned 4 [0194.440] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.440] lstrlenW (lpString=".7z") returned 3 [0194.440] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.440] lstrlenW (lpString=".dbf") returned 4 [0194.440] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.440] lstrlenW (lpString=".1cd") returned 4 [0194.440] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ca\\messages.json") returned 153 [0194.440] lstrlenW (lpString=".jpg") returned 4 [0194.441] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.441] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.441] lstrlenW (lpString="messages.json") returned 13 [0194.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.441] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.441] CloseHandle (hObject=0x120) returned 1 [0194.441] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 0x2020 [0194.441] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.442] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.442] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.442] GetLastError () returned 0x0 [0194.442] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.471] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.472] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.472] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.472] SetEndOfFile (hFile=0x388) returned 1 [0194.472] CloseHandle (hObject=0x388) returned 1 [0194.472] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.472] SetEndOfFile (hFile=0x120) returned 1 [0194.473] CloseHandle (hObject=0x120) returned 1 [0194.473] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.473] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json")) returned 1 [0194.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.473] lstrlenW (lpString=".doc") returned 4 [0194.473] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.473] lstrlenW (lpString=".docx") returned 5 [0194.474] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.474] lstrlenW (lpString=".pdf") returned 4 [0194.474] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.474] lstrlenW (lpString=".xls") returned 4 [0194.474] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.474] lstrlenW (lpString=".xlsx") returned 5 [0194.474] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.474] lstrlenW (lpString=".ppt") returned 4 [0194.474] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.474] lstrlenW (lpString=".zip") returned 4 [0194.474] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.474] lstrlenW (lpString=".rar") returned 4 [0194.474] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.474] lstrlenW (lpString=".bz2") returned 4 [0194.474] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.474] lstrlenW (lpString=".7z") returned 3 [0194.474] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.474] lstrlenW (lpString=".dbf") returned 4 [0194.474] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.474] lstrlenW (lpString=".1cd") returned 4 [0194.474] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.474] lstrlenW (lpString=".jpg") returned 4 [0194.474] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.474] lstrlenW (lpString=".doc") returned 4 [0194.474] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.475] lstrlenW (lpString=".docx") returned 5 [0194.475] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.475] lstrlenW (lpString=".pdf") returned 4 [0194.475] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.475] lstrlenW (lpString=".xls") returned 4 [0194.475] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.475] lstrlenW (lpString=".xlsx") returned 5 [0194.475] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.475] lstrlenW (lpString=".ppt") returned 4 [0194.475] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.475] lstrlenW (lpString=".zip") returned 4 [0194.475] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.475] lstrlenW (lpString=".rar") returned 4 [0194.475] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.475] lstrlenW (lpString=".bz2") returned 4 [0194.475] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.475] lstrlenW (lpString=".7z") returned 3 [0194.475] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.475] lstrlenW (lpString=".dbf") returned 4 [0194.475] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.475] lstrlenW (lpString=".1cd") returned 4 [0194.475] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\cs\\messages.json") returned 153 [0194.475] lstrlenW (lpString=".jpg") returned 4 [0194.475] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.476] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.476] lstrlenW (lpString="messages.json") returned 13 [0194.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.476] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.476] CloseHandle (hObject=0x120) returned 1 [0194.476] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 0x2020 [0194.476] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.476] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.476] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.477] GetLastError () returned 0x0 [0194.477] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.478] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.479] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.479] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.479] SetEndOfFile (hFile=0x388) returned 1 [0194.479] CloseHandle (hObject=0x388) returned 1 [0194.479] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.479] SetEndOfFile (hFile=0x120) returned 1 [0194.480] CloseHandle (hObject=0x120) returned 1 [0194.480] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.480] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json")) returned 1 [0194.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.480] lstrlenW (lpString=".doc") returned 4 [0194.480] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.480] lstrlenW (lpString=".docx") returned 5 [0194.480] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.480] lstrlenW (lpString=".pdf") returned 4 [0194.480] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.480] lstrlenW (lpString=".xls") returned 4 [0194.481] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.481] lstrlenW (lpString=".xlsx") returned 5 [0194.481] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.481] lstrlenW (lpString=".ppt") returned 4 [0194.481] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.481] lstrlenW (lpString=".zip") returned 4 [0194.481] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.481] lstrlenW (lpString=".rar") returned 4 [0194.481] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.481] lstrlenW (lpString=".bz2") returned 4 [0194.481] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.481] lstrlenW (lpString=".7z") returned 3 [0194.481] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.481] lstrlenW (lpString=".dbf") returned 4 [0194.481] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.481] lstrlenW (lpString=".1cd") returned 4 [0194.481] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.481] lstrlenW (lpString=".jpg") returned 4 [0194.481] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.493] lstrlenW (lpString=".doc") returned 4 [0194.493] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.493] lstrlenW (lpString=".docx") returned 5 [0194.493] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.493] lstrlenW (lpString=".pdf") returned 4 [0194.493] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.493] lstrlenW (lpString=".xls") returned 4 [0194.493] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.493] lstrlenW (lpString=".xlsx") returned 5 [0194.493] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.493] lstrlenW (lpString=".ppt") returned 4 [0194.493] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.493] lstrlenW (lpString=".zip") returned 4 [0194.493] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.493] lstrlenW (lpString=".rar") returned 4 [0194.493] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.493] lstrlenW (lpString=".bz2") returned 4 [0194.493] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.493] lstrlenW (lpString=".7z") returned 3 [0194.494] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.494] lstrlenW (lpString=".dbf") returned 4 [0194.494] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.494] lstrlenW (lpString=".1cd") returned 4 [0194.494] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\es\\messages.json") returned 153 [0194.494] lstrlenW (lpString=".jpg") returned 4 [0194.494] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.494] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.494] lstrlenW (lpString="messages.json") returned 13 [0194.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.495] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.495] CloseHandle (hObject=0x120) returned 1 [0194.495] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 0x2020 [0194.495] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.495] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.495] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.496] GetLastError () returned 0x0 [0194.496] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.497] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.498] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.498] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.498] SetEndOfFile (hFile=0x388) returned 1 [0194.498] CloseHandle (hObject=0x388) returned 1 [0194.498] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.498] SetEndOfFile (hFile=0x120) returned 1 [0194.499] CloseHandle (hObject=0x120) returned 1 [0194.499] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.499] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json")) returned 1 [0194.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.499] lstrlenW (lpString=".doc") returned 4 [0194.499] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.499] lstrlenW (lpString=".docx") returned 5 [0194.499] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.499] lstrlenW (lpString=".pdf") returned 4 [0194.499] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.500] lstrlenW (lpString=".xls") returned 4 [0194.500] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.500] lstrlenW (lpString=".xlsx") returned 5 [0194.500] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.500] lstrlenW (lpString=".ppt") returned 4 [0194.500] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.500] lstrlenW (lpString=".zip") returned 4 [0194.500] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.500] lstrlenW (lpString=".rar") returned 4 [0194.500] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.500] lstrlenW (lpString=".bz2") returned 4 [0194.500] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.500] lstrlenW (lpString=".7z") returned 3 [0194.500] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.500] lstrlenW (lpString=".dbf") returned 4 [0194.500] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.500] lstrlenW (lpString=".1cd") returned 4 [0194.500] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.500] lstrlenW (lpString=".jpg") returned 4 [0194.500] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.500] lstrlenW (lpString=".doc") returned 4 [0194.500] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.500] lstrlenW (lpString=".docx") returned 5 [0194.500] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.500] lstrlenW (lpString=".pdf") returned 4 [0194.500] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.501] lstrlenW (lpString=".xls") returned 4 [0194.501] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.501] lstrlenW (lpString=".xlsx") returned 5 [0194.501] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.501] lstrlenW (lpString=".ppt") returned 4 [0194.501] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.501] lstrlenW (lpString=".zip") returned 4 [0194.501] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.501] lstrlenW (lpString=".rar") returned 4 [0194.501] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.501] lstrlenW (lpString=".bz2") returned 4 [0194.501] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.501] lstrlenW (lpString=".7z") returned 3 [0194.501] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.501] lstrlenW (lpString=".dbf") returned 4 [0194.501] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.501] lstrlenW (lpString=".1cd") returned 4 [0194.501] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fi\\messages.json") returned 153 [0194.502] lstrlenW (lpString=".jpg") returned 4 [0194.502] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.502] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.503] lstrlenW (lpString="messages.json") returned 13 [0194.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.504] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.504] CloseHandle (hObject=0x120) returned 1 [0194.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 0x2020 [0194.504] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.504] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.504] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.505] GetLastError () returned 0x0 [0194.505] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.506] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.506] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.506] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.507] SetEndOfFile (hFile=0x388) returned 1 [0194.507] CloseHandle (hObject=0x388) returned 1 [0194.507] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.507] SetEndOfFile (hFile=0x120) returned 1 [0194.508] CloseHandle (hObject=0x120) returned 1 [0194.508] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.508] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json")) returned 1 [0194.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.508] lstrlenW (lpString=".doc") returned 4 [0194.508] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.508] lstrlenW (lpString=".docx") returned 5 [0194.508] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.508] lstrlenW (lpString=".pdf") returned 4 [0194.508] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.508] lstrlenW (lpString=".xls") returned 4 [0194.508] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.508] lstrlenW (lpString=".xlsx") returned 5 [0194.508] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.508] lstrlenW (lpString=".ppt") returned 4 [0194.508] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.508] lstrlenW (lpString=".zip") returned 4 [0194.509] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.509] lstrlenW (lpString=".rar") returned 4 [0194.509] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.509] lstrlenW (lpString=".bz2") returned 4 [0194.509] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.509] lstrlenW (lpString=".7z") returned 3 [0194.509] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.509] lstrlenW (lpString=".dbf") returned 4 [0194.509] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.509] lstrlenW (lpString=".1cd") returned 4 [0194.509] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.509] lstrlenW (lpString=".jpg") returned 4 [0194.509] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.509] lstrlenW (lpString=".doc") returned 4 [0194.509] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.509] lstrlenW (lpString=".docx") returned 5 [0194.509] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.509] lstrlenW (lpString=".pdf") returned 4 [0194.509] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.509] lstrlenW (lpString=".xls") returned 4 [0194.509] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.509] lstrlenW (lpString=".xlsx") returned 5 [0194.509] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.509] lstrlenW (lpString=".ppt") returned 4 [0194.509] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.509] lstrlenW (lpString=".zip") returned 4 [0194.510] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.510] lstrlenW (lpString=".rar") returned 4 [0194.510] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.510] lstrlenW (lpString=".bz2") returned 4 [0194.510] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.510] lstrlenW (lpString=".7z") returned 3 [0194.510] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.510] lstrlenW (lpString=".dbf") returned 4 [0194.510] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.510] lstrlenW (lpString=".1cd") returned 4 [0194.510] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fil\\messages.json") returned 154 [0194.510] lstrlenW (lpString=".jpg") returned 4 [0194.510] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.510] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.510] lstrlenW (lpString="messages.json") returned 13 [0194.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.511] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.511] CloseHandle (hObject=0x120) returned 1 [0194.511] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 0x2020 [0194.511] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.511] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.511] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.511] GetLastError () returned 0x0 [0194.512] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.512] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.514] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.514] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.514] SetEndOfFile (hFile=0x388) returned 1 [0194.514] CloseHandle (hObject=0x388) returned 1 [0194.514] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.514] SetEndOfFile (hFile=0x120) returned 1 [0194.515] CloseHandle (hObject=0x120) returned 1 [0194.515] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.515] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json")) returned 1 [0194.515] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.515] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.515] lstrlenW (lpString=".doc") returned 4 [0194.515] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.515] lstrlenW (lpString=".docx") returned 5 [0194.515] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.515] lstrlenW (lpString=".pdf") returned 4 [0194.515] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.515] lstrlenW (lpString=".xls") returned 4 [0194.515] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.515] lstrlenW (lpString=".xlsx") returned 5 [0194.516] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.516] lstrlenW (lpString=".ppt") returned 4 [0194.516] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.516] lstrlenW (lpString=".zip") returned 4 [0194.516] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.516] lstrlenW (lpString=".rar") returned 4 [0194.516] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.516] lstrlenW (lpString=".bz2") returned 4 [0194.516] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.516] lstrlenW (lpString=".7z") returned 3 [0194.516] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.516] lstrlenW (lpString=".dbf") returned 4 [0194.516] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.516] lstrlenW (lpString=".1cd") returned 4 [0194.516] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.516] lstrlenW (lpString=".jpg") returned 4 [0194.516] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.516] lstrlenW (lpString=".doc") returned 4 [0194.516] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.516] lstrlenW (lpString=".docx") returned 5 [0194.516] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.516] lstrlenW (lpString=".pdf") returned 4 [0194.516] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.516] lstrlenW (lpString=".xls") returned 4 [0194.516] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.517] lstrlenW (lpString=".xlsx") returned 5 [0194.517] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.517] lstrlenW (lpString=".ppt") returned 4 [0194.517] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.517] lstrlenW (lpString=".zip") returned 4 [0194.517] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.517] lstrlenW (lpString=".rar") returned 4 [0194.517] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.517] lstrlenW (lpString=".bz2") returned 4 [0194.517] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.517] lstrlenW (lpString=".7z") returned 3 [0194.517] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.517] lstrlenW (lpString=".dbf") returned 4 [0194.517] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.517] lstrlenW (lpString=".1cd") returned 4 [0194.517] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\fr\\messages.json") returned 153 [0194.517] lstrlenW (lpString=".jpg") returned 4 [0194.517] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.517] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.517] lstrlenW (lpString="messages.json") returned 13 [0194.517] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.518] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.518] CloseHandle (hObject=0x120) returned 1 [0194.519] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 0x2020 [0194.519] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.519] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.519] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.519] GetLastError () returned 0x0 [0194.519] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.554] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.555] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.555] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.555] SetEndOfFile (hFile=0x388) returned 1 [0194.555] CloseHandle (hObject=0x388) returned 1 [0194.555] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.555] SetEndOfFile (hFile=0x120) returned 1 [0194.556] CloseHandle (hObject=0x120) returned 1 [0194.556] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.556] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json")) returned 1 [0194.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.557] lstrlenW (lpString=".doc") returned 4 [0194.557] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.557] lstrlenW (lpString=".docx") returned 5 [0194.557] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.557] lstrlenW (lpString=".pdf") returned 4 [0194.557] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.557] lstrlenW (lpString=".xls") returned 4 [0194.557] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.557] lstrlenW (lpString=".xlsx") returned 5 [0194.557] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.557] lstrlenW (lpString=".ppt") returned 4 [0194.557] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.557] lstrlenW (lpString=".zip") returned 4 [0194.557] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.557] lstrlenW (lpString=".rar") returned 4 [0194.557] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.557] lstrlenW (lpString=".bz2") returned 4 [0194.557] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.557] lstrlenW (lpString=".7z") returned 3 [0194.557] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.557] lstrlenW (lpString=".dbf") returned 4 [0194.557] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.557] lstrlenW (lpString=".1cd") returned 4 [0194.557] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.557] lstrlenW (lpString=".jpg") returned 4 [0194.557] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.558] lstrlenW (lpString=".doc") returned 4 [0194.558] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.558] lstrlenW (lpString=".docx") returned 5 [0194.558] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.558] lstrlenW (lpString=".pdf") returned 4 [0194.558] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.558] lstrlenW (lpString=".xls") returned 4 [0194.558] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.558] lstrlenW (lpString=".xlsx") returned 5 [0194.558] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.558] lstrlenW (lpString=".ppt") returned 4 [0194.558] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.558] lstrlenW (lpString=".zip") returned 4 [0194.558] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.558] lstrlenW (lpString=".rar") returned 4 [0194.558] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.558] lstrlenW (lpString=".bz2") returned 4 [0194.558] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.558] lstrlenW (lpString=".7z") returned 3 [0194.558] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.558] lstrlenW (lpString=".dbf") returned 4 [0194.558] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.558] lstrlenW (lpString=".1cd") returned 4 [0194.558] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\he\\messages.json") returned 153 [0194.559] lstrlenW (lpString=".jpg") returned 4 [0194.559] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.559] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.559] lstrlenW (lpString="messages.json") returned 13 [0194.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.559] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.559] CloseHandle (hObject=0x120) returned 1 [0194.559] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 0x2020 [0194.559] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.560] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.560] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.562] GetLastError () returned 0x0 [0194.562] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.563] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.564] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.564] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.564] SetEndOfFile (hFile=0x388) returned 1 [0194.564] CloseHandle (hObject=0x388) returned 1 [0194.564] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.564] SetEndOfFile (hFile=0x120) returned 1 [0194.565] CloseHandle (hObject=0x120) returned 1 [0194.565] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.565] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json")) returned 1 [0194.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.565] lstrlenW (lpString=".doc") returned 4 [0194.565] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.565] lstrlenW (lpString=".docx") returned 5 [0194.565] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.565] lstrlenW (lpString=".pdf") returned 4 [0194.565] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.565] lstrlenW (lpString=".xls") returned 4 [0194.565] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.565] lstrlenW (lpString=".xlsx") returned 5 [0194.565] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.565] lstrlenW (lpString=".ppt") returned 4 [0194.565] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.565] lstrlenW (lpString=".zip") returned 4 [0194.565] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.566] lstrlenW (lpString=".rar") returned 4 [0194.566] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.566] lstrlenW (lpString=".bz2") returned 4 [0194.566] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.566] lstrlenW (lpString=".7z") returned 3 [0194.566] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.566] lstrlenW (lpString=".dbf") returned 4 [0194.566] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.566] lstrlenW (lpString=".1cd") returned 4 [0194.566] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.566] lstrlenW (lpString=".jpg") returned 4 [0194.566] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.566] lstrlenW (lpString=".doc") returned 4 [0194.566] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.566] lstrlenW (lpString=".docx") returned 5 [0194.566] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.566] lstrlenW (lpString=".pdf") returned 4 [0194.566] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.566] lstrlenW (lpString=".xls") returned 4 [0194.566] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.566] lstrlenW (lpString=".xlsx") returned 5 [0194.566] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.566] lstrlenW (lpString=".ppt") returned 4 [0194.566] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.567] lstrlenW (lpString=".zip") returned 4 [0194.567] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.567] lstrlenW (lpString=".rar") returned 4 [0194.567] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.567] lstrlenW (lpString=".bz2") returned 4 [0194.567] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.567] lstrlenW (lpString=".7z") returned 3 [0194.567] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.567] lstrlenW (lpString=".dbf") returned 4 [0194.567] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.567] lstrlenW (lpString=".1cd") returned 4 [0194.567] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ja\\messages.json") returned 153 [0194.567] lstrlenW (lpString=".jpg") returned 4 [0194.567] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.567] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.567] lstrlenW (lpString="messages.json") returned 13 [0194.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.568] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.569] CloseHandle (hObject=0x120) returned 1 [0194.569] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 0x2020 [0194.569] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.569] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.569] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.569] GetLastError () returned 0x0 [0194.569] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.570] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.571] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.571] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.571] SetEndOfFile (hFile=0x388) returned 1 [0194.571] CloseHandle (hObject=0x388) returned 1 [0194.571] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.571] SetEndOfFile (hFile=0x120) returned 1 [0194.572] CloseHandle (hObject=0x120) returned 1 [0194.572] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.572] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json")) returned 1 [0194.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.573] lstrlenW (lpString=".doc") returned 4 [0194.573] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.573] lstrlenW (lpString=".docx") returned 5 [0194.573] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.573] lstrlenW (lpString=".pdf") returned 4 [0194.573] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.573] lstrlenW (lpString=".xls") returned 4 [0194.573] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.573] lstrlenW (lpString=".xlsx") returned 5 [0194.573] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.573] lstrlenW (lpString=".ppt") returned 4 [0194.573] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.573] lstrlenW (lpString=".zip") returned 4 [0194.573] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.573] lstrlenW (lpString=".rar") returned 4 [0194.573] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.573] lstrlenW (lpString=".bz2") returned 4 [0194.573] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.573] lstrlenW (lpString=".7z") returned 3 [0194.573] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.573] lstrlenW (lpString=".dbf") returned 4 [0194.573] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.573] lstrlenW (lpString=".1cd") returned 4 [0194.573] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.574] lstrlenW (lpString=".jpg") returned 4 [0194.574] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.574] lstrlenW (lpString=".doc") returned 4 [0194.574] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.574] lstrlenW (lpString=".docx") returned 5 [0194.574] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.574] lstrlenW (lpString=".pdf") returned 4 [0194.574] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.574] lstrlenW (lpString=".xls") returned 4 [0194.574] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.574] lstrlenW (lpString=".xlsx") returned 5 [0194.574] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.574] lstrlenW (lpString=".ppt") returned 4 [0194.574] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.574] lstrlenW (lpString=".zip") returned 4 [0194.574] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.574] lstrlenW (lpString=".rar") returned 4 [0194.574] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.574] lstrlenW (lpString=".bz2") returned 4 [0194.574] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.574] lstrlenW (lpString=".7z") returned 3 [0194.574] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.574] lstrlenW (lpString=".dbf") returned 4 [0194.574] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.574] lstrlenW (lpString=".1cd") returned 4 [0194.574] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ko\\messages.json") returned 153 [0194.575] lstrlenW (lpString=".jpg") returned 4 [0194.575] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.575] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.575] lstrlenW (lpString="messages.json") returned 13 [0194.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.575] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.575] CloseHandle (hObject=0x120) returned 1 [0194.576] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 0x2020 [0194.576] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.576] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.576] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.576] GetLastError () returned 0x0 [0194.576] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.577] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.578] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.578] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.578] SetEndOfFile (hFile=0x388) returned 1 [0194.578] CloseHandle (hObject=0x388) returned 1 [0194.578] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.578] SetEndOfFile (hFile=0x120) returned 1 [0194.579] CloseHandle (hObject=0x120) returned 1 [0194.579] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.579] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json")) returned 1 [0194.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.580] lstrlenW (lpString=".doc") returned 4 [0194.580] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.580] lstrlenW (lpString=".docx") returned 5 [0194.580] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.580] lstrlenW (lpString=".pdf") returned 4 [0194.580] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.580] lstrlenW (lpString=".xls") returned 4 [0194.580] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.580] lstrlenW (lpString=".xlsx") returned 5 [0194.580] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.580] lstrlenW (lpString=".ppt") returned 4 [0194.580] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.580] lstrlenW (lpString=".zip") returned 4 [0194.580] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.580] lstrlenW (lpString=".rar") returned 4 [0194.580] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.580] lstrlenW (lpString=".bz2") returned 4 [0194.580] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.580] lstrlenW (lpString=".7z") returned 3 [0194.580] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.580] lstrlenW (lpString=".dbf") returned 4 [0194.580] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.580] lstrlenW (lpString=".1cd") returned 4 [0194.581] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.581] lstrlenW (lpString=".jpg") returned 4 [0194.581] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.581] lstrlenW (lpString=".doc") returned 4 [0194.581] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.581] lstrlenW (lpString=".docx") returned 5 [0194.581] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.581] lstrlenW (lpString=".pdf") returned 4 [0194.581] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.581] lstrlenW (lpString=".xls") returned 4 [0194.581] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.581] lstrlenW (lpString=".xlsx") returned 5 [0194.581] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.581] lstrlenW (lpString=".ppt") returned 4 [0194.581] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.581] lstrlenW (lpString=".zip") returned 4 [0194.581] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.581] lstrlenW (lpString=".rar") returned 4 [0194.581] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.581] lstrlenW (lpString=".bz2") returned 4 [0194.581] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.581] lstrlenW (lpString=".7z") returned 3 [0194.581] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.581] lstrlenW (lpString=".dbf") returned 4 [0194.581] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.581] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.582] lstrlenW (lpString=".1cd") returned 4 [0194.582] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.582] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lt\\messages.json") returned 153 [0194.582] lstrlenW (lpString=".jpg") returned 4 [0194.582] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.582] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.582] lstrlenW (lpString="messages.json") returned 13 [0194.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.582] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.582] CloseHandle (hObject=0x120) returned 1 [0194.582] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 0x2020 [0194.582] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.583] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.583] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.583] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.583] GetLastError () returned 0x0 [0194.583] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.584] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.585] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.585] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.585] SetEndOfFile (hFile=0x388) returned 1 [0194.585] CloseHandle (hObject=0x388) returned 1 [0194.585] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.585] SetEndOfFile (hFile=0x120) returned 1 [0194.586] CloseHandle (hObject=0x120) returned 1 [0194.586] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.586] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json")) returned 1 [0194.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.587] lstrlenW (lpString=".doc") returned 4 [0194.587] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.587] lstrlenW (lpString=".docx") returned 5 [0194.587] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.587] lstrlenW (lpString=".pdf") returned 4 [0194.587] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.587] lstrlenW (lpString=".xls") returned 4 [0194.587] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.587] lstrlenW (lpString=".xlsx") returned 5 [0194.587] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.587] lstrlenW (lpString=".ppt") returned 4 [0194.587] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.587] lstrlenW (lpString=".zip") returned 4 [0194.587] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.587] lstrlenW (lpString=".rar") returned 4 [0194.587] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.587] lstrlenW (lpString=".bz2") returned 4 [0194.587] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.587] lstrlenW (lpString=".7z") returned 3 [0194.587] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.587] lstrlenW (lpString=".dbf") returned 4 [0194.587] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.587] lstrlenW (lpString=".1cd") returned 4 [0194.587] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.587] lstrlenW (lpString=".jpg") returned 4 [0194.587] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.588] lstrlenW (lpString=".doc") returned 4 [0194.588] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.588] lstrlenW (lpString=".docx") returned 5 [0194.588] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.588] lstrlenW (lpString=".pdf") returned 4 [0194.588] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.588] lstrlenW (lpString=".xls") returned 4 [0194.588] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.588] lstrlenW (lpString=".xlsx") returned 5 [0194.588] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.588] lstrlenW (lpString=".ppt") returned 4 [0194.588] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.588] lstrlenW (lpString=".zip") returned 4 [0194.588] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.588] lstrlenW (lpString=".rar") returned 4 [0194.588] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.588] lstrlenW (lpString=".bz2") returned 4 [0194.588] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.588] lstrlenW (lpString=".7z") returned 3 [0194.588] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.588] lstrlenW (lpString=".dbf") returned 4 [0194.588] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.588] lstrlenW (lpString=".1cd") returned 4 [0194.588] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\lv\\messages.json") returned 153 [0194.588] lstrlenW (lpString=".jpg") returned 4 [0194.588] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.589] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.589] lstrlenW (lpString="messages.json") returned 13 [0194.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.589] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0194.589] CloseHandle (hObject=0x120) returned 1 [0194.589] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 0x2020 [0194.589] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.589] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.590] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.590] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.590] GetLastError () returned 0x0 [0194.590] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.796] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.797] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.797] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.797] SetEndOfFile (hFile=0x388) returned 1 [0194.797] CloseHandle (hObject=0x388) returned 1 [0194.797] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.797] SetEndOfFile (hFile=0x120) returned 1 [0194.800] CloseHandle (hObject=0x120) returned 1 [0194.800] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.800] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json")) returned 1 [0194.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.800] lstrlenW (lpString=".doc") returned 4 [0194.800] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.800] lstrlenW (lpString=".docx") returned 5 [0194.800] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.800] lstrlenW (lpString=".pdf") returned 4 [0194.800] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.800] lstrlenW (lpString=".xls") returned 4 [0194.800] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.800] lstrlenW (lpString=".xlsx") returned 5 [0194.800] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.800] lstrlenW (lpString=".ppt") returned 4 [0194.800] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.800] lstrlenW (lpString=".zip") returned 4 [0194.801] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.801] lstrlenW (lpString=".rar") returned 4 [0194.801] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.801] lstrlenW (lpString=".bz2") returned 4 [0194.801] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.801] lstrlenW (lpString=".7z") returned 3 [0194.801] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.801] lstrlenW (lpString=".dbf") returned 4 [0194.801] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.801] lstrlenW (lpString=".1cd") returned 4 [0194.801] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.801] lstrlenW (lpString=".jpg") returned 4 [0194.801] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.801] lstrlenW (lpString=".doc") returned 4 [0194.801] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.801] lstrlenW (lpString=".docx") returned 5 [0194.801] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.801] lstrlenW (lpString=".pdf") returned 4 [0194.801] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.801] lstrlenW (lpString=".xls") returned 4 [0194.801] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.801] lstrlenW (lpString=".xlsx") returned 5 [0194.801] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.802] lstrlenW (lpString=".ppt") returned 4 [0194.802] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.802] lstrlenW (lpString=".zip") returned 4 [0194.802] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.802] lstrlenW (lpString=".rar") returned 4 [0194.802] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.802] lstrlenW (lpString=".bz2") returned 4 [0194.802] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.802] lstrlenW (lpString=".7z") returned 3 [0194.802] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.802] lstrlenW (lpString=".dbf") returned 4 [0194.802] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.802] lstrlenW (lpString=".1cd") returned 4 [0194.802] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\nl\\messages.json") returned 153 [0194.802] lstrlenW (lpString=".jpg") returned 4 [0194.802] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.802] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0194.802] lstrlenW (lpString="icon_128.png") returned 12 [0194.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.803] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3399) returned 1 [0194.803] CloseHandle (hObject=0x120) returned 1 [0194.803] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 0x2020 [0194.803] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.803] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.804] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.804] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.804] GetLastError () returned 0x0 [0194.804] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd47, lpOverlapped=0x0) returned 1 [0194.806] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xd50, lpOverlapped=0x0) returned 1 [0194.807] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.807] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0194.807] SetEndOfFile (hFile=0x388) returned 1 [0194.807] CloseHandle (hObject=0x388) returned 1 [0194.807] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.807] SetEndOfFile (hFile=0x120) returned 1 [0194.808] CloseHandle (hObject=0x120) returned 1 [0194.808] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.808] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png")) returned 1 [0194.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.808] lstrlenW (lpString=".doc") returned 4 [0194.808] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0194.808] lstrlenW (lpString=".docx") returned 5 [0194.809] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0194.809] lstrlenW (lpString=".pdf") returned 4 [0194.809] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0194.809] lstrlenW (lpString=".xls") returned 4 [0194.809] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0194.809] lstrlenW (lpString=".xlsx") returned 5 [0194.809] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0194.809] lstrlenW (lpString=".ppt") returned 4 [0194.809] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0194.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.809] lstrlenW (lpString=".zip") returned 4 [0194.810] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0194.810] lstrlenW (lpString=".rar") returned 4 [0194.810] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0194.810] lstrlenW (lpString=".bz2") returned 4 [0194.810] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0194.810] lstrlenW (lpString=".7z") returned 3 [0194.810] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0194.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.810] lstrlenW (lpString=".dbf") returned 4 [0194.810] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0194.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.810] lstrlenW (lpString=".1cd") returned 4 [0194.810] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0194.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.810] lstrlenW (lpString=".jpg") returned 4 [0194.810] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0194.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.810] lstrlenW (lpString=".doc") returned 4 [0194.810] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0194.810] lstrlenW (lpString=".docx") returned 5 [0194.810] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0194.810] lstrlenW (lpString=".pdf") returned 4 [0194.810] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0194.810] lstrlenW (lpString=".xls") returned 4 [0194.810] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0194.810] lstrlenW (lpString=".xlsx") returned 5 [0194.810] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0194.811] lstrlenW (lpString=".ppt") returned 4 [0194.811] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0194.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.811] lstrlenW (lpString=".zip") returned 4 [0194.811] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0194.811] lstrlenW (lpString=".rar") returned 4 [0194.811] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0194.811] lstrlenW (lpString=".bz2") returned 4 [0194.811] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0194.811] lstrlenW (lpString=".7z") returned 3 [0194.811] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0194.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.811] lstrlenW (lpString=".dbf") returned 4 [0194.811] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0194.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.811] lstrlenW (lpString=".1cd") returned 4 [0194.811] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0194.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_128.png") returned 138 [0194.811] lstrlenW (lpString=".jpg") returned 4 [0194.811] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0194.811] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0194.811] lstrlenW (lpString="icon_16.png") returned 11 [0194.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.812] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=157) returned 1 [0194.812] CloseHandle (hObject=0x120) returned 1 [0194.812] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 0x2020 [0194.812] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.812] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.812] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.813] GetLastError () returned 0x0 [0194.813] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x9d, lpOverlapped=0x0) returned 1 [0194.814] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0194.815] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.815] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0194.815] SetEndOfFile (hFile=0x388) returned 1 [0194.815] CloseHandle (hObject=0x388) returned 1 [0194.815] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.815] SetEndOfFile (hFile=0x120) returned 1 [0194.816] CloseHandle (hObject=0x120) returned 1 [0194.816] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.816] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png")) returned 1 [0194.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.816] lstrlenW (lpString=".doc") returned 4 [0194.816] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0194.817] lstrlenW (lpString=".docx") returned 5 [0194.817] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0194.817] lstrlenW (lpString=".pdf") returned 4 [0194.817] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0194.817] lstrlenW (lpString=".xls") returned 4 [0194.817] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0194.817] lstrlenW (lpString=".xlsx") returned 5 [0194.817] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0194.817] lstrlenW (lpString=".ppt") returned 4 [0194.817] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0194.817] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.817] lstrlenW (lpString=".zip") returned 4 [0194.817] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0194.817] lstrlenW (lpString=".rar") returned 4 [0194.817] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0194.817] lstrlenW (lpString=".bz2") returned 4 [0194.817] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0194.817] lstrlenW (lpString=".7z") returned 3 [0194.817] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0194.817] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.817] lstrlenW (lpString=".dbf") returned 4 [0194.817] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0194.817] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.817] lstrlenW (lpString=".1cd") returned 4 [0194.817] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0194.817] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.817] lstrlenW (lpString=".jpg") returned 4 [0194.817] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0194.817] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.817] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.818] lstrlenW (lpString=".doc") returned 4 [0194.818] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0194.818] lstrlenW (lpString=".docx") returned 5 [0194.818] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0194.818] lstrlenW (lpString=".pdf") returned 4 [0194.818] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0194.818] lstrlenW (lpString=".xls") returned 4 [0194.818] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0194.818] lstrlenW (lpString=".xlsx") returned 5 [0194.818] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0194.818] lstrlenW (lpString=".ppt") returned 4 [0194.818] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0194.818] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.818] lstrlenW (lpString=".zip") returned 4 [0194.818] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0194.818] lstrlenW (lpString=".rar") returned 4 [0194.818] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0194.818] lstrlenW (lpString=".bz2") returned 4 [0194.818] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0194.818] lstrlenW (lpString=".7z") returned 3 [0194.818] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0194.818] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.818] lstrlenW (lpString=".dbf") returned 4 [0194.818] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0194.818] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.818] lstrlenW (lpString=".1cd") returned 4 [0194.818] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0194.818] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\icon_16.png") returned 137 [0194.818] lstrlenW (lpString=".jpg") returned 4 [0194.818] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0194.819] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0194.819] lstrlenW (lpString="main.html") returned 9 [0194.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.819] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=92) returned 1 [0194.819] CloseHandle (hObject=0x120) returned 1 [0194.819] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 0x2020 [0194.819] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.819] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.819] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.820] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.820] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.820] GetLastError () returned 0x0 [0194.820] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x5c, lpOverlapped=0x0) returned 1 [0194.821] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x60, lpOverlapped=0x0) returned 1 [0194.822] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.822] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0194.822] SetEndOfFile (hFile=0x388) returned 1 [0194.822] CloseHandle (hObject=0x388) returned 1 [0194.822] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.822] SetEndOfFile (hFile=0x120) returned 1 [0194.823] CloseHandle (hObject=0x120) returned 1 [0194.823] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.823] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html")) returned 1 [0194.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.824] lstrlenW (lpString=".doc") returned 4 [0194.824] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0194.824] lstrlenW (lpString=".docx") returned 5 [0194.824] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0194.824] lstrlenW (lpString=".pdf") returned 4 [0194.824] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0194.824] lstrlenW (lpString=".xls") returned 4 [0194.824] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0194.824] lstrlenW (lpString=".xlsx") returned 5 [0194.824] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0194.824] lstrlenW (lpString=".ppt") returned 4 [0194.824] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0194.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.824] lstrlenW (lpString=".zip") returned 4 [0194.824] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0194.824] lstrlenW (lpString=".rar") returned 4 [0194.824] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0194.824] lstrlenW (lpString=".bz2") returned 4 [0194.824] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0194.824] lstrlenW (lpString=".7z") returned 3 [0194.824] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0194.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.824] lstrlenW (lpString=".dbf") returned 4 [0194.824] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0194.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.824] lstrlenW (lpString=".1cd") returned 4 [0194.824] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0194.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.824] lstrlenW (lpString=".jpg") returned 4 [0194.824] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0194.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.825] lstrlenW (lpString=".doc") returned 4 [0194.825] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0194.825] lstrlenW (lpString=".docx") returned 5 [0194.825] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0194.825] lstrlenW (lpString=".pdf") returned 4 [0194.825] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0194.825] lstrlenW (lpString=".xls") returned 4 [0194.825] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0194.825] lstrlenW (lpString=".xlsx") returned 5 [0194.825] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0194.825] lstrlenW (lpString=".ppt") returned 4 [0194.825] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0194.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.825] lstrlenW (lpString=".zip") returned 4 [0194.825] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0194.825] lstrlenW (lpString=".rar") returned 4 [0194.825] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0194.825] lstrlenW (lpString=".bz2") returned 4 [0194.825] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0194.825] lstrlenW (lpString=".7z") returned 3 [0194.826] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0194.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.826] lstrlenW (lpString=".dbf") returned 4 [0194.826] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0194.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.826] lstrlenW (lpString=".1cd") returned 4 [0194.826] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0194.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.html") returned 135 [0194.826] lstrlenW (lpString=".jpg") returned 4 [0194.826] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0194.826] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0194.826] lstrlenW (lpString="main.js") returned 7 [0194.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.826] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=95) returned 1 [0194.826] CloseHandle (hObject=0x120) returned 1 [0194.827] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 0x2020 [0194.827] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.828] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.828] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.828] GetLastError () returned 0x0 [0194.828] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x5f, lpOverlapped=0x0) returned 1 [0194.829] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x60, lpOverlapped=0x0) returned 1 [0194.830] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.830] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0194.830] SetEndOfFile (hFile=0x388) returned 1 [0194.830] CloseHandle (hObject=0x388) returned 1 [0194.830] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.830] SetEndOfFile (hFile=0x120) returned 1 [0194.831] CloseHandle (hObject=0x120) returned 1 [0194.831] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.831] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js")) returned 1 [0194.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.832] lstrlenW (lpString=".doc") returned 4 [0194.832] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0194.832] lstrlenW (lpString=".docx") returned 5 [0194.832] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0194.832] lstrlenW (lpString=".pdf") returned 4 [0194.832] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0194.832] lstrlenW (lpString=".xls") returned 4 [0194.832] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0194.832] lstrlenW (lpString=".xlsx") returned 5 [0194.832] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0194.832] lstrlenW (lpString=".ppt") returned 4 [0194.832] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0194.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.832] lstrlenW (lpString=".zip") returned 4 [0194.832] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0194.832] lstrlenW (lpString=".rar") returned 4 [0194.832] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0194.832] lstrlenW (lpString=".bz2") returned 4 [0194.832] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0194.832] lstrlenW (lpString=".7z") returned 3 [0194.832] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0194.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.832] lstrlenW (lpString=".dbf") returned 4 [0194.833] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0194.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.833] lstrlenW (lpString=".1cd") returned 4 [0194.833] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0194.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.833] lstrlenW (lpString=".jpg") returned 4 [0194.833] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0194.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.833] lstrlenW (lpString=".doc") returned 4 [0194.833] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0194.833] lstrlenW (lpString=".docx") returned 5 [0194.833] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0194.833] lstrlenW (lpString=".pdf") returned 4 [0194.833] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0194.833] lstrlenW (lpString=".xls") returned 4 [0194.833] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0194.833] lstrlenW (lpString=".xlsx") returned 5 [0194.833] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0194.833] lstrlenW (lpString=".ppt") returned 4 [0194.833] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0194.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.833] lstrlenW (lpString=".zip") returned 4 [0194.833] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0194.833] lstrlenW (lpString=".rar") returned 4 [0194.833] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0194.833] lstrlenW (lpString=".bz2") returned 4 [0194.833] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0194.833] lstrlenW (lpString=".7z") returned 3 [0194.834] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0194.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.834] lstrlenW (lpString=".dbf") returned 4 [0194.834] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0194.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.834] lstrlenW (lpString=".1cd") returned 4 [0194.834] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0194.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\main.js") returned 133 [0194.834] lstrlenW (lpString=".jpg") returned 4 [0194.834] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0194.834] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.834] lstrlenW (lpString="manifest.json") returned 13 [0194.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.834] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=726) returned 1 [0194.834] CloseHandle (hObject=0x120) returned 1 [0194.835] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json")) returned 0x2020 [0194.835] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.835] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.835] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.835] GetLastError () returned 0x0 [0194.835] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x2d6, lpOverlapped=0x0) returned 1 [0194.837] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0194.838] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.838] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.838] SetEndOfFile (hFile=0x388) returned 1 [0194.838] CloseHandle (hObject=0x388) returned 1 [0194.838] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.838] SetEndOfFile (hFile=0x120) returned 1 [0194.839] CloseHandle (hObject=0x120) returned 1 [0194.839] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.839] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json")) returned 1 [0194.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.840] lstrlenW (lpString=".doc") returned 4 [0194.840] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.840] lstrlenW (lpString=".docx") returned 5 [0194.840] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.840] lstrlenW (lpString=".pdf") returned 4 [0194.840] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.840] lstrlenW (lpString=".xls") returned 4 [0194.840] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.840] lstrlenW (lpString=".xlsx") returned 5 [0194.840] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.840] lstrlenW (lpString=".ppt") returned 4 [0194.840] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.840] lstrlenW (lpString=".zip") returned 4 [0194.840] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.840] lstrlenW (lpString=".rar") returned 4 [0194.840] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.840] lstrlenW (lpString=".bz2") returned 4 [0194.840] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.840] lstrlenW (lpString=".7z") returned 3 [0194.841] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.841] lstrlenW (lpString=".dbf") returned 4 [0194.841] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.841] lstrlenW (lpString=".1cd") returned 4 [0194.841] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.841] lstrlenW (lpString=".jpg") returned 4 [0194.841] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.841] lstrlenW (lpString=".doc") returned 4 [0194.841] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.841] lstrlenW (lpString=".docx") returned 5 [0194.841] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.841] lstrlenW (lpString=".pdf") returned 4 [0194.841] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.841] lstrlenW (lpString=".xls") returned 4 [0194.841] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.841] lstrlenW (lpString=".xlsx") returned 5 [0194.841] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.841] lstrlenW (lpString=".ppt") returned 4 [0194.841] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.841] lstrlenW (lpString=".zip") returned 4 [0194.841] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.841] lstrlenW (lpString=".rar") returned 4 [0194.841] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.841] lstrlenW (lpString=".bz2") returned 4 [0194.841] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.841] lstrlenW (lpString=".7z") returned 3 [0194.842] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.842] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.842] lstrlenW (lpString=".dbf") returned 4 [0194.842] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.842] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.842] lstrlenW (lpString=".1cd") returned 4 [0194.842] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.842] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\manifest.json") returned 139 [0194.842] lstrlenW (lpString=".jpg") returned 4 [0194.842] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.842] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.842] lstrlenW (lpString="messages.json") returned 13 [0194.842] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.843] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=254) returned 1 [0194.843] CloseHandle (hObject=0x120) returned 1 [0194.843] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json")) returned 0x2020 [0194.843] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.844] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.844] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.844] GetLastError () returned 0x0 [0194.844] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xfe, lpOverlapped=0x0) returned 1 [0194.845] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.846] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.846] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.846] SetEndOfFile (hFile=0x388) returned 1 [0194.846] CloseHandle (hObject=0x388) returned 1 [0194.846] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.847] SetEndOfFile (hFile=0x120) returned 1 [0194.847] CloseHandle (hObject=0x120) returned 1 [0194.847] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.848] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json")) returned 1 [0194.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.848] lstrlenW (lpString=".doc") returned 4 [0194.848] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.848] lstrlenW (lpString=".docx") returned 5 [0194.848] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.848] lstrlenW (lpString=".pdf") returned 4 [0194.848] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.848] lstrlenW (lpString=".xls") returned 4 [0194.848] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.848] lstrlenW (lpString=".xlsx") returned 5 [0194.848] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.848] lstrlenW (lpString=".ppt") returned 4 [0194.848] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.848] lstrlenW (lpString=".zip") returned 4 [0194.848] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.848] lstrlenW (lpString=".rar") returned 4 [0194.848] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.848] lstrlenW (lpString=".bz2") returned 4 [0194.848] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.848] lstrlenW (lpString=".7z") returned 3 [0194.849] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.849] lstrlenW (lpString=".dbf") returned 4 [0194.849] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.849] lstrlenW (lpString=".1cd") returned 4 [0194.849] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.849] lstrlenW (lpString=".jpg") returned 4 [0194.849] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.849] lstrlenW (lpString=".doc") returned 4 [0194.849] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.849] lstrlenW (lpString=".docx") returned 5 [0194.849] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.849] lstrlenW (lpString=".pdf") returned 4 [0194.849] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.849] lstrlenW (lpString=".xls") returned 4 [0194.849] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.849] lstrlenW (lpString=".xlsx") returned 5 [0194.849] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.849] lstrlenW (lpString=".ppt") returned 4 [0194.849] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.849] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.849] lstrlenW (lpString=".zip") returned 4 [0194.849] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.849] lstrlenW (lpString=".rar") returned 4 [0194.849] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.849] lstrlenW (lpString=".bz2") returned 4 [0194.850] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.850] lstrlenW (lpString=".7z") returned 3 [0194.850] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.850] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.850] lstrlenW (lpString=".dbf") returned 4 [0194.850] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.850] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.850] lstrlenW (lpString=".1cd") returned 4 [0194.850] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.850] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ar\\messages.json") returned 151 [0194.850] lstrlenW (lpString=".jpg") returned 4 [0194.850] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.850] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.850] lstrlenW (lpString="messages.json") returned 13 [0194.850] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.851] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=303) returned 1 [0194.851] CloseHandle (hObject=0x120) returned 1 [0194.851] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json")) returned 0x2020 [0194.851] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.851] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.851] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.851] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.851] GetLastError () returned 0x0 [0194.852] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x12f, lpOverlapped=0x0) returned 1 [0194.852] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x130, lpOverlapped=0x0) returned 1 [0194.853] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.853] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.854] SetEndOfFile (hFile=0x388) returned 1 [0194.854] CloseHandle (hObject=0x388) returned 1 [0194.854] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.854] SetEndOfFile (hFile=0x120) returned 1 [0194.854] CloseHandle (hObject=0x120) returned 1 [0194.855] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.855] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json")) returned 1 [0194.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.855] lstrlenW (lpString=".doc") returned 4 [0194.855] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.855] lstrlenW (lpString=".docx") returned 5 [0194.855] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.855] lstrlenW (lpString=".pdf") returned 4 [0194.855] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.855] lstrlenW (lpString=".xls") returned 4 [0194.855] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.855] lstrlenW (lpString=".xlsx") returned 5 [0194.855] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.855] lstrlenW (lpString=".ppt") returned 4 [0194.855] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.855] lstrlenW (lpString=".zip") returned 4 [0194.855] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.855] lstrlenW (lpString=".rar") returned 4 [0194.855] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.856] lstrlenW (lpString=".bz2") returned 4 [0194.856] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.856] lstrlenW (lpString=".7z") returned 3 [0194.856] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.856] lstrlenW (lpString=".dbf") returned 4 [0194.856] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.856] lstrlenW (lpString=".1cd") returned 4 [0194.856] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.856] lstrlenW (lpString=".jpg") returned 4 [0194.856] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.856] lstrlenW (lpString=".doc") returned 4 [0194.856] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.856] lstrlenW (lpString=".docx") returned 5 [0194.856] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.856] lstrlenW (lpString=".pdf") returned 4 [0194.856] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.856] lstrlenW (lpString=".xls") returned 4 [0194.856] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.856] lstrlenW (lpString=".xlsx") returned 5 [0194.856] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.856] lstrlenW (lpString=".ppt") returned 4 [0194.856] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.856] lstrlenW (lpString=".zip") returned 4 [0194.856] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.857] lstrlenW (lpString=".rar") returned 4 [0194.857] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.857] lstrlenW (lpString=".bz2") returned 4 [0194.857] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.857] lstrlenW (lpString=".7z") returned 3 [0194.857] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.857] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.857] lstrlenW (lpString=".dbf") returned 4 [0194.857] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.857] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.857] lstrlenW (lpString=".1cd") returned 4 [0194.857] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.857] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\bg\\messages.json") returned 151 [0194.857] lstrlenW (lpString=".jpg") returned 4 [0194.857] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.857] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.857] lstrlenW (lpString="messages.json") returned 13 [0194.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.858] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=229) returned 1 [0194.858] CloseHandle (hObject=0x120) returned 1 [0194.858] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json")) returned 0x2020 [0194.858] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.858] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.858] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.858] GetLastError () returned 0x0 [0194.858] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xe5, lpOverlapped=0x0) returned 1 [0194.859] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0194.860] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.860] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.860] SetEndOfFile (hFile=0x388) returned 1 [0194.861] CloseHandle (hObject=0x388) returned 1 [0194.861] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.861] SetEndOfFile (hFile=0x120) returned 1 [0194.862] CloseHandle (hObject=0x120) returned 1 [0194.862] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.862] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json")) returned 1 [0194.862] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.862] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.862] lstrlenW (lpString=".doc") returned 4 [0194.862] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.862] lstrlenW (lpString=".docx") returned 5 [0194.862] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.862] lstrlenW (lpString=".pdf") returned 4 [0194.862] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.862] lstrlenW (lpString=".xls") returned 4 [0194.862] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.862] lstrlenW (lpString=".xlsx") returned 5 [0194.862] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.862] lstrlenW (lpString=".ppt") returned 4 [0194.862] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.862] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.862] lstrlenW (lpString=".zip") returned 4 [0194.862] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.862] lstrlenW (lpString=".rar") returned 4 [0194.863] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.863] lstrlenW (lpString=".bz2") returned 4 [0194.863] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.863] lstrlenW (lpString=".7z") returned 3 [0194.863] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.863] lstrlenW (lpString=".dbf") returned 4 [0194.863] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.863] lstrlenW (lpString=".1cd") returned 4 [0194.863] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.863] lstrlenW (lpString=".jpg") returned 4 [0194.863] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.863] lstrlenW (lpString=".doc") returned 4 [0194.863] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.863] lstrlenW (lpString=".docx") returned 5 [0194.863] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.863] lstrlenW (lpString=".pdf") returned 4 [0194.863] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.863] lstrlenW (lpString=".xls") returned 4 [0194.863] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.863] lstrlenW (lpString=".xlsx") returned 5 [0194.863] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.863] lstrlenW (lpString=".ppt") returned 4 [0194.863] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.863] lstrlenW (lpString=".zip") returned 4 [0194.864] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.864] lstrlenW (lpString=".rar") returned 4 [0194.864] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.864] lstrlenW (lpString=".bz2") returned 4 [0194.864] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.864] lstrlenW (lpString=".7z") returned 3 [0194.864] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.864] lstrlenW (lpString=".dbf") returned 4 [0194.864] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.864] lstrlenW (lpString=".1cd") returned 4 [0194.864] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ca\\messages.json") returned 151 [0194.864] lstrlenW (lpString=".jpg") returned 4 [0194.864] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.864] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.864] lstrlenW (lpString="messages.json") returned 13 [0194.864] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.865] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=218) returned 1 [0194.865] CloseHandle (hObject=0x120) returned 1 [0194.865] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json")) returned 0x2020 [0194.865] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.865] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.865] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.866] GetLastError () returned 0x0 [0194.866] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xda, lpOverlapped=0x0) returned 1 [0194.867] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0194.867] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.868] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.868] SetEndOfFile (hFile=0x388) returned 1 [0194.868] CloseHandle (hObject=0x388) returned 1 [0194.868] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.868] SetEndOfFile (hFile=0x120) returned 1 [0194.869] CloseHandle (hObject=0x120) returned 1 [0194.869] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.869] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json")) returned 1 [0194.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.869] lstrlenW (lpString=".doc") returned 4 [0194.869] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.869] lstrlenW (lpString=".docx") returned 5 [0194.869] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.869] lstrlenW (lpString=".pdf") returned 4 [0194.869] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.869] lstrlenW (lpString=".xls") returned 4 [0194.869] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.869] lstrlenW (lpString=".xlsx") returned 5 [0194.869] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.870] lstrlenW (lpString=".ppt") returned 4 [0194.870] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.870] lstrlenW (lpString=".zip") returned 4 [0194.870] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.870] lstrlenW (lpString=".rar") returned 4 [0194.870] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.870] lstrlenW (lpString=".bz2") returned 4 [0194.870] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.870] lstrlenW (lpString=".7z") returned 3 [0194.870] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.870] lstrlenW (lpString=".dbf") returned 4 [0194.870] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.870] lstrlenW (lpString=".1cd") returned 4 [0194.870] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.870] lstrlenW (lpString=".jpg") returned 4 [0194.870] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.870] lstrlenW (lpString=".doc") returned 4 [0194.870] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.870] lstrlenW (lpString=".docx") returned 5 [0194.870] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.870] lstrlenW (lpString=".pdf") returned 4 [0194.870] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.870] lstrlenW (lpString=".xls") returned 4 [0194.870] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.870] lstrlenW (lpString=".xlsx") returned 5 [0194.871] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.871] lstrlenW (lpString=".ppt") returned 4 [0194.871] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.871] lstrlenW (lpString=".zip") returned 4 [0194.871] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.871] lstrlenW (lpString=".rar") returned 4 [0194.871] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.871] lstrlenW (lpString=".bz2") returned 4 [0194.871] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.871] lstrlenW (lpString=".7z") returned 3 [0194.871] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.871] lstrlenW (lpString=".dbf") returned 4 [0194.871] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.871] lstrlenW (lpString=".1cd") returned 4 [0194.871] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\cs\\messages.json") returned 151 [0194.871] lstrlenW (lpString=".jpg") returned 4 [0194.871] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.872] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.872] lstrlenW (lpString="messages.json") returned 13 [0194.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.872] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=207) returned 1 [0194.872] CloseHandle (hObject=0x120) returned 1 [0194.872] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json")) returned 0x2020 [0194.872] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.873] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.873] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.873] GetLastError () returned 0x0 [0194.873] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xcf, lpOverlapped=0x0) returned 1 [0194.874] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0194.875] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.875] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.875] SetEndOfFile (hFile=0x388) returned 1 [0194.875] CloseHandle (hObject=0x388) returned 1 [0194.876] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.876] SetEndOfFile (hFile=0x120) returned 1 [0194.876] CloseHandle (hObject=0x120) returned 1 [0194.876] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.876] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json")) returned 1 [0194.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.877] lstrlenW (lpString=".doc") returned 4 [0194.877] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.877] lstrlenW (lpString=".docx") returned 5 [0194.877] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.877] lstrlenW (lpString=".pdf") returned 4 [0194.877] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.877] lstrlenW (lpString=".xls") returned 4 [0194.877] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.877] lstrlenW (lpString=".xlsx") returned 5 [0194.877] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.877] lstrlenW (lpString=".ppt") returned 4 [0194.877] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.877] lstrlenW (lpString=".zip") returned 4 [0194.877] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.877] lstrlenW (lpString=".rar") returned 4 [0194.877] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.877] lstrlenW (lpString=".bz2") returned 4 [0194.877] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.877] lstrlenW (lpString=".7z") returned 3 [0194.877] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.877] lstrlenW (lpString=".dbf") returned 4 [0194.877] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.878] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.878] lstrlenW (lpString=".1cd") returned 4 [0194.878] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.878] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.878] lstrlenW (lpString=".jpg") returned 4 [0194.878] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.878] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.878] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.878] lstrlenW (lpString=".doc") returned 4 [0194.878] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.878] lstrlenW (lpString=".docx") returned 5 [0194.878] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.878] lstrlenW (lpString=".pdf") returned 4 [0194.878] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.878] lstrlenW (lpString=".xls") returned 4 [0194.878] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.878] lstrlenW (lpString=".xlsx") returned 5 [0194.878] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.878] lstrlenW (lpString=".ppt") returned 4 [0194.878] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.878] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.878] lstrlenW (lpString=".zip") returned 4 [0194.878] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.878] lstrlenW (lpString=".rar") returned 4 [0194.878] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.878] lstrlenW (lpString=".bz2") returned 4 [0194.878] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.878] lstrlenW (lpString=".7z") returned 3 [0194.879] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.879] lstrlenW (lpString=".dbf") returned 4 [0194.879] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.879] lstrlenW (lpString=".1cd") returned 4 [0194.879] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\da\\messages.json") returned 151 [0194.879] lstrlenW (lpString=".jpg") returned 4 [0194.879] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.879] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.879] lstrlenW (lpString="messages.json") returned 13 [0194.879] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.879] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=220) returned 1 [0194.879] CloseHandle (hObject=0x120) returned 1 [0194.880] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json")) returned 0x2020 [0194.880] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.880] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.880] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.880] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.880] GetLastError () returned 0x0 [0194.880] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xdc, lpOverlapped=0x0) returned 1 [0194.881] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0194.882] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.882] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.882] SetEndOfFile (hFile=0x388) returned 1 [0194.883] CloseHandle (hObject=0x388) returned 1 [0194.883] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.883] SetEndOfFile (hFile=0x120) returned 1 [0194.883] CloseHandle (hObject=0x120) returned 1 [0194.884] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.884] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json")) returned 1 [0194.884] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.884] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.884] lstrlenW (lpString=".doc") returned 4 [0194.884] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.884] lstrlenW (lpString=".docx") returned 5 [0194.884] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.884] lstrlenW (lpString=".pdf") returned 4 [0194.884] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.884] lstrlenW (lpString=".xls") returned 4 [0194.884] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.884] lstrlenW (lpString=".xlsx") returned 5 [0194.884] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.884] lstrlenW (lpString=".ppt") returned 4 [0194.884] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.884] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.884] lstrlenW (lpString=".zip") returned 4 [0194.884] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.884] lstrlenW (lpString=".rar") returned 4 [0194.885] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.885] lstrlenW (lpString=".bz2") returned 4 [0194.885] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.885] lstrlenW (lpString=".7z") returned 3 [0194.885] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.885] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.885] lstrlenW (lpString=".dbf") returned 4 [0194.885] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.885] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.885] lstrlenW (lpString=".1cd") returned 4 [0194.885] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.885] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.885] lstrlenW (lpString=".jpg") returned 4 [0194.885] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.885] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.885] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.885] lstrlenW (lpString=".doc") returned 4 [0194.885] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.885] lstrlenW (lpString=".docx") returned 5 [0194.885] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.885] lstrlenW (lpString=".pdf") returned 4 [0194.885] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.885] lstrlenW (lpString=".xls") returned 4 [0194.885] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.885] lstrlenW (lpString=".xlsx") returned 5 [0194.885] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.885] lstrlenW (lpString=".ppt") returned 4 [0194.885] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.885] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.886] lstrlenW (lpString=".zip") returned 4 [0194.886] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.886] lstrlenW (lpString=".rar") returned 4 [0194.886] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.886] lstrlenW (lpString=".bz2") returned 4 [0194.886] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.886] lstrlenW (lpString=".7z") returned 3 [0194.886] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.886] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.886] lstrlenW (lpString=".dbf") returned 4 [0194.886] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.886] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.886] lstrlenW (lpString=".1cd") returned 4 [0194.886] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.886] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\de\\messages.json") returned 151 [0194.886] lstrlenW (lpString=".jpg") returned 4 [0194.886] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.886] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.886] lstrlenW (lpString="messages.json") returned 13 [0194.886] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.887] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=304) returned 1 [0194.887] CloseHandle (hObject=0x120) returned 1 [0194.887] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json")) returned 0x2020 [0194.887] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.887] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.887] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.888] GetLastError () returned 0x0 [0194.888] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x130, lpOverlapped=0x0) returned 1 [0194.890] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x140, lpOverlapped=0x0) returned 1 [0194.891] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.891] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.891] SetEndOfFile (hFile=0x388) returned 1 [0194.891] CloseHandle (hObject=0x388) returned 1 [0194.891] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.891] SetEndOfFile (hFile=0x120) returned 1 [0194.892] CloseHandle (hObject=0x120) returned 1 [0194.892] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.892] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json")) returned 1 [0194.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.892] lstrlenW (lpString=".doc") returned 4 [0194.892] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.893] lstrlenW (lpString=".docx") returned 5 [0194.893] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.893] lstrlenW (lpString=".pdf") returned 4 [0194.893] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.893] lstrlenW (lpString=".xls") returned 4 [0194.893] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.893] lstrlenW (lpString=".xlsx") returned 5 [0194.893] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.893] lstrlenW (lpString=".ppt") returned 4 [0194.893] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.893] lstrlenW (lpString=".zip") returned 4 [0194.893] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.893] lstrlenW (lpString=".rar") returned 4 [0194.893] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.893] lstrlenW (lpString=".bz2") returned 4 [0194.893] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.893] lstrlenW (lpString=".7z") returned 3 [0194.893] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.893] lstrlenW (lpString=".dbf") returned 4 [0194.893] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.893] lstrlenW (lpString=".1cd") returned 4 [0194.893] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.893] lstrlenW (lpString=".jpg") returned 4 [0194.893] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.893] lstrlenW (lpString=".doc") returned 4 [0194.894] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.894] lstrlenW (lpString=".docx") returned 5 [0194.894] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.894] lstrlenW (lpString=".pdf") returned 4 [0194.894] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.894] lstrlenW (lpString=".xls") returned 4 [0194.894] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.894] lstrlenW (lpString=".xlsx") returned 5 [0194.894] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.894] lstrlenW (lpString=".ppt") returned 4 [0194.894] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.894] lstrlenW (lpString=".zip") returned 4 [0194.894] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.894] lstrlenW (lpString=".rar") returned 4 [0194.894] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.894] lstrlenW (lpString=".bz2") returned 4 [0194.894] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.894] lstrlenW (lpString=".7z") returned 3 [0194.894] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.894] lstrlenW (lpString=".dbf") returned 4 [0194.894] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.894] lstrlenW (lpString=".1cd") returned 4 [0194.894] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\el\\messages.json") returned 151 [0194.894] lstrlenW (lpString=".jpg") returned 4 [0194.894] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.895] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.895] lstrlenW (lpString="messages.json") returned 13 [0194.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.895] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=213) returned 1 [0194.895] CloseHandle (hObject=0x120) returned 1 [0194.895] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0194.895] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.896] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.896] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.896] GetLastError () returned 0x0 [0194.896] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd5, lpOverlapped=0x0) returned 1 [0194.897] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0194.898] ReadFile (in: hFile=0x120, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.898] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.898] SetEndOfFile (hFile=0x388) returned 1 [0194.898] CloseHandle (hObject=0x388) returned 1 [0194.898] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.898] SetEndOfFile (hFile=0x120) returned 1 [0194.899] CloseHandle (hObject=0x120) returned 1 [0194.899] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.899] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_gb\\messages.json")) returned 1 [0194.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.900] lstrlenW (lpString=".doc") returned 4 [0194.900] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.900] lstrlenW (lpString=".docx") returned 5 [0194.900] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.900] lstrlenW (lpString=".pdf") returned 4 [0194.900] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.900] lstrlenW (lpString=".xls") returned 4 [0194.900] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.900] lstrlenW (lpString=".xlsx") returned 5 [0194.900] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.900] lstrlenW (lpString=".ppt") returned 4 [0194.900] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.900] lstrlenW (lpString=".zip") returned 4 [0194.900] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.900] lstrlenW (lpString=".rar") returned 4 [0194.900] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.900] lstrlenW (lpString=".bz2") returned 4 [0194.900] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.900] lstrlenW (lpString=".7z") returned 3 [0194.900] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.900] lstrlenW (lpString=".dbf") returned 4 [0194.900] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.900] lstrlenW (lpString=".1cd") returned 4 [0194.900] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.900] lstrlenW (lpString=".jpg") returned 4 [0194.901] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.901] lstrlenW (lpString=".doc") returned 4 [0194.901] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.901] lstrlenW (lpString=".docx") returned 5 [0194.901] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.901] lstrlenW (lpString=".pdf") returned 4 [0194.901] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.901] lstrlenW (lpString=".xls") returned 4 [0194.901] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.901] lstrlenW (lpString=".xlsx") returned 5 [0194.901] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.901] lstrlenW (lpString=".ppt") returned 4 [0194.901] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.901] lstrlenW (lpString=".zip") returned 4 [0194.901] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.901] lstrlenW (lpString=".rar") returned 4 [0194.901] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.901] lstrlenW (lpString=".bz2") returned 4 [0194.901] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.901] lstrlenW (lpString=".7z") returned 3 [0194.901] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.901] lstrlenW (lpString=".dbf") returned 4 [0194.901] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.901] lstrlenW (lpString=".1cd") returned 4 [0194.901] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_GB\\messages.json") returned 154 [0194.902] lstrlenW (lpString=".jpg") returned 4 [0194.902] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.902] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.902] lstrlenW (lpString="messages.json") returned 13 [0194.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.902] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=213) returned 1 [0194.902] CloseHandle (hObject=0x120) returned 1 [0194.902] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0194.903] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.098] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.098] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.099] GetLastError () returned 0x0 [0195.099] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd5, lpOverlapped=0x0) returned 1 [0195.100] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.101] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.101] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.101] SetEndOfFile (hFile=0x150) returned 1 [0195.101] CloseHandle (hObject=0x150) returned 1 [0195.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.101] SetEndOfFile (hFile=0x114) returned 1 [0195.102] CloseHandle (hObject=0x114) returned 1 [0195.102] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.102] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_us\\messages.json")) returned 1 [0195.103] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.103] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.103] lstrlenW (lpString=".doc") returned 4 [0195.103] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.103] lstrlenW (lpString=".docx") returned 5 [0195.103] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.103] lstrlenW (lpString=".pdf") returned 4 [0195.103] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.103] lstrlenW (lpString=".xls") returned 4 [0195.103] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.103] lstrlenW (lpString=".xlsx") returned 5 [0195.103] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.103] lstrlenW (lpString=".ppt") returned 4 [0195.103] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.103] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.103] lstrlenW (lpString=".zip") returned 4 [0195.103] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.103] lstrlenW (lpString=".rar") returned 4 [0195.103] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.103] lstrlenW (lpString=".bz2") returned 4 [0195.103] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.103] lstrlenW (lpString=".7z") returned 3 [0195.103] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.103] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.103] lstrlenW (lpString=".dbf") returned 4 [0195.103] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.103] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.104] lstrlenW (lpString=".1cd") returned 4 [0195.104] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.104] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.104] lstrlenW (lpString=".jpg") returned 4 [0195.104] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.104] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.104] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.104] lstrlenW (lpString=".doc") returned 4 [0195.104] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.104] lstrlenW (lpString=".docx") returned 5 [0195.104] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.104] lstrlenW (lpString=".pdf") returned 4 [0195.104] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.104] lstrlenW (lpString=".xls") returned 4 [0195.104] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.104] lstrlenW (lpString=".xlsx") returned 5 [0195.104] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.104] lstrlenW (lpString=".ppt") returned 4 [0195.104] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.104] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.104] lstrlenW (lpString=".zip") returned 4 [0195.104] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.104] lstrlenW (lpString=".rar") returned 4 [0195.104] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.104] lstrlenW (lpString=".bz2") returned 4 [0195.104] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.104] lstrlenW (lpString=".7z") returned 3 [0195.104] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.104] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.105] lstrlenW (lpString=".dbf") returned 4 [0195.105] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.105] lstrlenW (lpString=".1cd") returned 4 [0195.105] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\en_US\\messages.json") returned 154 [0195.105] lstrlenW (lpString=".jpg") returned 4 [0195.105] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.105] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.105] lstrlenW (lpString="messages.json") returned 13 [0195.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.106] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=222) returned 1 [0195.106] CloseHandle (hObject=0x114) returned 1 [0195.106] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 0x2020 [0195.106] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.106] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.107] GetLastError () returned 0x0 [0195.107] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xde, lpOverlapped=0x0) returned 1 [0195.108] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.109] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.109] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.109] SetEndOfFile (hFile=0x150) returned 1 [0195.109] CloseHandle (hObject=0x150) returned 1 [0195.109] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.109] SetEndOfFile (hFile=0x114) returned 1 [0195.110] CloseHandle (hObject=0x114) returned 1 [0195.110] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.110] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json")) returned 1 [0195.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.110] lstrlenW (lpString=".doc") returned 4 [0195.110] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.110] lstrlenW (lpString=".docx") returned 5 [0195.110] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.110] lstrlenW (lpString=".pdf") returned 4 [0195.110] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.110] lstrlenW (lpString=".xls") returned 4 [0195.110] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.111] lstrlenW (lpString=".xlsx") returned 5 [0195.111] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.111] lstrlenW (lpString=".ppt") returned 4 [0195.111] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.111] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.111] lstrlenW (lpString=".zip") returned 4 [0195.111] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.111] lstrlenW (lpString=".rar") returned 4 [0195.111] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.111] lstrlenW (lpString=".bz2") returned 4 [0195.111] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.111] lstrlenW (lpString=".7z") returned 3 [0195.111] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.111] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.111] lstrlenW (lpString=".dbf") returned 4 [0195.111] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.111] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.111] lstrlenW (lpString=".1cd") returned 4 [0195.111] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.111] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.111] lstrlenW (lpString=".jpg") returned 4 [0195.111] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.111] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.111] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.111] lstrlenW (lpString=".doc") returned 4 [0195.111] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.111] lstrlenW (lpString=".docx") returned 5 [0195.111] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.111] lstrlenW (lpString=".pdf") returned 4 [0195.112] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.112] lstrlenW (lpString=".xls") returned 4 [0195.112] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.112] lstrlenW (lpString=".xlsx") returned 5 [0195.112] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.112] lstrlenW (lpString=".ppt") returned 4 [0195.112] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.112] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.112] lstrlenW (lpString=".zip") returned 4 [0195.112] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.112] lstrlenW (lpString=".rar") returned 4 [0195.112] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.112] lstrlenW (lpString=".bz2") returned 4 [0195.112] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.112] lstrlenW (lpString=".7z") returned 3 [0195.112] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.112] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.112] lstrlenW (lpString=".dbf") returned 4 [0195.112] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.112] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.112] lstrlenW (lpString=".1cd") returned 4 [0195.112] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.112] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sl\\messages.json") returned 151 [0195.112] lstrlenW (lpString=".jpg") returned 4 [0195.112] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.112] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.112] lstrlenW (lpString="messages.json") returned 13 [0195.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.113] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=236) returned 1 [0195.113] CloseHandle (hObject=0x114) returned 1 [0195.113] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 0x2020 [0195.113] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.113] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.113] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.113] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.114] GetLastError () returned 0x0 [0195.114] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xec, lpOverlapped=0x0) returned 1 [0195.115] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.116] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.116] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.116] SetEndOfFile (hFile=0x150) returned 1 [0195.116] CloseHandle (hObject=0x150) returned 1 [0195.116] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.116] SetEndOfFile (hFile=0x114) returned 1 [0195.117] CloseHandle (hObject=0x114) returned 1 [0195.117] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.117] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json")) returned 1 [0195.118] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.118] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.118] lstrlenW (lpString=".doc") returned 4 [0195.118] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.118] lstrlenW (lpString=".docx") returned 5 [0195.118] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.118] lstrlenW (lpString=".pdf") returned 4 [0195.118] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.118] lstrlenW (lpString=".xls") returned 4 [0195.118] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.118] lstrlenW (lpString=".xlsx") returned 5 [0195.118] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.118] lstrlenW (lpString=".ppt") returned 4 [0195.118] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.118] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.118] lstrlenW (lpString=".zip") returned 4 [0195.118] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.118] lstrlenW (lpString=".rar") returned 4 [0195.118] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.118] lstrlenW (lpString=".bz2") returned 4 [0195.118] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.118] lstrlenW (lpString=".7z") returned 3 [0195.118] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.118] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.118] lstrlenW (lpString=".dbf") returned 4 [0195.118] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.118] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.118] lstrlenW (lpString=".1cd") returned 4 [0195.118] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.119] lstrlenW (lpString=".jpg") returned 4 [0195.119] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.119] lstrlenW (lpString=".doc") returned 4 [0195.119] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.119] lstrlenW (lpString=".docx") returned 5 [0195.119] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.119] lstrlenW (lpString=".pdf") returned 4 [0195.119] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.119] lstrlenW (lpString=".xls") returned 4 [0195.119] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.119] lstrlenW (lpString=".xlsx") returned 5 [0195.119] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.119] lstrlenW (lpString=".ppt") returned 4 [0195.119] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.119] lstrlenW (lpString=".zip") returned 4 [0195.119] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.119] lstrlenW (lpString=".rar") returned 4 [0195.119] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.119] lstrlenW (lpString=".bz2") returned 4 [0195.119] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.119] lstrlenW (lpString=".7z") returned 3 [0195.119] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.119] lstrlenW (lpString=".dbf") returned 4 [0195.119] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.119] lstrlenW (lpString=".1cd") returned 4 [0195.120] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sr\\messages.json") returned 151 [0195.120] lstrlenW (lpString=".jpg") returned 4 [0195.120] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.120] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.120] lstrlenW (lpString="messages.json") returned 13 [0195.120] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.120] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=216) returned 1 [0195.120] CloseHandle (hObject=0x114) returned 1 [0195.120] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 0x2020 [0195.121] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.121] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.121] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.121] GetLastError () returned 0x0 [0195.121] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd8, lpOverlapped=0x0) returned 1 [0195.122] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.123] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.123] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.123] SetEndOfFile (hFile=0x150) returned 1 [0195.123] CloseHandle (hObject=0x150) returned 1 [0195.124] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.124] SetEndOfFile (hFile=0x114) returned 1 [0195.124] CloseHandle (hObject=0x114) returned 1 [0195.124] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.124] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json")) returned 1 [0195.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.125] lstrlenW (lpString=".doc") returned 4 [0195.125] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.125] lstrlenW (lpString=".docx") returned 5 [0195.125] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.125] lstrlenW (lpString=".pdf") returned 4 [0195.125] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.125] lstrlenW (lpString=".xls") returned 4 [0195.125] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.125] lstrlenW (lpString=".xlsx") returned 5 [0195.125] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.125] lstrlenW (lpString=".ppt") returned 4 [0195.125] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.125] lstrlenW (lpString=".zip") returned 4 [0195.125] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.125] lstrlenW (lpString=".rar") returned 4 [0195.125] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.125] lstrlenW (lpString=".bz2") returned 4 [0195.125] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.125] lstrlenW (lpString=".7z") returned 3 [0195.125] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.125] lstrlenW (lpString=".dbf") returned 4 [0195.126] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.126] lstrlenW (lpString=".1cd") returned 4 [0195.126] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.126] lstrlenW (lpString=".jpg") returned 4 [0195.126] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.126] lstrlenW (lpString=".doc") returned 4 [0195.126] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.126] lstrlenW (lpString=".docx") returned 5 [0195.126] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.126] lstrlenW (lpString=".pdf") returned 4 [0195.126] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.126] lstrlenW (lpString=".xls") returned 4 [0195.126] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.126] lstrlenW (lpString=".xlsx") returned 5 [0195.126] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.126] lstrlenW (lpString=".ppt") returned 4 [0195.126] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.126] lstrlenW (lpString=".zip") returned 4 [0195.126] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.126] lstrlenW (lpString=".rar") returned 4 [0195.126] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.126] lstrlenW (lpString=".bz2") returned 4 [0195.126] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.126] lstrlenW (lpString=".7z") returned 3 [0195.126] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.127] lstrlenW (lpString=".dbf") returned 4 [0195.127] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.127] lstrlenW (lpString=".1cd") returned 4 [0195.127] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sv\\messages.json") returned 151 [0195.127] lstrlenW (lpString=".jpg") returned 4 [0195.127] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.127] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.127] lstrlenW (lpString="messages.json") returned 13 [0195.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.129] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=266) returned 1 [0195.130] CloseHandle (hObject=0x114) returned 1 [0195.130] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 0x2020 [0195.130] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.130] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.130] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.130] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.130] GetLastError () returned 0x0 [0195.131] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x10a, lpOverlapped=0x0) returned 1 [0195.274] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0195.277] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.277] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.277] SetEndOfFile (hFile=0x150) returned 1 [0195.277] CloseHandle (hObject=0x150) returned 1 [0195.277] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.277] SetEndOfFile (hFile=0x114) returned 1 [0195.278] CloseHandle (hObject=0x114) returned 1 [0195.278] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.278] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json")) returned 1 [0195.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.279] lstrlenW (lpString=".doc") returned 4 [0195.279] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.279] lstrlenW (lpString=".docx") returned 5 [0195.279] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.279] lstrlenW (lpString=".pdf") returned 4 [0195.279] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.279] lstrlenW (lpString=".xls") returned 4 [0195.279] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.279] lstrlenW (lpString=".xlsx") returned 5 [0195.279] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.279] lstrlenW (lpString=".ppt") returned 4 [0195.279] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.279] lstrlenW (lpString=".zip") returned 4 [0195.279] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.279] lstrlenW (lpString=".rar") returned 4 [0195.279] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.279] lstrlenW (lpString=".bz2") returned 4 [0195.279] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.279] lstrlenW (lpString=".7z") returned 3 [0195.279] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.279] lstrlenW (lpString=".dbf") returned 4 [0195.279] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.279] lstrlenW (lpString=".1cd") returned 4 [0195.280] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.280] lstrlenW (lpString=".jpg") returned 4 [0195.280] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.280] lstrlenW (lpString=".doc") returned 4 [0195.280] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.280] lstrlenW (lpString=".docx") returned 5 [0195.280] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.280] lstrlenW (lpString=".pdf") returned 4 [0195.280] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.280] lstrlenW (lpString=".xls") returned 4 [0195.280] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.280] lstrlenW (lpString=".xlsx") returned 5 [0195.280] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.280] lstrlenW (lpString=".ppt") returned 4 [0195.280] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.280] lstrlenW (lpString=".zip") returned 4 [0195.280] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.280] lstrlenW (lpString=".rar") returned 4 [0195.280] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.280] lstrlenW (lpString=".bz2") returned 4 [0195.280] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.280] lstrlenW (lpString=".7z") returned 3 [0195.280] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.280] lstrlenW (lpString=".dbf") returned 4 [0195.280] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.281] lstrlenW (lpString=".1cd") returned 4 [0195.281] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\th\\messages.json") returned 151 [0195.281] lstrlenW (lpString=".jpg") returned 4 [0195.281] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.281] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0195.281] lstrlenW (lpString="128.png") returned 7 [0195.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.281] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=4984) returned 1 [0195.281] CloseHandle (hObject=0x114) returned 1 [0195.282] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 0x2020 [0195.282] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.282] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.282] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.283] GetLastError () returned 0x0 [0195.283] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1378, lpOverlapped=0x0) returned 1 [0195.284] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0195.285] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.285] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0195.285] SetEndOfFile (hFile=0x150) returned 1 [0195.286] CloseHandle (hObject=0x150) returned 1 [0195.286] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.286] SetEndOfFile (hFile=0x114) returned 1 [0195.287] CloseHandle (hObject=0x114) returned 1 [0195.287] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.287] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png")) returned 1 [0195.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.287] lstrlenW (lpString=".doc") returned 4 [0195.287] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0195.287] lstrlenW (lpString=".docx") returned 5 [0195.287] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0195.287] lstrlenW (lpString=".pdf") returned 4 [0195.287] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0195.287] lstrlenW (lpString=".xls") returned 4 [0195.287] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0195.287] lstrlenW (lpString=".xlsx") returned 5 [0195.287] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0195.287] lstrlenW (lpString=".ppt") returned 4 [0195.287] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0195.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.287] lstrlenW (lpString=".zip") returned 4 [0195.288] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0195.288] lstrlenW (lpString=".rar") returned 4 [0195.288] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0195.288] lstrlenW (lpString=".bz2") returned 4 [0195.288] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0195.288] lstrlenW (lpString=".7z") returned 3 [0195.288] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0195.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.288] lstrlenW (lpString=".dbf") returned 4 [0195.288] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0195.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.288] lstrlenW (lpString=".1cd") returned 4 [0195.288] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0195.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.288] lstrlenW (lpString=".jpg") returned 4 [0195.288] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0195.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.288] lstrlenW (lpString=".doc") returned 4 [0195.288] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0195.288] lstrlenW (lpString=".docx") returned 5 [0195.288] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0195.288] lstrlenW (lpString=".pdf") returned 4 [0195.288] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0195.288] lstrlenW (lpString=".xls") returned 4 [0195.288] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0195.288] lstrlenW (lpString=".xlsx") returned 5 [0195.288] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0195.288] lstrlenW (lpString=".ppt") returned 4 [0195.288] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0195.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.288] lstrlenW (lpString=".zip") returned 4 [0195.288] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0195.289] lstrlenW (lpString=".rar") returned 4 [0195.289] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0195.289] lstrlenW (lpString=".bz2") returned 4 [0195.289] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0195.289] lstrlenW (lpString=".7z") returned 3 [0195.289] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0195.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.289] lstrlenW (lpString=".dbf") returned 4 [0195.289] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0195.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.289] lstrlenW (lpString=".1cd") returned 4 [0195.289] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0195.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\128.png") returned 133 [0195.289] lstrlenW (lpString=".jpg") returned 4 [0195.289] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0195.289] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0195.289] lstrlenW (lpString="contentscript_bin_prod.js") returned 25 [0195.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.290] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=4355) returned 1 [0195.290] CloseHandle (hObject=0x114) returned 1 [0195.291] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 0x2020 [0195.291] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.291] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.291] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.291] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.291] GetLastError () returned 0x0 [0195.291] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1103, lpOverlapped=0x0) returned 1 [0195.294] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1110, lpOverlapped=0x0) returned 1 [0195.295] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.295] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x106, lpOverlapped=0x0) returned 1 [0195.295] SetEndOfFile (hFile=0x150) returned 1 [0195.295] CloseHandle (hObject=0x150) returned 1 [0195.295] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.295] SetEndOfFile (hFile=0x114) returned 1 [0195.296] CloseHandle (hObject=0x114) returned 1 [0195.296] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.296] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js")) returned 1 [0195.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.296] lstrlenW (lpString=".doc") returned 4 [0195.297] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString=".docx") returned 5 [0195.297] lstrcmpiW (lpString1=".docx", lpString2="od.js") returned -1 [0195.297] lstrlenW (lpString=".pdf") returned 4 [0195.297] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString=".xls") returned 4 [0195.297] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString=".xlsx") returned 5 [0195.297] lstrcmpiW (lpString1=".xlsx", lpString2="od.js") returned -1 [0195.297] lstrlenW (lpString=".ppt") returned 4 [0195.297] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.297] lstrlenW (lpString=".zip") returned 4 [0195.297] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString=".rar") returned 4 [0195.297] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString=".bz2") returned 4 [0195.297] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString=".7z") returned 3 [0195.297] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0195.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.297] lstrlenW (lpString=".dbf") returned 4 [0195.297] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.297] lstrlenW (lpString=".1cd") returned 4 [0195.297] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.297] lstrlenW (lpString=".jpg") returned 4 [0195.297] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.297] lstrlenW (lpString=".doc") returned 4 [0195.297] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0195.297] lstrlenW (lpString=".docx") returned 5 [0195.298] lstrcmpiW (lpString1=".docx", lpString2="od.js") returned -1 [0195.298] lstrlenW (lpString=".pdf") returned 4 [0195.298] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0195.298] lstrlenW (lpString=".xls") returned 4 [0195.298] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0195.298] lstrlenW (lpString=".xlsx") returned 5 [0195.298] lstrcmpiW (lpString1=".xlsx", lpString2="od.js") returned -1 [0195.298] lstrlenW (lpString=".ppt") returned 4 [0195.298] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0195.298] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.298] lstrlenW (lpString=".zip") returned 4 [0195.298] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0195.298] lstrlenW (lpString=".rar") returned 4 [0195.298] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0195.298] lstrlenW (lpString=".bz2") returned 4 [0195.298] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0195.298] lstrlenW (lpString=".7z") returned 3 [0195.298] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0195.298] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.298] lstrlenW (lpString=".dbf") returned 4 [0195.298] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0195.298] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.298] lstrlenW (lpString=".1cd") returned 4 [0195.298] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0195.298] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\contentscript_bin_prod.js") returned 151 [0195.298] lstrlenW (lpString=".jpg") returned 4 [0195.298] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0195.299] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0195.299] lstrlenW (lpString="eventpage_bin_prod.js") returned 21 [0195.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.299] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=23404) returned 1 [0195.299] CloseHandle (hObject=0x114) returned 1 [0195.299] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 0x2020 [0195.299] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.300] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.300] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.300] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.300] GetLastError () returned 0x0 [0195.300] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x5b6c, lpOverlapped=0x0) returned 1 [0195.303] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x5b70, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5b70, lpOverlapped=0x0) returned 1 [0195.304] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.304] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0195.304] SetEndOfFile (hFile=0x150) returned 1 [0195.305] CloseHandle (hObject=0x150) returned 1 [0195.305] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.305] SetEndOfFile (hFile=0x114) returned 1 [0195.306] CloseHandle (hObject=0x114) returned 1 [0195.306] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.306] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js")) returned 1 [0195.306] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.306] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.306] lstrlenW (lpString=".doc") returned 4 [0195.306] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0195.306] lstrlenW (lpString=".docx") returned 5 [0195.306] lstrcmpiW (lpString1=".docx", lpString2="od.js") returned -1 [0195.306] lstrlenW (lpString=".pdf") returned 4 [0195.306] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0195.306] lstrlenW (lpString=".xls") returned 4 [0195.306] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0195.306] lstrlenW (lpString=".xlsx") returned 5 [0195.306] lstrcmpiW (lpString1=".xlsx", lpString2="od.js") returned -1 [0195.306] lstrlenW (lpString=".ppt") returned 4 [0195.306] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.307] lstrlenW (lpString=".zip") returned 4 [0195.307] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString=".rar") returned 4 [0195.307] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString=".bz2") returned 4 [0195.307] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString=".7z") returned 3 [0195.307] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0195.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.307] lstrlenW (lpString=".dbf") returned 4 [0195.307] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.307] lstrlenW (lpString=".1cd") returned 4 [0195.307] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.307] lstrlenW (lpString=".jpg") returned 4 [0195.307] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.307] lstrlenW (lpString=".doc") returned 4 [0195.307] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString=".docx") returned 5 [0195.307] lstrcmpiW (lpString1=".docx", lpString2="od.js") returned -1 [0195.307] lstrlenW (lpString=".pdf") returned 4 [0195.307] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString=".xls") returned 4 [0195.307] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString=".xlsx") returned 5 [0195.307] lstrcmpiW (lpString1=".xlsx", lpString2="od.js") returned -1 [0195.307] lstrlenW (lpString=".ppt") returned 4 [0195.307] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0195.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.308] lstrlenW (lpString=".zip") returned 4 [0195.308] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0195.308] lstrlenW (lpString=".rar") returned 4 [0195.308] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0195.308] lstrlenW (lpString=".bz2") returned 4 [0195.308] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0195.308] lstrlenW (lpString=".7z") returned 3 [0195.308] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0195.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.308] lstrlenW (lpString=".dbf") returned 4 [0195.308] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0195.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.308] lstrlenW (lpString=".1cd") returned 4 [0195.308] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0195.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\eventpage_bin_prod.js") returned 147 [0195.308] lstrlenW (lpString=".jpg") returned 4 [0195.308] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0195.308] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.308] lstrlenW (lpString="manifest.json") returned 13 [0195.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.309] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1457) returned 1 [0195.309] CloseHandle (hObject=0x114) returned 1 [0195.309] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json")) returned 0x2020 [0195.309] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.309] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.309] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.310] GetLastError () returned 0x0 [0195.310] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x5b1, lpOverlapped=0x0) returned 1 [0195.449] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0195.450] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.450] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.450] SetEndOfFile (hFile=0x150) returned 1 [0195.450] CloseHandle (hObject=0x150) returned 1 [0195.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.451] SetEndOfFile (hFile=0x114) returned 1 [0195.451] CloseHandle (hObject=0x114) returned 1 [0195.451] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.452] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json")) returned 1 [0195.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.452] lstrlenW (lpString=".doc") returned 4 [0195.452] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.452] lstrlenW (lpString=".docx") returned 5 [0195.452] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.452] lstrlenW (lpString=".pdf") returned 4 [0195.452] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.452] lstrlenW (lpString=".xls") returned 4 [0195.452] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.452] lstrlenW (lpString=".xlsx") returned 5 [0195.452] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.452] lstrlenW (lpString=".ppt") returned 4 [0195.452] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.452] lstrlenW (lpString=".zip") returned 4 [0195.452] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.452] lstrlenW (lpString=".rar") returned 4 [0195.452] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.452] lstrlenW (lpString=".bz2") returned 4 [0195.452] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.452] lstrlenW (lpString=".7z") returned 3 [0195.453] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.453] lstrlenW (lpString=".dbf") returned 4 [0195.453] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.453] lstrlenW (lpString=".1cd") returned 4 [0195.453] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.453] lstrlenW (lpString=".jpg") returned 4 [0195.453] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.453] lstrlenW (lpString=".doc") returned 4 [0195.453] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.453] lstrlenW (lpString=".docx") returned 5 [0195.453] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.453] lstrlenW (lpString=".pdf") returned 4 [0195.453] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.453] lstrlenW (lpString=".xls") returned 4 [0195.453] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.453] lstrlenW (lpString=".xlsx") returned 5 [0195.453] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.453] lstrlenW (lpString=".ppt") returned 4 [0195.453] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.453] lstrlenW (lpString=".zip") returned 4 [0195.453] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.453] lstrlenW (lpString=".rar") returned 4 [0195.453] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.453] lstrlenW (lpString=".bz2") returned 4 [0195.453] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.453] lstrlenW (lpString=".7z") returned 3 [0195.454] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.454] lstrlenW (lpString=".dbf") returned 4 [0195.454] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.454] lstrlenW (lpString=".1cd") returned 4 [0195.454] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\manifest.json") returned 139 [0195.454] lstrlenW (lpString=".jpg") returned 4 [0195.454] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.454] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.454] lstrlenW (lpString="messages.json") returned 13 [0195.454] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.455] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=265) returned 1 [0195.455] CloseHandle (hObject=0x114) returned 1 [0195.455] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0195.455] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.456] GetLastError () returned 0x0 [0195.456] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x109, lpOverlapped=0x0) returned 1 [0195.457] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0195.458] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.458] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.458] SetEndOfFile (hFile=0x150) returned 1 [0195.458] CloseHandle (hObject=0x150) returned 1 [0195.458] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.458] SetEndOfFile (hFile=0x114) returned 1 [0195.459] CloseHandle (hObject=0x114) returned 1 [0195.459] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.459] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_us\\messages.json")) returned 1 [0195.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.459] lstrlenW (lpString=".doc") returned 4 [0195.459] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.459] lstrlenW (lpString=".docx") returned 5 [0195.460] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.460] lstrlenW (lpString=".pdf") returned 4 [0195.460] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.460] lstrlenW (lpString=".xls") returned 4 [0195.460] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.460] lstrlenW (lpString=".xlsx") returned 5 [0195.460] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.460] lstrlenW (lpString=".ppt") returned 4 [0195.460] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.460] lstrlenW (lpString=".zip") returned 4 [0195.460] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.460] lstrlenW (lpString=".rar") returned 4 [0195.460] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.460] lstrlenW (lpString=".bz2") returned 4 [0195.460] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.460] lstrlenW (lpString=".7z") returned 3 [0195.460] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.460] lstrlenW (lpString=".dbf") returned 4 [0195.460] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.460] lstrlenW (lpString=".1cd") returned 4 [0195.460] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.460] lstrlenW (lpString=".jpg") returned 4 [0195.460] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.460] lstrlenW (lpString=".doc") returned 4 [0195.460] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.460] lstrlenW (lpString=".docx") returned 5 [0195.461] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.461] lstrlenW (lpString=".pdf") returned 4 [0195.461] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.461] lstrlenW (lpString=".xls") returned 4 [0195.461] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.461] lstrlenW (lpString=".xlsx") returned 5 [0195.461] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.461] lstrlenW (lpString=".ppt") returned 4 [0195.461] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.461] lstrlenW (lpString=".zip") returned 4 [0195.461] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.461] lstrlenW (lpString=".rar") returned 4 [0195.461] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.461] lstrlenW (lpString=".bz2") returned 4 [0195.461] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.461] lstrlenW (lpString=".7z") returned 3 [0195.461] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.461] lstrlenW (lpString=".dbf") returned 4 [0195.461] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.461] lstrlenW (lpString=".1cd") returned 4 [0195.461] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_US\\messages.json") returned 154 [0195.461] lstrlenW (lpString=".jpg") returned 4 [0195.461] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.461] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.461] lstrlenW (lpString="messages.json") returned 13 [0195.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.462] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=204) returned 1 [0195.462] CloseHandle (hObject=0x114) returned 1 [0195.462] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json")) returned 0x2020 [0195.462] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.462] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.463] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.463] GetLastError () returned 0x0 [0195.463] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xcc, lpOverlapped=0x0) returned 1 [0195.465] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.466] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.466] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.466] SetEndOfFile (hFile=0x150) returned 1 [0195.466] CloseHandle (hObject=0x150) returned 1 [0195.466] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.466] SetEndOfFile (hFile=0x114) returned 1 [0195.467] CloseHandle (hObject=0x114) returned 1 [0195.467] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.467] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json")) returned 1 [0195.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.468] lstrlenW (lpString=".doc") returned 4 [0195.468] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.468] lstrlenW (lpString=".docx") returned 5 [0195.468] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.468] lstrlenW (lpString=".pdf") returned 4 [0195.468] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.468] lstrlenW (lpString=".xls") returned 4 [0195.468] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.468] lstrlenW (lpString=".xlsx") returned 5 [0195.468] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.468] lstrlenW (lpString=".ppt") returned 4 [0195.468] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.468] lstrlenW (lpString=".zip") returned 4 [0195.468] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.468] lstrlenW (lpString=".rar") returned 4 [0195.468] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.468] lstrlenW (lpString=".bz2") returned 4 [0195.468] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.468] lstrlenW (lpString=".7z") returned 3 [0195.468] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.468] lstrlenW (lpString=".dbf") returned 4 [0195.468] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.468] lstrlenW (lpString=".1cd") returned 4 [0195.468] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.468] lstrlenW (lpString=".jpg") returned 4 [0195.468] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.469] lstrlenW (lpString=".doc") returned 4 [0195.469] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.469] lstrlenW (lpString=".docx") returned 5 [0195.469] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.469] lstrlenW (lpString=".pdf") returned 4 [0195.469] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.469] lstrlenW (lpString=".xls") returned 4 [0195.469] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.469] lstrlenW (lpString=".xlsx") returned 5 [0195.469] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.469] lstrlenW (lpString=".ppt") returned 4 [0195.469] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.469] lstrlenW (lpString=".zip") returned 4 [0195.469] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.469] lstrlenW (lpString=".rar") returned 4 [0195.469] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.469] lstrlenW (lpString=".bz2") returned 4 [0195.469] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.469] lstrlenW (lpString=".7z") returned 3 [0195.469] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.469] lstrlenW (lpString=".dbf") returned 4 [0195.469] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.469] lstrlenW (lpString=".1cd") returned 4 [0195.469] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es\\messages.json") returned 151 [0195.469] lstrlenW (lpString=".jpg") returned 4 [0195.469] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.470] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.470] lstrlenW (lpString="messages.json") returned 13 [0195.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.470] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=227) returned 1 [0195.470] CloseHandle (hObject=0x114) returned 1 [0195.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0195.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.471] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.471] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.471] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.471] GetLastError () returned 0x0 [0195.471] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xe3, lpOverlapped=0x0) returned 1 [0195.472] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.473] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.473] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.473] SetEndOfFile (hFile=0x150) returned 1 [0195.473] CloseHandle (hObject=0x150) returned 1 [0195.473] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.474] SetEndOfFile (hFile=0x114) returned 1 [0195.474] CloseHandle (hObject=0x114) returned 1 [0195.474] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.474] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json")) returned 1 [0195.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.475] lstrlenW (lpString=".doc") returned 4 [0195.475] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.475] lstrlenW (lpString=".docx") returned 5 [0195.475] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.475] lstrlenW (lpString=".pdf") returned 4 [0195.475] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.475] lstrlenW (lpString=".xls") returned 4 [0195.475] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.475] lstrlenW (lpString=".xlsx") returned 5 [0195.475] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.475] lstrlenW (lpString=".ppt") returned 4 [0195.475] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.475] lstrlenW (lpString=".zip") returned 4 [0195.475] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.475] lstrlenW (lpString=".rar") returned 4 [0195.475] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.475] lstrlenW (lpString=".bz2") returned 4 [0195.475] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.475] lstrlenW (lpString=".7z") returned 3 [0195.475] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.475] lstrlenW (lpString=".dbf") returned 4 [0195.475] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.476] lstrlenW (lpString=".1cd") returned 4 [0195.476] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.476] lstrlenW (lpString=".jpg") returned 4 [0195.476] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.476] lstrlenW (lpString=".doc") returned 4 [0195.476] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.476] lstrlenW (lpString=".docx") returned 5 [0195.476] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.476] lstrlenW (lpString=".pdf") returned 4 [0195.476] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.476] lstrlenW (lpString=".xls") returned 4 [0195.476] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.476] lstrlenW (lpString=".xlsx") returned 5 [0195.476] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.476] lstrlenW (lpString=".ppt") returned 4 [0195.476] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.476] lstrlenW (lpString=".zip") returned 4 [0195.476] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.476] lstrlenW (lpString=".rar") returned 4 [0195.476] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.476] lstrlenW (lpString=".bz2") returned 4 [0195.476] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.476] lstrlenW (lpString=".7z") returned 3 [0195.476] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.476] lstrlenW (lpString=".dbf") returned 4 [0195.476] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.476] lstrlenW (lpString=".1cd") returned 4 [0195.477] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\es_419\\messages.json") returned 155 [0195.477] lstrlenW (lpString=".jpg") returned 4 [0195.477] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.477] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.477] lstrlenW (lpString="messages.json") returned 13 [0195.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.477] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=212) returned 1 [0195.477] CloseHandle (hObject=0x114) returned 1 [0195.477] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json")) returned 0x2020 [0195.478] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.478] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.478] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.478] GetLastError () returned 0x0 [0195.478] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd4, lpOverlapped=0x0) returned 1 [0195.479] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.480] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.480] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.481] SetEndOfFile (hFile=0x150) returned 1 [0195.481] CloseHandle (hObject=0x150) returned 1 [0195.481] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.481] SetEndOfFile (hFile=0x114) returned 1 [0195.482] CloseHandle (hObject=0x114) returned 1 [0195.482] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.482] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json")) returned 1 [0195.482] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.482] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.482] lstrlenW (lpString=".doc") returned 4 [0195.482] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.482] lstrlenW (lpString=".docx") returned 5 [0195.482] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.482] lstrlenW (lpString=".pdf") returned 4 [0195.482] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.482] lstrlenW (lpString=".xls") returned 4 [0195.482] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.482] lstrlenW (lpString=".xlsx") returned 5 [0195.482] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.482] lstrlenW (lpString=".ppt") returned 4 [0195.482] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.482] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.482] lstrlenW (lpString=".zip") returned 4 [0195.483] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.483] lstrlenW (lpString=".rar") returned 4 [0195.483] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.483] lstrlenW (lpString=".bz2") returned 4 [0195.483] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.483] lstrlenW (lpString=".7z") returned 3 [0195.483] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.483] lstrlenW (lpString=".dbf") returned 4 [0195.483] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.483] lstrlenW (lpString=".1cd") returned 4 [0195.483] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.483] lstrlenW (lpString=".jpg") returned 4 [0195.483] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.483] lstrlenW (lpString=".doc") returned 4 [0195.483] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.483] lstrlenW (lpString=".docx") returned 5 [0195.483] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.483] lstrlenW (lpString=".pdf") returned 4 [0195.483] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.483] lstrlenW (lpString=".xls") returned 4 [0195.483] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.483] lstrlenW (lpString=".xlsx") returned 5 [0195.483] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.483] lstrlenW (lpString=".ppt") returned 4 [0195.483] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.483] lstrlenW (lpString=".zip") returned 4 [0195.483] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.484] lstrlenW (lpString=".rar") returned 4 [0195.484] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.484] lstrlenW (lpString=".bz2") returned 4 [0195.484] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.484] lstrlenW (lpString=".7z") returned 3 [0195.484] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.484] lstrlenW (lpString=".dbf") returned 4 [0195.484] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.484] lstrlenW (lpString=".1cd") returned 4 [0195.484] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\et\\messages.json") returned 151 [0195.484] lstrlenW (lpString=".jpg") returned 4 [0195.484] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.484] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.484] lstrlenW (lpString="messages.json") returned 13 [0195.484] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.492] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=152) returned 1 [0195.492] CloseHandle (hObject=0x114) returned 1 [0195.492] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json")) returned 0x2020 [0195.493] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.493] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.493] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.494] GetLastError () returned 0x0 [0195.494] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x98, lpOverlapped=0x0) returned 1 [0195.670] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0195.677] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.677] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.677] SetEndOfFile (hFile=0x150) returned 1 [0195.677] CloseHandle (hObject=0x150) returned 1 [0195.677] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.677] SetEndOfFile (hFile=0x114) returned 1 [0195.678] CloseHandle (hObject=0x114) returned 1 [0195.678] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.678] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json")) returned 1 [0195.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.678] lstrlenW (lpString=".doc") returned 4 [0195.679] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.679] lstrlenW (lpString=".docx") returned 5 [0195.679] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.679] lstrlenW (lpString=".pdf") returned 4 [0195.679] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.679] lstrlenW (lpString=".xls") returned 4 [0195.679] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.679] lstrlenW (lpString=".xlsx") returned 5 [0195.679] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.679] lstrlenW (lpString=".ppt") returned 4 [0195.679] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.679] lstrlenW (lpString=".zip") returned 4 [0195.679] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.679] lstrlenW (lpString=".rar") returned 4 [0195.679] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.679] lstrlenW (lpString=".bz2") returned 4 [0195.679] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.679] lstrlenW (lpString=".7z") returned 3 [0195.679] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.679] lstrlenW (lpString=".dbf") returned 4 [0195.679] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.679] lstrlenW (lpString=".1cd") returned 4 [0195.679] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.679] lstrlenW (lpString=".jpg") returned 4 [0195.679] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.680] lstrlenW (lpString=".doc") returned 4 [0195.680] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.680] lstrlenW (lpString=".docx") returned 5 [0195.680] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.680] lstrlenW (lpString=".pdf") returned 4 [0195.680] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.680] lstrlenW (lpString=".xls") returned 4 [0195.680] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.680] lstrlenW (lpString=".xlsx") returned 5 [0195.680] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.680] lstrlenW (lpString=".ppt") returned 4 [0195.680] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.680] lstrlenW (lpString=".zip") returned 4 [0195.680] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.680] lstrlenW (lpString=".rar") returned 4 [0195.680] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.680] lstrlenW (lpString=".bz2") returned 4 [0195.680] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.680] lstrlenW (lpString=".7z") returned 3 [0195.680] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.680] lstrlenW (lpString=".dbf") returned 4 [0195.680] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.680] lstrlenW (lpString=".1cd") returned 4 [0195.680] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\eu\\messages.json") returned 151 [0195.680] lstrlenW (lpString=".jpg") returned 4 [0195.680] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.681] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.681] lstrlenW (lpString="messages.json") returned 13 [0195.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.681] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=327) returned 1 [0195.681] CloseHandle (hObject=0x114) returned 1 [0195.681] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json")) returned 0x2020 [0195.681] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.682] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.682] GetLastError () returned 0x0 [0195.682] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x147, lpOverlapped=0x0) returned 1 [0195.683] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x150, lpOverlapped=0x0) returned 1 [0195.684] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.685] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.685] SetEndOfFile (hFile=0x150) returned 1 [0195.685] CloseHandle (hObject=0x150) returned 1 [0195.685] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.685] SetEndOfFile (hFile=0x114) returned 1 [0195.686] CloseHandle (hObject=0x114) returned 1 [0195.686] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.686] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json")) returned 1 [0195.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.686] lstrlenW (lpString=".doc") returned 4 [0195.686] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.686] lstrlenW (lpString=".docx") returned 5 [0195.686] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.686] lstrlenW (lpString=".pdf") returned 4 [0195.686] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.686] lstrlenW (lpString=".xls") returned 4 [0195.686] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.686] lstrlenW (lpString=".xlsx") returned 5 [0195.686] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.686] lstrlenW (lpString=".ppt") returned 4 [0195.686] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.687] lstrlenW (lpString=".zip") returned 4 [0195.687] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.687] lstrlenW (lpString=".rar") returned 4 [0195.687] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.687] lstrlenW (lpString=".bz2") returned 4 [0195.687] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.687] lstrlenW (lpString=".7z") returned 3 [0195.687] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.687] lstrlenW (lpString=".dbf") returned 4 [0195.687] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.687] lstrlenW (lpString=".1cd") returned 4 [0195.687] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.687] lstrlenW (lpString=".jpg") returned 4 [0195.687] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.687] lstrlenW (lpString=".doc") returned 4 [0195.687] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.687] lstrlenW (lpString=".docx") returned 5 [0195.687] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.687] lstrlenW (lpString=".pdf") returned 4 [0195.687] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.687] lstrlenW (lpString=".xls") returned 4 [0195.687] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.687] lstrlenW (lpString=".xlsx") returned 5 [0195.687] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.687] lstrlenW (lpString=".ppt") returned 4 [0195.687] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.687] lstrlenW (lpString=".zip") returned 4 [0195.688] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.688] lstrlenW (lpString=".rar") returned 4 [0195.688] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.688] lstrlenW (lpString=".bz2") returned 4 [0195.688] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.688] lstrlenW (lpString=".7z") returned 3 [0195.688] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.688] lstrlenW (lpString=".dbf") returned 4 [0195.688] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.688] lstrlenW (lpString=".1cd") returned 4 [0195.688] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\kn\\messages.json") returned 151 [0195.688] lstrlenW (lpString=".jpg") returned 4 [0195.688] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.688] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.688] lstrlenW (lpString="messages.json") returned 13 [0195.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.689] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=217) returned 1 [0195.689] CloseHandle (hObject=0x114) returned 1 [0195.689] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 0x2020 [0195.689] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.690] GetLastError () returned 0x0 [0195.690] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd9, lpOverlapped=0x0) returned 1 [0195.691] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.691] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.691] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.692] SetEndOfFile (hFile=0x150) returned 1 [0195.692] CloseHandle (hObject=0x150) returned 1 [0195.692] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.692] SetEndOfFile (hFile=0x114) returned 1 [0195.693] CloseHandle (hObject=0x114) returned 1 [0195.693] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.693] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json")) returned 1 [0195.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.693] lstrlenW (lpString=".doc") returned 4 [0195.693] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.693] lstrlenW (lpString=".docx") returned 5 [0195.693] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.693] lstrlenW (lpString=".pdf") returned 4 [0195.693] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.693] lstrlenW (lpString=".xls") returned 4 [0195.693] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.693] lstrlenW (lpString=".xlsx") returned 5 [0195.694] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.694] lstrlenW (lpString=".ppt") returned 4 [0195.694] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.694] lstrlenW (lpString=".zip") returned 4 [0195.694] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.694] lstrlenW (lpString=".rar") returned 4 [0195.694] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.694] lstrlenW (lpString=".bz2") returned 4 [0195.694] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.694] lstrlenW (lpString=".7z") returned 3 [0195.694] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.694] lstrlenW (lpString=".dbf") returned 4 [0195.694] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.694] lstrlenW (lpString=".1cd") returned 4 [0195.694] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.694] lstrlenW (lpString=".jpg") returned 4 [0195.694] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.694] lstrlenW (lpString=".doc") returned 4 [0195.694] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.694] lstrlenW (lpString=".docx") returned 5 [0195.694] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.694] lstrlenW (lpString=".pdf") returned 4 [0195.694] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.694] lstrlenW (lpString=".xls") returned 4 [0195.694] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.694] lstrlenW (lpString=".xlsx") returned 5 [0195.695] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.695] lstrlenW (lpString=".ppt") returned 4 [0195.695] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.695] lstrlenW (lpString=".zip") returned 4 [0195.695] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.695] lstrlenW (lpString=".rar") returned 4 [0195.695] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.695] lstrlenW (lpString=".bz2") returned 4 [0195.695] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.695] lstrlenW (lpString=".7z") returned 3 [0195.695] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.695] lstrlenW (lpString=".dbf") returned 4 [0195.695] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.695] lstrlenW (lpString=".1cd") returned 4 [0195.695] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ko\\messages.json") returned 151 [0195.695] lstrlenW (lpString=".jpg") returned 4 [0195.695] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.695] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.695] lstrlenW (lpString="messages.json") returned 13 [0195.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.696] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=450) returned 1 [0195.696] CloseHandle (hObject=0x114) returned 1 [0195.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json")) returned 0x2020 [0195.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.696] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.697] GetLastError () returned 0x0 [0195.697] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1c2, lpOverlapped=0x0) returned 1 [0195.698] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0195.699] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.699] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.699] SetEndOfFile (hFile=0x150) returned 1 [0195.699] CloseHandle (hObject=0x150) returned 1 [0195.699] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.699] SetEndOfFile (hFile=0x114) returned 1 [0195.700] CloseHandle (hObject=0x114) returned 1 [0195.700] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.700] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json")) returned 1 [0195.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.701] lstrlenW (lpString=".doc") returned 4 [0195.701] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.701] lstrlenW (lpString=".docx") returned 5 [0195.701] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.701] lstrlenW (lpString=".pdf") returned 4 [0195.701] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.701] lstrlenW (lpString=".xls") returned 4 [0195.701] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.701] lstrlenW (lpString=".xlsx") returned 5 [0195.701] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.701] lstrlenW (lpString=".ppt") returned 4 [0195.701] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.701] lstrlenW (lpString=".zip") returned 4 [0195.701] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.701] lstrlenW (lpString=".rar") returned 4 [0195.701] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.701] lstrlenW (lpString=".bz2") returned 4 [0195.701] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.701] lstrlenW (lpString=".7z") returned 3 [0195.701] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.701] lstrlenW (lpString=".dbf") returned 4 [0195.701] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.701] lstrlenW (lpString=".1cd") returned 4 [0195.701] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.701] lstrlenW (lpString=".jpg") returned 4 [0195.701] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.702] lstrlenW (lpString=".doc") returned 4 [0195.702] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.702] lstrlenW (lpString=".docx") returned 5 [0195.702] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.702] lstrlenW (lpString=".pdf") returned 4 [0195.702] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.702] lstrlenW (lpString=".xls") returned 4 [0195.702] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.702] lstrlenW (lpString=".xlsx") returned 5 [0195.702] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.702] lstrlenW (lpString=".ppt") returned 4 [0195.702] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.702] lstrlenW (lpString=".zip") returned 4 [0195.702] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.702] lstrlenW (lpString=".rar") returned 4 [0195.702] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.702] lstrlenW (lpString=".bz2") returned 4 [0195.702] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.702] lstrlenW (lpString=".7z") returned 3 [0195.702] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.702] lstrlenW (lpString=".dbf") returned 4 [0195.702] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.702] lstrlenW (lpString=".1cd") returned 4 [0195.702] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lo\\messages.json") returned 151 [0195.702] lstrlenW (lpString=".jpg") returned 4 [0195.702] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.703] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.703] lstrlenW (lpString="messages.json") returned 13 [0195.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.703] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=213) returned 1 [0195.703] CloseHandle (hObject=0x114) returned 1 [0195.703] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json")) returned 0x2020 [0195.703] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.704] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.704] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.704] GetLastError () returned 0x0 [0195.704] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd5, lpOverlapped=0x0) returned 1 [0195.705] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.706] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.706] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.706] SetEndOfFile (hFile=0x150) returned 1 [0195.706] CloseHandle (hObject=0x150) returned 1 [0195.706] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.706] SetEndOfFile (hFile=0x114) returned 1 [0195.707] CloseHandle (hObject=0x114) returned 1 [0195.707] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.707] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json")) returned 1 [0195.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.708] lstrlenW (lpString=".doc") returned 4 [0195.708] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.708] lstrlenW (lpString=".docx") returned 5 [0195.708] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.708] lstrlenW (lpString=".pdf") returned 4 [0195.708] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.708] lstrlenW (lpString=".xls") returned 4 [0195.708] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.708] lstrlenW (lpString=".xlsx") returned 5 [0195.708] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.708] lstrlenW (lpString=".ppt") returned 4 [0195.708] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.708] lstrlenW (lpString=".zip") returned 4 [0195.708] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.708] lstrlenW (lpString=".rar") returned 4 [0195.708] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.708] lstrlenW (lpString=".bz2") returned 4 [0195.708] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.708] lstrlenW (lpString=".7z") returned 3 [0195.708] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.708] lstrlenW (lpString=".dbf") returned 4 [0195.708] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.708] lstrlenW (lpString=".1cd") returned 4 [0195.708] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.708] lstrlenW (lpString=".jpg") returned 4 [0195.708] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.709] lstrlenW (lpString=".doc") returned 4 [0195.709] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.709] lstrlenW (lpString=".docx") returned 5 [0195.709] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.709] lstrlenW (lpString=".pdf") returned 4 [0195.709] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.709] lstrlenW (lpString=".xls") returned 4 [0195.709] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.709] lstrlenW (lpString=".xlsx") returned 5 [0195.709] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.709] lstrlenW (lpString=".ppt") returned 4 [0195.709] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.709] lstrlenW (lpString=".zip") returned 4 [0195.709] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.709] lstrlenW (lpString=".rar") returned 4 [0195.709] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.709] lstrlenW (lpString=".bz2") returned 4 [0195.709] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.709] lstrlenW (lpString=".7z") returned 3 [0195.709] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.709] lstrlenW (lpString=".dbf") returned 4 [0195.709] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.709] lstrlenW (lpString=".1cd") returned 4 [0195.709] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lt\\messages.json") returned 151 [0195.710] lstrlenW (lpString=".jpg") returned 4 [0195.710] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.710] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.710] lstrlenW (lpString="messages.json") returned 13 [0195.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.710] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=198) returned 1 [0195.710] CloseHandle (hObject=0x114) returned 1 [0195.710] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json")) returned 0x2020 [0195.710] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.710] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.711] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.711] GetLastError () returned 0x0 [0195.711] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xc6, lpOverlapped=0x0) returned 1 [0195.827] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.828] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.828] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.828] SetEndOfFile (hFile=0x150) returned 1 [0195.828] CloseHandle (hObject=0x150) returned 1 [0195.828] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.828] SetEndOfFile (hFile=0x114) returned 1 [0195.829] CloseHandle (hObject=0x114) returned 1 [0195.829] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.829] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json")) returned 1 [0195.829] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.829] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.829] lstrlenW (lpString=".doc") returned 4 [0195.829] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.829] lstrlenW (lpString=".docx") returned 5 [0195.829] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.829] lstrlenW (lpString=".pdf") returned 4 [0195.829] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.829] lstrlenW (lpString=".xls") returned 4 [0195.829] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.829] lstrlenW (lpString=".xlsx") returned 5 [0195.829] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.829] lstrlenW (lpString=".ppt") returned 4 [0195.829] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.830] lstrlenW (lpString=".zip") returned 4 [0195.830] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.830] lstrlenW (lpString=".rar") returned 4 [0195.830] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.830] lstrlenW (lpString=".bz2") returned 4 [0195.830] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.830] lstrlenW (lpString=".7z") returned 3 [0195.830] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.830] lstrlenW (lpString=".dbf") returned 4 [0195.830] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.830] lstrlenW (lpString=".1cd") returned 4 [0195.830] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.830] lstrlenW (lpString=".jpg") returned 4 [0195.830] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.830] lstrlenW (lpString=".doc") returned 4 [0195.830] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.830] lstrlenW (lpString=".docx") returned 5 [0195.830] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.830] lstrlenW (lpString=".pdf") returned 4 [0195.830] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.830] lstrlenW (lpString=".xls") returned 4 [0195.830] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.830] lstrlenW (lpString=".xlsx") returned 5 [0195.830] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.830] lstrlenW (lpString=".ppt") returned 4 [0195.830] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.830] lstrlenW (lpString=".zip") returned 4 [0195.831] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.831] lstrlenW (lpString=".rar") returned 4 [0195.831] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.831] lstrlenW (lpString=".bz2") returned 4 [0195.831] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.831] lstrlenW (lpString=".7z") returned 3 [0195.831] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.831] lstrlenW (lpString=".dbf") returned 4 [0195.831] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.831] lstrlenW (lpString=".1cd") returned 4 [0195.831] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\lv\\messages.json") returned 151 [0195.831] lstrlenW (lpString=".jpg") returned 4 [0195.831] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.831] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.831] lstrlenW (lpString="messages.json") returned 13 [0195.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.832] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=190) returned 1 [0195.832] CloseHandle (hObject=0x114) returned 1 [0195.832] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json")) returned 0x2020 [0195.832] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.832] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.832] GetLastError () returned 0x0 [0195.833] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xbe, lpOverlapped=0x0) returned 1 [0195.833] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.834] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.834] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.835] SetEndOfFile (hFile=0x150) returned 1 [0195.835] CloseHandle (hObject=0x150) returned 1 [0195.835] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.835] SetEndOfFile (hFile=0x114) returned 1 [0195.836] CloseHandle (hObject=0x114) returned 1 [0195.836] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.836] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json")) returned 1 [0195.836] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.836] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.836] lstrlenW (lpString=".doc") returned 4 [0195.836] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.836] lstrlenW (lpString=".docx") returned 5 [0195.836] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.836] lstrlenW (lpString=".pdf") returned 4 [0195.836] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.836] lstrlenW (lpString=".xls") returned 4 [0195.836] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.836] lstrlenW (lpString=".xlsx") returned 5 [0195.836] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.836] lstrlenW (lpString=".ppt") returned 4 [0195.836] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.836] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.836] lstrlenW (lpString=".zip") returned 4 [0195.836] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.836] lstrlenW (lpString=".rar") returned 4 [0195.836] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.836] lstrlenW (lpString=".bz2") returned 4 [0195.836] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.836] lstrlenW (lpString=".7z") returned 3 [0195.837] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.837] lstrlenW (lpString=".dbf") returned 4 [0195.837] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.837] lstrlenW (lpString=".1cd") returned 4 [0195.837] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.837] lstrlenW (lpString=".jpg") returned 4 [0195.837] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.837] lstrlenW (lpString=".doc") returned 4 [0195.837] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.837] lstrlenW (lpString=".docx") returned 5 [0195.837] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.837] lstrlenW (lpString=".pdf") returned 4 [0195.837] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.837] lstrlenW (lpString=".xls") returned 4 [0195.837] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.837] lstrlenW (lpString=".xlsx") returned 5 [0195.837] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.837] lstrlenW (lpString=".ppt") returned 4 [0195.837] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.837] lstrlenW (lpString=".zip") returned 4 [0195.837] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.837] lstrlenW (lpString=".rar") returned 4 [0195.837] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.837] lstrlenW (lpString=".bz2") returned 4 [0195.837] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.837] lstrlenW (lpString=".7z") returned 3 [0195.837] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.837] lstrlenW (lpString=".dbf") returned 4 [0195.838] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.838] lstrlenW (lpString=".1cd") returned 4 [0195.838] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sl\\messages.json") returned 151 [0195.838] lstrlenW (lpString=".jpg") returned 4 [0195.838] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.838] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.838] lstrlenW (lpString="messages.json") returned 13 [0195.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.839] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=260) returned 1 [0195.839] CloseHandle (hObject=0x114) returned 1 [0195.839] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json")) returned 0x2020 [0195.839] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.839] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.840] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.840] GetLastError () returned 0x0 [0195.840] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x104, lpOverlapped=0x0) returned 1 [0195.841] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0195.842] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.842] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.842] SetEndOfFile (hFile=0x150) returned 1 [0195.842] CloseHandle (hObject=0x150) returned 1 [0195.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.842] SetEndOfFile (hFile=0x114) returned 1 [0195.843] CloseHandle (hObject=0x114) returned 1 [0195.843] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.843] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json")) returned 1 [0195.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.843] lstrlenW (lpString=".doc") returned 4 [0195.843] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.844] lstrlenW (lpString=".docx") returned 5 [0195.844] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.844] lstrlenW (lpString=".pdf") returned 4 [0195.844] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.844] lstrlenW (lpString=".xls") returned 4 [0195.844] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.844] lstrlenW (lpString=".xlsx") returned 5 [0195.844] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.844] lstrlenW (lpString=".ppt") returned 4 [0195.844] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.844] lstrlenW (lpString=".zip") returned 4 [0195.844] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.844] lstrlenW (lpString=".rar") returned 4 [0195.844] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.844] lstrlenW (lpString=".bz2") returned 4 [0195.844] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.844] lstrlenW (lpString=".7z") returned 3 [0195.844] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.844] lstrlenW (lpString=".dbf") returned 4 [0195.844] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.844] lstrlenW (lpString=".1cd") returned 4 [0195.844] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.844] lstrlenW (lpString=".jpg") returned 4 [0195.844] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.844] lstrlenW (lpString=".doc") returned 4 [0195.844] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.844] lstrlenW (lpString=".docx") returned 5 [0195.844] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.844] lstrlenW (lpString=".pdf") returned 4 [0195.845] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.845] lstrlenW (lpString=".xls") returned 4 [0195.845] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.845] lstrlenW (lpString=".xlsx") returned 5 [0195.845] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.845] lstrlenW (lpString=".ppt") returned 4 [0195.845] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.845] lstrlenW (lpString=".zip") returned 4 [0195.845] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.845] lstrlenW (lpString=".rar") returned 4 [0195.845] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.845] lstrlenW (lpString=".bz2") returned 4 [0195.845] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.845] lstrlenW (lpString=".7z") returned 3 [0195.845] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.845] lstrlenW (lpString=".dbf") returned 4 [0195.845] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.845] lstrlenW (lpString=".1cd") returned 4 [0195.845] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sr\\messages.json") returned 151 [0195.845] lstrlenW (lpString=".jpg") returned 4 [0195.845] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.845] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.845] lstrlenW (lpString="messages.json") returned 13 [0195.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.846] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=179) returned 1 [0195.846] CloseHandle (hObject=0x114) returned 1 [0195.847] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json")) returned 0x2020 [0195.847] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.847] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.847] GetLastError () returned 0x0 [0195.847] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xb3, lpOverlapped=0x0) returned 1 [0195.848] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.849] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.849] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.849] SetEndOfFile (hFile=0x150) returned 1 [0195.849] CloseHandle (hObject=0x150) returned 1 [0195.849] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.849] SetEndOfFile (hFile=0x114) returned 1 [0195.850] CloseHandle (hObject=0x114) returned 1 [0195.850] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.850] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json")) returned 1 [0195.850] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.851] lstrlenW (lpString=".doc") returned 4 [0195.851] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.851] lstrlenW (lpString=".docx") returned 5 [0195.851] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.851] lstrlenW (lpString=".pdf") returned 4 [0195.851] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.851] lstrlenW (lpString=".xls") returned 4 [0195.851] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.851] lstrlenW (lpString=".xlsx") returned 5 [0195.851] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.851] lstrlenW (lpString=".ppt") returned 4 [0195.851] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.851] lstrlenW (lpString=".zip") returned 4 [0195.851] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.851] lstrlenW (lpString=".rar") returned 4 [0195.851] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.851] lstrlenW (lpString=".bz2") returned 4 [0195.851] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.851] lstrlenW (lpString=".7z") returned 3 [0195.851] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.851] lstrlenW (lpString=".dbf") returned 4 [0195.851] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.851] lstrlenW (lpString=".1cd") returned 4 [0195.851] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.851] lstrlenW (lpString=".jpg") returned 4 [0195.851] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.851] lstrlenW (lpString=".doc") returned 4 [0195.852] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.852] lstrlenW (lpString=".docx") returned 5 [0195.852] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.852] lstrlenW (lpString=".pdf") returned 4 [0195.852] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.852] lstrlenW (lpString=".xls") returned 4 [0195.852] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.852] lstrlenW (lpString=".xlsx") returned 5 [0195.852] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.852] lstrlenW (lpString=".ppt") returned 4 [0195.852] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.852] lstrlenW (lpString=".zip") returned 4 [0195.852] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.852] lstrlenW (lpString=".rar") returned 4 [0195.852] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.852] lstrlenW (lpString=".bz2") returned 4 [0195.852] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.852] lstrlenW (lpString=".7z") returned 3 [0195.852] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.852] lstrlenW (lpString=".dbf") returned 4 [0195.852] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.852] lstrlenW (lpString=".1cd") returned 4 [0195.852] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sv\\messages.json") returned 151 [0195.852] lstrlenW (lpString=".jpg") returned 4 [0195.852] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.852] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.852] lstrlenW (lpString="messages.json") returned 13 [0195.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.854] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=196) returned 1 [0195.854] CloseHandle (hObject=0x114) returned 1 [0195.855] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json")) returned 0x2020 [0195.855] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.855] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.855] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.855] GetLastError () returned 0x0 [0195.855] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xc4, lpOverlapped=0x0) returned 1 [0195.856] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.857] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.857] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.857] SetEndOfFile (hFile=0x150) returned 1 [0195.857] CloseHandle (hObject=0x150) returned 1 [0195.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.858] SetEndOfFile (hFile=0x114) returned 1 [0195.858] CloseHandle (hObject=0x114) returned 1 [0195.858] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.858] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json")) returned 1 [0195.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.859] lstrlenW (lpString=".doc") returned 4 [0195.859] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.859] lstrlenW (lpString=".docx") returned 5 [0195.859] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.859] lstrlenW (lpString=".pdf") returned 4 [0195.859] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.859] lstrlenW (lpString=".xls") returned 4 [0195.859] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.859] lstrlenW (lpString=".xlsx") returned 5 [0195.859] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.859] lstrlenW (lpString=".ppt") returned 4 [0195.859] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.859] lstrlenW (lpString=".zip") returned 4 [0195.859] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.859] lstrlenW (lpString=".rar") returned 4 [0195.859] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.859] lstrlenW (lpString=".bz2") returned 4 [0195.859] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.859] lstrlenW (lpString=".7z") returned 3 [0195.859] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.859] lstrlenW (lpString=".dbf") returned 4 [0195.859] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.859] lstrlenW (lpString=".1cd") returned 4 [0195.859] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.860] lstrlenW (lpString=".jpg") returned 4 [0195.860] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.860] lstrlenW (lpString=".doc") returned 4 [0195.860] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.860] lstrlenW (lpString=".docx") returned 5 [0195.860] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.860] lstrlenW (lpString=".pdf") returned 4 [0195.860] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.860] lstrlenW (lpString=".xls") returned 4 [0195.860] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.860] lstrlenW (lpString=".xlsx") returned 5 [0195.860] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.860] lstrlenW (lpString=".ppt") returned 4 [0195.860] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.860] lstrlenW (lpString=".zip") returned 4 [0195.860] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.860] lstrlenW (lpString=".rar") returned 4 [0195.860] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.860] lstrlenW (lpString=".bz2") returned 4 [0195.860] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.860] lstrlenW (lpString=".7z") returned 3 [0195.860] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.860] lstrlenW (lpString=".dbf") returned 4 [0195.860] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.860] lstrlenW (lpString=".1cd") returned 4 [0195.860] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sw\\messages.json") returned 151 [0195.860] lstrlenW (lpString=".jpg") returned 4 [0195.861] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.861] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.861] lstrlenW (lpString="messages.json") returned 13 [0195.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.861] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=336) returned 1 [0195.861] CloseHandle (hObject=0x114) returned 1 [0195.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json")) returned 0x2020 [0195.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.862] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0195.862] GetLastError () returned 0x0 [0195.862] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x150, lpOverlapped=0x0) returned 1 [0196.022] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x160, lpOverlapped=0x0) returned 1 [0196.023] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.023] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.023] SetEndOfFile (hFile=0x150) returned 1 [0196.023] CloseHandle (hObject=0x150) returned 1 [0196.024] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.024] SetEndOfFile (hFile=0x114) returned 1 [0196.024] CloseHandle (hObject=0x114) returned 1 [0196.024] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.024] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json")) returned 1 [0196.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.025] lstrlenW (lpString=".doc") returned 4 [0196.025] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.025] lstrlenW (lpString=".docx") returned 5 [0196.025] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.025] lstrlenW (lpString=".pdf") returned 4 [0196.025] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.025] lstrlenW (lpString=".xls") returned 4 [0196.025] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.025] lstrlenW (lpString=".xlsx") returned 5 [0196.025] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.025] lstrlenW (lpString=".ppt") returned 4 [0196.025] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.025] lstrlenW (lpString=".zip") returned 4 [0196.025] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.025] lstrlenW (lpString=".rar") returned 4 [0196.025] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.025] lstrlenW (lpString=".bz2") returned 4 [0196.025] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.025] lstrlenW (lpString=".7z") returned 3 [0196.025] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.025] lstrlenW (lpString=".dbf") returned 4 [0196.025] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.026] lstrlenW (lpString=".1cd") returned 4 [0196.026] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.026] lstrlenW (lpString=".jpg") returned 4 [0196.026] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.026] lstrlenW (lpString=".doc") returned 4 [0196.026] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.026] lstrlenW (lpString=".docx") returned 5 [0196.026] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.026] lstrlenW (lpString=".pdf") returned 4 [0196.026] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.026] lstrlenW (lpString=".xls") returned 4 [0196.026] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.026] lstrlenW (lpString=".xlsx") returned 5 [0196.026] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.026] lstrlenW (lpString=".ppt") returned 4 [0196.026] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.026] lstrlenW (lpString=".zip") returned 4 [0196.026] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.026] lstrlenW (lpString=".rar") returned 4 [0196.026] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.026] lstrlenW (lpString=".bz2") returned 4 [0196.026] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.027] lstrlenW (lpString=".7z") returned 3 [0196.027] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.027] lstrlenW (lpString=".dbf") returned 4 [0196.027] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.027] lstrlenW (lpString=".1cd") returned 4 [0196.027] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ta\\messages.json") returned 151 [0196.027] lstrlenW (lpString=".jpg") returned 4 [0196.027] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.027] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.027] lstrlenW (lpString="verified_contents.json") returned 22 [0196.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.224] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=17492) returned 1 [0196.235] CloseHandle (hObject=0x358) returned 1 [0196.235] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 0x2020 [0196.235] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.242] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.250] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.250] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.250] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.258] GetLastError () returned 0x0 [0196.258] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x4454, lpOverlapped=0x0) returned 1 [0196.260] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x4460, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4460, lpOverlapped=0x0) returned 1 [0196.261] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.261] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x100, lpOverlapped=0x0) returned 1 [0196.261] SetEndOfFile (hFile=0x120) returned 1 [0196.261] CloseHandle (hObject=0x120) returned 1 [0196.261] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.262] SetEndOfFile (hFile=0x358) returned 1 [0196.262] CloseHandle (hObject=0x358) returned 1 [0196.262] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.263] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json")) returned 1 [0196.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.263] lstrlenW (lpString=".doc") returned 4 [0196.263] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.263] lstrlenW (lpString=".docx") returned 5 [0196.263] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.263] lstrlenW (lpString=".pdf") returned 4 [0196.263] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.263] lstrlenW (lpString=".xls") returned 4 [0196.263] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.263] lstrlenW (lpString=".xlsx") returned 5 [0196.263] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.263] lstrlenW (lpString=".ppt") returned 4 [0196.263] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.263] lstrlenW (lpString=".zip") returned 4 [0196.263] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.263] lstrlenW (lpString=".rar") returned 4 [0196.263] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.263] lstrlenW (lpString=".bz2") returned 4 [0196.263] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.263] lstrlenW (lpString=".7z") returned 3 [0196.263] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.263] lstrlenW (lpString=".dbf") returned 4 [0196.263] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.264] lstrlenW (lpString=".1cd") returned 4 [0196.264] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.264] lstrlenW (lpString=".jpg") returned 4 [0196.264] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.264] lstrlenW (lpString=".doc") returned 4 [0196.264] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.264] lstrlenW (lpString=".docx") returned 5 [0196.264] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.264] lstrlenW (lpString=".pdf") returned 4 [0196.264] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.264] lstrlenW (lpString=".xls") returned 4 [0196.264] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.264] lstrlenW (lpString=".xlsx") returned 5 [0196.264] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.264] lstrlenW (lpString=".ppt") returned 4 [0196.264] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.264] lstrlenW (lpString=".zip") returned 4 [0196.264] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.264] lstrlenW (lpString=".rar") returned 4 [0196.264] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.264] lstrlenW (lpString=".bz2") returned 4 [0196.264] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.264] lstrlenW (lpString=".7z") returned 3 [0196.264] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.264] lstrlenW (lpString=".dbf") returned 4 [0196.264] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.265] lstrlenW (lpString=".1cd") returned 4 [0196.265] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\verified_contents.json") returned 158 [0196.265] lstrlenW (lpString=".jpg") returned 4 [0196.265] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.265] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.265] lstrlenW (lpString="messages.json") returned 13 [0196.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.265] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=667) returned 1 [0196.265] CloseHandle (hObject=0x358) returned 1 [0196.265] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0196.266] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.266] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.266] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.266] GetLastError () returned 0x0 [0196.266] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x29b, lpOverlapped=0x0) returned 1 [0196.268] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0196.269] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.269] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.269] SetEndOfFile (hFile=0x120) returned 1 [0196.269] CloseHandle (hObject=0x120) returned 1 [0196.269] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.269] SetEndOfFile (hFile=0x358) returned 1 [0196.270] CloseHandle (hObject=0x358) returned 1 [0196.270] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.270] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json")) returned 1 [0196.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.270] lstrlenW (lpString=".doc") returned 4 [0196.271] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.271] lstrlenW (lpString=".docx") returned 5 [0196.271] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.271] lstrlenW (lpString=".pdf") returned 4 [0196.271] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.271] lstrlenW (lpString=".xls") returned 4 [0196.271] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.271] lstrlenW (lpString=".xlsx") returned 5 [0196.271] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.271] lstrlenW (lpString=".ppt") returned 4 [0196.271] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.271] lstrlenW (lpString=".zip") returned 4 [0196.271] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.271] lstrlenW (lpString=".rar") returned 4 [0196.271] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.271] lstrlenW (lpString=".bz2") returned 4 [0196.271] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.271] lstrlenW (lpString=".7z") returned 3 [0196.271] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.271] lstrlenW (lpString=".dbf") returned 4 [0196.271] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.271] lstrlenW (lpString=".1cd") returned 4 [0196.271] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.271] lstrlenW (lpString=".jpg") returned 4 [0196.271] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.271] lstrlenW (lpString=".doc") returned 4 [0196.271] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.271] lstrlenW (lpString=".docx") returned 5 [0196.272] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.272] lstrlenW (lpString=".pdf") returned 4 [0196.272] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.272] lstrlenW (lpString=".xls") returned 4 [0196.272] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.272] lstrlenW (lpString=".xlsx") returned 5 [0196.272] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.272] lstrlenW (lpString=".ppt") returned 4 [0196.272] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.272] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.272] lstrlenW (lpString=".zip") returned 4 [0196.272] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.272] lstrlenW (lpString=".rar") returned 4 [0196.272] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.272] lstrlenW (lpString=".bz2") returned 4 [0196.272] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.272] lstrlenW (lpString=".7z") returned 3 [0196.272] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.272] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.272] lstrlenW (lpString=".dbf") returned 4 [0196.272] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.272] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.272] lstrlenW (lpString=".1cd") returned 4 [0196.272] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.272] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es_419\\messages.json") returned 159 [0196.272] lstrlenW (lpString=".jpg") returned 4 [0196.272] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.272] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.272] lstrlenW (lpString="messages.json") returned 13 [0196.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.273] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=609) returned 1 [0196.273] CloseHandle (hObject=0x358) returned 1 [0196.274] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json")) returned 0x2020 [0196.274] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.274] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.274] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.274] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.275] GetLastError () returned 0x0 [0196.275] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x261, lpOverlapped=0x0) returned 1 [0196.276] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x270, lpOverlapped=0x0) returned 1 [0196.277] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.277] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.277] SetEndOfFile (hFile=0x120) returned 1 [0196.277] CloseHandle (hObject=0x120) returned 1 [0196.278] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.278] SetEndOfFile (hFile=0x358) returned 1 [0196.278] CloseHandle (hObject=0x358) returned 1 [0196.278] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.279] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json")) returned 1 [0196.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.279] lstrlenW (lpString=".doc") returned 4 [0196.279] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.279] lstrlenW (lpString=".docx") returned 5 [0196.279] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.279] lstrlenW (lpString=".pdf") returned 4 [0196.279] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.279] lstrlenW (lpString=".xls") returned 4 [0196.279] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.279] lstrlenW (lpString=".xlsx") returned 5 [0196.279] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.279] lstrlenW (lpString=".ppt") returned 4 [0196.279] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.279] lstrlenW (lpString=".zip") returned 4 [0196.279] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.279] lstrlenW (lpString=".rar") returned 4 [0196.279] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.279] lstrlenW (lpString=".bz2") returned 4 [0196.279] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.279] lstrlenW (lpString=".7z") returned 3 [0196.279] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.279] lstrlenW (lpString=".dbf") returned 4 [0196.279] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.280] lstrlenW (lpString=".1cd") returned 4 [0196.280] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.280] lstrlenW (lpString=".jpg") returned 4 [0196.280] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.280] lstrlenW (lpString=".doc") returned 4 [0196.280] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.280] lstrlenW (lpString=".docx") returned 5 [0196.280] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.280] lstrlenW (lpString=".pdf") returned 4 [0196.280] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.280] lstrlenW (lpString=".xls") returned 4 [0196.280] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.280] lstrlenW (lpString=".xlsx") returned 5 [0196.280] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.280] lstrlenW (lpString=".ppt") returned 4 [0196.280] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.280] lstrlenW (lpString=".zip") returned 4 [0196.280] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.280] lstrlenW (lpString=".rar") returned 4 [0196.280] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.280] lstrlenW (lpString=".bz2") returned 4 [0196.280] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.280] lstrlenW (lpString=".7z") returned 3 [0196.280] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.280] lstrlenW (lpString=".dbf") returned 4 [0196.280] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.280] lstrlenW (lpString=".1cd") returned 4 [0196.281] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\et\\messages.json") returned 155 [0196.281] lstrlenW (lpString=".jpg") returned 4 [0196.281] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.281] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.281] lstrlenW (lpString="messages.json") returned 13 [0196.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.281] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=673) returned 1 [0196.281] CloseHandle (hObject=0x358) returned 1 [0196.281] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json")) returned 0x2020 [0196.281] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.282] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.282] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.282] GetLastError () returned 0x0 [0196.282] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x2a1, lpOverlapped=0x0) returned 1 [0196.284] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0196.285] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.285] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.285] SetEndOfFile (hFile=0x120) returned 1 [0196.285] CloseHandle (hObject=0x120) returned 1 [0196.285] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.285] SetEndOfFile (hFile=0x358) returned 1 [0196.286] CloseHandle (hObject=0x358) returned 1 [0196.286] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.286] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json")) returned 1 [0196.286] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.286] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.286] lstrlenW (lpString=".doc") returned 4 [0196.286] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.286] lstrlenW (lpString=".docx") returned 5 [0196.286] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.286] lstrlenW (lpString=".pdf") returned 4 [0196.286] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.286] lstrlenW (lpString=".xls") returned 4 [0196.286] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.286] lstrlenW (lpString=".xlsx") returned 5 [0196.286] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.286] lstrlenW (lpString=".ppt") returned 4 [0196.286] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.287] lstrlenW (lpString=".zip") returned 4 [0196.287] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.287] lstrlenW (lpString=".rar") returned 4 [0196.287] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.287] lstrlenW (lpString=".bz2") returned 4 [0196.287] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.287] lstrlenW (lpString=".7z") returned 3 [0196.287] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.287] lstrlenW (lpString=".dbf") returned 4 [0196.287] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.287] lstrlenW (lpString=".1cd") returned 4 [0196.287] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.287] lstrlenW (lpString=".jpg") returned 4 [0196.287] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.287] lstrlenW (lpString=".doc") returned 4 [0196.287] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.287] lstrlenW (lpString=".docx") returned 5 [0196.287] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.287] lstrlenW (lpString=".pdf") returned 4 [0196.287] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.287] lstrlenW (lpString=".xls") returned 4 [0196.287] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.287] lstrlenW (lpString=".xlsx") returned 5 [0196.287] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.287] lstrlenW (lpString=".ppt") returned 4 [0196.287] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.288] lstrlenW (lpString=".zip") returned 4 [0196.288] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.288] lstrlenW (lpString=".rar") returned 4 [0196.288] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.288] lstrlenW (lpString=".bz2") returned 4 [0196.288] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.288] lstrlenW (lpString=".7z") returned 3 [0196.288] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.288] lstrlenW (lpString=".dbf") returned 4 [0196.288] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.288] lstrlenW (lpString=".1cd") returned 4 [0196.288] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fi\\messages.json") returned 155 [0196.288] lstrlenW (lpString=".jpg") returned 4 [0196.288] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.288] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.288] lstrlenW (lpString="messages.json") returned 13 [0196.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.289] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=692) returned 1 [0196.289] CloseHandle (hObject=0x358) returned 1 [0196.289] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json")) returned 0x2020 [0196.289] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.289] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.289] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.289] GetLastError () returned 0x0 [0196.289] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x2b4, lpOverlapped=0x0) returned 1 [0196.292] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0196.293] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.293] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.293] SetEndOfFile (hFile=0x120) returned 1 [0196.294] CloseHandle (hObject=0x120) returned 1 [0196.294] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.294] SetEndOfFile (hFile=0x358) returned 1 [0196.294] CloseHandle (hObject=0x358) returned 1 [0196.295] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.295] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json")) returned 1 [0196.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.295] lstrlenW (lpString=".doc") returned 4 [0196.295] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.295] lstrlenW (lpString=".docx") returned 5 [0196.295] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.295] lstrlenW (lpString=".pdf") returned 4 [0196.295] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.295] lstrlenW (lpString=".xls") returned 4 [0196.295] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.295] lstrlenW (lpString=".xlsx") returned 5 [0196.295] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.295] lstrlenW (lpString=".ppt") returned 4 [0196.295] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.295] lstrlenW (lpString=".zip") returned 4 [0196.295] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.295] lstrlenW (lpString=".rar") returned 4 [0196.295] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.295] lstrlenW (lpString=".bz2") returned 4 [0196.295] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.296] lstrlenW (lpString=".7z") returned 3 [0196.296] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.296] lstrlenW (lpString=".dbf") returned 4 [0196.296] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.296] lstrlenW (lpString=".1cd") returned 4 [0196.296] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.296] lstrlenW (lpString=".jpg") returned 4 [0196.296] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.296] lstrlenW (lpString=".doc") returned 4 [0196.296] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.296] lstrlenW (lpString=".docx") returned 5 [0196.296] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.296] lstrlenW (lpString=".pdf") returned 4 [0196.296] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.296] lstrlenW (lpString=".xls") returned 4 [0196.296] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.296] lstrlenW (lpString=".xlsx") returned 5 [0196.296] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.296] lstrlenW (lpString=".ppt") returned 4 [0196.296] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.296] lstrlenW (lpString=".zip") returned 4 [0196.296] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.296] lstrlenW (lpString=".rar") returned 4 [0196.296] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.296] lstrlenW (lpString=".bz2") returned 4 [0196.296] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.296] lstrlenW (lpString=".7z") returned 3 [0196.296] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.297] lstrlenW (lpString=".dbf") returned 4 [0196.297] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.297] lstrlenW (lpString=".1cd") returned 4 [0196.297] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fil\\messages.json") returned 156 [0196.297] lstrlenW (lpString=".jpg") returned 4 [0196.297] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.297] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.297] lstrlenW (lpString="messages.json") returned 13 [0196.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.297] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=708) returned 1 [0196.298] CloseHandle (hObject=0x358) returned 1 [0196.298] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json")) returned 0x2020 [0196.298] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.298] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.298] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.298] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.299] GetLastError () returned 0x0 [0196.299] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x2c4, lpOverlapped=0x0) returned 1 [0196.497] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0196.498] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.498] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.499] SetEndOfFile (hFile=0x120) returned 1 [0196.499] CloseHandle (hObject=0x120) returned 1 [0196.499] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.499] SetEndOfFile (hFile=0x358) returned 1 [0196.499] CloseHandle (hObject=0x358) returned 1 [0196.500] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.500] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json")) returned 1 [0196.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.500] lstrlenW (lpString=".doc") returned 4 [0196.500] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.500] lstrlenW (lpString=".docx") returned 5 [0196.500] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.500] lstrlenW (lpString=".pdf") returned 4 [0196.500] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.500] lstrlenW (lpString=".xls") returned 4 [0196.500] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.500] lstrlenW (lpString=".xlsx") returned 5 [0196.500] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.500] lstrlenW (lpString=".ppt") returned 4 [0196.500] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.500] lstrlenW (lpString=".zip") returned 4 [0196.500] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.501] lstrlenW (lpString=".rar") returned 4 [0196.501] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.501] lstrlenW (lpString=".bz2") returned 4 [0196.501] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.501] lstrlenW (lpString=".7z") returned 3 [0196.501] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.501] lstrlenW (lpString=".dbf") returned 4 [0196.501] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.501] lstrlenW (lpString=".1cd") returned 4 [0196.501] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.501] lstrlenW (lpString=".jpg") returned 4 [0196.501] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.501] lstrlenW (lpString=".doc") returned 4 [0196.501] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.501] lstrlenW (lpString=".docx") returned 5 [0196.501] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.501] lstrlenW (lpString=".pdf") returned 4 [0196.501] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.501] lstrlenW (lpString=".xls") returned 4 [0196.501] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.501] lstrlenW (lpString=".xlsx") returned 5 [0196.501] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.501] lstrlenW (lpString=".ppt") returned 4 [0196.501] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.501] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.501] lstrlenW (lpString=".zip") returned 4 [0196.501] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.501] lstrlenW (lpString=".rar") returned 4 [0196.501] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.502] lstrlenW (lpString=".bz2") returned 4 [0196.502] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.502] lstrlenW (lpString=".7z") returned 3 [0196.502] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.502] lstrlenW (lpString=".dbf") returned 4 [0196.502] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.502] lstrlenW (lpString=".1cd") returned 4 [0196.502] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\fr\\messages.json") returned 155 [0196.502] lstrlenW (lpString=".jpg") returned 4 [0196.502] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.502] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.502] lstrlenW (lpString="messages.json") returned 13 [0196.502] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.503] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=668) returned 1 [0196.503] CloseHandle (hObject=0x358) returned 1 [0196.503] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json")) returned 0x2020 [0196.503] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.503] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.503] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.503] GetLastError () returned 0x0 [0196.504] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x29c, lpOverlapped=0x0) returned 1 [0196.506] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0196.507] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.507] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.507] SetEndOfFile (hFile=0x120) returned 1 [0196.507] CloseHandle (hObject=0x120) returned 1 [0196.507] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.507] SetEndOfFile (hFile=0x358) returned 1 [0196.508] CloseHandle (hObject=0x358) returned 1 [0196.508] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.508] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json")) returned 1 [0196.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.508] lstrlenW (lpString=".doc") returned 4 [0196.508] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.508] lstrlenW (lpString=".docx") returned 5 [0196.508] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.508] lstrlenW (lpString=".pdf") returned 4 [0196.509] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.509] lstrlenW (lpString=".xls") returned 4 [0196.509] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.509] lstrlenW (lpString=".xlsx") returned 5 [0196.509] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.509] lstrlenW (lpString=".ppt") returned 4 [0196.509] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.509] lstrlenW (lpString=".zip") returned 4 [0196.509] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.509] lstrlenW (lpString=".rar") returned 4 [0196.509] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.509] lstrlenW (lpString=".bz2") returned 4 [0196.509] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.509] lstrlenW (lpString=".7z") returned 3 [0196.509] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.509] lstrlenW (lpString=".dbf") returned 4 [0196.509] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.509] lstrlenW (lpString=".1cd") returned 4 [0196.509] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.509] lstrlenW (lpString=".jpg") returned 4 [0196.509] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.509] lstrlenW (lpString=".doc") returned 4 [0196.509] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.509] lstrlenW (lpString=".docx") returned 5 [0196.509] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.509] lstrlenW (lpString=".pdf") returned 4 [0196.510] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.510] lstrlenW (lpString=".xls") returned 4 [0196.510] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.510] lstrlenW (lpString=".xlsx") returned 5 [0196.510] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.510] lstrlenW (lpString=".ppt") returned 4 [0196.510] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.510] lstrlenW (lpString=".zip") returned 4 [0196.510] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.510] lstrlenW (lpString=".rar") returned 4 [0196.510] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.510] lstrlenW (lpString=".bz2") returned 4 [0196.510] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.510] lstrlenW (lpString=".7z") returned 3 [0196.510] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.510] lstrlenW (lpString=".dbf") returned 4 [0196.510] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.510] lstrlenW (lpString=".1cd") returned 4 [0196.510] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ro\\messages.json") returned 155 [0196.510] lstrlenW (lpString=".jpg") returned 4 [0196.510] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.510] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.510] lstrlenW (lpString="messages.json") returned 13 [0196.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.511] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=783) returned 1 [0196.511] CloseHandle (hObject=0x358) returned 1 [0196.511] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 0x2020 [0196.511] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.511] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.511] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.512] GetLastError () returned 0x0 [0196.512] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x30f, lpOverlapped=0x0) returned 1 [0196.514] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x310, lpOverlapped=0x0) returned 1 [0196.515] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.515] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.515] SetEndOfFile (hFile=0x120) returned 1 [0196.515] CloseHandle (hObject=0x120) returned 1 [0196.515] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.515] SetEndOfFile (hFile=0x358) returned 1 [0196.516] CloseHandle (hObject=0x358) returned 1 [0196.516] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.516] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json")) returned 1 [0196.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.516] lstrlenW (lpString=".doc") returned 4 [0196.516] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.516] lstrlenW (lpString=".docx") returned 5 [0196.516] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.516] lstrlenW (lpString=".pdf") returned 4 [0196.516] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.517] lstrlenW (lpString=".xls") returned 4 [0196.517] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.517] lstrlenW (lpString=".xlsx") returned 5 [0196.517] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.517] lstrlenW (lpString=".ppt") returned 4 [0196.517] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.517] lstrlenW (lpString=".zip") returned 4 [0196.517] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.517] lstrlenW (lpString=".rar") returned 4 [0196.517] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.517] lstrlenW (lpString=".bz2") returned 4 [0196.517] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.517] lstrlenW (lpString=".7z") returned 3 [0196.517] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.517] lstrlenW (lpString=".dbf") returned 4 [0196.517] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.517] lstrlenW (lpString=".1cd") returned 4 [0196.517] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.517] lstrlenW (lpString=".jpg") returned 4 [0196.517] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.517] lstrlenW (lpString=".doc") returned 4 [0196.517] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.517] lstrlenW (lpString=".docx") returned 5 [0196.517] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.517] lstrlenW (lpString=".pdf") returned 4 [0196.517] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.517] lstrlenW (lpString=".xls") returned 4 [0196.517] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.518] lstrlenW (lpString=".xlsx") returned 5 [0196.518] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.518] lstrlenW (lpString=".ppt") returned 4 [0196.518] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.518] lstrlenW (lpString=".zip") returned 4 [0196.518] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.518] lstrlenW (lpString=".rar") returned 4 [0196.518] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.518] lstrlenW (lpString=".bz2") returned 4 [0196.518] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.518] lstrlenW (lpString=".7z") returned 3 [0196.518] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.518] lstrlenW (lpString=".dbf") returned 4 [0196.518] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.518] lstrlenW (lpString=".1cd") returned 4 [0196.518] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ru\\messages.json") returned 155 [0196.518] lstrlenW (lpString=".jpg") returned 4 [0196.518] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.518] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.518] lstrlenW (lpString="messages.json") returned 13 [0196.518] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.519] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=671) returned 1 [0196.519] CloseHandle (hObject=0x358) returned 1 [0196.519] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 0x2020 [0196.519] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.519] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.519] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.520] GetLastError () returned 0x0 [0196.520] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x29f, lpOverlapped=0x0) returned 1 [0196.522] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0196.523] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.523] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.523] SetEndOfFile (hFile=0x120) returned 1 [0196.524] CloseHandle (hObject=0x120) returned 1 [0196.524] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.524] SetEndOfFile (hFile=0x358) returned 1 [0196.524] CloseHandle (hObject=0x358) returned 1 [0196.524] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.525] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json")) returned 1 [0196.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.525] lstrlenW (lpString=".doc") returned 4 [0196.525] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.525] lstrlenW (lpString=".docx") returned 5 [0196.525] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.525] lstrlenW (lpString=".pdf") returned 4 [0196.525] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.525] lstrlenW (lpString=".xls") returned 4 [0196.525] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.525] lstrlenW (lpString=".xlsx") returned 5 [0196.525] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.525] lstrlenW (lpString=".ppt") returned 4 [0196.525] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.525] lstrlenW (lpString=".zip") returned 4 [0196.525] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.525] lstrlenW (lpString=".rar") returned 4 [0196.525] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.525] lstrlenW (lpString=".bz2") returned 4 [0196.525] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.525] lstrlenW (lpString=".7z") returned 3 [0196.525] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.526] lstrlenW (lpString=".dbf") returned 4 [0196.526] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.526] lstrlenW (lpString=".1cd") returned 4 [0196.526] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.526] lstrlenW (lpString=".jpg") returned 4 [0196.526] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.526] lstrlenW (lpString=".doc") returned 4 [0196.526] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.526] lstrlenW (lpString=".docx") returned 5 [0196.526] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.526] lstrlenW (lpString=".pdf") returned 4 [0196.526] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.526] lstrlenW (lpString=".xls") returned 4 [0196.526] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.526] lstrlenW (lpString=".xlsx") returned 5 [0196.526] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.526] lstrlenW (lpString=".ppt") returned 4 [0196.526] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.526] lstrlenW (lpString=".zip") returned 4 [0196.526] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.526] lstrlenW (lpString=".rar") returned 4 [0196.526] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.526] lstrlenW (lpString=".bz2") returned 4 [0196.526] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.526] lstrlenW (lpString=".7z") returned 3 [0196.526] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.526] lstrlenW (lpString=".dbf") returned 4 [0196.526] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.527] lstrlenW (lpString=".1cd") returned 4 [0196.527] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sk\\messages.json") returned 155 [0196.527] lstrlenW (lpString=".jpg") returned 4 [0196.527] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.527] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.527] lstrlenW (lpString="messages.json") returned 13 [0196.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.527] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=642) returned 1 [0196.527] CloseHandle (hObject=0x358) returned 1 [0196.527] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 0x2020 [0196.527] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.528] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.528] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.528] GetLastError () returned 0x0 [0196.528] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x282, lpOverlapped=0x0) returned 1 [0196.530] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x290, lpOverlapped=0x0) returned 1 [0196.531] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.531] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.531] SetEndOfFile (hFile=0x120) returned 1 [0196.531] CloseHandle (hObject=0x120) returned 1 [0196.531] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.532] SetEndOfFile (hFile=0x358) returned 1 [0196.532] CloseHandle (hObject=0x358) returned 1 [0196.532] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.532] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json")) returned 1 [0196.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.533] lstrlenW (lpString=".doc") returned 4 [0196.533] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.533] lstrlenW (lpString=".docx") returned 5 [0196.533] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.533] lstrlenW (lpString=".pdf") returned 4 [0196.533] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.533] lstrlenW (lpString=".xls") returned 4 [0196.533] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.533] lstrlenW (lpString=".xlsx") returned 5 [0196.533] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.533] lstrlenW (lpString=".ppt") returned 4 [0196.533] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.533] lstrlenW (lpString=".zip") returned 4 [0196.533] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.533] lstrlenW (lpString=".rar") returned 4 [0196.533] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.533] lstrlenW (lpString=".bz2") returned 4 [0196.533] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.533] lstrlenW (lpString=".7z") returned 3 [0196.533] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.533] lstrlenW (lpString=".dbf") returned 4 [0196.533] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.533] lstrlenW (lpString=".1cd") returned 4 [0196.533] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.533] lstrlenW (lpString=".jpg") returned 4 [0196.533] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.534] lstrlenW (lpString=".doc") returned 4 [0196.534] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.534] lstrlenW (lpString=".docx") returned 5 [0196.534] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.534] lstrlenW (lpString=".pdf") returned 4 [0196.534] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.534] lstrlenW (lpString=".xls") returned 4 [0196.534] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.534] lstrlenW (lpString=".xlsx") returned 5 [0196.534] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.534] lstrlenW (lpString=".ppt") returned 4 [0196.534] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.534] lstrlenW (lpString=".zip") returned 4 [0196.534] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.534] lstrlenW (lpString=".rar") returned 4 [0196.534] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.534] lstrlenW (lpString=".bz2") returned 4 [0196.534] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.534] lstrlenW (lpString=".7z") returned 3 [0196.534] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.534] lstrlenW (lpString=".dbf") returned 4 [0196.534] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.534] lstrlenW (lpString=".1cd") returned 4 [0196.534] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sl\\messages.json") returned 155 [0196.534] lstrlenW (lpString=".jpg") returned 4 [0196.534] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.535] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.535] lstrlenW (lpString="messages.json") returned 13 [0196.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.535] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=812) returned 1 [0196.535] CloseHandle (hObject=0x358) returned 1 [0196.535] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 0x2020 [0196.535] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.535] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.536] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.536] GetLastError () returned 0x0 [0196.536] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x32c, lpOverlapped=0x0) returned 1 [0196.733] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x330, lpOverlapped=0x0) returned 1 [0196.736] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.736] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.736] SetEndOfFile (hFile=0x120) returned 1 [0196.736] CloseHandle (hObject=0x120) returned 1 [0196.736] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.736] SetEndOfFile (hFile=0x358) returned 1 [0196.738] CloseHandle (hObject=0x358) returned 1 [0196.738] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.739] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json")) returned 1 [0196.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.739] lstrlenW (lpString=".doc") returned 4 [0196.739] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.739] lstrlenW (lpString=".docx") returned 5 [0196.739] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.739] lstrlenW (lpString=".pdf") returned 4 [0196.739] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.739] lstrlenW (lpString=".xls") returned 4 [0196.739] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.739] lstrlenW (lpString=".xlsx") returned 5 [0196.739] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.739] lstrlenW (lpString=".ppt") returned 4 [0196.739] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.739] lstrlenW (lpString=".zip") returned 4 [0196.739] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.739] lstrlenW (lpString=".rar") returned 4 [0196.739] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.739] lstrlenW (lpString=".bz2") returned 4 [0196.739] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.739] lstrlenW (lpString=".7z") returned 3 [0196.740] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.740] lstrlenW (lpString=".dbf") returned 4 [0196.740] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.740] lstrlenW (lpString=".1cd") returned 4 [0196.740] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.740] lstrlenW (lpString=".jpg") returned 4 [0196.740] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.740] lstrlenW (lpString=".doc") returned 4 [0196.740] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.740] lstrlenW (lpString=".docx") returned 5 [0196.740] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.740] lstrlenW (lpString=".pdf") returned 4 [0196.740] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.740] lstrlenW (lpString=".xls") returned 4 [0196.740] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.740] lstrlenW (lpString=".xlsx") returned 5 [0196.740] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.740] lstrlenW (lpString=".ppt") returned 4 [0196.740] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.740] lstrlenW (lpString=".zip") returned 4 [0196.740] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.740] lstrlenW (lpString=".rar") returned 4 [0196.740] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.740] lstrlenW (lpString=".bz2") returned 4 [0196.740] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.740] lstrlenW (lpString=".7z") returned 3 [0196.740] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.740] lstrlenW (lpString=".dbf") returned 4 [0196.741] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.741] lstrlenW (lpString=".1cd") returned 4 [0196.741] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sr\\messages.json") returned 155 [0196.741] lstrlenW (lpString=".jpg") returned 4 [0196.741] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.741] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.741] lstrlenW (lpString="messages.json") returned 13 [0196.741] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.741] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=239) returned 1 [0196.741] CloseHandle (hObject=0x358) returned 1 [0196.741] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 0x2020 [0196.742] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.742] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.742] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0196.742] GetLastError () returned 0x0 [0196.742] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xef, lpOverlapped=0x0) returned 1 [0196.743] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0196.744] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.744] WriteFile (in: hFile=0x120, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.744] SetEndOfFile (hFile=0x120) returned 1 [0196.744] CloseHandle (hObject=0x120) returned 1 [0196.744] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.744] SetEndOfFile (hFile=0x358) returned 1 [0196.745] CloseHandle (hObject=0x358) returned 1 [0196.745] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.745] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json")) returned 1 [0196.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.746] lstrlenW (lpString=".doc") returned 4 [0196.746] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.746] lstrlenW (lpString=".docx") returned 5 [0196.746] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.746] lstrlenW (lpString=".pdf") returned 4 [0196.746] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.746] lstrlenW (lpString=".xls") returned 4 [0196.746] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.746] lstrlenW (lpString=".xlsx") returned 5 [0196.746] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.746] lstrlenW (lpString=".ppt") returned 4 [0196.746] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.746] lstrlenW (lpString=".zip") returned 4 [0196.746] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.746] lstrlenW (lpString=".rar") returned 4 [0196.746] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.746] lstrlenW (lpString=".bz2") returned 4 [0196.746] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.746] lstrlenW (lpString=".7z") returned 3 [0196.746] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.746] lstrlenW (lpString=".dbf") returned 4 [0196.746] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.746] lstrlenW (lpString=".1cd") returned 4 [0196.746] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.746] lstrlenW (lpString=".jpg") returned 4 [0196.746] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.747] lstrlenW (lpString=".doc") returned 4 [0196.747] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.747] lstrlenW (lpString=".docx") returned 5 [0196.747] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.747] lstrlenW (lpString=".pdf") returned 4 [0196.747] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.747] lstrlenW (lpString=".xls") returned 4 [0196.747] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.747] lstrlenW (lpString=".xlsx") returned 5 [0196.747] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.747] lstrlenW (lpString=".ppt") returned 4 [0196.747] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.747] lstrlenW (lpString=".zip") returned 4 [0196.747] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.747] lstrlenW (lpString=".rar") returned 4 [0196.747] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.747] lstrlenW (lpString=".bz2") returned 4 [0196.747] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.747] lstrlenW (lpString=".7z") returned 3 [0196.747] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.747] lstrlenW (lpString=".dbf") returned 4 [0196.747] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.747] lstrlenW (lpString=".1cd") returned 4 [0196.747] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\de\\messages.json") returned 151 [0196.747] lstrlenW (lpString=".jpg") returned 4 [0196.747] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.747] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.748] lstrlenW (lpString="messages.json") returned 13 [0196.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.796] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=332) returned 1 [0196.796] CloseHandle (hObject=0x154) returned 1 [0196.796] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 0x2020 [0196.796] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.796] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.796] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.796] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.797] GetLastError () returned 0x0 [0196.797] ReadFile (in: hFile=0x154, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x14c, lpOverlapped=0x0) returned 1 [0196.798] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x150, lpOverlapped=0x0) returned 1 [0196.798] ReadFile (in: hFile=0x154, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.799] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.799] SetEndOfFile (hFile=0x114) returned 1 [0196.799] CloseHandle (hObject=0x114) returned 1 [0196.800] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.800] SetEndOfFile (hFile=0x154) returned 1 [0196.800] CloseHandle (hObject=0x154) returned 1 [0196.800] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.801] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json")) returned 1 [0196.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.801] lstrlenW (lpString=".doc") returned 4 [0196.801] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.801] lstrlenW (lpString=".docx") returned 5 [0196.801] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.801] lstrlenW (lpString=".pdf") returned 4 [0196.801] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.801] lstrlenW (lpString=".xls") returned 4 [0196.801] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.801] lstrlenW (lpString=".xlsx") returned 5 [0196.801] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.801] lstrlenW (lpString=".ppt") returned 4 [0196.801] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.801] lstrlenW (lpString=".zip") returned 4 [0196.801] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.801] lstrlenW (lpString=".rar") returned 4 [0196.801] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.801] lstrlenW (lpString=".bz2") returned 4 [0196.801] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.801] lstrlenW (lpString=".7z") returned 3 [0196.801] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.801] lstrlenW (lpString=".dbf") returned 4 [0196.801] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.801] lstrlenW (lpString=".1cd") returned 4 [0196.802] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.802] lstrlenW (lpString=".jpg") returned 4 [0196.802] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.802] lstrlenW (lpString=".doc") returned 4 [0196.802] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.802] lstrlenW (lpString=".docx") returned 5 [0196.802] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.802] lstrlenW (lpString=".pdf") returned 4 [0196.802] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.802] lstrlenW (lpString=".xls") returned 4 [0196.802] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.802] lstrlenW (lpString=".xlsx") returned 5 [0196.802] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.802] lstrlenW (lpString=".ppt") returned 4 [0196.802] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.802] lstrlenW (lpString=".zip") returned 4 [0196.802] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.802] lstrlenW (lpString=".rar") returned 4 [0196.802] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.802] lstrlenW (lpString=".bz2") returned 4 [0196.802] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.802] lstrlenW (lpString=".7z") returned 3 [0196.802] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.802] lstrlenW (lpString=".dbf") returned 4 [0196.802] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.802] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.802] lstrlenW (lpString=".1cd") returned 4 [0196.802] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.803] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\el\\messages.json") returned 151 [0196.803] lstrlenW (lpString=".jpg") returned 4 [0196.803] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.803] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.803] lstrlenW (lpString="messages.json") returned 13 [0196.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.903] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=234) returned 1 [0196.903] CloseHandle (hObject=0x35c) returned 1 [0196.903] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 0x2020 [0196.903] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.904] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.904] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.904] GetLastError () returned 0x0 [0196.904] ReadFile (in: hFile=0x35c, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xea, lpOverlapped=0x0) returned 1 [0196.905] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0196.906] ReadFile (in: hFile=0x35c, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.906] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.906] SetEndOfFile (hFile=0x388) returned 1 [0196.906] CloseHandle (hObject=0x388) returned 1 [0196.906] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.906] SetEndOfFile (hFile=0x35c) returned 1 [0196.907] CloseHandle (hObject=0x35c) returned 1 [0196.907] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.907] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json")) returned 1 [0196.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.908] lstrlenW (lpString=".doc") returned 4 [0196.908] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.908] lstrlenW (lpString=".docx") returned 5 [0196.908] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.908] lstrlenW (lpString=".pdf") returned 4 [0196.908] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.908] lstrlenW (lpString=".xls") returned 4 [0196.908] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.908] lstrlenW (lpString=".xlsx") returned 5 [0196.908] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.908] lstrlenW (lpString=".ppt") returned 4 [0196.908] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.908] lstrlenW (lpString=".zip") returned 4 [0196.908] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.908] lstrlenW (lpString=".rar") returned 4 [0196.908] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.908] lstrlenW (lpString=".bz2") returned 4 [0196.908] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.908] lstrlenW (lpString=".7z") returned 3 [0196.908] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.908] lstrlenW (lpString=".dbf") returned 4 [0196.908] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.908] lstrlenW (lpString=".1cd") returned 4 [0196.908] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.908] lstrlenW (lpString=".jpg") returned 4 [0196.908] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.909] lstrlenW (lpString=".doc") returned 4 [0196.909] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.909] lstrlenW (lpString=".docx") returned 5 [0196.909] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.909] lstrlenW (lpString=".pdf") returned 4 [0196.909] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.909] lstrlenW (lpString=".xls") returned 4 [0196.909] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.909] lstrlenW (lpString=".xlsx") returned 5 [0196.909] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.909] lstrlenW (lpString=".ppt") returned 4 [0196.909] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.909] lstrlenW (lpString=".zip") returned 4 [0196.909] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.909] lstrlenW (lpString=".rar") returned 4 [0196.909] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.909] lstrlenW (lpString=".bz2") returned 4 [0196.909] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.909] lstrlenW (lpString=".7z") returned 3 [0196.909] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.909] lstrlenW (lpString=".dbf") returned 4 [0196.909] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.909] lstrlenW (lpString=".1cd") returned 4 [0196.909] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fil\\messages.json") returned 152 [0196.909] lstrlenW (lpString=".jpg") returned 4 [0196.909] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.910] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.910] lstrlenW (lpString="messages.json") returned 13 [0196.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.015] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=238) returned 1 [0197.015] CloseHandle (hObject=0x114) returned 1 [0197.015] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 0x2020 [0197.015] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.015] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.016] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.016] GetLastError () returned 0x0 [0197.016] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xee, lpOverlapped=0x0) returned 1 [0197.017] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0197.018] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.018] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.018] SetEndOfFile (hFile=0x388) returned 1 [0197.018] CloseHandle (hObject=0x388) returned 1 [0197.018] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.018] SetEndOfFile (hFile=0x114) returned 1 [0197.019] CloseHandle (hObject=0x114) returned 1 [0197.019] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.019] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json")) returned 1 [0197.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.019] lstrlenW (lpString=".doc") returned 4 [0197.019] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.020] lstrlenW (lpString=".docx") returned 5 [0197.020] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.020] lstrlenW (lpString=".pdf") returned 4 [0197.020] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.020] lstrlenW (lpString=".xls") returned 4 [0197.020] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.020] lstrlenW (lpString=".xlsx") returned 5 [0197.020] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.020] lstrlenW (lpString=".ppt") returned 4 [0197.020] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.020] lstrlenW (lpString=".zip") returned 4 [0197.020] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.020] lstrlenW (lpString=".rar") returned 4 [0197.020] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.020] lstrlenW (lpString=".bz2") returned 4 [0197.020] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.020] lstrlenW (lpString=".7z") returned 3 [0197.020] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.020] lstrlenW (lpString=".dbf") returned 4 [0197.020] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.020] lstrlenW (lpString=".1cd") returned 4 [0197.020] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.020] lstrlenW (lpString=".jpg") returned 4 [0197.020] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.020] lstrlenW (lpString=".doc") returned 4 [0197.020] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.020] lstrlenW (lpString=".docx") returned 5 [0197.021] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.021] lstrlenW (lpString=".pdf") returned 4 [0197.021] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.021] lstrlenW (lpString=".xls") returned 4 [0197.021] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.021] lstrlenW (lpString=".xlsx") returned 5 [0197.021] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.021] lstrlenW (lpString=".ppt") returned 4 [0197.021] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.021] lstrlenW (lpString=".zip") returned 4 [0197.021] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.021] lstrlenW (lpString=".rar") returned 4 [0197.021] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.021] lstrlenW (lpString=".bz2") returned 4 [0197.021] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.021] lstrlenW (lpString=".7z") returned 3 [0197.021] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.021] lstrlenW (lpString=".dbf") returned 4 [0197.021] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.021] lstrlenW (lpString=".1cd") returned 4 [0197.021] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lv\\messages.json") returned 151 [0197.021] lstrlenW (lpString=".jpg") returned 4 [0197.021] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.021] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.021] lstrlenW (lpString="messages.json") returned 13 [0197.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.022] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=286) returned 1 [0197.022] CloseHandle (hObject=0x114) returned 1 [0197.022] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 0x2020 [0197.022] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.022] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.022] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.023] GetLastError () returned 0x0 [0197.023] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x11e, lpOverlapped=0x0) returned 1 [0197.122] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x120, lpOverlapped=0x0) returned 1 [0197.123] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.123] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.123] SetEndOfFile (hFile=0x388) returned 1 [0197.123] CloseHandle (hObject=0x388) returned 1 [0197.123] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.123] SetEndOfFile (hFile=0x114) returned 1 [0197.124] CloseHandle (hObject=0x114) returned 1 [0197.124] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.124] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json")) returned 1 [0197.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.124] lstrlenW (lpString=".doc") returned 4 [0197.124] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.124] lstrlenW (lpString=".docx") returned 5 [0197.124] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.124] lstrlenW (lpString=".pdf") returned 4 [0197.124] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.125] lstrlenW (lpString=".xls") returned 4 [0197.125] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.125] lstrlenW (lpString=".xlsx") returned 5 [0197.125] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.125] lstrlenW (lpString=".ppt") returned 4 [0197.125] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.125] lstrlenW (lpString=".zip") returned 4 [0197.125] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.125] lstrlenW (lpString=".rar") returned 4 [0197.125] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.125] lstrlenW (lpString=".bz2") returned 4 [0197.125] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.125] lstrlenW (lpString=".7z") returned 3 [0197.125] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.125] lstrlenW (lpString=".dbf") returned 4 [0197.125] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.125] lstrlenW (lpString=".1cd") returned 4 [0197.125] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.125] lstrlenW (lpString=".jpg") returned 4 [0197.125] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.125] lstrlenW (lpString=".doc") returned 4 [0197.125] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.125] lstrlenW (lpString=".docx") returned 5 [0197.125] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.125] lstrlenW (lpString=".pdf") returned 4 [0197.125] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.125] lstrlenW (lpString=".xls") returned 4 [0197.125] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.126] lstrlenW (lpString=".xlsx") returned 5 [0197.126] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.126] lstrlenW (lpString=".ppt") returned 4 [0197.126] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.126] lstrlenW (lpString=".zip") returned 4 [0197.126] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.126] lstrlenW (lpString=".rar") returned 4 [0197.126] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.126] lstrlenW (lpString=".bz2") returned 4 [0197.126] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.126] lstrlenW (lpString=".7z") returned 3 [0197.126] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.126] lstrlenW (lpString=".dbf") returned 4 [0197.126] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.126] lstrlenW (lpString=".1cd") returned 4 [0197.126] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ru\\messages.json") returned 151 [0197.126] lstrlenW (lpString=".jpg") returned 4 [0197.126] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.126] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.126] lstrlenW (lpString="angular.js") returned 10 [0197.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.127] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=573631) returned 1 [0197.127] CloseHandle (hObject=0x114) returned 1 [0197.127] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 0x2020 [0197.127] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.127] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.128] GetLastError () returned 0x0 [0197.128] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x8c0bf, lpOverlapped=0x0) returned 1 [0197.141] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x8c0c0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x8c0c0, lpOverlapped=0x0) returned 1 [0197.153] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.153] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0197.153] SetEndOfFile (hFile=0x388) returned 1 [0197.153] CloseHandle (hObject=0x388) returned 1 [0197.153] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.153] SetEndOfFile (hFile=0x114) returned 1 [0197.158] CloseHandle (hObject=0x114) returned 1 [0197.158] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.158] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js")) returned 1 [0197.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.159] lstrlenW (lpString=".doc") returned 4 [0197.159] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0197.159] lstrlenW (lpString=".docx") returned 5 [0197.159] lstrcmpiW (lpString1=".docx", lpString2="ar.js") returned -1 [0197.159] lstrlenW (lpString=".pdf") returned 4 [0197.159] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0197.159] lstrlenW (lpString=".xls") returned 4 [0197.159] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0197.159] lstrlenW (lpString=".xlsx") returned 5 [0197.159] lstrcmpiW (lpString1=".xlsx", lpString2="ar.js") returned -1 [0197.159] lstrlenW (lpString=".ppt") returned 4 [0197.159] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0197.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.159] lstrlenW (lpString=".zip") returned 4 [0197.159] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0197.159] lstrlenW (lpString=".rar") returned 4 [0197.159] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0197.159] lstrlenW (lpString=".bz2") returned 4 [0197.159] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0197.159] lstrlenW (lpString=".7z") returned 3 [0197.159] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.159] lstrlenW (lpString=".dbf") returned 4 [0197.159] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0197.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.159] lstrlenW (lpString=".1cd") returned 4 [0197.160] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0197.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.160] lstrlenW (lpString=".jpg") returned 4 [0197.160] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0197.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.160] lstrlenW (lpString=".doc") returned 4 [0197.160] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0197.160] lstrlenW (lpString=".docx") returned 5 [0197.160] lstrcmpiW (lpString1=".docx", lpString2="ar.js") returned -1 [0197.160] lstrlenW (lpString=".pdf") returned 4 [0197.160] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0197.160] lstrlenW (lpString=".xls") returned 4 [0197.160] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0197.160] lstrlenW (lpString=".xlsx") returned 5 [0197.160] lstrcmpiW (lpString1=".xlsx", lpString2="ar.js") returned -1 [0197.160] lstrlenW (lpString=".ppt") returned 4 [0197.160] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0197.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.160] lstrlenW (lpString=".zip") returned 4 [0197.160] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0197.160] lstrlenW (lpString=".rar") returned 4 [0197.160] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0197.160] lstrlenW (lpString=".bz2") returned 4 [0197.160] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0197.160] lstrlenW (lpString=".7z") returned 3 [0197.160] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.160] lstrlenW (lpString=".dbf") returned 4 [0197.160] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0197.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.160] lstrlenW (lpString=".1cd") returned 4 [0197.160] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0197.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\angular.js") returned 145 [0197.161] lstrlenW (lpString=".jpg") returned 4 [0197.161] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0197.161] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.161] lstrlenW (lpString="background_script.js") returned 20 [0197.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.359] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=43164) returned 1 [0197.362] CloseHandle (hObject=0x150) returned 1 [0197.362] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 0x2020 [0197.362] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.362] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.363] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.363] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.363] GetLastError () returned 0x0 [0197.363] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xa89c, lpOverlapped=0x0) returned 1 [0197.366] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xa8a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa8a0, lpOverlapped=0x0) returned 1 [0197.367] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.367] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0197.368] SetEndOfFile (hFile=0x358) returned 1 [0197.368] CloseHandle (hObject=0x358) returned 1 [0197.368] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.368] SetEndOfFile (hFile=0x150) returned 1 [0197.371] CloseHandle (hObject=0x150) returned 1 [0197.371] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.371] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js")) returned 1 [0197.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.371] lstrlenW (lpString=".doc") returned 4 [0197.371] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0197.371] lstrlenW (lpString=".docx") returned 5 [0197.371] lstrcmpiW (lpString1=".docx", lpString2="pt.js") returned -1 [0197.371] lstrlenW (lpString=".pdf") returned 4 [0197.371] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0197.371] lstrlenW (lpString=".xls") returned 4 [0197.371] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0197.371] lstrlenW (lpString=".xlsx") returned 5 [0197.371] lstrcmpiW (lpString1=".xlsx", lpString2="pt.js") returned -1 [0197.371] lstrlenW (lpString=".ppt") returned 4 [0197.371] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0197.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.371] lstrlenW (lpString=".zip") returned 4 [0197.371] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0197.371] lstrlenW (lpString=".rar") returned 4 [0197.371] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0197.371] lstrlenW (lpString=".bz2") returned 4 [0197.372] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString=".7z") returned 3 [0197.372] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.372] lstrlenW (lpString=".dbf") returned 4 [0197.372] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.372] lstrlenW (lpString=".1cd") returned 4 [0197.372] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.372] lstrlenW (lpString=".jpg") returned 4 [0197.372] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.372] lstrlenW (lpString=".doc") returned 4 [0197.372] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString=".docx") returned 5 [0197.372] lstrcmpiW (lpString1=".docx", lpString2="pt.js") returned -1 [0197.372] lstrlenW (lpString=".pdf") returned 4 [0197.372] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString=".xls") returned 4 [0197.372] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString=".xlsx") returned 5 [0197.372] lstrcmpiW (lpString1=".xlsx", lpString2="pt.js") returned -1 [0197.372] lstrlenW (lpString=".ppt") returned 4 [0197.372] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.372] lstrlenW (lpString=".zip") returned 4 [0197.372] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString=".rar") returned 4 [0197.372] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString=".bz2") returned 4 [0197.372] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0197.372] lstrlenW (lpString=".7z") returned 3 [0197.373] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.373] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.373] lstrlenW (lpString=".dbf") returned 4 [0197.373] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0197.373] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.373] lstrlenW (lpString=".1cd") returned 4 [0197.373] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0197.373] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\background_script.js") returned 155 [0197.373] lstrlenW (lpString=".jpg") returned 4 [0197.373] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0197.373] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0197.373] lstrlenW (lpString="devices.html") returned 12 [0197.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.433] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=59) returned 1 [0197.433] CloseHandle (hObject=0x114) returned 1 [0197.433] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 0x2020 [0197.433] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.433] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.436] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.436] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.443] GetLastError () returned 0x0 [0197.443] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x3b, lpOverlapped=0x0) returned 1 [0197.444] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x40, lpOverlapped=0x0) returned 1 [0197.445] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.445] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.445] SetEndOfFile (hFile=0x150) returned 1 [0197.445] CloseHandle (hObject=0x150) returned 1 [0197.446] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.446] SetEndOfFile (hFile=0x114) returned 1 [0197.446] CloseHandle (hObject=0x114) returned 1 [0197.446] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.447] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html")) returned 1 [0197.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.447] lstrlenW (lpString=".doc") returned 4 [0197.447] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.447] lstrlenW (lpString=".docx") returned 5 [0197.447] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.447] lstrlenW (lpString=".pdf") returned 4 [0197.447] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.447] lstrlenW (lpString=".xls") returned 4 [0197.447] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.447] lstrlenW (lpString=".xlsx") returned 5 [0197.447] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.447] lstrlenW (lpString=".ppt") returned 4 [0197.447] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.447] lstrlenW (lpString=".zip") returned 4 [0197.447] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.447] lstrlenW (lpString=".rar") returned 4 [0197.447] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.447] lstrlenW (lpString=".bz2") returned 4 [0197.447] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.447] lstrlenW (lpString=".7z") returned 3 [0197.447] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.447] lstrlenW (lpString=".dbf") returned 4 [0197.447] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.448] lstrlenW (lpString=".1cd") returned 4 [0197.448] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.448] lstrlenW (lpString=".jpg") returned 4 [0197.448] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.448] lstrlenW (lpString=".doc") returned 4 [0197.448] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.448] lstrlenW (lpString=".docx") returned 5 [0197.448] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.448] lstrlenW (lpString=".pdf") returned 4 [0197.448] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.448] lstrlenW (lpString=".xls") returned 4 [0197.448] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.448] lstrlenW (lpString=".xlsx") returned 5 [0197.448] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.448] lstrlenW (lpString=".ppt") returned 4 [0197.448] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.448] lstrlenW (lpString=".zip") returned 4 [0197.448] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.448] lstrlenW (lpString=".rar") returned 4 [0197.448] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.448] lstrlenW (lpString=".bz2") returned 4 [0197.448] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.448] lstrlenW (lpString=".7z") returned 3 [0197.448] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.448] lstrlenW (lpString=".dbf") returned 4 [0197.448] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.448] lstrlenW (lpString=".1cd") returned 4 [0197.448] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\devices.html") returned 158 [0197.449] lstrlenW (lpString=".jpg") returned 4 [0197.449] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.449] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.449] lstrlenW (lpString="common.js") returned 9 [0197.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.450] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=51320) returned 1 [0197.450] CloseHandle (hObject=0x114) returned 1 [0197.450] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 0x2020 [0197.450] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.450] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.451] GetLastError () returned 0x0 [0197.451] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xc878, lpOverlapped=0x0) returned 1 [0197.454] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc880, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc880, lpOverlapped=0x0) returned 1 [0197.455] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.455] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0197.455] SetEndOfFile (hFile=0x150) returned 1 [0197.455] CloseHandle (hObject=0x150) returned 1 [0197.455] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.456] SetEndOfFile (hFile=0x114) returned 1 [0197.456] CloseHandle (hObject=0x114) returned 1 [0197.457] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.457] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js")) returned 1 [0197.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.457] lstrlenW (lpString=".doc") returned 4 [0197.457] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0197.457] lstrlenW (lpString=".docx") returned 5 [0197.457] lstrcmpiW (lpString1=".docx", lpString2="on.js") returned -1 [0197.457] lstrlenW (lpString=".pdf") returned 4 [0197.457] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0197.457] lstrlenW (lpString=".xls") returned 4 [0197.457] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0197.457] lstrlenW (lpString=".xlsx") returned 5 [0197.457] lstrcmpiW (lpString1=".xlsx", lpString2="on.js") returned -1 [0197.457] lstrlenW (lpString=".ppt") returned 4 [0197.457] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0197.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.457] lstrlenW (lpString=".zip") returned 4 [0197.457] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0197.457] lstrlenW (lpString=".rar") returned 4 [0197.457] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0197.457] lstrlenW (lpString=".bz2") returned 4 [0197.457] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString=".7z") returned 3 [0197.458] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.458] lstrlenW (lpString=".dbf") returned 4 [0197.458] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.458] lstrlenW (lpString=".1cd") returned 4 [0197.458] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.458] lstrlenW (lpString=".jpg") returned 4 [0197.458] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.458] lstrlenW (lpString=".doc") returned 4 [0197.458] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString=".docx") returned 5 [0197.458] lstrcmpiW (lpString1=".docx", lpString2="on.js") returned -1 [0197.458] lstrlenW (lpString=".pdf") returned 4 [0197.458] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString=".xls") returned 4 [0197.458] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString=".xlsx") returned 5 [0197.458] lstrcmpiW (lpString1=".xlsx", lpString2="on.js") returned -1 [0197.458] lstrlenW (lpString=".ppt") returned 4 [0197.458] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.458] lstrlenW (lpString=".zip") returned 4 [0197.458] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString=".rar") returned 4 [0197.458] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString=".bz2") returned 4 [0197.458] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0197.458] lstrlenW (lpString=".7z") returned 3 [0197.458] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.459] lstrlenW (lpString=".dbf") returned 4 [0197.459] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0197.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.459] lstrlenW (lpString=".1cd") returned 4 [0197.459] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0197.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\common.js") returned 144 [0197.459] lstrlenW (lpString=".jpg") returned 4 [0197.459] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0197.459] lstrcmpiW (lpString1=".css", lpString2=".wiki") returned -1 [0197.459] lstrlenW (lpString="feedback.css") returned 12 [0197.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.459] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3110) returned 1 [0197.459] CloseHandle (hObject=0x114) returned 1 [0197.459] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 0x2020 [0197.459] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.460] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.460] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.460] GetLastError () returned 0x0 [0197.460] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xc26, lpOverlapped=0x0) returned 1 [0197.462] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xc30, lpOverlapped=0x0) returned 1 [0197.463] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.463] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.463] SetEndOfFile (hFile=0x150) returned 1 [0197.463] CloseHandle (hObject=0x150) returned 1 [0197.463] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.463] SetEndOfFile (hFile=0x114) returned 1 [0197.464] CloseHandle (hObject=0x114) returned 1 [0197.464] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.464] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css")) returned 1 [0197.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.464] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.464] lstrlenW (lpString=".doc") returned 4 [0197.464] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0197.464] lstrlenW (lpString=".docx") returned 5 [0197.465] lstrcmpiW (lpString1=".docx", lpString2="k.css") returned -1 [0197.465] lstrlenW (lpString=".pdf") returned 4 [0197.465] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0197.465] lstrlenW (lpString=".xls") returned 4 [0197.465] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0197.465] lstrlenW (lpString=".xlsx") returned 5 [0197.465] lstrcmpiW (lpString1=".xlsx", lpString2="k.css") returned -1 [0197.465] lstrlenW (lpString=".ppt") returned 4 [0197.465] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0197.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.465] lstrlenW (lpString=".zip") returned 4 [0197.465] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0197.465] lstrlenW (lpString=".rar") returned 4 [0197.465] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0197.465] lstrlenW (lpString=".bz2") returned 4 [0197.465] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0197.465] lstrlenW (lpString=".7z") returned 3 [0197.465] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0197.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.465] lstrlenW (lpString=".dbf") returned 4 [0197.465] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0197.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.465] lstrlenW (lpString=".1cd") returned 4 [0197.465] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0197.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.465] lstrlenW (lpString=".jpg") returned 4 [0197.465] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0197.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.465] lstrlenW (lpString=".doc") returned 4 [0197.465] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0197.465] lstrlenW (lpString=".docx") returned 5 [0197.465] lstrcmpiW (lpString1=".docx", lpString2="k.css") returned -1 [0197.465] lstrlenW (lpString=".pdf") returned 4 [0197.466] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0197.466] lstrlenW (lpString=".xls") returned 4 [0197.466] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0197.466] lstrlenW (lpString=".xlsx") returned 5 [0197.466] lstrcmpiW (lpString1=".xlsx", lpString2="k.css") returned -1 [0197.466] lstrlenW (lpString=".ppt") returned 4 [0197.466] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0197.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.466] lstrlenW (lpString=".zip") returned 4 [0197.466] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0197.466] lstrlenW (lpString=".rar") returned 4 [0197.466] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0197.466] lstrlenW (lpString=".bz2") returned 4 [0197.466] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0197.466] lstrlenW (lpString=".7z") returned 3 [0197.466] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0197.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.466] lstrlenW (lpString=".dbf") returned 4 [0197.466] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0197.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.466] lstrlenW (lpString=".1cd") returned 4 [0197.466] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0197.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.css") returned 147 [0197.466] lstrlenW (lpString=".jpg") returned 4 [0197.466] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0197.466] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0197.466] lstrlenW (lpString="feedback.html") returned 13 [0197.466] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.467] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=14504) returned 1 [0197.467] CloseHandle (hObject=0x114) returned 1 [0197.467] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html")) returned 0x2020 [0197.467] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.467] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.467] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.468] GetLastError () returned 0x0 [0197.468] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x38a8, lpOverlapped=0x0) returned 1 [0197.513] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x38b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x38b0, lpOverlapped=0x0) returned 1 [0197.514] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.514] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.514] SetEndOfFile (hFile=0x150) returned 1 [0197.538] CloseHandle (hObject=0x150) returned 1 [0197.538] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.538] SetEndOfFile (hFile=0x114) returned 1 [0197.559] CloseHandle (hObject=0x114) returned 1 [0197.559] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.567] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html")) returned 1 [0197.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.568] lstrlenW (lpString=".doc") returned 4 [0197.568] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.568] lstrlenW (lpString=".docx") returned 5 [0197.568] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.568] lstrlenW (lpString=".pdf") returned 4 [0197.568] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.568] lstrlenW (lpString=".xls") returned 4 [0197.568] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.568] lstrlenW (lpString=".xlsx") returned 5 [0197.569] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.569] lstrlenW (lpString=".ppt") returned 4 [0197.569] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.569] lstrlenW (lpString=".zip") returned 4 [0197.569] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.569] lstrlenW (lpString=".rar") returned 4 [0197.569] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.569] lstrlenW (lpString=".bz2") returned 4 [0197.569] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.569] lstrlenW (lpString=".7z") returned 3 [0197.569] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.569] lstrlenW (lpString=".dbf") returned 4 [0197.569] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.569] lstrlenW (lpString=".1cd") returned 4 [0197.569] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.569] lstrlenW (lpString=".jpg") returned 4 [0197.569] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.569] lstrlenW (lpString=".doc") returned 4 [0197.569] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.569] lstrlenW (lpString=".docx") returned 5 [0197.569] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.569] lstrlenW (lpString=".pdf") returned 4 [0197.569] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.569] lstrlenW (lpString=".xls") returned 4 [0197.569] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.569] lstrlenW (lpString=".xlsx") returned 5 [0197.569] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.569] lstrlenW (lpString=".ppt") returned 4 [0197.569] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.570] lstrlenW (lpString=".zip") returned 4 [0197.570] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.570] lstrlenW (lpString=".rar") returned 4 [0197.570] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.570] lstrlenW (lpString=".bz2") returned 4 [0197.570] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.570] lstrlenW (lpString=".7z") returned 3 [0197.570] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.570] lstrlenW (lpString=".dbf") returned 4 [0197.570] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.570] lstrlenW (lpString=".1cd") returned 4 [0197.570] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback.html") returned 148 [0197.570] lstrlenW (lpString=".jpg") returned 4 [0197.570] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.570] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.570] lstrlenW (lpString="mirroring_hangouts.js") returned 21 [0197.570] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.571] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=496847) returned 1 [0197.571] CloseHandle (hObject=0x114) returned 1 [0197.571] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js")) returned 0x2020 [0197.571] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.571] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.571] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.572] GetLastError () returned 0x0 [0197.572] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x794cf, lpOverlapped=0x0) returned 1 [0197.584] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x794d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x794d0, lpOverlapped=0x0) returned 1 [0197.592] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.592] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0197.592] SetEndOfFile (hFile=0x150) returned 1 [0197.592] CloseHandle (hObject=0x150) returned 1 [0197.592] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.592] SetEndOfFile (hFile=0x114) returned 1 [0197.596] CloseHandle (hObject=0x114) returned 1 [0197.596] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.596] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js")) returned 1 [0197.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.597] lstrlenW (lpString=".doc") returned 4 [0197.597] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0197.597] lstrlenW (lpString=".docx") returned 5 [0197.597] lstrcmpiW (lpString1=".docx", lpString2="ts.js") returned -1 [0197.597] lstrlenW (lpString=".pdf") returned 4 [0197.597] lstrcmpiW (lpString1=".pdf", lpString2="s.js") returned -1 [0197.597] lstrlenW (lpString=".xls") returned 4 [0197.597] lstrcmpiW (lpString1=".xls", lpString2="s.js") returned -1 [0197.597] lstrlenW (lpString=".xlsx") returned 5 [0197.597] lstrcmpiW (lpString1=".xlsx", lpString2="ts.js") returned -1 [0197.597] lstrlenW (lpString=".ppt") returned 4 [0197.597] lstrcmpiW (lpString1=".ppt", lpString2="s.js") returned -1 [0197.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.597] lstrlenW (lpString=".zip") returned 4 [0197.597] lstrcmpiW (lpString1=".zip", lpString2="s.js") returned -1 [0197.597] lstrlenW (lpString=".rar") returned 4 [0197.597] lstrcmpiW (lpString1=".rar", lpString2="s.js") returned -1 [0197.597] lstrlenW (lpString=".bz2") returned 4 [0197.597] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0197.597] lstrlenW (lpString=".7z") returned 3 [0197.597] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.597] lstrlenW (lpString=".dbf") returned 4 [0197.597] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0197.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.597] lstrlenW (lpString=".1cd") returned 4 [0197.597] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0197.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.597] lstrlenW (lpString=".jpg") returned 4 [0197.597] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0197.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.598] lstrlenW (lpString=".doc") returned 4 [0197.598] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0197.598] lstrlenW (lpString=".docx") returned 5 [0197.598] lstrcmpiW (lpString1=".docx", lpString2="ts.js") returned -1 [0197.598] lstrlenW (lpString=".pdf") returned 4 [0197.598] lstrcmpiW (lpString1=".pdf", lpString2="s.js") returned -1 [0197.598] lstrlenW (lpString=".xls") returned 4 [0197.598] lstrcmpiW (lpString1=".xls", lpString2="s.js") returned -1 [0197.598] lstrlenW (lpString=".xlsx") returned 5 [0197.598] lstrcmpiW (lpString1=".xlsx", lpString2="ts.js") returned -1 [0197.598] lstrlenW (lpString=".ppt") returned 4 [0197.598] lstrcmpiW (lpString1=".ppt", lpString2="s.js") returned -1 [0197.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.598] lstrlenW (lpString=".zip") returned 4 [0197.598] lstrcmpiW (lpString1=".zip", lpString2="s.js") returned -1 [0197.598] lstrlenW (lpString=".rar") returned 4 [0197.598] lstrcmpiW (lpString1=".rar", lpString2="s.js") returned -1 [0197.598] lstrlenW (lpString=".bz2") returned 4 [0197.598] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0197.598] lstrlenW (lpString=".7z") returned 3 [0197.598] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.598] lstrlenW (lpString=".dbf") returned 4 [0197.598] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0197.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.598] lstrlenW (lpString=".1cd") returned 4 [0197.598] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0197.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_hangouts.js") returned 156 [0197.598] lstrlenW (lpString=".jpg") returned 4 [0197.598] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0197.599] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.599] lstrlenW (lpString="mirroring_webrtc.js") returned 19 [0197.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.601] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2369) returned 1 [0197.601] CloseHandle (hObject=0x114) returned 1 [0197.601] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js")) returned 0x2020 [0197.601] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.689] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.690] GetLastError () returned 0x0 [0197.690] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x941, lpOverlapped=0x0) returned 1 [0197.717] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x950, lpOverlapped=0x0) returned 1 [0197.719] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.719] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0197.719] SetEndOfFile (hFile=0x2d8) returned 1 [0197.719] CloseHandle (hObject=0x2d8) returned 1 [0197.719] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.719] SetEndOfFile (hFile=0x114) returned 1 [0197.720] CloseHandle (hObject=0x114) returned 1 [0197.720] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.720] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js")) returned 1 [0197.720] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.720] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.720] lstrlenW (lpString=".doc") returned 4 [0197.720] lstrcmpiW (lpString1=".doc", lpString2="c.js") returned -1 [0197.720] lstrlenW (lpString=".docx") returned 5 [0197.720] lstrcmpiW (lpString1=".docx", lpString2="tc.js") returned -1 [0197.720] lstrlenW (lpString=".pdf") returned 4 [0197.720] lstrcmpiW (lpString1=".pdf", lpString2="c.js") returned -1 [0197.720] lstrlenW (lpString=".xls") returned 4 [0197.720] lstrcmpiW (lpString1=".xls", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString=".xlsx") returned 5 [0197.721] lstrcmpiW (lpString1=".xlsx", lpString2="tc.js") returned -1 [0197.721] lstrlenW (lpString=".ppt") returned 4 [0197.721] lstrcmpiW (lpString1=".ppt", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.721] lstrlenW (lpString=".zip") returned 4 [0197.721] lstrcmpiW (lpString1=".zip", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString=".rar") returned 4 [0197.721] lstrcmpiW (lpString1=".rar", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString=".bz2") returned 4 [0197.721] lstrcmpiW (lpString1=".bz2", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString=".7z") returned 3 [0197.721] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.721] lstrlenW (lpString=".dbf") returned 4 [0197.721] lstrcmpiW (lpString1=".dbf", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.721] lstrlenW (lpString=".1cd") returned 4 [0197.721] lstrcmpiW (lpString1=".1cd", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.721] lstrlenW (lpString=".jpg") returned 4 [0197.721] lstrcmpiW (lpString1=".jpg", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.721] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.721] lstrlenW (lpString=".doc") returned 4 [0197.721] lstrcmpiW (lpString1=".doc", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString=".docx") returned 5 [0197.721] lstrcmpiW (lpString1=".docx", lpString2="tc.js") returned -1 [0197.721] lstrlenW (lpString=".pdf") returned 4 [0197.721] lstrcmpiW (lpString1=".pdf", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString=".xls") returned 4 [0197.721] lstrcmpiW (lpString1=".xls", lpString2="c.js") returned -1 [0197.721] lstrlenW (lpString=".xlsx") returned 5 [0197.722] lstrcmpiW (lpString1=".xlsx", lpString2="tc.js") returned -1 [0197.722] lstrlenW (lpString=".ppt") returned 4 [0197.722] lstrcmpiW (lpString1=".ppt", lpString2="c.js") returned -1 [0197.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.722] lstrlenW (lpString=".zip") returned 4 [0197.722] lstrcmpiW (lpString1=".zip", lpString2="c.js") returned -1 [0197.722] lstrlenW (lpString=".rar") returned 4 [0197.722] lstrcmpiW (lpString1=".rar", lpString2="c.js") returned -1 [0197.722] lstrlenW (lpString=".bz2") returned 4 [0197.722] lstrcmpiW (lpString1=".bz2", lpString2="c.js") returned -1 [0197.722] lstrlenW (lpString=".7z") returned 3 [0197.722] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.722] lstrlenW (lpString=".dbf") returned 4 [0197.722] lstrcmpiW (lpString1=".dbf", lpString2="c.js") returned -1 [0197.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.722] lstrlenW (lpString=".1cd") returned 4 [0197.722] lstrcmpiW (lpString1=".1cd", lpString2="c.js") returned -1 [0197.722] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_webrtc.js") returned 154 [0197.722] lstrlenW (lpString=".jpg") returned 4 [0197.722] lstrcmpiW (lpString1=".jpg", lpString2="c.js") returned -1 [0197.722] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.722] lstrlenW (lpString="messages.json") returned 13 [0197.722] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.723] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=16005) returned 1 [0197.723] CloseHandle (hObject=0x114) returned 1 [0197.723] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json")) returned 0x2020 [0197.723] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.723] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.724] GetLastError () returned 0x0 [0197.724] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x3e85, lpOverlapped=0x0) returned 1 [0197.725] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3e90, lpOverlapped=0x0) returned 1 [0197.726] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.726] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.727] SetEndOfFile (hFile=0x2d8) returned 1 [0197.727] CloseHandle (hObject=0x2d8) returned 1 [0197.727] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.727] SetEndOfFile (hFile=0x114) returned 1 [0197.728] CloseHandle (hObject=0x114) returned 1 [0197.728] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.728] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json")) returned 1 [0197.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.728] lstrlenW (lpString=".doc") returned 4 [0197.728] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.728] lstrlenW (lpString=".docx") returned 5 [0197.728] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.728] lstrlenW (lpString=".pdf") returned 4 [0197.728] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.728] lstrlenW (lpString=".xls") returned 4 [0197.728] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.728] lstrlenW (lpString=".xlsx") returned 5 [0197.728] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.728] lstrlenW (lpString=".ppt") returned 4 [0197.728] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.728] lstrlenW (lpString=".zip") returned 4 [0197.728] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.729] lstrlenW (lpString=".rar") returned 4 [0197.729] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.729] lstrlenW (lpString=".bz2") returned 4 [0197.729] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.729] lstrlenW (lpString=".7z") returned 3 [0197.729] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.729] lstrlenW (lpString=".dbf") returned 4 [0197.729] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.729] lstrlenW (lpString=".1cd") returned 4 [0197.729] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.729] lstrlenW (lpString=".jpg") returned 4 [0197.729] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.729] lstrlenW (lpString=".doc") returned 4 [0197.729] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.729] lstrlenW (lpString=".docx") returned 5 [0197.729] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.729] lstrlenW (lpString=".pdf") returned 4 [0197.729] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.729] lstrlenW (lpString=".xls") returned 4 [0197.729] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.729] lstrlenW (lpString=".xlsx") returned 5 [0197.729] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.729] lstrlenW (lpString=".ppt") returned 4 [0197.729] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.729] lstrlenW (lpString=".zip") returned 4 [0197.729] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.729] lstrlenW (lpString=".rar") returned 4 [0197.729] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.730] lstrlenW (lpString=".bz2") returned 4 [0197.730] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.730] lstrlenW (lpString=".7z") returned 3 [0197.730] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.730] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.730] lstrlenW (lpString=".dbf") returned 4 [0197.730] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.730] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.730] lstrlenW (lpString=".1cd") returned 4 [0197.730] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.730] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\et\\messages.json") returned 160 [0197.730] lstrlenW (lpString=".jpg") returned 4 [0197.730] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.730] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.730] lstrlenW (lpString="messages.json") returned 13 [0197.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.731] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=18165) returned 1 [0197.731] CloseHandle (hObject=0x114) returned 1 [0197.731] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json")) returned 0x2020 [0197.731] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.731] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.731] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.731] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.732] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.732] GetLastError () returned 0x0 [0197.732] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x46f5, lpOverlapped=0x0) returned 1 [0197.735] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x4700, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4700, lpOverlapped=0x0) returned 1 [0197.736] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.736] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.736] SetEndOfFile (hFile=0x2d8) returned 1 [0197.736] CloseHandle (hObject=0x2d8) returned 1 [0197.736] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.736] SetEndOfFile (hFile=0x114) returned 1 [0197.737] CloseHandle (hObject=0x114) returned 1 [0197.737] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.737] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json")) returned 1 [0197.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.737] lstrlenW (lpString=".doc") returned 4 [0197.737] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.737] lstrlenW (lpString=".docx") returned 5 [0197.738] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.738] lstrlenW (lpString=".pdf") returned 4 [0197.738] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.738] lstrlenW (lpString=".xls") returned 4 [0197.738] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.738] lstrlenW (lpString=".xlsx") returned 5 [0197.738] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.738] lstrlenW (lpString=".ppt") returned 4 [0197.738] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.738] lstrlenW (lpString=".zip") returned 4 [0197.738] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.738] lstrlenW (lpString=".rar") returned 4 [0197.738] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.738] lstrlenW (lpString=".bz2") returned 4 [0197.738] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.738] lstrlenW (lpString=".7z") returned 3 [0197.738] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.738] lstrlenW (lpString=".dbf") returned 4 [0197.738] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.738] lstrlenW (lpString=".1cd") returned 4 [0197.738] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.738] lstrlenW (lpString=".jpg") returned 4 [0197.738] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.738] lstrlenW (lpString=".doc") returned 4 [0197.738] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.738] lstrlenW (lpString=".docx") returned 5 [0197.739] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.739] lstrlenW (lpString=".pdf") returned 4 [0197.739] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.739] lstrlenW (lpString=".xls") returned 4 [0197.739] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.739] lstrlenW (lpString=".xlsx") returned 5 [0197.739] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.739] lstrlenW (lpString=".ppt") returned 4 [0197.739] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.739] lstrlenW (lpString=".zip") returned 4 [0197.739] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.739] lstrlenW (lpString=".rar") returned 4 [0197.739] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.739] lstrlenW (lpString=".bz2") returned 4 [0197.739] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.739] lstrlenW (lpString=".7z") returned 3 [0197.739] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.739] lstrlenW (lpString=".dbf") returned 4 [0197.739] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.739] lstrlenW (lpString=".1cd") returned 4 [0197.739] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fa\\messages.json") returned 160 [0197.739] lstrlenW (lpString=".jpg") returned 4 [0197.739] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.739] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.739] lstrlenW (lpString="messages.json") returned 13 [0197.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.740] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=16204) returned 1 [0197.740] CloseHandle (hObject=0x114) returned 1 [0197.740] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json")) returned 0x2020 [0197.740] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.740] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.741] GetLastError () returned 0x0 [0197.741] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x3f4c, lpOverlapped=0x0) returned 1 [0197.743] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3f50, lpOverlapped=0x0) returned 1 [0197.744] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.744] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.745] SetEndOfFile (hFile=0x2d8) returned 1 [0197.745] CloseHandle (hObject=0x2d8) returned 1 [0197.745] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.745] SetEndOfFile (hFile=0x114) returned 1 [0197.746] CloseHandle (hObject=0x114) returned 1 [0197.746] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.746] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json")) returned 1 [0197.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.746] lstrlenW (lpString=".doc") returned 4 [0197.746] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.746] lstrlenW (lpString=".docx") returned 5 [0197.746] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.746] lstrlenW (lpString=".pdf") returned 4 [0197.746] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.746] lstrlenW (lpString=".xls") returned 4 [0197.746] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.746] lstrlenW (lpString=".xlsx") returned 5 [0197.746] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.746] lstrlenW (lpString=".ppt") returned 4 [0197.746] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.746] lstrlenW (lpString=".zip") returned 4 [0197.746] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.746] lstrlenW (lpString=".rar") returned 4 [0197.747] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.747] lstrlenW (lpString=".bz2") returned 4 [0197.747] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.747] lstrlenW (lpString=".7z") returned 3 [0197.747] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.747] lstrlenW (lpString=".dbf") returned 4 [0197.747] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.747] lstrlenW (lpString=".1cd") returned 4 [0197.747] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.747] lstrlenW (lpString=".jpg") returned 4 [0197.747] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.747] lstrlenW (lpString=".doc") returned 4 [0197.747] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.747] lstrlenW (lpString=".docx") returned 5 [0197.747] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.747] lstrlenW (lpString=".pdf") returned 4 [0197.747] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.747] lstrlenW (lpString=".xls") returned 4 [0197.747] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.747] lstrlenW (lpString=".xlsx") returned 5 [0197.747] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.747] lstrlenW (lpString=".ppt") returned 4 [0197.747] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.747] lstrlenW (lpString=".zip") returned 4 [0197.747] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.747] lstrlenW (lpString=".rar") returned 4 [0197.748] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.748] lstrlenW (lpString=".bz2") returned 4 [0197.748] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.748] lstrlenW (lpString=".7z") returned 3 [0197.748] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.748] lstrlenW (lpString=".dbf") returned 4 [0197.748] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.748] lstrlenW (lpString=".1cd") returned 4 [0197.748] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fi\\messages.json") returned 160 [0197.748] lstrlenW (lpString=".jpg") returned 4 [0197.748] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.748] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.748] lstrlenW (lpString="messages.json") returned 13 [0197.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.749] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=16514) returned 1 [0197.749] CloseHandle (hObject=0x114) returned 1 [0197.749] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json")) returned 0x2020 [0197.749] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.749] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.749] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.749] GetLastError () returned 0x0 [0197.749] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x4082, lpOverlapped=0x0) returned 1 [0197.928] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x4090, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4090, lpOverlapped=0x0) returned 1 [0197.963] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.963] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.963] SetEndOfFile (hFile=0x2d8) returned 1 [0197.963] CloseHandle (hObject=0x2d8) returned 1 [0197.963] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.963] SetEndOfFile (hFile=0x114) returned 1 [0197.964] CloseHandle (hObject=0x114) returned 1 [0197.964] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.964] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json")) returned 1 [0197.965] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.965] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.965] lstrlenW (lpString=".doc") returned 4 [0197.965] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.965] lstrlenW (lpString=".docx") returned 5 [0197.965] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.965] lstrlenW (lpString=".pdf") returned 4 [0197.965] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.965] lstrlenW (lpString=".xls") returned 4 [0197.965] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.965] lstrlenW (lpString=".xlsx") returned 5 [0197.965] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.965] lstrlenW (lpString=".ppt") returned 4 [0197.965] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.965] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.965] lstrlenW (lpString=".zip") returned 4 [0197.965] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.965] lstrlenW (lpString=".rar") returned 4 [0197.965] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.965] lstrlenW (lpString=".bz2") returned 4 [0197.965] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.965] lstrlenW (lpString=".7z") returned 3 [0197.965] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.965] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.965] lstrlenW (lpString=".dbf") returned 4 [0197.965] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.965] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.965] lstrlenW (lpString=".1cd") returned 4 [0197.965] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.965] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.965] lstrlenW (lpString=".jpg") returned 4 [0197.965] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.965] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.966] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.966] lstrlenW (lpString=".doc") returned 4 [0197.966] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.966] lstrlenW (lpString=".docx") returned 5 [0197.966] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.966] lstrlenW (lpString=".pdf") returned 4 [0197.966] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.966] lstrlenW (lpString=".xls") returned 4 [0197.966] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.966] lstrlenW (lpString=".xlsx") returned 5 [0197.966] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.966] lstrlenW (lpString=".ppt") returned 4 [0197.966] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.966] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.966] lstrlenW (lpString=".zip") returned 4 [0197.966] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.966] lstrlenW (lpString=".rar") returned 4 [0197.966] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.966] lstrlenW (lpString=".bz2") returned 4 [0197.966] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.966] lstrlenW (lpString=".7z") returned 3 [0197.966] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.966] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.966] lstrlenW (lpString=".dbf") returned 4 [0197.966] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.966] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.966] lstrlenW (lpString=".1cd") returned 4 [0197.966] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.966] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fil\\messages.json") returned 161 [0197.966] lstrlenW (lpString=".jpg") returned 4 [0197.966] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.967] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.967] lstrlenW (lpString="messages.json") returned 13 [0197.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.967] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=21028) returned 1 [0197.967] CloseHandle (hObject=0x114) returned 1 [0197.967] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json")) returned 0x2020 [0197.967] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.968] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.968] GetLastError () returned 0x0 [0197.968] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x5224, lpOverlapped=0x0) returned 1 [0197.970] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x5230, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x5230, lpOverlapped=0x0) returned 1 [0197.971] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.972] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.972] SetEndOfFile (hFile=0x2d8) returned 1 [0197.972] CloseHandle (hObject=0x2d8) returned 1 [0197.972] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.972] SetEndOfFile (hFile=0x114) returned 1 [0197.973] CloseHandle (hObject=0x114) returned 1 [0197.973] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.973] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json")) returned 1 [0197.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.973] lstrlenW (lpString=".doc") returned 4 [0197.973] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.973] lstrlenW (lpString=".docx") returned 5 [0197.973] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.973] lstrlenW (lpString=".pdf") returned 4 [0197.973] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.973] lstrlenW (lpString=".xls") returned 4 [0197.973] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.973] lstrlenW (lpString=".xlsx") returned 5 [0197.973] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.973] lstrlenW (lpString=".ppt") returned 4 [0197.973] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.974] lstrlenW (lpString=".zip") returned 4 [0197.974] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.974] lstrlenW (lpString=".rar") returned 4 [0197.974] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.974] lstrlenW (lpString=".bz2") returned 4 [0197.974] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.974] lstrlenW (lpString=".7z") returned 3 [0197.974] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.974] lstrlenW (lpString=".dbf") returned 4 [0197.974] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.974] lstrlenW (lpString=".1cd") returned 4 [0197.974] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.974] lstrlenW (lpString=".jpg") returned 4 [0197.974] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.974] lstrlenW (lpString=".doc") returned 4 [0197.974] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.974] lstrlenW (lpString=".docx") returned 5 [0197.974] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.974] lstrlenW (lpString=".pdf") returned 4 [0197.974] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.974] lstrlenW (lpString=".xls") returned 4 [0197.974] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.974] lstrlenW (lpString=".xlsx") returned 5 [0197.974] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.974] lstrlenW (lpString=".ppt") returned 4 [0197.974] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.974] lstrlenW (lpString=".zip") returned 4 [0197.974] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.975] lstrlenW (lpString=".rar") returned 4 [0197.975] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.975] lstrlenW (lpString=".bz2") returned 4 [0197.975] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.975] lstrlenW (lpString=".7z") returned 3 [0197.975] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.975] lstrlenW (lpString=".dbf") returned 4 [0197.975] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.975] lstrlenW (lpString=".1cd") returned 4 [0197.975] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\mr\\messages.json") returned 160 [0197.975] lstrlenW (lpString=".jpg") returned 4 [0197.975] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.975] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.975] lstrlenW (lpString="messages.json") returned 13 [0197.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.976] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=16267) returned 1 [0197.976] CloseHandle (hObject=0x114) returned 1 [0197.978] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json")) returned 0x2020 [0197.978] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.978] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.978] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.979] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.979] GetLastError () returned 0x0 [0197.979] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x3f8b, lpOverlapped=0x0) returned 1 [0197.981] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x3f90, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3f90, lpOverlapped=0x0) returned 1 [0197.982] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.982] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.982] SetEndOfFile (hFile=0x2d8) returned 1 [0197.982] CloseHandle (hObject=0x2d8) returned 1 [0197.982] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.982] SetEndOfFile (hFile=0x114) returned 1 [0197.983] CloseHandle (hObject=0x114) returned 1 [0197.983] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.983] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json")) returned 1 [0197.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.984] lstrlenW (lpString=".doc") returned 4 [0197.984] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.984] lstrlenW (lpString=".docx") returned 5 [0197.984] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.984] lstrlenW (lpString=".pdf") returned 4 [0197.984] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.984] lstrlenW (lpString=".xls") returned 4 [0197.984] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.984] lstrlenW (lpString=".xlsx") returned 5 [0197.984] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.984] lstrlenW (lpString=".ppt") returned 4 [0197.984] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.984] lstrlenW (lpString=".zip") returned 4 [0197.984] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.984] lstrlenW (lpString=".rar") returned 4 [0197.984] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.984] lstrlenW (lpString=".bz2") returned 4 [0197.984] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.984] lstrlenW (lpString=".7z") returned 3 [0197.984] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.984] lstrlenW (lpString=".dbf") returned 4 [0197.984] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.984] lstrlenW (lpString=".1cd") returned 4 [0197.984] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.984] lstrlenW (lpString=".jpg") returned 4 [0197.984] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.985] lstrlenW (lpString=".doc") returned 4 [0197.985] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.985] lstrlenW (lpString=".docx") returned 5 [0197.985] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.985] lstrlenW (lpString=".pdf") returned 4 [0197.985] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.985] lstrlenW (lpString=".xls") returned 4 [0197.985] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.985] lstrlenW (lpString=".xlsx") returned 5 [0197.985] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.985] lstrlenW (lpString=".ppt") returned 4 [0197.985] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.985] lstrlenW (lpString=".zip") returned 4 [0197.985] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.985] lstrlenW (lpString=".rar") returned 4 [0197.985] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.985] lstrlenW (lpString=".bz2") returned 4 [0197.985] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.985] lstrlenW (lpString=".7z") returned 3 [0197.985] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.985] lstrlenW (lpString=".dbf") returned 4 [0197.985] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.985] lstrlenW (lpString=".1cd") returned 4 [0197.985] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ms\\messages.json") returned 160 [0197.985] lstrlenW (lpString=".jpg") returned 4 [0197.985] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.985] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.986] lstrlenW (lpString="messages.json") returned 13 [0197.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.986] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=16060) returned 1 [0197.986] CloseHandle (hObject=0x114) returned 1 [0197.986] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json")) returned 0x2020 [0197.986] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.986] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.987] GetLastError () returned 0x0 [0197.987] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x3ebc, lpOverlapped=0x0) returned 1 [0197.991] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3ec0, lpOverlapped=0x0) returned 1 [0197.992] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.992] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.993] SetEndOfFile (hFile=0x2d8) returned 1 [0197.993] CloseHandle (hObject=0x2d8) returned 1 [0197.993] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.993] SetEndOfFile (hFile=0x114) returned 1 [0197.994] CloseHandle (hObject=0x114) returned 1 [0197.994] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.994] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json")) returned 1 [0197.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.994] lstrlenW (lpString=".doc") returned 4 [0197.994] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.994] lstrlenW (lpString=".docx") returned 5 [0197.994] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.994] lstrlenW (lpString=".pdf") returned 4 [0197.994] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.994] lstrlenW (lpString=".xls") returned 4 [0197.994] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.994] lstrlenW (lpString=".xlsx") returned 5 [0197.994] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.994] lstrlenW (lpString=".ppt") returned 4 [0197.994] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.994] lstrlenW (lpString=".zip") returned 4 [0197.994] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.994] lstrlenW (lpString=".rar") returned 4 [0197.994] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.995] lstrlenW (lpString=".bz2") returned 4 [0197.995] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.995] lstrlenW (lpString=".7z") returned 3 [0197.995] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.995] lstrlenW (lpString=".dbf") returned 4 [0197.995] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.995] lstrlenW (lpString=".1cd") returned 4 [0197.995] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.995] lstrlenW (lpString=".jpg") returned 4 [0197.995] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.995] lstrlenW (lpString=".doc") returned 4 [0197.995] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.995] lstrlenW (lpString=".docx") returned 5 [0197.995] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.995] lstrlenW (lpString=".pdf") returned 4 [0197.995] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.995] lstrlenW (lpString=".xls") returned 4 [0197.995] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.995] lstrlenW (lpString=".xlsx") returned 5 [0197.995] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.995] lstrlenW (lpString=".ppt") returned 4 [0197.995] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.995] lstrlenW (lpString=".zip") returned 4 [0197.995] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.995] lstrlenW (lpString=".rar") returned 4 [0197.995] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.995] lstrlenW (lpString=".bz2") returned 4 [0197.995] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.995] lstrlenW (lpString=".7z") returned 3 [0197.996] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.996] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.996] lstrlenW (lpString=".dbf") returned 4 [0197.996] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.996] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.996] lstrlenW (lpString=".1cd") returned 4 [0197.996] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.996] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nb\\messages.json") returned 160 [0197.996] lstrlenW (lpString=".jpg") returned 4 [0197.996] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.996] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.996] lstrlenW (lpString="messages.json") returned 13 [0197.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.996] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=16197) returned 1 [0197.996] CloseHandle (hObject=0x114) returned 1 [0197.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json")) returned 0x2020 [0197.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.997] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0197.997] GetLastError () returned 0x0 [0197.997] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x3f45, lpOverlapped=0x0) returned 1 [0197.999] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x3f50, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3f50, lpOverlapped=0x0) returned 1 [0198.000] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.000] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.001] SetEndOfFile (hFile=0x2d8) returned 1 [0198.001] CloseHandle (hObject=0x2d8) returned 1 [0198.001] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.001] SetEndOfFile (hFile=0x114) returned 1 [0198.001] CloseHandle (hObject=0x114) returned 1 [0198.002] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.002] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json")) returned 1 [0198.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.002] lstrlenW (lpString=".doc") returned 4 [0198.002] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.002] lstrlenW (lpString=".docx") returned 5 [0198.002] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.002] lstrlenW (lpString=".pdf") returned 4 [0198.002] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.002] lstrlenW (lpString=".xls") returned 4 [0198.002] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.002] lstrlenW (lpString=".xlsx") returned 5 [0198.002] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.002] lstrlenW (lpString=".ppt") returned 4 [0198.002] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.002] lstrlenW (lpString=".zip") returned 4 [0198.002] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.002] lstrlenW (lpString=".rar") returned 4 [0198.002] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.002] lstrlenW (lpString=".bz2") returned 4 [0198.002] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.003] lstrlenW (lpString=".7z") returned 3 [0198.003] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.003] lstrlenW (lpString=".dbf") returned 4 [0198.003] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.003] lstrlenW (lpString=".1cd") returned 4 [0198.003] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.003] lstrlenW (lpString=".jpg") returned 4 [0198.003] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.003] lstrlenW (lpString=".doc") returned 4 [0198.003] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.003] lstrlenW (lpString=".docx") returned 5 [0198.003] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.003] lstrlenW (lpString=".pdf") returned 4 [0198.003] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.003] lstrlenW (lpString=".xls") returned 4 [0198.003] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.003] lstrlenW (lpString=".xlsx") returned 5 [0198.003] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.003] lstrlenW (lpString=".ppt") returned 4 [0198.003] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.003] lstrlenW (lpString=".zip") returned 4 [0198.003] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.003] lstrlenW (lpString=".rar") returned 4 [0198.003] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.003] lstrlenW (lpString=".bz2") returned 4 [0198.003] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.003] lstrlenW (lpString=".7z") returned 3 [0198.003] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.004] lstrlenW (lpString=".dbf") returned 4 [0198.004] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.004] lstrlenW (lpString=".1cd") returned 4 [0198.004] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.004] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\nl\\messages.json") returned 160 [0198.004] lstrlenW (lpString=".jpg") returned 4 [0198.004] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.004] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.004] lstrlenW (lpString="messages.json") returned 13 [0198.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.004] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=16343) returned 1 [0198.004] CloseHandle (hObject=0x114) returned 1 [0198.005] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json")) returned 0x2020 [0198.005] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.005] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.005] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.005] GetLastError () returned 0x0 [0198.005] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x3fd7, lpOverlapped=0x0) returned 1 [0198.182] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0198.183] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.183] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.184] SetEndOfFile (hFile=0x2d8) returned 1 [0198.184] CloseHandle (hObject=0x2d8) returned 1 [0198.184] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.184] SetEndOfFile (hFile=0x114) returned 1 [0198.185] CloseHandle (hObject=0x114) returned 1 [0198.185] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.185] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json")) returned 1 [0198.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.185] lstrlenW (lpString=".doc") returned 4 [0198.185] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.185] lstrlenW (lpString=".docx") returned 5 [0198.185] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.185] lstrlenW (lpString=".pdf") returned 4 [0198.185] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.185] lstrlenW (lpString=".xls") returned 4 [0198.185] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.185] lstrlenW (lpString=".xlsx") returned 5 [0198.185] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.186] lstrlenW (lpString=".ppt") returned 4 [0198.186] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.186] lstrlenW (lpString=".zip") returned 4 [0198.186] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.186] lstrlenW (lpString=".rar") returned 4 [0198.186] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.186] lstrlenW (lpString=".bz2") returned 4 [0198.186] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.186] lstrlenW (lpString=".7z") returned 3 [0198.186] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.186] lstrlenW (lpString=".dbf") returned 4 [0198.186] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.186] lstrlenW (lpString=".1cd") returned 4 [0198.186] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.186] lstrlenW (lpString=".jpg") returned 4 [0198.186] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.186] lstrlenW (lpString=".doc") returned 4 [0198.186] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.186] lstrlenW (lpString=".docx") returned 5 [0198.186] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.186] lstrlenW (lpString=".pdf") returned 4 [0198.186] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.186] lstrlenW (lpString=".xls") returned 4 [0198.186] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.186] lstrlenW (lpString=".xlsx") returned 5 [0198.186] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.186] lstrlenW (lpString=".ppt") returned 4 [0198.187] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.187] lstrlenW (lpString=".zip") returned 4 [0198.187] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.187] lstrlenW (lpString=".rar") returned 4 [0198.187] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.187] lstrlenW (lpString=".bz2") returned 4 [0198.187] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.187] lstrlenW (lpString=".7z") returned 3 [0198.187] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.187] lstrlenW (lpString=".dbf") returned 4 [0198.187] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.187] lstrlenW (lpString=".1cd") returned 4 [0198.187] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pl\\messages.json") returned 160 [0198.187] lstrlenW (lpString=".jpg") returned 4 [0198.187] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.187] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.187] lstrlenW (lpString="messages.json") returned 13 [0198.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.188] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=16462) returned 1 [0198.188] CloseHandle (hObject=0x114) returned 1 [0198.188] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json")) returned 0x2020 [0198.188] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.188] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.189] GetLastError () returned 0x0 [0198.189] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x404e, lpOverlapped=0x0) returned 1 [0198.192] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4050, lpOverlapped=0x0) returned 1 [0198.193] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.193] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.193] SetEndOfFile (hFile=0x2d8) returned 1 [0198.193] CloseHandle (hObject=0x2d8) returned 1 [0198.193] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.193] SetEndOfFile (hFile=0x114) returned 1 [0198.194] CloseHandle (hObject=0x114) returned 1 [0198.194] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.194] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json")) returned 1 [0198.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.195] lstrlenW (lpString=".doc") returned 4 [0198.195] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.195] lstrlenW (lpString=".docx") returned 5 [0198.195] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.195] lstrlenW (lpString=".pdf") returned 4 [0198.195] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.195] lstrlenW (lpString=".xls") returned 4 [0198.195] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.195] lstrlenW (lpString=".xlsx") returned 5 [0198.195] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.195] lstrlenW (lpString=".ppt") returned 4 [0198.195] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.195] lstrlenW (lpString=".zip") returned 4 [0198.195] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.195] lstrlenW (lpString=".rar") returned 4 [0198.195] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.195] lstrlenW (lpString=".bz2") returned 4 [0198.195] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.195] lstrlenW (lpString=".7z") returned 3 [0198.195] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.195] lstrlenW (lpString=".dbf") returned 4 [0198.195] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.195] lstrlenW (lpString=".1cd") returned 4 [0198.195] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.196] lstrlenW (lpString=".jpg") returned 4 [0198.196] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.196] lstrlenW (lpString=".doc") returned 4 [0198.196] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.196] lstrlenW (lpString=".docx") returned 5 [0198.196] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.196] lstrlenW (lpString=".pdf") returned 4 [0198.196] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.196] lstrlenW (lpString=".xls") returned 4 [0198.196] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.196] lstrlenW (lpString=".xlsx") returned 5 [0198.196] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.196] lstrlenW (lpString=".ppt") returned 4 [0198.196] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.196] lstrlenW (lpString=".zip") returned 4 [0198.196] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.196] lstrlenW (lpString=".rar") returned 4 [0198.196] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.196] lstrlenW (lpString=".bz2") returned 4 [0198.196] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.196] lstrlenW (lpString=".7z") returned 3 [0198.196] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.196] lstrlenW (lpString=".dbf") returned 4 [0198.196] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.196] lstrlenW (lpString=".1cd") returned 4 [0198.196] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\tr\\messages.json") returned 160 [0198.196] lstrlenW (lpString=".jpg") returned 4 [0198.196] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.197] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.197] lstrlenW (lpString="messages.json") returned 13 [0198.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.197] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=18673) returned 1 [0198.197] CloseHandle (hObject=0x114) returned 1 [0198.197] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json")) returned 0x2020 [0198.197] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.198] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.198] GetLastError () returned 0x0 [0198.198] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x48f1, lpOverlapped=0x0) returned 1 [0198.200] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4900, lpOverlapped=0x0) returned 1 [0198.201] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.201] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.201] SetEndOfFile (hFile=0x2d8) returned 1 [0198.201] CloseHandle (hObject=0x2d8) returned 1 [0198.201] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.201] SetEndOfFile (hFile=0x114) returned 1 [0198.202] CloseHandle (hObject=0x114) returned 1 [0198.202] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.202] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json")) returned 1 [0198.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.203] lstrlenW (lpString=".doc") returned 4 [0198.203] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.203] lstrlenW (lpString=".docx") returned 5 [0198.203] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.203] lstrlenW (lpString=".pdf") returned 4 [0198.203] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.203] lstrlenW (lpString=".xls") returned 4 [0198.203] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.203] lstrlenW (lpString=".xlsx") returned 5 [0198.203] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.203] lstrlenW (lpString=".ppt") returned 4 [0198.203] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.203] lstrlenW (lpString=".zip") returned 4 [0198.203] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.203] lstrlenW (lpString=".rar") returned 4 [0198.203] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.203] lstrlenW (lpString=".bz2") returned 4 [0198.203] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.203] lstrlenW (lpString=".7z") returned 3 [0198.203] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.203] lstrlenW (lpString=".dbf") returned 4 [0198.203] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.203] lstrlenW (lpString=".1cd") returned 4 [0198.203] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.203] lstrlenW (lpString=".jpg") returned 4 [0198.204] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.204] lstrlenW (lpString=".doc") returned 4 [0198.204] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.204] lstrlenW (lpString=".docx") returned 5 [0198.204] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.204] lstrlenW (lpString=".pdf") returned 4 [0198.204] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.204] lstrlenW (lpString=".xls") returned 4 [0198.204] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.204] lstrlenW (lpString=".xlsx") returned 5 [0198.204] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.204] lstrlenW (lpString=".ppt") returned 4 [0198.204] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.204] lstrlenW (lpString=".zip") returned 4 [0198.204] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.204] lstrlenW (lpString=".rar") returned 4 [0198.204] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.204] lstrlenW (lpString=".bz2") returned 4 [0198.204] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.204] lstrlenW (lpString=".7z") returned 3 [0198.204] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.204] lstrlenW (lpString=".dbf") returned 4 [0198.204] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.204] lstrlenW (lpString=".1cd") returned 4 [0198.204] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\uk\\messages.json") returned 160 [0198.204] lstrlenW (lpString=".jpg") returned 4 [0198.204] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.205] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.205] lstrlenW (lpString="messages.json") returned 13 [0198.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.205] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=17003) returned 1 [0198.205] CloseHandle (hObject=0x114) returned 1 [0198.205] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json")) returned 0x2020 [0198.205] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.206] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.206] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.214] GetLastError () returned 0x0 [0198.214] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x426b, lpOverlapped=0x0) returned 1 [0198.216] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x4270, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x4270, lpOverlapped=0x0) returned 1 [0198.217] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.217] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.217] SetEndOfFile (hFile=0x2d8) returned 1 [0198.217] CloseHandle (hObject=0x2d8) returned 1 [0198.217] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.217] SetEndOfFile (hFile=0x114) returned 1 [0198.218] CloseHandle (hObject=0x114) returned 1 [0198.218] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.218] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json")) returned 1 [0198.218] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.218] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.218] lstrlenW (lpString=".doc") returned 4 [0198.219] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.219] lstrlenW (lpString=".docx") returned 5 [0198.219] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.219] lstrlenW (lpString=".pdf") returned 4 [0198.219] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.219] lstrlenW (lpString=".xls") returned 4 [0198.219] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.219] lstrlenW (lpString=".xlsx") returned 5 [0198.219] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.219] lstrlenW (lpString=".ppt") returned 4 [0198.219] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.219] lstrlenW (lpString=".zip") returned 4 [0198.219] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.219] lstrlenW (lpString=".rar") returned 4 [0198.219] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.219] lstrlenW (lpString=".bz2") returned 4 [0198.219] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.219] lstrlenW (lpString=".7z") returned 3 [0198.219] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.219] lstrlenW (lpString=".dbf") returned 4 [0198.219] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.219] lstrlenW (lpString=".1cd") returned 4 [0198.219] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.219] lstrlenW (lpString=".jpg") returned 4 [0198.219] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.219] lstrlenW (lpString=".doc") returned 4 [0198.219] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.220] lstrlenW (lpString=".docx") returned 5 [0198.220] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.220] lstrlenW (lpString=".pdf") returned 4 [0198.220] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.220] lstrlenW (lpString=".xls") returned 4 [0198.220] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.220] lstrlenW (lpString=".xlsx") returned 5 [0198.220] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.220] lstrlenW (lpString=".ppt") returned 4 [0198.220] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.220] lstrlenW (lpString=".zip") returned 4 [0198.220] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.220] lstrlenW (lpString=".rar") returned 4 [0198.220] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.220] lstrlenW (lpString=".bz2") returned 4 [0198.220] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.220] lstrlenW (lpString=".7z") returned 3 [0198.220] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.220] lstrlenW (lpString=".dbf") returned 4 [0198.220] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.220] lstrlenW (lpString=".1cd") returned 4 [0198.220] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\vi\\messages.json") returned 160 [0198.220] lstrlenW (lpString=".jpg") returned 4 [0198.220] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.220] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.221] lstrlenW (lpString="messages.json") returned 13 [0198.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.221] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=15633) returned 1 [0198.221] CloseHandle (hObject=0x114) returned 1 [0198.221] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json")) returned 0x2020 [0198.221] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.221] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.222] GetLastError () returned 0x0 [0198.222] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x3d11, lpOverlapped=0x0) returned 1 [0198.464] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x3d20, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3d20, lpOverlapped=0x0) returned 1 [0198.465] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.465] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.466] SetEndOfFile (hFile=0x2d8) returned 1 [0198.466] CloseHandle (hObject=0x2d8) returned 1 [0198.466] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.466] SetEndOfFile (hFile=0x114) returned 1 [0198.467] CloseHandle (hObject=0x114) returned 1 [0198.467] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.467] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json")) returned 1 [0198.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.467] lstrlenW (lpString=".doc") returned 4 [0198.467] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.467] lstrlenW (lpString=".docx") returned 5 [0198.467] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.467] lstrlenW (lpString=".pdf") returned 4 [0198.467] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.467] lstrlenW (lpString=".xls") returned 4 [0198.467] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.467] lstrlenW (lpString=".xlsx") returned 5 [0198.467] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.467] lstrlenW (lpString=".ppt") returned 4 [0198.467] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.467] lstrlenW (lpString=".zip") returned 4 [0198.468] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.468] lstrlenW (lpString=".rar") returned 4 [0198.468] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.468] lstrlenW (lpString=".bz2") returned 4 [0198.468] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.468] lstrlenW (lpString=".7z") returned 3 [0198.468] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.468] lstrlenW (lpString=".dbf") returned 4 [0198.468] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.468] lstrlenW (lpString=".1cd") returned 4 [0198.468] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.468] lstrlenW (lpString=".jpg") returned 4 [0198.468] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.468] lstrlenW (lpString=".doc") returned 4 [0198.468] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.468] lstrlenW (lpString=".docx") returned 5 [0198.468] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.468] lstrlenW (lpString=".pdf") returned 4 [0198.468] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.468] lstrlenW (lpString=".xls") returned 4 [0198.468] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.468] lstrlenW (lpString=".xlsx") returned 5 [0198.468] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.468] lstrlenW (lpString=".ppt") returned 4 [0198.468] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.468] lstrlenW (lpString=".zip") returned 4 [0198.468] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.468] lstrlenW (lpString=".rar") returned 4 [0198.469] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.469] lstrlenW (lpString=".bz2") returned 4 [0198.469] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.469] lstrlenW (lpString=".7z") returned 3 [0198.469] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.469] lstrlenW (lpString=".dbf") returned 4 [0198.469] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.469] lstrlenW (lpString=".1cd") returned 4 [0198.469] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh\\messages.json") returned 160 [0198.469] lstrlenW (lpString=".jpg") returned 4 [0198.469] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.469] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0198.469] lstrlenW (lpString="desktop.ini") returned 11 [0198.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.617] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=67) returned 1 [0198.617] CloseHandle (hObject=0x358) returned 1 [0198.617] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 0x2026 [0198.617] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.617] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.617] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.618] GetLastError () returned 0x0 [0198.618] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x43, lpOverlapped=0x0) returned 1 [0198.619] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x50, lpOverlapped=0x0) returned 1 [0198.619] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.619] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0198.620] SetEndOfFile (hFile=0x114) returned 1 [0198.620] CloseHandle (hObject=0x114) returned 1 [0198.620] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.620] SetEndOfFile (hFile=0x358) returned 1 [0198.620] CloseHandle (hObject=0x358) returned 1 [0198.620] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0198.621] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\desktop.ini")) returned 1 [0198.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.621] lstrlenW (lpString=".doc") returned 4 [0198.621] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.621] lstrlenW (lpString=".docx") returned 5 [0198.621] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.621] lstrlenW (lpString=".pdf") returned 4 [0198.621] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.621] lstrlenW (lpString=".xls") returned 4 [0198.621] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.621] lstrlenW (lpString=".xlsx") returned 5 [0198.621] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.621] lstrlenW (lpString=".ppt") returned 4 [0198.621] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.621] lstrlenW (lpString=".zip") returned 4 [0198.621] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.621] lstrlenW (lpString=".rar") returned 4 [0198.621] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.621] lstrlenW (lpString=".bz2") returned 4 [0198.621] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.621] lstrlenW (lpString=".7z") returned 3 [0198.621] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.621] lstrlenW (lpString=".dbf") returned 4 [0198.621] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.622] lstrlenW (lpString=".1cd") returned 4 [0198.622] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.622] lstrlenW (lpString=".jpg") returned 4 [0198.622] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.622] lstrlenW (lpString=".doc") returned 4 [0198.622] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.622] lstrlenW (lpString=".docx") returned 5 [0198.622] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.622] lstrlenW (lpString=".pdf") returned 4 [0198.622] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.622] lstrlenW (lpString=".xls") returned 4 [0198.622] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.622] lstrlenW (lpString=".xlsx") returned 5 [0198.622] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.622] lstrlenW (lpString=".ppt") returned 4 [0198.622] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.622] lstrlenW (lpString=".zip") returned 4 [0198.622] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.622] lstrlenW (lpString=".rar") returned 4 [0198.622] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.622] lstrlenW (lpString=".bz2") returned 4 [0198.622] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.622] lstrlenW (lpString=".7z") returned 3 [0198.622] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.622] lstrlenW (lpString=".dbf") returned 4 [0198.622] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.622] lstrlenW (lpString=".1cd") returned 4 [0198.623] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\desktop.ini") returned 86 [0198.623] lstrlenW (lpString=".jpg") returned 4 [0198.623] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.623] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0198.623] lstrlenW (lpString="get.adobe[1].xml") returned 16 [0198.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.623] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=13) returned 1 [0198.623] CloseHandle (hObject=0x358) returned 1 [0198.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml")) returned 0x2020 [0198.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.624] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.624] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.624] GetLastError () returned 0x0 [0198.624] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xd, lpOverlapped=0x0) returned 1 [0198.625] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x10, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x10, lpOverlapped=0x0) returned 1 [0198.626] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.627] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0198.627] SetEndOfFile (hFile=0x114) returned 1 [0198.627] CloseHandle (hObject=0x114) returned 1 [0198.627] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.627] SetEndOfFile (hFile=0x358) returned 1 [0198.628] CloseHandle (hObject=0x358) returned 1 [0198.628] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.628] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\8nes5h33\\get.adobe[1].xml")) returned 1 [0198.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.628] lstrlenW (lpString=".doc") returned 4 [0198.628] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.628] lstrlenW (lpString=".docx") returned 5 [0198.628] lstrcmpiW (lpString1=".docx", lpString2="].xml") returned -1 [0198.628] lstrlenW (lpString=".pdf") returned 4 [0198.628] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.628] lstrlenW (lpString=".xls") returned 4 [0198.628] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.628] lstrlenW (lpString=".xlsx") returned 5 [0198.628] lstrcmpiW (lpString1=".xlsx", lpString2="].xml") returned -1 [0198.628] lstrlenW (lpString=".ppt") returned 4 [0198.628] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.628] lstrlenW (lpString=".zip") returned 4 [0198.628] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.628] lstrlenW (lpString=".rar") returned 4 [0198.628] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.629] lstrlenW (lpString=".bz2") returned 4 [0198.629] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.629] lstrlenW (lpString=".7z") returned 3 [0198.629] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.629] lstrlenW (lpString=".dbf") returned 4 [0198.629] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.629] lstrlenW (lpString=".1cd") returned 4 [0198.629] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.629] lstrlenW (lpString=".jpg") returned 4 [0198.629] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.629] lstrlenW (lpString=".doc") returned 4 [0198.629] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.629] lstrlenW (lpString=".docx") returned 5 [0198.629] lstrcmpiW (lpString1=".docx", lpString2="].xml") returned -1 [0198.629] lstrlenW (lpString=".pdf") returned 4 [0198.629] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.629] lstrlenW (lpString=".xls") returned 4 [0198.629] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.629] lstrlenW (lpString=".xlsx") returned 5 [0198.629] lstrcmpiW (lpString1=".xlsx", lpString2="].xml") returned -1 [0198.629] lstrlenW (lpString=".ppt") returned 4 [0198.629] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.629] lstrlenW (lpString=".zip") returned 4 [0198.629] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.629] lstrlenW (lpString=".rar") returned 4 [0198.629] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.629] lstrlenW (lpString=".bz2") returned 4 [0198.629] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.630] lstrlenW (lpString=".7z") returned 3 [0198.630] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.630] lstrlenW (lpString=".dbf") returned 4 [0198.630] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.630] lstrlenW (lpString=".1cd") returned 4 [0198.630] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\8NES5H33\\get.adobe[1].xml") returned 106 [0198.630] lstrlenW (lpString=".jpg") returned 4 [0198.630] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.630] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0198.630] lstrlenW (lpString="index.dat") returned 9 [0198.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.630] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=32768) returned 1 [0198.630] CloseHandle (hObject=0x358) returned 1 [0198.631] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat")) returned 0x2026 [0198.631] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.631] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.631] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0198.661] GetLastError () returned 0x0 [0198.661] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x8000, lpOverlapped=0x0) returned 1 [0198.673] WriteFile (in: hFile=0x2d4, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x8010, lpOverlapped=0x0) returned 1 [0198.675] ReadFile (in: hFile=0x358, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.675] WriteFile (in: hFile=0x2d4, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0198.675] SetEndOfFile (hFile=0x2d4) returned 1 [0198.675] CloseHandle (hObject=0x2d4) returned 1 [0198.675] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.675] SetEndOfFile (hFile=0x358) returned 1 [0198.676] CloseHandle (hObject=0x358) returned 1 [0198.676] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0198.676] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\domstore\\index.dat")) returned 1 [0198.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.677] lstrlenW (lpString=".doc") returned 4 [0198.677] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.677] lstrlenW (lpString=".docx") returned 5 [0198.677] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0198.677] lstrlenW (lpString=".pdf") returned 4 [0198.677] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.677] lstrlenW (lpString=".xls") returned 4 [0198.677] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.677] lstrlenW (lpString=".xlsx") returned 5 [0198.677] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0198.677] lstrlenW (lpString=".ppt") returned 4 [0198.677] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.677] lstrlenW (lpString=".zip") returned 4 [0198.677] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.677] lstrlenW (lpString=".rar") returned 4 [0198.677] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.677] lstrlenW (lpString=".bz2") returned 4 [0198.677] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.677] lstrlenW (lpString=".7z") returned 3 [0198.677] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.677] lstrlenW (lpString=".dbf") returned 4 [0198.677] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.677] lstrlenW (lpString=".1cd") returned 4 [0198.677] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.677] lstrlenW (lpString=".jpg") returned 4 [0198.677] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.677] lstrlenW (lpString=".doc") returned 4 [0198.677] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.678] lstrlenW (lpString=".docx") returned 5 [0198.678] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0198.678] lstrlenW (lpString=".pdf") returned 4 [0198.678] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.678] lstrlenW (lpString=".xls") returned 4 [0198.678] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.678] lstrlenW (lpString=".xlsx") returned 5 [0198.678] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0198.678] lstrlenW (lpString=".ppt") returned 4 [0198.678] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.678] lstrlenW (lpString=".zip") returned 4 [0198.678] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.678] lstrlenW (lpString=".rar") returned 4 [0198.678] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.678] lstrlenW (lpString=".bz2") returned 4 [0198.678] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.678] lstrlenW (lpString=".7z") returned 3 [0198.678] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.678] lstrlenW (lpString=".dbf") returned 4 [0198.678] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.678] lstrlenW (lpString=".1cd") returned 4 [0198.679] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\DOMStore\\index.dat") returned 90 [0198.679] lstrlenW (lpString=".jpg") returned 4 [0198.679] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.679] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0198.679] lstrlenW (lpString="{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 42 [0198.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.685] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=4608) returned 1 [0198.685] CloseHandle (hObject=0x150) returned 1 [0198.685] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 0x2020 [0198.685] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.686] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.686] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.686] GetLastError () returned 0x0 [0198.686] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1200, lpOverlapped=0x0) returned 1 [0198.688] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0198.689] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.689] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x128, lpOverlapped=0x0) returned 1 [0198.689] SetEndOfFile (hFile=0x154) returned 1 [0198.689] CloseHandle (hObject=0x154) returned 1 [0198.689] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.689] SetEndOfFile (hFile=0x150) returned 1 [0198.690] CloseHandle (hObject=0x150) returned 1 [0198.690] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.690] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{4bd650f0-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1 [0198.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.690] lstrlenW (lpString=".doc") returned 4 [0198.690] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.690] lstrlenW (lpString=".docx") returned 5 [0198.690] lstrcmpiW (lpString1=".docx", lpString2="}.dat") returned -1 [0198.690] lstrlenW (lpString=".pdf") returned 4 [0198.690] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.690] lstrlenW (lpString=".xls") returned 4 [0198.690] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.690] lstrlenW (lpString=".xlsx") returned 5 [0198.691] lstrcmpiW (lpString1=".xlsx", lpString2="}.dat") returned -1 [0198.691] lstrlenW (lpString=".ppt") returned 4 [0198.691] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.691] lstrlenW (lpString=".zip") returned 4 [0198.691] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.691] lstrlenW (lpString=".rar") returned 4 [0198.691] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.691] lstrlenW (lpString=".bz2") returned 4 [0198.691] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.691] lstrlenW (lpString=".7z") returned 3 [0198.691] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.691] lstrlenW (lpString=".dbf") returned 4 [0198.691] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.691] lstrlenW (lpString=".1cd") returned 4 [0198.691] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.691] lstrlenW (lpString=".jpg") returned 4 [0198.691] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.691] lstrlenW (lpString=".doc") returned 4 [0198.691] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.691] lstrlenW (lpString=".docx") returned 5 [0198.691] lstrcmpiW (lpString1=".docx", lpString2="}.dat") returned -1 [0198.691] lstrlenW (lpString=".pdf") returned 4 [0198.691] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.691] lstrlenW (lpString=".xls") returned 4 [0198.691] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.691] lstrlenW (lpString=".xlsx") returned 5 [0198.691] lstrcmpiW (lpString1=".xlsx", lpString2="}.dat") returned -1 [0198.691] lstrlenW (lpString=".ppt") returned 4 [0198.691] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.692] lstrlenW (lpString=".zip") returned 4 [0198.692] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.692] lstrlenW (lpString=".rar") returned 4 [0198.692] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.692] lstrlenW (lpString=".bz2") returned 4 [0198.692] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.692] lstrlenW (lpString=".7z") returned 3 [0198.692] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.692] lstrlenW (lpString=".dbf") returned 4 [0198.692] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.692] lstrlenW (lpString=".1cd") returned 4 [0198.692] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{4BD650F0-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.692] lstrlenW (lpString=".jpg") returned 4 [0198.692] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.692] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0198.692] lstrlenW (lpString="350db95df4cbd94b2a1c300510e12e11.xml") returned 36 [0198.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.694] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2031) returned 1 [0198.694] CloseHandle (hObject=0x150) returned 1 [0198.694] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml")) returned 0x2020 [0198.694] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.694] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.694] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.697] GetLastError () returned 0x0 [0198.697] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x7ef, lpOverlapped=0x0) returned 1 [0198.698] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0198.699] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.699] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x11c, lpOverlapped=0x0) returned 1 [0198.699] SetEndOfFile (hFile=0x154) returned 1 [0198.699] CloseHandle (hObject=0x154) returned 1 [0198.699] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.699] SetEndOfFile (hFile=0x150) returned 1 [0198.700] CloseHandle (hObject=0x150) returned 1 [0198.700] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.700] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.xml")) returned 1 [0198.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.700] lstrlenW (lpString=".doc") returned 4 [0198.701] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.701] lstrlenW (lpString=".docx") returned 5 [0198.701] lstrcmpiW (lpString1=".docx", lpString2="1.xml") returned -1 [0198.701] lstrlenW (lpString=".pdf") returned 4 [0198.701] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.701] lstrlenW (lpString=".xls") returned 4 [0198.701] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.701] lstrlenW (lpString=".xlsx") returned 5 [0198.701] lstrcmpiW (lpString1=".xlsx", lpString2="1.xml") returned -1 [0198.701] lstrlenW (lpString=".ppt") returned 4 [0198.701] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.701] lstrlenW (lpString=".zip") returned 4 [0198.701] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.701] lstrlenW (lpString=".rar") returned 4 [0198.701] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.701] lstrlenW (lpString=".bz2") returned 4 [0198.701] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.701] lstrlenW (lpString=".7z") returned 3 [0198.701] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.701] lstrlenW (lpString=".dbf") returned 4 [0198.701] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.701] lstrlenW (lpString=".1cd") returned 4 [0198.701] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.701] lstrlenW (lpString=".jpg") returned 4 [0198.701] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.701] lstrlenW (lpString=".doc") returned 4 [0198.701] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0198.701] lstrlenW (lpString=".docx") returned 5 [0198.702] lstrcmpiW (lpString1=".docx", lpString2="1.xml") returned -1 [0198.702] lstrlenW (lpString=".pdf") returned 4 [0198.702] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0198.702] lstrlenW (lpString=".xls") returned 4 [0198.702] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0198.702] lstrlenW (lpString=".xlsx") returned 5 [0198.702] lstrcmpiW (lpString1=".xlsx", lpString2="1.xml") returned -1 [0198.702] lstrlenW (lpString=".ppt") returned 4 [0198.702] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0198.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.702] lstrlenW (lpString=".zip") returned 4 [0198.702] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0198.702] lstrlenW (lpString=".rar") returned 4 [0198.702] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0198.702] lstrlenW (lpString=".bz2") returned 4 [0198.702] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0198.702] lstrlenW (lpString=".7z") returned 3 [0198.702] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0198.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.702] lstrlenW (lpString=".dbf") returned 4 [0198.702] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0198.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.702] lstrlenW (lpString=".1cd") returned 4 [0198.702] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0198.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.xml") returned 108 [0198.702] lstrlenW (lpString=".jpg") returned 4 [0198.702] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0198.702] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0198.702] lstrlenW (lpString="Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 58 [0198.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.703] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=260) returned 1 [0198.703] CloseHandle (hObject=0x150) returned 1 [0198.703] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat")) returned 0x2020 [0198.703] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.703] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.703] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.860] GetLastError () returned 0x0 [0198.860] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x104, lpOverlapped=0x0) returned 1 [0198.861] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x110, lpOverlapped=0x0) returned 1 [0198.862] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.862] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x148, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x148, lpOverlapped=0x0) returned 1 [0198.862] SetEndOfFile (hFile=0x388) returned 1 [0198.862] CloseHandle (hObject=0x388) returned 1 [0198.862] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.862] SetEndOfFile (hFile=0x150) returned 1 [0198.863] CloseHandle (hObject=0x150) returned 1 [0198.863] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.863] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\roamcache\\stream_contactprefs_2_f230e11936b7d740a008ffc660e83c71.dat")) returned 1 [0198.863] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.864] lstrlenW (lpString=".doc") returned 4 [0198.864] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.864] lstrlenW (lpString=".docx") returned 5 [0198.864] lstrcmpiW (lpString1=".docx", lpString2="1.dat") returned -1 [0198.864] lstrlenW (lpString=".pdf") returned 4 [0198.864] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.864] lstrlenW (lpString=".xls") returned 4 [0198.864] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.864] lstrlenW (lpString=".xlsx") returned 5 [0198.864] lstrcmpiW (lpString1=".xlsx", lpString2="1.dat") returned -1 [0198.864] lstrlenW (lpString=".ppt") returned 4 [0198.864] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.864] lstrlenW (lpString=".zip") returned 4 [0198.864] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.864] lstrlenW (lpString=".rar") returned 4 [0198.864] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.864] lstrlenW (lpString=".bz2") returned 4 [0198.864] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.864] lstrlenW (lpString=".7z") returned 3 [0198.864] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.864] lstrlenW (lpString=".dbf") returned 4 [0198.864] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.864] lstrlenW (lpString=".1cd") returned 4 [0198.864] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.864] lstrlenW (lpString=".jpg") returned 4 [0198.864] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.865] lstrlenW (lpString=".doc") returned 4 [0198.865] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.865] lstrlenW (lpString=".docx") returned 5 [0198.865] lstrcmpiW (lpString1=".docx", lpString2="1.dat") returned -1 [0198.865] lstrlenW (lpString=".pdf") returned 4 [0198.865] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.865] lstrlenW (lpString=".xls") returned 4 [0198.865] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.865] lstrlenW (lpString=".xlsx") returned 5 [0198.865] lstrcmpiW (lpString1=".xlsx", lpString2="1.dat") returned -1 [0198.865] lstrlenW (lpString=".ppt") returned 4 [0198.865] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.865] lstrlenW (lpString=".zip") returned 4 [0198.865] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.865] lstrlenW (lpString=".rar") returned 4 [0198.865] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.865] lstrlenW (lpString=".bz2") returned 4 [0198.865] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.865] lstrlenW (lpString=".7z") returned 3 [0198.865] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.865] lstrlenW (lpString=".dbf") returned 4 [0198.865] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.865] lstrlenW (lpString=".1cd") returned 4 [0198.866] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\RoamCache\\Stream_ContactPrefs_2_F230E11936B7D740A008FFC660E83C71.dat") returned 130 [0198.866] lstrlenW (lpString=".jpg") returned 4 [0198.866] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.866] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.866] lstrlenW (lpString="thumbcache_1024.db") returned 18 [0198.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.866] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=24) returned 1 [0198.866] CloseHandle (hObject=0x150) returned 1 [0198.866] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 0x2020 [0198.866] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.866] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.867] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.867] GetLastError () returned 0x0 [0198.867] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x18, lpOverlapped=0x0) returned 1 [0198.868] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x20, lpOverlapped=0x0) returned 1 [0198.869] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.869] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0198.869] SetEndOfFile (hFile=0x388) returned 1 [0198.869] CloseHandle (hObject=0x388) returned 1 [0198.869] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.869] SetEndOfFile (hFile=0x150) returned 0 [0198.869] CloseHandle (hObject=0x150) returned 1 [0198.869] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.869] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_1024.db")) returned 0 [0198.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.869] lstrlenW (lpString=".doc") returned 4 [0198.869] lstrcmpiW (lpString1=".doc", lpString2="4.db") returned -1 [0198.869] lstrlenW (lpString=".docx") returned 5 [0198.869] lstrcmpiW (lpString1=".docx", lpString2="24.db") returned -1 [0198.870] lstrlenW (lpString=".pdf") returned 4 [0198.870] lstrcmpiW (lpString1=".pdf", lpString2="4.db") returned -1 [0198.870] lstrlenW (lpString=".xls") returned 4 [0198.870] lstrcmpiW (lpString1=".xls", lpString2="4.db") returned -1 [0198.870] lstrlenW (lpString=".xlsx") returned 5 [0198.870] lstrcmpiW (lpString1=".xlsx", lpString2="24.db") returned -1 [0198.870] lstrlenW (lpString=".ppt") returned 4 [0198.870] lstrcmpiW (lpString1=".ppt", lpString2="4.db") returned -1 [0198.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.870] lstrlenW (lpString=".zip") returned 4 [0198.870] lstrcmpiW (lpString1=".zip", lpString2="4.db") returned -1 [0198.870] lstrlenW (lpString=".rar") returned 4 [0198.870] lstrcmpiW (lpString1=".rar", lpString2="4.db") returned -1 [0198.870] lstrlenW (lpString=".bz2") returned 4 [0198.870] lstrcmpiW (lpString1=".bz2", lpString2="4.db") returned -1 [0198.870] lstrlenW (lpString=".7z") returned 3 [0198.870] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.870] lstrlenW (lpString=".dbf") returned 4 [0198.870] lstrcmpiW (lpString1=".dbf", lpString2="4.db") returned -1 [0198.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.870] lstrlenW (lpString=".1cd") returned 4 [0198.870] lstrcmpiW (lpString1=".1cd", lpString2="4.db") returned -1 [0198.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.870] lstrlenW (lpString=".jpg") returned 4 [0198.870] lstrcmpiW (lpString1=".jpg", lpString2="4.db") returned -1 [0198.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.870] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.870] lstrlenW (lpString=".doc") returned 4 [0198.870] lstrcmpiW (lpString1=".doc", lpString2="4.db") returned -1 [0198.870] lstrlenW (lpString=".docx") returned 5 [0198.870] lstrcmpiW (lpString1=".docx", lpString2="24.db") returned -1 [0198.870] lstrlenW (lpString=".pdf") returned 4 [0198.870] lstrcmpiW (lpString1=".pdf", lpString2="4.db") returned -1 [0198.871] lstrlenW (lpString=".xls") returned 4 [0198.871] lstrcmpiW (lpString1=".xls", lpString2="4.db") returned -1 [0198.871] lstrlenW (lpString=".xlsx") returned 5 [0198.871] lstrcmpiW (lpString1=".xlsx", lpString2="24.db") returned -1 [0198.871] lstrlenW (lpString=".ppt") returned 4 [0198.871] lstrcmpiW (lpString1=".ppt", lpString2="4.db") returned -1 [0198.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.871] lstrlenW (lpString=".zip") returned 4 [0198.871] lstrcmpiW (lpString1=".zip", lpString2="4.db") returned -1 [0198.871] lstrlenW (lpString=".rar") returned 4 [0198.871] lstrcmpiW (lpString1=".rar", lpString2="4.db") returned -1 [0198.871] lstrlenW (lpString=".bz2") returned 4 [0198.871] lstrcmpiW (lpString1=".bz2", lpString2="4.db") returned -1 [0198.871] lstrlenW (lpString=".7z") returned 3 [0198.871] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.871] lstrlenW (lpString=".dbf") returned 4 [0198.871] lstrcmpiW (lpString1=".dbf", lpString2="4.db") returned -1 [0198.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.871] lstrlenW (lpString=".1cd") returned 4 [0198.871] lstrcmpiW (lpString1=".1cd", lpString2="4.db") returned -1 [0198.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_1024.db") returned 89 [0198.871] lstrlenW (lpString=".jpg") returned 4 [0198.871] lstrcmpiW (lpString1=".jpg", lpString2="4.db") returned -1 [0198.871] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.871] lstrlenW (lpString="thumbcache_256.db") returned 17 [0198.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.872] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1048576) returned 1 [0198.872] CloseHandle (hObject=0x150) returned 1 [0198.872] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 0x2020 [0198.872] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.872] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.872] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.872] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.874] GetLastError () returned 0x0 [0198.874] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0198.947] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0198.965] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x10, lpOverlapped=0x0) returned 1 [0198.965] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x20, lpOverlapped=0x0) returned 1 [0198.968] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.968] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0198.968] SetEndOfFile (hFile=0x388) returned 1 [0198.969] CloseHandle (hObject=0x388) returned 1 [0198.969] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.969] SetEndOfFile (hFile=0x150) returned 0 [0198.969] CloseHandle (hObject=0x150) returned 1 [0198.969] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.969] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_256.db")) returned 0 [0198.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.969] lstrlenW (lpString=".doc") returned 4 [0198.969] lstrcmpiW (lpString1=".doc", lpString2="6.db") returned -1 [0198.969] lstrlenW (lpString=".docx") returned 5 [0198.969] lstrcmpiW (lpString1=".docx", lpString2="56.db") returned -1 [0198.969] lstrlenW (lpString=".pdf") returned 4 [0198.969] lstrcmpiW (lpString1=".pdf", lpString2="6.db") returned -1 [0198.969] lstrlenW (lpString=".xls") returned 4 [0198.969] lstrcmpiW (lpString1=".xls", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString=".xlsx") returned 5 [0198.970] lstrcmpiW (lpString1=".xlsx", lpString2="56.db") returned -1 [0198.970] lstrlenW (lpString=".ppt") returned 4 [0198.970] lstrcmpiW (lpString1=".ppt", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.970] lstrlenW (lpString=".zip") returned 4 [0198.970] lstrcmpiW (lpString1=".zip", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString=".rar") returned 4 [0198.970] lstrcmpiW (lpString1=".rar", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString=".bz2") returned 4 [0198.970] lstrcmpiW (lpString1=".bz2", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString=".7z") returned 3 [0198.970] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.970] lstrlenW (lpString=".dbf") returned 4 [0198.970] lstrcmpiW (lpString1=".dbf", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.970] lstrlenW (lpString=".1cd") returned 4 [0198.970] lstrcmpiW (lpString1=".1cd", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.970] lstrlenW (lpString=".jpg") returned 4 [0198.970] lstrcmpiW (lpString1=".jpg", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.970] lstrlenW (lpString=".doc") returned 4 [0198.970] lstrcmpiW (lpString1=".doc", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString=".docx") returned 5 [0198.970] lstrcmpiW (lpString1=".docx", lpString2="56.db") returned -1 [0198.970] lstrlenW (lpString=".pdf") returned 4 [0198.970] lstrcmpiW (lpString1=".pdf", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString=".xls") returned 4 [0198.970] lstrcmpiW (lpString1=".xls", lpString2="6.db") returned -1 [0198.970] lstrlenW (lpString=".xlsx") returned 5 [0198.971] lstrcmpiW (lpString1=".xlsx", lpString2="56.db") returned -1 [0198.971] lstrlenW (lpString=".ppt") returned 4 [0198.971] lstrcmpiW (lpString1=".ppt", lpString2="6.db") returned -1 [0198.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.971] lstrlenW (lpString=".zip") returned 4 [0198.971] lstrcmpiW (lpString1=".zip", lpString2="6.db") returned -1 [0198.971] lstrlenW (lpString=".rar") returned 4 [0198.971] lstrcmpiW (lpString1=".rar", lpString2="6.db") returned -1 [0198.971] lstrlenW (lpString=".bz2") returned 4 [0198.971] lstrcmpiW (lpString1=".bz2", lpString2="6.db") returned -1 [0198.971] lstrlenW (lpString=".7z") returned 3 [0198.971] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.971] lstrlenW (lpString=".dbf") returned 4 [0198.971] lstrcmpiW (lpString1=".dbf", lpString2="6.db") returned -1 [0198.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.971] lstrlenW (lpString=".1cd") returned 4 [0198.971] lstrcmpiW (lpString1=".1cd", lpString2="6.db") returned -1 [0198.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_256.db") returned 88 [0198.971] lstrlenW (lpString=".jpg") returned 4 [0198.971] lstrcmpiW (lpString1=".jpg", lpString2="6.db") returned -1 [0198.971] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.971] lstrlenW (lpString="thumbcache_idx.db") returned 17 [0198.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.972] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=3256) returned 1 [0198.972] CloseHandle (hObject=0x150) returned 1 [0198.972] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 0x2020 [0198.972] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.972] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.972] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.973] GetLastError () returned 0x0 [0198.973] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0xcb8, lpOverlapped=0x0) returned 1 [0198.973] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0198.974] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.974] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0198.975] SetEndOfFile (hFile=0x388) returned 1 [0198.975] CloseHandle (hObject=0x388) returned 1 [0198.975] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.975] SetEndOfFile (hFile=0x150) returned 0 [0198.975] CloseHandle (hObject=0x150) returned 1 [0198.975] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.975] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_idx.db")) returned 0 [0198.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.975] lstrlenW (lpString=".doc") returned 4 [0198.975] lstrcmpiW (lpString1=".doc", lpString2="x.db") returned -1 [0198.975] lstrlenW (lpString=".docx") returned 5 [0198.975] lstrcmpiW (lpString1=".docx", lpString2="dx.db") returned -1 [0198.975] lstrlenW (lpString=".pdf") returned 4 [0198.975] lstrcmpiW (lpString1=".pdf", lpString2="x.db") returned -1 [0198.975] lstrlenW (lpString=".xls") returned 4 [0198.975] lstrcmpiW (lpString1=".xls", lpString2="x.db") returned -1 [0198.975] lstrlenW (lpString=".xlsx") returned 5 [0198.976] lstrcmpiW (lpString1=".xlsx", lpString2="dx.db") returned -1 [0198.976] lstrlenW (lpString=".ppt") returned 4 [0198.976] lstrcmpiW (lpString1=".ppt", lpString2="x.db") returned -1 [0198.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.976] lstrlenW (lpString=".zip") returned 4 [0198.976] lstrcmpiW (lpString1=".zip", lpString2="x.db") returned -1 [0198.976] lstrlenW (lpString=".rar") returned 4 [0198.976] lstrcmpiW (lpString1=".rar", lpString2="x.db") returned -1 [0198.976] lstrlenW (lpString=".bz2") returned 4 [0198.976] lstrcmpiW (lpString1=".bz2", lpString2="x.db") returned -1 [0198.976] lstrlenW (lpString=".7z") returned 3 [0198.976] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.976] lstrlenW (lpString=".dbf") returned 4 [0198.976] lstrcmpiW (lpString1=".dbf", lpString2="x.db") returned -1 [0198.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.976] lstrlenW (lpString=".1cd") returned 4 [0198.976] lstrcmpiW (lpString1=".1cd", lpString2="x.db") returned -1 [0198.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.976] lstrlenW (lpString=".jpg") returned 4 [0198.976] lstrcmpiW (lpString1=".jpg", lpString2="x.db") returned -1 [0198.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.976] lstrlenW (lpString=".doc") returned 4 [0198.976] lstrcmpiW (lpString1=".doc", lpString2="x.db") returned -1 [0198.976] lstrlenW (lpString=".docx") returned 5 [0198.976] lstrcmpiW (lpString1=".docx", lpString2="dx.db") returned -1 [0198.976] lstrlenW (lpString=".pdf") returned 4 [0198.976] lstrcmpiW (lpString1=".pdf", lpString2="x.db") returned -1 [0198.976] lstrlenW (lpString=".xls") returned 4 [0198.976] lstrcmpiW (lpString1=".xls", lpString2="x.db") returned -1 [0198.976] lstrlenW (lpString=".xlsx") returned 5 [0198.976] lstrcmpiW (lpString1=".xlsx", lpString2="dx.db") returned -1 [0198.977] lstrlenW (lpString=".ppt") returned 4 [0198.977] lstrcmpiW (lpString1=".ppt", lpString2="x.db") returned -1 [0198.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.977] lstrlenW (lpString=".zip") returned 4 [0198.977] lstrcmpiW (lpString1=".zip", lpString2="x.db") returned -1 [0198.977] lstrlenW (lpString=".rar") returned 4 [0198.977] lstrcmpiW (lpString1=".rar", lpString2="x.db") returned -1 [0198.977] lstrlenW (lpString=".bz2") returned 4 [0198.977] lstrcmpiW (lpString1=".bz2", lpString2="x.db") returned -1 [0198.977] lstrlenW (lpString=".7z") returned 3 [0198.977] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.977] lstrlenW (lpString=".dbf") returned 4 [0198.977] lstrcmpiW (lpString1=".dbf", lpString2="x.db") returned -1 [0198.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.977] lstrlenW (lpString=".1cd") returned 4 [0198.977] lstrcmpiW (lpString1=".1cd", lpString2="x.db") returned -1 [0198.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_idx.db") returned 88 [0198.977] lstrlenW (lpString=".jpg") returned 4 [0198.977] lstrcmpiW (lpString1=".jpg", lpString2="x.db") returned -1 [0198.977] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.977] lstrlenW (lpString="thumbcache_sr.db") returned 16 [0198.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.978] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=24) returned 1 [0198.978] CloseHandle (hObject=0x150) returned 1 [0198.978] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 0x2020 [0198.978] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.978] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.978] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.978] GetLastError () returned 0x0 [0198.978] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x18, lpOverlapped=0x0) returned 1 [0198.979] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x20, lpOverlapped=0x0) returned 1 [0198.980] ReadFile (in: hFile=0x150, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.980] WriteFile (in: hFile=0x388, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0198.980] SetEndOfFile (hFile=0x388) returned 1 [0198.980] CloseHandle (hObject=0x388) returned 1 [0198.980] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.980] SetEndOfFile (hFile=0x150) returned 0 [0198.980] CloseHandle (hObject=0x150) returned 1 [0198.980] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.981] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_sr.db")) returned 0 [0198.981] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.981] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.981] lstrlenW (lpString=".doc") returned 4 [0198.981] lstrcmpiW (lpString1=".doc", lpString2="r.db") returned -1 [0198.981] lstrlenW (lpString=".docx") returned 5 [0198.981] lstrcmpiW (lpString1=".docx", lpString2="sr.db") returned -1 [0198.981] lstrlenW (lpString=".pdf") returned 4 [0198.981] lstrcmpiW (lpString1=".pdf", lpString2="r.db") returned -1 [0198.981] lstrlenW (lpString=".xls") returned 4 [0198.981] lstrcmpiW (lpString1=".xls", lpString2="r.db") returned -1 [0198.981] lstrlenW (lpString=".xlsx") returned 5 [0198.981] lstrcmpiW (lpString1=".xlsx", lpString2="sr.db") returned -1 [0198.981] lstrlenW (lpString=".ppt") returned 4 [0198.981] lstrcmpiW (lpString1=".ppt", lpString2="r.db") returned -1 [0198.981] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.981] lstrlenW (lpString=".zip") returned 4 [0198.981] lstrcmpiW (lpString1=".zip", lpString2="r.db") returned -1 [0198.981] lstrlenW (lpString=".rar") returned 4 [0198.981] lstrcmpiW (lpString1=".rar", lpString2="r.db") returned -1 [0198.981] lstrlenW (lpString=".bz2") returned 4 [0198.981] lstrcmpiW (lpString1=".bz2", lpString2="r.db") returned -1 [0198.981] lstrlenW (lpString=".7z") returned 3 [0198.981] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.981] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.981] lstrlenW (lpString=".dbf") returned 4 [0198.981] lstrcmpiW (lpString1=".dbf", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.982] lstrlenW (lpString=".1cd") returned 4 [0198.982] lstrcmpiW (lpString1=".1cd", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.982] lstrlenW (lpString=".jpg") returned 4 [0198.982] lstrcmpiW (lpString1=".jpg", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.982] lstrlenW (lpString=".doc") returned 4 [0198.982] lstrcmpiW (lpString1=".doc", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString=".docx") returned 5 [0198.982] lstrcmpiW (lpString1=".docx", lpString2="sr.db") returned -1 [0198.982] lstrlenW (lpString=".pdf") returned 4 [0198.982] lstrcmpiW (lpString1=".pdf", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString=".xls") returned 4 [0198.982] lstrcmpiW (lpString1=".xls", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString=".xlsx") returned 5 [0198.982] lstrcmpiW (lpString1=".xlsx", lpString2="sr.db") returned -1 [0198.982] lstrlenW (lpString=".ppt") returned 4 [0198.982] lstrcmpiW (lpString1=".ppt", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.982] lstrlenW (lpString=".zip") returned 4 [0198.982] lstrcmpiW (lpString1=".zip", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString=".rar") returned 4 [0198.982] lstrcmpiW (lpString1=".rar", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString=".bz2") returned 4 [0198.982] lstrcmpiW (lpString1=".bz2", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString=".7z") returned 3 [0198.982] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.982] lstrlenW (lpString=".dbf") returned 4 [0198.982] lstrcmpiW (lpString1=".dbf", lpString2="r.db") returned -1 [0198.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.983] lstrlenW (lpString=".1cd") returned 4 [0198.983] lstrcmpiW (lpString1=".1cd", lpString2="r.db") returned -1 [0198.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_sr.db") returned 87 [0198.983] lstrlenW (lpString=".jpg") returned 4 [0198.983] lstrcmpiW (lpString1=".jpg", lpString2="r.db") returned -1 [0198.983] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0198.983] lstrlenW (lpString="desktop.ini") returned 11 [0198.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.091] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=145) returned 1 [0199.091] CloseHandle (hObject=0x114) returned 1 [0199.091] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 0x2026 [0199.091] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.091] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.092] GetLastError () returned 0x0 [0199.092] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x91, lpOverlapped=0x0) returned 1 [0199.093] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0199.094] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.094] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.094] SetEndOfFile (hFile=0x2d8) returned 1 [0199.094] CloseHandle (hObject=0x2d8) returned 1 [0199.094] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.094] SetEndOfFile (hFile=0x114) returned 1 [0199.095] CloseHandle (hObject=0x114) returned 1 [0199.095] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.095] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\desktop.ini")) returned 1 [0199.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.095] lstrlenW (lpString=".doc") returned 4 [0199.095] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.095] lstrlenW (lpString=".docx") returned 5 [0199.095] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.095] lstrlenW (lpString=".pdf") returned 4 [0199.096] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.096] lstrlenW (lpString=".xls") returned 4 [0199.096] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.096] lstrlenW (lpString=".xlsx") returned 5 [0199.096] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.096] lstrlenW (lpString=".ppt") returned 4 [0199.096] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.096] lstrlenW (lpString=".zip") returned 4 [0199.096] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.096] lstrlenW (lpString=".rar") returned 4 [0199.096] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.096] lstrlenW (lpString=".bz2") returned 4 [0199.096] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.096] lstrlenW (lpString=".7z") returned 3 [0199.096] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.096] lstrlenW (lpString=".dbf") returned 4 [0199.096] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.096] lstrlenW (lpString=".1cd") returned 4 [0199.096] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.096] lstrlenW (lpString=".jpg") returned 4 [0199.096] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.096] lstrlenW (lpString=".doc") returned 4 [0199.096] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.096] lstrlenW (lpString=".docx") returned 5 [0199.096] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.096] lstrlenW (lpString=".pdf") returned 4 [0199.096] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.097] lstrlenW (lpString=".xls") returned 4 [0199.097] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.097] lstrlenW (lpString=".xlsx") returned 5 [0199.097] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.097] lstrlenW (lpString=".ppt") returned 4 [0199.097] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.097] lstrlenW (lpString=".zip") returned 4 [0199.097] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.097] lstrlenW (lpString=".rar") returned 4 [0199.097] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.097] lstrlenW (lpString=".bz2") returned 4 [0199.097] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.097] lstrlenW (lpString=".7z") returned 3 [0199.097] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.097] lstrlenW (lpString=".dbf") returned 4 [0199.097] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.097] lstrlenW (lpString=".1cd") returned 4 [0199.097] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\desktop.ini") returned 81 [0199.097] lstrlenW (lpString=".jpg") returned 4 [0199.097] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.097] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0199.097] lstrlenW (lpString="desktop.ini") returned 11 [0199.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.101] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=145) returned 1 [0199.101] CloseHandle (hObject=0x114) returned 1 [0199.101] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini")) returned 0x2006 [0199.101] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.101] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.102] GetLastError () returned 0x0 [0199.102] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x91, lpOverlapped=0x0) returned 1 [0199.103] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0199.104] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.104] WriteFile (in: hFile=0x2d8, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.104] SetEndOfFile (hFile=0x2d8) returned 1 [0199.104] CloseHandle (hObject=0x2d8) returned 1 [0199.104] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.104] SetEndOfFile (hFile=0x114) returned 1 [0199.105] CloseHandle (hObject=0x114) returned 1 [0199.105] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2006) returned 1 [0199.105] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\desktop.ini")) returned 1 [0199.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.105] lstrlenW (lpString=".doc") returned 4 [0199.105] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.105] lstrlenW (lpString=".docx") returned 5 [0199.105] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.105] lstrlenW (lpString=".pdf") returned 4 [0199.105] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.105] lstrlenW (lpString=".xls") returned 4 [0199.105] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.105] lstrlenW (lpString=".xlsx") returned 5 [0199.105] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.105] lstrlenW (lpString=".ppt") returned 4 [0199.105] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.105] lstrlenW (lpString=".zip") returned 4 [0199.105] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.106] lstrlenW (lpString=".rar") returned 4 [0199.106] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.106] lstrlenW (lpString=".bz2") returned 4 [0199.106] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.106] lstrlenW (lpString=".7z") returned 3 [0199.106] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.106] lstrlenW (lpString=".dbf") returned 4 [0199.106] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.106] lstrlenW (lpString=".1cd") returned 4 [0199.106] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.106] lstrlenW (lpString=".jpg") returned 4 [0199.106] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.106] lstrlenW (lpString=".doc") returned 4 [0199.106] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.106] lstrlenW (lpString=".docx") returned 5 [0199.106] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.106] lstrlenW (lpString=".pdf") returned 4 [0199.106] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.106] lstrlenW (lpString=".xls") returned 4 [0199.106] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.106] lstrlenW (lpString=".xlsx") returned 5 [0199.106] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.106] lstrlenW (lpString=".ppt") returned 4 [0199.106] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.106] lstrlenW (lpString=".zip") returned 4 [0199.106] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.107] lstrlenW (lpString=".rar") returned 4 [0199.107] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.107] lstrlenW (lpString=".bz2") returned 4 [0199.107] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.107] lstrlenW (lpString=".7z") returned 3 [0199.107] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.107] lstrlenW (lpString=".dbf") returned 4 [0199.107] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.107] lstrlenW (lpString=".1cd") returned 4 [0199.107] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\desktop.ini") returned 85 [0199.107] lstrlenW (lpString=".jpg") returned 4 [0199.107] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.107] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0199.107] lstrlenW (lpString="desktop.ini") returned 11 [0199.107] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.108] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=145) returned 1 [0199.108] CloseHandle (hObject=0x114) returned 1 [0199.108] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini")) returned 0x2006 [0199.108] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.108] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.223] GetLastError () returned 0x0 [0199.223] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x91, lpOverlapped=0x0) returned 1 [0199.224] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0199.225] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.225] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.225] SetEndOfFile (hFile=0x150) returned 1 [0199.225] CloseHandle (hObject=0x150) returned 1 [0199.225] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.225] SetEndOfFile (hFile=0x114) returned 1 [0199.226] CloseHandle (hObject=0x114) returned 1 [0199.226] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2006) returned 1 [0199.226] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\desktop.ini")) returned 1 [0199.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.227] lstrlenW (lpString=".doc") returned 4 [0199.227] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.227] lstrlenW (lpString=".docx") returned 5 [0199.227] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.227] lstrlenW (lpString=".pdf") returned 4 [0199.227] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.227] lstrlenW (lpString=".xls") returned 4 [0199.227] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.227] lstrlenW (lpString=".xlsx") returned 5 [0199.227] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.227] lstrlenW (lpString=".ppt") returned 4 [0199.227] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.227] lstrlenW (lpString=".zip") returned 4 [0199.227] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.227] lstrlenW (lpString=".rar") returned 4 [0199.227] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.227] lstrlenW (lpString=".bz2") returned 4 [0199.227] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.227] lstrlenW (lpString=".7z") returned 3 [0199.227] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.227] lstrlenW (lpString=".dbf") returned 4 [0199.227] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.227] lstrlenW (lpString=".1cd") returned 4 [0199.227] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.227] lstrlenW (lpString=".jpg") returned 4 [0199.227] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.228] lstrlenW (lpString=".doc") returned 4 [0199.228] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.228] lstrlenW (lpString=".docx") returned 5 [0199.228] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.228] lstrlenW (lpString=".pdf") returned 4 [0199.228] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.228] lstrlenW (lpString=".xls") returned 4 [0199.228] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.228] lstrlenW (lpString=".xlsx") returned 5 [0199.228] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.228] lstrlenW (lpString=".ppt") returned 4 [0199.228] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.228] lstrlenW (lpString=".zip") returned 4 [0199.228] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.228] lstrlenW (lpString=".rar") returned 4 [0199.228] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.228] lstrlenW (lpString=".bz2") returned 4 [0199.228] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.228] lstrlenW (lpString=".7z") returned 3 [0199.228] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.228] lstrlenW (lpString=".dbf") returned 4 [0199.228] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.228] lstrlenW (lpString=".1cd") returned 4 [0199.228] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\desktop.ini") returned 97 [0199.228] lstrlenW (lpString=".jpg") returned 4 [0199.228] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.229] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0199.229] lstrlenW (lpString="index.dat") returned 9 [0199.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.230] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=32768) returned 1 [0199.230] CloseHandle (hObject=0x114) returned 1 [0199.230] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat")) returned 0x2026 [0199.231] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.231] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.231] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.231] GetLastError () returned 0x0 [0199.231] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x8000, lpOverlapped=0x0) returned 1 [0199.233] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x8010, lpOverlapped=0x0) returned 1 [0199.235] ReadFile (in: hFile=0x114, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.235] WriteFile (in: hFile=0x150, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.235] SetEndOfFile (hFile=0x150) returned 1 [0199.235] CloseHandle (hObject=0x150) returned 1 [0199.235] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.235] SetEndOfFile (hFile=0x114) returned 1 [0199.236] CloseHandle (hObject=0x114) returned 1 [0199.236] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.236] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\index.dat")) returned 1 [0199.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.236] lstrlenW (lpString=".doc") returned 4 [0199.236] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.236] lstrlenW (lpString=".docx") returned 5 [0199.236] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0199.236] lstrlenW (lpString=".pdf") returned 4 [0199.236] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.237] lstrlenW (lpString=".xls") returned 4 [0199.237] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.237] lstrlenW (lpString=".xlsx") returned 5 [0199.237] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0199.237] lstrlenW (lpString=".ppt") returned 4 [0199.237] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.237] lstrlenW (lpString=".zip") returned 4 [0199.237] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.237] lstrlenW (lpString=".rar") returned 4 [0199.237] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.237] lstrlenW (lpString=".bz2") returned 4 [0199.237] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.237] lstrlenW (lpString=".7z") returned 3 [0199.237] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.237] lstrlenW (lpString=".dbf") returned 4 [0199.237] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.237] lstrlenW (lpString=".1cd") returned 4 [0199.237] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.237] lstrlenW (lpString=".jpg") returned 4 [0199.237] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.237] lstrlenW (lpString=".doc") returned 4 [0199.237] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.237] lstrlenW (lpString=".docx") returned 5 [0199.237] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0199.237] lstrlenW (lpString=".pdf") returned 4 [0199.237] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.237] lstrlenW (lpString=".xls") returned 4 [0199.238] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.238] lstrlenW (lpString=".xlsx") returned 5 [0199.238] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0199.238] lstrlenW (lpString=".ppt") returned 4 [0199.238] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.238] lstrlenW (lpString=".zip") returned 4 [0199.238] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.238] lstrlenW (lpString=".rar") returned 4 [0199.238] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.238] lstrlenW (lpString=".bz2") returned 4 [0199.238] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.238] lstrlenW (lpString=".7z") returned 3 [0199.238] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.238] lstrlenW (lpString=".dbf") returned 4 [0199.238] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.238] lstrlenW (lpString=".1cd") returned 4 [0199.238] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\index.dat") returned 95 [0199.238] lstrlenW (lpString=".jpg") returned 4 [0199.238] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.238] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0199.238] lstrlenW (lpString="index.dat") returned 9 [0199.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.239] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=32768) returned 1 [0199.239] CloseHandle (hObject=0x114) returned 1 [0199.239] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat")) returned 0x2026 [0199.239] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.340] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.340] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.340] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0199.341] GetLastError () returned 0x0 [0199.341] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x8000, lpOverlapped=0x0) returned 1 [0199.343] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x8010, lpOverlapped=0x0) returned 1 [0199.344] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.344] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.344] SetEndOfFile (hFile=0x358) returned 1 [0199.345] CloseHandle (hObject=0x358) returned 1 [0199.345] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.345] SetEndOfFile (hFile=0x2d8) returned 1 [0199.346] CloseHandle (hObject=0x2d8) returned 1 [0199.346] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.346] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\low\\history.ie5\\mshist012017071220170713\\index.dat")) returned 1 [0199.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.346] lstrlenW (lpString=".doc") returned 4 [0199.346] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.346] lstrlenW (lpString=".docx") returned 5 [0199.346] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0199.346] lstrlenW (lpString=".pdf") returned 4 [0199.346] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.346] lstrlenW (lpString=".xls") returned 4 [0199.346] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.346] lstrlenW (lpString=".xlsx") returned 5 [0199.346] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0199.346] lstrlenW (lpString=".ppt") returned 4 [0199.346] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.346] lstrlenW (lpString=".zip") returned 4 [0199.346] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.346] lstrlenW (lpString=".rar") returned 4 [0199.346] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.347] lstrlenW (lpString=".bz2") returned 4 [0199.347] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.347] lstrlenW (lpString=".7z") returned 3 [0199.347] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.347] lstrlenW (lpString=".dbf") returned 4 [0199.347] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.347] lstrlenW (lpString=".1cd") returned 4 [0199.347] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.347] lstrlenW (lpString=".jpg") returned 4 [0199.347] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.347] lstrlenW (lpString=".doc") returned 4 [0199.347] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.347] lstrlenW (lpString=".docx") returned 5 [0199.347] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0199.347] lstrlenW (lpString=".pdf") returned 4 [0199.347] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.347] lstrlenW (lpString=".xls") returned 4 [0199.347] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.347] lstrlenW (lpString=".xlsx") returned 5 [0199.347] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0199.347] lstrlenW (lpString=".ppt") returned 4 [0199.347] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.347] lstrlenW (lpString=".zip") returned 4 [0199.347] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.347] lstrlenW (lpString=".rar") returned 4 [0199.347] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.347] lstrlenW (lpString=".bz2") returned 4 [0199.348] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.348] lstrlenW (lpString=".7z") returned 3 [0199.348] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.348] lstrlenW (lpString=".dbf") returned 4 [0199.348] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.348] lstrlenW (lpString=".1cd") returned 4 [0199.348] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\Low\\History.IE5\\MSHist012017071220170713\\index.dat") returned 120 [0199.348] lstrlenW (lpString=".jpg") returned 4 [0199.348] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.348] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.348] lstrlenW (lpString="AA3e3XC[2].png") returned 14 [0199.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.349] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=309) returned 1 [0199.349] CloseHandle (hObject=0x2d8) returned 1 [0199.349] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png")) returned 0x2020 [0199.349] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.349] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.349] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0199.350] GetLastError () returned 0x0 [0199.350] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x135, lpOverlapped=0x0) returned 1 [0199.523] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x140, lpOverlapped=0x0) returned 1 [0199.524] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.524] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.524] SetEndOfFile (hFile=0x358) returned 1 [0199.524] CloseHandle (hObject=0x358) returned 1 [0199.525] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.525] SetEndOfFile (hFile=0x2d8) returned 1 [0199.525] CloseHandle (hObject=0x2d8) returned 1 [0199.525] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.526] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3e3xc[2].png")) returned 1 [0199.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.526] lstrlenW (lpString=".doc") returned 4 [0199.526] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.526] lstrlenW (lpString=".docx") returned 5 [0199.526] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.526] lstrlenW (lpString=".pdf") returned 4 [0199.526] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.526] lstrlenW (lpString=".xls") returned 4 [0199.526] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.526] lstrlenW (lpString=".xlsx") returned 5 [0199.526] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.526] lstrlenW (lpString=".ppt") returned 4 [0199.526] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.526] lstrlenW (lpString=".zip") returned 4 [0199.526] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.526] lstrlenW (lpString=".rar") returned 4 [0199.526] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.526] lstrlenW (lpString=".bz2") returned 4 [0199.526] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.526] lstrlenW (lpString=".7z") returned 3 [0199.526] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.527] lstrlenW (lpString=".dbf") returned 4 [0199.527] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.527] lstrlenW (lpString=".1cd") returned 4 [0199.527] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.527] lstrlenW (lpString=".jpg") returned 4 [0199.527] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.527] lstrlenW (lpString=".doc") returned 4 [0199.527] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.527] lstrlenW (lpString=".docx") returned 5 [0199.527] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.527] lstrlenW (lpString=".pdf") returned 4 [0199.527] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.527] lstrlenW (lpString=".xls") returned 4 [0199.527] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.527] lstrlenW (lpString=".xlsx") returned 5 [0199.527] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.527] lstrlenW (lpString=".ppt") returned 4 [0199.527] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.527] lstrlenW (lpString=".zip") returned 4 [0199.527] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.527] lstrlenW (lpString=".rar") returned 4 [0199.527] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.527] lstrlenW (lpString=".bz2") returned 4 [0199.527] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.527] lstrlenW (lpString=".7z") returned 3 [0199.527] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.527] lstrlenW (lpString=".dbf") returned 4 [0199.528] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.528] lstrlenW (lpString=".1cd") returned 4 [0199.528] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.528] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3e3XC[2].png") returned 126 [0199.528] lstrlenW (lpString=".jpg") returned 4 [0199.528] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.528] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.528] lstrlenW (lpString="AA54rQj[1].png") returned 14 [0199.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.528] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=401) returned 1 [0199.528] CloseHandle (hObject=0x2d8) returned 1 [0199.528] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png")) returned 0x2020 [0199.529] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.529] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.529] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0199.529] GetLastError () returned 0x0 [0199.529] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x191, lpOverlapped=0x0) returned 1 [0199.550] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1a0, lpOverlapped=0x0) returned 1 [0199.551] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.551] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.552] SetEndOfFile (hFile=0x358) returned 1 [0199.560] CloseHandle (hObject=0x358) returned 1 [0199.560] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.560] SetEndOfFile (hFile=0x2d8) returned 1 [0199.561] CloseHandle (hObject=0x2d8) returned 1 [0199.561] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.561] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa54rqj[1].png")) returned 1 [0199.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.562] lstrlenW (lpString=".doc") returned 4 [0199.562] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.562] lstrlenW (lpString=".docx") returned 5 [0199.562] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.562] lstrlenW (lpString=".pdf") returned 4 [0199.562] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.562] lstrlenW (lpString=".xls") returned 4 [0199.562] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.562] lstrlenW (lpString=".xlsx") returned 5 [0199.562] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.562] lstrlenW (lpString=".ppt") returned 4 [0199.562] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.562] lstrlenW (lpString=".zip") returned 4 [0199.562] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.562] lstrlenW (lpString=".rar") returned 4 [0199.562] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.562] lstrlenW (lpString=".bz2") returned 4 [0199.562] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.562] lstrlenW (lpString=".7z") returned 3 [0199.562] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.562] lstrlenW (lpString=".dbf") returned 4 [0199.562] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.562] lstrlenW (lpString=".1cd") returned 4 [0199.563] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.563] lstrlenW (lpString=".jpg") returned 4 [0199.563] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.563] lstrlenW (lpString=".doc") returned 4 [0199.563] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.563] lstrlenW (lpString=".docx") returned 5 [0199.563] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.563] lstrlenW (lpString=".pdf") returned 4 [0199.563] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.563] lstrlenW (lpString=".xls") returned 4 [0199.563] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.563] lstrlenW (lpString=".xlsx") returned 5 [0199.563] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.563] lstrlenW (lpString=".ppt") returned 4 [0199.563] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.563] lstrlenW (lpString=".zip") returned 4 [0199.563] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.563] lstrlenW (lpString=".rar") returned 4 [0199.563] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.563] lstrlenW (lpString=".bz2") returned 4 [0199.563] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.563] lstrlenW (lpString=".7z") returned 3 [0199.563] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.563] lstrlenW (lpString=".dbf") returned 4 [0199.563] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.563] lstrlenW (lpString=".1cd") returned 4 [0199.563] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA54rQj[1].png") returned 126 [0199.564] lstrlenW (lpString=".jpg") returned 4 [0199.564] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.564] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.564] lstrlenW (lpString="AA8uCo4[1].png") returned 14 [0199.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.565] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=712) returned 1 [0199.565] CloseHandle (hObject=0x2d8) returned 1 [0199.565] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png")) returned 0x2020 [0199.565] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.565] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.565] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0199.566] GetLastError () returned 0x0 [0199.566] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x2c8, lpOverlapped=0x0) returned 1 [0199.602] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0199.603] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.603] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.603] SetEndOfFile (hFile=0x358) returned 1 [0199.603] CloseHandle (hObject=0x358) returned 1 [0199.603] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.603] SetEndOfFile (hFile=0x2d8) returned 1 [0199.604] CloseHandle (hObject=0x2d8) returned 1 [0199.604] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.604] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa8uco4[1].png")) returned 1 [0199.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.605] lstrlenW (lpString=".doc") returned 4 [0199.605] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.605] lstrlenW (lpString=".docx") returned 5 [0199.605] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.605] lstrlenW (lpString=".pdf") returned 4 [0199.605] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.605] lstrlenW (lpString=".xls") returned 4 [0199.605] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.605] lstrlenW (lpString=".xlsx") returned 5 [0199.605] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.605] lstrlenW (lpString=".ppt") returned 4 [0199.605] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.605] lstrlenW (lpString=".zip") returned 4 [0199.605] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.605] lstrlenW (lpString=".rar") returned 4 [0199.605] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.605] lstrlenW (lpString=".bz2") returned 4 [0199.605] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.605] lstrlenW (lpString=".7z") returned 3 [0199.605] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.605] lstrlenW (lpString=".dbf") returned 4 [0199.605] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.605] lstrlenW (lpString=".1cd") returned 4 [0199.605] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.606] lstrlenW (lpString=".jpg") returned 4 [0199.606] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.606] lstrlenW (lpString=".doc") returned 4 [0199.606] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.606] lstrlenW (lpString=".docx") returned 5 [0199.606] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.606] lstrlenW (lpString=".pdf") returned 4 [0199.606] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.606] lstrlenW (lpString=".xls") returned 4 [0199.606] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.606] lstrlenW (lpString=".xlsx") returned 5 [0199.606] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.606] lstrlenW (lpString=".ppt") returned 4 [0199.606] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.606] lstrlenW (lpString=".zip") returned 4 [0199.606] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.606] lstrlenW (lpString=".rar") returned 4 [0199.606] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.606] lstrlenW (lpString=".bz2") returned 4 [0199.606] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.606] lstrlenW (lpString=".7z") returned 3 [0199.606] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.606] lstrlenW (lpString=".dbf") returned 4 [0199.606] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.606] lstrlenW (lpString=".1cd") returned 4 [0199.606] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA8uCo4[1].png") returned 126 [0199.607] lstrlenW (lpString=".jpg") returned 4 [0199.607] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.607] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0199.607] lstrlenW (lpString="advertisement.ad[1].js") returned 22 [0199.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.607] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=28) returned 1 [0199.607] CloseHandle (hObject=0x2d8) returned 1 [0199.608] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js")) returned 0x2020 [0199.608] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.608] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.608] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0199.608] GetLastError () returned 0x0 [0199.608] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1c, lpOverlapped=0x0) returned 1 [0199.611] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x20, lpOverlapped=0x0) returned 1 [0199.611] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.612] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x100, lpOverlapped=0x0) returned 1 [0199.612] SetEndOfFile (hFile=0x358) returned 1 [0199.612] CloseHandle (hObject=0x358) returned 1 [0199.612] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.612] SetEndOfFile (hFile=0x2d8) returned 1 [0199.613] CloseHandle (hObject=0x2d8) returned 1 [0199.613] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.613] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\advertisement.ad[1].js")) returned 1 [0199.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.613] lstrlenW (lpString=".doc") returned 4 [0199.613] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0199.613] lstrlenW (lpString=".docx") returned 5 [0199.613] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0199.613] lstrlenW (lpString=".pdf") returned 4 [0199.613] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0199.613] lstrlenW (lpString=".xls") returned 4 [0199.613] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0199.613] lstrlenW (lpString=".xlsx") returned 5 [0199.613] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0199.613] lstrlenW (lpString=".ppt") returned 4 [0199.613] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0199.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.614] lstrlenW (lpString=".zip") returned 4 [0199.614] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0199.614] lstrlenW (lpString=".rar") returned 4 [0199.614] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0199.614] lstrlenW (lpString=".bz2") returned 4 [0199.615] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0199.615] lstrlenW (lpString=".7z") returned 3 [0199.615] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0199.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.615] lstrlenW (lpString=".dbf") returned 4 [0199.615] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0199.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.615] lstrlenW (lpString=".1cd") returned 4 [0199.615] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0199.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.615] lstrlenW (lpString=".jpg") returned 4 [0199.615] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0199.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.615] lstrlenW (lpString=".doc") returned 4 [0199.615] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0199.615] lstrlenW (lpString=".docx") returned 5 [0199.616] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0199.616] lstrlenW (lpString=".pdf") returned 4 [0199.616] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0199.616] lstrlenW (lpString=".xls") returned 4 [0199.616] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0199.616] lstrlenW (lpString=".xlsx") returned 5 [0199.616] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0199.616] lstrlenW (lpString=".ppt") returned 4 [0199.616] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0199.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.616] lstrlenW (lpString=".zip") returned 4 [0199.616] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0199.616] lstrlenW (lpString=".rar") returned 4 [0199.616] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0199.616] lstrlenW (lpString=".bz2") returned 4 [0199.616] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0199.616] lstrlenW (lpString=".7z") returned 3 [0199.616] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0199.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.616] lstrlenW (lpString=".dbf") returned 4 [0199.616] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0199.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.616] lstrlenW (lpString=".1cd") returned 4 [0199.616] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0199.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\advertisement.ad[1].js") returned 134 [0199.616] lstrlenW (lpString=".jpg") returned 4 [0199.616] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0199.616] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.616] lstrlenW (lpString="BB1CcOi[1].png") returned 14 [0199.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.617] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=464) returned 1 [0199.617] CloseHandle (hObject=0x2d8) returned 1 [0199.617] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png")) returned 0x2020 [0199.617] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.617] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.617] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0199.618] GetLastError () returned 0x0 [0199.618] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1d0, lpOverlapped=0x0) returned 1 [0199.654] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1e0, lpOverlapped=0x0) returned 1 [0199.655] ReadFile (in: hFile=0x2d8, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.655] WriteFile (in: hFile=0x358, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.655] SetEndOfFile (hFile=0x358) returned 1 [0199.655] CloseHandle (hObject=0x358) returned 1 [0199.655] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.656] SetEndOfFile (hFile=0x2d8) returned 1 [0199.656] CloseHandle (hObject=0x2d8) returned 1 [0199.656] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.657] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb1ccoi[1].png")) returned 1 [0199.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.657] lstrlenW (lpString=".doc") returned 4 [0199.657] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.657] lstrlenW (lpString=".docx") returned 5 [0199.657] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.657] lstrlenW (lpString=".pdf") returned 4 [0199.657] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.657] lstrlenW (lpString=".xls") returned 4 [0199.657] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.657] lstrlenW (lpString=".xlsx") returned 5 [0199.657] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.657] lstrlenW (lpString=".ppt") returned 4 [0199.657] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.657] lstrlenW (lpString=".zip") returned 4 [0199.657] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.657] lstrlenW (lpString=".rar") returned 4 [0199.657] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.657] lstrlenW (lpString=".bz2") returned 4 [0199.657] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.657] lstrlenW (lpString=".7z") returned 3 [0199.657] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.657] lstrlenW (lpString=".dbf") returned 4 [0199.657] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.657] lstrlenW (lpString=".1cd") returned 4 [0199.657] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.658] lstrlenW (lpString=".jpg") returned 4 [0199.658] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.658] lstrlenW (lpString=".doc") returned 4 [0199.658] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.658] lstrlenW (lpString=".docx") returned 5 [0199.658] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.658] lstrlenW (lpString=".pdf") returned 4 [0199.658] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.658] lstrlenW (lpString=".xls") returned 4 [0199.658] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.658] lstrlenW (lpString=".xlsx") returned 5 [0199.658] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.658] lstrlenW (lpString=".ppt") returned 4 [0199.658] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.658] lstrlenW (lpString=".zip") returned 4 [0199.658] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.658] lstrlenW (lpString=".rar") returned 4 [0199.658] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.658] lstrlenW (lpString=".bz2") returned 4 [0199.658] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.658] lstrlenW (lpString=".7z") returned 3 [0199.658] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.658] lstrlenW (lpString=".dbf") returned 4 [0199.658] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.658] lstrlenW (lpString=".1cd") returned 4 [0199.658] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB1CcOi[1].png") returned 126 [0199.659] lstrlenW (lpString=".jpg") returned 4 [0199.659] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.659] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.659] lstrlenW (lpString="BB46JmN[1].png") returned 14 [0199.659] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0200.172] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=784) returned 1 [0200.174] CloseHandle (hObject=0x350) returned 1 [0200.174] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png")) returned 0x2020 [0200.174] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.430] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.430] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.613] GetLastError () returned 0x0 [0200.613] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x310, lpOverlapped=0x0) returned 1 [0200.614] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x320, lpOverlapped=0x0) returned 1 [0200.615] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.615] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.615] SetEndOfFile (hFile=0x154) returned 1 [0200.616] CloseHandle (hObject=0x154) returned 1 [0200.616] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.616] SetEndOfFile (hFile=0x370) returned 1 [0200.616] CloseHandle (hObject=0x370) returned 1 [0200.616] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.617] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb46jmn[1].png")) returned 1 [0200.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.617] lstrlenW (lpString=".doc") returned 4 [0200.617] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0200.617] lstrlenW (lpString=".docx") returned 5 [0200.617] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0200.617] lstrlenW (lpString=".pdf") returned 4 [0200.617] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0200.617] lstrlenW (lpString=".xls") returned 4 [0200.617] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0200.617] lstrlenW (lpString=".xlsx") returned 5 [0200.617] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0200.617] lstrlenW (lpString=".ppt") returned 4 [0200.617] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0200.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.617] lstrlenW (lpString=".zip") returned 4 [0200.617] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0200.617] lstrlenW (lpString=".rar") returned 4 [0200.617] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0200.617] lstrlenW (lpString=".bz2") returned 4 [0200.617] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0200.617] lstrlenW (lpString=".7z") returned 3 [0200.617] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0200.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.618] lstrlenW (lpString=".dbf") returned 4 [0200.618] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0200.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.618] lstrlenW (lpString=".1cd") returned 4 [0200.618] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0200.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.618] lstrlenW (lpString=".jpg") returned 4 [0200.618] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0200.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.618] lstrlenW (lpString=".doc") returned 4 [0200.618] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0200.618] lstrlenW (lpString=".docx") returned 5 [0200.618] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0200.618] lstrlenW (lpString=".pdf") returned 4 [0200.618] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0200.618] lstrlenW (lpString=".xls") returned 4 [0200.618] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0200.618] lstrlenW (lpString=".xlsx") returned 5 [0200.618] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0200.618] lstrlenW (lpString=".ppt") returned 4 [0200.618] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0200.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.618] lstrlenW (lpString=".zip") returned 4 [0200.618] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0200.618] lstrlenW (lpString=".rar") returned 4 [0200.618] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0200.618] lstrlenW (lpString=".bz2") returned 4 [0200.618] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0200.618] lstrlenW (lpString=".7z") returned 3 [0200.618] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0200.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.618] lstrlenW (lpString=".dbf") returned 4 [0200.618] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0200.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.619] lstrlenW (lpString=".1cd") returned 4 [0200.619] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0200.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB46JmN[1].png") returned 126 [0200.619] lstrlenW (lpString=".jpg") returned 4 [0200.619] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0200.619] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.619] lstrlenW (lpString="BBBsqNL[1].jpg") returned 14 [0200.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.620] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=5846) returned 1 [0200.620] CloseHandle (hObject=0x370) returned 1 [0200.621] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg")) returned 0x2020 [0200.621] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.621] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.621] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.621] GetLastError () returned 0x0 [0200.621] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x16d6, lpOverlapped=0x0) returned 1 [0200.623] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0200.624] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.624] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.624] SetEndOfFile (hFile=0x154) returned 1 [0200.624] CloseHandle (hObject=0x154) returned 1 [0200.624] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.624] SetEndOfFile (hFile=0x370) returned 1 [0200.625] CloseHandle (hObject=0x370) returned 1 [0200.625] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.625] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsqnl[1].jpg")) returned 1 [0200.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.625] lstrlenW (lpString=".doc") returned 4 [0200.625] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.625] lstrlenW (lpString=".docx") returned 5 [0200.626] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.626] lstrlenW (lpString=".pdf") returned 4 [0200.626] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.626] lstrlenW (lpString=".xls") returned 4 [0200.626] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.626] lstrlenW (lpString=".xlsx") returned 5 [0200.626] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.626] lstrlenW (lpString=".ppt") returned 4 [0200.626] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.626] lstrlenW (lpString=".zip") returned 4 [0200.626] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.626] lstrlenW (lpString=".rar") returned 4 [0200.626] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.626] lstrlenW (lpString=".bz2") returned 4 [0200.626] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.626] lstrlenW (lpString=".7z") returned 3 [0200.626] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.626] lstrlenW (lpString=".dbf") returned 4 [0200.626] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.626] lstrlenW (lpString=".1cd") returned 4 [0200.626] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.626] lstrlenW (lpString=".jpg") returned 4 [0200.626] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.626] lstrlenW (lpString=".doc") returned 4 [0200.626] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.626] lstrlenW (lpString=".docx") returned 5 [0200.626] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.626] lstrlenW (lpString=".pdf") returned 4 [0200.627] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.627] lstrlenW (lpString=".xls") returned 4 [0200.627] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.627] lstrlenW (lpString=".xlsx") returned 5 [0200.627] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.627] lstrlenW (lpString=".ppt") returned 4 [0200.627] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.627] lstrlenW (lpString=".zip") returned 4 [0200.627] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.627] lstrlenW (lpString=".rar") returned 4 [0200.627] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.627] lstrlenW (lpString=".bz2") returned 4 [0200.627] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.627] lstrlenW (lpString=".7z") returned 3 [0200.627] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.627] lstrlenW (lpString=".dbf") returned 4 [0200.627] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.627] lstrlenW (lpString=".1cd") returned 4 [0200.627] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBsqNL[1].jpg") returned 126 [0200.627] lstrlenW (lpString=".jpg") returned 4 [0200.627] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.627] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.627] lstrlenW (lpString="BBBTpvW[1].jpg") returned 14 [0200.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.629] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1966) returned 1 [0200.629] CloseHandle (hObject=0x370) returned 1 [0200.629] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg")) returned 0x2020 [0200.629] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.629] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.629] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.630] GetLastError () returned 0x0 [0200.630] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x7ae, lpOverlapped=0x0) returned 1 [0200.631] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x7b0, lpOverlapped=0x0) returned 1 [0200.632] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.632] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.632] SetEndOfFile (hFile=0x154) returned 1 [0200.632] CloseHandle (hObject=0x154) returned 1 [0200.633] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.633] SetEndOfFile (hFile=0x370) returned 1 [0200.633] CloseHandle (hObject=0x370) returned 1 [0200.633] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.636] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbtpvw[1].jpg")) returned 1 [0200.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.637] lstrlenW (lpString=".doc") returned 4 [0200.637] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.637] lstrlenW (lpString=".docx") returned 5 [0200.637] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.637] lstrlenW (lpString=".pdf") returned 4 [0200.637] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.637] lstrlenW (lpString=".xls") returned 4 [0200.637] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.637] lstrlenW (lpString=".xlsx") returned 5 [0200.637] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.637] lstrlenW (lpString=".ppt") returned 4 [0200.637] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.637] lstrlenW (lpString=".zip") returned 4 [0200.637] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.637] lstrlenW (lpString=".rar") returned 4 [0200.637] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.637] lstrlenW (lpString=".bz2") returned 4 [0200.637] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.637] lstrlenW (lpString=".7z") returned 3 [0200.637] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.637] lstrlenW (lpString=".dbf") returned 4 [0200.637] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.637] lstrlenW (lpString=".1cd") returned 4 [0200.637] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.637] lstrlenW (lpString=".jpg") returned 4 [0200.637] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.638] lstrlenW (lpString=".doc") returned 4 [0200.638] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.638] lstrlenW (lpString=".docx") returned 5 [0200.638] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.638] lstrlenW (lpString=".pdf") returned 4 [0200.638] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.638] lstrlenW (lpString=".xls") returned 4 [0200.638] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.638] lstrlenW (lpString=".xlsx") returned 5 [0200.638] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.638] lstrlenW (lpString=".ppt") returned 4 [0200.638] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.638] lstrlenW (lpString=".zip") returned 4 [0200.638] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.638] lstrlenW (lpString=".rar") returned 4 [0200.638] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.638] lstrlenW (lpString=".bz2") returned 4 [0200.638] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.638] lstrlenW (lpString=".7z") returned 3 [0200.638] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.638] lstrlenW (lpString=".dbf") returned 4 [0200.638] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.638] lstrlenW (lpString=".1cd") returned 4 [0200.638] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBTpvW[1].jpg") returned 126 [0200.638] lstrlenW (lpString=".jpg") returned 4 [0200.638] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.639] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.639] lstrlenW (lpString="BBBVEOW[1].jpg") returned 14 [0200.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.639] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2420) returned 1 [0200.639] CloseHandle (hObject=0x370) returned 1 [0200.639] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg")) returned 0x2020 [0200.639] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.639] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.639] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.640] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.640] GetLastError () returned 0x0 [0200.640] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x974, lpOverlapped=0x0) returned 1 [0200.641] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x980, lpOverlapped=0x0) returned 1 [0200.642] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.642] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.643] SetEndOfFile (hFile=0x154) returned 1 [0200.643] CloseHandle (hObject=0x154) returned 1 [0200.643] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.643] SetEndOfFile (hFile=0x370) returned 1 [0200.644] CloseHandle (hObject=0x370) returned 1 [0200.644] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.644] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbveow[1].jpg")) returned 1 [0200.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.644] lstrlenW (lpString=".doc") returned 4 [0200.644] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.644] lstrlenW (lpString=".docx") returned 5 [0200.644] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.644] lstrlenW (lpString=".pdf") returned 4 [0200.644] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.644] lstrlenW (lpString=".xls") returned 4 [0200.644] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.644] lstrlenW (lpString=".xlsx") returned 5 [0200.644] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.644] lstrlenW (lpString=".ppt") returned 4 [0200.645] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.645] lstrlenW (lpString=".zip") returned 4 [0200.645] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.645] lstrlenW (lpString=".rar") returned 4 [0200.645] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.645] lstrlenW (lpString=".bz2") returned 4 [0200.645] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.645] lstrlenW (lpString=".7z") returned 3 [0200.645] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.645] lstrlenW (lpString=".dbf") returned 4 [0200.645] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.645] lstrlenW (lpString=".1cd") returned 4 [0200.645] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.645] lstrlenW (lpString=".jpg") returned 4 [0200.645] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.645] lstrlenW (lpString=".doc") returned 4 [0200.645] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.645] lstrlenW (lpString=".docx") returned 5 [0200.645] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.645] lstrlenW (lpString=".pdf") returned 4 [0200.645] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.645] lstrlenW (lpString=".xls") returned 4 [0200.645] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.645] lstrlenW (lpString=".xlsx") returned 5 [0200.645] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.645] lstrlenW (lpString=".ppt") returned 4 [0200.645] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.646] lstrlenW (lpString=".zip") returned 4 [0200.646] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.646] lstrlenW (lpString=".rar") returned 4 [0200.646] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.646] lstrlenW (lpString=".bz2") returned 4 [0200.646] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.646] lstrlenW (lpString=".7z") returned 3 [0200.646] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.646] lstrlenW (lpString=".dbf") returned 4 [0200.646] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.646] lstrlenW (lpString=".1cd") returned 4 [0200.646] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVEOW[1].jpg") returned 126 [0200.646] lstrlenW (lpString=".jpg") returned 4 [0200.646] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.646] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.646] lstrlenW (lpString="BBBVGsM[1].jpg") returned 14 [0200.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.647] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=7783) returned 1 [0200.647] CloseHandle (hObject=0x370) returned 1 [0200.647] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg")) returned 0x2020 [0200.647] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.647] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.647] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.648] GetLastError () returned 0x0 [0200.648] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1e67, lpOverlapped=0x0) returned 1 [0200.814] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1e70, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1e70, lpOverlapped=0x0) returned 1 [0200.814] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.815] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.815] SetEndOfFile (hFile=0x154) returned 1 [0201.144] CloseHandle (hObject=0x154) returned 1 [0201.144] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.144] SetEndOfFile (hFile=0x370) returned 1 [0201.145] CloseHandle (hObject=0x370) returned 1 [0201.151] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.153] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvgsm[1].jpg")) returned 1 [0201.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.161] lstrlenW (lpString=".doc") returned 4 [0201.161] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.161] lstrlenW (lpString=".docx") returned 5 [0201.161] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.161] lstrlenW (lpString=".pdf") returned 4 [0201.168] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.168] lstrlenW (lpString=".xls") returned 4 [0201.168] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.168] lstrlenW (lpString=".xlsx") returned 5 [0201.168] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.168] lstrlenW (lpString=".ppt") returned 4 [0201.168] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.176] lstrlenW (lpString=".zip") returned 4 [0201.176] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.176] lstrlenW (lpString=".rar") returned 4 [0201.176] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.176] lstrlenW (lpString=".bz2") returned 4 [0201.176] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.176] lstrlenW (lpString=".7z") returned 3 [0201.176] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.185] lstrlenW (lpString=".dbf") returned 4 [0201.185] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.185] lstrlenW (lpString=".1cd") returned 4 [0201.185] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.185] lstrlenW (lpString=".jpg") returned 4 [0201.185] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.185] lstrlenW (lpString=".doc") returned 4 [0201.185] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.185] lstrlenW (lpString=".docx") returned 5 [0201.185] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.185] lstrlenW (lpString=".pdf") returned 4 [0201.185] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.186] lstrlenW (lpString=".xls") returned 4 [0201.186] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.186] lstrlenW (lpString=".xlsx") returned 5 [0201.186] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.186] lstrlenW (lpString=".ppt") returned 4 [0201.186] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.186] lstrlenW (lpString=".zip") returned 4 [0201.186] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.186] lstrlenW (lpString=".rar") returned 4 [0201.186] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.186] lstrlenW (lpString=".bz2") returned 4 [0201.186] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.186] lstrlenW (lpString=".7z") returned 3 [0201.186] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.186] lstrlenW (lpString=".dbf") returned 4 [0201.186] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.186] lstrlenW (lpString=".1cd") returned 4 [0201.186] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVGsM[1].jpg") returned 126 [0201.186] lstrlenW (lpString=".jpg") returned 4 [0201.186] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.186] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.186] lstrlenW (lpString="BBC095c[1].jpg") returned 14 [0201.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0201.413] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1848) returned 1 [0201.413] CloseHandle (hObject=0x370) returned 1 [0201.424] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg")) returned 0x2020 [0201.424] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.489] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0201.505] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.505] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.505] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0201.514] GetLastError () returned 0x0 [0201.514] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x738, lpOverlapped=0x0) returned 1 [0201.515] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x740, lpOverlapped=0x0) returned 1 [0201.516] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.516] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.516] SetEndOfFile (hFile=0x114) returned 1 [0201.517] CloseHandle (hObject=0x114) returned 1 [0201.517] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.517] SetEndOfFile (hFile=0x370) returned 1 [0201.518] CloseHandle (hObject=0x370) returned 1 [0201.518] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.518] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc095c[1].jpg")) returned 1 [0201.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.518] lstrlenW (lpString=".doc") returned 4 [0201.518] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.518] lstrlenW (lpString=".docx") returned 5 [0201.518] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.518] lstrlenW (lpString=".pdf") returned 4 [0201.518] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.518] lstrlenW (lpString=".xls") returned 4 [0201.518] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.518] lstrlenW (lpString=".xlsx") returned 5 [0201.518] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.518] lstrlenW (lpString=".ppt") returned 4 [0201.518] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.518] lstrlenW (lpString=".zip") returned 4 [0201.518] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.518] lstrlenW (lpString=".rar") returned 4 [0201.519] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.519] lstrlenW (lpString=".bz2") returned 4 [0201.519] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.519] lstrlenW (lpString=".7z") returned 3 [0201.519] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.519] lstrlenW (lpString=".dbf") returned 4 [0201.519] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.519] lstrlenW (lpString=".1cd") returned 4 [0201.519] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.519] lstrlenW (lpString=".jpg") returned 4 [0201.519] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.519] lstrlenW (lpString=".doc") returned 4 [0201.519] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.519] lstrlenW (lpString=".docx") returned 5 [0201.519] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.519] lstrlenW (lpString=".pdf") returned 4 [0201.519] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.519] lstrlenW (lpString=".xls") returned 4 [0201.519] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.519] lstrlenW (lpString=".xlsx") returned 5 [0201.519] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.519] lstrlenW (lpString=".ppt") returned 4 [0201.519] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.519] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.519] lstrlenW (lpString=".zip") returned 4 [0201.519] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.519] lstrlenW (lpString=".rar") returned 4 [0201.519] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.520] lstrlenW (lpString=".bz2") returned 4 [0201.520] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.520] lstrlenW (lpString=".7z") returned 3 [0201.520] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.520] lstrlenW (lpString=".dbf") returned 4 [0201.520] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.520] lstrlenW (lpString=".1cd") returned 4 [0201.520] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.520] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC095c[1].jpg") returned 126 [0201.520] lstrlenW (lpString=".jpg") returned 4 [0201.520] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.520] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.520] lstrlenW (lpString="BBC0rDa[1].jpg") returned 14 [0201.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0201.521] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=6287) returned 1 [0201.521] CloseHandle (hObject=0x370) returned 1 [0201.521] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg")) returned 0x2020 [0201.521] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0201.521] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.521] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.521] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0201.521] GetLastError () returned 0x0 [0201.521] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x188f, lpOverlapped=0x0) returned 1 [0201.523] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1890, lpOverlapped=0x0) returned 1 [0201.524] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.524] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.524] SetEndOfFile (hFile=0x114) returned 1 [0201.524] CloseHandle (hObject=0x114) returned 1 [0201.524] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.524] SetEndOfFile (hFile=0x370) returned 1 [0201.525] CloseHandle (hObject=0x370) returned 1 [0201.525] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.525] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[1].jpg")) returned 1 [0201.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.526] lstrlenW (lpString=".doc") returned 4 [0201.526] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.526] lstrlenW (lpString=".docx") returned 5 [0201.526] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.526] lstrlenW (lpString=".pdf") returned 4 [0201.526] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.526] lstrlenW (lpString=".xls") returned 4 [0201.526] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.526] lstrlenW (lpString=".xlsx") returned 5 [0201.526] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.526] lstrlenW (lpString=".ppt") returned 4 [0201.526] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.526] lstrlenW (lpString=".zip") returned 4 [0201.526] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.526] lstrlenW (lpString=".rar") returned 4 [0201.526] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.526] lstrlenW (lpString=".bz2") returned 4 [0201.526] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.526] lstrlenW (lpString=".7z") returned 3 [0201.526] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.526] lstrlenW (lpString=".dbf") returned 4 [0201.526] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.526] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.526] lstrlenW (lpString=".1cd") returned 4 [0201.526] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.527] lstrlenW (lpString=".jpg") returned 4 [0201.527] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.527] lstrlenW (lpString=".doc") returned 4 [0201.527] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.527] lstrlenW (lpString=".docx") returned 5 [0201.527] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.527] lstrlenW (lpString=".pdf") returned 4 [0201.527] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.527] lstrlenW (lpString=".xls") returned 4 [0201.527] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.527] lstrlenW (lpString=".xlsx") returned 5 [0201.527] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.527] lstrlenW (lpString=".ppt") returned 4 [0201.527] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.527] lstrlenW (lpString=".zip") returned 4 [0201.527] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.527] lstrlenW (lpString=".rar") returned 4 [0201.527] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.527] lstrlenW (lpString=".bz2") returned 4 [0201.527] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.527] lstrlenW (lpString=".7z") returned 3 [0201.527] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.527] lstrlenW (lpString=".dbf") returned 4 [0201.527] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.527] lstrlenW (lpString=".1cd") returned 4 [0201.527] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.527] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[1].jpg") returned 126 [0201.527] lstrlenW (lpString=".jpg") returned 4 [0201.528] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.528] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.528] lstrlenW (lpString="BBC0rDa[2].jpg") returned 14 [0201.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0201.528] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2046) returned 1 [0201.528] CloseHandle (hObject=0x370) returned 1 [0201.528] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg")) returned 0x2020 [0201.528] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0201.529] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.529] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0201.529] GetLastError () returned 0x0 [0201.529] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x7fe, lpOverlapped=0x0) returned 1 [0201.531] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x800, lpOverlapped=0x0) returned 1 [0201.532] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.532] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.532] SetEndOfFile (hFile=0x114) returned 1 [0201.532] CloseHandle (hObject=0x114) returned 1 [0201.532] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.532] SetEndOfFile (hFile=0x370) returned 1 [0201.533] CloseHandle (hObject=0x370) returned 1 [0201.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.533] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0rda[2].jpg")) returned 1 [0201.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.533] lstrlenW (lpString=".doc") returned 4 [0201.533] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.533] lstrlenW (lpString=".docx") returned 5 [0201.533] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.533] lstrlenW (lpString=".pdf") returned 4 [0201.533] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.533] lstrlenW (lpString=".xls") returned 4 [0201.533] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.533] lstrlenW (lpString=".xlsx") returned 5 [0201.533] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.533] lstrlenW (lpString=".ppt") returned 4 [0201.533] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.534] lstrlenW (lpString=".zip") returned 4 [0201.534] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.534] lstrlenW (lpString=".rar") returned 4 [0201.534] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.534] lstrlenW (lpString=".bz2") returned 4 [0201.534] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.534] lstrlenW (lpString=".7z") returned 3 [0201.534] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.534] lstrlenW (lpString=".dbf") returned 4 [0201.534] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.534] lstrlenW (lpString=".1cd") returned 4 [0201.534] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.534] lstrlenW (lpString=".jpg") returned 4 [0201.534] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.534] lstrlenW (lpString=".doc") returned 4 [0201.534] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.534] lstrlenW (lpString=".docx") returned 5 [0201.534] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.534] lstrlenW (lpString=".pdf") returned 4 [0201.534] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.534] lstrlenW (lpString=".xls") returned 4 [0201.534] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.534] lstrlenW (lpString=".xlsx") returned 5 [0201.534] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.534] lstrlenW (lpString=".ppt") returned 4 [0201.534] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.535] lstrlenW (lpString=".zip") returned 4 [0201.535] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.535] lstrlenW (lpString=".rar") returned 4 [0201.535] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.535] lstrlenW (lpString=".bz2") returned 4 [0201.535] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.535] lstrlenW (lpString=".7z") returned 3 [0201.535] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.535] lstrlenW (lpString=".dbf") returned 4 [0201.535] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.535] lstrlenW (lpString=".1cd") returned 4 [0201.535] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0rDa[2].jpg") returned 126 [0201.535] lstrlenW (lpString=".jpg") returned 4 [0201.535] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.535] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.535] lstrlenW (lpString="BBC0tCi[1].jpg") returned 14 [0201.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0201.536] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=12813) returned 1 [0201.536] CloseHandle (hObject=0x370) returned 1 [0201.536] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg")) returned 0x2020 [0201.536] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0201.537] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.537] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0201.537] GetLastError () returned 0x0 [0201.537] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x320d, lpOverlapped=0x0) returned 1 [0201.539] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x3210, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x3210, lpOverlapped=0x0) returned 1 [0201.540] ReadFile (in: hFile=0x370, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.540] WriteFile (in: hFile=0x114, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.540] SetEndOfFile (hFile=0x114) returned 1 [0201.540] CloseHandle (hObject=0x114) returned 1 [0201.540] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.540] SetEndOfFile (hFile=0x370) returned 1 [0201.541] CloseHandle (hObject=0x370) returned 1 [0201.541] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.541] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0tci[1].jpg")) returned 1 [0201.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.542] lstrlenW (lpString=".doc") returned 4 [0201.542] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.542] lstrlenW (lpString=".docx") returned 5 [0201.542] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.542] lstrlenW (lpString=".pdf") returned 4 [0201.542] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.542] lstrlenW (lpString=".xls") returned 4 [0201.542] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.542] lstrlenW (lpString=".xlsx") returned 5 [0201.542] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.542] lstrlenW (lpString=".ppt") returned 4 [0201.542] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.542] lstrlenW (lpString=".zip") returned 4 [0201.542] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.542] lstrlenW (lpString=".rar") returned 4 [0201.542] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.542] lstrlenW (lpString=".bz2") returned 4 [0201.542] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.542] lstrlenW (lpString=".7z") returned 3 [0201.542] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.542] lstrlenW (lpString=".dbf") returned 4 [0201.542] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.542] lstrlenW (lpString=".1cd") returned 4 [0201.542] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.542] lstrlenW (lpString=".jpg") returned 4 [0201.542] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.543] lstrlenW (lpString=".doc") returned 4 [0201.543] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.543] lstrlenW (lpString=".docx") returned 5 [0201.543] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.543] lstrlenW (lpString=".pdf") returned 4 [0201.543] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.543] lstrlenW (lpString=".xls") returned 4 [0201.543] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.543] lstrlenW (lpString=".xlsx") returned 5 [0201.543] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.543] lstrlenW (lpString=".ppt") returned 4 [0201.543] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.543] lstrlenW (lpString=".zip") returned 4 [0201.543] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.543] lstrlenW (lpString=".rar") returned 4 [0201.543] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.543] lstrlenW (lpString=".bz2") returned 4 [0201.543] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.543] lstrlenW (lpString=".7z") returned 3 [0201.543] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.543] lstrlenW (lpString=".dbf") returned 4 [0201.543] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.543] lstrlenW (lpString=".1cd") returned 4 [0201.543] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0tCi[1].jpg") returned 126 [0201.543] lstrlenW (lpString=".jpg") returned 4 [0201.543] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.544] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.544] lstrlenW (lpString="BBDK7Yy[1].jpg") returned 14 [0201.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.837] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=10482) returned 1 [0201.837] CloseHandle (hObject=0x354) returned 1 [0201.837] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg")) returned 0x2020 [0201.837] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.837] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.837] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0201.838] GetLastError () returned 0x0 [0201.838] ReadFile (in: hFile=0x354, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x28f2, lpOverlapped=0x0) returned 1 [0201.840] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2900, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2900, lpOverlapped=0x0) returned 1 [0201.841] ReadFile (in: hFile=0x354, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.841] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.842] SetEndOfFile (hFile=0x154) returned 1 [0201.842] CloseHandle (hObject=0x154) returned 1 [0201.842] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.842] SetEndOfFile (hFile=0x354) returned 1 [0201.843] CloseHandle (hObject=0x354) returned 1 [0201.843] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.843] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdk7yy[1].jpg")) returned 1 [0201.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.843] lstrlenW (lpString=".doc") returned 4 [0201.843] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.843] lstrlenW (lpString=".docx") returned 5 [0201.843] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.843] lstrlenW (lpString=".pdf") returned 4 [0201.843] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.843] lstrlenW (lpString=".xls") returned 4 [0201.843] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.843] lstrlenW (lpString=".xlsx") returned 5 [0201.843] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.843] lstrlenW (lpString=".ppt") returned 4 [0201.843] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.843] lstrlenW (lpString=".zip") returned 4 [0201.843] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.844] lstrlenW (lpString=".rar") returned 4 [0201.844] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.844] lstrlenW (lpString=".bz2") returned 4 [0201.844] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.844] lstrlenW (lpString=".7z") returned 3 [0201.844] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.844] lstrlenW (lpString=".dbf") returned 4 [0201.844] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.844] lstrlenW (lpString=".1cd") returned 4 [0201.844] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.844] lstrlenW (lpString=".jpg") returned 4 [0201.844] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.844] lstrlenW (lpString=".doc") returned 4 [0201.844] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.844] lstrlenW (lpString=".docx") returned 5 [0201.844] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.844] lstrlenW (lpString=".pdf") returned 4 [0201.844] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.844] lstrlenW (lpString=".xls") returned 4 [0201.844] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.844] lstrlenW (lpString=".xlsx") returned 5 [0201.844] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.844] lstrlenW (lpString=".ppt") returned 4 [0201.844] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.844] lstrlenW (lpString=".zip") returned 4 [0201.844] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.845] lstrlenW (lpString=".rar") returned 4 [0201.845] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.845] lstrlenW (lpString=".bz2") returned 4 [0201.845] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.845] lstrlenW (lpString=".7z") returned 3 [0201.845] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.845] lstrlenW (lpString=".dbf") returned 4 [0201.845] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.845] lstrlenW (lpString=".1cd") returned 4 [0201.845] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDK7Yy[1].jpg") returned 126 [0201.845] lstrlenW (lpString=".jpg") returned 4 [0201.845] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.845] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.845] lstrlenW (lpString="BBDRbsH[1].jpg") returned 14 [0201.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.846] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2108) returned 1 [0201.846] CloseHandle (hObject=0x354) returned 1 [0201.846] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg")) returned 0x2020 [0201.846] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.847] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.847] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0201.847] GetLastError () returned 0x0 [0201.847] ReadFile (in: hFile=0x354, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x83c, lpOverlapped=0x0) returned 1 [0201.849] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x840, lpOverlapped=0x0) returned 1 [0201.850] ReadFile (in: hFile=0x354, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.850] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.850] SetEndOfFile (hFile=0x154) returned 1 [0201.850] CloseHandle (hObject=0x154) returned 1 [0201.850] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.850] SetEndOfFile (hFile=0x354) returned 1 [0201.851] CloseHandle (hObject=0x354) returned 1 [0201.851] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.851] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdrbsh[1].jpg")) returned 1 [0201.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.851] lstrlenW (lpString=".doc") returned 4 [0201.851] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.851] lstrlenW (lpString=".docx") returned 5 [0201.851] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.851] lstrlenW (lpString=".pdf") returned 4 [0201.851] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.851] lstrlenW (lpString=".xls") returned 4 [0201.851] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.851] lstrlenW (lpString=".xlsx") returned 5 [0201.851] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.852] lstrlenW (lpString=".ppt") returned 4 [0201.852] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.852] lstrlenW (lpString=".zip") returned 4 [0201.852] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.852] lstrlenW (lpString=".rar") returned 4 [0201.852] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.852] lstrlenW (lpString=".bz2") returned 4 [0201.852] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.852] lstrlenW (lpString=".7z") returned 3 [0201.852] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.852] lstrlenW (lpString=".dbf") returned 4 [0201.852] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.852] lstrlenW (lpString=".1cd") returned 4 [0201.852] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.852] lstrlenW (lpString=".jpg") returned 4 [0201.852] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.852] lstrlenW (lpString=".doc") returned 4 [0201.852] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.852] lstrlenW (lpString=".docx") returned 5 [0201.852] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.852] lstrlenW (lpString=".pdf") returned 4 [0201.852] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.852] lstrlenW (lpString=".xls") returned 4 [0201.852] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.852] lstrlenW (lpString=".xlsx") returned 5 [0201.852] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.852] lstrlenW (lpString=".ppt") returned 4 [0201.853] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.853] lstrlenW (lpString=".zip") returned 4 [0201.853] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.853] lstrlenW (lpString=".rar") returned 4 [0201.853] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.853] lstrlenW (lpString=".bz2") returned 4 [0201.853] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.853] lstrlenW (lpString=".7z") returned 3 [0201.853] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.853] lstrlenW (lpString=".dbf") returned 4 [0201.853] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.853] lstrlenW (lpString=".1cd") returned 4 [0201.853] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDRbsH[1].jpg") returned 126 [0201.853] lstrlenW (lpString=".jpg") returned 4 [0201.853] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.853] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.853] lstrlenW (lpString="BBDZoZR[1].jpg") returned 14 [0201.853] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.854] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2408) returned 1 [0201.854] CloseHandle (hObject=0x354) returned 1 [0201.854] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg")) returned 0x2020 [0201.854] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.855] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.855] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0201.855] GetLastError () returned 0x0 [0201.855] ReadFile (in: hFile=0x354, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x968, lpOverlapped=0x0) returned 1 [0201.857] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x970, lpOverlapped=0x0) returned 1 [0201.857] ReadFile (in: hFile=0x354, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.858] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.858] SetEndOfFile (hFile=0x154) returned 1 [0201.858] CloseHandle (hObject=0x154) returned 1 [0201.858] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.858] SetEndOfFile (hFile=0x354) returned 1 [0201.859] CloseHandle (hObject=0x354) returned 1 [0201.859] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.859] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbdzozr[1].jpg")) returned 1 [0201.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.859] lstrlenW (lpString=".doc") returned 4 [0201.859] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.859] lstrlenW (lpString=".docx") returned 5 [0201.859] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.859] lstrlenW (lpString=".pdf") returned 4 [0201.859] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.859] lstrlenW (lpString=".xls") returned 4 [0201.859] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.859] lstrlenW (lpString=".xlsx") returned 5 [0201.859] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.859] lstrlenW (lpString=".ppt") returned 4 [0201.859] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.859] lstrlenW (lpString=".zip") returned 4 [0201.859] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.860] lstrlenW (lpString=".rar") returned 4 [0201.860] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.860] lstrlenW (lpString=".bz2") returned 4 [0201.860] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.860] lstrlenW (lpString=".7z") returned 3 [0201.860] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.860] lstrlenW (lpString=".dbf") returned 4 [0201.860] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.860] lstrlenW (lpString=".1cd") returned 4 [0201.860] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.860] lstrlenW (lpString=".jpg") returned 4 [0201.860] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.860] lstrlenW (lpString=".doc") returned 4 [0201.860] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.860] lstrlenW (lpString=".docx") returned 5 [0201.860] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.860] lstrlenW (lpString=".pdf") returned 4 [0201.861] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.861] lstrlenW (lpString=".xls") returned 4 [0201.861] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.861] lstrlenW (lpString=".xlsx") returned 5 [0201.861] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.861] lstrlenW (lpString=".ppt") returned 4 [0201.861] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.861] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.861] lstrlenW (lpString=".zip") returned 4 [0201.861] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.861] lstrlenW (lpString=".rar") returned 4 [0201.861] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.861] lstrlenW (lpString=".bz2") returned 4 [0201.861] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.861] lstrlenW (lpString=".7z") returned 3 [0201.861] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.861] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.861] lstrlenW (lpString=".dbf") returned 4 [0201.861] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.861] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.861] lstrlenW (lpString=".1cd") returned 4 [0201.861] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.861] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBDZoZR[1].jpg") returned 126 [0201.861] lstrlenW (lpString=".jpg") returned 4 [0201.861] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.861] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.861] lstrlenW (lpString="BBE97O8[1].jpg") returned 14 [0201.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.862] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2260) returned 1 [0201.863] CloseHandle (hObject=0x354) returned 1 [0201.863] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg")) returned 0x2020 [0201.863] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.863] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.863] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.863] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0201.863] GetLastError () returned 0x0 [0201.863] ReadFile (in: hFile=0x354, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x8d4, lpOverlapped=0x0) returned 1 [0201.865] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0201.866] ReadFile (in: hFile=0x354, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.866] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.866] SetEndOfFile (hFile=0x154) returned 1 [0201.866] CloseHandle (hObject=0x154) returned 1 [0201.866] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.866] SetEndOfFile (hFile=0x354) returned 1 [0201.867] CloseHandle (hObject=0x354) returned 1 [0201.867] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.867] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe97o8[1].jpg")) returned 1 [0201.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.867] lstrlenW (lpString=".doc") returned 4 [0201.867] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.867] lstrlenW (lpString=".docx") returned 5 [0201.867] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.867] lstrlenW (lpString=".pdf") returned 4 [0201.868] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.868] lstrlenW (lpString=".xls") returned 4 [0201.868] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.868] lstrlenW (lpString=".xlsx") returned 5 [0201.868] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.868] lstrlenW (lpString=".ppt") returned 4 [0201.868] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.868] lstrlenW (lpString=".zip") returned 4 [0201.868] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.868] lstrlenW (lpString=".rar") returned 4 [0201.868] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.868] lstrlenW (lpString=".bz2") returned 4 [0201.868] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.868] lstrlenW (lpString=".7z") returned 3 [0201.868] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.868] lstrlenW (lpString=".dbf") returned 4 [0201.868] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.868] lstrlenW (lpString=".1cd") returned 4 [0201.868] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.868] lstrlenW (lpString=".jpg") returned 4 [0201.868] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.868] lstrlenW (lpString=".doc") returned 4 [0201.868] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.868] lstrlenW (lpString=".docx") returned 5 [0201.868] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.868] lstrlenW (lpString=".pdf") returned 4 [0201.868] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.868] lstrlenW (lpString=".xls") returned 4 [0201.869] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.869] lstrlenW (lpString=".xlsx") returned 5 [0201.869] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.869] lstrlenW (lpString=".ppt") returned 4 [0201.869] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.869] lstrlenW (lpString=".zip") returned 4 [0201.869] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.869] lstrlenW (lpString=".rar") returned 4 [0201.869] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.869] lstrlenW (lpString=".bz2") returned 4 [0201.869] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.869] lstrlenW (lpString=".7z") returned 3 [0201.869] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.869] lstrlenW (lpString=".dbf") returned 4 [0201.869] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.869] lstrlenW (lpString=".1cd") returned 4 [0201.869] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.869] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE97O8[1].jpg") returned 126 [0201.869] lstrlenW (lpString=".jpg") returned 4 [0201.869] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.869] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.869] lstrlenW (lpString="BBE9wSt[1].jpg") returned 14 [0201.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.870] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1760) returned 1 [0201.870] CloseHandle (hObject=0x354) returned 1 [0201.870] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg")) returned 0x2020 [0201.871] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.871] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.871] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.871] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0201.871] GetLastError () returned 0x0 [0201.871] ReadFile (in: hFile=0x354, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x6e0, lpOverlapped=0x0) returned 1 [0201.984] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x6f0, lpOverlapped=0x0) returned 1 [0201.985] ReadFile (in: hFile=0x354, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.985] WriteFile (in: hFile=0x154, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.985] SetEndOfFile (hFile=0x154) returned 1 [0202.125] CloseHandle (hObject=0x154) returned 1 [0202.125] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.125] SetEndOfFile (hFile=0x354) returned 1 [0202.136] CloseHandle (hObject=0x354) returned 1 [0202.136] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.145] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbe9wst[1].jpg")) returned 1 [0202.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.151] lstrlenW (lpString=".doc") returned 4 [0202.151] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.151] lstrlenW (lpString=".docx") returned 5 [0202.151] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.151] lstrlenW (lpString=".pdf") returned 4 [0202.151] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.151] lstrlenW (lpString=".xls") returned 4 [0202.151] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.151] lstrlenW (lpString=".xlsx") returned 5 [0202.151] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.151] lstrlenW (lpString=".ppt") returned 4 [0202.151] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.151] lstrlenW (lpString=".zip") returned 4 [0202.151] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.151] lstrlenW (lpString=".rar") returned 4 [0202.151] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.151] lstrlenW (lpString=".bz2") returned 4 [0202.151] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.151] lstrlenW (lpString=".7z") returned 3 [0202.151] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.152] lstrlenW (lpString=".dbf") returned 4 [0202.152] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.152] lstrlenW (lpString=".1cd") returned 4 [0202.152] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.152] lstrlenW (lpString=".jpg") returned 4 [0202.152] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.152] lstrlenW (lpString=".doc") returned 4 [0202.152] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.152] lstrlenW (lpString=".docx") returned 5 [0202.152] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.152] lstrlenW (lpString=".pdf") returned 4 [0202.152] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.152] lstrlenW (lpString=".xls") returned 4 [0202.152] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.152] lstrlenW (lpString=".xlsx") returned 5 [0202.152] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.152] lstrlenW (lpString=".ppt") returned 4 [0202.152] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.152] lstrlenW (lpString=".zip") returned 4 [0202.152] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.152] lstrlenW (lpString=".rar") returned 4 [0202.152] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.152] lstrlenW (lpString=".bz2") returned 4 [0202.152] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.152] lstrlenW (lpString=".7z") returned 3 [0202.152] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.152] lstrlenW (lpString=".dbf") returned 4 [0202.153] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.153] lstrlenW (lpString=".1cd") returned 4 [0202.153] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBE9wSt[1].jpg") returned 126 [0202.153] lstrlenW (lpString=".jpg") returned 4 [0202.153] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.153] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.153] lstrlenW (lpString="BBEdtWw[1].jpg") returned 14 [0202.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0202.536] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1744) returned 1 [0202.536] CloseHandle (hObject=0x378) returned 1 [0202.536] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg")) returned 0x2020 [0202.536] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0202.537] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.537] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.537] GetLastError () returned 0x0 [0202.537] ReadFile (in: hFile=0x378, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x6d0, lpOverlapped=0x0) returned 1 [0202.539] WriteFile (in: hFile=0x2d4, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x6e0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x6e0, lpOverlapped=0x0) returned 1 [0202.540] ReadFile (in: hFile=0x378, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.540] WriteFile (in: hFile=0x2d4, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.540] SetEndOfFile (hFile=0x2d4) returned 1 [0202.541] CloseHandle (hObject=0x2d4) returned 1 [0202.541] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.541] SetEndOfFile (hFile=0x378) returned 1 [0202.541] CloseHandle (hObject=0x378) returned 1 [0202.541] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.542] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedtww[1].jpg")) returned 1 [0202.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.542] lstrlenW (lpString=".doc") returned 4 [0202.542] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.542] lstrlenW (lpString=".docx") returned 5 [0202.542] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.542] lstrlenW (lpString=".pdf") returned 4 [0202.542] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.542] lstrlenW (lpString=".xls") returned 4 [0202.542] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.542] lstrlenW (lpString=".xlsx") returned 5 [0202.542] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.542] lstrlenW (lpString=".ppt") returned 4 [0202.542] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.542] lstrlenW (lpString=".zip") returned 4 [0202.542] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.542] lstrlenW (lpString=".rar") returned 4 [0202.542] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.542] lstrlenW (lpString=".bz2") returned 4 [0202.542] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.542] lstrlenW (lpString=".7z") returned 3 [0202.543] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.543] lstrlenW (lpString=".dbf") returned 4 [0202.543] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.543] lstrlenW (lpString=".1cd") returned 4 [0202.543] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.543] lstrlenW (lpString=".jpg") returned 4 [0202.543] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.543] lstrlenW (lpString=".doc") returned 4 [0202.543] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.543] lstrlenW (lpString=".docx") returned 5 [0202.543] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.543] lstrlenW (lpString=".pdf") returned 4 [0202.543] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.543] lstrlenW (lpString=".xls") returned 4 [0202.543] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.543] lstrlenW (lpString=".xlsx") returned 5 [0202.543] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.543] lstrlenW (lpString=".ppt") returned 4 [0202.543] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.543] lstrlenW (lpString=".zip") returned 4 [0202.543] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.543] lstrlenW (lpString=".rar") returned 4 [0202.543] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.543] lstrlenW (lpString=".bz2") returned 4 [0202.543] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.543] lstrlenW (lpString=".7z") returned 3 [0202.543] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.543] lstrlenW (lpString=".dbf") returned 4 [0202.544] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.544] lstrlenW (lpString=".1cd") returned 4 [0202.544] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdtWw[1].jpg") returned 126 [0202.544] lstrlenW (lpString=".jpg") returned 4 [0202.544] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.544] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.544] lstrlenW (lpString="BBEg9QV[1].jpg") returned 14 [0202.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0202.545] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=7950) returned 1 [0202.545] CloseHandle (hObject=0x378) returned 1 [0202.545] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg")) returned 0x2020 [0202.545] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0202.545] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.545] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.546] GetLastError () returned 0x0 [0202.546] ReadFile (in: hFile=0x378, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1f0e, lpOverlapped=0x0) returned 1 [0202.548] WriteFile (in: hFile=0x2d4, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0202.548] ReadFile (in: hFile=0x378, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.549] WriteFile (in: hFile=0x2d4, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.549] SetEndOfFile (hFile=0x2d4) returned 1 [0202.549] CloseHandle (hObject=0x2d4) returned 1 [0202.549] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.549] SetEndOfFile (hFile=0x378) returned 1 [0202.550] CloseHandle (hObject=0x378) returned 1 [0202.550] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.550] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeg9qv[1].jpg")) returned 1 [0202.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.550] lstrlenW (lpString=".doc") returned 4 [0202.550] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.550] lstrlenW (lpString=".docx") returned 5 [0202.550] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.550] lstrlenW (lpString=".pdf") returned 4 [0202.550] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.550] lstrlenW (lpString=".xls") returned 4 [0202.550] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.550] lstrlenW (lpString=".xlsx") returned 5 [0202.550] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.551] lstrlenW (lpString=".ppt") returned 4 [0202.551] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.551] lstrlenW (lpString=".zip") returned 4 [0202.551] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.551] lstrlenW (lpString=".rar") returned 4 [0202.551] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.551] lstrlenW (lpString=".bz2") returned 4 [0202.551] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.551] lstrlenW (lpString=".7z") returned 3 [0202.551] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.551] lstrlenW (lpString=".dbf") returned 4 [0202.551] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.551] lstrlenW (lpString=".1cd") returned 4 [0202.551] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.551] lstrlenW (lpString=".jpg") returned 4 [0202.551] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.551] lstrlenW (lpString=".doc") returned 4 [0202.551] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.551] lstrlenW (lpString=".docx") returned 5 [0202.551] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.551] lstrlenW (lpString=".pdf") returned 4 [0202.551] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.551] lstrlenW (lpString=".xls") returned 4 [0202.551] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.551] lstrlenW (lpString=".xlsx") returned 5 [0202.551] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.551] lstrlenW (lpString=".ppt") returned 4 [0202.552] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.552] lstrlenW (lpString=".zip") returned 4 [0202.552] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.552] lstrlenW (lpString=".rar") returned 4 [0202.552] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.552] lstrlenW (lpString=".bz2") returned 4 [0202.552] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.552] lstrlenW (lpString=".7z") returned 3 [0202.552] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.552] lstrlenW (lpString=".dbf") returned 4 [0202.552] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.552] lstrlenW (lpString=".1cd") returned 4 [0202.552] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEg9QV[1].jpg") returned 126 [0202.552] lstrlenW (lpString=".jpg") returned 4 [0202.552] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.552] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.552] lstrlenW (lpString="BBEgGSl[1].jpg") returned 14 [0202.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0202.553] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=2432) returned 1 [0202.553] CloseHandle (hObject=0x378) returned 1 [0202.553] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg")) returned 0x2020 [0202.553] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0202.554] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.554] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.063] GetLastError () returned 0x0 [0203.063] ReadFile (in: hFile=0x378, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x980, lpOverlapped=0x0) returned 1 [0203.093] WriteFile (in: hFile=0x354, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x990, lpOverlapped=0x0) returned 1 [0203.094] ReadFile (in: hFile=0x378, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.094] WriteFile (in: hFile=0x354, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.094] SetEndOfFile (hFile=0x354) returned 1 [0203.094] CloseHandle (hObject=0x354) returned 1 [0203.094] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.094] SetEndOfFile (hFile=0x378) returned 1 [0203.095] CloseHandle (hObject=0x378) returned 1 [0203.095] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.095] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeggsl[1].jpg")) returned 1 [0203.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.095] lstrlenW (lpString=".doc") returned 4 [0203.095] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.095] lstrlenW (lpString=".docx") returned 5 [0203.095] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.095] lstrlenW (lpString=".pdf") returned 4 [0203.095] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.095] lstrlenW (lpString=".xls") returned 4 [0203.095] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.095] lstrlenW (lpString=".xlsx") returned 5 [0203.095] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.096] lstrlenW (lpString=".ppt") returned 4 [0203.096] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.096] lstrlenW (lpString=".zip") returned 4 [0203.096] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.096] lstrlenW (lpString=".rar") returned 4 [0203.096] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.096] lstrlenW (lpString=".bz2") returned 4 [0203.096] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.096] lstrlenW (lpString=".7z") returned 3 [0203.096] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.096] lstrlenW (lpString=".dbf") returned 4 [0203.096] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.096] lstrlenW (lpString=".1cd") returned 4 [0203.096] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.096] lstrlenW (lpString=".jpg") returned 4 [0203.096] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.096] lstrlenW (lpString=".doc") returned 4 [0203.096] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.096] lstrlenW (lpString=".docx") returned 5 [0203.096] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.096] lstrlenW (lpString=".pdf") returned 4 [0203.096] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.096] lstrlenW (lpString=".xls") returned 4 [0203.096] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.096] lstrlenW (lpString=".xlsx") returned 5 [0203.096] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.096] lstrlenW (lpString=".ppt") returned 4 [0203.096] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.097] lstrlenW (lpString=".zip") returned 4 [0203.097] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.097] lstrlenW (lpString=".rar") returned 4 [0203.097] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.097] lstrlenW (lpString=".bz2") returned 4 [0203.097] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.097] lstrlenW (lpString=".7z") returned 3 [0203.097] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.097] lstrlenW (lpString=".dbf") returned 4 [0203.097] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.097] lstrlenW (lpString=".1cd") returned 4 [0203.097] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.097] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgGSl[1].jpg") returned 126 [0203.097] lstrlenW (lpString=".jpg") returned 4 [0203.097] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.097] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0203.097] lstrlenW (lpString="BBEgtcS[2].jpg") returned 14 [0203.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.235] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=6182) returned 1 [0203.236] CloseHandle (hObject=0x344) returned 1 [0203.236] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg")) returned 0x2020 [0203.236] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.294] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.294] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0203.767] GetLastError () returned 0x0 [0203.767] ReadFile (in: hFile=0x344, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1826, lpOverlapped=0x0) returned 1 [0203.769] WriteFile (in: hFile=0x370, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1830, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1830, lpOverlapped=0x0) returned 1 [0203.770] ReadFile (in: hFile=0x344, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.770] WriteFile (in: hFile=0x370, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.770] SetEndOfFile (hFile=0x370) returned 1 [0203.770] CloseHandle (hObject=0x370) returned 1 [0203.770] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.770] SetEndOfFile (hFile=0x344) returned 1 [0203.771] CloseHandle (hObject=0x344) returned 1 [0203.771] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.771] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[2].jpg")) returned 1 [0203.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.772] lstrlenW (lpString=".doc") returned 4 [0203.772] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.772] lstrlenW (lpString=".docx") returned 5 [0203.772] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.772] lstrlenW (lpString=".pdf") returned 4 [0203.772] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.772] lstrlenW (lpString=".xls") returned 4 [0203.772] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.772] lstrlenW (lpString=".xlsx") returned 5 [0203.772] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.772] lstrlenW (lpString=".ppt") returned 4 [0203.772] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.772] lstrlenW (lpString=".zip") returned 4 [0203.772] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.772] lstrlenW (lpString=".rar") returned 4 [0203.772] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.772] lstrlenW (lpString=".bz2") returned 4 [0203.772] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.772] lstrlenW (lpString=".7z") returned 3 [0203.772] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.772] lstrlenW (lpString=".dbf") returned 4 [0203.772] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.772] lstrlenW (lpString=".1cd") returned 4 [0203.772] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.772] lstrlenW (lpString=".jpg") returned 4 [0203.772] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.773] lstrlenW (lpString=".doc") returned 4 [0203.773] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.773] lstrlenW (lpString=".docx") returned 5 [0203.773] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.773] lstrlenW (lpString=".pdf") returned 4 [0203.773] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.773] lstrlenW (lpString=".xls") returned 4 [0203.773] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.773] lstrlenW (lpString=".xlsx") returned 5 [0203.773] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.773] lstrlenW (lpString=".ppt") returned 4 [0203.773] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.773] lstrlenW (lpString=".zip") returned 4 [0203.773] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.773] lstrlenW (lpString=".rar") returned 4 [0203.773] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.773] lstrlenW (lpString=".bz2") returned 4 [0203.773] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.773] lstrlenW (lpString=".7z") returned 3 [0203.773] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.773] lstrlenW (lpString=".dbf") returned 4 [0203.773] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.773] lstrlenW (lpString=".1cd") returned 4 [0203.773] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[2].jpg") returned 126 [0203.773] lstrlenW (lpString=".jpg") returned 4 [0203.773] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.774] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0203.774] lstrlenW (lpString="AA3e1oO[1].png") returned 14 [0203.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.284] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=667) returned 1 [0204.284] CloseHandle (hObject=0x348) returned 1 [0204.284] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png")) returned 0x2020 [0204.292] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.292] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.329] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0204.338] GetLastError () returned 0x0 [0204.338] ReadFile (in: hFile=0x348, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x29b, lpOverlapped=0x0) returned 1 [0204.339] WriteFile (in: hFile=0x324, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0204.340] ReadFile (in: hFile=0x348, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.340] WriteFile (in: hFile=0x324, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.340] SetEndOfFile (hFile=0x324) returned 1 [0204.341] CloseHandle (hObject=0x324) returned 1 [0204.341] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.341] SetEndOfFile (hFile=0x348) returned 1 [0204.341] CloseHandle (hObject=0x348) returned 1 [0204.341] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.342] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa3e1oo[1].png")) returned 1 [0204.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.342] lstrlenW (lpString=".doc") returned 4 [0204.342] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.342] lstrlenW (lpString=".docx") returned 5 [0204.342] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.342] lstrlenW (lpString=".pdf") returned 4 [0204.342] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.342] lstrlenW (lpString=".xls") returned 4 [0204.342] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.342] lstrlenW (lpString=".xlsx") returned 5 [0204.342] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.342] lstrlenW (lpString=".ppt") returned 4 [0204.342] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.342] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.342] lstrlenW (lpString=".zip") returned 4 [0204.342] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.342] lstrlenW (lpString=".rar") returned 4 [0204.342] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.342] lstrlenW (lpString=".bz2") returned 4 [0204.342] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.342] lstrlenW (lpString=".7z") returned 3 [0204.343] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.343] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.343] lstrlenW (lpString=".dbf") returned 4 [0204.343] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.343] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.343] lstrlenW (lpString=".1cd") returned 4 [0204.343] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.343] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.343] lstrlenW (lpString=".jpg") returned 4 [0204.343] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.343] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.343] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.343] lstrlenW (lpString=".doc") returned 4 [0204.343] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.343] lstrlenW (lpString=".docx") returned 5 [0204.343] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.343] lstrlenW (lpString=".pdf") returned 4 [0204.343] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.343] lstrlenW (lpString=".xls") returned 4 [0204.343] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.343] lstrlenW (lpString=".xlsx") returned 5 [0204.343] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.343] lstrlenW (lpString=".ppt") returned 4 [0204.343] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.343] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.343] lstrlenW (lpString=".zip") returned 4 [0204.343] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.343] lstrlenW (lpString=".rar") returned 4 [0204.343] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.343] lstrlenW (lpString=".bz2") returned 4 [0204.343] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.343] lstrlenW (lpString=".7z") returned 3 [0204.344] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.344] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.344] lstrlenW (lpString=".dbf") returned 4 [0204.344] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.344] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.344] lstrlenW (lpString=".1cd") returned 4 [0204.344] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.344] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA3e1oO[1].png") returned 126 [0204.344] lstrlenW (lpString=".jpg") returned 4 [0204.344] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.344] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.344] lstrlenW (lpString="BBBCFjo[1].jpg") returned 14 [0204.344] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.344] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=10951) returned 1 [0204.345] CloseHandle (hObject=0x348) returned 1 [0204.345] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg")) returned 0x2020 [0204.345] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.345] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.345] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.345] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0204.345] GetLastError () returned 0x0 [0204.345] ReadFile (in: hFile=0x348, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x2ac7, lpOverlapped=0x0) returned 1 [0204.347] WriteFile (in: hFile=0x324, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x2ad0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x2ad0, lpOverlapped=0x0) returned 1 [0204.348] ReadFile (in: hFile=0x348, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.348] WriteFile (in: hFile=0x324, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.349] SetEndOfFile (hFile=0x324) returned 1 [0204.349] CloseHandle (hObject=0x324) returned 1 [0204.349] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.349] SetEndOfFile (hFile=0x348) returned 1 [0204.350] CloseHandle (hObject=0x348) returned 1 [0204.350] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.350] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbcfjo[1].jpg")) returned 1 [0204.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.350] lstrlenW (lpString=".doc") returned 4 [0204.350] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.350] lstrlenW (lpString=".docx") returned 5 [0204.350] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.350] lstrlenW (lpString=".pdf") returned 4 [0204.350] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.350] lstrlenW (lpString=".xls") returned 4 [0204.350] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.350] lstrlenW (lpString=".xlsx") returned 5 [0204.350] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.350] lstrlenW (lpString=".ppt") returned 4 [0204.350] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.350] lstrlenW (lpString=".zip") returned 4 [0204.350] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.350] lstrlenW (lpString=".rar") returned 4 [0204.351] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.351] lstrlenW (lpString=".bz2") returned 4 [0204.351] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.351] lstrlenW (lpString=".7z") returned 3 [0204.351] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.351] lstrlenW (lpString=".dbf") returned 4 [0204.351] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.351] lstrlenW (lpString=".1cd") returned 4 [0204.351] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.351] lstrlenW (lpString=".jpg") returned 4 [0204.351] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.351] lstrlenW (lpString=".doc") returned 4 [0204.351] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.351] lstrlenW (lpString=".docx") returned 5 [0204.351] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.351] lstrlenW (lpString=".pdf") returned 4 [0204.351] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.351] lstrlenW (lpString=".xls") returned 4 [0204.351] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.351] lstrlenW (lpString=".xlsx") returned 5 [0204.351] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.351] lstrlenW (lpString=".ppt") returned 4 [0204.351] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.351] lstrlenW (lpString=".zip") returned 4 [0204.351] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.351] lstrlenW (lpString=".rar") returned 4 [0204.351] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.352] lstrlenW (lpString=".bz2") returned 4 [0204.352] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.352] lstrlenW (lpString=".7z") returned 3 [0204.352] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.352] lstrlenW (lpString=".dbf") returned 4 [0204.352] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.352] lstrlenW (lpString=".1cd") returned 4 [0204.352] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBCFjo[1].jpg") returned 126 [0204.352] lstrlenW (lpString=".jpg") returned 4 [0204.352] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.352] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.352] lstrlenW (lpString="BBBDtcM[1].jpg") returned 14 [0204.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.353] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1993) returned 1 [0204.353] CloseHandle (hObject=0x348) returned 1 [0204.353] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg")) returned 0x2020 [0204.353] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.353] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.353] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0204.354] GetLastError () returned 0x0 [0204.354] ReadFile (in: hFile=0x348, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x7c9, lpOverlapped=0x0) returned 1 [0204.355] WriteFile (in: hFile=0x324, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0204.356] ReadFile (in: hFile=0x348, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.356] WriteFile (in: hFile=0x324, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.357] SetEndOfFile (hFile=0x324) returned 1 [0204.357] CloseHandle (hObject=0x324) returned 1 [0204.357] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.357] SetEndOfFile (hFile=0x348) returned 1 [0204.357] CloseHandle (hObject=0x348) returned 1 [0204.358] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.358] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbdtcm[1].jpg")) returned 1 [0204.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.358] lstrlenW (lpString=".doc") returned 4 [0204.358] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.358] lstrlenW (lpString=".docx") returned 5 [0204.358] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.358] lstrlenW (lpString=".pdf") returned 4 [0204.358] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.358] lstrlenW (lpString=".xls") returned 4 [0204.358] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.358] lstrlenW (lpString=".xlsx") returned 5 [0204.358] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.358] lstrlenW (lpString=".ppt") returned 4 [0204.358] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.358] lstrlenW (lpString=".zip") returned 4 [0204.358] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.358] lstrlenW (lpString=".rar") returned 4 [0204.358] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.358] lstrlenW (lpString=".bz2") returned 4 [0204.359] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.359] lstrlenW (lpString=".7z") returned 3 [0204.359] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.359] lstrlenW (lpString=".dbf") returned 4 [0204.359] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.359] lstrlenW (lpString=".1cd") returned 4 [0204.359] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.359] lstrlenW (lpString=".jpg") returned 4 [0204.359] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.359] lstrlenW (lpString=".doc") returned 4 [0204.359] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.359] lstrlenW (lpString=".docx") returned 5 [0204.359] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.359] lstrlenW (lpString=".pdf") returned 4 [0204.359] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.359] lstrlenW (lpString=".xls") returned 4 [0204.359] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.359] lstrlenW (lpString=".xlsx") returned 5 [0204.359] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.359] lstrlenW (lpString=".ppt") returned 4 [0204.359] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.359] lstrlenW (lpString=".zip") returned 4 [0204.359] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.359] lstrlenW (lpString=".rar") returned 4 [0204.359] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.359] lstrlenW (lpString=".bz2") returned 4 [0204.359] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.360] lstrlenW (lpString=".7z") returned 3 [0204.360] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.360] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.360] lstrlenW (lpString=".dbf") returned 4 [0204.360] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.360] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.360] lstrlenW (lpString=".1cd") returned 4 [0204.360] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.360] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBDtcM[1].jpg") returned 126 [0204.360] lstrlenW (lpString=".jpg") returned 4 [0204.360] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.360] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.360] lstrlenW (lpString="BBBIeNJ[1].jpg") returned 14 [0204.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.361] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=7961) returned 1 [0204.361] CloseHandle (hObject=0x348) returned 1 [0204.361] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg")) returned 0x2020 [0204.361] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.361] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.361] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.362] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0204.362] GetLastError () returned 0x0 [0204.362] ReadFile (in: hFile=0x348, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x1f19, lpOverlapped=0x0) returned 1 [0204.364] WriteFile (in: hFile=0x324, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0204.365] ReadFile (in: hFile=0x348, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.365] WriteFile (in: hFile=0x324, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.365] SetEndOfFile (hFile=0x324) returned 1 [0204.365] CloseHandle (hObject=0x324) returned 1 [0204.365] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.365] SetEndOfFile (hFile=0x348) returned 1 [0204.366] CloseHandle (hObject=0x348) returned 1 [0204.366] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.366] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbienj[1].jpg")) returned 1 [0204.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.366] lstrlenW (lpString=".doc") returned 4 [0204.366] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.366] lstrlenW (lpString=".docx") returned 5 [0204.366] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.367] lstrlenW (lpString=".pdf") returned 4 [0204.367] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.367] lstrlenW (lpString=".xls") returned 4 [0204.367] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.367] lstrlenW (lpString=".xlsx") returned 5 [0204.367] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.367] lstrlenW (lpString=".ppt") returned 4 [0204.367] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.367] lstrlenW (lpString=".zip") returned 4 [0204.367] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.367] lstrlenW (lpString=".rar") returned 4 [0204.367] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.367] lstrlenW (lpString=".bz2") returned 4 [0204.367] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.367] lstrlenW (lpString=".7z") returned 3 [0204.367] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.367] lstrlenW (lpString=".dbf") returned 4 [0204.367] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.367] lstrlenW (lpString=".1cd") returned 4 [0204.367] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.367] lstrlenW (lpString=".jpg") returned 4 [0204.367] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.367] lstrlenW (lpString=".doc") returned 4 [0204.367] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.367] lstrlenW (lpString=".docx") returned 5 [0204.367] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.367] lstrlenW (lpString=".pdf") returned 4 [0204.368] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.368] lstrlenW (lpString=".xls") returned 4 [0204.368] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.368] lstrlenW (lpString=".xlsx") returned 5 [0204.368] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.368] lstrlenW (lpString=".ppt") returned 4 [0204.368] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.368] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.368] lstrlenW (lpString=".zip") returned 4 [0204.368] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.368] lstrlenW (lpString=".rar") returned 4 [0204.368] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.368] lstrlenW (lpString=".bz2") returned 4 [0204.368] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.368] lstrlenW (lpString=".7z") returned 3 [0204.368] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.368] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.368] lstrlenW (lpString=".dbf") returned 4 [0204.368] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.368] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.368] lstrlenW (lpString=".1cd") returned 4 [0204.368] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.368] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBIeNJ[1].jpg") returned 126 [0204.368] lstrlenW (lpString=".jpg") returned 4 [0204.368] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.368] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.368] lstrlenW (lpString="BBBImKX[1].jpg") returned 14 [0204.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.369] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x2d1ff1c | out: lpFileSize=0x2d1ff1c*=1809) returned 1 [0204.370] CloseHandle (hObject=0x348) returned 1 [0204.370] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg")) returned 0x2020 [0204.370] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0204.370] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.370] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.370] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0204.370] GetLastError () returned 0x0 [0204.370] ReadFile (in: hFile=0x348, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x711, lpOverlapped=0x0) returned 1 [0204.547] WriteFile (in: hFile=0x324, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0x720, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0x720, lpOverlapped=0x0) returned 1 [0204.897] ReadFile (in: hFile=0x348, lpBuffer=0x33c0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d1fed4, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesRead=0x2d1fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.897] WriteFile (in: hFile=0x324, lpBuffer=0x33c0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2d1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x33c0020*, lpNumberOfBytesWritten=0x2d1fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.897] SetEndOfFile (hFile=0x324) returned 1 [0204.897] CloseHandle (hObject=0x324) returned 1 [0204.897] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d1fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.897] SetEndOfFile (hFile=0x348) returned 1 [0204.898] CloseHandle (hObject=0x348) returned 1 [0204.898] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.898] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBImKX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbimkx[1].jpg")) Thread: id = 68 os_tid = 0x758 [0183.489] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x332c60 [0183.490] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x342c68 [0183.490] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310e58 [0183.490] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6) returned 0x322138 [0183.490] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310e70 [0183.490] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x3610020 [0183.490] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310e88 [0183.490] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310e88, Size=0x20) returned 0x2dc660 [0183.490] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310e88 [0183.490] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310e88, Size=0x20) returned 0x2dc638 [0183.490] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.491] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.491] Wow64DisableWow64FsRedirection (in: OldValue=0x2ebff58 | out: OldValue=0x2ebff58*=0x0) returned 1 [0183.491] lstrlenW (lpString="kernel32.dll") returned 12 [0183.491] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc660 | out: hHeap=0x270000) returned 1 [0183.491] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.491] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc638 | out: hHeap=0x270000) returned 1 [0183.491] Sleep (dwMilliseconds=0x64) [0183.593] lstrcmpiW (lpString1=".LOG", lpString2=".wiki") returned -1 [0183.593] lstrlenW (lpString="BCD.LOG") returned 7 [0183.593] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.593] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.594] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.594] lstrlenW (lpString=".doc") returned 4 [0183.594] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0183.594] lstrlenW (lpString=".docx") returned 5 [0183.594] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0183.594] lstrlenW (lpString=".pdf") returned 4 [0183.594] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0183.594] lstrlenW (lpString=".xls") returned 4 [0183.594] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0183.594] lstrlenW (lpString=".xlsx") returned 5 [0183.594] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0183.594] lstrlenW (lpString=".ppt") returned 4 [0183.594] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0183.594] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.594] lstrlenW (lpString=".zip") returned 4 [0183.594] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0183.594] lstrlenW (lpString=".rar") returned 4 [0183.594] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0183.594] lstrlenW (lpString=".bz2") returned 4 [0183.594] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0183.594] lstrlenW (lpString=".7z") returned 3 [0183.594] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0183.594] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.594] lstrlenW (lpString=".dbf") returned 4 [0183.594] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0183.594] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.594] lstrlenW (lpString=".1cd") returned 4 [0183.594] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0183.594] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.594] lstrlenW (lpString=".jpg") returned 4 [0183.594] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0183.594] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.594] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.594] lstrlenW (lpString=".doc") returned 4 [0183.595] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0183.595] lstrlenW (lpString=".docx") returned 5 [0183.595] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0183.595] lstrlenW (lpString=".pdf") returned 4 [0183.595] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0183.595] lstrlenW (lpString=".xls") returned 4 [0183.595] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0183.595] lstrlenW (lpString=".xlsx") returned 5 [0183.595] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0183.595] lstrlenW (lpString=".ppt") returned 4 [0183.595] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0183.595] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.595] lstrlenW (lpString=".zip") returned 4 [0183.595] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0183.595] lstrlenW (lpString=".rar") returned 4 [0183.595] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0183.595] lstrlenW (lpString=".bz2") returned 4 [0183.595] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0183.595] lstrlenW (lpString=".7z") returned 3 [0183.595] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0183.595] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.595] lstrlenW (lpString=".dbf") returned 4 [0183.595] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0183.595] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.595] lstrlenW (lpString=".1cd") returned 4 [0183.595] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0183.595] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0183.595] lstrlenW (lpString=".jpg") returned 4 [0183.595] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0183.595] Sleep (dwMilliseconds=0x64) [0183.775] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.775] lstrlenW (lpString="Alphabet.xml") returned 12 [0183.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x24c [0183.786] GetFileSizeEx (in: hFile=0x24c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=791686) returned 1 [0183.786] CloseHandle (hObject=0x24c) returned 1 [0183.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0183.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.786] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.786] lstrlenW (lpString=".doc") returned 4 [0183.786] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.786] lstrlenW (lpString=".docx") returned 5 [0183.786] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0183.786] lstrlenW (lpString=".pdf") returned 4 [0183.786] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.786] lstrlenW (lpString=".xls") returned 4 [0183.786] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.786] lstrlenW (lpString=".xlsx") returned 5 [0183.786] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0183.786] lstrlenW (lpString=".ppt") returned 4 [0183.786] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.786] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.786] lstrlenW (lpString=".zip") returned 4 [0183.786] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.787] lstrlenW (lpString=".rar") returned 4 [0183.787] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.787] lstrlenW (lpString=".bz2") returned 4 [0183.787] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.787] lstrlenW (lpString=".7z") returned 3 [0183.787] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.787] lstrlenW (lpString=".dbf") returned 4 [0183.787] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.787] lstrlenW (lpString=".1cd") returned 4 [0183.787] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.787] lstrlenW (lpString=".jpg") returned 4 [0183.787] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.787] lstrlenW (lpString=".doc") returned 4 [0183.787] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.787] lstrlenW (lpString=".docx") returned 5 [0183.787] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0183.787] lstrlenW (lpString=".pdf") returned 4 [0183.787] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.787] lstrlenW (lpString=".xls") returned 4 [0183.787] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.787] lstrlenW (lpString=".xlsx") returned 5 [0183.787] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0183.787] lstrlenW (lpString=".ppt") returned 4 [0183.787] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.787] lstrlenW (lpString=".zip") returned 4 [0183.787] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.787] lstrlenW (lpString=".rar") returned 4 [0183.788] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.788] lstrlenW (lpString=".bz2") returned 4 [0183.788] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.788] lstrlenW (lpString=".7z") returned 3 [0183.788] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.788] lstrlenW (lpString=".dbf") returned 4 [0183.788] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.788] lstrlenW (lpString=".1cd") returned 4 [0183.788] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0183.788] lstrlenW (lpString=".jpg") returned 4 [0183.788] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.788] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.788] lstrlenW (lpString="boxed-join.avi") returned 14 [0183.788] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.813] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=33280) returned 1 [0183.813] CloseHandle (hObject=0x1d0) returned 1 [0183.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0183.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.813] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.813] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.813] lstrlenW (lpString=".doc") returned 4 [0183.813] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.813] lstrlenW (lpString=".docx") returned 5 [0183.813] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0183.813] lstrlenW (lpString=".pdf") returned 4 [0183.813] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.813] lstrlenW (lpString=".xls") returned 4 [0183.813] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.813] lstrlenW (lpString=".xlsx") returned 5 [0183.813] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0183.814] lstrlenW (lpString=".ppt") returned 4 [0183.814] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.814] lstrlenW (lpString=".zip") returned 4 [0183.814] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.814] lstrlenW (lpString=".rar") returned 4 [0183.814] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.814] lstrlenW (lpString=".bz2") returned 4 [0183.814] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.814] lstrlenW (lpString=".7z") returned 3 [0183.814] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.814] lstrlenW (lpString=".dbf") returned 4 [0183.814] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.814] lstrlenW (lpString=".1cd") returned 4 [0183.814] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.814] lstrlenW (lpString=".jpg") returned 4 [0183.814] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.814] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.814] lstrlenW (lpString=".doc") returned 4 [0183.814] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.814] lstrlenW (lpString=".docx") returned 5 [0183.814] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0183.814] lstrlenW (lpString=".pdf") returned 4 [0183.814] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.814] lstrlenW (lpString=".xls") returned 4 [0183.814] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.814] lstrlenW (lpString=".xlsx") returned 5 [0183.814] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0183.815] lstrlenW (lpString=".ppt") returned 4 [0183.815] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.815] lstrlenW (lpString=".zip") returned 4 [0183.815] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.815] lstrlenW (lpString=".rar") returned 4 [0183.815] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.815] lstrlenW (lpString=".bz2") returned 4 [0183.815] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.815] lstrlenW (lpString=".7z") returned 3 [0183.815] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.815] lstrlenW (lpString=".dbf") returned 4 [0183.815] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.815] lstrlenW (lpString=".1cd") returned 4 [0183.815] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.815] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0183.815] lstrlenW (lpString=".jpg") returned 4 [0183.815] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.815] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.815] lstrlenW (lpString="auxpad.xml") returned 10 [0183.815] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.831] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=212) returned 1 [0183.831] CloseHandle (hObject=0x1d0) returned 1 [0183.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml")) returned 0x20 [0183.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.832] lstrlenW (lpString=".doc") returned 4 [0183.832] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.832] lstrlenW (lpString=".docx") returned 5 [0183.832] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0183.832] lstrlenW (lpString=".pdf") returned 4 [0183.832] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.832] lstrlenW (lpString=".xls") returned 4 [0183.832] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.832] lstrlenW (lpString=".xlsx") returned 5 [0183.832] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0183.832] lstrlenW (lpString=".ppt") returned 4 [0183.832] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.832] lstrlenW (lpString=".zip") returned 4 [0183.832] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.832] lstrlenW (lpString=".rar") returned 4 [0183.832] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.832] lstrlenW (lpString=".bz2") returned 4 [0183.832] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.832] lstrlenW (lpString=".7z") returned 3 [0183.832] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.833] lstrlenW (lpString=".dbf") returned 4 [0183.833] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.833] lstrlenW (lpString=".1cd") returned 4 [0183.833] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.833] lstrlenW (lpString=".jpg") returned 4 [0183.833] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.833] lstrlenW (lpString=".doc") returned 4 [0183.833] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.833] lstrlenW (lpString=".docx") returned 5 [0183.833] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0183.833] lstrlenW (lpString=".pdf") returned 4 [0183.833] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.833] lstrlenW (lpString=".xls") returned 4 [0183.833] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.833] lstrlenW (lpString=".xlsx") returned 5 [0183.833] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0183.833] lstrlenW (lpString=".ppt") returned 4 [0183.833] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.833] lstrlenW (lpString=".zip") returned 4 [0183.833] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.833] lstrlenW (lpString=".rar") returned 4 [0183.833] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.833] lstrlenW (lpString=".bz2") returned 4 [0183.833] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.833] lstrlenW (lpString=".7z") returned 3 [0183.833] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.833] lstrlenW (lpString=".dbf") returned 4 [0183.834] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.834] lstrlenW (lpString=".1cd") returned 4 [0183.834] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.834] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad.xml") returned 75 [0183.834] lstrlenW (lpString=".jpg") returned 4 [0183.834] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.834] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.834] lstrlenW (lpString="base_ca.xml") returned 11 [0183.834] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.847] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3166) returned 1 [0183.847] CloseHandle (hObject=0x1d0) returned 1 [0183.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml")) returned 0x20 [0183.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.847] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_ca.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.847] lstrlenW (lpString=".doc") returned 4 [0183.847] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.847] lstrlenW (lpString=".docx") returned 5 [0183.847] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0183.847] lstrlenW (lpString=".pdf") returned 4 [0183.847] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.847] lstrlenW (lpString=".xls") returned 4 [0183.847] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.847] lstrlenW (lpString=".xlsx") returned 5 [0183.847] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0183.847] lstrlenW (lpString=".ppt") returned 4 [0183.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.848] lstrlenW (lpString=".zip") returned 4 [0183.848] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.848] lstrlenW (lpString=".rar") returned 4 [0183.848] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.848] lstrlenW (lpString=".bz2") returned 4 [0183.848] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.848] lstrlenW (lpString=".7z") returned 3 [0183.848] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.848] lstrlenW (lpString=".dbf") returned 4 [0183.848] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.848] lstrlenW (lpString=".1cd") returned 4 [0183.848] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.848] lstrlenW (lpString=".jpg") returned 4 [0183.848] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.848] lstrlenW (lpString=".doc") returned 4 [0183.848] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.848] lstrlenW (lpString=".docx") returned 5 [0183.848] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0183.848] lstrlenW (lpString=".pdf") returned 4 [0183.848] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.848] lstrlenW (lpString=".xls") returned 4 [0183.848] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.848] lstrlenW (lpString=".xlsx") returned 5 [0183.848] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0183.848] lstrlenW (lpString=".ppt") returned 4 [0183.848] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.849] lstrlenW (lpString=".zip") returned 4 [0183.849] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.849] lstrlenW (lpString=".rar") returned 4 [0183.849] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.849] lstrlenW (lpString=".bz2") returned 4 [0183.849] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.849] lstrlenW (lpString=".7z") returned 3 [0183.849] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.849] lstrlenW (lpString=".dbf") returned 4 [0183.849] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.849] lstrlenW (lpString=".1cd") returned 4 [0183.849] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_ca.xml") returned 81 [0183.849] lstrlenW (lpString=".jpg") returned 4 [0183.849] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.849] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.849] lstrlenW (lpString="base_rtl.xml") returned 12 [0183.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.849] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=617) returned 1 [0183.850] CloseHandle (hObject=0x1d0) returned 1 [0183.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml")) returned 0x20 [0183.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.850] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base_rtl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.850] lstrlenW (lpString=".doc") returned 4 [0183.850] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.850] lstrlenW (lpString=".docx") returned 5 [0183.850] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0183.850] lstrlenW (lpString=".pdf") returned 4 [0183.850] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.850] lstrlenW (lpString=".xls") returned 4 [0183.850] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.850] lstrlenW (lpString=".xlsx") returned 5 [0183.850] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0183.850] lstrlenW (lpString=".ppt") returned 4 [0183.850] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.850] lstrlenW (lpString=".zip") returned 4 [0183.850] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.850] lstrlenW (lpString=".rar") returned 4 [0183.850] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.850] lstrlenW (lpString=".bz2") returned 4 [0183.850] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.850] lstrlenW (lpString=".7z") returned 3 [0183.850] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.850] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.851] lstrlenW (lpString=".dbf") returned 4 [0183.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.851] lstrlenW (lpString=".1cd") returned 4 [0183.851] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.851] lstrlenW (lpString=".jpg") returned 4 [0183.851] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.851] lstrlenW (lpString=".doc") returned 4 [0183.851] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.851] lstrlenW (lpString=".docx") returned 5 [0183.851] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0183.851] lstrlenW (lpString=".pdf") returned 4 [0183.851] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.851] lstrlenW (lpString=".xls") returned 4 [0183.851] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.851] lstrlenW (lpString=".xlsx") returned 5 [0183.851] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0183.851] lstrlenW (lpString=".ppt") returned 4 [0183.851] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.851] lstrlenW (lpString=".zip") returned 4 [0183.851] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.851] lstrlenW (lpString=".rar") returned 4 [0183.851] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.851] lstrlenW (lpString=".bz2") returned 4 [0183.851] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.851] lstrlenW (lpString=".7z") returned 3 [0183.851] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.851] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.851] lstrlenW (lpString=".dbf") returned 4 [0183.851] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.852] lstrlenW (lpString=".1cd") returned 4 [0183.852] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.852] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base_rtl.xml") returned 82 [0183.852] lstrlenW (lpString=".jpg") returned 4 [0183.852] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.852] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.852] lstrlenW (lpString="ja-jp.xml") returned 9 [0183.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.853] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=16616) returned 1 [0183.853] CloseHandle (hObject=0x1d0) returned 1 [0183.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml")) returned 0x20 [0183.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.853] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\ja-jp.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0183.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0183.853] lstrlenW (lpString=".doc") returned 4 [0183.853] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.853] lstrlenW (lpString=".docx") returned 5 [0183.853] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0183.853] lstrlenW (lpString=".pdf") returned 4 [0183.853] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.853] lstrlenW (lpString=".xls") returned 4 [0183.853] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.853] lstrlenW (lpString=".xlsx") returned 5 [0183.853] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0183.853] lstrlenW (lpString=".ppt") returned 4 [0183.853] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.853] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\ja-jp.xml") returned 79 [0183.853] lstrlenW (lpString=".zip") returned 4 [0183.853] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.854] lstrlenW (lpString=".rar") returned 4 [0183.854] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.854] lstrlenW (lpString=".bz2") returned 4 [0183.854] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.854] lstrlenW (lpString=".7z") returned 3 [0183.854] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0184.875] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.875] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.267] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.267] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.267] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.268] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.269] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.269] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.125] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XMLSDK5.CHM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xmlsdk5.chm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVCMP.DIC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\advcmp.dic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADVTEL.DIC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\advtel.dic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0192.669] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\icudtl.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\icudtl.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0192.713] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedQuanPin.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedquanpin.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0192.714] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\TableTextService\\TableTextServiceSimplifiedZhengMa.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows nt\\tabletextservice\\tabletextservicesimplifiedzhengma.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0192.902] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat"), lpNewFileName="C:\\ProgramData\\Microsoft\\OfficeSoftwareProtectionPlatform\\tokens.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\officesoftwareprotectionplatform\\tokens.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.003] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.003] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.004] GetLastError () returned 0x0 [0193.004] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x12ea5, lpOverlapped=0x0) returned 1 [0193.014] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x12eb0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x12eb0, lpOverlapped=0x0) returned 1 [0193.016] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.016] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.016] SetEndOfFile (hFile=0x358) returned 1 [0193.016] CloseHandle (hObject=0x358) returned 1 [0193.017] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.017] SetEndOfFile (hFile=0x35c) returned 1 [0193.018] CloseHandle (hObject=0x35c) returned 1 [0193.018] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.018] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\usercache.bin")) returned 1 [0193.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.018] lstrlenW (lpString=".doc") returned 4 [0193.018] lstrcmpiW (lpString1=".doc", lpString2=".bin") returned 1 [0193.018] lstrlenW (lpString=".docx") returned 5 [0193.018] lstrcmpiW (lpString1=".docx", lpString2="e.bin") returned -1 [0193.018] lstrlenW (lpString=".pdf") returned 4 [0193.018] lstrcmpiW (lpString1=".pdf", lpString2=".bin") returned 1 [0193.019] lstrlenW (lpString=".xls") returned 4 [0193.019] lstrcmpiW (lpString1=".xls", lpString2=".bin") returned 1 [0193.019] lstrlenW (lpString=".xlsx") returned 5 [0193.019] lstrcmpiW (lpString1=".xlsx", lpString2="e.bin") returned -1 [0193.019] lstrlenW (lpString=".ppt") returned 4 [0193.019] lstrcmpiW (lpString1=".ppt", lpString2=".bin") returned 1 [0193.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.019] lstrlenW (lpString=".zip") returned 4 [0193.019] lstrcmpiW (lpString1=".zip", lpString2=".bin") returned 1 [0193.019] lstrlenW (lpString=".rar") returned 4 [0193.019] lstrcmpiW (lpString1=".rar", lpString2=".bin") returned 1 [0193.019] lstrlenW (lpString=".bz2") returned 4 [0193.019] lstrcmpiW (lpString1=".bz2", lpString2=".bin") returned 1 [0193.019] lstrlenW (lpString=".7z") returned 3 [0193.019] lstrcmpiW (lpString1=".7z", lpString2="bin") returned -1 [0193.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.019] lstrlenW (lpString=".dbf") returned 4 [0193.019] lstrcmpiW (lpString1=".dbf", lpString2=".bin") returned 1 [0193.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.019] lstrlenW (lpString=".1cd") returned 4 [0193.019] lstrcmpiW (lpString1=".1cd", lpString2=".bin") returned -1 [0193.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.019] lstrlenW (lpString=".jpg") returned 4 [0193.019] lstrcmpiW (lpString1=".jpg", lpString2=".bin") returned 1 [0193.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.019] lstrlenW (lpString=".doc") returned 4 [0193.019] lstrcmpiW (lpString1=".doc", lpString2=".bin") returned 1 [0193.019] lstrlenW (lpString=".docx") returned 5 [0193.019] lstrcmpiW (lpString1=".docx", lpString2="e.bin") returned -1 [0193.019] lstrlenW (lpString=".pdf") returned 4 [0193.019] lstrcmpiW (lpString1=".pdf", lpString2=".bin") returned 1 [0193.019] lstrlenW (lpString=".xls") returned 4 [0193.020] lstrcmpiW (lpString1=".xls", lpString2=".bin") returned 1 [0193.020] lstrlenW (lpString=".xlsx") returned 5 [0193.020] lstrcmpiW (lpString1=".xlsx", lpString2="e.bin") returned -1 [0193.020] lstrlenW (lpString=".ppt") returned 4 [0193.020] lstrcmpiW (lpString1=".ppt", lpString2=".bin") returned 1 [0193.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.020] lstrlenW (lpString=".zip") returned 4 [0193.020] lstrcmpiW (lpString1=".zip", lpString2=".bin") returned 1 [0193.020] lstrlenW (lpString=".rar") returned 4 [0193.020] lstrcmpiW (lpString1=".rar", lpString2=".bin") returned 1 [0193.020] lstrlenW (lpString=".bz2") returned 4 [0193.020] lstrcmpiW (lpString1=".bz2", lpString2=".bin") returned 1 [0193.020] lstrlenW (lpString=".7z") returned 3 [0193.020] lstrcmpiW (lpString1=".7z", lpString2="bin") returned -1 [0193.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.020] lstrlenW (lpString=".dbf") returned 4 [0193.020] lstrcmpiW (lpString1=".dbf", lpString2=".bin") returned 1 [0193.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.020] lstrlenW (lpString=".1cd") returned 4 [0193.020] lstrcmpiW (lpString1=".1cd", lpString2=".bin") returned -1 [0193.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\UserCache.bin") returned 76 [0193.020] lstrlenW (lpString=".jpg") returned 4 [0193.020] lstrcmpiW (lpString1=".jpg", lpString2=".bin") returned 1 [0193.020] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0193.020] lstrlenW (lpString="main.js") returned 7 [0193.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.021] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=95) returned 1 [0193.021] CloseHandle (hObject=0x35c) returned 1 [0193.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 0x2020 [0193.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.021] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.021] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.021] GetLastError () returned 0x0 [0193.021] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x5f, lpOverlapped=0x0) returned 1 [0193.022] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x60, lpOverlapped=0x0) returned 1 [0193.023] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.023] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0193.023] SetEndOfFile (hFile=0x358) returned 1 [0193.023] CloseHandle (hObject=0x358) returned 1 [0193.024] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.024] SetEndOfFile (hFile=0x35c) returned 1 [0193.024] CloseHandle (hObject=0x35c) returned 1 [0193.024] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.025] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js")) returned 1 [0193.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.025] lstrlenW (lpString=".doc") returned 4 [0193.025] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0193.025] lstrlenW (lpString=".docx") returned 5 [0193.025] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0193.025] lstrlenW (lpString=".pdf") returned 4 [0193.025] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0193.025] lstrlenW (lpString=".xls") returned 4 [0193.025] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0193.025] lstrlenW (lpString=".xlsx") returned 5 [0193.025] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0193.025] lstrlenW (lpString=".ppt") returned 4 [0193.025] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0193.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.025] lstrlenW (lpString=".zip") returned 4 [0193.025] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0193.025] lstrlenW (lpString=".rar") returned 4 [0193.025] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0193.025] lstrlenW (lpString=".bz2") returned 4 [0193.025] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0193.025] lstrlenW (lpString=".7z") returned 3 [0193.025] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0193.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.026] lstrlenW (lpString=".dbf") returned 4 [0193.026] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0193.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.026] lstrlenW (lpString=".1cd") returned 4 [0193.026] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0193.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.026] lstrlenW (lpString=".jpg") returned 4 [0193.026] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0193.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.026] lstrlenW (lpString=".doc") returned 4 [0193.026] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0193.026] lstrlenW (lpString=".docx") returned 5 [0193.026] lstrcmpiW (lpString1=".docx", lpString2="in.js") returned -1 [0193.026] lstrlenW (lpString=".pdf") returned 4 [0193.026] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0193.026] lstrlenW (lpString=".xls") returned 4 [0193.026] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0193.026] lstrlenW (lpString=".xlsx") returned 5 [0193.026] lstrcmpiW (lpString1=".xlsx", lpString2="in.js") returned -1 [0193.026] lstrlenW (lpString=".ppt") returned 4 [0193.026] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0193.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.026] lstrlenW (lpString=".zip") returned 4 [0193.026] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0193.026] lstrlenW (lpString=".rar") returned 4 [0193.026] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0193.026] lstrlenW (lpString=".bz2") returned 4 [0193.026] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0193.026] lstrlenW (lpString=".7z") returned 3 [0193.026] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0193.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.026] lstrlenW (lpString=".dbf") returned 4 [0193.027] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0193.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.027] lstrlenW (lpString=".1cd") returned 4 [0193.027] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0193.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.js") returned 133 [0193.027] lstrlenW (lpString=".jpg") returned 4 [0193.027] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0193.027] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.027] lstrlenW (lpString="manifest.json") returned 13 [0193.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.027] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=725) returned 1 [0193.027] CloseHandle (hObject=0x35c) returned 1 [0193.027] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 0x2020 [0193.027] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.028] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.028] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.028] GetLastError () returned 0x0 [0193.028] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2d5, lpOverlapped=0x0) returned 1 [0193.030] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0193.031] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.031] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.031] SetEndOfFile (hFile=0x358) returned 1 [0193.031] CloseHandle (hObject=0x358) returned 1 [0193.031] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.031] SetEndOfFile (hFile=0x35c) returned 1 [0193.032] CloseHandle (hObject=0x35c) returned 1 [0193.032] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.032] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json")) returned 1 [0193.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.033] lstrlenW (lpString=".doc") returned 4 [0193.033] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.033] lstrlenW (lpString=".docx") returned 5 [0193.033] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.033] lstrlenW (lpString=".pdf") returned 4 [0193.033] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.033] lstrlenW (lpString=".xls") returned 4 [0193.033] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.033] lstrlenW (lpString=".xlsx") returned 5 [0193.033] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.033] lstrlenW (lpString=".ppt") returned 4 [0193.033] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.033] lstrlenW (lpString=".zip") returned 4 [0193.033] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.033] lstrlenW (lpString=".rar") returned 4 [0193.033] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.033] lstrlenW (lpString=".bz2") returned 4 [0193.033] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.033] lstrlenW (lpString=".7z") returned 3 [0193.033] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.033] lstrlenW (lpString=".dbf") returned 4 [0193.033] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.033] lstrlenW (lpString=".1cd") returned 4 [0193.033] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.033] lstrlenW (lpString=".jpg") returned 4 [0193.033] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.034] lstrlenW (lpString=".doc") returned 4 [0193.034] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.034] lstrlenW (lpString=".docx") returned 5 [0193.034] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.034] lstrlenW (lpString=".pdf") returned 4 [0193.034] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.034] lstrlenW (lpString=".xls") returned 4 [0193.034] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.034] lstrlenW (lpString=".xlsx") returned 5 [0193.034] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.034] lstrlenW (lpString=".ppt") returned 4 [0193.034] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.034] lstrlenW (lpString=".zip") returned 4 [0193.034] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.034] lstrlenW (lpString=".rar") returned 4 [0193.034] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.034] lstrlenW (lpString=".bz2") returned 4 [0193.034] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.034] lstrlenW (lpString=".7z") returned 3 [0193.034] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.034] lstrlenW (lpString=".dbf") returned 4 [0193.034] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.034] lstrlenW (lpString=".1cd") returned 4 [0193.034] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\manifest.json") returned 139 [0193.034] lstrlenW (lpString=".jpg") returned 4 [0193.034] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.035] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.035] lstrlenW (lpString="messages.json") returned 13 [0193.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.036] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=257) returned 1 [0193.036] CloseHandle (hObject=0x35c) returned 1 [0193.036] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 0x2020 [0193.036] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.036] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.036] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.036] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.037] GetLastError () returned 0x0 [0193.037] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x101, lpOverlapped=0x0) returned 1 [0193.038] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x110, lpOverlapped=0x0) returned 1 [0193.038] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.038] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.039] SetEndOfFile (hFile=0x358) returned 1 [0193.039] CloseHandle (hObject=0x358) returned 1 [0193.039] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.039] SetEndOfFile (hFile=0x35c) returned 1 [0193.040] CloseHandle (hObject=0x35c) returned 1 [0193.040] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.040] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0193.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.040] lstrlenW (lpString=".doc") returned 4 [0193.040] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.040] lstrlenW (lpString=".docx") returned 5 [0193.040] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.040] lstrlenW (lpString=".pdf") returned 4 [0193.040] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.040] lstrlenW (lpString=".xls") returned 4 [0193.040] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.040] lstrlenW (lpString=".xlsx") returned 5 [0193.040] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.040] lstrlenW (lpString=".ppt") returned 4 [0193.040] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.041] lstrlenW (lpString=".zip") returned 4 [0193.041] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.041] lstrlenW (lpString=".rar") returned 4 [0193.041] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.041] lstrlenW (lpString=".bz2") returned 4 [0193.041] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.041] lstrlenW (lpString=".7z") returned 3 [0193.041] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.041] lstrlenW (lpString=".dbf") returned 4 [0193.041] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.041] lstrlenW (lpString=".1cd") returned 4 [0193.041] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.041] lstrlenW (lpString=".jpg") returned 4 [0193.041] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.041] lstrlenW (lpString=".doc") returned 4 [0193.041] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.041] lstrlenW (lpString=".docx") returned 5 [0193.041] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.041] lstrlenW (lpString=".pdf") returned 4 [0193.041] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.041] lstrlenW (lpString=".xls") returned 4 [0193.041] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.041] lstrlenW (lpString=".xlsx") returned 5 [0193.041] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.041] lstrlenW (lpString=".ppt") returned 4 [0193.041] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.041] lstrlenW (lpString=".zip") returned 4 [0193.041] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.042] lstrlenW (lpString=".rar") returned 4 [0193.042] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.042] lstrlenW (lpString=".bz2") returned 4 [0193.042] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.042] lstrlenW (lpString=".7z") returned 3 [0193.042] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.042] lstrlenW (lpString=".dbf") returned 4 [0193.042] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.042] lstrlenW (lpString=".1cd") returned 4 [0193.042] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.042] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.042] lstrlenW (lpString=".jpg") returned 4 [0193.042] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.042] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.042] lstrlenW (lpString="messages.json") returned 13 [0193.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.043] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=272) returned 1 [0193.043] CloseHandle (hObject=0x35c) returned 1 [0193.043] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 0x2020 [0193.043] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.043] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.043] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.043] GetLastError () returned 0x0 [0193.043] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x110, lpOverlapped=0x0) returned 1 [0193.044] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x120, lpOverlapped=0x0) returned 1 [0193.045] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.045] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.046] SetEndOfFile (hFile=0x358) returned 1 [0193.046] CloseHandle (hObject=0x358) returned 1 [0193.046] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.046] SetEndOfFile (hFile=0x35c) returned 1 [0193.047] CloseHandle (hObject=0x35c) returned 1 [0193.047] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.047] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0193.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.048] lstrlenW (lpString=".doc") returned 4 [0193.048] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.048] lstrlenW (lpString=".docx") returned 5 [0193.048] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.048] lstrlenW (lpString=".pdf") returned 4 [0193.048] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.048] lstrlenW (lpString=".xls") returned 4 [0193.048] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.048] lstrlenW (lpString=".xlsx") returned 5 [0193.048] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.048] lstrlenW (lpString=".ppt") returned 4 [0193.048] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.048] lstrlenW (lpString=".zip") returned 4 [0193.048] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.048] lstrlenW (lpString=".rar") returned 4 [0193.048] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.048] lstrlenW (lpString=".bz2") returned 4 [0193.048] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.048] lstrlenW (lpString=".7z") returned 3 [0193.048] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.048] lstrlenW (lpString=".dbf") returned 4 [0193.048] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.048] lstrlenW (lpString=".1cd") returned 4 [0193.048] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.048] lstrlenW (lpString=".jpg") returned 4 [0193.048] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.049] lstrlenW (lpString=".doc") returned 4 [0193.049] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.049] lstrlenW (lpString=".docx") returned 5 [0193.049] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.049] lstrlenW (lpString=".pdf") returned 4 [0193.049] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.049] lstrlenW (lpString=".xls") returned 4 [0193.049] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.049] lstrlenW (lpString=".xlsx") returned 5 [0193.049] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.049] lstrlenW (lpString=".ppt") returned 4 [0193.049] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.049] lstrlenW (lpString=".zip") returned 4 [0193.049] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.049] lstrlenW (lpString=".rar") returned 4 [0193.049] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.049] lstrlenW (lpString=".bz2") returned 4 [0193.049] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.049] lstrlenW (lpString=".7z") returned 3 [0193.049] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.049] lstrlenW (lpString=".dbf") returned 4 [0193.049] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.049] lstrlenW (lpString=".1cd") returned 4 [0193.049] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.049] lstrlenW (lpString=".jpg") returned 4 [0193.049] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.050] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.050] lstrlenW (lpString="messages.json") returned 13 [0193.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.050] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=224) returned 1 [0193.050] CloseHandle (hObject=0x35c) returned 1 [0193.050] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 0x2020 [0193.050] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.050] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.050] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.051] GetLastError () returned 0x0 [0193.051] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xe0, lpOverlapped=0x0) returned 1 [0193.052] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.053] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.053] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.053] SetEndOfFile (hFile=0x358) returned 1 [0193.053] CloseHandle (hObject=0x358) returned 1 [0193.053] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.053] SetEndOfFile (hFile=0x35c) returned 1 [0193.054] CloseHandle (hObject=0x35c) returned 1 [0193.054] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.054] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0193.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.054] lstrlenW (lpString=".doc") returned 4 [0193.054] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.054] lstrlenW (lpString=".docx") returned 5 [0193.054] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.054] lstrlenW (lpString=".pdf") returned 4 [0193.054] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.054] lstrlenW (lpString=".xls") returned 4 [0193.054] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.054] lstrlenW (lpString=".xlsx") returned 5 [0193.054] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.054] lstrlenW (lpString=".ppt") returned 4 [0193.054] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.054] lstrlenW (lpString=".zip") returned 4 [0193.054] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.054] lstrlenW (lpString=".rar") returned 4 [0193.055] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.055] lstrlenW (lpString=".bz2") returned 4 [0193.055] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.055] lstrlenW (lpString=".7z") returned 3 [0193.055] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.055] lstrlenW (lpString=".dbf") returned 4 [0193.055] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.055] lstrlenW (lpString=".1cd") returned 4 [0193.055] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.055] lstrlenW (lpString=".jpg") returned 4 [0193.055] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.055] lstrlenW (lpString=".doc") returned 4 [0193.055] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.055] lstrlenW (lpString=".docx") returned 5 [0193.055] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.055] lstrlenW (lpString=".pdf") returned 4 [0193.055] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.055] lstrlenW (lpString=".xls") returned 4 [0193.055] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.055] lstrlenW (lpString=".xlsx") returned 5 [0193.055] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.055] lstrlenW (lpString=".ppt") returned 4 [0193.055] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.055] lstrlenW (lpString=".zip") returned 4 [0193.055] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.055] lstrlenW (lpString=".rar") returned 4 [0193.055] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.056] lstrlenW (lpString=".bz2") returned 4 [0193.056] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.056] lstrlenW (lpString=".7z") returned 3 [0193.056] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.056] lstrlenW (lpString=".dbf") returned 4 [0193.056] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.056] lstrlenW (lpString=".1cd") returned 4 [0193.056] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.056] lstrlenW (lpString=".jpg") returned 4 [0193.056] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.056] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.056] lstrlenW (lpString="messages.json") returned 13 [0193.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.056] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=224) returned 1 [0193.056] CloseHandle (hObject=0x35c) returned 1 [0193.057] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 0x2020 [0193.057] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.057] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.057] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.057] GetLastError () returned 0x0 [0193.057] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xe0, lpOverlapped=0x0) returned 1 [0193.058] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.059] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.059] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.059] SetEndOfFile (hFile=0x358) returned 1 [0193.060] CloseHandle (hObject=0x358) returned 1 [0193.060] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.060] SetEndOfFile (hFile=0x35c) returned 1 [0193.060] CloseHandle (hObject=0x35c) returned 1 [0193.060] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.061] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0193.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.061] lstrlenW (lpString=".doc") returned 4 [0193.061] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.061] lstrlenW (lpString=".docx") returned 5 [0193.061] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.061] lstrlenW (lpString=".pdf") returned 4 [0193.061] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.061] lstrlenW (lpString=".xls") returned 4 [0193.061] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.061] lstrlenW (lpString=".xlsx") returned 5 [0193.061] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.061] lstrlenW (lpString=".ppt") returned 4 [0193.061] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.061] lstrlenW (lpString=".zip") returned 4 [0193.061] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.061] lstrlenW (lpString=".rar") returned 4 [0193.061] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.061] lstrlenW (lpString=".bz2") returned 4 [0193.061] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.061] lstrlenW (lpString=".7z") returned 3 [0193.061] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.061] lstrlenW (lpString=".dbf") returned 4 [0193.061] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.062] lstrlenW (lpString=".1cd") returned 4 [0193.062] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.062] lstrlenW (lpString=".jpg") returned 4 [0193.062] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.062] lstrlenW (lpString=".doc") returned 4 [0193.062] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.062] lstrlenW (lpString=".docx") returned 5 [0193.062] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.062] lstrlenW (lpString=".pdf") returned 4 [0193.062] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.062] lstrlenW (lpString=".xls") returned 4 [0193.062] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.062] lstrlenW (lpString=".xlsx") returned 5 [0193.062] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.062] lstrlenW (lpString=".ppt") returned 4 [0193.062] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.062] lstrlenW (lpString=".zip") returned 4 [0193.062] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.062] lstrlenW (lpString=".rar") returned 4 [0193.062] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.062] lstrlenW (lpString=".bz2") returned 4 [0193.062] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.063] lstrlenW (lpString=".7z") returned 3 [0193.063] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.063] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.063] lstrlenW (lpString=".dbf") returned 4 [0193.063] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.063] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.063] lstrlenW (lpString=".1cd") returned 4 [0193.063] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.063] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.063] lstrlenW (lpString=".jpg") returned 4 [0193.063] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.063] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.063] lstrlenW (lpString="messages.json") returned 13 [0193.063] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.063] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=224) returned 1 [0193.063] CloseHandle (hObject=0x35c) returned 1 [0193.063] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 0x2020 [0193.064] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.064] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.064] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.064] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.064] GetLastError () returned 0x0 [0193.064] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xe0, lpOverlapped=0x0) returned 1 [0193.065] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.066] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.066] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.066] SetEndOfFile (hFile=0x358) returned 1 [0193.066] CloseHandle (hObject=0x358) returned 1 [0193.066] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.066] SetEndOfFile (hFile=0x35c) returned 1 [0193.067] CloseHandle (hObject=0x35c) returned 1 [0193.067] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.067] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json")) returned 1 [0193.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.067] lstrlenW (lpString=".doc") returned 4 [0193.067] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.067] lstrlenW (lpString=".docx") returned 5 [0193.068] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.068] lstrlenW (lpString=".pdf") returned 4 [0193.068] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.068] lstrlenW (lpString=".xls") returned 4 [0193.068] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.068] lstrlenW (lpString=".xlsx") returned 5 [0193.068] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.068] lstrlenW (lpString=".ppt") returned 4 [0193.068] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.068] lstrlenW (lpString=".zip") returned 4 [0193.068] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.068] lstrlenW (lpString=".rar") returned 4 [0193.068] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.068] lstrlenW (lpString=".bz2") returned 4 [0193.068] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.068] lstrlenW (lpString=".7z") returned 3 [0193.068] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.068] lstrlenW (lpString=".dbf") returned 4 [0193.068] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.068] lstrlenW (lpString=".1cd") returned 4 [0193.068] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.068] lstrlenW (lpString=".jpg") returned 4 [0193.068] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.068] lstrlenW (lpString=".doc") returned 4 [0193.068] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.068] lstrlenW (lpString=".docx") returned 5 [0193.068] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.069] lstrlenW (lpString=".pdf") returned 4 [0193.069] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.069] lstrlenW (lpString=".xls") returned 4 [0193.069] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.069] lstrlenW (lpString=".xlsx") returned 5 [0193.069] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.069] lstrlenW (lpString=".ppt") returned 4 [0193.069] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.069] lstrlenW (lpString=".zip") returned 4 [0193.069] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.069] lstrlenW (lpString=".rar") returned 4 [0193.069] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.069] lstrlenW (lpString=".bz2") returned 4 [0193.069] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.069] lstrlenW (lpString=".7z") returned 3 [0193.069] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.069] lstrlenW (lpString=".dbf") returned 4 [0193.069] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.069] lstrlenW (lpString=".1cd") returned 4 [0193.069] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.069] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\da\\messages.json") returned 151 [0193.069] lstrlenW (lpString=".jpg") returned 4 [0193.069] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.069] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.069] lstrlenW (lpString="messages.json") returned 13 [0193.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.073] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=234) returned 1 [0193.073] CloseHandle (hObject=0x35c) returned 1 [0193.073] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 0x2020 [0193.073] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.074] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.074] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.074] GetLastError () returned 0x0 [0193.074] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xea, lpOverlapped=0x0) returned 1 [0193.075] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.076] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.076] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.076] SetEndOfFile (hFile=0x358) returned 1 [0193.076] CloseHandle (hObject=0x358) returned 1 [0193.076] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.076] SetEndOfFile (hFile=0x35c) returned 1 [0193.077] CloseHandle (hObject=0x35c) returned 1 [0193.077] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.077] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json")) returned 1 [0193.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.078] lstrlenW (lpString=".doc") returned 4 [0193.078] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.078] lstrlenW (lpString=".docx") returned 5 [0193.078] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.078] lstrlenW (lpString=".pdf") returned 4 [0193.078] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.078] lstrlenW (lpString=".xls") returned 4 [0193.078] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.078] lstrlenW (lpString=".xlsx") returned 5 [0193.078] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.078] lstrlenW (lpString=".ppt") returned 4 [0193.078] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.078] lstrlenW (lpString=".zip") returned 4 [0193.078] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.078] lstrlenW (lpString=".rar") returned 4 [0193.078] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.078] lstrlenW (lpString=".bz2") returned 4 [0193.078] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.078] lstrlenW (lpString=".7z") returned 3 [0193.078] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.078] lstrlenW (lpString=".dbf") returned 4 [0193.078] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.078] lstrlenW (lpString=".1cd") returned 4 [0193.078] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.078] lstrlenW (lpString=".jpg") returned 4 [0193.078] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.079] lstrlenW (lpString=".doc") returned 4 [0193.079] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.079] lstrlenW (lpString=".docx") returned 5 [0193.079] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.079] lstrlenW (lpString=".pdf") returned 4 [0193.079] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.079] lstrlenW (lpString=".xls") returned 4 [0193.079] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.079] lstrlenW (lpString=".xlsx") returned 5 [0193.079] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.079] lstrlenW (lpString=".ppt") returned 4 [0193.079] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.079] lstrlenW (lpString=".zip") returned 4 [0193.079] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.079] lstrlenW (lpString=".rar") returned 4 [0193.079] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.079] lstrlenW (lpString=".bz2") returned 4 [0193.079] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.079] lstrlenW (lpString=".7z") returned 3 [0193.079] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.079] lstrlenW (lpString=".dbf") returned 4 [0193.079] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.079] lstrlenW (lpString=".1cd") returned 4 [0193.079] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\de\\messages.json") returned 151 [0193.079] lstrlenW (lpString=".jpg") returned 4 [0193.079] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.080] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.080] lstrlenW (lpString="messages.json") returned 13 [0193.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.080] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=274) returned 1 [0193.080] CloseHandle (hObject=0x35c) returned 1 [0193.080] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 0x2020 [0193.080] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.080] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.080] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.081] GetLastError () returned 0x0 [0193.081] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x112, lpOverlapped=0x0) returned 1 [0193.082] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x120, lpOverlapped=0x0) returned 1 [0193.082] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.082] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.083] SetEndOfFile (hFile=0x358) returned 1 [0193.083] CloseHandle (hObject=0x358) returned 1 [0193.083] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.083] SetEndOfFile (hFile=0x35c) returned 1 [0193.084] CloseHandle (hObject=0x35c) returned 1 [0193.084] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.084] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json")) returned 1 [0193.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.084] lstrlenW (lpString=".doc") returned 4 [0193.084] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.084] lstrlenW (lpString=".docx") returned 5 [0193.084] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.084] lstrlenW (lpString=".pdf") returned 4 [0193.084] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.084] lstrlenW (lpString=".xls") returned 4 [0193.084] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.084] lstrlenW (lpString=".xlsx") returned 5 [0193.084] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.085] lstrlenW (lpString=".ppt") returned 4 [0193.085] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.085] lstrlenW (lpString=".zip") returned 4 [0193.085] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.085] lstrlenW (lpString=".rar") returned 4 [0193.085] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.085] lstrlenW (lpString=".bz2") returned 4 [0193.085] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.085] lstrlenW (lpString=".7z") returned 3 [0193.085] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.085] lstrlenW (lpString=".dbf") returned 4 [0193.085] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.085] lstrlenW (lpString=".1cd") returned 4 [0193.085] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.085] lstrlenW (lpString=".jpg") returned 4 [0193.085] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.085] lstrlenW (lpString=".doc") returned 4 [0193.085] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.085] lstrlenW (lpString=".docx") returned 5 [0193.085] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.085] lstrlenW (lpString=".pdf") returned 4 [0193.085] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.085] lstrlenW (lpString=".xls") returned 4 [0193.085] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.085] lstrlenW (lpString=".xlsx") returned 5 [0193.085] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.085] lstrlenW (lpString=".ppt") returned 4 [0193.086] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.086] lstrlenW (lpString=".zip") returned 4 [0193.086] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.086] lstrlenW (lpString=".rar") returned 4 [0193.086] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.086] lstrlenW (lpString=".bz2") returned 4 [0193.086] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.086] lstrlenW (lpString=".7z") returned 3 [0193.086] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.086] lstrlenW (lpString=".dbf") returned 4 [0193.086] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.086] lstrlenW (lpString=".1cd") returned 4 [0193.086] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\el\\messages.json") returned 151 [0193.086] lstrlenW (lpString=".jpg") returned 4 [0193.086] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.086] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.086] lstrlenW (lpString="messages.json") returned 13 [0193.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.087] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=214) returned 1 [0193.087] CloseHandle (hObject=0x35c) returned 1 [0193.087] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0193.087] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.087] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.087] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.087] GetLastError () returned 0x0 [0193.087] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xd6, lpOverlapped=0x0) returned 1 [0193.088] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.089] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.089] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.089] SetEndOfFile (hFile=0x358) returned 1 [0193.090] CloseHandle (hObject=0x358) returned 1 [0193.090] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.090] SetEndOfFile (hFile=0x35c) returned 1 [0193.090] CloseHandle (hObject=0x35c) returned 1 [0193.090] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.091] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_gb\\messages.json")) returned 1 [0193.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.091] lstrlenW (lpString=".doc") returned 4 [0193.091] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.091] lstrlenW (lpString=".docx") returned 5 [0193.091] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.091] lstrlenW (lpString=".pdf") returned 4 [0193.091] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.091] lstrlenW (lpString=".xls") returned 4 [0193.091] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.091] lstrlenW (lpString=".xlsx") returned 5 [0193.091] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.091] lstrlenW (lpString=".ppt") returned 4 [0193.091] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.091] lstrlenW (lpString=".zip") returned 4 [0193.091] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.091] lstrlenW (lpString=".rar") returned 4 [0193.091] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.091] lstrlenW (lpString=".bz2") returned 4 [0193.091] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.091] lstrlenW (lpString=".7z") returned 3 [0193.091] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.091] lstrlenW (lpString=".dbf") returned 4 [0193.092] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.092] lstrlenW (lpString=".1cd") returned 4 [0193.092] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.092] lstrlenW (lpString=".jpg") returned 4 [0193.092] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.092] lstrlenW (lpString=".doc") returned 4 [0193.092] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.092] lstrlenW (lpString=".docx") returned 5 [0193.092] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.092] lstrlenW (lpString=".pdf") returned 4 [0193.092] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.092] lstrlenW (lpString=".xls") returned 4 [0193.092] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.092] lstrlenW (lpString=".xlsx") returned 5 [0193.092] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.092] lstrlenW (lpString=".ppt") returned 4 [0193.092] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.092] lstrlenW (lpString=".zip") returned 4 [0193.092] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.092] lstrlenW (lpString=".rar") returned 4 [0193.092] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.092] lstrlenW (lpString=".bz2") returned 4 [0193.092] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.092] lstrlenW (lpString=".7z") returned 3 [0193.092] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.092] lstrlenW (lpString=".dbf") returned 4 [0193.092] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.093] lstrlenW (lpString=".1cd") returned 4 [0193.093] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_GB\\messages.json") returned 154 [0193.093] lstrlenW (lpString=".jpg") returned 4 [0193.093] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.093] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.093] lstrlenW (lpString="messages.json") returned 13 [0193.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.093] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=215) returned 1 [0193.093] CloseHandle (hObject=0x35c) returned 1 [0193.094] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0193.094] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.094] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.094] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.094] GetLastError () returned 0x0 [0193.094] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xd7, lpOverlapped=0x0) returned 1 [0193.095] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.096] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.096] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.096] SetEndOfFile (hFile=0x358) returned 1 [0193.096] CloseHandle (hObject=0x358) returned 1 [0193.096] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.096] SetEndOfFile (hFile=0x35c) returned 1 [0193.097] CloseHandle (hObject=0x35c) returned 1 [0193.097] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.097] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0193.098] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.098] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.098] lstrlenW (lpString=".doc") returned 4 [0193.098] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.098] lstrlenW (lpString=".docx") returned 5 [0193.098] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.098] lstrlenW (lpString=".pdf") returned 4 [0193.098] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.098] lstrlenW (lpString=".xls") returned 4 [0193.098] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.098] lstrlenW (lpString=".xlsx") returned 5 [0193.098] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.098] lstrlenW (lpString=".ppt") returned 4 [0193.098] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.098] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.098] lstrlenW (lpString=".zip") returned 4 [0193.098] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.098] lstrlenW (lpString=".rar") returned 4 [0193.098] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.098] lstrlenW (lpString=".bz2") returned 4 [0193.098] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.098] lstrlenW (lpString=".7z") returned 3 [0193.098] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.098] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.098] lstrlenW (lpString=".dbf") returned 4 [0193.098] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.098] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.098] lstrlenW (lpString=".1cd") returned 4 [0193.098] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.098] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.098] lstrlenW (lpString=".jpg") returned 4 [0193.098] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.099] lstrlenW (lpString=".doc") returned 4 [0193.099] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.099] lstrlenW (lpString=".docx") returned 5 [0193.099] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.099] lstrlenW (lpString=".pdf") returned 4 [0193.099] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.099] lstrlenW (lpString=".xls") returned 4 [0193.099] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.099] lstrlenW (lpString=".xlsx") returned 5 [0193.099] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.099] lstrlenW (lpString=".ppt") returned 4 [0193.099] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.099] lstrlenW (lpString=".zip") returned 4 [0193.099] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.099] lstrlenW (lpString=".rar") returned 4 [0193.099] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.099] lstrlenW (lpString=".bz2") returned 4 [0193.099] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.099] lstrlenW (lpString=".7z") returned 3 [0193.099] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.099] lstrlenW (lpString=".dbf") returned 4 [0193.099] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.099] lstrlenW (lpString=".1cd") returned 4 [0193.099] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.099] lstrlenW (lpString=".jpg") returned 4 [0193.099] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.100] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.100] lstrlenW (lpString="messages.json") returned 13 [0193.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.100] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=223) returned 1 [0193.100] CloseHandle (hObject=0x35c) returned 1 [0193.100] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 0x2020 [0193.100] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.100] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.100] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.103] GetLastError () returned 0x0 [0193.103] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xdf, lpOverlapped=0x0) returned 1 [0193.104] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.105] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.105] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.105] SetEndOfFile (hFile=0x358) returned 1 [0193.105] CloseHandle (hObject=0x358) returned 1 [0193.105] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.105] SetEndOfFile (hFile=0x35c) returned 1 [0193.106] CloseHandle (hObject=0x35c) returned 1 [0193.106] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.106] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0193.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.106] lstrlenW (lpString=".doc") returned 4 [0193.106] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.106] lstrlenW (lpString=".docx") returned 5 [0193.106] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.106] lstrlenW (lpString=".pdf") returned 4 [0193.106] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.106] lstrlenW (lpString=".xls") returned 4 [0193.106] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.106] lstrlenW (lpString=".xlsx") returned 5 [0193.106] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.106] lstrlenW (lpString=".ppt") returned 4 [0193.106] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.107] lstrlenW (lpString=".zip") returned 4 [0193.107] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.107] lstrlenW (lpString=".rar") returned 4 [0193.107] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.107] lstrlenW (lpString=".bz2") returned 4 [0193.107] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.107] lstrlenW (lpString=".7z") returned 3 [0193.107] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.107] lstrlenW (lpString=".dbf") returned 4 [0193.107] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.107] lstrlenW (lpString=".1cd") returned 4 [0193.107] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.107] lstrlenW (lpString=".jpg") returned 4 [0193.107] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.107] lstrlenW (lpString=".doc") returned 4 [0193.107] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.107] lstrlenW (lpString=".docx") returned 5 [0193.107] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.107] lstrlenW (lpString=".pdf") returned 4 [0193.107] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.107] lstrlenW (lpString=".xls") returned 4 [0193.107] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.107] lstrlenW (lpString=".xlsx") returned 5 [0193.107] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.107] lstrlenW (lpString=".ppt") returned 4 [0193.107] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.107] lstrlenW (lpString=".zip") returned 4 [0193.108] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.108] lstrlenW (lpString=".rar") returned 4 [0193.108] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.108] lstrlenW (lpString=".bz2") returned 4 [0193.108] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.108] lstrlenW (lpString=".7z") returned 3 [0193.108] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.108] lstrlenW (lpString=".dbf") returned 4 [0193.108] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.108] lstrlenW (lpString=".1cd") returned 4 [0193.108] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.108] lstrlenW (lpString=".jpg") returned 4 [0193.108] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.108] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.108] lstrlenW (lpString="messages.json") returned 13 [0193.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.268] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=221) returned 1 [0193.268] CloseHandle (hObject=0x35c) returned 1 [0193.269] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0193.269] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.269] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.269] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0193.270] GetLastError () returned 0x0 [0193.270] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xdd, lpOverlapped=0x0) returned 1 [0193.271] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.277] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.277] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.277] SetEndOfFile (hFile=0x114) returned 1 [0193.277] CloseHandle (hObject=0x114) returned 1 [0193.277] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.277] SetEndOfFile (hFile=0x35c) returned 1 [0193.278] CloseHandle (hObject=0x35c) returned 1 [0193.278] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.278] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0193.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.278] lstrlenW (lpString=".doc") returned 4 [0193.279] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.279] lstrlenW (lpString=".docx") returned 5 [0193.279] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.279] lstrlenW (lpString=".pdf") returned 4 [0193.279] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.279] lstrlenW (lpString=".xls") returned 4 [0193.279] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.279] lstrlenW (lpString=".xlsx") returned 5 [0193.279] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.279] lstrlenW (lpString=".ppt") returned 4 [0193.279] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.279] lstrlenW (lpString=".zip") returned 4 [0193.279] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.279] lstrlenW (lpString=".rar") returned 4 [0193.279] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.279] lstrlenW (lpString=".bz2") returned 4 [0193.279] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.279] lstrlenW (lpString=".7z") returned 3 [0193.279] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.279] lstrlenW (lpString=".dbf") returned 4 [0193.279] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.279] lstrlenW (lpString=".1cd") returned 4 [0193.279] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.279] lstrlenW (lpString=".jpg") returned 4 [0193.279] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.279] lstrlenW (lpString=".doc") returned 4 [0193.280] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.280] lstrlenW (lpString=".docx") returned 5 [0193.280] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.280] lstrlenW (lpString=".pdf") returned 4 [0193.280] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.280] lstrlenW (lpString=".xls") returned 4 [0193.280] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.280] lstrlenW (lpString=".xlsx") returned 5 [0193.280] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.280] lstrlenW (lpString=".ppt") returned 4 [0193.280] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.280] lstrlenW (lpString=".zip") returned 4 [0193.280] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.280] lstrlenW (lpString=".rar") returned 4 [0193.280] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.280] lstrlenW (lpString=".bz2") returned 4 [0193.280] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.280] lstrlenW (lpString=".7z") returned 3 [0193.282] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.282] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.282] lstrlenW (lpString=".dbf") returned 4 [0193.282] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.282] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.282] lstrlenW (lpString=".1cd") returned 4 [0193.282] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.282] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.282] lstrlenW (lpString=".jpg") returned 4 [0193.282] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.282] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.282] lstrlenW (lpString="messages.json") returned 13 [0193.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.283] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=230) returned 1 [0193.283] CloseHandle (hObject=0x35c) returned 1 [0193.283] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 0x2020 [0193.283] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.283] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.283] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0193.284] GetLastError () returned 0x0 [0193.284] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xe6, lpOverlapped=0x0) returned 1 [0193.285] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.286] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.286] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.286] SetEndOfFile (hFile=0x114) returned 1 [0193.286] CloseHandle (hObject=0x114) returned 1 [0193.286] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.286] SetEndOfFile (hFile=0x35c) returned 1 [0193.287] CloseHandle (hObject=0x35c) returned 1 [0193.287] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.287] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0193.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.287] lstrlenW (lpString=".doc") returned 4 [0193.287] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.287] lstrlenW (lpString=".docx") returned 5 [0193.287] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.287] lstrlenW (lpString=".pdf") returned 4 [0193.287] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.287] lstrlenW (lpString=".xls") returned 4 [0193.287] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.287] lstrlenW (lpString=".xlsx") returned 5 [0193.287] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.287] lstrlenW (lpString=".ppt") returned 4 [0193.287] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.287] lstrlenW (lpString=".zip") returned 4 [0193.287] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.288] lstrlenW (lpString=".rar") returned 4 [0193.288] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.288] lstrlenW (lpString=".bz2") returned 4 [0193.288] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.288] lstrlenW (lpString=".7z") returned 3 [0193.288] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.288] lstrlenW (lpString=".dbf") returned 4 [0193.288] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.288] lstrlenW (lpString=".1cd") returned 4 [0193.288] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.288] lstrlenW (lpString=".jpg") returned 4 [0193.288] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.288] lstrlenW (lpString=".doc") returned 4 [0193.288] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.288] lstrlenW (lpString=".docx") returned 5 [0193.288] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.288] lstrlenW (lpString=".pdf") returned 4 [0193.288] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.288] lstrlenW (lpString=".xls") returned 4 [0193.288] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.288] lstrlenW (lpString=".xlsx") returned 5 [0193.288] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.288] lstrlenW (lpString=".ppt") returned 4 [0193.288] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.288] lstrlenW (lpString=".zip") returned 4 [0193.288] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.288] lstrlenW (lpString=".rar") returned 4 [0193.289] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.289] lstrlenW (lpString=".bz2") returned 4 [0193.289] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.289] lstrlenW (lpString=".7z") returned 3 [0193.289] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.289] lstrlenW (lpString=".dbf") returned 4 [0193.289] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.289] lstrlenW (lpString=".1cd") returned 4 [0193.289] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.289] lstrlenW (lpString=".jpg") returned 4 [0193.289] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.289] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.289] lstrlenW (lpString="messages.json") returned 13 [0193.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.289] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=228) returned 1 [0193.290] CloseHandle (hObject=0x35c) returned 1 [0193.290] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 0x2020 [0193.290] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.290] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.290] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0193.290] GetLastError () returned 0x0 [0193.290] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xe4, lpOverlapped=0x0) returned 1 [0193.292] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.293] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.293] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.293] SetEndOfFile (hFile=0x114) returned 1 [0193.293] CloseHandle (hObject=0x114) returned 1 [0193.293] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.293] SetEndOfFile (hFile=0x35c) returned 1 [0193.294] CloseHandle (hObject=0x35c) returned 1 [0193.294] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.294] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0193.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.294] lstrlenW (lpString=".doc") returned 4 [0193.294] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.294] lstrlenW (lpString=".docx") returned 5 [0193.294] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.294] lstrlenW (lpString=".pdf") returned 4 [0193.294] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.294] lstrlenW (lpString=".xls") returned 4 [0193.294] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.294] lstrlenW (lpString=".xlsx") returned 5 [0193.295] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.295] lstrlenW (lpString=".ppt") returned 4 [0193.295] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.295] lstrlenW (lpString=".zip") returned 4 [0193.295] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.295] lstrlenW (lpString=".rar") returned 4 [0193.295] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.295] lstrlenW (lpString=".bz2") returned 4 [0193.295] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.295] lstrlenW (lpString=".7z") returned 3 [0193.295] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.295] lstrlenW (lpString=".dbf") returned 4 [0193.295] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.295] lstrlenW (lpString=".1cd") returned 4 [0193.295] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.295] lstrlenW (lpString=".jpg") returned 4 [0193.295] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.295] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.295] lstrlenW (lpString=".doc") returned 4 [0193.295] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.295] lstrlenW (lpString=".docx") returned 5 [0193.295] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.295] lstrlenW (lpString=".pdf") returned 4 [0193.295] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.295] lstrlenW (lpString=".xls") returned 4 [0193.295] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.295] lstrlenW (lpString=".xlsx") returned 5 [0193.295] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.296] lstrlenW (lpString=".ppt") returned 4 [0193.296] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.296] lstrlenW (lpString=".zip") returned 4 [0193.296] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.296] lstrlenW (lpString=".rar") returned 4 [0193.296] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.296] lstrlenW (lpString=".bz2") returned 4 [0193.296] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.296] lstrlenW (lpString=".7z") returned 3 [0193.296] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.296] lstrlenW (lpString=".dbf") returned 4 [0193.296] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.296] lstrlenW (lpString=".1cd") returned 4 [0193.296] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.296] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.296] lstrlenW (lpString=".jpg") returned 4 [0193.296] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.296] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.296] lstrlenW (lpString="messages.json") returned 13 [0193.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.297] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=233) returned 1 [0193.297] CloseHandle (hObject=0x35c) returned 1 [0193.297] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 0x2020 [0193.297] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.297] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.297] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.297] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0193.298] GetLastError () returned 0x0 [0193.298] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xe9, lpOverlapped=0x0) returned 1 [0193.299] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.300] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.300] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.300] SetEndOfFile (hFile=0x114) returned 1 [0193.300] CloseHandle (hObject=0x114) returned 1 [0193.300] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.300] SetEndOfFile (hFile=0x35c) returned 1 [0193.301] CloseHandle (hObject=0x35c) returned 1 [0193.301] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.301] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0193.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.301] lstrlenW (lpString=".doc") returned 4 [0193.301] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.301] lstrlenW (lpString=".docx") returned 5 [0193.301] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.301] lstrlenW (lpString=".pdf") returned 4 [0193.301] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.301] lstrlenW (lpString=".xls") returned 4 [0193.301] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.301] lstrlenW (lpString=".xlsx") returned 5 [0193.301] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.301] lstrlenW (lpString=".ppt") returned 4 [0193.301] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.302] lstrlenW (lpString=".zip") returned 4 [0193.302] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.302] lstrlenW (lpString=".rar") returned 4 [0193.302] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.302] lstrlenW (lpString=".bz2") returned 4 [0193.302] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.302] lstrlenW (lpString=".7z") returned 3 [0193.302] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.302] lstrlenW (lpString=".dbf") returned 4 [0193.302] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.302] lstrlenW (lpString=".1cd") returned 4 [0193.302] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.302] lstrlenW (lpString=".jpg") returned 4 [0193.302] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.302] lstrlenW (lpString=".doc") returned 4 [0193.302] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.302] lstrlenW (lpString=".docx") returned 5 [0193.302] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.302] lstrlenW (lpString=".pdf") returned 4 [0193.302] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.302] lstrlenW (lpString=".xls") returned 4 [0193.302] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.302] lstrlenW (lpString=".xlsx") returned 5 [0193.302] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.302] lstrlenW (lpString=".ppt") returned 4 [0193.302] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.303] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.303] lstrlenW (lpString=".zip") returned 4 [0193.303] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.303] lstrlenW (lpString=".rar") returned 4 [0193.303] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.303] lstrlenW (lpString=".bz2") returned 4 [0193.303] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.303] lstrlenW (lpString=".7z") returned 3 [0193.303] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.303] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.303] lstrlenW (lpString=".dbf") returned 4 [0193.303] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.303] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.303] lstrlenW (lpString=".1cd") returned 4 [0193.303] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.303] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.303] lstrlenW (lpString=".jpg") returned 4 [0193.303] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.303] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.303] lstrlenW (lpString="messages.json") returned 13 [0193.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.304] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=210) returned 1 [0193.304] CloseHandle (hObject=0x35c) returned 1 [0193.304] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 0x2020 [0193.304] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.304] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.304] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0193.304] GetLastError () returned 0x0 [0193.304] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xd2, lpOverlapped=0x0) returned 1 [0193.463] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.464] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.464] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.464] SetEndOfFile (hFile=0x114) returned 1 [0193.464] CloseHandle (hObject=0x114) returned 1 [0193.464] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.464] SetEndOfFile (hFile=0x35c) returned 1 [0193.465] CloseHandle (hObject=0x35c) returned 1 [0193.465] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.465] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0193.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.465] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.465] lstrlenW (lpString=".doc") returned 4 [0193.465] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.465] lstrlenW (lpString=".docx") returned 5 [0193.465] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.465] lstrlenW (lpString=".pdf") returned 4 [0193.466] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.466] lstrlenW (lpString=".xls") returned 4 [0193.466] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.466] lstrlenW (lpString=".xlsx") returned 5 [0193.466] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.466] lstrlenW (lpString=".ppt") returned 4 [0193.466] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.466] lstrlenW (lpString=".zip") returned 4 [0193.466] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.466] lstrlenW (lpString=".rar") returned 4 [0193.466] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.466] lstrlenW (lpString=".bz2") returned 4 [0193.466] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.466] lstrlenW (lpString=".7z") returned 3 [0193.466] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.466] lstrlenW (lpString=".dbf") returned 4 [0193.466] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.466] lstrlenW (lpString=".1cd") returned 4 [0193.466] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.466] lstrlenW (lpString=".jpg") returned 4 [0193.466] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.466] lstrlenW (lpString=".doc") returned 4 [0193.466] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.466] lstrlenW (lpString=".docx") returned 5 [0193.466] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.467] lstrlenW (lpString=".pdf") returned 4 [0193.467] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.467] lstrlenW (lpString=".xls") returned 4 [0193.467] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.467] lstrlenW (lpString=".xlsx") returned 5 [0193.467] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.467] lstrlenW (lpString=".ppt") returned 4 [0193.467] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.467] lstrlenW (lpString=".zip") returned 4 [0193.467] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.467] lstrlenW (lpString=".rar") returned 4 [0193.467] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.467] lstrlenW (lpString=".bz2") returned 4 [0193.467] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.467] lstrlenW (lpString=".7z") returned 3 [0193.467] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.467] lstrlenW (lpString=".dbf") returned 4 [0193.467] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.467] lstrlenW (lpString=".1cd") returned 4 [0193.467] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.467] lstrlenW (lpString=".jpg") returned 4 [0193.468] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.468] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.468] lstrlenW (lpString="messages.json") returned 13 [0193.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.468] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=237) returned 1 [0193.468] CloseHandle (hObject=0x35c) returned 1 [0193.468] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 0x2020 [0193.468] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.469] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.469] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0193.469] GetLastError () returned 0x0 [0193.469] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xed, lpOverlapped=0x0) returned 1 [0193.470] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.471] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.471] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.471] SetEndOfFile (hFile=0x114) returned 1 [0193.471] CloseHandle (hObject=0x114) returned 1 [0193.471] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.471] SetEndOfFile (hFile=0x35c) returned 1 [0193.472] CloseHandle (hObject=0x35c) returned 1 [0193.472] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.472] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json")) returned 1 [0193.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.472] lstrlenW (lpString=".doc") returned 4 [0193.472] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.472] lstrlenW (lpString=".docx") returned 5 [0193.472] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.472] lstrlenW (lpString=".pdf") returned 4 [0193.472] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.473] lstrlenW (lpString=".xls") returned 4 [0193.473] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.473] lstrlenW (lpString=".xlsx") returned 5 [0193.473] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.473] lstrlenW (lpString=".ppt") returned 4 [0193.473] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.473] lstrlenW (lpString=".zip") returned 4 [0193.473] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.473] lstrlenW (lpString=".rar") returned 4 [0193.473] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.473] lstrlenW (lpString=".bz2") returned 4 [0193.473] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.473] lstrlenW (lpString=".7z") returned 3 [0193.473] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.473] lstrlenW (lpString=".dbf") returned 4 [0193.473] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.473] lstrlenW (lpString=".1cd") returned 4 [0193.473] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.473] lstrlenW (lpString=".jpg") returned 4 [0193.473] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.473] lstrlenW (lpString=".doc") returned 4 [0193.473] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.473] lstrlenW (lpString=".docx") returned 5 [0193.473] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.473] lstrlenW (lpString=".pdf") returned 4 [0193.473] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.474] lstrlenW (lpString=".xls") returned 4 [0193.474] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.474] lstrlenW (lpString=".xlsx") returned 5 [0193.474] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.474] lstrlenW (lpString=".ppt") returned 4 [0193.474] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.474] lstrlenW (lpString=".zip") returned 4 [0193.474] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.474] lstrlenW (lpString=".rar") returned 4 [0193.474] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.474] lstrlenW (lpString=".bz2") returned 4 [0193.474] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.474] lstrlenW (lpString=".7z") returned 3 [0193.474] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.474] lstrlenW (lpString=".dbf") returned 4 [0193.474] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.474] lstrlenW (lpString=".1cd") returned 4 [0193.474] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.474] lstrlenW (lpString=".jpg") returned 4 [0193.474] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.474] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.474] lstrlenW (lpString="messages.json") returned 13 [0193.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.475] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=215) returned 1 [0193.475] CloseHandle (hObject=0x35c) returned 1 [0193.475] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0193.475] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.475] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.475] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0193.476] GetLastError () returned 0x0 [0193.476] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xd7, lpOverlapped=0x0) returned 1 [0193.477] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.477] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.477] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.478] SetEndOfFile (hFile=0x114) returned 1 [0193.478] CloseHandle (hObject=0x114) returned 1 [0193.478] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.478] SetEndOfFile (hFile=0x35c) returned 1 [0193.478] CloseHandle (hObject=0x35c) returned 1 [0193.479] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.479] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1 [0193.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.479] lstrlenW (lpString=".doc") returned 4 [0193.479] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.479] lstrlenW (lpString=".docx") returned 5 [0193.479] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.479] lstrlenW (lpString=".pdf") returned 4 [0193.479] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.479] lstrlenW (lpString=".xls") returned 4 [0193.479] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.479] lstrlenW (lpString=".xlsx") returned 5 [0193.479] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.479] lstrlenW (lpString=".ppt") returned 4 [0193.479] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.479] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.479] lstrlenW (lpString=".zip") returned 4 [0193.479] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.479] lstrlenW (lpString=".rar") returned 4 [0193.479] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.479] lstrlenW (lpString=".bz2") returned 4 [0193.480] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.480] lstrlenW (lpString=".7z") returned 3 [0193.480] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.480] lstrlenW (lpString=".dbf") returned 4 [0193.480] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.480] lstrlenW (lpString=".1cd") returned 4 [0193.480] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.480] lstrlenW (lpString=".jpg") returned 4 [0193.480] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.480] lstrlenW (lpString=".doc") returned 4 [0193.480] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.480] lstrlenW (lpString=".docx") returned 5 [0193.480] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.480] lstrlenW (lpString=".pdf") returned 4 [0193.480] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.480] lstrlenW (lpString=".xls") returned 4 [0193.480] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.480] lstrlenW (lpString=".xlsx") returned 5 [0193.480] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.480] lstrlenW (lpString=".ppt") returned 4 [0193.480] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.480] lstrlenW (lpString=".zip") returned 4 [0193.480] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.480] lstrlenW (lpString=".rar") returned 4 [0193.480] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.481] lstrlenW (lpString=".bz2") returned 4 [0193.481] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.481] lstrlenW (lpString=".7z") returned 3 [0193.481] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.481] lstrlenW (lpString=".dbf") returned 4 [0193.481] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.481] lstrlenW (lpString=".1cd") returned 4 [0193.481] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.481] lstrlenW (lpString=".jpg") returned 4 [0193.481] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.481] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.481] lstrlenW (lpString="messages.json") returned 13 [0193.481] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.487] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=209) returned 1 [0193.487] CloseHandle (hObject=0x35c) returned 1 [0193.487] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0193.487] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.487] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.488] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.488] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0193.488] GetLastError () returned 0x0 [0193.488] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xd1, lpOverlapped=0x0) returned 1 [0193.489] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.490] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.490] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.490] SetEndOfFile (hFile=0x114) returned 1 [0193.490] CloseHandle (hObject=0x114) returned 1 [0193.490] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.490] SetEndOfFile (hFile=0x35c) returned 1 [0193.491] CloseHandle (hObject=0x35c) returned 1 [0193.491] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.491] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1 [0193.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.491] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.491] lstrlenW (lpString=".doc") returned 4 [0193.491] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.491] lstrlenW (lpString=".docx") returned 5 [0193.491] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.492] lstrlenW (lpString=".pdf") returned 4 [0193.492] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.492] lstrlenW (lpString=".xls") returned 4 [0193.492] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.492] lstrlenW (lpString=".xlsx") returned 5 [0193.492] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.492] lstrlenW (lpString=".ppt") returned 4 [0193.492] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.492] lstrlenW (lpString=".zip") returned 4 [0193.492] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.492] lstrlenW (lpString=".rar") returned 4 [0193.492] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.492] lstrlenW (lpString=".bz2") returned 4 [0193.492] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.492] lstrlenW (lpString=".7z") returned 3 [0193.492] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.492] lstrlenW (lpString=".dbf") returned 4 [0193.492] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.492] lstrlenW (lpString=".1cd") returned 4 [0193.492] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.492] lstrlenW (lpString=".jpg") returned 4 [0193.492] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.492] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.492] lstrlenW (lpString=".doc") returned 4 [0193.492] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.492] lstrlenW (lpString=".docx") returned 5 [0193.493] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.493] lstrlenW (lpString=".pdf") returned 4 [0193.493] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.493] lstrlenW (lpString=".xls") returned 4 [0193.493] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.493] lstrlenW (lpString=".xlsx") returned 5 [0193.493] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.493] lstrlenW (lpString=".ppt") returned 4 [0193.493] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.493] lstrlenW (lpString=".zip") returned 4 [0193.493] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.493] lstrlenW (lpString=".rar") returned 4 [0193.493] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.493] lstrlenW (lpString=".bz2") returned 4 [0193.493] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.493] lstrlenW (lpString=".7z") returned 3 [0193.493] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.493] lstrlenW (lpString=".dbf") returned 4 [0193.493] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.493] lstrlenW (lpString=".1cd") returned 4 [0193.493] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0193.493] lstrlenW (lpString=".jpg") returned 4 [0193.493] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.493] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.494] lstrlenW (lpString="computed_hashes.json") returned 20 [0193.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.494] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=352) returned 1 [0193.494] CloseHandle (hObject=0x35c) returned 1 [0193.494] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0193.494] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.494] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.494] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.494] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.698] GetLastError () returned 0x0 [0193.698] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x160, lpOverlapped=0x0) returned 1 [0193.699] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x170, lpOverlapped=0x0) returned 1 [0193.700] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.700] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0193.700] SetEndOfFile (hFile=0x15c) returned 1 [0193.700] CloseHandle (hObject=0x15c) returned 1 [0193.700] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.700] SetEndOfFile (hFile=0x35c) returned 1 [0193.701] CloseHandle (hObject=0x35c) returned 1 [0193.701] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.702] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json")) returned 1 [0193.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.702] lstrlenW (lpString=".doc") returned 4 [0193.702] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.702] lstrlenW (lpString=".docx") returned 5 [0193.702] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.702] lstrlenW (lpString=".pdf") returned 4 [0193.702] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.702] lstrlenW (lpString=".xls") returned 4 [0193.702] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.702] lstrlenW (lpString=".xlsx") returned 5 [0193.702] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.702] lstrlenW (lpString=".ppt") returned 4 [0193.702] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.702] lstrlenW (lpString=".zip") returned 4 [0193.702] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.702] lstrlenW (lpString=".rar") returned 4 [0193.702] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.702] lstrlenW (lpString=".bz2") returned 4 [0193.702] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.703] lstrlenW (lpString=".7z") returned 3 [0193.703] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.703] lstrlenW (lpString=".dbf") returned 4 [0193.703] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.703] lstrlenW (lpString=".1cd") returned 4 [0193.703] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.703] lstrlenW (lpString=".jpg") returned 4 [0193.703] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.703] lstrlenW (lpString=".doc") returned 4 [0193.703] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.703] lstrlenW (lpString=".docx") returned 5 [0193.703] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.703] lstrlenW (lpString=".pdf") returned 4 [0193.703] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.703] lstrlenW (lpString=".xls") returned 4 [0193.703] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.703] lstrlenW (lpString=".xlsx") returned 5 [0193.703] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.703] lstrlenW (lpString=".ppt") returned 4 [0193.703] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.703] lstrlenW (lpString=".zip") returned 4 [0193.703] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.703] lstrlenW (lpString=".rar") returned 4 [0193.703] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.703] lstrlenW (lpString=".bz2") returned 4 [0193.704] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.704] lstrlenW (lpString=".7z") returned 3 [0193.704] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.704] lstrlenW (lpString=".dbf") returned 4 [0193.704] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.704] lstrlenW (lpString=".1cd") returned 4 [0193.704] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0193.704] lstrlenW (lpString=".jpg") returned 4 [0193.704] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.704] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.704] lstrlenW (lpString="messages.json") returned 13 [0193.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.704] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=215) returned 1 [0193.705] CloseHandle (hObject=0x35c) returned 1 [0193.705] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 0x2020 [0193.705] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.705] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.705] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.705] GetLastError () returned 0x0 [0193.705] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xd7, lpOverlapped=0x0) returned 1 [0193.706] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.707] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.707] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.708] SetEndOfFile (hFile=0x15c) returned 1 [0193.708] CloseHandle (hObject=0x15c) returned 1 [0193.708] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.708] SetEndOfFile (hFile=0x35c) returned 1 [0193.708] CloseHandle (hObject=0x35c) returned 1 [0193.709] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.709] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0193.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.709] lstrlenW (lpString=".doc") returned 4 [0193.709] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.709] lstrlenW (lpString=".docx") returned 5 [0193.709] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.709] lstrlenW (lpString=".pdf") returned 4 [0193.709] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.709] lstrlenW (lpString=".xls") returned 4 [0193.709] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.709] lstrlenW (lpString=".xlsx") returned 5 [0193.709] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.709] lstrlenW (lpString=".ppt") returned 4 [0193.709] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.709] lstrlenW (lpString=".zip") returned 4 [0193.709] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.709] lstrlenW (lpString=".rar") returned 4 [0193.709] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.709] lstrlenW (lpString=".bz2") returned 4 [0193.710] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.710] lstrlenW (lpString=".7z") returned 3 [0193.710] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.710] lstrlenW (lpString=".dbf") returned 4 [0193.710] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.710] lstrlenW (lpString=".1cd") returned 4 [0193.710] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.710] lstrlenW (lpString=".jpg") returned 4 [0193.710] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.710] lstrlenW (lpString=".doc") returned 4 [0193.710] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.710] lstrlenW (lpString=".docx") returned 5 [0193.710] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.710] lstrlenW (lpString=".pdf") returned 4 [0193.710] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.710] lstrlenW (lpString=".xls") returned 4 [0193.710] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.710] lstrlenW (lpString=".xlsx") returned 5 [0193.710] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.710] lstrlenW (lpString=".ppt") returned 4 [0193.710] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.710] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.710] lstrlenW (lpString=".zip") returned 4 [0193.710] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.710] lstrlenW (lpString=".rar") returned 4 [0193.711] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.711] lstrlenW (lpString=".bz2") returned 4 [0193.711] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.711] lstrlenW (lpString=".7z") returned 3 [0193.711] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.711] lstrlenW (lpString=".dbf") returned 4 [0193.711] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.711] lstrlenW (lpString=".1cd") returned 4 [0193.711] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.711] lstrlenW (lpString=".jpg") returned 4 [0193.711] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.711] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.711] lstrlenW (lpString="messages.json") returned 13 [0193.711] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.712] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=221) returned 1 [0193.712] CloseHandle (hObject=0x35c) returned 1 [0193.712] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 0x2020 [0193.712] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.712] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.712] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.712] GetLastError () returned 0x0 [0193.712] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xdd, lpOverlapped=0x0) returned 1 [0193.713] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.714] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.714] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.714] SetEndOfFile (hFile=0x15c) returned 1 [0193.714] CloseHandle (hObject=0x15c) returned 1 [0193.715] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.715] SetEndOfFile (hFile=0x35c) returned 1 [0193.715] CloseHandle (hObject=0x35c) returned 1 [0193.715] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.715] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0193.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.716] lstrlenW (lpString=".doc") returned 4 [0193.716] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.716] lstrlenW (lpString=".docx") returned 5 [0193.716] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.716] lstrlenW (lpString=".pdf") returned 4 [0193.716] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.716] lstrlenW (lpString=".xls") returned 4 [0193.716] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.716] lstrlenW (lpString=".xlsx") returned 5 [0193.716] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.716] lstrlenW (lpString=".ppt") returned 4 [0193.716] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.716] lstrlenW (lpString=".zip") returned 4 [0193.716] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.716] lstrlenW (lpString=".rar") returned 4 [0193.716] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.716] lstrlenW (lpString=".bz2") returned 4 [0193.716] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.716] lstrlenW (lpString=".7z") returned 3 [0193.716] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.716] lstrlenW (lpString=".dbf") returned 4 [0193.716] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.717] lstrlenW (lpString=".1cd") returned 4 [0193.717] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.717] lstrlenW (lpString=".jpg") returned 4 [0193.717] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.717] lstrlenW (lpString=".doc") returned 4 [0193.717] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.717] lstrlenW (lpString=".docx") returned 5 [0193.717] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.717] lstrlenW (lpString=".pdf") returned 4 [0193.717] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.717] lstrlenW (lpString=".xls") returned 4 [0193.717] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.717] lstrlenW (lpString=".xlsx") returned 5 [0193.717] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.717] lstrlenW (lpString=".ppt") returned 4 [0193.717] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.717] lstrlenW (lpString=".zip") returned 4 [0193.717] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.717] lstrlenW (lpString=".rar") returned 4 [0193.718] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.718] lstrlenW (lpString=".bz2") returned 4 [0193.718] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.718] lstrlenW (lpString=".7z") returned 3 [0193.718] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.718] lstrlenW (lpString=".dbf") returned 4 [0193.718] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.718] lstrlenW (lpString=".1cd") returned 4 [0193.718] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.718] lstrlenW (lpString=".jpg") returned 4 [0193.718] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.718] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.718] lstrlenW (lpString="messages.json") returned 13 [0193.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.719] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=279) returned 1 [0193.719] CloseHandle (hObject=0x35c) returned 1 [0193.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 0x2020 [0193.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.719] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.719] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.719] GetLastError () returned 0x0 [0193.720] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x117, lpOverlapped=0x0) returned 1 [0193.720] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x120, lpOverlapped=0x0) returned 1 [0193.721] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.721] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.721] SetEndOfFile (hFile=0x15c) returned 1 [0193.722] CloseHandle (hObject=0x15c) returned 1 [0193.722] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.722] SetEndOfFile (hFile=0x35c) returned 1 [0193.722] CloseHandle (hObject=0x35c) returned 1 [0193.722] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.723] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0193.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.723] lstrlenW (lpString=".doc") returned 4 [0193.723] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.723] lstrlenW (lpString=".docx") returned 5 [0193.723] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.723] lstrlenW (lpString=".pdf") returned 4 [0193.723] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.723] lstrlenW (lpString=".xls") returned 4 [0193.723] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.723] lstrlenW (lpString=".xlsx") returned 5 [0193.723] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.723] lstrlenW (lpString=".ppt") returned 4 [0193.723] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.723] lstrlenW (lpString=".zip") returned 4 [0193.723] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.723] lstrlenW (lpString=".rar") returned 4 [0193.723] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.723] lstrlenW (lpString=".bz2") returned 4 [0193.723] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.723] lstrlenW (lpString=".7z") returned 3 [0193.724] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.724] lstrlenW (lpString=".dbf") returned 4 [0193.724] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.724] lstrlenW (lpString=".1cd") returned 4 [0193.724] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.724] lstrlenW (lpString=".jpg") returned 4 [0193.724] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.724] lstrlenW (lpString=".doc") returned 4 [0193.724] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.724] lstrlenW (lpString=".docx") returned 5 [0193.724] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.724] lstrlenW (lpString=".pdf") returned 4 [0193.724] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.724] lstrlenW (lpString=".xls") returned 4 [0193.724] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.724] lstrlenW (lpString=".xlsx") returned 5 [0193.724] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.724] lstrlenW (lpString=".ppt") returned 4 [0193.724] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.724] lstrlenW (lpString=".zip") returned 4 [0193.724] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.724] lstrlenW (lpString=".rar") returned 4 [0193.724] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.724] lstrlenW (lpString=".bz2") returned 4 [0193.724] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.725] lstrlenW (lpString=".7z") returned 3 [0193.725] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.725] lstrlenW (lpString=".dbf") returned 4 [0193.725] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.725] lstrlenW (lpString=".1cd") returned 4 [0193.725] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.725] lstrlenW (lpString=".jpg") returned 4 [0193.725] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.725] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.725] lstrlenW (lpString="messages.json") returned 13 [0193.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.725] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=235) returned 1 [0193.725] CloseHandle (hObject=0x35c) returned 1 [0193.726] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 0x2020 [0193.726] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.726] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.726] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.726] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.726] GetLastError () returned 0x0 [0193.726] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xeb, lpOverlapped=0x0) returned 1 [0193.727] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.728] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0193.728] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.728] SetEndOfFile (hFile=0x15c) returned 1 [0193.730] CloseHandle (hObject=0x15c) returned 1 [0193.730] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.730] SetEndOfFile (hFile=0x35c) returned 1 [0193.731] CloseHandle (hObject=0x35c) returned 1 [0193.731] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.731] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0193.731] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.731] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.731] lstrlenW (lpString=".doc") returned 4 [0193.731] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.731] lstrlenW (lpString=".docx") returned 5 [0193.731] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.732] lstrlenW (lpString=".pdf") returned 4 [0193.732] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.732] lstrlenW (lpString=".xls") returned 4 [0193.732] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.732] lstrlenW (lpString=".xlsx") returned 5 [0193.732] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.732] lstrlenW (lpString=".ppt") returned 4 [0193.732] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.732] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.732] lstrlenW (lpString=".zip") returned 4 [0193.732] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.732] lstrlenW (lpString=".rar") returned 4 [0193.732] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.732] lstrlenW (lpString=".bz2") returned 4 [0193.732] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.732] lstrlenW (lpString=".7z") returned 3 [0193.732] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.732] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.732] lstrlenW (lpString=".dbf") returned 4 [0193.732] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.732] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.732] lstrlenW (lpString=".1cd") returned 4 [0193.732] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.732] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.732] lstrlenW (lpString=".jpg") returned 4 [0193.732] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.732] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.732] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.732] lstrlenW (lpString=".doc") returned 4 [0193.919] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.919] lstrlenW (lpString=".docx") returned 5 [0193.919] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.919] lstrlenW (lpString=".pdf") returned 4 [0193.919] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.919] lstrlenW (lpString=".xls") returned 4 [0193.919] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.919] lstrlenW (lpString=".xlsx") returned 5 [0193.919] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.919] lstrlenW (lpString=".ppt") returned 4 [0193.919] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.919] lstrlenW (lpString=".zip") returned 4 [0193.919] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.919] lstrlenW (lpString=".rar") returned 4 [0193.919] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.919] lstrlenW (lpString=".bz2") returned 4 [0193.919] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.919] lstrlenW (lpString=".7z") returned 3 [0193.919] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.919] lstrlenW (lpString=".dbf") returned 4 [0193.920] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.920] lstrlenW (lpString=".1cd") returned 4 [0193.920] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.921] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.921] lstrlenW (lpString=".jpg") returned 4 [0193.921] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.921] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.922] lstrlenW (lpString="computed_hashes.json") returned 20 [0193.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.922] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=352) returned 1 [0193.922] CloseHandle (hObject=0x35c) returned 1 [0193.922] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0193.922] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.922] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.922] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0193.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.209] GetLastError () returned 0x0 [0194.209] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x160, lpOverlapped=0x0) returned 1 [0194.210] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x170, lpOverlapped=0x0) returned 1 [0194.211] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.211] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0194.211] SetEndOfFile (hFile=0x154) returned 1 [0194.212] CloseHandle (hObject=0x154) returned 1 [0194.212] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.212] SetEndOfFile (hFile=0x35c) returned 1 [0194.212] CloseHandle (hObject=0x35c) returned 1 [0194.212] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.213] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json")) returned 1 [0194.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.213] lstrlenW (lpString=".doc") returned 4 [0194.213] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.213] lstrlenW (lpString=".docx") returned 5 [0194.213] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.213] lstrlenW (lpString=".pdf") returned 4 [0194.213] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.213] lstrlenW (lpString=".xls") returned 4 [0194.213] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.213] lstrlenW (lpString=".xlsx") returned 5 [0194.213] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.213] lstrlenW (lpString=".ppt") returned 4 [0194.213] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.213] lstrlenW (lpString=".zip") returned 4 [0194.213] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.213] lstrlenW (lpString=".rar") returned 4 [0194.213] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.213] lstrlenW (lpString=".bz2") returned 4 [0194.213] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.213] lstrlenW (lpString=".7z") returned 3 [0194.213] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.214] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.214] lstrlenW (lpString=".dbf") returned 4 [0194.214] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.214] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.214] lstrlenW (lpString=".1cd") returned 4 [0194.214] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.214] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.214] lstrlenW (lpString=".jpg") returned 4 [0194.214] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.214] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.214] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.214] lstrlenW (lpString=".doc") returned 4 [0194.214] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.214] lstrlenW (lpString=".docx") returned 5 [0194.214] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.214] lstrlenW (lpString=".pdf") returned 4 [0194.214] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.214] lstrlenW (lpString=".xls") returned 4 [0194.214] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.214] lstrlenW (lpString=".xlsx") returned 5 [0194.214] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.214] lstrlenW (lpString=".ppt") returned 4 [0194.214] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.214] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.214] lstrlenW (lpString=".zip") returned 4 [0194.214] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.214] lstrlenW (lpString=".rar") returned 4 [0194.214] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.214] lstrlenW (lpString=".bz2") returned 4 [0194.214] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.214] lstrlenW (lpString=".7z") returned 3 [0194.215] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.215] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.215] lstrlenW (lpString=".dbf") returned 4 [0194.215] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.215] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.215] lstrlenW (lpString=".1cd") returned 4 [0194.215] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.215] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\computed_hashes.json") returned 156 [0194.215] lstrlenW (lpString=".jpg") returned 4 [0194.215] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.215] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.215] lstrlenW (lpString="messages.json") returned 13 [0194.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.219] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=254) returned 1 [0194.219] CloseHandle (hObject=0x35c) returned 1 [0194.219] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 0x2020 [0194.219] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.219] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.219] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.219] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.220] GetLastError () returned 0x0 [0194.220] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xfe, lpOverlapped=0x0) returned 1 [0194.221] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.222] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.222] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.222] SetEndOfFile (hFile=0x154) returned 1 [0194.222] CloseHandle (hObject=0x154) returned 1 [0194.222] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.222] SetEndOfFile (hFile=0x35c) returned 1 [0194.223] CloseHandle (hObject=0x35c) returned 1 [0194.223] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.223] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json")) returned 1 [0194.223] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.223] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.223] lstrlenW (lpString=".doc") returned 4 [0194.223] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.223] lstrlenW (lpString=".docx") returned 5 [0194.223] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.223] lstrlenW (lpString=".pdf") returned 4 [0194.223] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.223] lstrlenW (lpString=".xls") returned 4 [0194.223] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.223] lstrlenW (lpString=".xlsx") returned 5 [0194.223] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.223] lstrlenW (lpString=".ppt") returned 4 [0194.223] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.224] lstrlenW (lpString=".zip") returned 4 [0194.224] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.224] lstrlenW (lpString=".rar") returned 4 [0194.224] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.224] lstrlenW (lpString=".bz2") returned 4 [0194.224] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.224] lstrlenW (lpString=".7z") returned 3 [0194.224] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.224] lstrlenW (lpString=".dbf") returned 4 [0194.224] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.224] lstrlenW (lpString=".1cd") returned 4 [0194.224] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.224] lstrlenW (lpString=".jpg") returned 4 [0194.224] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.224] lstrlenW (lpString=".doc") returned 4 [0194.224] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.224] lstrlenW (lpString=".docx") returned 5 [0194.224] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.224] lstrlenW (lpString=".pdf") returned 4 [0194.224] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.224] lstrlenW (lpString=".xls") returned 4 [0194.224] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.224] lstrlenW (lpString=".xlsx") returned 5 [0194.224] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.224] lstrlenW (lpString=".ppt") returned 4 [0194.225] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.225] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.225] lstrlenW (lpString=".zip") returned 4 [0194.225] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.225] lstrlenW (lpString=".rar") returned 4 [0194.225] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.225] lstrlenW (lpString=".bz2") returned 4 [0194.225] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.225] lstrlenW (lpString=".7z") returned 3 [0194.225] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.225] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.225] lstrlenW (lpString=".dbf") returned 4 [0194.225] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.225] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.225] lstrlenW (lpString=".1cd") returned 4 [0194.225] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.225] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ms\\messages.json") returned 152 [0194.225] lstrlenW (lpString=".jpg") returned 4 [0194.225] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.225] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.225] lstrlenW (lpString="messages.json") returned 13 [0194.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.226] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=242) returned 1 [0194.226] CloseHandle (hObject=0x35c) returned 1 [0194.226] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 0x2020 [0194.226] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.226] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.226] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.227] GetLastError () returned 0x0 [0194.227] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xf2, lpOverlapped=0x0) returned 1 [0194.227] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.228] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.228] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.229] SetEndOfFile (hFile=0x154) returned 1 [0194.229] CloseHandle (hObject=0x154) returned 1 [0194.229] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.229] SetEndOfFile (hFile=0x35c) returned 1 [0194.229] CloseHandle (hObject=0x35c) returned 1 [0194.230] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.230] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json")) returned 1 [0194.230] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.230] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.230] lstrlenW (lpString=".doc") returned 4 [0194.230] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.230] lstrlenW (lpString=".docx") returned 5 [0194.230] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.230] lstrlenW (lpString=".pdf") returned 4 [0194.230] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.230] lstrlenW (lpString=".xls") returned 4 [0194.230] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.230] lstrlenW (lpString=".xlsx") returned 5 [0194.230] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.230] lstrlenW (lpString=".ppt") returned 4 [0194.230] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.230] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.230] lstrlenW (lpString=".zip") returned 4 [0194.230] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.230] lstrlenW (lpString=".rar") returned 4 [0194.230] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.230] lstrlenW (lpString=".bz2") returned 4 [0194.230] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.231] lstrlenW (lpString=".7z") returned 3 [0194.231] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.231] lstrlenW (lpString=".dbf") returned 4 [0194.231] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.231] lstrlenW (lpString=".1cd") returned 4 [0194.231] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.231] lstrlenW (lpString=".jpg") returned 4 [0194.231] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.231] lstrlenW (lpString=".doc") returned 4 [0194.231] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.231] lstrlenW (lpString=".docx") returned 5 [0194.231] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.231] lstrlenW (lpString=".pdf") returned 4 [0194.231] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.231] lstrlenW (lpString=".xls") returned 4 [0194.231] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.231] lstrlenW (lpString=".xlsx") returned 5 [0194.231] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.231] lstrlenW (lpString=".ppt") returned 4 [0194.231] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.231] lstrlenW (lpString=".zip") returned 4 [0194.231] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.231] lstrlenW (lpString=".rar") returned 4 [0194.231] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.231] lstrlenW (lpString=".bz2") returned 4 [0194.232] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.232] lstrlenW (lpString=".7z") returned 3 [0194.232] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.232] lstrlenW (lpString=".dbf") returned 4 [0194.232] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.232] lstrlenW (lpString=".1cd") returned 4 [0194.232] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\nl\\messages.json") returned 152 [0194.232] lstrlenW (lpString=".jpg") returned 4 [0194.232] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.232] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.232] lstrlenW (lpString="messages.json") returned 13 [0194.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.232] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=218) returned 1 [0194.233] CloseHandle (hObject=0x35c) returned 1 [0194.233] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 0x2020 [0194.233] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.233] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.233] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.233] GetLastError () returned 0x0 [0194.233] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xda, lpOverlapped=0x0) returned 1 [0194.234] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0194.235] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.235] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.235] SetEndOfFile (hFile=0x154) returned 1 [0194.235] CloseHandle (hObject=0x154) returned 1 [0194.235] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.236] SetEndOfFile (hFile=0x35c) returned 1 [0194.236] CloseHandle (hObject=0x35c) returned 1 [0194.236] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.236] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json")) returned 1 [0194.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.237] lstrlenW (lpString=".doc") returned 4 [0194.237] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.237] lstrlenW (lpString=".docx") returned 5 [0194.237] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.237] lstrlenW (lpString=".pdf") returned 4 [0194.237] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.237] lstrlenW (lpString=".xls") returned 4 [0194.237] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.237] lstrlenW (lpString=".xlsx") returned 5 [0194.237] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.237] lstrlenW (lpString=".ppt") returned 4 [0194.237] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.237] lstrlenW (lpString=".zip") returned 4 [0194.237] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.237] lstrlenW (lpString=".rar") returned 4 [0194.237] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.237] lstrlenW (lpString=".bz2") returned 4 [0194.237] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.237] lstrlenW (lpString=".7z") returned 3 [0194.237] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.237] lstrlenW (lpString=".dbf") returned 4 [0194.237] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.237] lstrlenW (lpString=".1cd") returned 4 [0194.238] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.238] lstrlenW (lpString=".jpg") returned 4 [0194.238] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.238] lstrlenW (lpString=".doc") returned 4 [0194.238] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.238] lstrlenW (lpString=".docx") returned 5 [0194.238] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.238] lstrlenW (lpString=".pdf") returned 4 [0194.238] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.238] lstrlenW (lpString=".xls") returned 4 [0194.238] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.238] lstrlenW (lpString=".xlsx") returned 5 [0194.238] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.238] lstrlenW (lpString=".ppt") returned 4 [0194.238] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.238] lstrlenW (lpString=".zip") returned 4 [0194.238] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.238] lstrlenW (lpString=".rar") returned 4 [0194.238] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.238] lstrlenW (lpString=".bz2") returned 4 [0194.238] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.238] lstrlenW (lpString=".7z") returned 3 [0194.238] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.238] lstrlenW (lpString=".dbf") returned 4 [0194.238] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.239] lstrlenW (lpString=".1cd") returned 4 [0194.239] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\no\\messages.json") returned 152 [0194.239] lstrlenW (lpString=".jpg") returned 4 [0194.239] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.239] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.239] lstrlenW (lpString="messages.json") returned 13 [0194.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.239] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=257) returned 1 [0194.239] CloseHandle (hObject=0x35c) returned 1 [0194.239] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 0x2020 [0194.239] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.240] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.240] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.240] GetLastError () returned 0x0 [0194.240] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x101, lpOverlapped=0x0) returned 1 [0194.241] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.242] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.242] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.242] SetEndOfFile (hFile=0x154) returned 1 [0194.242] CloseHandle (hObject=0x154) returned 1 [0194.242] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.242] SetEndOfFile (hFile=0x35c) returned 1 [0194.243] CloseHandle (hObject=0x35c) returned 1 [0194.243] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.243] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json")) returned 1 [0194.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.243] lstrlenW (lpString=".doc") returned 4 [0194.244] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.244] lstrlenW (lpString=".docx") returned 5 [0194.244] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.244] lstrlenW (lpString=".pdf") returned 4 [0194.244] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.244] lstrlenW (lpString=".xls") returned 4 [0194.244] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.244] lstrlenW (lpString=".xlsx") returned 5 [0194.244] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.244] lstrlenW (lpString=".ppt") returned 4 [0194.244] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.244] lstrlenW (lpString=".zip") returned 4 [0194.244] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.244] lstrlenW (lpString=".rar") returned 4 [0194.244] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.244] lstrlenW (lpString=".bz2") returned 4 [0194.244] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.244] lstrlenW (lpString=".7z") returned 3 [0194.244] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.244] lstrlenW (lpString=".dbf") returned 4 [0194.244] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.244] lstrlenW (lpString=".1cd") returned 4 [0194.244] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.244] lstrlenW (lpString=".jpg") returned 4 [0194.244] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.245] lstrlenW (lpString=".doc") returned 4 [0194.245] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.245] lstrlenW (lpString=".docx") returned 5 [0194.245] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.245] lstrlenW (lpString=".pdf") returned 4 [0194.245] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.245] lstrlenW (lpString=".xls") returned 4 [0194.245] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.245] lstrlenW (lpString=".xlsx") returned 5 [0194.245] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.245] lstrlenW (lpString=".ppt") returned 4 [0194.245] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.245] lstrlenW (lpString=".zip") returned 4 [0194.245] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.245] lstrlenW (lpString=".rar") returned 4 [0194.245] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.245] lstrlenW (lpString=".bz2") returned 4 [0194.245] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.245] lstrlenW (lpString=".7z") returned 3 [0194.245] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.245] lstrlenW (lpString=".dbf") returned 4 [0194.245] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.245] lstrlenW (lpString=".1cd") returned 4 [0194.245] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pl\\messages.json") returned 152 [0194.245] lstrlenW (lpString=".jpg") returned 4 [0194.245] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.246] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.246] lstrlenW (lpString="messages.json") returned 13 [0194.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.246] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=246) returned 1 [0194.246] CloseHandle (hObject=0x35c) returned 1 [0194.246] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0194.246] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.246] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.246] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.246] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.247] GetLastError () returned 0x0 [0194.247] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xf6, lpOverlapped=0x0) returned 1 [0194.361] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.362] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.362] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.362] SetEndOfFile (hFile=0x154) returned 1 [0194.362] CloseHandle (hObject=0x154) returned 1 [0194.362] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.362] SetEndOfFile (hFile=0x35c) returned 1 [0194.365] CloseHandle (hObject=0x35c) returned 1 [0194.365] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.365] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0194.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.365] lstrlenW (lpString=".doc") returned 4 [0194.365] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.365] lstrlenW (lpString=".docx") returned 5 [0194.365] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.365] lstrlenW (lpString=".pdf") returned 4 [0194.365] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.365] lstrlenW (lpString=".xls") returned 4 [0194.365] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.366] lstrlenW (lpString=".xlsx") returned 5 [0194.366] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.366] lstrlenW (lpString=".ppt") returned 4 [0194.366] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.366] lstrlenW (lpString=".zip") returned 4 [0194.366] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.366] lstrlenW (lpString=".rar") returned 4 [0194.366] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.366] lstrlenW (lpString=".bz2") returned 4 [0194.366] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.366] lstrlenW (lpString=".7z") returned 3 [0194.366] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.366] lstrlenW (lpString=".dbf") returned 4 [0194.366] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.366] lstrlenW (lpString=".1cd") returned 4 [0194.366] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.366] lstrlenW (lpString=".jpg") returned 4 [0194.366] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.366] lstrlenW (lpString=".doc") returned 4 [0194.366] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.366] lstrlenW (lpString=".docx") returned 5 [0194.366] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.366] lstrlenW (lpString=".pdf") returned 4 [0194.366] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.366] lstrlenW (lpString=".xls") returned 4 [0194.366] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.367] lstrlenW (lpString=".xlsx") returned 5 [0194.367] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.367] lstrlenW (lpString=".ppt") returned 4 [0194.367] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.367] lstrlenW (lpString=".zip") returned 4 [0194.367] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.367] lstrlenW (lpString=".rar") returned 4 [0194.367] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.367] lstrlenW (lpString=".bz2") returned 4 [0194.367] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.367] lstrlenW (lpString=".7z") returned 3 [0194.367] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.367] lstrlenW (lpString=".dbf") returned 4 [0194.367] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.367] lstrlenW (lpString=".1cd") returned 4 [0194.367] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\pt_BR\\messages.json") returned 155 [0194.367] lstrlenW (lpString=".jpg") returned 4 [0194.367] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.367] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.367] lstrlenW (lpString="messages.json") returned 13 [0194.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.368] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=279) returned 1 [0194.368] CloseHandle (hObject=0x35c) returned 1 [0194.368] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 0x2020 [0194.368] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.368] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.368] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.369] GetLastError () returned 0x0 [0194.369] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x117, lpOverlapped=0x0) returned 1 [0194.369] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x120, lpOverlapped=0x0) returned 1 [0194.370] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.370] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.371] SetEndOfFile (hFile=0x154) returned 1 [0194.371] CloseHandle (hObject=0x154) returned 1 [0194.371] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.371] SetEndOfFile (hFile=0x35c) returned 1 [0194.371] CloseHandle (hObject=0x35c) returned 1 [0194.372] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.372] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json")) returned 1 [0194.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.372] lstrlenW (lpString=".doc") returned 4 [0194.372] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.372] lstrlenW (lpString=".docx") returned 5 [0194.372] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.372] lstrlenW (lpString=".pdf") returned 4 [0194.372] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.374] lstrlenW (lpString=".xls") returned 4 [0194.374] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.374] lstrlenW (lpString=".xlsx") returned 5 [0194.374] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.374] lstrlenW (lpString=".ppt") returned 4 [0194.374] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.374] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.374] lstrlenW (lpString=".zip") returned 4 [0194.374] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.374] lstrlenW (lpString=".rar") returned 4 [0194.374] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.375] lstrlenW (lpString=".bz2") returned 4 [0194.375] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.375] lstrlenW (lpString=".7z") returned 3 [0194.375] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.375] lstrlenW (lpString=".dbf") returned 4 [0194.375] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.375] lstrlenW (lpString=".1cd") returned 4 [0194.375] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.375] lstrlenW (lpString=".jpg") returned 4 [0194.375] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.375] lstrlenW (lpString=".doc") returned 4 [0194.375] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.375] lstrlenW (lpString=".docx") returned 5 [0194.375] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.375] lstrlenW (lpString=".pdf") returned 4 [0194.375] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.375] lstrlenW (lpString=".xls") returned 4 [0194.375] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.375] lstrlenW (lpString=".xlsx") returned 5 [0194.375] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.375] lstrlenW (lpString=".ppt") returned 4 [0194.375] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.375] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.375] lstrlenW (lpString=".zip") returned 4 [0194.375] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.375] lstrlenW (lpString=".rar") returned 4 [0194.375] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.376] lstrlenW (lpString=".bz2") returned 4 [0194.376] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.376] lstrlenW (lpString=".7z") returned 3 [0194.376] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.376] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.376] lstrlenW (lpString=".dbf") returned 4 [0194.376] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.376] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.376] lstrlenW (lpString=".1cd") returned 4 [0194.376] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.376] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\vi\\messages.json") returned 152 [0194.376] lstrlenW (lpString=".jpg") returned 4 [0194.376] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.376] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.376] lstrlenW (lpString="messages.json") returned 13 [0194.376] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.377] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=273) returned 1 [0194.377] CloseHandle (hObject=0x35c) returned 1 [0194.377] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0194.377] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.377] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.377] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.377] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.377] GetLastError () returned 0x0 [0194.377] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x111, lpOverlapped=0x0) returned 1 [0194.378] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x120, lpOverlapped=0x0) returned 1 [0194.379] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.379] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.380] SetEndOfFile (hFile=0x154) returned 1 [0194.380] CloseHandle (hObject=0x154) returned 1 [0194.380] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.380] SetEndOfFile (hFile=0x35c) returned 1 [0194.380] CloseHandle (hObject=0x35c) returned 1 [0194.380] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.381] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0194.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.381] lstrlenW (lpString=".doc") returned 4 [0194.381] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.381] lstrlenW (lpString=".docx") returned 5 [0194.381] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.381] lstrlenW (lpString=".pdf") returned 4 [0194.381] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.381] lstrlenW (lpString=".xls") returned 4 [0194.381] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.381] lstrlenW (lpString=".xlsx") returned 5 [0194.381] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.381] lstrlenW (lpString=".ppt") returned 4 [0194.381] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.381] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.381] lstrlenW (lpString=".zip") returned 4 [0194.381] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.381] lstrlenW (lpString=".rar") returned 4 [0194.381] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.381] lstrlenW (lpString=".bz2") returned 4 [0194.381] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.381] lstrlenW (lpString=".7z") returned 3 [0194.382] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.382] lstrlenW (lpString=".dbf") returned 4 [0194.382] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.382] lstrlenW (lpString=".1cd") returned 4 [0194.382] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.382] lstrlenW (lpString=".jpg") returned 4 [0194.382] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.382] lstrlenW (lpString=".doc") returned 4 [0194.382] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.382] lstrlenW (lpString=".docx") returned 5 [0194.382] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.382] lstrlenW (lpString=".pdf") returned 4 [0194.382] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.382] lstrlenW (lpString=".xls") returned 4 [0194.382] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.382] lstrlenW (lpString=".xlsx") returned 5 [0194.382] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.382] lstrlenW (lpString=".ppt") returned 4 [0194.382] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.382] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.382] lstrlenW (lpString=".zip") returned 4 [0194.382] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.382] lstrlenW (lpString=".rar") returned 4 [0194.382] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.382] lstrlenW (lpString=".bz2") returned 4 [0194.382] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.382] lstrlenW (lpString=".7z") returned 3 [0194.383] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.383] lstrlenW (lpString=".dbf") returned 4 [0194.383] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.383] lstrlenW (lpString=".1cd") returned 4 [0194.383] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.383] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_CN\\messages.json") returned 155 [0194.383] lstrlenW (lpString=".jpg") returned 4 [0194.383] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.383] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.383] lstrlenW (lpString="messages.json") returned 13 [0194.383] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.383] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=267) returned 1 [0194.383] CloseHandle (hObject=0x35c) returned 1 [0194.384] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0194.384] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.384] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.384] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.384] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.384] GetLastError () returned 0x0 [0194.384] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x10b, lpOverlapped=0x0) returned 1 [0194.385] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.386] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.386] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.386] SetEndOfFile (hFile=0x154) returned 1 [0194.386] CloseHandle (hObject=0x154) returned 1 [0194.386] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.386] SetEndOfFile (hFile=0x35c) returned 1 [0194.387] CloseHandle (hObject=0x35c) returned 1 [0194.387] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.387] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0194.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.388] lstrlenW (lpString=".doc") returned 4 [0194.388] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.388] lstrlenW (lpString=".docx") returned 5 [0194.388] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.388] lstrlenW (lpString=".pdf") returned 4 [0194.388] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.388] lstrlenW (lpString=".xls") returned 4 [0194.388] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.388] lstrlenW (lpString=".xlsx") returned 5 [0194.388] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.388] lstrlenW (lpString=".ppt") returned 4 [0194.388] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.388] lstrlenW (lpString=".zip") returned 4 [0194.388] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.388] lstrlenW (lpString=".rar") returned 4 [0194.388] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.388] lstrlenW (lpString=".bz2") returned 4 [0194.388] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.388] lstrlenW (lpString=".7z") returned 3 [0194.388] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.388] lstrlenW (lpString=".dbf") returned 4 [0194.388] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.388] lstrlenW (lpString=".1cd") returned 4 [0194.388] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.388] lstrlenW (lpString=".jpg") returned 4 [0194.388] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.389] lstrlenW (lpString=".doc") returned 4 [0194.389] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.389] lstrlenW (lpString=".docx") returned 5 [0194.389] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.389] lstrlenW (lpString=".pdf") returned 4 [0194.389] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.389] lstrlenW (lpString=".xls") returned 4 [0194.389] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.389] lstrlenW (lpString=".xlsx") returned 5 [0194.389] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.389] lstrlenW (lpString=".ppt") returned 4 [0194.389] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.389] lstrlenW (lpString=".zip") returned 4 [0194.389] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.389] lstrlenW (lpString=".rar") returned 4 [0194.389] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.389] lstrlenW (lpString=".bz2") returned 4 [0194.389] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.389] lstrlenW (lpString=".7z") returned 3 [0194.389] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.389] lstrlenW (lpString=".dbf") returned 4 [0194.389] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.389] lstrlenW (lpString=".1cd") returned 4 [0194.389] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\zh_TW\\messages.json") returned 155 [0194.389] lstrlenW (lpString=".jpg") returned 4 [0194.389] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.390] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.390] lstrlenW (lpString="verified_contents.json") returned 22 [0194.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.390] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=11221) returned 1 [0194.390] CloseHandle (hObject=0x35c) returned 1 [0194.390] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 0x2020 [0194.390] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0194.390] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.391] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.726] GetLastError () returned 0x0 [0194.726] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2bd5, lpOverlapped=0x0) returned 1 [0194.728] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0194.729] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0194.729] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.730] SetEndOfFile (hFile=0x114) returned 1 [0194.730] CloseHandle (hObject=0x114) returned 1 [0194.730] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0194.730] SetEndOfFile (hFile=0x35c) returned 1 [0194.731] CloseHandle (hObject=0x35c) returned 1 [0194.731] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.939] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json")) returned 1 [0195.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.059] lstrlenW (lpString=".doc") returned 4 [0195.059] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.059] lstrlenW (lpString=".docx") returned 5 [0195.059] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.059] lstrlenW (lpString=".pdf") returned 4 [0195.059] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.059] lstrlenW (lpString=".xls") returned 4 [0195.059] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.059] lstrlenW (lpString=".xlsx") returned 5 [0195.059] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.059] lstrlenW (lpString=".ppt") returned 4 [0195.059] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.059] lstrlenW (lpString=".zip") returned 4 [0195.059] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.059] lstrlenW (lpString=".rar") returned 4 [0195.059] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.059] lstrlenW (lpString=".bz2") returned 4 [0195.059] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.059] lstrlenW (lpString=".7z") returned 3 [0195.059] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.059] lstrlenW (lpString=".dbf") returned 4 [0195.060] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.060] lstrlenW (lpString=".1cd") returned 4 [0195.060] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.060] lstrlenW (lpString=".jpg") returned 4 [0195.060] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.060] lstrlenW (lpString=".doc") returned 4 [0195.060] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.060] lstrlenW (lpString=".docx") returned 5 [0195.060] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.060] lstrlenW (lpString=".pdf") returned 4 [0195.060] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.060] lstrlenW (lpString=".xls") returned 4 [0195.060] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.060] lstrlenW (lpString=".xlsx") returned 5 [0195.060] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.060] lstrlenW (lpString=".ppt") returned 4 [0195.060] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.060] lstrlenW (lpString=".zip") returned 4 [0195.060] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.060] lstrlenW (lpString=".rar") returned 4 [0195.060] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.060] lstrlenW (lpString=".bz2") returned 4 [0195.060] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.061] lstrlenW (lpString=".7z") returned 3 [0195.061] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.061] lstrlenW (lpString=".dbf") returned 4 [0195.061] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.061] lstrlenW (lpString=".1cd") returned 4 [0195.061] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_metadata\\verified_contents.json") returned 159 [0195.061] lstrlenW (lpString=".jpg") returned 4 [0195.061] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.061] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.061] lstrlenW (lpString="messages.json") returned 13 [0195.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.062] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=213) returned 1 [0195.062] CloseHandle (hObject=0x35c) returned 1 [0195.062] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0195.062] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.062] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.062] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.063] GetLastError () returned 0x0 [0195.063] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xd5, lpOverlapped=0x0) returned 1 [0195.064] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.064] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.064] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.065] SetEndOfFile (hFile=0x358) returned 1 [0195.065] CloseHandle (hObject=0x358) returned 1 [0195.065] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.065] SetEndOfFile (hFile=0x35c) returned 1 [0195.066] CloseHandle (hObject=0x35c) returned 1 [0195.066] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.066] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0195.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.066] lstrlenW (lpString=".doc") returned 4 [0195.066] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.066] lstrlenW (lpString=".docx") returned 5 [0195.066] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.066] lstrlenW (lpString=".pdf") returned 4 [0195.066] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.066] lstrlenW (lpString=".xls") returned 4 [0195.066] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.066] lstrlenW (lpString=".xlsx") returned 5 [0195.066] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.066] lstrlenW (lpString=".ppt") returned 4 [0195.066] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.067] lstrlenW (lpString=".zip") returned 4 [0195.067] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.067] lstrlenW (lpString=".rar") returned 4 [0195.067] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.067] lstrlenW (lpString=".bz2") returned 4 [0195.067] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.067] lstrlenW (lpString=".7z") returned 3 [0195.067] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.067] lstrlenW (lpString=".dbf") returned 4 [0195.067] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.067] lstrlenW (lpString=".1cd") returned 4 [0195.067] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.067] lstrlenW (lpString=".jpg") returned 4 [0195.067] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.067] lstrlenW (lpString=".doc") returned 4 [0195.067] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.067] lstrlenW (lpString=".docx") returned 5 [0195.067] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.067] lstrlenW (lpString=".pdf") returned 4 [0195.067] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.067] lstrlenW (lpString=".xls") returned 4 [0195.067] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.067] lstrlenW (lpString=".xlsx") returned 5 [0195.067] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.067] lstrlenW (lpString=".ppt") returned 4 [0195.068] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.068] lstrlenW (lpString=".zip") returned 4 [0195.068] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.068] lstrlenW (lpString=".rar") returned 4 [0195.068] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.068] lstrlenW (lpString=".bz2") returned 4 [0195.068] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.068] lstrlenW (lpString=".7z") returned 3 [0195.068] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.068] lstrlenW (lpString=".dbf") returned 4 [0195.068] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.068] lstrlenW (lpString=".1cd") returned 4 [0195.068] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.068] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.068] lstrlenW (lpString=".jpg") returned 4 [0195.068] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.068] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.068] lstrlenW (lpString="messages.json") returned 13 [0195.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.069] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=230) returned 1 [0195.069] CloseHandle (hObject=0x35c) returned 1 [0195.069] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0195.069] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.069] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.069] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.070] GetLastError () returned 0x0 [0195.070] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xe6, lpOverlapped=0x0) returned 1 [0195.071] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.071] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.071] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.072] SetEndOfFile (hFile=0x358) returned 1 [0195.072] CloseHandle (hObject=0x358) returned 1 [0195.072] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.072] SetEndOfFile (hFile=0x35c) returned 1 [0195.073] CloseHandle (hObject=0x35c) returned 1 [0195.073] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.073] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0195.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.073] lstrlenW (lpString=".doc") returned 4 [0195.073] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.073] lstrlenW (lpString=".docx") returned 5 [0195.073] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.073] lstrlenW (lpString=".pdf") returned 4 [0195.073] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.073] lstrlenW (lpString=".xls") returned 4 [0195.073] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.073] lstrlenW (lpString=".xlsx") returned 5 [0195.073] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.073] lstrlenW (lpString=".ppt") returned 4 [0195.073] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.073] lstrlenW (lpString=".zip") returned 4 [0195.073] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.074] lstrlenW (lpString=".rar") returned 4 [0195.074] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.074] lstrlenW (lpString=".bz2") returned 4 [0195.074] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.074] lstrlenW (lpString=".7z") returned 3 [0195.074] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.074] lstrlenW (lpString=".dbf") returned 4 [0195.074] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.074] lstrlenW (lpString=".1cd") returned 4 [0195.074] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.074] lstrlenW (lpString=".jpg") returned 4 [0195.074] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.074] lstrlenW (lpString=".doc") returned 4 [0195.074] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.075] lstrlenW (lpString=".docx") returned 5 [0195.075] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.075] lstrlenW (lpString=".pdf") returned 4 [0195.075] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.075] lstrlenW (lpString=".xls") returned 4 [0195.075] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.075] lstrlenW (lpString=".xlsx") returned 5 [0195.075] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.075] lstrlenW (lpString=".ppt") returned 4 [0195.075] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.075] lstrlenW (lpString=".zip") returned 4 [0195.075] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.075] lstrlenW (lpString=".rar") returned 4 [0195.075] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.075] lstrlenW (lpString=".bz2") returned 4 [0195.075] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.075] lstrlenW (lpString=".7z") returned 3 [0195.075] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.075] lstrlenW (lpString=".dbf") returned 4 [0195.075] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.075] lstrlenW (lpString=".1cd") returned 4 [0195.075] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.075] lstrlenW (lpString=".jpg") returned 4 [0195.075] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.076] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.076] lstrlenW (lpString="messages.json") returned 13 [0195.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.076] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=226) returned 1 [0195.076] CloseHandle (hObject=0x35c) returned 1 [0195.076] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 0x2020 [0195.076] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.076] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.077] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.077] GetLastError () returned 0x0 [0195.077] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xe2, lpOverlapped=0x0) returned 1 [0195.078] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.079] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.079] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.079] SetEndOfFile (hFile=0x358) returned 1 [0195.079] CloseHandle (hObject=0x358) returned 1 [0195.079] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.079] SetEndOfFile (hFile=0x35c) returned 1 [0195.080] CloseHandle (hObject=0x35c) returned 1 [0195.080] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.080] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json")) returned 1 [0195.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.081] lstrlenW (lpString=".doc") returned 4 [0195.081] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.081] lstrlenW (lpString=".docx") returned 5 [0195.081] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.081] lstrlenW (lpString=".pdf") returned 4 [0195.081] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.081] lstrlenW (lpString=".xls") returned 4 [0195.081] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.081] lstrlenW (lpString=".xlsx") returned 5 [0195.081] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.081] lstrlenW (lpString=".ppt") returned 4 [0195.081] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.081] lstrlenW (lpString=".zip") returned 4 [0195.081] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.081] lstrlenW (lpString=".rar") returned 4 [0195.081] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.081] lstrlenW (lpString=".bz2") returned 4 [0195.081] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.081] lstrlenW (lpString=".7z") returned 3 [0195.081] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.081] lstrlenW (lpString=".dbf") returned 4 [0195.081] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.081] lstrlenW (lpString=".1cd") returned 4 [0195.081] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.081] lstrlenW (lpString=".jpg") returned 4 [0195.081] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.082] lstrlenW (lpString=".doc") returned 4 [0195.082] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.082] lstrlenW (lpString=".docx") returned 5 [0195.082] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.082] lstrlenW (lpString=".pdf") returned 4 [0195.082] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.082] lstrlenW (lpString=".xls") returned 4 [0195.082] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.082] lstrlenW (lpString=".xlsx") returned 5 [0195.082] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.082] lstrlenW (lpString=".ppt") returned 4 [0195.082] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.082] lstrlenW (lpString=".zip") returned 4 [0195.082] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.082] lstrlenW (lpString=".rar") returned 4 [0195.082] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.082] lstrlenW (lpString=".bz2") returned 4 [0195.082] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.082] lstrlenW (lpString=".7z") returned 3 [0195.082] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.082] lstrlenW (lpString=".dbf") returned 4 [0195.082] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.082] lstrlenW (lpString=".1cd") returned 4 [0195.082] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ro\\messages.json") returned 151 [0195.083] lstrlenW (lpString=".jpg") returned 4 [0195.083] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.083] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.083] lstrlenW (lpString="messages.json") returned 13 [0195.083] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.083] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=254) returned 1 [0195.083] CloseHandle (hObject=0x35c) returned 1 [0195.083] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 0x2020 [0195.083] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.083] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.084] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.084] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.084] GetLastError () returned 0x0 [0195.084] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xfe, lpOverlapped=0x0) returned 1 [0195.085] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x100, lpOverlapped=0x0) returned 1 [0195.086] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.086] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.086] SetEndOfFile (hFile=0x358) returned 1 [0195.086] CloseHandle (hObject=0x358) returned 1 [0195.086] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.086] SetEndOfFile (hFile=0x35c) returned 1 [0195.087] CloseHandle (hObject=0x35c) returned 1 [0195.087] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.087] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json")) returned 1 [0195.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.088] lstrlenW (lpString=".doc") returned 4 [0195.088] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.088] lstrlenW (lpString=".docx") returned 5 [0195.088] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.088] lstrlenW (lpString=".pdf") returned 4 [0195.088] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.088] lstrlenW (lpString=".xls") returned 4 [0195.088] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.088] lstrlenW (lpString=".xlsx") returned 5 [0195.088] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.088] lstrlenW (lpString=".ppt") returned 4 [0195.088] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.088] lstrlenW (lpString=".zip") returned 4 [0195.088] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.088] lstrlenW (lpString=".rar") returned 4 [0195.088] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.088] lstrlenW (lpString=".bz2") returned 4 [0195.088] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.088] lstrlenW (lpString=".7z") returned 3 [0195.088] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.088] lstrlenW (lpString=".dbf") returned 4 [0195.088] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.088] lstrlenW (lpString=".1cd") returned 4 [0195.088] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.088] lstrlenW (lpString=".jpg") returned 4 [0195.088] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.089] lstrlenW (lpString=".doc") returned 4 [0195.089] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.089] lstrlenW (lpString=".docx") returned 5 [0195.089] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.089] lstrlenW (lpString=".pdf") returned 4 [0195.089] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.089] lstrlenW (lpString=".xls") returned 4 [0195.089] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.089] lstrlenW (lpString=".xlsx") returned 5 [0195.089] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.089] lstrlenW (lpString=".ppt") returned 4 [0195.089] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.089] lstrlenW (lpString=".zip") returned 4 [0195.089] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.089] lstrlenW (lpString=".rar") returned 4 [0195.089] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.089] lstrlenW (lpString=".bz2") returned 4 [0195.089] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.089] lstrlenW (lpString=".7z") returned 3 [0195.089] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.089] lstrlenW (lpString=".dbf") returned 4 [0195.089] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.089] lstrlenW (lpString=".1cd") returned 4 [0195.089] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ru\\messages.json") returned 151 [0195.089] lstrlenW (lpString=".jpg") returned 4 [0195.089] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.090] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.090] lstrlenW (lpString="messages.json") returned 13 [0195.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.090] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=219) returned 1 [0195.090] CloseHandle (hObject=0x35c) returned 1 [0195.090] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 0x2020 [0195.090] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.091] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.091] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.091] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.091] GetLastError () returned 0x0 [0195.091] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xdb, lpOverlapped=0x0) returned 1 [0195.177] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.178] ReadFile (in: hFile=0x35c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.178] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.178] SetEndOfFile (hFile=0x358) returned 1 [0195.179] CloseHandle (hObject=0x358) returned 1 [0195.179] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.179] SetEndOfFile (hFile=0x35c) returned 1 [0195.179] CloseHandle (hObject=0x35c) returned 1 [0195.179] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.180] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json")) returned 1 [0195.180] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.180] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.180] lstrlenW (lpString=".doc") returned 4 [0195.180] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.180] lstrlenW (lpString=".docx") returned 5 [0195.180] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.180] lstrlenW (lpString=".pdf") returned 4 [0195.180] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.180] lstrlenW (lpString=".xls") returned 4 [0195.180] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.180] lstrlenW (lpString=".xlsx") returned 5 [0195.180] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.180] lstrlenW (lpString=".ppt") returned 4 [0195.180] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.180] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.180] lstrlenW (lpString=".zip") returned 4 [0195.180] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.181] lstrlenW (lpString=".rar") returned 4 [0195.181] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.181] lstrlenW (lpString=".bz2") returned 4 [0195.181] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.181] lstrlenW (lpString=".7z") returned 3 [0195.181] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.181] lstrlenW (lpString=".dbf") returned 4 [0195.181] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.181] lstrlenW (lpString=".1cd") returned 4 [0195.181] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.181] lstrlenW (lpString=".jpg") returned 4 [0195.181] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.181] lstrlenW (lpString=".doc") returned 4 [0195.181] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.181] lstrlenW (lpString=".docx") returned 5 [0195.181] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.181] lstrlenW (lpString=".pdf") returned 4 [0195.181] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.181] lstrlenW (lpString=".xls") returned 4 [0195.181] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.181] lstrlenW (lpString=".xlsx") returned 5 [0195.181] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.181] lstrlenW (lpString=".ppt") returned 4 [0195.181] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.182] lstrlenW (lpString=".zip") returned 4 [0195.182] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.182] lstrlenW (lpString=".rar") returned 4 [0195.182] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.182] lstrlenW (lpString=".bz2") returned 4 [0195.182] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.182] lstrlenW (lpString=".7z") returned 3 [0195.182] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.182] lstrlenW (lpString=".dbf") returned 4 [0195.182] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.182] lstrlenW (lpString=".1cd") returned 4 [0195.182] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\sk\\messages.json") returned 151 [0195.182] lstrlenW (lpString=".jpg") returned 4 [0195.182] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.182] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.182] lstrlenW (lpString="verified_contents.json") returned 22 [0195.182] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.500] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=11094) returned 1 [0195.500] CloseHandle (hObject=0x358) returned 1 [0195.500] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 0x2020 [0195.500] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.500] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.500] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.501] GetLastError () returned 0x0 [0195.501] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2b56, lpOverlapped=0x0) returned 1 [0195.503] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2b60, lpOverlapped=0x0) returned 1 [0195.504] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.504] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x100, lpOverlapped=0x0) returned 1 [0195.504] SetEndOfFile (hFile=0x120) returned 1 [0195.504] CloseHandle (hObject=0x120) returned 1 [0195.504] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.504] SetEndOfFile (hFile=0x358) returned 1 [0195.507] CloseHandle (hObject=0x358) returned 1 [0195.507] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.507] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json")) returned 1 [0195.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.507] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.507] lstrlenW (lpString=".doc") returned 4 [0195.507] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.507] lstrlenW (lpString=".docx") returned 5 [0195.507] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.507] lstrlenW (lpString=".pdf") returned 4 [0195.507] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.507] lstrlenW (lpString=".xls") returned 4 [0195.507] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.507] lstrlenW (lpString=".xlsx") returned 5 [0195.507] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.507] lstrlenW (lpString=".ppt") returned 4 [0195.507] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.508] lstrlenW (lpString=".zip") returned 4 [0195.508] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.508] lstrlenW (lpString=".rar") returned 4 [0195.508] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.508] lstrlenW (lpString=".bz2") returned 4 [0195.508] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.508] lstrlenW (lpString=".7z") returned 3 [0195.508] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.508] lstrlenW (lpString=".dbf") returned 4 [0195.508] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.508] lstrlenW (lpString=".1cd") returned 4 [0195.508] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.508] lstrlenW (lpString=".jpg") returned 4 [0195.508] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.508] lstrlenW (lpString=".doc") returned 4 [0195.508] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.508] lstrlenW (lpString=".docx") returned 5 [0195.508] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.508] lstrlenW (lpString=".pdf") returned 4 [0195.508] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.508] lstrlenW (lpString=".xls") returned 4 [0195.508] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.508] lstrlenW (lpString=".xlsx") returned 5 [0195.508] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.508] lstrlenW (lpString=".ppt") returned 4 [0195.509] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.509] lstrlenW (lpString=".zip") returned 4 [0195.509] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.509] lstrlenW (lpString=".rar") returned 4 [0195.509] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.509] lstrlenW (lpString=".bz2") returned 4 [0195.509] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.509] lstrlenW (lpString=".7z") returned 3 [0195.509] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.509] lstrlenW (lpString=".dbf") returned 4 [0195.509] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.509] lstrlenW (lpString=".1cd") returned 4 [0195.509] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\verified_contents.json") returned 158 [0195.509] lstrlenW (lpString=".jpg") returned 4 [0195.509] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.509] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.509] lstrlenW (lpString="messages.json") returned 13 [0195.509] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.510] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=255) returned 1 [0195.510] CloseHandle (hObject=0x358) returned 1 [0195.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json")) returned 0x2020 [0195.510] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.510] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.510] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.511] GetLastError () returned 0x0 [0195.511] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xff, lpOverlapped=0x0) returned 1 [0195.514] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x100, lpOverlapped=0x0) returned 1 [0195.515] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.515] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.515] SetEndOfFile (hFile=0x120) returned 1 [0195.515] CloseHandle (hObject=0x120) returned 1 [0195.515] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.515] SetEndOfFile (hFile=0x358) returned 1 [0195.516] CloseHandle (hObject=0x358) returned 1 [0195.516] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.516] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json")) returned 1 [0195.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.516] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.516] lstrlenW (lpString=".doc") returned 4 [0195.516] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.516] lstrlenW (lpString=".docx") returned 5 [0195.516] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.517] lstrlenW (lpString=".pdf") returned 4 [0195.517] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.517] lstrlenW (lpString=".xls") returned 4 [0195.517] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.517] lstrlenW (lpString=".xlsx") returned 5 [0195.517] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.517] lstrlenW (lpString=".ppt") returned 4 [0195.517] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.517] lstrlenW (lpString=".zip") returned 4 [0195.517] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.517] lstrlenW (lpString=".rar") returned 4 [0195.517] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.517] lstrlenW (lpString=".bz2") returned 4 [0195.517] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.517] lstrlenW (lpString=".7z") returned 3 [0195.517] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.517] lstrlenW (lpString=".dbf") returned 4 [0195.517] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.517] lstrlenW (lpString=".1cd") returned 4 [0195.517] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.517] lstrlenW (lpString=".jpg") returned 4 [0195.517] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.517] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.517] lstrlenW (lpString=".doc") returned 4 [0195.517] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.517] lstrlenW (lpString=".docx") returned 5 [0195.517] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.517] lstrlenW (lpString=".pdf") returned 4 [0195.518] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.518] lstrlenW (lpString=".xls") returned 4 [0195.518] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.518] lstrlenW (lpString=".xlsx") returned 5 [0195.518] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.518] lstrlenW (lpString=".ppt") returned 4 [0195.518] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.518] lstrlenW (lpString=".zip") returned 4 [0195.518] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.518] lstrlenW (lpString=".rar") returned 4 [0195.518] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.518] lstrlenW (lpString=".bz2") returned 4 [0195.518] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.518] lstrlenW (lpString=".7z") returned 3 [0195.518] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.518] lstrlenW (lpString=".dbf") returned 4 [0195.518] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.518] lstrlenW (lpString=".1cd") returned 4 [0195.518] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.518] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fa\\messages.json") returned 151 [0195.518] lstrlenW (lpString=".jpg") returned 4 [0195.518] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.518] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.519] lstrlenW (lpString="messages.json") returned 13 [0195.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.519] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=183) returned 1 [0195.519] CloseHandle (hObject=0x358) returned 1 [0195.519] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json")) returned 0x2020 [0195.519] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.519] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.519] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.519] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.520] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.520] GetLastError () returned 0x0 [0195.520] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xb7, lpOverlapped=0x0) returned 1 [0195.521] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.522] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.522] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.522] SetEndOfFile (hFile=0x120) returned 1 [0195.522] CloseHandle (hObject=0x120) returned 1 [0195.522] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.522] SetEndOfFile (hFile=0x358) returned 1 [0195.523] CloseHandle (hObject=0x358) returned 1 [0195.523] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.523] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json")) returned 1 [0195.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.524] lstrlenW (lpString=".doc") returned 4 [0195.524] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.524] lstrlenW (lpString=".docx") returned 5 [0195.524] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.524] lstrlenW (lpString=".pdf") returned 4 [0195.524] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.524] lstrlenW (lpString=".xls") returned 4 [0195.524] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.524] lstrlenW (lpString=".xlsx") returned 5 [0195.524] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.524] lstrlenW (lpString=".ppt") returned 4 [0195.524] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.524] lstrlenW (lpString=".zip") returned 4 [0195.524] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.524] lstrlenW (lpString=".rar") returned 4 [0195.524] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.524] lstrlenW (lpString=".bz2") returned 4 [0195.524] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.524] lstrlenW (lpString=".7z") returned 3 [0195.524] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.524] lstrlenW (lpString=".dbf") returned 4 [0195.524] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.524] lstrlenW (lpString=".1cd") returned 4 [0195.524] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.525] lstrlenW (lpString=".jpg") returned 4 [0195.525] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.525] lstrlenW (lpString=".doc") returned 4 [0195.525] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.525] lstrlenW (lpString=".docx") returned 5 [0195.525] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.525] lstrlenW (lpString=".pdf") returned 4 [0195.525] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.525] lstrlenW (lpString=".xls") returned 4 [0195.525] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.525] lstrlenW (lpString=".xlsx") returned 5 [0195.525] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.525] lstrlenW (lpString=".ppt") returned 4 [0195.525] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.525] lstrlenW (lpString=".zip") returned 4 [0195.525] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.525] lstrlenW (lpString=".rar") returned 4 [0195.525] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.525] lstrlenW (lpString=".bz2") returned 4 [0195.525] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.525] lstrlenW (lpString=".7z") returned 3 [0195.525] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.525] lstrlenW (lpString=".dbf") returned 4 [0195.525] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.525] lstrlenW (lpString=".1cd") returned 4 [0195.525] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fi\\messages.json") returned 151 [0195.526] lstrlenW (lpString=".jpg") returned 4 [0195.526] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.526] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.526] lstrlenW (lpString="messages.json") returned 13 [0195.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.526] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=199) returned 1 [0195.526] CloseHandle (hObject=0x358) returned 1 [0195.526] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json")) returned 0x2020 [0195.527] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.527] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.527] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.528] GetLastError () returned 0x0 [0195.528] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xc7, lpOverlapped=0x0) returned 1 [0195.529] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.530] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.530] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.530] SetEndOfFile (hFile=0x120) returned 1 [0195.530] CloseHandle (hObject=0x120) returned 1 [0195.530] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.530] SetEndOfFile (hFile=0x358) returned 1 [0195.531] CloseHandle (hObject=0x358) returned 1 [0195.531] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.531] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json")) returned 1 [0195.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.532] lstrlenW (lpString=".doc") returned 4 [0195.532] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.532] lstrlenW (lpString=".docx") returned 5 [0195.532] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.532] lstrlenW (lpString=".pdf") returned 4 [0195.532] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.532] lstrlenW (lpString=".xls") returned 4 [0195.532] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.532] lstrlenW (lpString=".xlsx") returned 5 [0195.532] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.532] lstrlenW (lpString=".ppt") returned 4 [0195.532] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.532] lstrlenW (lpString=".zip") returned 4 [0195.532] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.532] lstrlenW (lpString=".rar") returned 4 [0195.532] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.532] lstrlenW (lpString=".bz2") returned 4 [0195.532] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.532] lstrlenW (lpString=".7z") returned 3 [0195.532] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.532] lstrlenW (lpString=".dbf") returned 4 [0195.532] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.532] lstrlenW (lpString=".1cd") returned 4 [0195.532] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.533] lstrlenW (lpString=".jpg") returned 4 [0195.533] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.533] lstrlenW (lpString=".doc") returned 4 [0195.533] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.533] lstrlenW (lpString=".docx") returned 5 [0195.533] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.533] lstrlenW (lpString=".pdf") returned 4 [0195.533] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.533] lstrlenW (lpString=".xls") returned 4 [0195.533] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.533] lstrlenW (lpString=".xlsx") returned 5 [0195.533] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.533] lstrlenW (lpString=".ppt") returned 4 [0195.533] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.533] lstrlenW (lpString=".zip") returned 4 [0195.533] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.533] lstrlenW (lpString=".rar") returned 4 [0195.533] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.533] lstrlenW (lpString=".bz2") returned 4 [0195.533] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.533] lstrlenW (lpString=".7z") returned 3 [0195.533] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.533] lstrlenW (lpString=".dbf") returned 4 [0195.533] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.533] lstrlenW (lpString=".1cd") returned 4 [0195.533] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fil\\messages.json") returned 152 [0195.534] lstrlenW (lpString=".jpg") returned 4 [0195.534] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.534] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.534] lstrlenW (lpString="messages.json") returned 13 [0195.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.534] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=187) returned 1 [0195.534] CloseHandle (hObject=0x358) returned 1 [0195.534] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json")) returned 0x2020 [0195.534] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.535] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.535] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.535] GetLastError () returned 0x0 [0195.535] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xbb, lpOverlapped=0x0) returned 1 [0195.536] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.537] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.537] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.537] SetEndOfFile (hFile=0x120) returned 1 [0195.537] CloseHandle (hObject=0x120) returned 1 [0195.538] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.538] SetEndOfFile (hFile=0x358) returned 1 [0195.538] CloseHandle (hObject=0x358) returned 1 [0195.538] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.539] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json")) returned 1 [0195.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.539] lstrlenW (lpString=".doc") returned 4 [0195.539] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.539] lstrlenW (lpString=".docx") returned 5 [0195.539] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.539] lstrlenW (lpString=".pdf") returned 4 [0195.539] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.539] lstrlenW (lpString=".xls") returned 4 [0195.539] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.539] lstrlenW (lpString=".xlsx") returned 5 [0195.539] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.539] lstrlenW (lpString=".ppt") returned 4 [0195.539] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.539] lstrlenW (lpString=".zip") returned 4 [0195.539] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.539] lstrlenW (lpString=".rar") returned 4 [0195.539] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.539] lstrlenW (lpString=".bz2") returned 4 [0195.539] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.539] lstrlenW (lpString=".7z") returned 3 [0195.539] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.540] lstrlenW (lpString=".dbf") returned 4 [0195.540] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.540] lstrlenW (lpString=".1cd") returned 4 [0195.540] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.540] lstrlenW (lpString=".jpg") returned 4 [0195.540] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.540] lstrlenW (lpString=".doc") returned 4 [0195.540] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.540] lstrlenW (lpString=".docx") returned 5 [0195.540] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.540] lstrlenW (lpString=".pdf") returned 4 [0195.540] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.540] lstrlenW (lpString=".xls") returned 4 [0195.540] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.540] lstrlenW (lpString=".xlsx") returned 5 [0195.540] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.540] lstrlenW (lpString=".ppt") returned 4 [0195.540] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.540] lstrlenW (lpString=".zip") returned 4 [0195.540] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.540] lstrlenW (lpString=".rar") returned 4 [0195.540] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.540] lstrlenW (lpString=".bz2") returned 4 [0195.540] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.540] lstrlenW (lpString=".7z") returned 3 [0195.540] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.541] lstrlenW (lpString=".dbf") returned 4 [0195.541] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.541] lstrlenW (lpString=".1cd") returned 4 [0195.541] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr\\messages.json") returned 151 [0195.541] lstrlenW (lpString=".jpg") returned 4 [0195.541] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.541] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.541] lstrlenW (lpString="messages.json") returned 13 [0195.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.541] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=210) returned 1 [0195.542] CloseHandle (hObject=0x358) returned 1 [0195.542] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json")) returned 0x2020 [0195.542] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.542] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.542] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.542] GetLastError () returned 0x0 [0195.543] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xd2, lpOverlapped=0x0) returned 1 [0195.543] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.544] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.544] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.544] SetEndOfFile (hFile=0x120) returned 1 [0195.545] CloseHandle (hObject=0x120) returned 1 [0195.545] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.545] SetEndOfFile (hFile=0x358) returned 1 [0195.545] CloseHandle (hObject=0x358) returned 1 [0195.545] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.546] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_ca\\messages.json")) returned 1 [0195.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.546] lstrlenW (lpString=".doc") returned 4 [0195.546] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.546] lstrlenW (lpString=".docx") returned 5 [0195.546] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.546] lstrlenW (lpString=".pdf") returned 4 [0195.546] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.546] lstrlenW (lpString=".xls") returned 4 [0195.546] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.546] lstrlenW (lpString=".xlsx") returned 5 [0195.546] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.546] lstrlenW (lpString=".ppt") returned 4 [0195.546] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.546] lstrlenW (lpString=".zip") returned 4 [0195.546] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.546] lstrlenW (lpString=".rar") returned 4 [0195.546] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.546] lstrlenW (lpString=".bz2") returned 4 [0195.546] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.546] lstrlenW (lpString=".7z") returned 3 [0195.546] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.547] lstrlenW (lpString=".dbf") returned 4 [0195.547] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.547] lstrlenW (lpString=".1cd") returned 4 [0195.547] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.547] lstrlenW (lpString=".jpg") returned 4 [0195.547] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.547] lstrlenW (lpString=".doc") returned 4 [0195.547] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.547] lstrlenW (lpString=".docx") returned 5 [0195.547] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.547] lstrlenW (lpString=".pdf") returned 4 [0195.547] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.547] lstrlenW (lpString=".xls") returned 4 [0195.547] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.547] lstrlenW (lpString=".xlsx") returned 5 [0195.547] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.547] lstrlenW (lpString=".ppt") returned 4 [0195.547] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.547] lstrlenW (lpString=".zip") returned 4 [0195.547] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.547] lstrlenW (lpString=".rar") returned 4 [0195.547] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.547] lstrlenW (lpString=".bz2") returned 4 [0195.547] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.547] lstrlenW (lpString=".7z") returned 3 [0195.547] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.548] lstrlenW (lpString=".dbf") returned 4 [0195.548] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.548] lstrlenW (lpString=".1cd") returned 4 [0195.548] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\fr_CA\\messages.json") returned 154 [0195.548] lstrlenW (lpString=".jpg") returned 4 [0195.548] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.548] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.548] lstrlenW (lpString="messages.json") returned 13 [0195.548] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.548] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=172) returned 1 [0195.549] CloseHandle (hObject=0x358) returned 1 [0195.549] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json")) returned 0x2020 [0195.549] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.549] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.549] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.550] GetLastError () returned 0x0 [0195.550] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xac, lpOverlapped=0x0) returned 1 [0195.550] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xb0, lpOverlapped=0x0) returned 1 [0195.551] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.551] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.551] SetEndOfFile (hFile=0x120) returned 1 [0195.552] CloseHandle (hObject=0x120) returned 1 [0195.552] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.552] SetEndOfFile (hFile=0x358) returned 1 [0195.553] CloseHandle (hObject=0x358) returned 1 [0195.553] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.553] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json")) returned 1 [0195.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.553] lstrlenW (lpString=".doc") returned 4 [0195.553] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.553] lstrlenW (lpString=".docx") returned 5 [0195.553] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.553] lstrlenW (lpString=".pdf") returned 4 [0195.553] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.553] lstrlenW (lpString=".xls") returned 4 [0195.553] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.553] lstrlenW (lpString=".xlsx") returned 5 [0195.553] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.553] lstrlenW (lpString=".ppt") returned 4 [0195.553] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.553] lstrlenW (lpString=".zip") returned 4 [0195.553] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.553] lstrlenW (lpString=".rar") returned 4 [0195.553] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.554] lstrlenW (lpString=".bz2") returned 4 [0195.554] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.554] lstrlenW (lpString=".7z") returned 3 [0195.554] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.554] lstrlenW (lpString=".dbf") returned 4 [0195.554] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.554] lstrlenW (lpString=".1cd") returned 4 [0195.554] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.554] lstrlenW (lpString=".jpg") returned 4 [0195.554] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.554] lstrlenW (lpString=".doc") returned 4 [0195.554] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.554] lstrlenW (lpString=".docx") returned 5 [0195.554] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.554] lstrlenW (lpString=".pdf") returned 4 [0195.554] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.554] lstrlenW (lpString=".xls") returned 4 [0195.554] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.554] lstrlenW (lpString=".xlsx") returned 5 [0195.554] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.554] lstrlenW (lpString=".ppt") returned 4 [0195.554] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.554] lstrlenW (lpString=".zip") returned 4 [0195.554] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.554] lstrlenW (lpString=".rar") returned 4 [0195.555] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.555] lstrlenW (lpString=".bz2") returned 4 [0195.555] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.555] lstrlenW (lpString=".7z") returned 3 [0195.555] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.555] lstrlenW (lpString=".dbf") returned 4 [0195.555] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.555] lstrlenW (lpString=".1cd") returned 4 [0195.555] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gl\\messages.json") returned 151 [0195.555] lstrlenW (lpString=".jpg") returned 4 [0195.555] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.555] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.555] lstrlenW (lpString="messages.json") returned 13 [0195.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.556] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=286) returned 1 [0195.556] CloseHandle (hObject=0x358) returned 1 [0195.556] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 0x2020 [0195.556] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.556] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.556] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.557] GetLastError () returned 0x0 [0195.557] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x11e, lpOverlapped=0x0) returned 1 [0195.558] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x120, lpOverlapped=0x0) returned 1 [0195.559] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.559] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.559] SetEndOfFile (hFile=0x120) returned 1 [0195.559] CloseHandle (hObject=0x120) returned 1 [0195.559] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.559] SetEndOfFile (hFile=0x358) returned 1 [0195.560] CloseHandle (hObject=0x358) returned 1 [0195.560] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.560] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json")) returned 1 [0195.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.560] lstrlenW (lpString=".doc") returned 4 [0195.560] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.560] lstrlenW (lpString=".docx") returned 5 [0195.561] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.561] lstrlenW (lpString=".pdf") returned 4 [0195.561] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.561] lstrlenW (lpString=".xls") returned 4 [0195.561] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.561] lstrlenW (lpString=".xlsx") returned 5 [0195.561] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.561] lstrlenW (lpString=".ppt") returned 4 [0195.561] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.561] lstrlenW (lpString=".zip") returned 4 [0195.561] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.561] lstrlenW (lpString=".rar") returned 4 [0195.561] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.561] lstrlenW (lpString=".bz2") returned 4 [0195.561] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.561] lstrlenW (lpString=".7z") returned 3 [0195.561] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.561] lstrlenW (lpString=".dbf") returned 4 [0195.561] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.561] lstrlenW (lpString=".1cd") returned 4 [0195.561] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.561] lstrlenW (lpString=".jpg") returned 4 [0195.561] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.561] lstrlenW (lpString=".doc") returned 4 [0195.561] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.561] lstrlenW (lpString=".docx") returned 5 [0195.561] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.561] lstrlenW (lpString=".pdf") returned 4 [0195.562] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.562] lstrlenW (lpString=".xls") returned 4 [0195.562] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.562] lstrlenW (lpString=".xlsx") returned 5 [0195.562] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.562] lstrlenW (lpString=".ppt") returned 4 [0195.562] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.562] lstrlenW (lpString=".zip") returned 4 [0195.562] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.562] lstrlenW (lpString=".rar") returned 4 [0195.562] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.562] lstrlenW (lpString=".bz2") returned 4 [0195.562] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.562] lstrlenW (lpString=".7z") returned 3 [0195.562] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.562] lstrlenW (lpString=".dbf") returned 4 [0195.562] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.562] lstrlenW (lpString=".1cd") returned 4 [0195.562] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\gu\\messages.json") returned 151 [0195.562] lstrlenW (lpString=".jpg") returned 4 [0195.562] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.562] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.562] lstrlenW (lpString="messages.json") returned 13 [0195.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.563] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=318) returned 1 [0195.563] CloseHandle (hObject=0x358) returned 1 [0195.563] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json")) returned 0x2020 [0195.563] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.563] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.563] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.564] GetLastError () returned 0x0 [0195.564] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x13e, lpOverlapped=0x0) returned 1 [0195.565] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x140, lpOverlapped=0x0) returned 1 [0195.566] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.566] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.566] SetEndOfFile (hFile=0x120) returned 1 [0195.566] CloseHandle (hObject=0x120) returned 1 [0195.566] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.566] SetEndOfFile (hFile=0x358) returned 1 [0195.567] CloseHandle (hObject=0x358) returned 1 [0195.567] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.567] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json")) returned 1 [0195.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.568] lstrlenW (lpString=".doc") returned 4 [0195.568] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.568] lstrlenW (lpString=".docx") returned 5 [0195.568] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.568] lstrlenW (lpString=".pdf") returned 4 [0195.568] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.568] lstrlenW (lpString=".xls") returned 4 [0195.568] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.568] lstrlenW (lpString=".xlsx") returned 5 [0195.568] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.568] lstrlenW (lpString=".ppt") returned 4 [0195.568] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.568] lstrlenW (lpString=".zip") returned 4 [0195.568] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.568] lstrlenW (lpString=".rar") returned 4 [0195.568] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.568] lstrlenW (lpString=".bz2") returned 4 [0195.568] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.568] lstrlenW (lpString=".7z") returned 3 [0195.568] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.568] lstrlenW (lpString=".dbf") returned 4 [0195.568] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.568] lstrlenW (lpString=".1cd") returned 4 [0195.568] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.568] lstrlenW (lpString=".jpg") returned 4 [0195.568] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.569] lstrlenW (lpString=".doc") returned 4 [0195.569] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.569] lstrlenW (lpString=".docx") returned 5 [0195.569] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.569] lstrlenW (lpString=".pdf") returned 4 [0195.569] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.569] lstrlenW (lpString=".xls") returned 4 [0195.569] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.569] lstrlenW (lpString=".xlsx") returned 5 [0195.569] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.569] lstrlenW (lpString=".ppt") returned 4 [0195.569] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.569] lstrlenW (lpString=".zip") returned 4 [0195.569] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.569] lstrlenW (lpString=".rar") returned 4 [0195.569] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.569] lstrlenW (lpString=".bz2") returned 4 [0195.569] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.569] lstrlenW (lpString=".7z") returned 3 [0195.569] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.569] lstrlenW (lpString=".dbf") returned 4 [0195.569] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.569] lstrlenW (lpString=".1cd") returned 4 [0195.569] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hi\\messages.json") returned 151 [0195.569] lstrlenW (lpString=".jpg") returned 4 [0195.569] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.569] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.570] lstrlenW (lpString="messages.json") returned 13 [0195.570] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.570] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=200) returned 1 [0195.570] CloseHandle (hObject=0x358) returned 1 [0195.570] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json")) returned 0x2020 [0195.570] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.570] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.571] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.571] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.571] GetLastError () returned 0x0 [0195.571] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xc8, lpOverlapped=0x0) returned 1 [0195.572] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.573] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.573] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.573] SetEndOfFile (hFile=0x120) returned 1 [0195.574] CloseHandle (hObject=0x120) returned 1 [0195.574] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.574] SetEndOfFile (hFile=0x358) returned 1 [0195.574] CloseHandle (hObject=0x358) returned 1 [0195.574] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.575] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json")) returned 1 [0195.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.575] lstrlenW (lpString=".doc") returned 4 [0195.575] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.575] lstrlenW (lpString=".docx") returned 5 [0195.575] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.575] lstrlenW (lpString=".pdf") returned 4 [0195.575] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.575] lstrlenW (lpString=".xls") returned 4 [0195.575] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.575] lstrlenW (lpString=".xlsx") returned 5 [0195.575] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.575] lstrlenW (lpString=".ppt") returned 4 [0195.575] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.575] lstrlenW (lpString=".zip") returned 4 [0195.575] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.575] lstrlenW (lpString=".rar") returned 4 [0195.575] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.575] lstrlenW (lpString=".bz2") returned 4 [0195.576] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.576] lstrlenW (lpString=".7z") returned 3 [0195.576] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.576] lstrlenW (lpString=".dbf") returned 4 [0195.576] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.576] lstrlenW (lpString=".1cd") returned 4 [0195.576] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.576] lstrlenW (lpString=".jpg") returned 4 [0195.576] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.576] lstrlenW (lpString=".doc") returned 4 [0195.576] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.576] lstrlenW (lpString=".docx") returned 5 [0195.576] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.576] lstrlenW (lpString=".pdf") returned 4 [0195.576] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.576] lstrlenW (lpString=".xls") returned 4 [0195.576] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.576] lstrlenW (lpString=".xlsx") returned 5 [0195.576] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.576] lstrlenW (lpString=".ppt") returned 4 [0195.576] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.576] lstrlenW (lpString=".zip") returned 4 [0195.576] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.576] lstrlenW (lpString=".rar") returned 4 [0195.576] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.576] lstrlenW (lpString=".bz2") returned 4 [0195.576] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.576] lstrlenW (lpString=".7z") returned 3 [0195.577] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.577] lstrlenW (lpString=".dbf") returned 4 [0195.577] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.577] lstrlenW (lpString=".1cd") returned 4 [0195.577] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hr\\messages.json") returned 151 [0195.577] lstrlenW (lpString=".jpg") returned 4 [0195.577] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.577] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.577] lstrlenW (lpString="messages.json") returned 13 [0195.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.579] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=198) returned 1 [0195.579] CloseHandle (hObject=0x358) returned 1 [0195.579] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json")) returned 0x2020 [0195.579] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.579] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.579] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.580] GetLastError () returned 0x0 [0195.580] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xc6, lpOverlapped=0x0) returned 1 [0195.581] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.582] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.582] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.582] SetEndOfFile (hFile=0x120) returned 1 [0195.582] CloseHandle (hObject=0x120) returned 1 [0195.582] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.582] SetEndOfFile (hFile=0x358) returned 1 [0195.583] CloseHandle (hObject=0x358) returned 1 [0195.583] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.583] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json")) returned 1 [0195.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.584] lstrlenW (lpString=".doc") returned 4 [0195.584] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.584] lstrlenW (lpString=".docx") returned 5 [0195.584] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.584] lstrlenW (lpString=".pdf") returned 4 [0195.584] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.584] lstrlenW (lpString=".xls") returned 4 [0195.584] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.584] lstrlenW (lpString=".xlsx") returned 5 [0195.584] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.584] lstrlenW (lpString=".ppt") returned 4 [0195.584] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.584] lstrlenW (lpString=".zip") returned 4 [0195.584] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.584] lstrlenW (lpString=".rar") returned 4 [0195.584] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.584] lstrlenW (lpString=".bz2") returned 4 [0195.584] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.584] lstrlenW (lpString=".7z") returned 3 [0195.584] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.584] lstrlenW (lpString=".dbf") returned 4 [0195.584] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.584] lstrlenW (lpString=".1cd") returned 4 [0195.584] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.584] lstrlenW (lpString=".jpg") returned 4 [0195.584] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.585] lstrlenW (lpString=".doc") returned 4 [0195.585] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.585] lstrlenW (lpString=".docx") returned 5 [0195.585] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.585] lstrlenW (lpString=".pdf") returned 4 [0195.585] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.585] lstrlenW (lpString=".xls") returned 4 [0195.585] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.585] lstrlenW (lpString=".xlsx") returned 5 [0195.585] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.585] lstrlenW (lpString=".ppt") returned 4 [0195.585] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.585] lstrlenW (lpString=".zip") returned 4 [0195.585] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.585] lstrlenW (lpString=".rar") returned 4 [0195.585] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.585] lstrlenW (lpString=".bz2") returned 4 [0195.585] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.585] lstrlenW (lpString=".7z") returned 3 [0195.585] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.585] lstrlenW (lpString=".dbf") returned 4 [0195.585] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.585] lstrlenW (lpString=".1cd") returned 4 [0195.585] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hu\\messages.json") returned 151 [0195.585] lstrlenW (lpString=".jpg") returned 4 [0195.585] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.586] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.586] lstrlenW (lpString="messages.json") returned 13 [0195.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.586] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=665) returned 1 [0195.586] CloseHandle (hObject=0x358) returned 1 [0195.586] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json")) returned 0x2020 [0195.586] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.586] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.587] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.587] GetLastError () returned 0x0 [0195.587] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x299, lpOverlapped=0x0) returned 1 [0195.589] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0195.590] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.590] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.590] SetEndOfFile (hFile=0x120) returned 1 [0195.591] CloseHandle (hObject=0x120) returned 1 [0195.591] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.591] SetEndOfFile (hFile=0x358) returned 1 [0195.591] CloseHandle (hObject=0x358) returned 1 [0195.592] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.592] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json")) returned 1 [0195.592] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.592] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.592] lstrlenW (lpString=".doc") returned 4 [0195.592] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.592] lstrlenW (lpString=".docx") returned 5 [0195.592] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.592] lstrlenW (lpString=".pdf") returned 4 [0195.592] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.592] lstrlenW (lpString=".xls") returned 4 [0195.592] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.592] lstrlenW (lpString=".xlsx") returned 5 [0195.592] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.592] lstrlenW (lpString=".ppt") returned 4 [0195.592] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.592] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.592] lstrlenW (lpString=".zip") returned 4 [0195.592] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.592] lstrlenW (lpString=".rar") returned 4 [0195.592] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.592] lstrlenW (lpString=".bz2") returned 4 [0195.592] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.593] lstrlenW (lpString=".7z") returned 3 [0195.593] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.593] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.593] lstrlenW (lpString=".dbf") returned 4 [0195.593] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.593] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.593] lstrlenW (lpString=".1cd") returned 4 [0195.593] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.593] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.593] lstrlenW (lpString=".jpg") returned 4 [0195.593] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.593] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.593] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.593] lstrlenW (lpString=".doc") returned 4 [0195.593] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.593] lstrlenW (lpString=".docx") returned 5 [0195.593] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.593] lstrlenW (lpString=".pdf") returned 4 [0195.593] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.593] lstrlenW (lpString=".xls") returned 4 [0195.593] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.593] lstrlenW (lpString=".xlsx") returned 5 [0195.593] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.593] lstrlenW (lpString=".ppt") returned 4 [0195.593] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.593] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.593] lstrlenW (lpString=".zip") returned 4 [0195.593] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.593] lstrlenW (lpString=".rar") returned 4 [0195.593] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.593] lstrlenW (lpString=".bz2") returned 4 [0195.594] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.594] lstrlenW (lpString=".7z") returned 3 [0195.594] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.594] lstrlenW (lpString=".dbf") returned 4 [0195.594] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.594] lstrlenW (lpString=".1cd") returned 4 [0195.594] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\hy\\messages.json") returned 151 [0195.594] lstrlenW (lpString=".jpg") returned 4 [0195.594] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.594] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.594] lstrlenW (lpString="messages.json") returned 13 [0195.594] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.595] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=187) returned 1 [0195.595] CloseHandle (hObject=0x358) returned 1 [0195.595] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json")) returned 0x2020 [0195.595] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.595] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.595] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.595] GetLastError () returned 0x0 [0195.596] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xbb, lpOverlapped=0x0) returned 1 [0195.596] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.597] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.597] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.598] SetEndOfFile (hFile=0x120) returned 1 [0195.598] CloseHandle (hObject=0x120) returned 1 [0195.598] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.598] SetEndOfFile (hFile=0x358) returned 1 [0195.599] CloseHandle (hObject=0x358) returned 1 [0195.599] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.599] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json")) returned 1 [0195.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.599] lstrlenW (lpString=".doc") returned 4 [0195.599] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.599] lstrlenW (lpString=".docx") returned 5 [0195.599] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.599] lstrlenW (lpString=".pdf") returned 4 [0195.599] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.599] lstrlenW (lpString=".xls") returned 4 [0195.599] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.599] lstrlenW (lpString=".xlsx") returned 5 [0195.599] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.599] lstrlenW (lpString=".ppt") returned 4 [0195.600] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.600] lstrlenW (lpString=".zip") returned 4 [0195.600] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.600] lstrlenW (lpString=".rar") returned 4 [0195.600] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.600] lstrlenW (lpString=".bz2") returned 4 [0195.600] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.600] lstrlenW (lpString=".7z") returned 3 [0195.600] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.600] lstrlenW (lpString=".dbf") returned 4 [0195.600] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.600] lstrlenW (lpString=".1cd") returned 4 [0195.600] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.600] lstrlenW (lpString=".jpg") returned 4 [0195.600] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.600] lstrlenW (lpString=".doc") returned 4 [0195.600] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.600] lstrlenW (lpString=".docx") returned 5 [0195.600] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.600] lstrlenW (lpString=".pdf") returned 4 [0195.600] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.600] lstrlenW (lpString=".xls") returned 4 [0195.600] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.600] lstrlenW (lpString=".xlsx") returned 5 [0195.600] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.600] lstrlenW (lpString=".ppt") returned 4 [0195.600] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.601] lstrlenW (lpString=".zip") returned 4 [0195.601] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.601] lstrlenW (lpString=".rar") returned 4 [0195.601] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.601] lstrlenW (lpString=".bz2") returned 4 [0195.601] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.601] lstrlenW (lpString=".7z") returned 3 [0195.601] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.601] lstrlenW (lpString=".dbf") returned 4 [0195.601] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.601] lstrlenW (lpString=".1cd") returned 4 [0195.601] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\id\\messages.json") returned 151 [0195.601] lstrlenW (lpString=".jpg") returned 4 [0195.601] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.601] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.601] lstrlenW (lpString="messages.json") returned 13 [0195.601] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.602] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=178) returned 1 [0195.602] CloseHandle (hObject=0x358) returned 1 [0195.602] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json")) returned 0x2020 [0195.602] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.602] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.602] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.603] GetLastError () returned 0x0 [0195.603] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xb2, lpOverlapped=0x0) returned 1 [0195.604] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.745] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.745] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.745] SetEndOfFile (hFile=0x120) returned 1 [0195.745] CloseHandle (hObject=0x120) returned 1 [0195.745] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.746] SetEndOfFile (hFile=0x358) returned 1 [0195.746] CloseHandle (hObject=0x358) returned 1 [0195.746] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.747] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json")) returned 1 [0195.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.747] lstrlenW (lpString=".doc") returned 4 [0195.747] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.747] lstrlenW (lpString=".docx") returned 5 [0195.747] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.747] lstrlenW (lpString=".pdf") returned 4 [0195.747] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.747] lstrlenW (lpString=".xls") returned 4 [0195.747] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.747] lstrlenW (lpString=".xlsx") returned 5 [0195.747] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.747] lstrlenW (lpString=".ppt") returned 4 [0195.747] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.747] lstrlenW (lpString=".zip") returned 4 [0195.747] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.747] lstrlenW (lpString=".rar") returned 4 [0195.747] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.747] lstrlenW (lpString=".bz2") returned 4 [0195.747] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.747] lstrlenW (lpString=".7z") returned 3 [0195.747] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.747] lstrlenW (lpString=".dbf") returned 4 [0195.748] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.748] lstrlenW (lpString=".1cd") returned 4 [0195.748] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.748] lstrlenW (lpString=".jpg") returned 4 [0195.748] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.748] lstrlenW (lpString=".doc") returned 4 [0195.748] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.748] lstrlenW (lpString=".docx") returned 5 [0195.748] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.748] lstrlenW (lpString=".pdf") returned 4 [0195.748] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.748] lstrlenW (lpString=".xls") returned 4 [0195.748] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.748] lstrlenW (lpString=".xlsx") returned 5 [0195.748] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.748] lstrlenW (lpString=".ppt") returned 4 [0195.748] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.748] lstrlenW (lpString=".zip") returned 4 [0195.748] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.748] lstrlenW (lpString=".rar") returned 4 [0195.748] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.748] lstrlenW (lpString=".bz2") returned 4 [0195.748] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.748] lstrlenW (lpString=".7z") returned 3 [0195.748] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.749] lstrlenW (lpString=".dbf") returned 4 [0195.749] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.749] lstrlenW (lpString=".1cd") returned 4 [0195.749] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\is\\messages.json") returned 151 [0195.749] lstrlenW (lpString=".jpg") returned 4 [0195.749] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.749] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.749] lstrlenW (lpString="messages.json") returned 13 [0195.749] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.749] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=523) returned 1 [0195.749] CloseHandle (hObject=0x358) returned 1 [0195.750] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json")) returned 0x2020 [0195.750] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.750] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.750] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.750] GetLastError () returned 0x0 [0195.750] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x20b, lpOverlapped=0x0) returned 1 [0195.751] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x210, lpOverlapped=0x0) returned 1 [0195.752] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.752] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.753] SetEndOfFile (hFile=0x120) returned 1 [0195.753] CloseHandle (hObject=0x120) returned 1 [0195.753] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.753] SetEndOfFile (hFile=0x358) returned 1 [0195.754] CloseHandle (hObject=0x358) returned 1 [0195.754] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.754] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json")) returned 1 [0195.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.754] lstrlenW (lpString=".doc") returned 4 [0195.754] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.754] lstrlenW (lpString=".docx") returned 5 [0195.754] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.754] lstrlenW (lpString=".pdf") returned 4 [0195.754] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.754] lstrlenW (lpString=".xls") returned 4 [0195.754] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.754] lstrlenW (lpString=".xlsx") returned 5 [0195.754] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.755] lstrlenW (lpString=".ppt") returned 4 [0195.755] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.755] lstrlenW (lpString=".zip") returned 4 [0195.755] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.755] lstrlenW (lpString=".rar") returned 4 [0195.755] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.755] lstrlenW (lpString=".bz2") returned 4 [0195.755] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.755] lstrlenW (lpString=".7z") returned 3 [0195.755] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.755] lstrlenW (lpString=".dbf") returned 4 [0195.755] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.755] lstrlenW (lpString=".1cd") returned 4 [0195.755] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.755] lstrlenW (lpString=".jpg") returned 4 [0195.755] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.755] lstrlenW (lpString=".doc") returned 4 [0195.755] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.755] lstrlenW (lpString=".docx") returned 5 [0195.755] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.755] lstrlenW (lpString=".pdf") returned 4 [0195.755] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.755] lstrlenW (lpString=".xls") returned 4 [0195.755] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.755] lstrlenW (lpString=".xlsx") returned 5 [0195.756] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.756] lstrlenW (lpString=".ppt") returned 4 [0195.756] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.756] lstrlenW (lpString=".zip") returned 4 [0195.756] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.756] lstrlenW (lpString=".rar") returned 4 [0195.756] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.756] lstrlenW (lpString=".bz2") returned 4 [0195.756] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.756] lstrlenW (lpString=".7z") returned 3 [0195.756] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.756] lstrlenW (lpString=".dbf") returned 4 [0195.756] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.756] lstrlenW (lpString=".1cd") returned 4 [0195.756] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ne\\messages.json") returned 151 [0195.756] lstrlenW (lpString=".jpg") returned 4 [0195.756] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.756] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.756] lstrlenW (lpString="messages.json") returned 13 [0195.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.757] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=177) returned 1 [0195.757] CloseHandle (hObject=0x358) returned 1 [0195.757] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json")) returned 0x2020 [0195.757] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.757] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.757] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.758] GetLastError () returned 0x0 [0195.758] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xb1, lpOverlapped=0x0) returned 1 [0195.759] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.760] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.760] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.760] SetEndOfFile (hFile=0x120) returned 1 [0195.760] CloseHandle (hObject=0x120) returned 1 [0195.760] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.760] SetEndOfFile (hFile=0x358) returned 1 [0195.761] CloseHandle (hObject=0x358) returned 1 [0195.761] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.761] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json")) returned 1 [0195.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.762] lstrlenW (lpString=".doc") returned 4 [0195.762] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.762] lstrlenW (lpString=".docx") returned 5 [0195.762] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.762] lstrlenW (lpString=".pdf") returned 4 [0195.762] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.762] lstrlenW (lpString=".xls") returned 4 [0195.762] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.762] lstrlenW (lpString=".xlsx") returned 5 [0195.762] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.762] lstrlenW (lpString=".ppt") returned 4 [0195.762] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.762] lstrlenW (lpString=".zip") returned 4 [0195.762] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.762] lstrlenW (lpString=".rar") returned 4 [0195.762] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.762] lstrlenW (lpString=".bz2") returned 4 [0195.762] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.762] lstrlenW (lpString=".7z") returned 3 [0195.762] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.762] lstrlenW (lpString=".dbf") returned 4 [0195.762] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.763] lstrlenW (lpString=".1cd") returned 4 [0195.763] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.763] lstrlenW (lpString=".jpg") returned 4 [0195.763] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.763] lstrlenW (lpString=".doc") returned 4 [0195.763] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.763] lstrlenW (lpString=".docx") returned 5 [0195.763] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.763] lstrlenW (lpString=".pdf") returned 4 [0195.763] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.763] lstrlenW (lpString=".xls") returned 4 [0195.763] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.763] lstrlenW (lpString=".xlsx") returned 5 [0195.763] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.763] lstrlenW (lpString=".ppt") returned 4 [0195.763] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.763] lstrlenW (lpString=".zip") returned 4 [0195.763] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.763] lstrlenW (lpString=".rar") returned 4 [0195.763] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.763] lstrlenW (lpString=".bz2") returned 4 [0195.763] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.763] lstrlenW (lpString=".7z") returned 3 [0195.763] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.763] lstrlenW (lpString=".dbf") returned 4 [0195.763] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.764] lstrlenW (lpString=".1cd") returned 4 [0195.764] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.764] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\nl\\messages.json") returned 151 [0195.764] lstrlenW (lpString=".jpg") returned 4 [0195.764] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.764] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.764] lstrlenW (lpString="messages.json") returned 13 [0195.764] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.764] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=150) returned 1 [0195.764] CloseHandle (hObject=0x358) returned 1 [0195.764] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json")) returned 0x2020 [0195.765] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.765] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.765] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.765] GetLastError () returned 0x0 [0195.765] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x96, lpOverlapped=0x0) returned 1 [0195.766] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xa0, lpOverlapped=0x0) returned 1 [0195.767] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.767] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.767] SetEndOfFile (hFile=0x120) returned 1 [0195.768] CloseHandle (hObject=0x120) returned 1 [0195.768] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.768] SetEndOfFile (hFile=0x358) returned 1 [0195.768] CloseHandle (hObject=0x358) returned 1 [0195.768] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.769] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json")) returned 1 [0195.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.769] lstrlenW (lpString=".doc") returned 4 [0195.769] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.769] lstrlenW (lpString=".docx") returned 5 [0195.769] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.769] lstrlenW (lpString=".pdf") returned 4 [0195.769] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.769] lstrlenW (lpString=".xls") returned 4 [0195.769] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.769] lstrlenW (lpString=".xlsx") returned 5 [0195.769] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.769] lstrlenW (lpString=".ppt") returned 4 [0195.769] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.769] lstrlenW (lpString=".zip") returned 4 [0195.769] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.769] lstrlenW (lpString=".rar") returned 4 [0195.769] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.770] lstrlenW (lpString=".bz2") returned 4 [0195.770] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.770] lstrlenW (lpString=".7z") returned 3 [0195.770] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.770] lstrlenW (lpString=".dbf") returned 4 [0195.770] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.770] lstrlenW (lpString=".1cd") returned 4 [0195.770] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.770] lstrlenW (lpString=".jpg") returned 4 [0195.770] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.770] lstrlenW (lpString=".doc") returned 4 [0195.770] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.770] lstrlenW (lpString=".docx") returned 5 [0195.770] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.770] lstrlenW (lpString=".pdf") returned 4 [0195.770] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.770] lstrlenW (lpString=".xls") returned 4 [0195.770] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.770] lstrlenW (lpString=".xlsx") returned 5 [0195.770] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.770] lstrlenW (lpString=".ppt") returned 4 [0195.770] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.770] lstrlenW (lpString=".zip") returned 4 [0195.770] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.770] lstrlenW (lpString=".rar") returned 4 [0195.770] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.771] lstrlenW (lpString=".bz2") returned 4 [0195.771] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.771] lstrlenW (lpString=".7z") returned 3 [0195.771] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.771] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.771] lstrlenW (lpString=".dbf") returned 4 [0195.771] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.771] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.771] lstrlenW (lpString=".1cd") returned 4 [0195.771] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.771] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\no\\messages.json") returned 151 [0195.771] lstrlenW (lpString=".jpg") returned 4 [0195.771] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.771] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.771] lstrlenW (lpString="messages.json") returned 13 [0195.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.774] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=180) returned 1 [0195.774] CloseHandle (hObject=0x358) returned 1 [0195.774] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json")) returned 0x2020 [0195.774] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.774] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.775] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.775] GetLastError () returned 0x0 [0195.775] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xb4, lpOverlapped=0x0) returned 1 [0195.776] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.777] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.777] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.778] SetEndOfFile (hFile=0x120) returned 1 [0195.778] CloseHandle (hObject=0x120) returned 1 [0195.778] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.778] SetEndOfFile (hFile=0x358) returned 1 [0195.778] CloseHandle (hObject=0x358) returned 1 [0195.779] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.779] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json")) returned 1 [0195.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.779] lstrlenW (lpString=".doc") returned 4 [0195.779] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.779] lstrlenW (lpString=".docx") returned 5 [0195.779] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.779] lstrlenW (lpString=".pdf") returned 4 [0195.779] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.779] lstrlenW (lpString=".xls") returned 4 [0195.779] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.779] lstrlenW (lpString=".xlsx") returned 5 [0195.779] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.779] lstrlenW (lpString=".ppt") returned 4 [0195.779] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.779] lstrlenW (lpString=".zip") returned 4 [0195.779] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.779] lstrlenW (lpString=".rar") returned 4 [0195.779] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.779] lstrlenW (lpString=".bz2") returned 4 [0195.779] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.780] lstrlenW (lpString=".7z") returned 3 [0195.780] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.780] lstrlenW (lpString=".dbf") returned 4 [0195.780] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.780] lstrlenW (lpString=".1cd") returned 4 [0195.780] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.780] lstrlenW (lpString=".jpg") returned 4 [0195.780] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.780] lstrlenW (lpString=".doc") returned 4 [0195.780] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.780] lstrlenW (lpString=".docx") returned 5 [0195.780] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.780] lstrlenW (lpString=".pdf") returned 4 [0195.780] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.780] lstrlenW (lpString=".xls") returned 4 [0195.780] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.780] lstrlenW (lpString=".xlsx") returned 5 [0195.780] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.780] lstrlenW (lpString=".ppt") returned 4 [0195.780] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.780] lstrlenW (lpString=".zip") returned 4 [0195.780] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.780] lstrlenW (lpString=".rar") returned 4 [0195.780] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.780] lstrlenW (lpString=".bz2") returned 4 [0195.781] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.781] lstrlenW (lpString=".7z") returned 3 [0195.781] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.781] lstrlenW (lpString=".dbf") returned 4 [0195.781] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.781] lstrlenW (lpString=".1cd") returned 4 [0195.781] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pl\\messages.json") returned 151 [0195.781] lstrlenW (lpString=".jpg") returned 4 [0195.781] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.781] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.781] lstrlenW (lpString="messages.json") returned 13 [0195.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.782] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=187) returned 1 [0195.782] CloseHandle (hObject=0x358) returned 1 [0195.782] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0195.782] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.782] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.782] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.782] GetLastError () returned 0x0 [0195.783] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xbb, lpOverlapped=0x0) returned 1 [0195.900] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.901] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.901] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.901] SetEndOfFile (hFile=0x120) returned 1 [0195.901] CloseHandle (hObject=0x120) returned 1 [0195.901] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.901] SetEndOfFile (hFile=0x358) returned 1 [0195.902] CloseHandle (hObject=0x358) returned 1 [0195.902] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.902] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_br\\messages.json")) returned 1 [0195.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.903] lstrlenW (lpString=".doc") returned 4 [0195.903] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.903] lstrlenW (lpString=".docx") returned 5 [0195.903] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.903] lstrlenW (lpString=".pdf") returned 4 [0195.903] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.903] lstrlenW (lpString=".xls") returned 4 [0195.903] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.903] lstrlenW (lpString=".xlsx") returned 5 [0195.903] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.903] lstrlenW (lpString=".ppt") returned 4 [0195.903] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.903] lstrlenW (lpString=".zip") returned 4 [0195.903] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.903] lstrlenW (lpString=".rar") returned 4 [0195.903] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.903] lstrlenW (lpString=".bz2") returned 4 [0195.903] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.903] lstrlenW (lpString=".7z") returned 3 [0195.903] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.903] lstrlenW (lpString=".dbf") returned 4 [0195.903] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.903] lstrlenW (lpString=".1cd") returned 4 [0195.903] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.903] lstrlenW (lpString=".jpg") returned 4 [0195.903] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.903] lstrlenW (lpString=".doc") returned 4 [0195.903] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.904] lstrlenW (lpString=".docx") returned 5 [0195.904] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.904] lstrlenW (lpString=".pdf") returned 4 [0195.904] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.904] lstrlenW (lpString=".xls") returned 4 [0195.904] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.904] lstrlenW (lpString=".xlsx") returned 5 [0195.904] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.904] lstrlenW (lpString=".ppt") returned 4 [0195.904] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.904] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.904] lstrlenW (lpString=".zip") returned 4 [0195.904] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.904] lstrlenW (lpString=".rar") returned 4 [0195.904] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.904] lstrlenW (lpString=".bz2") returned 4 [0195.904] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.904] lstrlenW (lpString=".7z") returned 3 [0195.904] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.904] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.904] lstrlenW (lpString=".dbf") returned 4 [0195.904] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.904] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.904] lstrlenW (lpString=".1cd") returned 4 [0195.904] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.904] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_BR\\messages.json") returned 154 [0195.904] lstrlenW (lpString=".jpg") returned 4 [0195.904] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.904] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.904] lstrlenW (lpString="messages.json") returned 13 [0195.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.905] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=221) returned 1 [0195.905] CloseHandle (hObject=0x358) returned 1 [0195.905] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 0x2020 [0195.905] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.905] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.905] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.908] GetLastError () returned 0x0 [0195.908] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xdd, lpOverlapped=0x0) returned 1 [0195.908] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.910] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.910] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.910] SetEndOfFile (hFile=0x120) returned 1 [0195.910] CloseHandle (hObject=0x120) returned 1 [0195.910] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.910] SetEndOfFile (hFile=0x358) returned 1 [0195.911] CloseHandle (hObject=0x358) returned 1 [0195.911] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.911] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json")) returned 1 [0195.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.911] lstrlenW (lpString=".doc") returned 4 [0195.911] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.911] lstrlenW (lpString=".docx") returned 5 [0195.911] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.911] lstrlenW (lpString=".pdf") returned 4 [0195.911] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.911] lstrlenW (lpString=".xls") returned 4 [0195.911] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.911] lstrlenW (lpString=".xlsx") returned 5 [0195.911] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.911] lstrlenW (lpString=".ppt") returned 4 [0195.911] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.912] lstrlenW (lpString=".zip") returned 4 [0195.912] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.912] lstrlenW (lpString=".rar") returned 4 [0195.912] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.912] lstrlenW (lpString=".bz2") returned 4 [0195.912] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.912] lstrlenW (lpString=".7z") returned 3 [0195.912] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.912] lstrlenW (lpString=".dbf") returned 4 [0195.912] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.912] lstrlenW (lpString=".1cd") returned 4 [0195.912] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.912] lstrlenW (lpString=".jpg") returned 4 [0195.912] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.912] lstrlenW (lpString=".doc") returned 4 [0195.912] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.912] lstrlenW (lpString=".docx") returned 5 [0195.912] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.912] lstrlenW (lpString=".pdf") returned 4 [0195.912] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.912] lstrlenW (lpString=".xls") returned 4 [0195.912] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.912] lstrlenW (lpString=".xlsx") returned 5 [0195.912] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.912] lstrlenW (lpString=".ppt") returned 4 [0195.912] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.912] lstrlenW (lpString=".zip") returned 4 [0195.913] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.913] lstrlenW (lpString=".rar") returned 4 [0195.913] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.913] lstrlenW (lpString=".bz2") returned 4 [0195.913] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.913] lstrlenW (lpString=".7z") returned 3 [0195.913] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.913] lstrlenW (lpString=".dbf") returned 4 [0195.913] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.913] lstrlenW (lpString=".1cd") returned 4 [0195.913] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\vi\\messages.json") returned 151 [0195.913] lstrlenW (lpString=".jpg") returned 4 [0195.913] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.913] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.913] lstrlenW (lpString="messages.json") returned 13 [0195.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.914] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=176) returned 1 [0195.914] CloseHandle (hObject=0x358) returned 1 [0195.914] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0195.914] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.914] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.914] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.914] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.914] GetLastError () returned 0x0 [0195.915] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xb0, lpOverlapped=0x0) returned 1 [0195.915] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.916] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.916] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.916] SetEndOfFile (hFile=0x120) returned 1 [0195.917] CloseHandle (hObject=0x120) returned 1 [0195.917] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.917] SetEndOfFile (hFile=0x358) returned 1 [0195.917] CloseHandle (hObject=0x358) returned 1 [0195.917] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.918] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_cn\\messages.json")) returned 1 [0195.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.918] lstrlenW (lpString=".doc") returned 4 [0195.918] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.918] lstrlenW (lpString=".docx") returned 5 [0195.918] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.918] lstrlenW (lpString=".pdf") returned 4 [0195.918] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.918] lstrlenW (lpString=".xls") returned 4 [0195.918] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.918] lstrlenW (lpString=".xlsx") returned 5 [0195.918] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.918] lstrlenW (lpString=".ppt") returned 4 [0195.918] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.918] lstrlenW (lpString=".zip") returned 4 [0195.918] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.918] lstrlenW (lpString=".rar") returned 4 [0195.918] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.918] lstrlenW (lpString=".bz2") returned 4 [0195.918] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.918] lstrlenW (lpString=".7z") returned 3 [0195.918] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.919] lstrlenW (lpString=".dbf") returned 4 [0195.919] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.919] lstrlenW (lpString=".1cd") returned 4 [0195.919] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.919] lstrlenW (lpString=".jpg") returned 4 [0195.919] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.919] lstrlenW (lpString=".doc") returned 4 [0195.919] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.919] lstrlenW (lpString=".docx") returned 5 [0195.919] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.919] lstrlenW (lpString=".pdf") returned 4 [0195.919] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.919] lstrlenW (lpString=".xls") returned 4 [0195.919] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.919] lstrlenW (lpString=".xlsx") returned 5 [0195.919] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.919] lstrlenW (lpString=".ppt") returned 4 [0195.919] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.919] lstrlenW (lpString=".zip") returned 4 [0195.919] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.919] lstrlenW (lpString=".rar") returned 4 [0195.919] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.919] lstrlenW (lpString=".bz2") returned 4 [0195.919] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.919] lstrlenW (lpString=".7z") returned 3 [0195.919] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.919] lstrlenW (lpString=".dbf") returned 4 [0195.919] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.920] lstrlenW (lpString=".1cd") returned 4 [0195.920] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.920] lstrlenW (lpString=".jpg") returned 4 [0195.920] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.920] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.920] lstrlenW (lpString="messages.json") returned 13 [0195.920] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.920] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=210) returned 1 [0195.920] CloseHandle (hObject=0x358) returned 1 [0195.920] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 0x2020 [0195.920] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.921] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.921] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.921] GetLastError () returned 0x0 [0195.921] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xd2, lpOverlapped=0x0) returned 1 [0195.922] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.923] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.923] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.923] SetEndOfFile (hFile=0x120) returned 1 [0195.923] CloseHandle (hObject=0x120) returned 1 [0195.923] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.923] SetEndOfFile (hFile=0x358) returned 1 [0195.924] CloseHandle (hObject=0x358) returned 1 [0195.924] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.924] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_hk\\messages.json")) returned 1 [0195.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.924] lstrlenW (lpString=".doc") returned 4 [0195.924] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.925] lstrlenW (lpString=".docx") returned 5 [0195.925] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.925] lstrlenW (lpString=".pdf") returned 4 [0195.925] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.925] lstrlenW (lpString=".xls") returned 4 [0195.925] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.925] lstrlenW (lpString=".xlsx") returned 5 [0195.925] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.925] lstrlenW (lpString=".ppt") returned 4 [0195.925] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.925] lstrlenW (lpString=".zip") returned 4 [0195.925] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.925] lstrlenW (lpString=".rar") returned 4 [0195.925] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.925] lstrlenW (lpString=".bz2") returned 4 [0195.925] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.925] lstrlenW (lpString=".7z") returned 3 [0195.925] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.925] lstrlenW (lpString=".dbf") returned 4 [0195.925] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.925] lstrlenW (lpString=".1cd") returned 4 [0195.925] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.925] lstrlenW (lpString=".jpg") returned 4 [0195.925] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.925] lstrlenW (lpString=".doc") returned 4 [0195.925] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.925] lstrlenW (lpString=".docx") returned 5 [0195.925] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.926] lstrlenW (lpString=".pdf") returned 4 [0195.926] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.926] lstrlenW (lpString=".xls") returned 4 [0195.926] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.926] lstrlenW (lpString=".xlsx") returned 5 [0195.926] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.926] lstrlenW (lpString=".ppt") returned 4 [0195.926] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.926] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.926] lstrlenW (lpString=".zip") returned 4 [0195.926] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.926] lstrlenW (lpString=".rar") returned 4 [0195.926] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.926] lstrlenW (lpString=".bz2") returned 4 [0195.926] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.926] lstrlenW (lpString=".7z") returned 3 [0195.926] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.926] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.926] lstrlenW (lpString=".dbf") returned 4 [0195.926] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.926] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.926] lstrlenW (lpString=".1cd") returned 4 [0195.926] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.926] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_HK\\messages.json") returned 154 [0195.926] lstrlenW (lpString=".jpg") returned 4 [0195.926] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.926] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.926] lstrlenW (lpString="messages.json") returned 13 [0195.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.927] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=170) returned 1 [0195.927] CloseHandle (hObject=0x358) returned 1 [0195.927] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0195.927] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.927] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.927] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.928] GetLastError () returned 0x0 [0195.928] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xaa, lpOverlapped=0x0) returned 1 [0195.929] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xb0, lpOverlapped=0x0) returned 1 [0195.930] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0195.930] WriteFile (in: hFile=0x120, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.930] SetEndOfFile (hFile=0x120) returned 1 [0195.930] CloseHandle (hObject=0x120) returned 1 [0195.930] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0195.930] SetEndOfFile (hFile=0x358) returned 1 [0195.931] CloseHandle (hObject=0x358) returned 1 [0195.931] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.931] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_tw\\messages.json")) returned 1 [0195.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.931] lstrlenW (lpString=".doc") returned 4 [0195.931] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.931] lstrlenW (lpString=".docx") returned 5 [0195.931] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.931] lstrlenW (lpString=".pdf") returned 4 [0195.931] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.932] lstrlenW (lpString=".xls") returned 4 [0195.932] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.932] lstrlenW (lpString=".xlsx") returned 5 [0195.932] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.932] lstrlenW (lpString=".ppt") returned 4 [0195.932] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.932] lstrlenW (lpString=".zip") returned 4 [0195.932] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.932] lstrlenW (lpString=".rar") returned 4 [0195.932] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.932] lstrlenW (lpString=".bz2") returned 4 [0195.932] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.932] lstrlenW (lpString=".7z") returned 3 [0195.932] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.932] lstrlenW (lpString=".dbf") returned 4 [0195.932] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.932] lstrlenW (lpString=".1cd") returned 4 [0195.932] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0196.037] lstrlenW (lpString=".jpg") returned 4 [0196.037] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0196.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0196.037] lstrlenW (lpString=".doc") returned 4 [0196.037] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.037] lstrlenW (lpString=".docx") returned 5 [0196.037] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.037] lstrlenW (lpString=".pdf") returned 4 [0196.053] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.053] lstrlenW (lpString=".xls") returned 4 [0196.053] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.053] lstrlenW (lpString=".xlsx") returned 5 [0196.053] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.053] lstrlenW (lpString=".ppt") returned 4 [0196.053] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.053] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0196.053] lstrlenW (lpString=".zip") returned 4 [0196.053] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.053] lstrlenW (lpString=".rar") returned 4 [0196.053] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.053] lstrlenW (lpString=".bz2") returned 4 [0196.053] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.053] lstrlenW (lpString=".7z") returned 3 [0196.053] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.053] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0196.053] lstrlenW (lpString=".dbf") returned 4 [0196.053] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.053] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0196.053] lstrlenW (lpString=".1cd") returned 4 [0196.053] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.053] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zh_TW\\messages.json") returned 154 [0196.053] lstrlenW (lpString=".jpg") returned 4 [0196.053] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.070] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0196.070] lstrlenW (lpString="craw_window.html") returned 16 [0196.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.071] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=810) returned 1 [0196.071] CloseHandle (hObject=0x114) returned 1 [0196.071] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 0x2020 [0196.071] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.071] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.071] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.071] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.072] GetLastError () returned 0x0 [0196.072] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x32a, lpOverlapped=0x0) returned 1 [0196.073] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x330, lpOverlapped=0x0) returned 1 [0196.074] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.074] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf4, lpOverlapped=0x0) returned 1 [0196.074] SetEndOfFile (hFile=0x150) returned 1 [0196.074] CloseHandle (hObject=0x150) returned 1 [0196.075] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.075] SetEndOfFile (hFile=0x114) returned 1 [0196.075] CloseHandle (hObject=0x114) returned 1 [0196.075] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.076] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html")) returned 1 [0196.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.076] lstrlenW (lpString=".doc") returned 4 [0196.076] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0196.076] lstrlenW (lpString=".docx") returned 5 [0196.076] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0196.076] lstrlenW (lpString=".pdf") returned 4 [0196.076] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0196.076] lstrlenW (lpString=".xls") returned 4 [0196.076] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0196.076] lstrlenW (lpString=".xlsx") returned 5 [0196.076] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0196.076] lstrlenW (lpString=".ppt") returned 4 [0196.076] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0196.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.076] lstrlenW (lpString=".zip") returned 4 [0196.076] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0196.076] lstrlenW (lpString=".rar") returned 4 [0196.076] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0196.076] lstrlenW (lpString=".bz2") returned 4 [0196.076] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0196.076] lstrlenW (lpString=".7z") returned 3 [0196.076] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0196.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.076] lstrlenW (lpString=".dbf") returned 4 [0196.076] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0196.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.076] lstrlenW (lpString=".1cd") returned 4 [0196.077] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0196.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.077] lstrlenW (lpString=".jpg") returned 4 [0196.077] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0196.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.077] lstrlenW (lpString=".doc") returned 4 [0196.077] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0196.077] lstrlenW (lpString=".docx") returned 5 [0196.077] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0196.077] lstrlenW (lpString=".pdf") returned 4 [0196.077] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0196.077] lstrlenW (lpString=".xls") returned 4 [0196.077] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0196.077] lstrlenW (lpString=".xlsx") returned 5 [0196.077] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0196.077] lstrlenW (lpString=".ppt") returned 4 [0196.077] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0196.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.077] lstrlenW (lpString=".zip") returned 4 [0196.077] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0196.077] lstrlenW (lpString=".rar") returned 4 [0196.077] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0196.077] lstrlenW (lpString=".bz2") returned 4 [0196.077] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0196.077] lstrlenW (lpString=".7z") returned 3 [0196.077] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0196.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.077] lstrlenW (lpString=".dbf") returned 4 [0196.077] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0196.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.077] lstrlenW (lpString=".1cd") returned 4 [0196.077] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0196.077] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\html\\craw_window.html") returned 151 [0196.078] lstrlenW (lpString=".jpg") returned 4 [0196.078] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0196.078] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0196.078] lstrlenW (lpString="flapper.gif") returned 11 [0196.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.079] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=70364) returned 1 [0196.079] CloseHandle (hObject=0x114) returned 1 [0196.079] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 0x2020 [0196.079] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.079] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.079] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.080] GetLastError () returned 0x0 [0196.080] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x112dc, lpOverlapped=0x0) returned 1 [0196.082] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x112e0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x112e0, lpOverlapped=0x0) returned 1 [0196.085] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.085] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0196.085] SetEndOfFile (hFile=0x150) returned 1 [0196.085] CloseHandle (hObject=0x150) returned 1 [0196.085] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.085] SetEndOfFile (hFile=0x114) returned 1 [0196.086] CloseHandle (hObject=0x114) returned 1 [0196.086] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.086] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif")) returned 1 [0196.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.087] lstrlenW (lpString=".doc") returned 4 [0196.087] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0196.087] lstrlenW (lpString=".docx") returned 5 [0196.087] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0196.087] lstrlenW (lpString=".pdf") returned 4 [0196.087] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0196.087] lstrlenW (lpString=".xls") returned 4 [0196.087] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0196.087] lstrlenW (lpString=".xlsx") returned 5 [0196.087] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0196.087] lstrlenW (lpString=".ppt") returned 4 [0196.087] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0196.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.087] lstrlenW (lpString=".zip") returned 4 [0196.087] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0196.087] lstrlenW (lpString=".rar") returned 4 [0196.087] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0196.087] lstrlenW (lpString=".bz2") returned 4 [0196.087] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0196.087] lstrlenW (lpString=".7z") returned 3 [0196.087] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0196.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.087] lstrlenW (lpString=".dbf") returned 4 [0196.087] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0196.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.087] lstrlenW (lpString=".1cd") returned 4 [0196.087] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0196.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.087] lstrlenW (lpString=".jpg") returned 4 [0196.087] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0196.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.088] lstrlenW (lpString=".doc") returned 4 [0196.088] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0196.088] lstrlenW (lpString=".docx") returned 5 [0196.088] lstrcmpiW (lpString1=".docx", lpString2="r.gif") returned -1 [0196.088] lstrlenW (lpString=".pdf") returned 4 [0196.088] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0196.088] lstrlenW (lpString=".xls") returned 4 [0196.088] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0196.088] lstrlenW (lpString=".xlsx") returned 5 [0196.088] lstrcmpiW (lpString1=".xlsx", lpString2="r.gif") returned -1 [0196.088] lstrlenW (lpString=".ppt") returned 4 [0196.088] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0196.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.088] lstrlenW (lpString=".zip") returned 4 [0196.088] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0196.088] lstrlenW (lpString=".rar") returned 4 [0196.088] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0196.088] lstrlenW (lpString=".bz2") returned 4 [0196.088] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0196.088] lstrlenW (lpString=".7z") returned 3 [0196.088] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0196.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.088] lstrlenW (lpString=".dbf") returned 4 [0196.088] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0196.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.088] lstrlenW (lpString=".1cd") returned 4 [0196.088] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0196.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\flapper.gif") returned 148 [0196.089] lstrlenW (lpString=".jpg") returned 4 [0196.089] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0196.089] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0196.089] lstrlenW (lpString="icon_128.png") returned 12 [0196.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.089] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4361) returned 1 [0196.089] CloseHandle (hObject=0x114) returned 1 [0196.089] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 0x2020 [0196.089] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.090] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.090] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.090] GetLastError () returned 0x0 [0196.090] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x1109, lpOverlapped=0x0) returned 1 [0196.091] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1110, lpOverlapped=0x0) returned 1 [0196.092] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.092] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xec, lpOverlapped=0x0) returned 1 [0196.092] SetEndOfFile (hFile=0x150) returned 1 [0196.093] CloseHandle (hObject=0x150) returned 1 [0196.093] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.093] SetEndOfFile (hFile=0x114) returned 1 [0196.093] CloseHandle (hObject=0x114) returned 1 [0196.093] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.094] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png")) returned 1 [0196.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.094] lstrlenW (lpString=".doc") returned 4 [0196.094] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.094] lstrlenW (lpString=".docx") returned 5 [0196.094] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0196.094] lstrlenW (lpString=".pdf") returned 4 [0196.094] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.094] lstrlenW (lpString=".xls") returned 4 [0196.094] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.094] lstrlenW (lpString=".xlsx") returned 5 [0196.094] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0196.094] lstrlenW (lpString=".ppt") returned 4 [0196.094] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.094] lstrlenW (lpString=".zip") returned 4 [0196.094] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.094] lstrlenW (lpString=".rar") returned 4 [0196.094] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.094] lstrlenW (lpString=".bz2") returned 4 [0196.094] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.094] lstrlenW (lpString=".7z") returned 3 [0196.094] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.094] lstrlenW (lpString=".dbf") returned 4 [0196.094] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.095] lstrlenW (lpString=".1cd") returned 4 [0196.095] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.095] lstrlenW (lpString=".jpg") returned 4 [0196.095] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.095] lstrlenW (lpString=".doc") returned 4 [0196.095] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.095] lstrlenW (lpString=".docx") returned 5 [0196.095] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0196.095] lstrlenW (lpString=".pdf") returned 4 [0196.095] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.095] lstrlenW (lpString=".xls") returned 4 [0196.095] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.095] lstrlenW (lpString=".xlsx") returned 5 [0196.095] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0196.095] lstrlenW (lpString=".ppt") returned 4 [0196.095] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.095] lstrlenW (lpString=".zip") returned 4 [0196.095] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.095] lstrlenW (lpString=".rar") returned 4 [0196.095] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.095] lstrlenW (lpString=".bz2") returned 4 [0196.095] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.095] lstrlenW (lpString=".7z") returned 3 [0196.095] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.095] lstrlenW (lpString=".dbf") returned 4 [0196.095] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.096] lstrlenW (lpString=".1cd") returned 4 [0196.096] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_128.png") returned 149 [0196.096] lstrlenW (lpString=".jpg") returned 4 [0196.096] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.096] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0196.096] lstrlenW (lpString="icon_16.png") returned 11 [0196.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.097] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=556) returned 1 [0196.097] CloseHandle (hObject=0x154) returned 1 [0196.097] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 0x2020 [0196.097] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.097] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.097] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.098] GetLastError () returned 0x0 [0196.098] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x22c, lpOverlapped=0x0) returned 1 [0196.099] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x230, lpOverlapped=0x0) returned 1 [0196.100] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.100] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0196.100] SetEndOfFile (hFile=0x114) returned 1 [0196.100] CloseHandle (hObject=0x114) returned 1 [0196.100] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.100] SetEndOfFile (hFile=0x154) returned 1 [0196.101] CloseHandle (hObject=0x154) returned 1 [0196.101] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.101] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png")) returned 1 [0196.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.101] lstrlenW (lpString=".doc") returned 4 [0196.101] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.101] lstrlenW (lpString=".docx") returned 5 [0196.101] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0196.101] lstrlenW (lpString=".pdf") returned 4 [0196.101] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.101] lstrlenW (lpString=".xls") returned 4 [0196.101] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.101] lstrlenW (lpString=".xlsx") returned 5 [0196.101] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0196.101] lstrlenW (lpString=".ppt") returned 4 [0196.102] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.102] lstrlenW (lpString=".zip") returned 4 [0196.102] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.102] lstrlenW (lpString=".rar") returned 4 [0196.102] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.102] lstrlenW (lpString=".bz2") returned 4 [0196.102] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.102] lstrlenW (lpString=".7z") returned 3 [0196.102] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.102] lstrlenW (lpString=".dbf") returned 4 [0196.102] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.102] lstrlenW (lpString=".1cd") returned 4 [0196.102] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.102] lstrlenW (lpString=".jpg") returned 4 [0196.102] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.102] lstrlenW (lpString=".doc") returned 4 [0196.102] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.102] lstrlenW (lpString=".docx") returned 5 [0196.102] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0196.102] lstrlenW (lpString=".pdf") returned 4 [0196.102] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.102] lstrlenW (lpString=".xls") returned 4 [0196.102] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.102] lstrlenW (lpString=".xlsx") returned 5 [0196.102] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0196.102] lstrlenW (lpString=".ppt") returned 4 [0196.102] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.103] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.103] lstrlenW (lpString=".zip") returned 4 [0196.103] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.103] lstrlenW (lpString=".rar") returned 4 [0196.103] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.103] lstrlenW (lpString=".bz2") returned 4 [0196.103] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.103] lstrlenW (lpString=".7z") returned 3 [0196.103] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.103] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.103] lstrlenW (lpString=".dbf") returned 4 [0196.103] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.103] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.103] lstrlenW (lpString=".1cd") returned 4 [0196.103] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.103] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\icon_16.png") returned 148 [0196.103] lstrlenW (lpString=".jpg") returned 4 [0196.103] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.103] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0196.103] lstrlenW (lpString="topbar_floating_button.png") returned 26 [0196.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.104] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=160) returned 1 [0196.104] CloseHandle (hObject=0x154) returned 1 [0196.179] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 0x2020 [0196.179] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.179] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.179] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.180] GetLastError () returned 0x0 [0196.180] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xa0, lpOverlapped=0x0) returned 1 [0196.181] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xb0, lpOverlapped=0x0) returned 1 [0196.181] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.181] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x108, lpOverlapped=0x0) returned 1 [0196.182] SetEndOfFile (hFile=0x114) returned 1 [0196.183] CloseHandle (hObject=0x114) returned 1 [0196.183] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.183] SetEndOfFile (hFile=0x154) returned 1 [0196.184] CloseHandle (hObject=0x154) returned 1 [0196.184] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.184] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png")) returned 1 [0196.184] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.184] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.184] lstrlenW (lpString=".doc") returned 4 [0196.184] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.184] lstrlenW (lpString=".docx") returned 5 [0196.184] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0196.184] lstrlenW (lpString=".pdf") returned 4 [0196.184] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.184] lstrlenW (lpString=".xls") returned 4 [0196.184] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.184] lstrlenW (lpString=".xlsx") returned 5 [0196.184] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0196.184] lstrlenW (lpString=".ppt") returned 4 [0196.184] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.184] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.184] lstrlenW (lpString=".zip") returned 4 [0196.184] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.184] lstrlenW (lpString=".rar") returned 4 [0196.184] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.184] lstrlenW (lpString=".bz2") returned 4 [0196.185] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.185] lstrlenW (lpString=".7z") returned 3 [0196.185] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.185] lstrlenW (lpString=".dbf") returned 4 [0196.185] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.185] lstrlenW (lpString=".1cd") returned 4 [0196.185] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.185] lstrlenW (lpString=".jpg") returned 4 [0196.185] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.185] lstrlenW (lpString=".doc") returned 4 [0196.185] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.185] lstrlenW (lpString=".docx") returned 5 [0196.185] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0196.185] lstrlenW (lpString=".pdf") returned 4 [0196.185] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.185] lstrlenW (lpString=".xls") returned 4 [0196.185] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.185] lstrlenW (lpString=".xlsx") returned 5 [0196.185] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0196.185] lstrlenW (lpString=".ppt") returned 4 [0196.185] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.185] lstrlenW (lpString=".zip") returned 4 [0196.185] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.185] lstrlenW (lpString=".rar") returned 4 [0196.185] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.185] lstrlenW (lpString=".bz2") returned 4 [0196.185] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.186] lstrlenW (lpString=".7z") returned 3 [0196.186] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.186] lstrlenW (lpString=".dbf") returned 4 [0196.186] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.186] lstrlenW (lpString=".1cd") returned 4 [0196.186] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button.png") returned 163 [0196.186] lstrlenW (lpString=".jpg") returned 4 [0196.186] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.186] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.186] lstrlenW (lpString="messages.json") returned 13 [0196.186] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.187] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=886) returned 1 [0196.187] CloseHandle (hObject=0x154) returned 1 [0196.187] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json")) returned 0x2020 [0196.187] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.188] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.188] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.188] GetLastError () returned 0x0 [0196.188] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x376, lpOverlapped=0x0) returned 1 [0196.190] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x380, lpOverlapped=0x0) returned 1 [0196.191] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.191] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.191] SetEndOfFile (hFile=0x114) returned 1 [0196.191] CloseHandle (hObject=0x114) returned 1 [0196.191] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.191] SetEndOfFile (hFile=0x154) returned 1 [0196.192] CloseHandle (hObject=0x154) returned 1 [0196.192] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.192] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json")) returned 1 [0196.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.192] lstrlenW (lpString=".doc") returned 4 [0196.192] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.192] lstrlenW (lpString=".docx") returned 5 [0196.192] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.192] lstrlenW (lpString=".pdf") returned 4 [0196.192] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.192] lstrlenW (lpString=".xls") returned 4 [0196.192] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.192] lstrlenW (lpString=".xlsx") returned 5 [0196.192] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.192] lstrlenW (lpString=".ppt") returned 4 [0196.193] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.193] lstrlenW (lpString=".zip") returned 4 [0196.193] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.193] lstrlenW (lpString=".rar") returned 4 [0196.193] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.193] lstrlenW (lpString=".bz2") returned 4 [0196.193] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.193] lstrlenW (lpString=".7z") returned 3 [0196.193] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.193] lstrlenW (lpString=".dbf") returned 4 [0196.193] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.193] lstrlenW (lpString=".1cd") returned 4 [0196.193] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.193] lstrlenW (lpString=".jpg") returned 4 [0196.193] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.193] lstrlenW (lpString=".doc") returned 4 [0196.193] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.193] lstrlenW (lpString=".docx") returned 5 [0196.193] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.193] lstrlenW (lpString=".pdf") returned 4 [0196.193] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.193] lstrlenW (lpString=".xls") returned 4 [0196.193] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.193] lstrlenW (lpString=".xlsx") returned 5 [0196.193] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.193] lstrlenW (lpString=".ppt") returned 4 [0196.193] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.193] lstrlenW (lpString=".zip") returned 4 [0196.194] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.194] lstrlenW (lpString=".rar") returned 4 [0196.194] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.194] lstrlenW (lpString=".bz2") returned 4 [0196.194] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.194] lstrlenW (lpString=".7z") returned 3 [0196.194] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.194] lstrlenW (lpString=".dbf") returned 4 [0196.194] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.194] lstrlenW (lpString=".1cd") returned 4 [0196.194] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\bg\\messages.json") returned 155 [0196.194] lstrlenW (lpString=".jpg") returned 4 [0196.194] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.194] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.194] lstrlenW (lpString="messages.json") returned 13 [0196.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.195] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=705) returned 1 [0196.195] CloseHandle (hObject=0x154) returned 1 [0196.195] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 0x2020 [0196.195] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.195] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.195] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.195] GetLastError () returned 0x0 [0196.195] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2c1, lpOverlapped=0x0) returned 1 [0196.197] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0196.198] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.198] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.198] SetEndOfFile (hFile=0x114) returned 1 [0196.198] CloseHandle (hObject=0x114) returned 1 [0196.198] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.198] SetEndOfFile (hFile=0x154) returned 1 [0196.199] CloseHandle (hObject=0x154) returned 1 [0196.199] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.199] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json")) returned 1 [0196.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.200] lstrlenW (lpString=".doc") returned 4 [0196.200] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.200] lstrlenW (lpString=".docx") returned 5 [0196.200] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.200] lstrlenW (lpString=".pdf") returned 4 [0196.200] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.200] lstrlenW (lpString=".xls") returned 4 [0196.200] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.200] lstrlenW (lpString=".xlsx") returned 5 [0196.200] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.200] lstrlenW (lpString=".ppt") returned 4 [0196.200] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.200] lstrlenW (lpString=".zip") returned 4 [0196.200] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.200] lstrlenW (lpString=".rar") returned 4 [0196.200] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.200] lstrlenW (lpString=".bz2") returned 4 [0196.200] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.200] lstrlenW (lpString=".7z") returned 3 [0196.200] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.200] lstrlenW (lpString=".dbf") returned 4 [0196.200] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.200] lstrlenW (lpString=".1cd") returned 4 [0196.200] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.201] lstrlenW (lpString=".jpg") returned 4 [0196.201] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.201] lstrlenW (lpString=".doc") returned 4 [0196.201] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.201] lstrlenW (lpString=".docx") returned 5 [0196.201] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.201] lstrlenW (lpString=".pdf") returned 4 [0196.201] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.201] lstrlenW (lpString=".xls") returned 4 [0196.201] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.201] lstrlenW (lpString=".xlsx") returned 5 [0196.201] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.201] lstrlenW (lpString=".ppt") returned 4 [0196.201] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.201] lstrlenW (lpString=".zip") returned 4 [0196.201] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.201] lstrlenW (lpString=".rar") returned 4 [0196.201] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.201] lstrlenW (lpString=".bz2") returned 4 [0196.201] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.201] lstrlenW (lpString=".7z") returned 3 [0196.201] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.201] lstrlenW (lpString=".dbf") returned 4 [0196.201] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.201] lstrlenW (lpString=".1cd") returned 4 [0196.201] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ca\\messages.json") returned 155 [0196.201] lstrlenW (lpString=".jpg") returned 4 [0196.202] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.202] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.202] lstrlenW (lpString="messages.json") returned 13 [0196.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.202] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=663) returned 1 [0196.202] CloseHandle (hObject=0x154) returned 1 [0196.202] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 0x2020 [0196.202] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.202] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.202] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.203] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.203] GetLastError () returned 0x0 [0196.203] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x297, lpOverlapped=0x0) returned 1 [0196.207] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0196.208] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.208] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.208] SetEndOfFile (hFile=0x114) returned 1 [0196.208] CloseHandle (hObject=0x114) returned 1 [0196.210] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.210] SetEndOfFile (hFile=0x154) returned 1 [0196.210] CloseHandle (hObject=0x154) returned 1 [0196.210] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.211] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json")) returned 1 [0196.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.211] lstrlenW (lpString=".doc") returned 4 [0196.211] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.211] lstrlenW (lpString=".docx") returned 5 [0196.211] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.211] lstrlenW (lpString=".pdf") returned 4 [0196.211] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.211] lstrlenW (lpString=".xls") returned 4 [0196.211] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.211] lstrlenW (lpString=".xlsx") returned 5 [0196.211] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.211] lstrlenW (lpString=".ppt") returned 4 [0196.211] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.211] lstrlenW (lpString=".zip") returned 4 [0196.211] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.211] lstrlenW (lpString=".rar") returned 4 [0196.211] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.211] lstrlenW (lpString=".bz2") returned 4 [0196.211] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.211] lstrlenW (lpString=".7z") returned 3 [0196.211] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.211] lstrlenW (lpString=".dbf") returned 4 [0196.211] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.212] lstrlenW (lpString=".1cd") returned 4 [0196.212] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.212] lstrlenW (lpString=".jpg") returned 4 [0196.212] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.212] lstrlenW (lpString=".doc") returned 4 [0196.212] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.212] lstrlenW (lpString=".docx") returned 5 [0196.212] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.212] lstrlenW (lpString=".pdf") returned 4 [0196.212] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.212] lstrlenW (lpString=".xls") returned 4 [0196.212] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.212] lstrlenW (lpString=".xlsx") returned 5 [0196.212] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.212] lstrlenW (lpString=".ppt") returned 4 [0196.212] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.212] lstrlenW (lpString=".zip") returned 4 [0196.212] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.212] lstrlenW (lpString=".rar") returned 4 [0196.212] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.212] lstrlenW (lpString=".bz2") returned 4 [0196.212] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.212] lstrlenW (lpString=".7z") returned 3 [0196.212] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.212] lstrlenW (lpString=".dbf") returned 4 [0196.212] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.212] lstrlenW (lpString=".1cd") returned 4 [0196.212] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\cs\\messages.json") returned 155 [0196.213] lstrlenW (lpString=".jpg") returned 4 [0196.213] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.213] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.213] lstrlenW (lpString="messages.json") returned 13 [0196.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.213] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=642) returned 1 [0196.213] CloseHandle (hObject=0x154) returned 1 [0196.213] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 0x2020 [0196.213] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.214] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.214] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.214] GetLastError () returned 0x0 [0196.214] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x282, lpOverlapped=0x0) returned 1 [0196.401] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x290, lpOverlapped=0x0) returned 1 [0196.422] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.423] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.423] SetEndOfFile (hFile=0x114) returned 1 [0196.423] CloseHandle (hObject=0x114) returned 1 [0196.423] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.423] SetEndOfFile (hFile=0x154) returned 1 [0196.424] CloseHandle (hObject=0x154) returned 1 [0196.424] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.424] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json")) returned 1 [0196.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.424] lstrlenW (lpString=".doc") returned 4 [0196.424] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.424] lstrlenW (lpString=".docx") returned 5 [0196.424] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.424] lstrlenW (lpString=".pdf") returned 4 [0196.424] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.424] lstrlenW (lpString=".xls") returned 4 [0196.424] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.424] lstrlenW (lpString=".xlsx") returned 5 [0196.425] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.425] lstrlenW (lpString=".ppt") returned 4 [0196.425] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.425] lstrlenW (lpString=".zip") returned 4 [0196.425] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.425] lstrlenW (lpString=".rar") returned 4 [0196.425] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.425] lstrlenW (lpString=".bz2") returned 4 [0196.425] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.425] lstrlenW (lpString=".7z") returned 3 [0196.425] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.425] lstrlenW (lpString=".dbf") returned 4 [0196.425] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.425] lstrlenW (lpString=".1cd") returned 4 [0196.425] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.425] lstrlenW (lpString=".jpg") returned 4 [0196.425] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.425] lstrlenW (lpString=".doc") returned 4 [0196.425] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.425] lstrlenW (lpString=".docx") returned 5 [0196.425] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.425] lstrlenW (lpString=".pdf") returned 4 [0196.425] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.425] lstrlenW (lpString=".xls") returned 4 [0196.425] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.425] lstrlenW (lpString=".xlsx") returned 5 [0196.425] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.425] lstrlenW (lpString=".ppt") returned 4 [0196.426] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.426] lstrlenW (lpString=".zip") returned 4 [0196.426] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.426] lstrlenW (lpString=".rar") returned 4 [0196.426] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.426] lstrlenW (lpString=".bz2") returned 4 [0196.426] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.426] lstrlenW (lpString=".7z") returned 3 [0196.426] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.426] lstrlenW (lpString=".dbf") returned 4 [0196.426] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.426] lstrlenW (lpString=".1cd") returned 4 [0196.426] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\da\\messages.json") returned 155 [0196.426] lstrlenW (lpString=".jpg") returned 4 [0196.426] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.426] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.426] lstrlenW (lpString="messages.json") returned 13 [0196.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.427] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=778) returned 1 [0196.427] CloseHandle (hObject=0x154) returned 1 [0196.427] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json")) returned 0x2020 [0196.427] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.427] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.427] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.428] GetLastError () returned 0x0 [0196.428] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x30a, lpOverlapped=0x0) returned 1 [0196.429] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x310, lpOverlapped=0x0) returned 1 [0196.430] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.430] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.430] SetEndOfFile (hFile=0x114) returned 1 [0196.430] CloseHandle (hObject=0x114) returned 1 [0196.430] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.430] SetEndOfFile (hFile=0x154) returned 1 [0196.431] CloseHandle (hObject=0x154) returned 1 [0196.431] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.431] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json")) returned 1 [0196.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.432] lstrlenW (lpString=".doc") returned 4 [0196.432] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.432] lstrlenW (lpString=".docx") returned 5 [0196.432] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.432] lstrlenW (lpString=".pdf") returned 4 [0196.432] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.432] lstrlenW (lpString=".xls") returned 4 [0196.432] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.432] lstrlenW (lpString=".xlsx") returned 5 [0196.432] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.432] lstrlenW (lpString=".ppt") returned 4 [0196.432] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.432] lstrlenW (lpString=".zip") returned 4 [0196.432] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.432] lstrlenW (lpString=".rar") returned 4 [0196.432] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.432] lstrlenW (lpString=".bz2") returned 4 [0196.432] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.432] lstrlenW (lpString=".7z") returned 3 [0196.432] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.432] lstrlenW (lpString=".dbf") returned 4 [0196.432] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.432] lstrlenW (lpString=".1cd") returned 4 [0196.432] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.432] lstrlenW (lpString=".jpg") returned 4 [0196.432] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.432] lstrlenW (lpString=".doc") returned 4 [0196.432] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.433] lstrlenW (lpString=".docx") returned 5 [0196.433] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.433] lstrlenW (lpString=".pdf") returned 4 [0196.433] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.433] lstrlenW (lpString=".xls") returned 4 [0196.433] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.433] lstrlenW (lpString=".xlsx") returned 5 [0196.433] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.433] lstrlenW (lpString=".ppt") returned 4 [0196.433] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.433] lstrlenW (lpString=".zip") returned 4 [0196.433] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.433] lstrlenW (lpString=".rar") returned 4 [0196.433] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.433] lstrlenW (lpString=".bz2") returned 4 [0196.433] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.433] lstrlenW (lpString=".7z") returned 3 [0196.433] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.433] lstrlenW (lpString=".dbf") returned 4 [0196.433] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.433] lstrlenW (lpString=".1cd") returned 4 [0196.433] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ja\\messages.json") returned 155 [0196.433] lstrlenW (lpString=".jpg") returned 4 [0196.433] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.433] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.433] lstrlenW (lpString="messages.json") returned 13 [0196.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.434] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=669) returned 1 [0196.434] CloseHandle (hObject=0x154) returned 1 [0196.434] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json")) returned 0x2020 [0196.434] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.434] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.434] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.434] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.435] GetLastError () returned 0x0 [0196.435] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x29d, lpOverlapped=0x0) returned 1 [0196.436] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0196.437] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.437] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.437] SetEndOfFile (hFile=0x114) returned 1 [0196.437] CloseHandle (hObject=0x114) returned 1 [0196.438] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.438] SetEndOfFile (hFile=0x154) returned 1 [0196.438] CloseHandle (hObject=0x154) returned 1 [0196.438] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.439] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json")) returned 1 [0196.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.439] lstrlenW (lpString=".doc") returned 4 [0196.439] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.439] lstrlenW (lpString=".docx") returned 5 [0196.439] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.439] lstrlenW (lpString=".pdf") returned 4 [0196.439] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.439] lstrlenW (lpString=".xls") returned 4 [0196.439] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.439] lstrlenW (lpString=".xlsx") returned 5 [0196.439] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.439] lstrlenW (lpString=".ppt") returned 4 [0196.439] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.439] lstrlenW (lpString=".zip") returned 4 [0196.439] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.439] lstrlenW (lpString=".rar") returned 4 [0196.439] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.439] lstrlenW (lpString=".bz2") returned 4 [0196.439] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.439] lstrlenW (lpString=".7z") returned 3 [0196.439] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.439] lstrlenW (lpString=".dbf") returned 4 [0196.439] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.440] lstrlenW (lpString=".1cd") returned 4 [0196.440] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.440] lstrlenW (lpString=".jpg") returned 4 [0196.440] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.440] lstrlenW (lpString=".doc") returned 4 [0196.440] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.440] lstrlenW (lpString=".docx") returned 5 [0196.440] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.440] lstrlenW (lpString=".pdf") returned 4 [0196.440] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.440] lstrlenW (lpString=".xls") returned 4 [0196.440] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.440] lstrlenW (lpString=".xlsx") returned 5 [0196.440] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.440] lstrlenW (lpString=".ppt") returned 4 [0196.440] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.440] lstrlenW (lpString=".zip") returned 4 [0196.440] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.440] lstrlenW (lpString=".rar") returned 4 [0196.440] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.440] lstrlenW (lpString=".bz2") returned 4 [0196.440] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.440] lstrlenW (lpString=".7z") returned 3 [0196.440] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.440] lstrlenW (lpString=".dbf") returned 4 [0196.440] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.440] lstrlenW (lpString=".1cd") returned 4 [0196.440] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\ko\\messages.json") returned 155 [0196.441] lstrlenW (lpString=".jpg") returned 4 [0196.441] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.441] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.441] lstrlenW (lpString="messages.json") returned 13 [0196.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.441] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=686) returned 1 [0196.441] CloseHandle (hObject=0x154) returned 1 [0196.441] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json")) returned 0x2020 [0196.441] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.442] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.442] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.442] GetLastError () returned 0x0 [0196.442] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2ae, lpOverlapped=0x0) returned 1 [0196.443] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0196.444] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.444] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.444] SetEndOfFile (hFile=0x114) returned 1 [0196.445] CloseHandle (hObject=0x114) returned 1 [0196.445] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.445] SetEndOfFile (hFile=0x154) returned 1 [0196.445] CloseHandle (hObject=0x154) returned 1 [0196.445] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.446] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json")) returned 1 [0196.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.446] lstrlenW (lpString=".doc") returned 4 [0196.446] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.446] lstrlenW (lpString=".docx") returned 5 [0196.446] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.446] lstrlenW (lpString=".pdf") returned 4 [0196.446] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.446] lstrlenW (lpString=".xls") returned 4 [0196.446] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.446] lstrlenW (lpString=".xlsx") returned 5 [0196.446] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.446] lstrlenW (lpString=".ppt") returned 4 [0196.446] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.446] lstrlenW (lpString=".zip") returned 4 [0196.446] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.446] lstrlenW (lpString=".rar") returned 4 [0196.446] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.446] lstrlenW (lpString=".bz2") returned 4 [0196.446] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.446] lstrlenW (lpString=".7z") returned 3 [0196.446] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.447] lstrlenW (lpString=".dbf") returned 4 [0196.447] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.447] lstrlenW (lpString=".1cd") returned 4 [0196.447] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.447] lstrlenW (lpString=".jpg") returned 4 [0196.447] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.447] lstrlenW (lpString=".doc") returned 4 [0196.447] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.447] lstrlenW (lpString=".docx") returned 5 [0196.447] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.447] lstrlenW (lpString=".pdf") returned 4 [0196.447] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.447] lstrlenW (lpString=".xls") returned 4 [0196.447] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.447] lstrlenW (lpString=".xlsx") returned 5 [0196.447] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.447] lstrlenW (lpString=".ppt") returned 4 [0196.447] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.447] lstrlenW (lpString=".zip") returned 4 [0196.447] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.447] lstrlenW (lpString=".rar") returned 4 [0196.447] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.447] lstrlenW (lpString=".bz2") returned 4 [0196.447] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.447] lstrlenW (lpString=".7z") returned 3 [0196.447] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.447] lstrlenW (lpString=".dbf") returned 4 [0196.448] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.448] lstrlenW (lpString=".1cd") returned 4 [0196.448] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lt\\messages.json") returned 155 [0196.448] lstrlenW (lpString=".jpg") returned 4 [0196.448] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.448] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.448] lstrlenW (lpString="messages.json") returned 13 [0196.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.448] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=699) returned 1 [0196.448] CloseHandle (hObject=0x154) returned 1 [0196.448] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 0x2020 [0196.449] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.449] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.449] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.449] GetLastError () returned 0x0 [0196.449] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2bb, lpOverlapped=0x0) returned 1 [0196.451] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0196.452] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.452] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.452] SetEndOfFile (hFile=0x114) returned 1 [0196.452] CloseHandle (hObject=0x114) returned 1 [0196.452] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.452] SetEndOfFile (hFile=0x154) returned 1 [0196.453] CloseHandle (hObject=0x154) returned 1 [0196.453] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.453] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json")) returned 1 [0196.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.453] lstrlenW (lpString=".doc") returned 4 [0196.453] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.453] lstrlenW (lpString=".docx") returned 5 [0196.453] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.453] lstrlenW (lpString=".pdf") returned 4 [0196.453] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.453] lstrlenW (lpString=".xls") returned 4 [0196.453] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.453] lstrlenW (lpString=".xlsx") returned 5 [0196.453] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.453] lstrlenW (lpString=".ppt") returned 4 [0196.453] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.454] lstrlenW (lpString=".zip") returned 4 [0196.454] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.454] lstrlenW (lpString=".rar") returned 4 [0196.454] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.454] lstrlenW (lpString=".bz2") returned 4 [0196.454] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.454] lstrlenW (lpString=".7z") returned 3 [0196.454] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.454] lstrlenW (lpString=".dbf") returned 4 [0196.454] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.454] lstrlenW (lpString=".1cd") returned 4 [0196.454] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.454] lstrlenW (lpString=".jpg") returned 4 [0196.454] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.454] lstrlenW (lpString=".doc") returned 4 [0196.454] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.454] lstrlenW (lpString=".docx") returned 5 [0196.454] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.454] lstrlenW (lpString=".pdf") returned 4 [0196.454] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.454] lstrlenW (lpString=".xls") returned 4 [0196.454] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.454] lstrlenW (lpString=".xlsx") returned 5 [0196.454] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.454] lstrlenW (lpString=".ppt") returned 4 [0196.454] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.454] lstrlenW (lpString=".zip") returned 4 [0196.454] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.455] lstrlenW (lpString=".rar") returned 4 [0196.455] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.455] lstrlenW (lpString=".bz2") returned 4 [0196.455] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.455] lstrlenW (lpString=".7z") returned 3 [0196.455] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.455] lstrlenW (lpString=".dbf") returned 4 [0196.455] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.455] lstrlenW (lpString=".1cd") returned 4 [0196.455] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\lv\\messages.json") returned 155 [0196.455] lstrlenW (lpString=".jpg") returned 4 [0196.455] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.455] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.455] lstrlenW (lpString="messages.json") returned 13 [0196.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.456] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=644) returned 1 [0196.456] CloseHandle (hObject=0x154) returned 1 [0196.456] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json")) returned 0x2020 [0196.456] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.456] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.456] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.456] GetLastError () returned 0x0 [0196.457] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x284, lpOverlapped=0x0) returned 1 [0196.625] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x290, lpOverlapped=0x0) returned 1 [0196.648] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.648] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.648] SetEndOfFile (hFile=0x114) returned 1 [0196.649] CloseHandle (hObject=0x114) returned 1 [0196.649] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.649] SetEndOfFile (hFile=0x154) returned 1 [0196.649] CloseHandle (hObject=0x154) returned 1 [0196.649] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.650] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json")) returned 1 [0196.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.650] lstrlenW (lpString=".doc") returned 4 [0196.650] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.650] lstrlenW (lpString=".docx") returned 5 [0196.650] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.650] lstrlenW (lpString=".pdf") returned 4 [0196.650] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.650] lstrlenW (lpString=".xls") returned 4 [0196.650] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.650] lstrlenW (lpString=".xlsx") returned 5 [0196.650] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.650] lstrlenW (lpString=".ppt") returned 4 [0196.650] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.651] lstrlenW (lpString=".zip") returned 4 [0196.651] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.651] lstrlenW (lpString=".rar") returned 4 [0196.651] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.651] lstrlenW (lpString=".bz2") returned 4 [0196.651] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.651] lstrlenW (lpString=".7z") returned 3 [0196.651] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.651] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.651] lstrlenW (lpString=".dbf") returned 4 [0196.651] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.651] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.651] lstrlenW (lpString=".1cd") returned 4 [0196.651] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.651] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.651] lstrlenW (lpString=".jpg") returned 4 [0196.651] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.651] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.651] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.651] lstrlenW (lpString=".doc") returned 4 [0196.651] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.651] lstrlenW (lpString=".docx") returned 5 [0196.651] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.651] lstrlenW (lpString=".pdf") returned 4 [0196.651] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.651] lstrlenW (lpString=".xls") returned 4 [0196.651] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.651] lstrlenW (lpString=".xlsx") returned 5 [0196.651] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.651] lstrlenW (lpString=".ppt") returned 4 [0196.651] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.651] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.651] lstrlenW (lpString=".zip") returned 4 [0196.652] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.652] lstrlenW (lpString=".rar") returned 4 [0196.652] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.652] lstrlenW (lpString=".bz2") returned 4 [0196.652] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.652] lstrlenW (lpString=".7z") returned 3 [0196.652] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.652] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.652] lstrlenW (lpString=".dbf") returned 4 [0196.652] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.652] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.652] lstrlenW (lpString=".1cd") returned 4 [0196.652] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.652] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nb\\messages.json") returned 155 [0196.652] lstrlenW (lpString=".jpg") returned 4 [0196.652] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.652] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.652] lstrlenW (lpString="messages.json") returned 13 [0196.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.653] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=595) returned 1 [0196.653] CloseHandle (hObject=0x154) returned 1 [0196.653] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0196.653] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.653] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.653] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.653] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.654] GetLastError () returned 0x0 [0196.654] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x253, lpOverlapped=0x0) returned 1 [0196.655] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x260, lpOverlapped=0x0) returned 1 [0196.656] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.656] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.656] SetEndOfFile (hFile=0x114) returned 1 [0196.656] CloseHandle (hObject=0x114) returned 1 [0196.656] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.656] SetEndOfFile (hFile=0x154) returned 1 [0196.657] CloseHandle (hObject=0x154) returned 1 [0196.657] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.657] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_cn\\messages.json")) returned 1 [0196.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.658] lstrlenW (lpString=".doc") returned 4 [0196.658] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.658] lstrlenW (lpString=".docx") returned 5 [0196.658] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.658] lstrlenW (lpString=".pdf") returned 4 [0196.658] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.658] lstrlenW (lpString=".xls") returned 4 [0196.658] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.658] lstrlenW (lpString=".xlsx") returned 5 [0196.658] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.658] lstrlenW (lpString=".ppt") returned 4 [0196.658] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.658] lstrlenW (lpString=".zip") returned 4 [0196.658] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.658] lstrlenW (lpString=".rar") returned 4 [0196.658] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.658] lstrlenW (lpString=".bz2") returned 4 [0196.658] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.658] lstrlenW (lpString=".7z") returned 3 [0196.658] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.658] lstrlenW (lpString=".dbf") returned 4 [0196.658] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.658] lstrlenW (lpString=".1cd") returned 4 [0196.658] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.658] lstrlenW (lpString=".jpg") returned 4 [0196.658] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.659] lstrlenW (lpString=".doc") returned 4 [0196.659] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.659] lstrlenW (lpString=".docx") returned 5 [0196.659] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.659] lstrlenW (lpString=".pdf") returned 4 [0196.659] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.659] lstrlenW (lpString=".xls") returned 4 [0196.659] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.659] lstrlenW (lpString=".xlsx") returned 5 [0196.659] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.659] lstrlenW (lpString=".ppt") returned 4 [0196.659] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.659] lstrlenW (lpString=".zip") returned 4 [0196.659] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.659] lstrlenW (lpString=".rar") returned 4 [0196.659] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.659] lstrlenW (lpString=".bz2") returned 4 [0196.659] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.659] lstrlenW (lpString=".7z") returned 3 [0196.659] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.659] lstrlenW (lpString=".dbf") returned 4 [0196.659] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.659] lstrlenW (lpString=".1cd") returned 4 [0196.659] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_CN\\messages.json") returned 158 [0196.659] lstrlenW (lpString=".jpg") returned 4 [0196.659] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.660] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.660] lstrlenW (lpString="messages.json") returned 13 [0196.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.660] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=640) returned 1 [0196.660] CloseHandle (hObject=0x154) returned 1 [0196.660] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0196.660] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.660] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.660] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.661] GetLastError () returned 0x0 [0196.661] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x280, lpOverlapped=0x0) returned 1 [0196.662] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x290, lpOverlapped=0x0) returned 1 [0196.663] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.663] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.663] SetEndOfFile (hFile=0x114) returned 1 [0196.663] CloseHandle (hObject=0x114) returned 1 [0196.664] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.664] SetEndOfFile (hFile=0x154) returned 1 [0196.664] CloseHandle (hObject=0x154) returned 1 [0196.664] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.664] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_tw\\messages.json")) returned 1 [0196.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.665] lstrlenW (lpString=".doc") returned 4 [0196.665] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.665] lstrlenW (lpString=".docx") returned 5 [0196.665] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.665] lstrlenW (lpString=".pdf") returned 4 [0196.665] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.665] lstrlenW (lpString=".xls") returned 4 [0196.665] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.665] lstrlenW (lpString=".xlsx") returned 5 [0196.665] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.665] lstrlenW (lpString=".ppt") returned 4 [0196.665] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.665] lstrlenW (lpString=".zip") returned 4 [0196.665] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.665] lstrlenW (lpString=".rar") returned 4 [0196.665] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.665] lstrlenW (lpString=".bz2") returned 4 [0196.665] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.665] lstrlenW (lpString=".7z") returned 3 [0196.665] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.665] lstrlenW (lpString=".dbf") returned 4 [0196.665] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.666] lstrlenW (lpString=".1cd") returned 4 [0196.666] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.666] lstrlenW (lpString=".jpg") returned 4 [0196.666] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.666] lstrlenW (lpString=".doc") returned 4 [0196.666] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.666] lstrlenW (lpString=".docx") returned 5 [0196.666] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.666] lstrlenW (lpString=".pdf") returned 4 [0196.666] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.666] lstrlenW (lpString=".xls") returned 4 [0196.666] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.666] lstrlenW (lpString=".xlsx") returned 5 [0196.666] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.666] lstrlenW (lpString=".ppt") returned 4 [0196.666] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.666] lstrlenW (lpString=".zip") returned 4 [0196.666] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.666] lstrlenW (lpString=".rar") returned 4 [0196.666] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.666] lstrlenW (lpString=".bz2") returned 4 [0196.666] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.666] lstrlenW (lpString=".7z") returned 3 [0196.666] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.666] lstrlenW (lpString=".dbf") returned 4 [0196.666] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.667] lstrlenW (lpString=".1cd") returned 4 [0196.667] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\zh_TW\\messages.json") returned 158 [0196.667] lstrlenW (lpString=".jpg") returned 4 [0196.667] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.667] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.667] lstrlenW (lpString="verified_contents.json") returned 22 [0196.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.667] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=11770) returned 1 [0196.667] CloseHandle (hObject=0x154) returned 1 [0196.667] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json")) returned 0x2020 [0196.667] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.668] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.668] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.670] GetLastError () returned 0x0 [0196.670] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2dfa, lpOverlapped=0x0) returned 1 [0196.671] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2e00, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2e00, lpOverlapped=0x0) returned 1 [0196.672] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.672] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x100, lpOverlapped=0x0) returned 1 [0196.672] SetEndOfFile (hFile=0x114) returned 1 [0196.672] CloseHandle (hObject=0x114) returned 1 [0196.672] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.672] SetEndOfFile (hFile=0x154) returned 1 [0196.673] CloseHandle (hObject=0x154) returned 1 [0196.673] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.673] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json")) returned 1 [0196.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.674] lstrlenW (lpString=".doc") returned 4 [0196.674] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.674] lstrlenW (lpString=".docx") returned 5 [0196.674] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.674] lstrlenW (lpString=".pdf") returned 4 [0196.674] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.674] lstrlenW (lpString=".xls") returned 4 [0196.674] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.674] lstrlenW (lpString=".xlsx") returned 5 [0196.674] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.674] lstrlenW (lpString=".ppt") returned 4 [0196.674] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.674] lstrlenW (lpString=".zip") returned 4 [0196.674] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.674] lstrlenW (lpString=".rar") returned 4 [0196.674] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.674] lstrlenW (lpString=".bz2") returned 4 [0196.674] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.674] lstrlenW (lpString=".7z") returned 3 [0196.674] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.674] lstrlenW (lpString=".dbf") returned 4 [0196.674] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.674] lstrlenW (lpString=".1cd") returned 4 [0196.674] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.674] lstrlenW (lpString=".jpg") returned 4 [0196.675] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.675] lstrlenW (lpString=".doc") returned 4 [0196.675] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.675] lstrlenW (lpString=".docx") returned 5 [0196.675] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.675] lstrlenW (lpString=".pdf") returned 4 [0196.675] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.675] lstrlenW (lpString=".xls") returned 4 [0196.675] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.675] lstrlenW (lpString=".xlsx") returned 5 [0196.675] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.675] lstrlenW (lpString=".ppt") returned 4 [0196.675] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.675] lstrlenW (lpString=".zip") returned 4 [0196.675] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.675] lstrlenW (lpString=".rar") returned 4 [0196.675] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.675] lstrlenW (lpString=".bz2") returned 4 [0196.675] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.675] lstrlenW (lpString=".7z") returned 3 [0196.675] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.675] lstrlenW (lpString=".dbf") returned 4 [0196.675] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.675] lstrlenW (lpString=".1cd") returned 4 [0196.675] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_metadata\\verified_contents.json") returned 162 [0196.675] lstrlenW (lpString=".jpg") returned 4 [0196.675] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.676] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0196.676] lstrlenW (lpString="128.png") returned 7 [0196.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.676] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=6159) returned 1 [0196.676] CloseHandle (hObject=0x154) returned 1 [0196.676] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 0x2020 [0196.676] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.676] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.676] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.677] GetLastError () returned 0x0 [0196.677] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x180f, lpOverlapped=0x0) returned 1 [0196.678] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1810, lpOverlapped=0x0) returned 1 [0196.679] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.679] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0196.679] SetEndOfFile (hFile=0x114) returned 1 [0196.680] CloseHandle (hObject=0x114) returned 1 [0196.680] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.680] SetEndOfFile (hFile=0x154) returned 1 [0196.680] CloseHandle (hObject=0x154) returned 1 [0196.680] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.681] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png")) returned 1 [0196.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.681] lstrlenW (lpString=".doc") returned 4 [0196.681] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.681] lstrlenW (lpString=".docx") returned 5 [0196.681] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0196.681] lstrlenW (lpString=".pdf") returned 4 [0196.681] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.681] lstrlenW (lpString=".xls") returned 4 [0196.681] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.681] lstrlenW (lpString=".xlsx") returned 5 [0196.681] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0196.681] lstrlenW (lpString=".ppt") returned 4 [0196.681] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.681] lstrlenW (lpString=".zip") returned 4 [0196.681] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.681] lstrlenW (lpString=".rar") returned 4 [0196.681] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.682] lstrlenW (lpString=".bz2") returned 4 [0196.682] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.682] lstrlenW (lpString=".7z") returned 3 [0196.682] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.682] lstrlenW (lpString=".dbf") returned 4 [0196.682] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.682] lstrlenW (lpString=".1cd") returned 4 [0196.682] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.682] lstrlenW (lpString=".jpg") returned 4 [0196.682] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.682] lstrlenW (lpString=".doc") returned 4 [0196.682] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.682] lstrlenW (lpString=".docx") returned 5 [0196.682] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0196.682] lstrlenW (lpString=".pdf") returned 4 [0196.682] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.682] lstrlenW (lpString=".xls") returned 4 [0196.682] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.682] lstrlenW (lpString=".xlsx") returned 5 [0196.682] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0196.682] lstrlenW (lpString=".ppt") returned 4 [0196.682] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.682] lstrlenW (lpString=".zip") returned 4 [0196.682] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.682] lstrlenW (lpString=".rar") returned 4 [0196.682] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.682] lstrlenW (lpString=".bz2") returned 4 [0196.683] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.683] lstrlenW (lpString=".7z") returned 3 [0196.683] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.683] lstrlenW (lpString=".dbf") returned 4 [0196.683] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.683] lstrlenW (lpString=".1cd") returned 4 [0196.683] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\128.png") returned 133 [0196.683] lstrlenW (lpString=".jpg") returned 4 [0196.683] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.683] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.683] lstrlenW (lpString="manifest.json") returned 13 [0196.683] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.683] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=784) returned 1 [0196.683] CloseHandle (hObject=0x154) returned 1 [0196.683] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 0x2020 [0196.684] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.684] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.684] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.684] GetLastError () returned 0x0 [0196.684] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x310, lpOverlapped=0x0) returned 1 [0196.780] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x320, lpOverlapped=0x0) returned 1 [0196.781] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.781] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.781] SetEndOfFile (hFile=0x114) returned 1 [0196.781] CloseHandle (hObject=0x114) returned 1 [0196.781] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.781] SetEndOfFile (hFile=0x154) returned 1 [0196.782] CloseHandle (hObject=0x154) returned 1 [0196.782] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.782] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json")) returned 1 [0196.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.783] lstrlenW (lpString=".doc") returned 4 [0196.783] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.783] lstrlenW (lpString=".docx") returned 5 [0196.783] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.783] lstrlenW (lpString=".pdf") returned 4 [0196.783] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.783] lstrlenW (lpString=".xls") returned 4 [0196.783] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.783] lstrlenW (lpString=".xlsx") returned 5 [0196.783] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.783] lstrlenW (lpString=".ppt") returned 4 [0196.783] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.783] lstrlenW (lpString=".zip") returned 4 [0196.783] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.783] lstrlenW (lpString=".rar") returned 4 [0196.783] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.783] lstrlenW (lpString=".bz2") returned 4 [0196.783] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.783] lstrlenW (lpString=".7z") returned 3 [0196.783] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.783] lstrlenW (lpString=".dbf") returned 4 [0196.783] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.783] lstrlenW (lpString=".1cd") returned 4 [0196.783] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.783] lstrlenW (lpString=".jpg") returned 4 [0196.783] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.784] lstrlenW (lpString=".doc") returned 4 [0196.784] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.784] lstrlenW (lpString=".docx") returned 5 [0196.784] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.784] lstrlenW (lpString=".pdf") returned 4 [0196.784] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.784] lstrlenW (lpString=".xls") returned 4 [0196.784] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.784] lstrlenW (lpString=".xlsx") returned 5 [0196.784] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.784] lstrlenW (lpString=".ppt") returned 4 [0196.784] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.784] lstrlenW (lpString=".zip") returned 4 [0196.784] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.784] lstrlenW (lpString=".rar") returned 4 [0196.784] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.784] lstrlenW (lpString=".bz2") returned 4 [0196.784] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.784] lstrlenW (lpString=".7z") returned 3 [0196.784] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.784] lstrlenW (lpString=".dbf") returned 4 [0196.784] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.784] lstrlenW (lpString=".1cd") returned 4 [0196.784] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\manifest.json") returned 139 [0196.784] lstrlenW (lpString=".jpg") returned 4 [0196.784] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.785] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.785] lstrlenW (lpString="messages.json") returned 13 [0196.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.861] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=269) returned 1 [0196.861] CloseHandle (hObject=0x154) returned 1 [0196.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 0x2020 [0196.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.861] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.862] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.862] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.862] GetLastError () returned 0x0 [0196.862] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x10d, lpOverlapped=0x0) returned 1 [0196.863] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x110, lpOverlapped=0x0) returned 1 [0196.864] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.864] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.864] SetEndOfFile (hFile=0x114) returned 1 [0196.864] CloseHandle (hObject=0x114) returned 1 [0196.864] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.864] SetEndOfFile (hFile=0x154) returned 1 [0196.865] CloseHandle (hObject=0x154) returned 1 [0196.865] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.865] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json")) returned 1 [0196.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.865] lstrlenW (lpString=".doc") returned 4 [0196.865] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.865] lstrlenW (lpString=".docx") returned 5 [0196.865] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.865] lstrlenW (lpString=".pdf") returned 4 [0196.865] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.865] lstrlenW (lpString=".xls") returned 4 [0196.866] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.866] lstrlenW (lpString=".xlsx") returned 5 [0196.866] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.866] lstrlenW (lpString=".ppt") returned 4 [0196.866] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.866] lstrlenW (lpString=".zip") returned 4 [0196.866] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.866] lstrlenW (lpString=".rar") returned 4 [0196.866] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.866] lstrlenW (lpString=".bz2") returned 4 [0196.866] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.866] lstrlenW (lpString=".7z") returned 3 [0196.866] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.866] lstrlenW (lpString=".dbf") returned 4 [0196.866] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.866] lstrlenW (lpString=".1cd") returned 4 [0196.866] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.866] lstrlenW (lpString=".jpg") returned 4 [0196.866] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.866] lstrlenW (lpString=".doc") returned 4 [0196.866] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.866] lstrlenW (lpString=".docx") returned 5 [0196.866] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.866] lstrlenW (lpString=".pdf") returned 4 [0196.866] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.866] lstrlenW (lpString=".xls") returned 4 [0196.866] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.867] lstrlenW (lpString=".xlsx") returned 5 [0196.867] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.867] lstrlenW (lpString=".ppt") returned 4 [0196.867] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.867] lstrlenW (lpString=".zip") returned 4 [0196.867] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.867] lstrlenW (lpString=".rar") returned 4 [0196.867] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.867] lstrlenW (lpString=".bz2") returned 4 [0196.867] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.867] lstrlenW (lpString=".7z") returned 3 [0196.867] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.867] lstrlenW (lpString=".dbf") returned 4 [0196.867] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.867] lstrlenW (lpString=".1cd") returned 4 [0196.867] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\es\\messages.json") returned 151 [0196.867] lstrlenW (lpString=".jpg") returned 4 [0196.867] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.867] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.867] lstrlenW (lpString="messages.json") returned 13 [0196.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.868] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=242) returned 1 [0196.868] CloseHandle (hObject=0x154) returned 1 [0196.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 0x2020 [0196.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.868] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.868] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.869] GetLastError () returned 0x0 [0196.869] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xf2, lpOverlapped=0x0) returned 1 [0196.870] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x100, lpOverlapped=0x0) returned 1 [0196.871] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.871] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.871] SetEndOfFile (hFile=0x114) returned 1 [0196.871] CloseHandle (hObject=0x114) returned 1 [0196.871] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.871] SetEndOfFile (hFile=0x154) returned 1 [0196.872] CloseHandle (hObject=0x154) returned 1 [0196.872] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.872] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json")) returned 1 [0196.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.872] lstrlenW (lpString=".doc") returned 4 [0196.872] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.872] lstrlenW (lpString=".docx") returned 5 [0196.872] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.872] lstrlenW (lpString=".pdf") returned 4 [0196.872] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.872] lstrlenW (lpString=".xls") returned 4 [0196.872] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.872] lstrlenW (lpString=".xlsx") returned 5 [0196.872] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.872] lstrlenW (lpString=".ppt") returned 4 [0196.872] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.873] lstrlenW (lpString=".zip") returned 4 [0196.873] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.873] lstrlenW (lpString=".rar") returned 4 [0196.873] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.873] lstrlenW (lpString=".bz2") returned 4 [0196.873] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.873] lstrlenW (lpString=".7z") returned 3 [0196.873] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.873] lstrlenW (lpString=".dbf") returned 4 [0196.873] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.873] lstrlenW (lpString=".1cd") returned 4 [0196.873] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.873] lstrlenW (lpString=".jpg") returned 4 [0196.873] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.873] lstrlenW (lpString=".doc") returned 4 [0196.873] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.873] lstrlenW (lpString=".docx") returned 5 [0196.873] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.873] lstrlenW (lpString=".pdf") returned 4 [0196.873] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.873] lstrlenW (lpString=".xls") returned 4 [0196.873] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.873] lstrlenW (lpString=".xlsx") returned 5 [0196.873] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.873] lstrlenW (lpString=".ppt") returned 4 [0196.873] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.873] lstrlenW (lpString=".zip") returned 4 [0196.874] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.874] lstrlenW (lpString=".rar") returned 4 [0196.874] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.874] lstrlenW (lpString=".bz2") returned 4 [0196.874] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.874] lstrlenW (lpString=".7z") returned 3 [0196.874] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.874] lstrlenW (lpString=".dbf") returned 4 [0196.874] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.874] lstrlenW (lpString=".1cd") returned 4 [0196.874] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\id\\messages.json") returned 151 [0196.874] lstrlenW (lpString=".jpg") returned 4 [0196.874] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.874] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.874] lstrlenW (lpString="messages.json") returned 13 [0196.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.875] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=256) returned 1 [0196.875] CloseHandle (hObject=0x154) returned 1 [0196.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 0x2020 [0196.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.875] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.875] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.875] GetLastError () returned 0x0 [0196.876] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x100, lpOverlapped=0x0) returned 1 [0196.876] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x110, lpOverlapped=0x0) returned 1 [0196.877] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.877] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.877] SetEndOfFile (hFile=0x114) returned 1 [0196.877] CloseHandle (hObject=0x114) returned 1 [0196.878] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.878] SetEndOfFile (hFile=0x154) returned 1 [0196.878] CloseHandle (hObject=0x154) returned 1 [0196.878] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.878] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json")) returned 1 [0196.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.879] lstrlenW (lpString=".doc") returned 4 [0196.879] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.879] lstrlenW (lpString=".docx") returned 5 [0196.879] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.879] lstrlenW (lpString=".pdf") returned 4 [0196.879] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.879] lstrlenW (lpString=".xls") returned 4 [0196.879] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.879] lstrlenW (lpString=".xlsx") returned 5 [0196.879] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.879] lstrlenW (lpString=".ppt") returned 4 [0196.879] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.879] lstrlenW (lpString=".zip") returned 4 [0196.879] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.879] lstrlenW (lpString=".rar") returned 4 [0196.879] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.879] lstrlenW (lpString=".bz2") returned 4 [0196.879] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.879] lstrlenW (lpString=".7z") returned 3 [0196.879] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.879] lstrlenW (lpString=".dbf") returned 4 [0196.879] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.879] lstrlenW (lpString=".1cd") returned 4 [0196.879] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.880] lstrlenW (lpString=".jpg") returned 4 [0196.880] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.880] lstrlenW (lpString=".doc") returned 4 [0196.880] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.880] lstrlenW (lpString=".docx") returned 5 [0196.880] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.880] lstrlenW (lpString=".pdf") returned 4 [0196.880] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.880] lstrlenW (lpString=".xls") returned 4 [0196.880] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.880] lstrlenW (lpString=".xlsx") returned 5 [0196.880] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.880] lstrlenW (lpString=".ppt") returned 4 [0196.880] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.880] lstrlenW (lpString=".zip") returned 4 [0196.880] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.880] lstrlenW (lpString=".rar") returned 4 [0196.880] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.880] lstrlenW (lpString=".bz2") returned 4 [0196.880] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.880] lstrlenW (lpString=".7z") returned 3 [0196.880] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.880] lstrlenW (lpString=".dbf") returned 4 [0196.880] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.880] lstrlenW (lpString=".1cd") returned 4 [0196.880] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\it\\messages.json") returned 151 [0196.881] lstrlenW (lpString=".jpg") returned 4 [0196.881] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.881] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.881] lstrlenW (lpString="messages.json") returned 13 [0196.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.882] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=271) returned 1 [0196.882] CloseHandle (hObject=0x154) returned 1 [0196.882] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 0x2020 [0196.882] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.882] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.882] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.883] GetLastError () returned 0x0 [0196.883] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x10f, lpOverlapped=0x0) returned 1 [0196.884] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x110, lpOverlapped=0x0) returned 1 [0196.885] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.885] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.885] SetEndOfFile (hFile=0x114) returned 1 [0196.885] CloseHandle (hObject=0x114) returned 1 [0196.885] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.885] SetEndOfFile (hFile=0x154) returned 1 [0196.886] CloseHandle (hObject=0x154) returned 1 [0196.886] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.886] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json")) returned 1 [0196.886] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.886] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.886] lstrlenW (lpString=".doc") returned 4 [0196.886] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.886] lstrlenW (lpString=".docx") returned 5 [0196.886] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.886] lstrlenW (lpString=".pdf") returned 4 [0196.886] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.886] lstrlenW (lpString=".xls") returned 4 [0196.886] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.886] lstrlenW (lpString=".xlsx") returned 5 [0196.886] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.886] lstrlenW (lpString=".ppt") returned 4 [0196.887] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.887] lstrlenW (lpString=".zip") returned 4 [0196.887] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.887] lstrlenW (lpString=".rar") returned 4 [0196.887] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.887] lstrlenW (lpString=".bz2") returned 4 [0196.887] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.887] lstrlenW (lpString=".7z") returned 3 [0196.887] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.887] lstrlenW (lpString=".dbf") returned 4 [0196.887] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.887] lstrlenW (lpString=".1cd") returned 4 [0196.887] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.887] lstrlenW (lpString=".jpg") returned 4 [0196.887] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.887] lstrlenW (lpString=".doc") returned 4 [0196.887] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.887] lstrlenW (lpString=".docx") returned 5 [0196.887] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.887] lstrlenW (lpString=".pdf") returned 4 [0196.887] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.887] lstrlenW (lpString=".xls") returned 4 [0196.887] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.887] lstrlenW (lpString=".xlsx") returned 5 [0196.887] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.887] lstrlenW (lpString=".ppt") returned 4 [0196.887] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.888] lstrlenW (lpString=".zip") returned 4 [0196.888] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.888] lstrlenW (lpString=".rar") returned 4 [0196.888] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.888] lstrlenW (lpString=".bz2") returned 4 [0196.888] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.888] lstrlenW (lpString=".7z") returned 3 [0196.888] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.888] lstrlenW (lpString=".dbf") returned 4 [0196.888] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.888] lstrlenW (lpString=".1cd") returned 4 [0196.888] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ja\\messages.json") returned 151 [0196.888] lstrlenW (lpString=".jpg") returned 4 [0196.888] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.888] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.888] lstrlenW (lpString="messages.json") returned 13 [0196.888] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.889] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=256) returned 1 [0196.889] CloseHandle (hObject=0x154) returned 1 [0196.889] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 0x2020 [0196.889] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.889] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.889] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.889] GetLastError () returned 0x0 [0196.890] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x100, lpOverlapped=0x0) returned 1 [0196.981] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x110, lpOverlapped=0x0) returned 1 [0196.983] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0196.983] WriteFile (in: hFile=0x114, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.983] SetEndOfFile (hFile=0x114) returned 1 [0196.983] CloseHandle (hObject=0x114) returned 1 [0196.983] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0196.983] SetEndOfFile (hFile=0x154) returned 1 [0196.984] CloseHandle (hObject=0x154) returned 1 [0196.984] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.984] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json")) returned 1 [0196.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.984] lstrlenW (lpString=".doc") returned 4 [0196.984] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.984] lstrlenW (lpString=".docx") returned 5 [0196.984] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.984] lstrlenW (lpString=".pdf") returned 4 [0196.984] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.984] lstrlenW (lpString=".xls") returned 4 [0196.984] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.984] lstrlenW (lpString=".xlsx") returned 5 [0196.984] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.984] lstrlenW (lpString=".ppt") returned 4 [0196.984] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.984] lstrlenW (lpString=".zip") returned 4 [0196.984] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.984] lstrlenW (lpString=".rar") returned 4 [0196.985] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.985] lstrlenW (lpString=".bz2") returned 4 [0196.985] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.985] lstrlenW (lpString=".7z") returned 3 [0196.985] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.985] lstrlenW (lpString=".dbf") returned 4 [0196.985] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.985] lstrlenW (lpString=".1cd") returned 4 [0196.985] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.985] lstrlenW (lpString=".jpg") returned 4 [0196.985] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.985] lstrlenW (lpString=".doc") returned 4 [0196.985] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.985] lstrlenW (lpString=".docx") returned 5 [0196.985] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.985] lstrlenW (lpString=".pdf") returned 4 [0196.985] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.985] lstrlenW (lpString=".xls") returned 4 [0196.985] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.985] lstrlenW (lpString=".xlsx") returned 5 [0196.985] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.985] lstrlenW (lpString=".ppt") returned 4 [0196.985] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.985] lstrlenW (lpString=".zip") returned 4 [0196.985] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.985] lstrlenW (lpString=".rar") returned 4 [0196.985] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.985] lstrlenW (lpString=".bz2") returned 4 [0196.985] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.986] lstrlenW (lpString=".7z") returned 3 [0196.986] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.986] lstrlenW (lpString=".dbf") returned 4 [0196.986] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.986] lstrlenW (lpString=".1cd") returned 4 [0196.986] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ko\\messages.json") returned 151 [0196.986] lstrlenW (lpString=".jpg") returned 4 [0196.986] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.986] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.986] lstrlenW (lpString="messages.json") returned 13 [0196.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.044] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=264) returned 1 [0197.044] CloseHandle (hObject=0x15c) returned 1 [0197.044] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 0x2020 [0197.044] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.044] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.044] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.045] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.045] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.045] GetLastError () returned 0x0 [0197.045] ReadFile (in: hFile=0x15c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x108, lpOverlapped=0x0) returned 1 [0197.046] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x110, lpOverlapped=0x0) returned 1 [0197.047] ReadFile (in: hFile=0x15c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.047] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.047] SetEndOfFile (hFile=0x150) returned 1 [0197.047] CloseHandle (hObject=0x150) returned 1 [0197.047] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.047] SetEndOfFile (hFile=0x15c) returned 1 [0197.048] CloseHandle (hObject=0x15c) returned 1 [0197.048] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.048] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json")) returned 1 [0197.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.049] lstrlenW (lpString=".doc") returned 4 [0197.049] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.049] lstrlenW (lpString=".docx") returned 5 [0197.049] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.049] lstrlenW (lpString=".pdf") returned 4 [0197.049] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.049] lstrlenW (lpString=".xls") returned 4 [0197.049] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.049] lstrlenW (lpString=".xlsx") returned 5 [0197.049] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.049] lstrlenW (lpString=".ppt") returned 4 [0197.049] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.049] lstrlenW (lpString=".zip") returned 4 [0197.049] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.049] lstrlenW (lpString=".rar") returned 4 [0197.049] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.049] lstrlenW (lpString=".bz2") returned 4 [0197.049] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.049] lstrlenW (lpString=".7z") returned 3 [0197.049] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.049] lstrlenW (lpString=".dbf") returned 4 [0197.049] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.049] lstrlenW (lpString=".1cd") returned 4 [0197.049] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.049] lstrlenW (lpString=".jpg") returned 4 [0197.049] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.049] lstrlenW (lpString=".doc") returned 4 [0197.050] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.050] lstrlenW (lpString=".docx") returned 5 [0197.050] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.050] lstrlenW (lpString=".pdf") returned 4 [0197.050] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.050] lstrlenW (lpString=".xls") returned 4 [0197.050] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.050] lstrlenW (lpString=".xlsx") returned 5 [0197.050] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.050] lstrlenW (lpString=".ppt") returned 4 [0197.050] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.050] lstrlenW (lpString=".zip") returned 4 [0197.050] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.050] lstrlenW (lpString=".rar") returned 4 [0197.050] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.050] lstrlenW (lpString=".bz2") returned 4 [0197.050] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.050] lstrlenW (lpString=".7z") returned 3 [0197.050] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.050] lstrlenW (lpString=".dbf") returned 4 [0197.050] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.050] lstrlenW (lpString=".1cd") returned 4 [0197.050] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pl\\messages.json") returned 151 [0197.050] lstrlenW (lpString=".jpg") returned 4 [0197.050] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.050] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.051] lstrlenW (lpString="messages.json") returned 13 [0197.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.051] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=234) returned 1 [0197.051] CloseHandle (hObject=0x15c) returned 1 [0197.051] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 0x2020 [0197.051] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.051] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.051] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.052] GetLastError () returned 0x0 [0197.052] ReadFile (in: hFile=0x15c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xea, lpOverlapped=0x0) returned 1 [0197.053] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0197.054] ReadFile (in: hFile=0x15c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.054] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.054] SetEndOfFile (hFile=0x150) returned 1 [0197.054] CloseHandle (hObject=0x150) returned 1 [0197.054] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.054] SetEndOfFile (hFile=0x15c) returned 1 [0197.055] CloseHandle (hObject=0x15c) returned 1 [0197.055] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.055] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json")) returned 1 [0197.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.055] lstrlenW (lpString=".doc") returned 4 [0197.055] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.055] lstrlenW (lpString=".docx") returned 5 [0197.055] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.055] lstrlenW (lpString=".pdf") returned 4 [0197.055] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.055] lstrlenW (lpString=".xls") returned 4 [0197.055] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.056] lstrlenW (lpString=".xlsx") returned 5 [0197.056] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.056] lstrlenW (lpString=".ppt") returned 4 [0197.056] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.056] lstrlenW (lpString=".zip") returned 4 [0197.056] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.056] lstrlenW (lpString=".rar") returned 4 [0197.056] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.056] lstrlenW (lpString=".bz2") returned 4 [0197.056] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.056] lstrlenW (lpString=".7z") returned 3 [0197.056] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.056] lstrlenW (lpString=".dbf") returned 4 [0197.056] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.056] lstrlenW (lpString=".1cd") returned 4 [0197.056] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.056] lstrlenW (lpString=".jpg") returned 4 [0197.056] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.056] lstrlenW (lpString=".doc") returned 4 [0197.056] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.056] lstrlenW (lpString=".docx") returned 5 [0197.056] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.056] lstrlenW (lpString=".pdf") returned 4 [0197.056] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.056] lstrlenW (lpString=".xls") returned 4 [0197.056] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.056] lstrlenW (lpString=".xlsx") returned 5 [0197.057] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.057] lstrlenW (lpString=".ppt") returned 4 [0197.057] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.057] lstrlenW (lpString=".zip") returned 4 [0197.057] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.057] lstrlenW (lpString=".rar") returned 4 [0197.057] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.057] lstrlenW (lpString=".bz2") returned 4 [0197.057] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.057] lstrlenW (lpString=".7z") returned 3 [0197.057] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.057] lstrlenW (lpString=".dbf") returned 4 [0197.057] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.057] lstrlenW (lpString=".1cd") returned 4 [0197.057] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sl\\messages.json") returned 151 [0197.057] lstrlenW (lpString=".jpg") returned 4 [0197.057] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.057] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.057] lstrlenW (lpString="messages.json") returned 13 [0197.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.060] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=295) returned 1 [0197.060] CloseHandle (hObject=0x15c) returned 1 [0197.061] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 0x2020 [0197.061] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.061] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.061] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.061] GetLastError () returned 0x0 [0197.061] ReadFile (in: hFile=0x15c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x127, lpOverlapped=0x0) returned 1 [0197.062] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x130, lpOverlapped=0x0) returned 1 [0197.063] ReadFile (in: hFile=0x15c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.063] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.063] SetEndOfFile (hFile=0x150) returned 1 [0197.064] CloseHandle (hObject=0x150) returned 1 [0197.064] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.064] SetEndOfFile (hFile=0x15c) returned 1 [0197.064] CloseHandle (hObject=0x15c) returned 1 [0197.064] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.065] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json")) returned 1 [0197.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.065] lstrlenW (lpString=".doc") returned 4 [0197.065] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.065] lstrlenW (lpString=".docx") returned 5 [0197.065] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.065] lstrlenW (lpString=".pdf") returned 4 [0197.065] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.065] lstrlenW (lpString=".xls") returned 4 [0197.065] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.065] lstrlenW (lpString=".xlsx") returned 5 [0197.065] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.065] lstrlenW (lpString=".ppt") returned 4 [0197.065] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.065] lstrlenW (lpString=".zip") returned 4 [0197.065] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.065] lstrlenW (lpString=".rar") returned 4 [0197.065] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.065] lstrlenW (lpString=".bz2") returned 4 [0197.065] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.065] lstrlenW (lpString=".7z") returned 3 [0197.065] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.065] lstrlenW (lpString=".dbf") returned 4 [0197.065] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.065] lstrlenW (lpString=".1cd") returned 4 [0197.065] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.066] lstrlenW (lpString=".jpg") returned 4 [0197.066] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.066] lstrlenW (lpString=".doc") returned 4 [0197.066] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.066] lstrlenW (lpString=".docx") returned 5 [0197.066] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.066] lstrlenW (lpString=".pdf") returned 4 [0197.066] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.066] lstrlenW (lpString=".xls") returned 4 [0197.066] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.066] lstrlenW (lpString=".xlsx") returned 5 [0197.066] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.066] lstrlenW (lpString=".ppt") returned 4 [0197.066] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.066] lstrlenW (lpString=".zip") returned 4 [0197.066] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.066] lstrlenW (lpString=".rar") returned 4 [0197.066] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.066] lstrlenW (lpString=".bz2") returned 4 [0197.066] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.066] lstrlenW (lpString=".7z") returned 3 [0197.066] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.066] lstrlenW (lpString=".dbf") returned 4 [0197.066] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.066] lstrlenW (lpString=".1cd") returned 4 [0197.066] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sr\\messages.json") returned 151 [0197.067] lstrlenW (lpString=".jpg") returned 4 [0197.067] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.067] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.067] lstrlenW (lpString="messages.json") returned 13 [0197.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.067] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=324) returned 1 [0197.067] CloseHandle (hObject=0x15c) returned 1 [0197.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 0x2020 [0197.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.068] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.068] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.068] GetLastError () returned 0x0 [0197.068] ReadFile (in: hFile=0x15c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x144, lpOverlapped=0x0) returned 1 [0197.069] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x150, lpOverlapped=0x0) returned 1 [0197.070] ReadFile (in: hFile=0x15c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.070] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.070] SetEndOfFile (hFile=0x150) returned 1 [0197.070] CloseHandle (hObject=0x150) returned 1 [0197.070] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.070] SetEndOfFile (hFile=0x15c) returned 1 [0197.071] CloseHandle (hObject=0x15c) returned 1 [0197.072] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.072] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json")) returned 1 [0197.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.072] lstrlenW (lpString=".doc") returned 4 [0197.072] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.072] lstrlenW (lpString=".docx") returned 5 [0197.072] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.072] lstrlenW (lpString=".pdf") returned 4 [0197.072] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.072] lstrlenW (lpString=".xls") returned 4 [0197.072] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.072] lstrlenW (lpString=".xlsx") returned 5 [0197.072] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.072] lstrlenW (lpString=".ppt") returned 4 [0197.072] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.072] lstrlenW (lpString=".zip") returned 4 [0197.072] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.072] lstrlenW (lpString=".rar") returned 4 [0197.072] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.072] lstrlenW (lpString=".bz2") returned 4 [0197.072] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.072] lstrlenW (lpString=".7z") returned 3 [0197.073] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.073] lstrlenW (lpString=".dbf") returned 4 [0197.073] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.073] lstrlenW (lpString=".1cd") returned 4 [0197.073] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.073] lstrlenW (lpString=".jpg") returned 4 [0197.073] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.073] lstrlenW (lpString=".doc") returned 4 [0197.073] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.073] lstrlenW (lpString=".docx") returned 5 [0197.073] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.073] lstrlenW (lpString=".pdf") returned 4 [0197.073] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.073] lstrlenW (lpString=".xls") returned 4 [0197.073] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.073] lstrlenW (lpString=".xlsx") returned 5 [0197.073] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.073] lstrlenW (lpString=".ppt") returned 4 [0197.073] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.073] lstrlenW (lpString=".zip") returned 4 [0197.073] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.073] lstrlenW (lpString=".rar") returned 4 [0197.073] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.073] lstrlenW (lpString=".bz2") returned 4 [0197.073] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.073] lstrlenW (lpString=".7z") returned 3 [0197.073] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.074] lstrlenW (lpString=".dbf") returned 4 [0197.074] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.074] lstrlenW (lpString=".1cd") returned 4 [0197.074] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\th\\messages.json") returned 151 [0197.074] lstrlenW (lpString=".jpg") returned 4 [0197.074] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.074] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.074] lstrlenW (lpString="messages.json") returned 13 [0197.074] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.074] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=234) returned 1 [0197.074] CloseHandle (hObject=0x15c) returned 1 [0197.075] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 0x2020 [0197.075] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.075] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.075] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.075] GetLastError () returned 0x0 [0197.075] ReadFile (in: hFile=0x15c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xea, lpOverlapped=0x0) returned 1 [0197.237] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0197.238] ReadFile (in: hFile=0x15c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.238] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.238] SetEndOfFile (hFile=0x150) returned 1 [0197.238] CloseHandle (hObject=0x150) returned 1 [0197.238] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.238] SetEndOfFile (hFile=0x15c) returned 1 [0197.239] CloseHandle (hObject=0x15c) returned 1 [0197.239] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.239] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json")) returned 1 [0197.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.239] lstrlenW (lpString=".doc") returned 4 [0197.239] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.239] lstrlenW (lpString=".docx") returned 5 [0197.239] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.239] lstrlenW (lpString=".pdf") returned 4 [0197.240] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.240] lstrlenW (lpString=".xls") returned 4 [0197.240] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.240] lstrlenW (lpString=".xlsx") returned 5 [0197.240] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.240] lstrlenW (lpString=".ppt") returned 4 [0197.240] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.240] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.240] lstrlenW (lpString=".zip") returned 4 [0197.240] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.240] lstrlenW (lpString=".rar") returned 4 [0197.240] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.240] lstrlenW (lpString=".bz2") returned 4 [0197.240] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.240] lstrlenW (lpString=".7z") returned 3 [0197.240] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.240] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.240] lstrlenW (lpString=".dbf") returned 4 [0197.240] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.240] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.240] lstrlenW (lpString=".1cd") returned 4 [0197.240] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.240] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.240] lstrlenW (lpString=".jpg") returned 4 [0197.240] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.240] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.240] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.240] lstrlenW (lpString=".doc") returned 4 [0197.240] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.240] lstrlenW (lpString=".docx") returned 5 [0197.240] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.240] lstrlenW (lpString=".pdf") returned 4 [0197.240] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.240] lstrlenW (lpString=".xls") returned 4 [0197.240] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.240] lstrlenW (lpString=".xlsx") returned 5 [0197.241] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.241] lstrlenW (lpString=".ppt") returned 4 [0197.241] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.241] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.241] lstrlenW (lpString=".zip") returned 4 [0197.241] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.241] lstrlenW (lpString=".rar") returned 4 [0197.241] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.241] lstrlenW (lpString=".bz2") returned 4 [0197.241] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.241] lstrlenW (lpString=".7z") returned 3 [0197.241] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.241] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.241] lstrlenW (lpString=".dbf") returned 4 [0197.241] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.241] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.241] lstrlenW (lpString=".1cd") returned 4 [0197.241] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.241] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\tr\\messages.json") returned 151 [0197.241] lstrlenW (lpString=".jpg") returned 4 [0197.241] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.241] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0197.241] lstrlenW (lpString="cast_route_details.html") returned 23 [0197.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0197.289] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=70113) returned 1 [0197.289] CloseHandle (hObject=0x120) returned 1 [0197.289] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 0x2020 [0197.306] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0197.306] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.306] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.306] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.317] GetLastError () returned 0x0 [0197.317] ReadFile (in: hFile=0x120, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x111e1, lpOverlapped=0x0) returned 1 [0197.320] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x111f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x111f0, lpOverlapped=0x0) returned 1 [0197.322] ReadFile (in: hFile=0x120, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.322] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x102, lpOverlapped=0x0) returned 1 [0197.323] SetEndOfFile (hFile=0x150) returned 1 [0197.323] CloseHandle (hObject=0x150) returned 1 [0197.323] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.323] SetEndOfFile (hFile=0x120) returned 1 [0197.324] CloseHandle (hObject=0x120) returned 1 [0197.324] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.324] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html")) returned 1 [0197.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.324] lstrlenW (lpString=".doc") returned 4 [0197.324] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.324] lstrlenW (lpString=".docx") returned 5 [0197.324] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.324] lstrlenW (lpString=".pdf") returned 4 [0197.324] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.324] lstrlenW (lpString=".xls") returned 4 [0197.324] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.325] lstrlenW (lpString=".xlsx") returned 5 [0197.325] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.325] lstrlenW (lpString=".ppt") returned 4 [0197.325] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.325] lstrlenW (lpString=".zip") returned 4 [0197.325] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.325] lstrlenW (lpString=".rar") returned 4 [0197.325] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.325] lstrlenW (lpString=".bz2") returned 4 [0197.325] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.325] lstrlenW (lpString=".7z") returned 3 [0197.325] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.325] lstrlenW (lpString=".dbf") returned 4 [0197.325] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.325] lstrlenW (lpString=".1cd") returned 4 [0197.325] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.325] lstrlenW (lpString=".jpg") returned 4 [0197.325] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.325] lstrlenW (lpString=".doc") returned 4 [0197.325] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.325] lstrlenW (lpString=".docx") returned 5 [0197.325] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.325] lstrlenW (lpString=".pdf") returned 4 [0197.325] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.325] lstrlenW (lpString=".xls") returned 4 [0197.325] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.325] lstrlenW (lpString=".xlsx") returned 5 [0197.325] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.326] lstrlenW (lpString=".ppt") returned 4 [0197.326] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.326] lstrlenW (lpString=".zip") returned 4 [0197.326] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.326] lstrlenW (lpString=".rar") returned 4 [0197.326] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.326] lstrlenW (lpString=".bz2") returned 4 [0197.326] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.326] lstrlenW (lpString=".7z") returned 3 [0197.326] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.326] lstrlenW (lpString=".dbf") returned 4 [0197.326] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.326] lstrlenW (lpString=".1cd") returned 4 [0197.326] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.html") returned 158 [0197.326] lstrlenW (lpString=".jpg") returned 4 [0197.326] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.326] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0197.326] lstrlenW (lpString="chromecast_logo_grey.png") returned 24 [0197.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.474] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7151) returned 1 [0197.474] CloseHandle (hObject=0x154) returned 1 [0197.475] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 0x2020 [0197.475] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.475] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.475] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.475] GetLastError () returned 0x0 [0197.475] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x1bef, lpOverlapped=0x0) returned 1 [0197.477] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1bf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1bf0, lpOverlapped=0x0) returned 1 [0197.478] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.478] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x104, lpOverlapped=0x0) returned 1 [0197.478] SetEndOfFile (hFile=0x15c) returned 1 [0197.479] CloseHandle (hObject=0x15c) returned 1 [0197.479] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.479] SetEndOfFile (hFile=0x154) returned 1 [0197.479] CloseHandle (hObject=0x154) returned 1 [0197.480] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.480] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png")) returned 1 [0197.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.480] lstrlenW (lpString=".doc") returned 4 [0197.480] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0197.480] lstrlenW (lpString=".docx") returned 5 [0197.480] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0197.480] lstrlenW (lpString=".pdf") returned 4 [0197.480] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0197.480] lstrlenW (lpString=".xls") returned 4 [0197.480] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0197.480] lstrlenW (lpString=".xlsx") returned 5 [0197.480] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0197.480] lstrlenW (lpString=".ppt") returned 4 [0197.480] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0197.480] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.480] lstrlenW (lpString=".zip") returned 4 [0197.480] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0197.480] lstrlenW (lpString=".rar") returned 4 [0197.480] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0197.480] lstrlenW (lpString=".bz2") returned 4 [0197.480] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0197.480] lstrlenW (lpString=".7z") returned 3 [0197.481] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0197.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.481] lstrlenW (lpString=".dbf") returned 4 [0197.481] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0197.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.481] lstrlenW (lpString=".1cd") returned 4 [0197.481] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0197.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.481] lstrlenW (lpString=".jpg") returned 4 [0197.481] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0197.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.481] lstrlenW (lpString=".doc") returned 4 [0197.481] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0197.481] lstrlenW (lpString=".docx") returned 5 [0197.481] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0197.481] lstrlenW (lpString=".pdf") returned 4 [0197.481] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0197.481] lstrlenW (lpString=".xls") returned 4 [0197.481] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0197.481] lstrlenW (lpString=".xlsx") returned 5 [0197.481] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0197.481] lstrlenW (lpString=".ppt") returned 4 [0197.481] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0197.481] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.481] lstrlenW (lpString=".zip") returned 4 [0197.481] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0197.481] lstrlenW (lpString=".rar") returned 4 [0197.481] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0197.481] lstrlenW (lpString=".bz2") returned 4 [0197.481] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0197.481] lstrlenW (lpString=".7z") returned 3 [0197.481] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0197.482] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.482] lstrlenW (lpString=".dbf") returned 4 [0197.482] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0197.482] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.482] lstrlenW (lpString=".1cd") returned 4 [0197.482] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0197.482] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\chromecast_logo_grey.png") returned 170 [0197.482] lstrlenW (lpString=".jpg") returned 4 [0197.482] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0197.482] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.482] lstrlenW (lpString="manifest.json") returned 13 [0197.482] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.527] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2296) returned 1 [0197.527] CloseHandle (hObject=0x154) returned 1 [0197.527] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json")) returned 0x2020 [0197.527] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.527] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.527] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.527] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.528] GetLastError () returned 0x0 [0197.528] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x8f8, lpOverlapped=0x0) returned 1 [0197.529] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x900, lpOverlapped=0x0) returned 1 [0197.530] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.530] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.530] SetEndOfFile (hFile=0x15c) returned 1 [0197.530] CloseHandle (hObject=0x15c) returned 1 [0197.530] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.530] SetEndOfFile (hFile=0x154) returned 1 [0197.531] CloseHandle (hObject=0x154) returned 1 [0197.531] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.531] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json")) returned 1 [0197.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.532] lstrlenW (lpString=".doc") returned 4 [0197.532] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.532] lstrlenW (lpString=".docx") returned 5 [0197.532] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.532] lstrlenW (lpString=".pdf") returned 4 [0197.532] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.532] lstrlenW (lpString=".xls") returned 4 [0197.532] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.532] lstrlenW (lpString=".xlsx") returned 5 [0197.532] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.532] lstrlenW (lpString=".ppt") returned 4 [0197.532] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.532] lstrlenW (lpString=".zip") returned 4 [0197.532] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.532] lstrlenW (lpString=".rar") returned 4 [0197.532] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.532] lstrlenW (lpString=".bz2") returned 4 [0197.532] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.532] lstrlenW (lpString=".7z") returned 3 [0197.532] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.532] lstrlenW (lpString=".dbf") returned 4 [0197.532] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.532] lstrlenW (lpString=".1cd") returned 4 [0197.532] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.532] lstrlenW (lpString=".jpg") returned 4 [0197.532] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.533] lstrlenW (lpString=".doc") returned 4 [0197.533] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.533] lstrlenW (lpString=".docx") returned 5 [0197.533] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.533] lstrlenW (lpString=".pdf") returned 4 [0197.533] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.533] lstrlenW (lpString=".xls") returned 4 [0197.533] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.533] lstrlenW (lpString=".xlsx") returned 5 [0197.533] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.533] lstrlenW (lpString=".ppt") returned 4 [0197.533] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.533] lstrlenW (lpString=".zip") returned 4 [0197.533] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.533] lstrlenW (lpString=".rar") returned 4 [0197.533] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.533] lstrlenW (lpString=".bz2") returned 4 [0197.533] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.533] lstrlenW (lpString=".7z") returned 3 [0197.533] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.533] lstrlenW (lpString=".dbf") returned 4 [0197.533] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.533] lstrlenW (lpString=".1cd") returned 4 [0197.533] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\manifest.json") returned 148 [0197.533] lstrlenW (lpString=".jpg") returned 4 [0197.533] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.534] lstrcmpiW (lpString1=".css", lpString2=".wiki") returned -1 [0197.534] lstrlenW (lpString="material_css_min.css") returned 20 [0197.534] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.536] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=286777) returned 1 [0197.536] CloseHandle (hObject=0x154) returned 1 [0197.536] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css")) returned 0x2020 [0197.536] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.536] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.536] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.537] GetLastError () returned 0x0 [0197.537] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x46039, lpOverlapped=0x0) returned 1 [0197.545] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x46040, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x46040, lpOverlapped=0x0) returned 1 [0197.550] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.550] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xfc, lpOverlapped=0x0) returned 1 [0197.550] SetEndOfFile (hFile=0x15c) returned 1 [0197.551] CloseHandle (hObject=0x15c) returned 1 [0197.551] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.551] SetEndOfFile (hFile=0x154) returned 1 [0197.553] CloseHandle (hObject=0x154) returned 1 [0197.554] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.554] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css")) returned 1 [0197.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.554] lstrlenW (lpString=".doc") returned 4 [0197.554] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0197.554] lstrlenW (lpString=".docx") returned 5 [0197.554] lstrcmpiW (lpString1=".docx", lpString2="n.css") returned -1 [0197.554] lstrlenW (lpString=".pdf") returned 4 [0197.554] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0197.554] lstrlenW (lpString=".xls") returned 4 [0197.554] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0197.554] lstrlenW (lpString=".xlsx") returned 5 [0197.554] lstrcmpiW (lpString1=".xlsx", lpString2="n.css") returned -1 [0197.554] lstrlenW (lpString=".ppt") returned 4 [0197.554] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0197.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.554] lstrlenW (lpString=".zip") returned 4 [0197.554] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0197.554] lstrlenW (lpString=".rar") returned 4 [0197.554] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0197.554] lstrlenW (lpString=".bz2") returned 4 [0197.554] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0197.554] lstrlenW (lpString=".7z") returned 3 [0197.555] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0197.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.555] lstrlenW (lpString=".dbf") returned 4 [0197.555] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0197.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.555] lstrlenW (lpString=".1cd") returned 4 [0197.555] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0197.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.555] lstrlenW (lpString=".jpg") returned 4 [0197.555] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0197.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.555] lstrlenW (lpString=".doc") returned 4 [0197.555] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0197.555] lstrlenW (lpString=".docx") returned 5 [0197.555] lstrcmpiW (lpString1=".docx", lpString2="n.css") returned -1 [0197.555] lstrlenW (lpString=".pdf") returned 4 [0197.555] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0197.555] lstrlenW (lpString=".xls") returned 4 [0197.555] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0197.555] lstrlenW (lpString=".xlsx") returned 5 [0197.555] lstrcmpiW (lpString1=".xlsx", lpString2="n.css") returned -1 [0197.555] lstrlenW (lpString=".ppt") returned 4 [0197.555] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0197.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.555] lstrlenW (lpString=".zip") returned 4 [0197.555] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0197.555] lstrlenW (lpString=".rar") returned 4 [0197.555] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0197.555] lstrlenW (lpString=".bz2") returned 4 [0197.555] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0197.556] lstrlenW (lpString=".7z") returned 3 [0197.556] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0197.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.556] lstrlenW (lpString=".dbf") returned 4 [0197.556] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0197.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.556] lstrlenW (lpString=".1cd") returned 4 [0197.556] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0197.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\material_css_min.css") returned 155 [0197.556] lstrlenW (lpString=".jpg") returned 4 [0197.556] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0197.556] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.556] lstrlenW (lpString="mirroring_cast_streaming.js") returned 27 [0197.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.556] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=31795) returned 1 [0197.557] CloseHandle (hObject=0x154) returned 1 [0197.557] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js")) returned 0x2020 [0197.557] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.557] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.557] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.557] GetLastError () returned 0x0 [0197.557] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x7c33, lpOverlapped=0x0) returned 1 [0197.560] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x7c40, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7c40, lpOverlapped=0x0) returned 1 [0197.561] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.561] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x10a, lpOverlapped=0x0) returned 1 [0197.561] SetEndOfFile (hFile=0x15c) returned 1 [0197.561] CloseHandle (hObject=0x15c) returned 1 [0197.562] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.562] SetEndOfFile (hFile=0x154) returned 1 [0197.562] CloseHandle (hObject=0x154) returned 1 [0197.563] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.563] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js")) returned 1 [0197.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.563] lstrlenW (lpString=".doc") returned 4 [0197.563] lstrcmpiW (lpString1=".doc", lpString2="g.js") returned -1 [0197.563] lstrlenW (lpString=".docx") returned 5 [0197.563] lstrcmpiW (lpString1=".docx", lpString2="ng.js") returned -1 [0197.563] lstrlenW (lpString=".pdf") returned 4 [0197.563] lstrcmpiW (lpString1=".pdf", lpString2="g.js") returned -1 [0197.563] lstrlenW (lpString=".xls") returned 4 [0197.563] lstrcmpiW (lpString1=".xls", lpString2="g.js") returned -1 [0197.563] lstrlenW (lpString=".xlsx") returned 5 [0197.563] lstrcmpiW (lpString1=".xlsx", lpString2="ng.js") returned -1 [0197.563] lstrlenW (lpString=".ppt") returned 4 [0197.563] lstrcmpiW (lpString1=".ppt", lpString2="g.js") returned -1 [0197.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.563] lstrlenW (lpString=".zip") returned 4 [0197.563] lstrcmpiW (lpString1=".zip", lpString2="g.js") returned -1 [0197.563] lstrlenW (lpString=".rar") returned 4 [0197.563] lstrcmpiW (lpString1=".rar", lpString2="g.js") returned -1 [0197.563] lstrlenW (lpString=".bz2") returned 4 [0197.563] lstrcmpiW (lpString1=".bz2", lpString2="g.js") returned -1 [0197.563] lstrlenW (lpString=".7z") returned 3 [0197.563] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.564] lstrlenW (lpString=".dbf") returned 4 [0197.564] lstrcmpiW (lpString1=".dbf", lpString2="g.js") returned -1 [0197.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.564] lstrlenW (lpString=".1cd") returned 4 [0197.564] lstrcmpiW (lpString1=".1cd", lpString2="g.js") returned -1 [0197.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.564] lstrlenW (lpString=".jpg") returned 4 [0197.564] lstrcmpiW (lpString1=".jpg", lpString2="g.js") returned -1 [0197.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.564] lstrlenW (lpString=".doc") returned 4 [0197.564] lstrcmpiW (lpString1=".doc", lpString2="g.js") returned -1 [0197.564] lstrlenW (lpString=".docx") returned 5 [0197.564] lstrcmpiW (lpString1=".docx", lpString2="ng.js") returned -1 [0197.564] lstrlenW (lpString=".pdf") returned 4 [0197.564] lstrcmpiW (lpString1=".pdf", lpString2="g.js") returned -1 [0197.564] lstrlenW (lpString=".xls") returned 4 [0197.564] lstrcmpiW (lpString1=".xls", lpString2="g.js") returned -1 [0197.564] lstrlenW (lpString=".xlsx") returned 5 [0197.564] lstrcmpiW (lpString1=".xlsx", lpString2="ng.js") returned -1 [0197.564] lstrlenW (lpString=".ppt") returned 4 [0197.564] lstrcmpiW (lpString1=".ppt", lpString2="g.js") returned -1 [0197.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.564] lstrlenW (lpString=".zip") returned 4 [0197.564] lstrcmpiW (lpString1=".zip", lpString2="g.js") returned -1 [0197.564] lstrlenW (lpString=".rar") returned 4 [0197.564] lstrcmpiW (lpString1=".rar", lpString2="g.js") returned -1 [0197.564] lstrlenW (lpString=".bz2") returned 4 [0197.564] lstrcmpiW (lpString1=".bz2", lpString2="g.js") returned -1 [0197.564] lstrlenW (lpString=".7z") returned 3 [0197.564] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.564] lstrlenW (lpString=".dbf") returned 4 [0197.564] lstrcmpiW (lpString1=".dbf", lpString2="g.js") returned -1 [0197.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.565] lstrlenW (lpString=".1cd") returned 4 [0197.565] lstrcmpiW (lpString1=".1cd", lpString2="g.js") returned -1 [0197.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_cast_streaming.js") returned 162 [0197.565] lstrlenW (lpString=".jpg") returned 4 [0197.565] lstrcmpiW (lpString1=".jpg", lpString2="g.js") returned -1 [0197.565] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.565] lstrlenW (lpString="mirroring_common.js") returned 19 [0197.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.565] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=175595) returned 1 [0197.565] CloseHandle (hObject=0x154) returned 1 [0197.565] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js")) returned 0x2020 [0197.565] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.566] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.566] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.566] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.566] GetLastError () returned 0x0 [0197.566] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2adeb, lpOverlapped=0x0) returned 1 [0197.679] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2adf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2adf0, lpOverlapped=0x0) returned 1 [0197.682] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.682] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0197.683] SetEndOfFile (hFile=0x15c) returned 1 [0197.683] CloseHandle (hObject=0x15c) returned 1 [0197.683] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.683] SetEndOfFile (hFile=0x154) returned 1 [0197.684] CloseHandle (hObject=0x154) returned 1 [0197.685] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.685] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js")) returned 1 [0197.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.685] lstrlenW (lpString=".doc") returned 4 [0197.685] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0197.685] lstrlenW (lpString=".docx") returned 5 [0197.685] lstrcmpiW (lpString1=".docx", lpString2="on.js") returned -1 [0197.685] lstrlenW (lpString=".pdf") returned 4 [0197.685] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0197.685] lstrlenW (lpString=".xls") returned 4 [0197.685] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0197.685] lstrlenW (lpString=".xlsx") returned 5 [0197.685] lstrcmpiW (lpString1=".xlsx", lpString2="on.js") returned -1 [0197.685] lstrlenW (lpString=".ppt") returned 4 [0197.685] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0197.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.685] lstrlenW (lpString=".zip") returned 4 [0197.685] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0197.685] lstrlenW (lpString=".rar") returned 4 [0197.685] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0197.685] lstrlenW (lpString=".bz2") returned 4 [0197.685] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0197.685] lstrlenW (lpString=".7z") returned 3 [0197.685] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.686] lstrlenW (lpString=".dbf") returned 4 [0197.686] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0197.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.686] lstrlenW (lpString=".1cd") returned 4 [0197.686] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0197.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.686] lstrlenW (lpString=".jpg") returned 4 [0197.686] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0197.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.686] lstrlenW (lpString=".doc") returned 4 [0197.686] lstrcmpiW (lpString1=".doc", lpString2="n.js") returned -1 [0197.686] lstrlenW (lpString=".docx") returned 5 [0197.686] lstrcmpiW (lpString1=".docx", lpString2="on.js") returned -1 [0197.686] lstrlenW (lpString=".pdf") returned 4 [0197.686] lstrcmpiW (lpString1=".pdf", lpString2="n.js") returned -1 [0197.686] lstrlenW (lpString=".xls") returned 4 [0197.686] lstrcmpiW (lpString1=".xls", lpString2="n.js") returned -1 [0197.686] lstrlenW (lpString=".xlsx") returned 5 [0197.686] lstrcmpiW (lpString1=".xlsx", lpString2="on.js") returned -1 [0197.686] lstrlenW (lpString=".ppt") returned 4 [0197.686] lstrcmpiW (lpString1=".ppt", lpString2="n.js") returned -1 [0197.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.686] lstrlenW (lpString=".zip") returned 4 [0197.686] lstrcmpiW (lpString1=".zip", lpString2="n.js") returned -1 [0197.686] lstrlenW (lpString=".rar") returned 4 [0197.686] lstrcmpiW (lpString1=".rar", lpString2="n.js") returned -1 [0197.686] lstrlenW (lpString=".bz2") returned 4 [0197.686] lstrcmpiW (lpString1=".bz2", lpString2="n.js") returned -1 [0197.686] lstrlenW (lpString=".7z") returned 3 [0197.686] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.686] lstrlenW (lpString=".dbf") returned 4 [0197.687] lstrcmpiW (lpString1=".dbf", lpString2="n.js") returned -1 [0197.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.687] lstrlenW (lpString=".1cd") returned 4 [0197.687] lstrcmpiW (lpString1=".1cd", lpString2="n.js") returned -1 [0197.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\mirroring_common.js") returned 154 [0197.687] lstrlenW (lpString=".jpg") returned 4 [0197.687] lstrcmpiW (lpString1=".jpg", lpString2="n.js") returned -1 [0197.687] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.687] lstrlenW (lpString="messages.json") returned 13 [0197.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.687] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=16495) returned 1 [0197.687] CloseHandle (hObject=0x154) returned 1 [0197.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json")) returned 0x2020 [0197.688] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.688] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.688] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.688] GetLastError () returned 0x0 [0197.688] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x406f, lpOverlapped=0x0) returned 1 [0197.691] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4070, lpOverlapped=0x0) returned 1 [0197.692] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.692] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.692] SetEndOfFile (hFile=0x15c) returned 1 [0197.692] CloseHandle (hObject=0x15c) returned 1 [0197.692] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.692] SetEndOfFile (hFile=0x154) returned 1 [0197.693] CloseHandle (hObject=0x154) returned 1 [0197.693] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.693] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json")) returned 1 [0197.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.694] lstrlenW (lpString=".doc") returned 4 [0197.694] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.694] lstrlenW (lpString=".docx") returned 5 [0197.694] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.694] lstrlenW (lpString=".pdf") returned 4 [0197.694] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.694] lstrlenW (lpString=".xls") returned 4 [0197.694] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.694] lstrlenW (lpString=".xlsx") returned 5 [0197.694] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.694] lstrlenW (lpString=".ppt") returned 4 [0197.694] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.694] lstrlenW (lpString=".zip") returned 4 [0197.694] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.694] lstrlenW (lpString=".rar") returned 4 [0197.694] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.694] lstrlenW (lpString=".bz2") returned 4 [0197.694] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.694] lstrlenW (lpString=".7z") returned 3 [0197.694] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.694] lstrlenW (lpString=".dbf") returned 4 [0197.694] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.694] lstrlenW (lpString=".1cd") returned 4 [0197.694] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.694] lstrlenW (lpString=".jpg") returned 4 [0197.694] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.694] lstrlenW (lpString=".doc") returned 4 [0197.695] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.695] lstrlenW (lpString=".docx") returned 5 [0197.695] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.695] lstrlenW (lpString=".pdf") returned 4 [0197.695] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.695] lstrlenW (lpString=".xls") returned 4 [0197.695] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.695] lstrlenW (lpString=".xlsx") returned 5 [0197.695] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.695] lstrlenW (lpString=".ppt") returned 4 [0197.695] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.695] lstrlenW (lpString=".zip") returned 4 [0197.695] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.695] lstrlenW (lpString=".rar") returned 4 [0197.695] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.695] lstrlenW (lpString=".bz2") returned 4 [0197.695] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.695] lstrlenW (lpString=".7z") returned 3 [0197.695] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.695] lstrlenW (lpString=".dbf") returned 4 [0197.695] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.695] lstrlenW (lpString=".1cd") returned 4 [0197.695] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\de\\messages.json") returned 160 [0197.695] lstrlenW (lpString=".jpg") returned 4 [0197.696] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.696] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.696] lstrlenW (lpString="messages.json") returned 13 [0197.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.696] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=19198) returned 1 [0197.696] CloseHandle (hObject=0x154) returned 1 [0197.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json")) returned 0x2020 [0197.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.697] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.697] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.697] GetLastError () returned 0x0 [0197.697] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x4afe, lpOverlapped=0x0) returned 1 [0197.699] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x4b00, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4b00, lpOverlapped=0x0) returned 1 [0197.700] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.700] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.700] SetEndOfFile (hFile=0x15c) returned 1 [0197.700] CloseHandle (hObject=0x15c) returned 1 [0197.701] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.701] SetEndOfFile (hFile=0x154) returned 1 [0197.701] CloseHandle (hObject=0x154) returned 1 [0197.701] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.702] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json")) returned 1 [0197.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.702] lstrlenW (lpString=".doc") returned 4 [0197.702] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.702] lstrlenW (lpString=".docx") returned 5 [0197.702] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.702] lstrlenW (lpString=".pdf") returned 4 [0197.702] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.702] lstrlenW (lpString=".xls") returned 4 [0197.702] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.702] lstrlenW (lpString=".xlsx") returned 5 [0197.702] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.702] lstrlenW (lpString=".ppt") returned 4 [0197.702] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.702] lstrlenW (lpString=".zip") returned 4 [0197.702] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.702] lstrlenW (lpString=".rar") returned 4 [0197.702] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.702] lstrlenW (lpString=".bz2") returned 4 [0197.702] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.702] lstrlenW (lpString=".7z") returned 3 [0197.702] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.702] lstrlenW (lpString=".dbf") returned 4 [0197.702] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.703] lstrlenW (lpString=".1cd") returned 4 [0197.703] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.703] lstrlenW (lpString=".jpg") returned 4 [0197.703] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.703] lstrlenW (lpString=".doc") returned 4 [0197.703] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.703] lstrlenW (lpString=".docx") returned 5 [0197.703] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.703] lstrlenW (lpString=".pdf") returned 4 [0197.703] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.703] lstrlenW (lpString=".xls") returned 4 [0197.703] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.703] lstrlenW (lpString=".xlsx") returned 5 [0197.703] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.703] lstrlenW (lpString=".ppt") returned 4 [0197.703] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.703] lstrlenW (lpString=".zip") returned 4 [0197.703] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.703] lstrlenW (lpString=".rar") returned 4 [0197.703] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.703] lstrlenW (lpString=".bz2") returned 4 [0197.703] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.703] lstrlenW (lpString=".7z") returned 3 [0197.703] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.703] lstrlenW (lpString=".dbf") returned 4 [0197.703] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.703] lstrlenW (lpString=".1cd") returned 4 [0197.704] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\el\\messages.json") returned 160 [0197.704] lstrlenW (lpString=".jpg") returned 4 [0197.704] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.704] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.704] lstrlenW (lpString="messages.json") returned 13 [0197.704] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.706] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=15738) returned 1 [0197.706] CloseHandle (hObject=0x154) returned 1 [0197.706] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json")) returned 0x2020 [0197.707] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.707] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.707] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.707] GetLastError () returned 0x0 [0197.707] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x3d7a, lpOverlapped=0x0) returned 1 [0197.710] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0197.711] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.711] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.711] SetEndOfFile (hFile=0x15c) returned 1 [0197.712] CloseHandle (hObject=0x15c) returned 1 [0197.712] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.712] SetEndOfFile (hFile=0x154) returned 1 [0197.712] CloseHandle (hObject=0x154) returned 1 [0197.712] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.713] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json")) returned 1 [0197.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.713] lstrlenW (lpString=".doc") returned 4 [0197.713] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.713] lstrlenW (lpString=".docx") returned 5 [0197.713] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.713] lstrlenW (lpString=".pdf") returned 4 [0197.713] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.713] lstrlenW (lpString=".xls") returned 4 [0197.713] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.713] lstrlenW (lpString=".xlsx") returned 5 [0197.713] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.713] lstrlenW (lpString=".ppt") returned 4 [0197.713] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.713] lstrlenW (lpString=".zip") returned 4 [0197.713] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.713] lstrlenW (lpString=".rar") returned 4 [0197.713] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.713] lstrlenW (lpString=".bz2") returned 4 [0197.713] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.713] lstrlenW (lpString=".7z") returned 3 [0197.713] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.714] lstrlenW (lpString=".dbf") returned 4 [0197.714] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.714] lstrlenW (lpString=".1cd") returned 4 [0197.714] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.714] lstrlenW (lpString=".jpg") returned 4 [0197.714] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.714] lstrlenW (lpString=".doc") returned 4 [0197.714] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.714] lstrlenW (lpString=".docx") returned 5 [0197.714] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.714] lstrlenW (lpString=".pdf") returned 4 [0197.714] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.714] lstrlenW (lpString=".xls") returned 4 [0197.714] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.714] lstrlenW (lpString=".xlsx") returned 5 [0197.714] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.714] lstrlenW (lpString=".ppt") returned 4 [0197.714] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.714] lstrlenW (lpString=".zip") returned 4 [0197.714] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.714] lstrlenW (lpString=".rar") returned 4 [0197.714] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.714] lstrlenW (lpString=".bz2") returned 4 [0197.714] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.714] lstrlenW (lpString=".7z") returned 3 [0197.714] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.714] lstrlenW (lpString=".dbf") returned 4 [0197.715] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.715] lstrlenW (lpString=".1cd") returned 4 [0197.715] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.715] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\en\\messages.json") returned 160 [0197.715] lstrlenW (lpString=".jpg") returned 4 [0197.715] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.715] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.715] lstrlenW (lpString="messages.json") returned 13 [0197.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.715] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=16459) returned 1 [0197.715] CloseHandle (hObject=0x154) returned 1 [0197.715] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json")) returned 0x2020 [0197.716] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.716] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.716] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.716] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.716] GetLastError () returned 0x0 [0197.716] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x404b, lpOverlapped=0x0) returned 1 [0197.885] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4050, lpOverlapped=0x0) returned 1 [0197.894] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.894] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.895] SetEndOfFile (hFile=0x15c) returned 1 [0197.895] CloseHandle (hObject=0x15c) returned 1 [0197.895] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.895] SetEndOfFile (hFile=0x154) returned 1 [0197.896] CloseHandle (hObject=0x154) returned 1 [0197.896] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.896] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json")) returned 1 [0197.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.896] lstrlenW (lpString=".doc") returned 4 [0197.896] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.896] lstrlenW (lpString=".docx") returned 5 [0197.896] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.896] lstrlenW (lpString=".pdf") returned 4 [0197.896] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.896] lstrlenW (lpString=".xls") returned 4 [0197.896] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.896] lstrlenW (lpString=".xlsx") returned 5 [0197.896] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.896] lstrlenW (lpString=".ppt") returned 4 [0197.896] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.896] lstrlenW (lpString=".zip") returned 4 [0197.896] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.896] lstrlenW (lpString=".rar") returned 4 [0197.896] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.896] lstrlenW (lpString=".bz2") returned 4 [0197.897] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.897] lstrlenW (lpString=".7z") returned 3 [0197.897] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.897] lstrlenW (lpString=".dbf") returned 4 [0197.897] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.897] lstrlenW (lpString=".1cd") returned 4 [0197.897] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.897] lstrlenW (lpString=".jpg") returned 4 [0197.897] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.897] lstrlenW (lpString=".doc") returned 4 [0197.897] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.897] lstrlenW (lpString=".docx") returned 5 [0197.897] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.897] lstrlenW (lpString=".pdf") returned 4 [0197.897] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.897] lstrlenW (lpString=".xls") returned 4 [0197.897] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.897] lstrlenW (lpString=".xlsx") returned 5 [0197.897] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.897] lstrlenW (lpString=".ppt") returned 4 [0197.897] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.897] lstrlenW (lpString=".zip") returned 4 [0197.897] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.897] lstrlenW (lpString=".rar") returned 4 [0197.897] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.897] lstrlenW (lpString=".bz2") returned 4 [0197.897] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.897] lstrlenW (lpString=".7z") returned 3 [0197.898] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.898] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.898] lstrlenW (lpString=".dbf") returned 4 [0197.898] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.898] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.898] lstrlenW (lpString=".1cd") returned 4 [0197.898] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.898] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\es\\messages.json") returned 160 [0197.898] lstrlenW (lpString=".jpg") returned 4 [0197.898] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.898] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.898] lstrlenW (lpString="messages.json") returned 13 [0197.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.899] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=16442) returned 1 [0197.899] CloseHandle (hObject=0x154) returned 1 [0197.899] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json")) returned 0x2020 [0197.899] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.899] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.899] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.900] GetLastError () returned 0x0 [0197.900] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x403a, lpOverlapped=0x0) returned 1 [0197.902] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4040, lpOverlapped=0x0) returned 1 [0197.903] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.903] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.903] SetEndOfFile (hFile=0x15c) returned 1 [0197.903] CloseHandle (hObject=0x15c) returned 1 [0197.903] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.903] SetEndOfFile (hFile=0x154) returned 1 [0197.904] CloseHandle (hObject=0x154) returned 1 [0197.904] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.904] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json")) returned 1 [0197.904] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.904] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.904] lstrlenW (lpString=".doc") returned 4 [0197.904] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.904] lstrlenW (lpString=".docx") returned 5 [0197.904] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.904] lstrlenW (lpString=".pdf") returned 4 [0197.905] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.905] lstrlenW (lpString=".xls") returned 4 [0197.905] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.905] lstrlenW (lpString=".xlsx") returned 5 [0197.905] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.905] lstrlenW (lpString=".ppt") returned 4 [0197.905] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.905] lstrlenW (lpString=".zip") returned 4 [0197.905] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.905] lstrlenW (lpString=".rar") returned 4 [0197.905] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.905] lstrlenW (lpString=".bz2") returned 4 [0197.905] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.905] lstrlenW (lpString=".7z") returned 3 [0197.905] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.905] lstrlenW (lpString=".dbf") returned 4 [0197.905] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.905] lstrlenW (lpString=".1cd") returned 4 [0197.905] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.905] lstrlenW (lpString=".jpg") returned 4 [0197.905] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.905] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.905] lstrlenW (lpString=".doc") returned 4 [0197.905] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.905] lstrlenW (lpString=".docx") returned 5 [0197.905] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.905] lstrlenW (lpString=".pdf") returned 4 [0197.905] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.905] lstrlenW (lpString=".xls") returned 4 [0197.906] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.906] lstrlenW (lpString=".xlsx") returned 5 [0197.906] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.906] lstrlenW (lpString=".ppt") returned 4 [0197.906] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.906] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.906] lstrlenW (lpString=".zip") returned 4 [0197.906] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.906] lstrlenW (lpString=".rar") returned 4 [0197.906] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.906] lstrlenW (lpString=".bz2") returned 4 [0197.906] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.906] lstrlenW (lpString=".7z") returned 3 [0197.906] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.906] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.906] lstrlenW (lpString=".dbf") returned 4 [0197.906] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.906] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.906] lstrlenW (lpString=".1cd") returned 4 [0197.906] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.906] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ko\\messages.json") returned 160 [0197.906] lstrlenW (lpString=".jpg") returned 4 [0197.906] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.906] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.906] lstrlenW (lpString="messages.json") returned 13 [0197.906] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.907] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=16747) returned 1 [0197.907] CloseHandle (hObject=0x154) returned 1 [0197.907] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json")) returned 0x2020 [0197.907] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.907] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.907] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.907] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.908] GetLastError () returned 0x0 [0197.908] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x416b, lpOverlapped=0x0) returned 1 [0197.910] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4170, lpOverlapped=0x0) returned 1 [0197.911] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.911] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.911] SetEndOfFile (hFile=0x15c) returned 1 [0197.911] CloseHandle (hObject=0x15c) returned 1 [0197.913] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.913] SetEndOfFile (hFile=0x154) returned 1 [0197.914] CloseHandle (hObject=0x154) returned 1 [0197.914] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.914] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json")) returned 1 [0197.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.914] lstrlenW (lpString=".doc") returned 4 [0197.914] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.914] lstrlenW (lpString=".docx") returned 5 [0197.914] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.914] lstrlenW (lpString=".pdf") returned 4 [0197.914] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.914] lstrlenW (lpString=".xls") returned 4 [0197.914] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.914] lstrlenW (lpString=".xlsx") returned 5 [0197.914] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.915] lstrlenW (lpString=".ppt") returned 4 [0197.915] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.915] lstrlenW (lpString=".zip") returned 4 [0197.915] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.915] lstrlenW (lpString=".rar") returned 4 [0197.915] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.915] lstrlenW (lpString=".bz2") returned 4 [0197.915] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.915] lstrlenW (lpString=".7z") returned 3 [0197.915] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.915] lstrlenW (lpString=".dbf") returned 4 [0197.915] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.915] lstrlenW (lpString=".1cd") returned 4 [0197.915] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.915] lstrlenW (lpString=".jpg") returned 4 [0197.915] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.915] lstrlenW (lpString=".doc") returned 4 [0197.915] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.915] lstrlenW (lpString=".docx") returned 5 [0197.915] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.915] lstrlenW (lpString=".pdf") returned 4 [0197.915] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.915] lstrlenW (lpString=".xls") returned 4 [0197.915] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.915] lstrlenW (lpString=".xlsx") returned 5 [0197.915] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.915] lstrlenW (lpString=".ppt") returned 4 [0197.915] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.916] lstrlenW (lpString=".zip") returned 4 [0197.916] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.916] lstrlenW (lpString=".rar") returned 4 [0197.916] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.916] lstrlenW (lpString=".bz2") returned 4 [0197.916] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.916] lstrlenW (lpString=".7z") returned 3 [0197.916] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.916] lstrlenW (lpString=".dbf") returned 4 [0197.916] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.916] lstrlenW (lpString=".1cd") returned 4 [0197.916] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lt\\messages.json") returned 160 [0197.916] lstrlenW (lpString=".jpg") returned 4 [0197.916] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.916] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.916] lstrlenW (lpString="messages.json") returned 13 [0197.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.917] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=16831) returned 1 [0197.917] CloseHandle (hObject=0x154) returned 1 [0197.917] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json")) returned 0x2020 [0197.917] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.917] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.917] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.918] GetLastError () returned 0x0 [0197.918] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x41bf, lpOverlapped=0x0) returned 1 [0197.920] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x41c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x41c0, lpOverlapped=0x0) returned 1 [0197.921] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0197.921] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.921] SetEndOfFile (hFile=0x15c) returned 1 [0197.921] CloseHandle (hObject=0x15c) returned 1 [0197.921] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.921] SetEndOfFile (hFile=0x154) returned 1 [0197.922] CloseHandle (hObject=0x154) returned 1 [0197.922] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.922] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json")) returned 1 [0197.922] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.922] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.922] lstrlenW (lpString=".doc") returned 4 [0197.922] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.922] lstrlenW (lpString=".docx") returned 5 [0197.922] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.923] lstrlenW (lpString=".pdf") returned 4 [0197.923] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.923] lstrlenW (lpString=".xls") returned 4 [0197.923] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.923] lstrlenW (lpString=".xlsx") returned 5 [0197.923] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.923] lstrlenW (lpString=".ppt") returned 4 [0197.923] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.923] lstrlenW (lpString=".zip") returned 4 [0197.923] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.923] lstrlenW (lpString=".rar") returned 4 [0197.923] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.923] lstrlenW (lpString=".bz2") returned 4 [0197.923] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.923] lstrlenW (lpString=".7z") returned 3 [0197.923] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.923] lstrlenW (lpString=".dbf") returned 4 [0197.923] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.923] lstrlenW (lpString=".1cd") returned 4 [0197.923] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.923] lstrlenW (lpString=".jpg") returned 4 [0197.923] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.923] lstrlenW (lpString=".doc") returned 4 [0197.923] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.923] lstrlenW (lpString=".docx") returned 5 [0197.923] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.923] lstrlenW (lpString=".pdf") returned 4 [0197.923] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.924] lstrlenW (lpString=".xls") returned 4 [0197.924] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.924] lstrlenW (lpString=".xlsx") returned 5 [0197.924] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.924] lstrlenW (lpString=".ppt") returned 4 [0197.924] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.924] lstrlenW (lpString=".zip") returned 4 [0197.924] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.924] lstrlenW (lpString=".rar") returned 4 [0197.924] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.924] lstrlenW (lpString=".bz2") returned 4 [0197.924] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.924] lstrlenW (lpString=".7z") returned 3 [0197.924] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.924] lstrlenW (lpString=".dbf") returned 4 [0197.924] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.924] lstrlenW (lpString=".1cd") returned 4 [0197.924] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\lv\\messages.json") returned 160 [0197.924] lstrlenW (lpString=".jpg") returned 4 [0197.924] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.924] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.924] lstrlenW (lpString="messages.json") returned 13 [0197.924] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.926] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=22591) returned 1 [0197.926] CloseHandle (hObject=0x154) returned 1 [0197.926] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json")) returned 0x2020 [0197.926] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.926] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.926] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0197.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.927] GetLastError () returned 0x0 [0197.927] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x583f, lpOverlapped=0x0) returned 1 [0198.148] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x5840, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5840, lpOverlapped=0x0) returned 1 [0198.149] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.149] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.149] SetEndOfFile (hFile=0x15c) returned 1 [0198.150] CloseHandle (hObject=0x15c) returned 1 [0198.150] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.150] SetEndOfFile (hFile=0x154) returned 1 [0198.150] CloseHandle (hObject=0x154) returned 1 [0198.151] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.151] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json")) returned 1 [0198.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.151] lstrlenW (lpString=".doc") returned 4 [0198.151] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.151] lstrlenW (lpString=".docx") returned 5 [0198.151] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.151] lstrlenW (lpString=".pdf") returned 4 [0198.151] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.151] lstrlenW (lpString=".xls") returned 4 [0198.151] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.151] lstrlenW (lpString=".xlsx") returned 5 [0198.151] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.151] lstrlenW (lpString=".ppt") returned 4 [0198.151] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.151] lstrlenW (lpString=".zip") returned 4 [0198.151] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.151] lstrlenW (lpString=".rar") returned 4 [0198.151] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.151] lstrlenW (lpString=".bz2") returned 4 [0198.152] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.152] lstrlenW (lpString=".7z") returned 3 [0198.152] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.152] lstrlenW (lpString=".dbf") returned 4 [0198.152] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.152] lstrlenW (lpString=".1cd") returned 4 [0198.152] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.152] lstrlenW (lpString=".jpg") returned 4 [0198.152] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.152] lstrlenW (lpString=".doc") returned 4 [0198.152] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.152] lstrlenW (lpString=".docx") returned 5 [0198.152] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.152] lstrlenW (lpString=".pdf") returned 4 [0198.152] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.152] lstrlenW (lpString=".xls") returned 4 [0198.152] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.152] lstrlenW (lpString=".xlsx") returned 5 [0198.152] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.152] lstrlenW (lpString=".ppt") returned 4 [0198.152] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.152] lstrlenW (lpString=".zip") returned 4 [0198.152] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.152] lstrlenW (lpString=".rar") returned 4 [0198.152] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.152] lstrlenW (lpString=".bz2") returned 4 [0198.152] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.152] lstrlenW (lpString=".7z") returned 3 [0198.153] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.153] lstrlenW (lpString=".dbf") returned 4 [0198.153] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.153] lstrlenW (lpString=".1cd") returned 4 [0198.153] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ml\\messages.json") returned 160 [0198.153] lstrlenW (lpString=".jpg") returned 4 [0198.153] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.153] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.153] lstrlenW (lpString="messages.json") returned 13 [0198.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.154] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=16011) returned 1 [0198.154] CloseHandle (hObject=0x154) returned 1 [0198.154] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json")) returned 0x2020 [0198.154] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.154] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.154] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0198.155] GetLastError () returned 0x0 [0198.155] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x3e8b, lpOverlapped=0x0) returned 1 [0198.157] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x3e90, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3e90, lpOverlapped=0x0) returned 1 [0198.158] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.158] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.158] SetEndOfFile (hFile=0x15c) returned 1 [0198.158] CloseHandle (hObject=0x15c) returned 1 [0198.158] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.158] SetEndOfFile (hFile=0x154) returned 1 [0198.159] CloseHandle (hObject=0x154) returned 1 [0198.159] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.159] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json")) returned 1 [0198.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.159] lstrlenW (lpString=".doc") returned 4 [0198.159] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.159] lstrlenW (lpString=".docx") returned 5 [0198.159] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.159] lstrlenW (lpString=".pdf") returned 4 [0198.159] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.159] lstrlenW (lpString=".xls") returned 4 [0198.159] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.160] lstrlenW (lpString=".xlsx") returned 5 [0198.160] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.160] lstrlenW (lpString=".ppt") returned 4 [0198.160] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.160] lstrlenW (lpString=".zip") returned 4 [0198.160] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.160] lstrlenW (lpString=".rar") returned 4 [0198.160] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.160] lstrlenW (lpString=".bz2") returned 4 [0198.160] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.160] lstrlenW (lpString=".7z") returned 3 [0198.160] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.160] lstrlenW (lpString=".dbf") returned 4 [0198.160] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.160] lstrlenW (lpString=".1cd") returned 4 [0198.160] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.160] lstrlenW (lpString=".jpg") returned 4 [0198.160] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.160] lstrlenW (lpString=".doc") returned 4 [0198.160] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.160] lstrlenW (lpString=".docx") returned 5 [0198.160] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.160] lstrlenW (lpString=".pdf") returned 4 [0198.160] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.160] lstrlenW (lpString=".xls") returned 4 [0198.160] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.160] lstrlenW (lpString=".xlsx") returned 5 [0198.160] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.161] lstrlenW (lpString=".ppt") returned 4 [0198.161] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.161] lstrlenW (lpString=".zip") returned 4 [0198.161] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.161] lstrlenW (lpString=".rar") returned 4 [0198.161] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.161] lstrlenW (lpString=".bz2") returned 4 [0198.161] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.161] lstrlenW (lpString=".7z") returned 3 [0198.161] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.161] lstrlenW (lpString=".dbf") returned 4 [0198.161] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.161] lstrlenW (lpString=".1cd") returned 4 [0198.161] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sw\\messages.json") returned 160 [0198.161] lstrlenW (lpString=".jpg") returned 4 [0198.161] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.161] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.161] lstrlenW (lpString="messages.json") returned 13 [0198.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.162] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=22077) returned 1 [0198.162] CloseHandle (hObject=0x154) returned 1 [0198.162] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json")) returned 0x2020 [0198.162] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.162] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.162] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0198.163] GetLastError () returned 0x0 [0198.163] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x563d, lpOverlapped=0x0) returned 1 [0198.165] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x5640, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x5640, lpOverlapped=0x0) returned 1 [0198.166] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.166] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.166] SetEndOfFile (hFile=0x15c) returned 1 [0198.166] CloseHandle (hObject=0x15c) returned 1 [0198.166] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.166] SetEndOfFile (hFile=0x154) returned 1 [0198.167] CloseHandle (hObject=0x154) returned 1 [0198.167] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.168] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json")) returned 1 [0198.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.168] lstrlenW (lpString=".doc") returned 4 [0198.168] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.168] lstrlenW (lpString=".docx") returned 5 [0198.168] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.168] lstrlenW (lpString=".pdf") returned 4 [0198.168] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.168] lstrlenW (lpString=".xls") returned 4 [0198.168] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.168] lstrlenW (lpString=".xlsx") returned 5 [0198.168] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.168] lstrlenW (lpString=".ppt") returned 4 [0198.168] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.168] lstrlenW (lpString=".zip") returned 4 [0198.168] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.168] lstrlenW (lpString=".rar") returned 4 [0198.168] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.168] lstrlenW (lpString=".bz2") returned 4 [0198.168] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.168] lstrlenW (lpString=".7z") returned 3 [0198.168] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.169] lstrlenW (lpString=".dbf") returned 4 [0198.169] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.169] lstrlenW (lpString=".1cd") returned 4 [0198.169] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.169] lstrlenW (lpString=".jpg") returned 4 [0198.169] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.169] lstrlenW (lpString=".doc") returned 4 [0198.169] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.169] lstrlenW (lpString=".docx") returned 5 [0198.169] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.169] lstrlenW (lpString=".pdf") returned 4 [0198.169] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.169] lstrlenW (lpString=".xls") returned 4 [0198.169] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.169] lstrlenW (lpString=".xlsx") returned 5 [0198.169] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.169] lstrlenW (lpString=".ppt") returned 4 [0198.169] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.169] lstrlenW (lpString=".zip") returned 4 [0198.169] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.169] lstrlenW (lpString=".rar") returned 4 [0198.169] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.169] lstrlenW (lpString=".bz2") returned 4 [0198.169] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.169] lstrlenW (lpString=".7z") returned 3 [0198.169] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.169] lstrlenW (lpString=".dbf") returned 4 [0198.169] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.170] lstrlenW (lpString=".1cd") returned 4 [0198.170] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ta\\messages.json") returned 160 [0198.170] lstrlenW (lpString=".jpg") returned 4 [0198.170] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.170] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.170] lstrlenW (lpString="messages.json") returned 13 [0198.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.170] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=21907) returned 1 [0198.170] CloseHandle (hObject=0x154) returned 1 [0198.170] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json")) returned 0x2020 [0198.171] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.171] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.171] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0198.171] GetLastError () returned 0x0 [0198.171] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x5593, lpOverlapped=0x0) returned 1 [0198.173] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x55a0, lpOverlapped=0x0) returned 1 [0198.175] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.175] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.175] SetEndOfFile (hFile=0x15c) returned 1 [0198.175] CloseHandle (hObject=0x15c) returned 1 [0198.175] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.175] SetEndOfFile (hFile=0x154) returned 1 [0198.176] CloseHandle (hObject=0x154) returned 1 [0198.176] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.176] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json")) returned 1 [0198.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.176] lstrlenW (lpString=".doc") returned 4 [0198.176] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.177] lstrlenW (lpString=".docx") returned 5 [0198.177] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.177] lstrlenW (lpString=".pdf") returned 4 [0198.177] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.177] lstrlenW (lpString=".xls") returned 4 [0198.177] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.177] lstrlenW (lpString=".xlsx") returned 5 [0198.177] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.177] lstrlenW (lpString=".ppt") returned 4 [0198.177] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.177] lstrlenW (lpString=".zip") returned 4 [0198.177] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.177] lstrlenW (lpString=".rar") returned 4 [0198.177] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.177] lstrlenW (lpString=".bz2") returned 4 [0198.177] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.177] lstrlenW (lpString=".7z") returned 3 [0198.177] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.177] lstrlenW (lpString=".dbf") returned 4 [0198.177] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.177] lstrlenW (lpString=".1cd") returned 4 [0198.177] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.177] lstrlenW (lpString=".jpg") returned 4 [0198.177] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.177] lstrlenW (lpString=".doc") returned 4 [0198.177] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.177] lstrlenW (lpString=".docx") returned 5 [0198.178] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.178] lstrlenW (lpString=".pdf") returned 4 [0198.178] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.178] lstrlenW (lpString=".xls") returned 4 [0198.178] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.178] lstrlenW (lpString=".xlsx") returned 5 [0198.178] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.178] lstrlenW (lpString=".ppt") returned 4 [0198.178] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.178] lstrlenW (lpString=".zip") returned 4 [0198.178] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.178] lstrlenW (lpString=".rar") returned 4 [0198.178] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.178] lstrlenW (lpString=".bz2") returned 4 [0198.178] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.178] lstrlenW (lpString=".7z") returned 3 [0198.178] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.178] lstrlenW (lpString=".dbf") returned 4 [0198.178] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.178] lstrlenW (lpString=".1cd") returned 4 [0198.178] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\te\\messages.json") returned 160 [0198.178] lstrlenW (lpString=".jpg") returned 4 [0198.178] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.178] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.179] lstrlenW (lpString="messages.json") returned 13 [0198.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.179] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=20324) returned 1 [0198.179] CloseHandle (hObject=0x154) returned 1 [0198.180] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json")) returned 0x2020 [0198.180] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.180] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.180] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0198.181] GetLastError () returned 0x0 [0198.181] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x4f64, lpOverlapped=0x0) returned 1 [0198.458] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x4f70, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x4f70, lpOverlapped=0x0) returned 1 [0198.459] ReadFile (in: hFile=0x154, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.459] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.459] SetEndOfFile (hFile=0x15c) returned 1 [0198.459] CloseHandle (hObject=0x15c) returned 1 [0198.459] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.460] SetEndOfFile (hFile=0x154) returned 1 [0198.460] CloseHandle (hObject=0x154) returned 1 [0198.460] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.461] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json")) returned 1 [0198.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.461] lstrlenW (lpString=".doc") returned 4 [0198.461] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.461] lstrlenW (lpString=".docx") returned 5 [0198.461] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.461] lstrlenW (lpString=".pdf") returned 4 [0198.461] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.461] lstrlenW (lpString=".xls") returned 4 [0198.461] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.461] lstrlenW (lpString=".xlsx") returned 5 [0198.461] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.461] lstrlenW (lpString=".ppt") returned 4 [0198.461] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.461] lstrlenW (lpString=".zip") returned 4 [0198.461] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.461] lstrlenW (lpString=".rar") returned 4 [0198.461] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.461] lstrlenW (lpString=".bz2") returned 4 [0198.461] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.461] lstrlenW (lpString=".7z") returned 3 [0198.461] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.462] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.462] lstrlenW (lpString=".dbf") returned 4 [0198.462] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.462] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.462] lstrlenW (lpString=".1cd") returned 4 [0198.462] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.462] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.462] lstrlenW (lpString=".jpg") returned 4 [0198.462] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.462] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.462] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.462] lstrlenW (lpString=".doc") returned 4 [0198.462] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.462] lstrlenW (lpString=".docx") returned 5 [0198.462] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.462] lstrlenW (lpString=".pdf") returned 4 [0198.462] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.462] lstrlenW (lpString=".xls") returned 4 [0198.462] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.462] lstrlenW (lpString=".xlsx") returned 5 [0198.462] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.462] lstrlenW (lpString=".ppt") returned 4 [0198.462] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.462] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.462] lstrlenW (lpString=".zip") returned 4 [0198.462] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.462] lstrlenW (lpString=".rar") returned 4 [0198.462] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.462] lstrlenW (lpString=".bz2") returned 4 [0198.462] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.462] lstrlenW (lpString=".7z") returned 3 [0198.462] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.462] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.463] lstrlenW (lpString=".dbf") returned 4 [0198.463] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.463] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.463] lstrlenW (lpString=".1cd") returned 4 [0198.463] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.463] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\th\\messages.json") returned 160 [0198.463] lstrlenW (lpString=".jpg") returned 4 [0198.463] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.463] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0198.463] lstrlenW (lpString="desktop.ini") returned 11 [0198.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0198.590] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=67) returned 1 [0198.607] CloseHandle (hObject=0x2d4) returned 1 [0198.607] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 0x2026 [0198.607] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.607] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0198.608] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.608] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.608] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.609] GetLastError () returned 0x0 [0198.609] ReadFile (in: hFile=0x2d4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x43, lpOverlapped=0x0) returned 1 [0198.609] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x50, lpOverlapped=0x0) returned 1 [0198.610] ReadFile (in: hFile=0x2d4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.610] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0198.610] SetEndOfFile (hFile=0x150) returned 1 [0198.611] CloseHandle (hObject=0x150) returned 1 [0198.611] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.611] SetEndOfFile (hFile=0x2d4) returned 1 [0198.611] CloseHandle (hObject=0x2d4) returned 1 [0198.611] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0198.612] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\desktop.ini")) returned 1 [0198.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.612] lstrlenW (lpString=".doc") returned 4 [0198.612] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.612] lstrlenW (lpString=".docx") returned 5 [0198.612] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.612] lstrlenW (lpString=".pdf") returned 4 [0198.612] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.612] lstrlenW (lpString=".xls") returned 4 [0198.612] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.612] lstrlenW (lpString=".xlsx") returned 5 [0198.612] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.612] lstrlenW (lpString=".ppt") returned 4 [0198.612] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.612] lstrlenW (lpString=".zip") returned 4 [0198.612] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.612] lstrlenW (lpString=".rar") returned 4 [0198.612] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.612] lstrlenW (lpString=".bz2") returned 4 [0198.612] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.612] lstrlenW (lpString=".7z") returned 3 [0198.612] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.613] lstrlenW (lpString=".dbf") returned 4 [0198.613] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.613] lstrlenW (lpString=".1cd") returned 4 [0198.613] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.613] lstrlenW (lpString=".jpg") returned 4 [0198.613] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.613] lstrlenW (lpString=".doc") returned 4 [0198.613] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.613] lstrlenW (lpString=".docx") returned 5 [0198.613] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.613] lstrlenW (lpString=".pdf") returned 4 [0198.613] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.613] lstrlenW (lpString=".xls") returned 4 [0198.613] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.613] lstrlenW (lpString=".xlsx") returned 5 [0198.613] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.613] lstrlenW (lpString=".ppt") returned 4 [0198.613] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.613] lstrlenW (lpString=".zip") returned 4 [0198.613] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.613] lstrlenW (lpString=".rar") returned 4 [0198.613] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.613] lstrlenW (lpString=".bz2") returned 4 [0198.613] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.613] lstrlenW (lpString=".7z") returned 3 [0198.613] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.613] lstrlenW (lpString=".dbf") returned 4 [0198.614] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.614] lstrlenW (lpString=".1cd") returned 4 [0198.614] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\desktop.ini") returned 86 [0198.614] lstrlenW (lpString=".jpg") returned 4 [0198.614] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.614] lstrcmpiW (lpString1=".txt", lpString2=".wiki") returned -1 [0198.614] lstrlenW (lpString="brndlog.txt") returned 11 [0198.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0198.614] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=12208) returned 1 [0198.614] CloseHandle (hObject=0x2d4) returned 1 [0198.614] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 0x2020 [0198.614] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0198.615] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.615] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.615] GetLastError () returned 0x0 [0198.615] ReadFile (in: hFile=0x2d4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2fb0, lpOverlapped=0x0) returned 1 [0198.638] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2fc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2fc0, lpOverlapped=0x0) returned 1 [0198.639] ReadFile (in: hFile=0x2d4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.639] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0198.639] SetEndOfFile (hFile=0x150) returned 1 [0198.639] CloseHandle (hObject=0x150) returned 1 [0198.639] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.639] SetEndOfFile (hFile=0x2d4) returned 1 [0198.640] CloseHandle (hObject=0x2d4) returned 1 [0198.640] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.640] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.txt")) returned 1 [0198.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.640] lstrlenW (lpString=".doc") returned 4 [0198.640] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0198.640] lstrlenW (lpString=".docx") returned 5 [0198.640] lstrcmpiW (lpString1=".docx", lpString2="g.txt") returned -1 [0198.640] lstrlenW (lpString=".pdf") returned 4 [0198.640] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0198.640] lstrlenW (lpString=".xls") returned 4 [0198.640] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0198.640] lstrlenW (lpString=".xlsx") returned 5 [0198.640] lstrcmpiW (lpString1=".xlsx", lpString2="g.txt") returned -1 [0198.641] lstrlenW (lpString=".ppt") returned 4 [0198.641] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0198.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.641] lstrlenW (lpString=".zip") returned 4 [0198.641] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0198.641] lstrlenW (lpString=".rar") returned 4 [0198.641] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0198.641] lstrlenW (lpString=".bz2") returned 4 [0198.641] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0198.641] lstrlenW (lpString=".7z") returned 3 [0198.641] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0198.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.641] lstrlenW (lpString=".dbf") returned 4 [0198.641] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0198.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.641] lstrlenW (lpString=".1cd") returned 4 [0198.641] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0198.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.641] lstrlenW (lpString=".jpg") returned 4 [0198.641] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0198.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.641] lstrlenW (lpString=".doc") returned 4 [0198.641] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0198.641] lstrlenW (lpString=".docx") returned 5 [0198.641] lstrcmpiW (lpString1=".docx", lpString2="g.txt") returned -1 [0198.641] lstrlenW (lpString=".pdf") returned 4 [0198.641] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0198.641] lstrlenW (lpString=".xls") returned 4 [0198.641] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0198.641] lstrlenW (lpString=".xlsx") returned 5 [0198.641] lstrcmpiW (lpString1=".xlsx", lpString2="g.txt") returned -1 [0198.641] lstrlenW (lpString=".ppt") returned 4 [0198.642] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0198.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.642] lstrlenW (lpString=".zip") returned 4 [0198.642] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0198.642] lstrlenW (lpString=".rar") returned 4 [0198.642] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0198.642] lstrlenW (lpString=".bz2") returned 4 [0198.642] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0198.642] lstrlenW (lpString=".7z") returned 3 [0198.642] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0198.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.642] lstrlenW (lpString=".dbf") returned 4 [0198.642] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0198.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.642] lstrlenW (lpString=".1cd") returned 4 [0198.642] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0198.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.txt") returned 83 [0198.642] lstrlenW (lpString=".jpg") returned 4 [0198.642] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0198.642] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0198.642] lstrlenW (lpString="frameiconcache.dat") returned 18 [0198.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.671] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=9204) returned 1 [0198.671] CloseHandle (hObject=0x150) returned 1 [0198.671] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat")) returned 0x2020 [0198.671] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.671] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.671] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.671] GetLastError () returned 0x0 [0198.671] ReadFile (in: hFile=0x150, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x23f4, lpOverlapped=0x0) returned 1 [0198.680] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2400, lpOverlapped=0x0) returned 1 [0198.680] ReadFile (in: hFile=0x150, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.681] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0198.681] SetEndOfFile (hFile=0x154) returned 1 [0198.681] CloseHandle (hObject=0x154) returned 1 [0198.681] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.681] SetEndOfFile (hFile=0x150) returned 1 [0198.682] CloseHandle (hObject=0x150) returned 1 [0198.682] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.682] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\frameiconcache.dat")) returned 1 [0198.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.682] lstrlenW (lpString=".doc") returned 4 [0198.682] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.682] lstrlenW (lpString=".docx") returned 5 [0198.682] lstrcmpiW (lpString1=".docx", lpString2="e.dat") returned -1 [0198.682] lstrlenW (lpString=".pdf") returned 4 [0198.682] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.682] lstrlenW (lpString=".xls") returned 4 [0198.682] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.682] lstrlenW (lpString=".xlsx") returned 5 [0198.682] lstrcmpiW (lpString1=".xlsx", lpString2="e.dat") returned -1 [0198.682] lstrlenW (lpString=".ppt") returned 4 [0198.683] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.683] lstrlenW (lpString=".zip") returned 4 [0198.683] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.683] lstrlenW (lpString=".rar") returned 4 [0198.683] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.683] lstrlenW (lpString=".bz2") returned 4 [0198.683] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.683] lstrlenW (lpString=".7z") returned 3 [0198.683] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.683] lstrlenW (lpString=".dbf") returned 4 [0198.683] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.683] lstrlenW (lpString=".1cd") returned 4 [0198.683] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.683] lstrlenW (lpString=".jpg") returned 4 [0198.683] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.683] lstrlenW (lpString=".doc") returned 4 [0198.683] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.683] lstrlenW (lpString=".docx") returned 5 [0198.683] lstrcmpiW (lpString1=".docx", lpString2="e.dat") returned -1 [0198.683] lstrlenW (lpString=".pdf") returned 4 [0198.683] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.683] lstrlenW (lpString=".xls") returned 4 [0198.683] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.683] lstrlenW (lpString=".xlsx") returned 5 [0198.683] lstrcmpiW (lpString1=".xlsx", lpString2="e.dat") returned -1 [0198.683] lstrlenW (lpString=".ppt") returned 4 [0198.683] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.684] lstrlenW (lpString=".zip") returned 4 [0198.684] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.684] lstrlenW (lpString=".rar") returned 4 [0198.684] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.684] lstrlenW (lpString=".bz2") returned 4 [0198.684] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.684] lstrlenW (lpString=".7z") returned 3 [0198.684] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.684] lstrlenW (lpString=".dbf") returned 4 [0198.684] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.684] lstrlenW (lpString=".1cd") returned 4 [0198.684] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\frameiconcache.dat") returned 90 [0198.684] lstrlenW (lpString=".jpg") returned 4 [0198.684] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.684] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0198.684] lstrlenW (lpString="{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 42 [0198.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.687] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4608) returned 1 [0198.693] CloseHandle (hObject=0x358) returned 1 [0198.695] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 0x2020 [0198.695] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.695] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.695] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.704] GetLastError () returned 0x0 [0198.704] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x1200, lpOverlapped=0x0) returned 1 [0198.708] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1210, lpOverlapped=0x0) returned 1 [0198.709] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.709] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x128, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x128, lpOverlapped=0x0) returned 1 [0198.709] SetEndOfFile (hFile=0x154) returned 1 [0198.709] CloseHandle (hObject=0x154) returned 1 [0198.710] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.710] SetEndOfFile (hFile=0x358) returned 1 [0198.710] CloseHandle (hObject=0x358) returned 1 [0198.710] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.711] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\{69512155-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1 [0198.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.711] lstrlenW (lpString=".doc") returned 4 [0198.711] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.711] lstrlenW (lpString=".docx") returned 5 [0198.711] lstrcmpiW (lpString1=".docx", lpString2="}.dat") returned -1 [0198.711] lstrlenW (lpString=".pdf") returned 4 [0198.711] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.711] lstrlenW (lpString=".xls") returned 4 [0198.711] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.711] lstrlenW (lpString=".xlsx") returned 5 [0198.711] lstrcmpiW (lpString1=".xlsx", lpString2="}.dat") returned -1 [0198.711] lstrlenW (lpString=".ppt") returned 4 [0198.711] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.711] lstrlenW (lpString=".zip") returned 4 [0198.711] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.711] lstrlenW (lpString=".rar") returned 4 [0198.711] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.711] lstrlenW (lpString=".bz2") returned 4 [0198.711] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.711] lstrlenW (lpString=".7z") returned 3 [0198.711] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.711] lstrlenW (lpString=".dbf") returned 4 [0198.711] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.712] lstrlenW (lpString=".1cd") returned 4 [0198.712] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.712] lstrlenW (lpString=".jpg") returned 4 [0198.712] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.712] lstrlenW (lpString=".doc") returned 4 [0198.712] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.712] lstrlenW (lpString=".docx") returned 5 [0198.712] lstrcmpiW (lpString1=".docx", lpString2="}.dat") returned -1 [0198.712] lstrlenW (lpString=".pdf") returned 4 [0198.712] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.712] lstrlenW (lpString=".xls") returned 4 [0198.712] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.712] lstrlenW (lpString=".xlsx") returned 5 [0198.712] lstrcmpiW (lpString1=".xlsx", lpString2="}.dat") returned -1 [0198.712] lstrlenW (lpString=".ppt") returned 4 [0198.712] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.712] lstrlenW (lpString=".zip") returned 4 [0198.712] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.712] lstrlenW (lpString=".rar") returned 4 [0198.712] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.712] lstrlenW (lpString=".bz2") returned 4 [0198.712] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.712] lstrlenW (lpString=".7z") returned 3 [0198.712] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.712] lstrlenW (lpString=".dbf") returned 4 [0198.712] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.712] lstrlenW (lpString=".1cd") returned 4 [0198.713] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\{69512155-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 135 [0198.713] lstrlenW (lpString=".jpg") returned 4 [0198.713] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.713] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0198.713] lstrlenW (lpString="content14.dat") returned 13 [0198.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.713] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=101600) returned 1 [0198.713] CloseHandle (hObject=0x358) returned 1 [0198.713] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat")) returned 0x2020 [0198.713] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.714] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.714] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0198.714] GetLastError () returned 0x0 [0198.714] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x18ce0, lpOverlapped=0x0) returned 1 [0198.898] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x18cf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x18cf0, lpOverlapped=0x0) returned 1 [0198.901] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0198.901] WriteFile (in: hFile=0x154, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.901] SetEndOfFile (hFile=0x154) returned 1 [0199.044] CloseHandle (hObject=0x154) returned 1 [0199.045] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.045] SetEndOfFile (hFile=0x358) returned 1 [0199.059] CloseHandle (hObject=0x358) returned 1 [0199.059] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.060] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\content14.dat")) returned 1 [0199.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.060] lstrlenW (lpString=".doc") returned 4 [0199.060] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.060] lstrlenW (lpString=".docx") returned 5 [0199.060] lstrcmpiW (lpString1=".docx", lpString2="4.dat") returned -1 [0199.060] lstrlenW (lpString=".pdf") returned 4 [0199.060] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.060] lstrlenW (lpString=".xls") returned 4 [0199.060] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.060] lstrlenW (lpString=".xlsx") returned 5 [0199.060] lstrcmpiW (lpString1=".xlsx", lpString2="4.dat") returned -1 [0199.060] lstrlenW (lpString=".ppt") returned 4 [0199.060] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.060] lstrlenW (lpString=".zip") returned 4 [0199.060] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.060] lstrlenW (lpString=".rar") returned 4 [0199.060] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.060] lstrlenW (lpString=".bz2") returned 4 [0199.060] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.060] lstrlenW (lpString=".7z") returned 3 [0199.060] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.060] lstrlenW (lpString=".dbf") returned 4 [0199.060] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.060] lstrlenW (lpString=".1cd") returned 4 [0199.061] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.061] lstrlenW (lpString=".jpg") returned 4 [0199.061] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.061] lstrlenW (lpString=".doc") returned 4 [0199.061] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.061] lstrlenW (lpString=".docx") returned 5 [0199.061] lstrcmpiW (lpString1=".docx", lpString2="4.dat") returned -1 [0199.061] lstrlenW (lpString=".pdf") returned 4 [0199.061] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.061] lstrlenW (lpString=".xls") returned 4 [0199.061] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.061] lstrlenW (lpString=".xlsx") returned 5 [0199.061] lstrcmpiW (lpString1=".xlsx", lpString2="4.dat") returned -1 [0199.061] lstrlenW (lpString=".ppt") returned 4 [0199.061] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.061] lstrlenW (lpString=".zip") returned 4 [0199.061] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.061] lstrlenW (lpString=".rar") returned 4 [0199.061] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.061] lstrlenW (lpString=".bz2") returned 4 [0199.061] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.061] lstrlenW (lpString=".7z") returned 3 [0199.061] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.061] lstrlenW (lpString=".dbf") returned 4 [0199.061] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.061] lstrlenW (lpString=".1cd") returned 4 [0199.061] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.062] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\content14.dat") returned 73 [0199.062] lstrlenW (lpString=".jpg") returned 4 [0199.062] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.062] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0199.062] lstrlenW (lpString="index.dat") returned 9 [0199.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.311] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=65536) returned 1 [0199.311] CloseHandle (hObject=0x114) returned 1 [0199.311] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 0x2026 [0199.313] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.314] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.314] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.314] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0199.339] GetLastError () returned 0x0 [0199.339] ReadFile (in: hFile=0x150, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x10000, lpOverlapped=0x0) returned 1 [0199.397] WriteFile (in: hFile=0x388, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x10010, lpOverlapped=0x0) returned 1 [0199.399] ReadFile (in: hFile=0x150, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.399] WriteFile (in: hFile=0x388, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.399] SetEndOfFile (hFile=0x388) returned 1 [0199.399] CloseHandle (hObject=0x388) returned 1 [0199.399] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.399] SetEndOfFile (hFile=0x150) returned 1 [0199.400] CloseHandle (hObject=0x150) returned 1 [0199.400] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.400] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\index.dat")) returned 1 [0199.400] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.401] lstrlenW (lpString=".doc") returned 4 [0199.401] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.401] lstrlenW (lpString=".docx") returned 5 [0199.401] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0199.401] lstrlenW (lpString=".pdf") returned 4 [0199.401] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.401] lstrlenW (lpString=".xls") returned 4 [0199.401] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.401] lstrlenW (lpString=".xlsx") returned 5 [0199.401] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0199.401] lstrlenW (lpString=".ppt") returned 4 [0199.401] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.401] lstrlenW (lpString=".zip") returned 4 [0199.401] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.401] lstrlenW (lpString=".rar") returned 4 [0199.401] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.401] lstrlenW (lpString=".bz2") returned 4 [0199.401] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.401] lstrlenW (lpString=".7z") returned 3 [0199.401] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.401] lstrlenW (lpString=".dbf") returned 4 [0199.401] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.401] lstrlenW (lpString=".1cd") returned 4 [0199.401] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.401] lstrlenW (lpString=".jpg") returned 4 [0199.401] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.402] lstrlenW (lpString=".doc") returned 4 [0199.402] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.402] lstrlenW (lpString=".docx") returned 5 [0199.402] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0199.402] lstrlenW (lpString=".pdf") returned 4 [0199.402] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.402] lstrlenW (lpString=".xls") returned 4 [0199.402] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.402] lstrlenW (lpString=".xlsx") returned 5 [0199.402] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0199.402] lstrlenW (lpString=".ppt") returned 4 [0199.402] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.402] lstrlenW (lpString=".zip") returned 4 [0199.402] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.402] lstrlenW (lpString=".rar") returned 4 [0199.402] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.402] lstrlenW (lpString=".bz2") returned 4 [0199.402] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.402] lstrlenW (lpString=".7z") returned 3 [0199.402] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.402] lstrlenW (lpString=".dbf") returned 4 [0199.402] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.402] lstrlenW (lpString=".1cd") returned 4 [0199.402] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\index.dat") returned 91 [0199.402] lstrlenW (lpString=".jpg") returned 4 [0199.402] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.402] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.403] lstrlenW (lpString="AA3vOVA[1].png") returned 14 [0199.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.516] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=654) returned 1 [0199.516] CloseHandle (hObject=0x34c) returned 1 [0199.516] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png")) returned 0x2020 [0199.516] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.516] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.516] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.516] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0199.516] GetLastError () returned 0x0 [0199.516] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x28e, lpOverlapped=0x0) returned 1 [0199.549] WriteFile (in: hFile=0x344, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x290, lpOverlapped=0x0) returned 1 [0199.550] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.550] WriteFile (in: hFile=0x344, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.550] SetEndOfFile (hFile=0x344) returned 1 [0199.567] CloseHandle (hObject=0x344) returned 1 [0199.567] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.567] SetEndOfFile (hFile=0x34c) returned 1 [0199.568] CloseHandle (hObject=0x34c) returned 1 [0199.568] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.568] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa3vova[1].png")) returned 1 [0199.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.569] lstrlenW (lpString=".doc") returned 4 [0199.569] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.569] lstrlenW (lpString=".docx") returned 5 [0199.569] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.569] lstrlenW (lpString=".pdf") returned 4 [0199.569] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.569] lstrlenW (lpString=".xls") returned 4 [0199.569] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.569] lstrlenW (lpString=".xlsx") returned 5 [0199.569] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.569] lstrlenW (lpString=".ppt") returned 4 [0199.569] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.569] lstrlenW (lpString=".zip") returned 4 [0199.569] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.569] lstrlenW (lpString=".rar") returned 4 [0199.569] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.569] lstrlenW (lpString=".bz2") returned 4 [0199.569] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.569] lstrlenW (lpString=".7z") returned 3 [0199.569] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.569] lstrlenW (lpString=".dbf") returned 4 [0199.569] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.569] lstrlenW (lpString=".1cd") returned 4 [0199.569] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.570] lstrlenW (lpString=".jpg") returned 4 [0199.570] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.570] lstrlenW (lpString=".doc") returned 4 [0199.570] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.570] lstrlenW (lpString=".docx") returned 5 [0199.570] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.570] lstrlenW (lpString=".pdf") returned 4 [0199.570] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.570] lstrlenW (lpString=".xls") returned 4 [0199.570] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.570] lstrlenW (lpString=".xlsx") returned 5 [0199.570] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.570] lstrlenW (lpString=".ppt") returned 4 [0199.570] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.570] lstrlenW (lpString=".zip") returned 4 [0199.570] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.570] lstrlenW (lpString=".rar") returned 4 [0199.570] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.570] lstrlenW (lpString=".bz2") returned 4 [0199.570] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.570] lstrlenW (lpString=".7z") returned 3 [0199.570] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.570] lstrlenW (lpString=".dbf") returned 4 [0199.570] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.570] lstrlenW (lpString=".1cd") returned 4 [0199.570] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA3vOVA[1].png") returned 126 [0199.571] lstrlenW (lpString=".jpg") returned 4 [0199.571] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.571] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.571] lstrlenW (lpString="AAdAVrM[1].png") returned 14 [0199.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.580] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=834) returned 1 [0199.580] CloseHandle (hObject=0x34c) returned 1 [0199.580] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png")) returned 0x2020 [0199.580] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.580] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.580] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0199.581] GetLastError () returned 0x0 [0199.581] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x342, lpOverlapped=0x0) returned 1 [0199.591] WriteFile (in: hFile=0x344, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x350, lpOverlapped=0x0) returned 1 [0199.592] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.592] WriteFile (in: hFile=0x344, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.592] SetEndOfFile (hFile=0x344) returned 1 [0199.592] CloseHandle (hObject=0x344) returned 1 [0199.592] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.592] SetEndOfFile (hFile=0x34c) returned 1 [0199.593] CloseHandle (hObject=0x34c) returned 1 [0199.593] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.593] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aadavrm[1].png")) returned 1 [0199.593] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.594] lstrlenW (lpString=".doc") returned 4 [0199.594] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.594] lstrlenW (lpString=".docx") returned 5 [0199.594] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.594] lstrlenW (lpString=".pdf") returned 4 [0199.594] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.594] lstrlenW (lpString=".xls") returned 4 [0199.594] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.594] lstrlenW (lpString=".xlsx") returned 5 [0199.594] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.594] lstrlenW (lpString=".ppt") returned 4 [0199.594] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.594] lstrlenW (lpString=".zip") returned 4 [0199.594] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.594] lstrlenW (lpString=".rar") returned 4 [0199.594] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.594] lstrlenW (lpString=".bz2") returned 4 [0199.594] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.594] lstrlenW (lpString=".7z") returned 3 [0199.594] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.594] lstrlenW (lpString=".dbf") returned 4 [0199.594] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.594] lstrlenW (lpString=".1cd") returned 4 [0199.594] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.594] lstrlenW (lpString=".jpg") returned 4 [0199.594] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.595] lstrlenW (lpString=".doc") returned 4 [0199.595] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.595] lstrlenW (lpString=".docx") returned 5 [0199.595] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.595] lstrlenW (lpString=".pdf") returned 4 [0199.595] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.595] lstrlenW (lpString=".xls") returned 4 [0199.595] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.595] lstrlenW (lpString=".xlsx") returned 5 [0199.595] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.595] lstrlenW (lpString=".ppt") returned 4 [0199.595] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.595] lstrlenW (lpString=".zip") returned 4 [0199.595] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.595] lstrlenW (lpString=".rar") returned 4 [0199.595] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.595] lstrlenW (lpString=".bz2") returned 4 [0199.595] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.595] lstrlenW (lpString=".7z") returned 3 [0199.595] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.595] lstrlenW (lpString=".dbf") returned 4 [0199.595] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.595] lstrlenW (lpString=".1cd") returned 4 [0199.595] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AAdAVrM[1].png") returned 126 [0199.595] lstrlenW (lpString=".jpg") returned 4 [0199.595] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.595] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0199.596] lstrlenW (lpString="adServer[1].htm") returned 15 [0199.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.610] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=8679) returned 1 [0199.610] CloseHandle (hObject=0x2d4) returned 1 [0199.610] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm")) returned 0x2020 [0199.610] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.621] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.621] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.621] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.621] GetLastError () returned 0x0 [0199.621] ReadFile (in: hFile=0x2d4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x21e7, lpOverlapped=0x0) returned 1 [0199.677] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x21f0, lpOverlapped=0x0) returned 1 [0199.678] ReadFile (in: hFile=0x2d4, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.678] WriteFile (in: hFile=0x15c, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0199.678] SetEndOfFile (hFile=0x15c) returned 1 [0199.678] CloseHandle (hObject=0x15c) returned 1 [0199.678] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.678] SetEndOfFile (hFile=0x2d4) returned 1 [0199.679] CloseHandle (hObject=0x2d4) returned 1 [0199.679] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.679] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\adserver[1].htm")) returned 1 [0199.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.811] lstrlenW (lpString=".doc") returned 4 [0199.811] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0199.811] lstrlenW (lpString=".docx") returned 5 [0199.811] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0199.811] lstrlenW (lpString=".pdf") returned 4 [0199.811] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0199.811] lstrlenW (lpString=".xls") returned 4 [0199.811] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0199.811] lstrlenW (lpString=".xlsx") returned 5 [0199.811] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0199.811] lstrlenW (lpString=".ppt") returned 4 [0199.811] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0199.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.811] lstrlenW (lpString=".zip") returned 4 [0199.811] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0199.811] lstrlenW (lpString=".rar") returned 4 [0199.811] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0199.811] lstrlenW (lpString=".bz2") returned 4 [0199.811] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0199.811] lstrlenW (lpString=".7z") returned 3 [0199.811] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0199.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.811] lstrlenW (lpString=".dbf") returned 4 [0199.811] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0199.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.811] lstrlenW (lpString=".1cd") returned 4 [0199.811] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0199.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.811] lstrlenW (lpString=".jpg") returned 4 [0199.811] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0199.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.812] lstrlenW (lpString=".doc") returned 4 [0199.812] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0199.812] lstrlenW (lpString=".docx") returned 5 [0199.812] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0199.812] lstrlenW (lpString=".pdf") returned 4 [0199.812] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0199.812] lstrlenW (lpString=".xls") returned 4 [0199.812] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0199.812] lstrlenW (lpString=".xlsx") returned 5 [0199.812] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0199.812] lstrlenW (lpString=".ppt") returned 4 [0199.812] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0199.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.812] lstrlenW (lpString=".zip") returned 4 [0199.812] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0199.812] lstrlenW (lpString=".rar") returned 4 [0199.812] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0199.812] lstrlenW (lpString=".bz2") returned 4 [0199.812] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0199.812] lstrlenW (lpString=".7z") returned 3 [0199.812] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0199.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.812] lstrlenW (lpString=".dbf") returned 4 [0199.812] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0199.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.812] lstrlenW (lpString=".1cd") returned 4 [0199.812] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0199.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\adServer[1].htm") returned 127 [0199.812] lstrlenW (lpString=".jpg") returned 4 [0199.812] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0199.813] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.813] lstrlenW (lpString="BB5kTiV[1].png") returned 14 [0199.813] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.994] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=289) returned 1 [0199.994] CloseHandle (hObject=0x2d8) returned 1 [0199.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png")) returned 0x2020 [0199.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.002] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.002] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.013] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0200.035] GetLastError () returned 0x0 [0200.035] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x121, lpOverlapped=0x0) returned 1 [0200.037] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x130, lpOverlapped=0x0) returned 1 [0200.038] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.038] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.038] SetEndOfFile (hFile=0x358) returned 1 [0200.038] CloseHandle (hObject=0x358) returned 1 [0200.038] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.038] SetEndOfFile (hFile=0x2d8) returned 1 [0200.039] CloseHandle (hObject=0x2d8) returned 1 [0200.039] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.039] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5ktiv[1].png")) returned 1 [0200.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.039] lstrlenW (lpString=".doc") returned 4 [0200.040] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0200.040] lstrlenW (lpString=".docx") returned 5 [0200.040] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0200.040] lstrlenW (lpString=".pdf") returned 4 [0200.040] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0200.040] lstrlenW (lpString=".xls") returned 4 [0200.040] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0200.040] lstrlenW (lpString=".xlsx") returned 5 [0200.040] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0200.040] lstrlenW (lpString=".ppt") returned 4 [0200.040] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0200.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.040] lstrlenW (lpString=".zip") returned 4 [0200.040] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0200.040] lstrlenW (lpString=".rar") returned 4 [0200.040] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0200.040] lstrlenW (lpString=".bz2") returned 4 [0200.040] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0200.040] lstrlenW (lpString=".7z") returned 3 [0200.040] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0200.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.040] lstrlenW (lpString=".dbf") returned 4 [0200.040] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0200.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.040] lstrlenW (lpString=".1cd") returned 4 [0200.040] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0200.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.040] lstrlenW (lpString=".jpg") returned 4 [0200.040] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0200.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.040] lstrlenW (lpString=".doc") returned 4 [0200.040] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0200.041] lstrlenW (lpString=".docx") returned 5 [0200.041] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0200.041] lstrlenW (lpString=".pdf") returned 4 [0200.041] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0200.041] lstrlenW (lpString=".xls") returned 4 [0200.041] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0200.041] lstrlenW (lpString=".xlsx") returned 5 [0200.041] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0200.041] lstrlenW (lpString=".ppt") returned 4 [0200.041] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0200.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.041] lstrlenW (lpString=".zip") returned 4 [0200.041] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0200.041] lstrlenW (lpString=".rar") returned 4 [0200.041] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0200.041] lstrlenW (lpString=".bz2") returned 4 [0200.041] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0200.041] lstrlenW (lpString=".7z") returned 3 [0200.041] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0200.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.041] lstrlenW (lpString=".dbf") returned 4 [0200.041] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0200.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.041] lstrlenW (lpString=".1cd") returned 4 [0200.041] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0200.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kTiV[1].png") returned 126 [0200.041] lstrlenW (lpString=".jpg") returned 4 [0200.041] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0200.041] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.042] lstrlenW (lpString="BBBO1mQ[1].jpg") returned 14 [0200.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.043] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5997) returned 1 [0200.043] CloseHandle (hObject=0x2d8) returned 1 [0200.043] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg")) returned 0x2020 [0200.043] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.043] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.043] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.043] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0200.044] GetLastError () returned 0x0 [0200.044] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x176d, lpOverlapped=0x0) returned 1 [0200.046] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1770, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1770, lpOverlapped=0x0) returned 1 [0200.047] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.047] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.047] SetEndOfFile (hFile=0x358) returned 1 [0200.047] CloseHandle (hObject=0x358) returned 1 [0200.047] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.047] SetEndOfFile (hFile=0x2d8) returned 1 [0200.049] CloseHandle (hObject=0x2d8) returned 1 [0200.049] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.050] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo1mq[1].jpg")) returned 1 [0200.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.050] lstrlenW (lpString=".doc") returned 4 [0200.050] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.050] lstrlenW (lpString=".docx") returned 5 [0200.050] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.050] lstrlenW (lpString=".pdf") returned 4 [0200.050] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.050] lstrlenW (lpString=".xls") returned 4 [0200.050] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.050] lstrlenW (lpString=".xlsx") returned 5 [0200.050] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.050] lstrlenW (lpString=".ppt") returned 4 [0200.050] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.050] lstrlenW (lpString=".zip") returned 4 [0200.050] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.051] lstrlenW (lpString=".rar") returned 4 [0200.051] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.051] lstrlenW (lpString=".bz2") returned 4 [0200.051] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.051] lstrlenW (lpString=".7z") returned 3 [0200.051] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.051] lstrlenW (lpString=".dbf") returned 4 [0200.051] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.051] lstrlenW (lpString=".1cd") returned 4 [0200.051] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.051] lstrlenW (lpString=".jpg") returned 4 [0200.051] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.051] lstrlenW (lpString=".doc") returned 4 [0200.051] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.051] lstrlenW (lpString=".docx") returned 5 [0200.051] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.051] lstrlenW (lpString=".pdf") returned 4 [0200.051] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.051] lstrlenW (lpString=".xls") returned 4 [0200.051] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.051] lstrlenW (lpString=".xlsx") returned 5 [0200.051] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.051] lstrlenW (lpString=".ppt") returned 4 [0200.052] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.052] lstrlenW (lpString=".zip") returned 4 [0200.052] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.052] lstrlenW (lpString=".rar") returned 4 [0200.052] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.052] lstrlenW (lpString=".bz2") returned 4 [0200.052] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.052] lstrlenW (lpString=".7z") returned 3 [0200.052] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.052] lstrlenW (lpString=".dbf") returned 4 [0200.052] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.052] lstrlenW (lpString=".1cd") returned 4 [0200.052] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO1mQ[1].jpg") returned 126 [0200.052] lstrlenW (lpString=".jpg") returned 4 [0200.052] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.052] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.052] lstrlenW (lpString="BBBO3tl[1].jpg") returned 14 [0200.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.053] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=25112) returned 1 [0200.053] CloseHandle (hObject=0x2d8) returned 1 [0200.053] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg")) returned 0x2020 [0200.053] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.053] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.053] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0200.054] GetLastError () returned 0x0 [0200.054] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x6218, lpOverlapped=0x0) returned 1 [0200.056] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x6220, lpOverlapped=0x0) returned 1 [0200.057] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.057] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.057] SetEndOfFile (hFile=0x358) returned 1 [0200.057] CloseHandle (hObject=0x358) returned 1 [0200.057] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.057] SetEndOfFile (hFile=0x2d8) returned 1 [0200.058] CloseHandle (hObject=0x2d8) returned 1 [0200.058] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.059] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo3tl[1].jpg")) returned 1 [0200.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.059] lstrlenW (lpString=".doc") returned 4 [0200.059] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.059] lstrlenW (lpString=".docx") returned 5 [0200.059] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.059] lstrlenW (lpString=".pdf") returned 4 [0200.059] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.059] lstrlenW (lpString=".xls") returned 4 [0200.059] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.059] lstrlenW (lpString=".xlsx") returned 5 [0200.059] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.059] lstrlenW (lpString=".ppt") returned 4 [0200.059] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.059] lstrlenW (lpString=".zip") returned 4 [0200.059] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.059] lstrlenW (lpString=".rar") returned 4 [0200.059] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.059] lstrlenW (lpString=".bz2") returned 4 [0200.059] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.059] lstrlenW (lpString=".7z") returned 3 [0200.059] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.060] lstrlenW (lpString=".dbf") returned 4 [0200.060] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.060] lstrlenW (lpString=".1cd") returned 4 [0200.060] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.060] lstrlenW (lpString=".jpg") returned 4 [0200.060] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.060] lstrlenW (lpString=".doc") returned 4 [0200.060] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.060] lstrlenW (lpString=".docx") returned 5 [0200.060] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.060] lstrlenW (lpString=".pdf") returned 4 [0200.060] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.060] lstrlenW (lpString=".xls") returned 4 [0200.060] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.060] lstrlenW (lpString=".xlsx") returned 5 [0200.060] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.060] lstrlenW (lpString=".ppt") returned 4 [0200.060] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.060] lstrlenW (lpString=".zip") returned 4 [0200.060] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.060] lstrlenW (lpString=".rar") returned 4 [0200.060] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.060] lstrlenW (lpString=".bz2") returned 4 [0200.060] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.060] lstrlenW (lpString=".7z") returned 3 [0200.060] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.061] lstrlenW (lpString=".dbf") returned 4 [0200.061] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.061] lstrlenW (lpString=".1cd") returned 4 [0200.061] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO3tl[1].jpg") returned 126 [0200.061] lstrlenW (lpString=".jpg") returned 4 [0200.061] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.061] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.061] lstrlenW (lpString="BBBO8dQ[1].jpg") returned 14 [0200.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.062] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1882) returned 1 [0200.062] CloseHandle (hObject=0x2d8) returned 1 [0200.062] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg")) returned 0x2020 [0200.062] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.062] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.062] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0200.063] GetLastError () returned 0x0 [0200.063] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x75a, lpOverlapped=0x0) returned 1 [0200.065] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x760, lpOverlapped=0x0) returned 1 [0200.066] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.066] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.066] SetEndOfFile (hFile=0x358) returned 1 [0200.066] CloseHandle (hObject=0x358) returned 1 [0200.101] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.101] SetEndOfFile (hFile=0x2d8) returned 1 [0200.128] CloseHandle (hObject=0x2d8) returned 1 [0200.128] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.128] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbo8dq[1].jpg")) returned 1 [0200.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.128] lstrlenW (lpString=".doc") returned 4 [0200.128] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.128] lstrlenW (lpString=".docx") returned 5 [0200.128] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.128] lstrlenW (lpString=".pdf") returned 4 [0200.128] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.128] lstrlenW (lpString=".xls") returned 4 [0200.128] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.128] lstrlenW (lpString=".xlsx") returned 5 [0200.128] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.128] lstrlenW (lpString=".ppt") returned 4 [0200.129] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.129] lstrlenW (lpString=".zip") returned 4 [0200.129] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.129] lstrlenW (lpString=".rar") returned 4 [0200.129] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.129] lstrlenW (lpString=".bz2") returned 4 [0200.129] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.129] lstrlenW (lpString=".7z") returned 3 [0200.129] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.130] lstrlenW (lpString=".dbf") returned 4 [0200.130] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.130] lstrlenW (lpString=".1cd") returned 4 [0200.130] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.130] lstrlenW (lpString=".jpg") returned 4 [0200.130] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.130] lstrlenW (lpString=".doc") returned 4 [0200.130] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.130] lstrlenW (lpString=".docx") returned 5 [0200.130] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.130] lstrlenW (lpString=".pdf") returned 4 [0200.130] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.130] lstrlenW (lpString=".xls") returned 4 [0200.130] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.130] lstrlenW (lpString=".xlsx") returned 5 [0200.130] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.130] lstrlenW (lpString=".ppt") returned 4 [0200.130] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.130] lstrlenW (lpString=".zip") returned 4 [0200.130] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.130] lstrlenW (lpString=".rar") returned 4 [0200.130] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.130] lstrlenW (lpString=".bz2") returned 4 [0200.130] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.130] lstrlenW (lpString=".7z") returned 3 [0200.130] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.131] lstrlenW (lpString=".dbf") returned 4 [0200.131] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.131] lstrlenW (lpString=".1cd") returned 4 [0200.131] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBO8dQ[1].jpg") returned 126 [0200.131] lstrlenW (lpString=".jpg") returned 4 [0200.131] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.131] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.131] lstrlenW (lpString="BBBOe7C[1].jpg") returned 14 [0200.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.131] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=11657) returned 1 [0200.131] CloseHandle (hObject=0x2d8) returned 1 [0200.132] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg")) returned 0x2020 [0200.132] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.132] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.132] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0200.132] GetLastError () returned 0x0 [0200.132] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2d89, lpOverlapped=0x0) returned 1 [0200.135] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0200.136] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.136] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.136] SetEndOfFile (hFile=0x358) returned 1 [0200.136] CloseHandle (hObject=0x358) returned 1 [0200.137] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.137] SetEndOfFile (hFile=0x2d8) returned 1 [0200.137] CloseHandle (hObject=0x2d8) returned 1 [0200.137] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.138] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbboe7c[1].jpg")) returned 1 [0200.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.138] lstrlenW (lpString=".doc") returned 4 [0200.138] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.138] lstrlenW (lpString=".docx") returned 5 [0200.138] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.138] lstrlenW (lpString=".pdf") returned 4 [0200.138] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.138] lstrlenW (lpString=".xls") returned 4 [0200.138] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.138] lstrlenW (lpString=".xlsx") returned 5 [0200.138] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.138] lstrlenW (lpString=".ppt") returned 4 [0200.138] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.138] lstrlenW (lpString=".zip") returned 4 [0200.138] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.138] lstrlenW (lpString=".rar") returned 4 [0200.138] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.138] lstrlenW (lpString=".bz2") returned 4 [0200.138] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.138] lstrlenW (lpString=".7z") returned 3 [0200.139] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.139] lstrlenW (lpString=".dbf") returned 4 [0200.139] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.139] lstrlenW (lpString=".1cd") returned 4 [0200.139] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.139] lstrlenW (lpString=".jpg") returned 4 [0200.139] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.139] lstrlenW (lpString=".doc") returned 4 [0200.139] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.139] lstrlenW (lpString=".docx") returned 5 [0200.139] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.139] lstrlenW (lpString=".pdf") returned 4 [0200.139] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.139] lstrlenW (lpString=".xls") returned 4 [0200.139] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.139] lstrlenW (lpString=".xlsx") returned 5 [0200.139] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.139] lstrlenW (lpString=".ppt") returned 4 [0200.139] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.139] lstrlenW (lpString=".zip") returned 4 [0200.139] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.139] lstrlenW (lpString=".rar") returned 4 [0200.139] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.139] lstrlenW (lpString=".bz2") returned 4 [0200.139] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.139] lstrlenW (lpString=".7z") returned 3 [0200.139] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.140] lstrlenW (lpString=".dbf") returned 4 [0200.140] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.140] lstrlenW (lpString=".1cd") returned 4 [0200.140] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBOe7C[1].jpg") returned 126 [0200.140] lstrlenW (lpString=".jpg") returned 4 [0200.140] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.140] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.140] lstrlenW (lpString="BBBPThN[1].jpg") returned 14 [0200.140] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.145] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7734) returned 1 [0200.145] CloseHandle (hObject=0x2d8) returned 1 [0200.145] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg")) returned 0x2020 [0200.145] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.145] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.145] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0200.146] GetLastError () returned 0x0 [0200.146] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x1e36, lpOverlapped=0x0) returned 1 [0200.148] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1e40, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1e40, lpOverlapped=0x0) returned 1 [0200.149] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.149] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.149] SetEndOfFile (hFile=0x358) returned 1 [0200.150] CloseHandle (hObject=0x358) returned 1 [0200.150] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.150] SetEndOfFile (hFile=0x2d8) returned 1 [0200.150] CloseHandle (hObject=0x2d8) returned 1 [0200.150] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.151] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpthn[1].jpg")) returned 1 [0200.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.151] lstrlenW (lpString=".doc") returned 4 [0200.151] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.151] lstrlenW (lpString=".docx") returned 5 [0200.151] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.151] lstrlenW (lpString=".pdf") returned 4 [0200.151] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.151] lstrlenW (lpString=".xls") returned 4 [0200.151] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.151] lstrlenW (lpString=".xlsx") returned 5 [0200.151] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.151] lstrlenW (lpString=".ppt") returned 4 [0200.151] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.151] lstrlenW (lpString=".zip") returned 4 [0200.151] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.151] lstrlenW (lpString=".rar") returned 4 [0200.151] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.151] lstrlenW (lpString=".bz2") returned 4 [0200.151] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.151] lstrlenW (lpString=".7z") returned 3 [0200.151] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.152] lstrlenW (lpString=".dbf") returned 4 [0200.152] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.152] lstrlenW (lpString=".1cd") returned 4 [0200.152] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.152] lstrlenW (lpString=".jpg") returned 4 [0200.152] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.152] lstrlenW (lpString=".doc") returned 4 [0200.152] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.152] lstrlenW (lpString=".docx") returned 5 [0200.152] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.152] lstrlenW (lpString=".pdf") returned 4 [0200.152] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.152] lstrlenW (lpString=".xls") returned 4 [0200.152] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.152] lstrlenW (lpString=".xlsx") returned 5 [0200.152] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.152] lstrlenW (lpString=".ppt") returned 4 [0200.152] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.152] lstrlenW (lpString=".zip") returned 4 [0200.152] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.152] lstrlenW (lpString=".rar") returned 4 [0200.152] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.152] lstrlenW (lpString=".bz2") returned 4 [0200.152] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.152] lstrlenW (lpString=".7z") returned 3 [0200.152] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.153] lstrlenW (lpString=".dbf") returned 4 [0200.153] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.153] lstrlenW (lpString=".1cd") returned 4 [0200.153] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPThN[1].jpg") returned 126 [0200.153] lstrlenW (lpString=".jpg") returned 4 [0200.153] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.153] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.153] lstrlenW (lpString="BBBPUFJ[1].jpg") returned 14 [0200.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.154] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=7911) returned 1 [0200.154] CloseHandle (hObject=0x2d8) returned 1 [0200.154] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg")) returned 0x2020 [0200.154] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.154] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.154] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0200.155] GetLastError () returned 0x0 [0200.155] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x1ee7, lpOverlapped=0x0) returned 1 [0200.157] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1ef0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1ef0, lpOverlapped=0x0) returned 1 [0200.158] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.158] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.158] SetEndOfFile (hFile=0x358) returned 1 [0200.158] CloseHandle (hObject=0x358) returned 1 [0200.159] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.159] SetEndOfFile (hFile=0x2d8) returned 1 [0200.159] CloseHandle (hObject=0x2d8) returned 1 [0200.159] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.160] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbpufj[1].jpg")) returned 1 [0200.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.160] lstrlenW (lpString=".doc") returned 4 [0200.160] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.160] lstrlenW (lpString=".docx") returned 5 [0200.160] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.160] lstrlenW (lpString=".pdf") returned 4 [0200.160] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.160] lstrlenW (lpString=".xls") returned 4 [0200.160] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.160] lstrlenW (lpString=".xlsx") returned 5 [0200.160] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.160] lstrlenW (lpString=".ppt") returned 4 [0200.160] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.161] lstrlenW (lpString=".zip") returned 4 [0200.161] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.161] lstrlenW (lpString=".rar") returned 4 [0200.161] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.161] lstrlenW (lpString=".bz2") returned 4 [0200.161] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.161] lstrlenW (lpString=".7z") returned 3 [0200.161] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.161] lstrlenW (lpString=".dbf") returned 4 [0200.161] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.161] lstrlenW (lpString=".1cd") returned 4 [0200.161] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.161] lstrlenW (lpString=".jpg") returned 4 [0200.161] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.161] lstrlenW (lpString=".doc") returned 4 [0200.161] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.161] lstrlenW (lpString=".docx") returned 5 [0200.161] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.161] lstrlenW (lpString=".pdf") returned 4 [0200.161] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.161] lstrlenW (lpString=".xls") returned 4 [0200.161] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.161] lstrlenW (lpString=".xlsx") returned 5 [0200.161] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.161] lstrlenW (lpString=".ppt") returned 4 [0200.161] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.161] lstrlenW (lpString=".zip") returned 4 [0200.162] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.162] lstrlenW (lpString=".rar") returned 4 [0200.162] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.162] lstrlenW (lpString=".bz2") returned 4 [0200.162] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.162] lstrlenW (lpString=".7z") returned 3 [0200.162] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.162] lstrlenW (lpString=".dbf") returned 4 [0200.162] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.162] lstrlenW (lpString=".1cd") returned 4 [0200.162] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBPUFJ[1].jpg") returned 126 [0200.162] lstrlenW (lpString=".jpg") returned 4 [0200.162] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.162] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.162] lstrlenW (lpString="BBBQxzx[1].jpg") returned 14 [0200.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.163] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2340) returned 1 [0200.163] CloseHandle (hObject=0x2d8) returned 1 [0200.163] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg")) returned 0x2020 [0200.163] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0200.163] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.163] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0200.163] GetLastError () returned 0x0 [0200.164] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x924, lpOverlapped=0x0) returned 1 [0200.429] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x930, lpOverlapped=0x0) returned 1 [0200.430] ReadFile (in: hFile=0x2d8, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.430] WriteFile (in: hFile=0x358, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.430] SetEndOfFile (hFile=0x358) returned 1 [0200.614] CloseHandle (hObject=0x358) returned 1 [0200.614] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.614] SetEndOfFile (hFile=0x2d8) returned 1 [0200.622] CloseHandle (hObject=0x2d8) returned 1 [0200.622] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.631] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbqxzx[1].jpg")) returned 1 [0200.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.649] lstrlenW (lpString=".doc") returned 4 [0200.649] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.649] lstrlenW (lpString=".docx") returned 5 [0200.649] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.649] lstrlenW (lpString=".pdf") returned 4 [0200.649] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.649] lstrlenW (lpString=".xls") returned 4 [0200.649] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.649] lstrlenW (lpString=".xlsx") returned 5 [0200.649] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.649] lstrlenW (lpString=".ppt") returned 4 [0200.649] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.649] lstrlenW (lpString=".zip") returned 4 [0200.649] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.649] lstrlenW (lpString=".rar") returned 4 [0200.649] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.649] lstrlenW (lpString=".bz2") returned 4 [0200.649] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.649] lstrlenW (lpString=".7z") returned 3 [0200.649] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.649] lstrlenW (lpString=".dbf") returned 4 [0200.649] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.650] lstrlenW (lpString=".1cd") returned 4 [0200.650] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.650] lstrlenW (lpString=".jpg") returned 4 [0200.650] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.650] lstrlenW (lpString=".doc") returned 4 [0200.650] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.650] lstrlenW (lpString=".docx") returned 5 [0200.650] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.650] lstrlenW (lpString=".pdf") returned 4 [0200.650] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.650] lstrlenW (lpString=".xls") returned 4 [0200.650] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.650] lstrlenW (lpString=".xlsx") returned 5 [0200.650] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.650] lstrlenW (lpString=".ppt") returned 4 [0200.650] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.650] lstrlenW (lpString=".zip") returned 4 [0200.650] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.650] lstrlenW (lpString=".rar") returned 4 [0200.650] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.650] lstrlenW (lpString=".bz2") returned 4 [0200.650] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.650] lstrlenW (lpString=".7z") returned 3 [0200.650] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.650] lstrlenW (lpString=".dbf") returned 4 [0200.650] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.650] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.651] lstrlenW (lpString=".1cd") returned 4 [0200.651] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.651] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBQxzx[1].jpg") returned 126 [0200.651] lstrlenW (lpString=".jpg") returned 4 [0200.651] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.651] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.651] lstrlenW (lpString="BBBVIzI[1].jpg") returned 14 [0200.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.876] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2728) returned 1 [0201.876] CloseHandle (hObject=0x358) returned 1 [0201.876] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg")) returned 0x2020 [0201.876] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.876] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.876] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0202.154] GetLastError () returned 0x0 [0202.154] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xaa8, lpOverlapped=0x0) returned 1 [0202.156] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xab0, lpOverlapped=0x0) returned 1 [0202.157] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0202.157] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.157] SetEndOfFile (hFile=0x354) returned 1 [0202.157] CloseHandle (hObject=0x354) returned 1 [0202.157] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.157] SetEndOfFile (hFile=0x358) returned 1 [0202.158] CloseHandle (hObject=0x358) returned 1 [0202.158] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.160] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvizi[1].jpg")) returned 1 [0202.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.161] lstrlenW (lpString=".doc") returned 4 [0202.161] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.161] lstrlenW (lpString=".docx") returned 5 [0202.161] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.161] lstrlenW (lpString=".pdf") returned 4 [0202.161] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.161] lstrlenW (lpString=".xls") returned 4 [0202.161] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.161] lstrlenW (lpString=".xlsx") returned 5 [0202.161] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.161] lstrlenW (lpString=".ppt") returned 4 [0202.161] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.161] lstrlenW (lpString=".zip") returned 4 [0202.161] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.161] lstrlenW (lpString=".rar") returned 4 [0202.161] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.161] lstrlenW (lpString=".bz2") returned 4 [0202.161] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.161] lstrlenW (lpString=".7z") returned 3 [0202.161] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.161] lstrlenW (lpString=".dbf") returned 4 [0202.161] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.161] lstrlenW (lpString=".1cd") returned 4 [0202.161] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.161] lstrlenW (lpString=".jpg") returned 4 [0202.161] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.162] lstrlenW (lpString=".doc") returned 4 [0202.162] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.162] lstrlenW (lpString=".docx") returned 5 [0202.162] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.162] lstrlenW (lpString=".pdf") returned 4 [0202.162] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.162] lstrlenW (lpString=".xls") returned 4 [0202.162] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.162] lstrlenW (lpString=".xlsx") returned 5 [0202.162] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.162] lstrlenW (lpString=".ppt") returned 4 [0202.162] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.162] lstrlenW (lpString=".zip") returned 4 [0202.162] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.162] lstrlenW (lpString=".rar") returned 4 [0202.162] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.162] lstrlenW (lpString=".bz2") returned 4 [0202.162] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.162] lstrlenW (lpString=".7z") returned 3 [0202.162] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.162] lstrlenW (lpString=".dbf") returned 4 [0202.162] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.162] lstrlenW (lpString=".1cd") returned 4 [0202.162] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVIzI[1].jpg") returned 126 [0202.162] lstrlenW (lpString=".jpg") returned 4 [0202.162] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.163] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.163] lstrlenW (lpString="BBEdXJj[1].jpg") returned 14 [0202.163] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.164] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1671) returned 1 [0202.164] CloseHandle (hObject=0x358) returned 1 [0202.164] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg")) returned 0x2020 [0202.164] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.164] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.164] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0202.165] GetLastError () returned 0x0 [0202.165] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x687, lpOverlapped=0x0) returned 1 [0202.166] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x690, lpOverlapped=0x0) returned 1 [0202.167] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0202.167] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.167] SetEndOfFile (hFile=0x354) returned 1 [0202.168] CloseHandle (hObject=0x354) returned 1 [0202.168] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.168] SetEndOfFile (hFile=0x358) returned 1 [0202.168] CloseHandle (hObject=0x358) returned 1 [0202.168] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.169] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedxjj[1].jpg")) returned 1 [0202.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.169] lstrlenW (lpString=".doc") returned 4 [0202.169] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.169] lstrlenW (lpString=".docx") returned 5 [0202.169] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.169] lstrlenW (lpString=".pdf") returned 4 [0202.169] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.169] lstrlenW (lpString=".xls") returned 4 [0202.169] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.169] lstrlenW (lpString=".xlsx") returned 5 [0202.169] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.169] lstrlenW (lpString=".ppt") returned 4 [0202.169] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.169] lstrlenW (lpString=".zip") returned 4 [0202.169] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.169] lstrlenW (lpString=".rar") returned 4 [0202.169] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.169] lstrlenW (lpString=".bz2") returned 4 [0202.169] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.169] lstrlenW (lpString=".7z") returned 3 [0202.169] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.169] lstrlenW (lpString=".dbf") returned 4 [0202.170] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.170] lstrlenW (lpString=".1cd") returned 4 [0202.170] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.170] lstrlenW (lpString=".jpg") returned 4 [0202.170] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.170] lstrlenW (lpString=".doc") returned 4 [0202.170] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.170] lstrlenW (lpString=".docx") returned 5 [0202.170] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.170] lstrlenW (lpString=".pdf") returned 4 [0202.170] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.170] lstrlenW (lpString=".xls") returned 4 [0202.170] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.170] lstrlenW (lpString=".xlsx") returned 5 [0202.170] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.170] lstrlenW (lpString=".ppt") returned 4 [0202.170] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.170] lstrlenW (lpString=".zip") returned 4 [0202.170] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.170] lstrlenW (lpString=".rar") returned 4 [0202.170] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.170] lstrlenW (lpString=".bz2") returned 4 [0202.170] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.170] lstrlenW (lpString=".7z") returned 3 [0202.170] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.170] lstrlenW (lpString=".dbf") returned 4 [0202.170] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.171] lstrlenW (lpString=".1cd") returned 4 [0202.171] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdXJj[1].jpg") returned 126 [0202.171] lstrlenW (lpString=".jpg") returned 4 [0202.171] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.171] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.171] lstrlenW (lpString="BBEeP0k[1].jpg") returned 14 [0202.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.172] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=9416) returned 1 [0202.172] CloseHandle (hObject=0x358) returned 1 [0202.172] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg")) returned 0x2020 [0202.172] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.173] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.173] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0202.173] GetLastError () returned 0x0 [0202.173] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x24c8, lpOverlapped=0x0) returned 1 [0202.175] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x24d0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x24d0, lpOverlapped=0x0) returned 1 [0202.176] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0202.176] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.176] SetEndOfFile (hFile=0x354) returned 1 [0202.176] CloseHandle (hObject=0x354) returned 1 [0202.176] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.176] SetEndOfFile (hFile=0x358) returned 1 [0202.177] CloseHandle (hObject=0x358) returned 1 [0202.177] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.177] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeep0k[1].jpg")) returned 1 [0202.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.178] lstrlenW (lpString=".doc") returned 4 [0202.178] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.178] lstrlenW (lpString=".docx") returned 5 [0202.178] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.178] lstrlenW (lpString=".pdf") returned 4 [0202.178] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.178] lstrlenW (lpString=".xls") returned 4 [0202.178] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.178] lstrlenW (lpString=".xlsx") returned 5 [0202.178] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.178] lstrlenW (lpString=".ppt") returned 4 [0202.178] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.178] lstrlenW (lpString=".zip") returned 4 [0202.178] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.178] lstrlenW (lpString=".rar") returned 4 [0202.178] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.178] lstrlenW (lpString=".bz2") returned 4 [0202.178] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.178] lstrlenW (lpString=".7z") returned 3 [0202.178] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.178] lstrlenW (lpString=".dbf") returned 4 [0202.178] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.178] lstrlenW (lpString=".1cd") returned 4 [0202.178] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.178] lstrlenW (lpString=".jpg") returned 4 [0202.178] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.178] lstrlenW (lpString=".doc") returned 4 [0202.179] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.179] lstrlenW (lpString=".docx") returned 5 [0202.179] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.179] lstrlenW (lpString=".pdf") returned 4 [0202.179] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.179] lstrlenW (lpString=".xls") returned 4 [0202.179] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.179] lstrlenW (lpString=".xlsx") returned 5 [0202.179] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.179] lstrlenW (lpString=".ppt") returned 4 [0202.179] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.179] lstrlenW (lpString=".zip") returned 4 [0202.179] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.179] lstrlenW (lpString=".rar") returned 4 [0202.179] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.179] lstrlenW (lpString=".bz2") returned 4 [0202.179] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.179] lstrlenW (lpString=".7z") returned 3 [0202.179] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.179] lstrlenW (lpString=".dbf") returned 4 [0202.179] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.179] lstrlenW (lpString=".1cd") returned 4 [0202.179] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeP0k[1].jpg") returned 126 [0202.179] lstrlenW (lpString=".jpg") returned 4 [0202.179] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.179] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.180] lstrlenW (lpString="BBEeTuf[1].jpg") returned 14 [0202.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.180] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=13335) returned 1 [0202.181] CloseHandle (hObject=0x358) returned 1 [0202.181] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg")) returned 0x2020 [0202.181] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.181] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.181] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.181] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0202.181] GetLastError () returned 0x0 [0202.182] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x3417, lpOverlapped=0x0) returned 1 [0202.183] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3420, lpOverlapped=0x0) returned 1 [0202.185] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0202.185] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.185] SetEndOfFile (hFile=0x354) returned 1 [0202.185] CloseHandle (hObject=0x354) returned 1 [0202.185] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.185] SetEndOfFile (hFile=0x358) returned 1 [0202.186] CloseHandle (hObject=0x358) returned 1 [0202.186] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.186] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbeetuf[1].jpg")) returned 1 [0202.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.186] lstrlenW (lpString=".doc") returned 4 [0202.186] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.186] lstrlenW (lpString=".docx") returned 5 [0202.186] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.186] lstrlenW (lpString=".pdf") returned 4 [0202.186] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.186] lstrlenW (lpString=".xls") returned 4 [0202.187] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.187] lstrlenW (lpString=".xlsx") returned 5 [0202.187] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.187] lstrlenW (lpString=".ppt") returned 4 [0202.187] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.187] lstrlenW (lpString=".zip") returned 4 [0202.187] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.187] lstrlenW (lpString=".rar") returned 4 [0202.187] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.187] lstrlenW (lpString=".bz2") returned 4 [0202.187] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.187] lstrlenW (lpString=".7z") returned 3 [0202.187] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.187] lstrlenW (lpString=".dbf") returned 4 [0202.187] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.187] lstrlenW (lpString=".1cd") returned 4 [0202.187] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.187] lstrlenW (lpString=".jpg") returned 4 [0202.187] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.187] lstrlenW (lpString=".doc") returned 4 [0202.187] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.187] lstrlenW (lpString=".docx") returned 5 [0202.187] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.187] lstrlenW (lpString=".pdf") returned 4 [0202.187] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.187] lstrlenW (lpString=".xls") returned 4 [0202.187] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.188] lstrlenW (lpString=".xlsx") returned 5 [0202.188] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.188] lstrlenW (lpString=".ppt") returned 4 [0202.188] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.188] lstrlenW (lpString=".zip") returned 4 [0202.188] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.188] lstrlenW (lpString=".rar") returned 4 [0202.188] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.188] lstrlenW (lpString=".bz2") returned 4 [0202.188] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.188] lstrlenW (lpString=".7z") returned 3 [0202.188] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.188] lstrlenW (lpString=".dbf") returned 4 [0202.188] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.188] lstrlenW (lpString=".1cd") returned 4 [0202.188] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.188] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEeTuf[1].jpg") returned 126 [0202.188] lstrlenW (lpString=".jpg") returned 4 [0202.188] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.188] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.188] lstrlenW (lpString="BBEfE6e[1].jpg") returned 14 [0202.188] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.189] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=3083) returned 1 [0202.189] CloseHandle (hObject=0x358) returned 1 [0202.189] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg")) returned 0x2020 [0202.190] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.190] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.190] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.190] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0202.190] GetLastError () returned 0x0 [0202.190] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xc0b, lpOverlapped=0x0) returned 1 [0202.192] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc10, lpOverlapped=0x0) returned 1 [0202.193] ReadFile (in: hFile=0x358, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0202.193] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.193] SetEndOfFile (hFile=0x354) returned 1 [0202.193] CloseHandle (hObject=0x354) returned 1 [0202.193] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.193] SetEndOfFile (hFile=0x358) returned 1 [0202.194] CloseHandle (hObject=0x358) returned 1 [0202.194] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.194] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefe6e[1].jpg")) returned 1 [0202.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.195] lstrlenW (lpString=".doc") returned 4 [0202.195] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.195] lstrlenW (lpString=".docx") returned 5 [0202.195] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.195] lstrlenW (lpString=".pdf") returned 4 [0202.195] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.195] lstrlenW (lpString=".xls") returned 4 [0202.195] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.195] lstrlenW (lpString=".xlsx") returned 5 [0202.195] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.195] lstrlenW (lpString=".ppt") returned 4 [0202.195] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.195] lstrlenW (lpString=".zip") returned 4 [0202.195] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.195] lstrlenW (lpString=".rar") returned 4 [0202.195] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.195] lstrlenW (lpString=".bz2") returned 4 [0202.195] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.195] lstrlenW (lpString=".7z") returned 3 [0202.195] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.195] lstrlenW (lpString=".dbf") returned 4 [0202.195] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.195] lstrlenW (lpString=".1cd") returned 4 [0202.195] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.195] lstrlenW (lpString=".jpg") returned 4 [0202.195] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.195] lstrlenW (lpString=".doc") returned 4 [0202.196] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.196] lstrlenW (lpString=".docx") returned 5 [0202.196] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.196] lstrlenW (lpString=".pdf") returned 4 [0202.196] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.196] lstrlenW (lpString=".xls") returned 4 [0202.196] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.196] lstrlenW (lpString=".xlsx") returned 5 [0202.196] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.196] lstrlenW (lpString=".ppt") returned 4 [0202.196] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.196] lstrlenW (lpString=".zip") returned 4 [0202.196] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.196] lstrlenW (lpString=".rar") returned 4 [0202.196] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.196] lstrlenW (lpString=".bz2") returned 4 [0202.196] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.196] lstrlenW (lpString=".7z") returned 3 [0202.196] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.196] lstrlenW (lpString=".dbf") returned 4 [0202.196] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.196] lstrlenW (lpString=".1cd") returned 4 [0202.196] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfE6e[1].jpg") returned 126 [0202.196] lstrlenW (lpString=".jpg") returned 4 [0202.196] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.196] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.197] lstrlenW (lpString="BBEfjuT[1].jpg") returned 14 [0202.197] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.547] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=15436) returned 1 [0202.547] CloseHandle (hObject=0x350) returned 1 [0202.547] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg")) returned 0x2020 [0202.553] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0202.650] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.650] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.989] GetLastError () returned 0x0 [0202.989] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x3c4c, lpOverlapped=0x0) returned 1 [0202.991] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x3c50, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x3c50, lpOverlapped=0x0) returned 1 [0202.992] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0202.992] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.992] SetEndOfFile (hFile=0x350) returned 1 [0202.992] CloseHandle (hObject=0x350) returned 1 [0202.992] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.992] SetEndOfFile (hFile=0x34c) returned 1 [0202.993] CloseHandle (hObject=0x34c) returned 1 [0202.993] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.993] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbefjut[1].jpg")) returned 1 [0202.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.993] lstrlenW (lpString=".doc") returned 4 [0202.993] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.994] lstrlenW (lpString=".docx") returned 5 [0202.994] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.994] lstrlenW (lpString=".pdf") returned 4 [0202.994] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.994] lstrlenW (lpString=".xls") returned 4 [0202.994] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.994] lstrlenW (lpString=".xlsx") returned 5 [0202.994] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.994] lstrlenW (lpString=".ppt") returned 4 [0202.994] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.994] lstrlenW (lpString=".zip") returned 4 [0202.994] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.994] lstrlenW (lpString=".rar") returned 4 [0202.994] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.994] lstrlenW (lpString=".bz2") returned 4 [0202.994] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.994] lstrlenW (lpString=".7z") returned 3 [0202.994] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.994] lstrlenW (lpString=".dbf") returned 4 [0202.994] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.994] lstrlenW (lpString=".1cd") returned 4 [0202.994] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.994] lstrlenW (lpString=".jpg") returned 4 [0202.994] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.994] lstrlenW (lpString=".doc") returned 4 [0202.994] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.994] lstrlenW (lpString=".docx") returned 5 [0202.994] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.995] lstrlenW (lpString=".pdf") returned 4 [0202.995] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.995] lstrlenW (lpString=".xls") returned 4 [0202.995] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.995] lstrlenW (lpString=".xlsx") returned 5 [0202.995] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.995] lstrlenW (lpString=".ppt") returned 4 [0202.995] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.995] lstrlenW (lpString=".zip") returned 4 [0202.995] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.995] lstrlenW (lpString=".rar") returned 4 [0202.995] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.995] lstrlenW (lpString=".bz2") returned 4 [0202.995] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.995] lstrlenW (lpString=".7z") returned 3 [0202.995] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.995] lstrlenW (lpString=".dbf") returned 4 [0202.995] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.995] lstrlenW (lpString=".1cd") returned 4 [0202.995] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEfjuT[1].jpg") returned 126 [0202.995] lstrlenW (lpString=".jpg") returned 4 [0202.995] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.995] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.995] lstrlenW (lpString="BBEgJfz[1].jpg") returned 14 [0202.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0202.996] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=6745) returned 1 [0202.997] CloseHandle (hObject=0x34c) returned 1 [0202.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg")) returned 0x2020 [0202.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0202.997] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.997] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.997] GetLastError () returned 0x0 [0202.997] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x1a59, lpOverlapped=0x0) returned 1 [0202.999] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1a60, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1a60, lpOverlapped=0x0) returned 1 [0203.000] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.000] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.000] SetEndOfFile (hFile=0x350) returned 1 [0203.000] CloseHandle (hObject=0x350) returned 1 [0203.000] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.000] SetEndOfFile (hFile=0x34c) returned 1 [0203.001] CloseHandle (hObject=0x34c) returned 1 [0203.001] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.001] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegjfz[1].jpg")) returned 1 [0203.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.002] lstrlenW (lpString=".doc") returned 4 [0203.002] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.002] lstrlenW (lpString=".docx") returned 5 [0203.002] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.002] lstrlenW (lpString=".pdf") returned 4 [0203.002] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.002] lstrlenW (lpString=".xls") returned 4 [0203.002] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.002] lstrlenW (lpString=".xlsx") returned 5 [0203.002] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.002] lstrlenW (lpString=".ppt") returned 4 [0203.002] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.002] lstrlenW (lpString=".zip") returned 4 [0203.002] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.002] lstrlenW (lpString=".rar") returned 4 [0203.002] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.002] lstrlenW (lpString=".bz2") returned 4 [0203.002] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.002] lstrlenW (lpString=".7z") returned 3 [0203.002] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.002] lstrlenW (lpString=".dbf") returned 4 [0203.002] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.002] lstrlenW (lpString=".1cd") returned 4 [0203.002] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.002] lstrlenW (lpString=".jpg") returned 4 [0203.002] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.003] lstrlenW (lpString=".doc") returned 4 [0203.003] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.003] lstrlenW (lpString=".docx") returned 5 [0203.003] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.003] lstrlenW (lpString=".pdf") returned 4 [0203.003] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.003] lstrlenW (lpString=".xls") returned 4 [0203.003] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.003] lstrlenW (lpString=".xlsx") returned 5 [0203.003] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.003] lstrlenW (lpString=".ppt") returned 4 [0203.003] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.003] lstrlenW (lpString=".zip") returned 4 [0203.003] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.003] lstrlenW (lpString=".rar") returned 4 [0203.003] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.003] lstrlenW (lpString=".bz2") returned 4 [0203.003] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.003] lstrlenW (lpString=".7z") returned 3 [0203.003] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.003] lstrlenW (lpString=".dbf") returned 4 [0203.003] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.003] lstrlenW (lpString=".1cd") returned 4 [0203.003] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgJfz[1].jpg") returned 126 [0203.003] lstrlenW (lpString=".jpg") returned 4 [0203.003] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.004] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0203.004] lstrlenW (lpString="BBEgqtY[1].jpg") returned 14 [0203.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.007] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1968) returned 1 [0203.007] CloseHandle (hObject=0x34c) returned 1 [0203.007] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg")) returned 0x2020 [0203.007] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.007] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.007] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.008] GetLastError () returned 0x0 [0203.008] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x7b0, lpOverlapped=0x0) returned 1 [0203.010] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7c0, lpOverlapped=0x0) returned 1 [0203.011] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.011] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.011] SetEndOfFile (hFile=0x350) returned 1 [0203.011] CloseHandle (hObject=0x350) returned 1 [0203.011] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.011] SetEndOfFile (hFile=0x34c) returned 1 [0203.012] CloseHandle (hObject=0x34c) returned 1 [0203.012] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.012] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegqty[1].jpg")) returned 1 [0203.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.012] lstrlenW (lpString=".doc") returned 4 [0203.012] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.012] lstrlenW (lpString=".docx") returned 5 [0203.012] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.012] lstrlenW (lpString=".pdf") returned 4 [0203.012] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.012] lstrlenW (lpString=".xls") returned 4 [0203.012] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.012] lstrlenW (lpString=".xlsx") returned 5 [0203.012] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.012] lstrlenW (lpString=".ppt") returned 4 [0203.012] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.013] lstrlenW (lpString=".zip") returned 4 [0203.013] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.013] lstrlenW (lpString=".rar") returned 4 [0203.013] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.013] lstrlenW (lpString=".bz2") returned 4 [0203.013] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.013] lstrlenW (lpString=".7z") returned 3 [0203.013] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.013] lstrlenW (lpString=".dbf") returned 4 [0203.013] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.013] lstrlenW (lpString=".1cd") returned 4 [0203.013] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.013] lstrlenW (lpString=".jpg") returned 4 [0203.013] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.013] lstrlenW (lpString=".doc") returned 4 [0203.013] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.013] lstrlenW (lpString=".docx") returned 5 [0203.013] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.013] lstrlenW (lpString=".pdf") returned 4 [0203.013] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.013] lstrlenW (lpString=".xls") returned 4 [0203.013] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.013] lstrlenW (lpString=".xlsx") returned 5 [0203.013] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.013] lstrlenW (lpString=".ppt") returned 4 [0203.013] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.013] lstrlenW (lpString=".zip") returned 4 [0203.014] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.014] lstrlenW (lpString=".rar") returned 4 [0203.014] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.014] lstrlenW (lpString=".bz2") returned 4 [0203.014] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.014] lstrlenW (lpString=".7z") returned 3 [0203.014] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.014] lstrlenW (lpString=".dbf") returned 4 [0203.014] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.014] lstrlenW (lpString=".1cd") returned 4 [0203.014] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgqtY[1].jpg") returned 126 [0203.014] lstrlenW (lpString=".jpg") returned 4 [0203.014] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.014] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0203.014] lstrlenW (lpString="BBEgsz3[1].jpg") returned 14 [0203.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.015] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=17644) returned 1 [0203.015] CloseHandle (hObject=0x34c) returned 1 [0203.015] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg")) returned 0x2020 [0203.016] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.016] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.016] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.016] GetLastError () returned 0x0 [0203.016] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x44ec, lpOverlapped=0x0) returned 1 [0203.018] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x44f0, lpOverlapped=0x0) returned 1 [0203.019] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.019] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.019] SetEndOfFile (hFile=0x350) returned 1 [0203.019] CloseHandle (hObject=0x350) returned 1 [0203.020] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.020] SetEndOfFile (hFile=0x34c) returned 1 [0203.020] CloseHandle (hObject=0x34c) returned 1 [0203.021] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.021] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegsz3[1].jpg")) returned 1 [0203.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.021] lstrlenW (lpString=".doc") returned 4 [0203.021] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.021] lstrlenW (lpString=".docx") returned 5 [0203.021] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.021] lstrlenW (lpString=".pdf") returned 4 [0203.021] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.021] lstrlenW (lpString=".xls") returned 4 [0203.021] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.021] lstrlenW (lpString=".xlsx") returned 5 [0203.021] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.021] lstrlenW (lpString=".ppt") returned 4 [0203.021] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.021] lstrlenW (lpString=".zip") returned 4 [0203.021] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.021] lstrlenW (lpString=".rar") returned 4 [0203.021] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.021] lstrlenW (lpString=".bz2") returned 4 [0203.021] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.021] lstrlenW (lpString=".7z") returned 3 [0203.022] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.022] lstrlenW (lpString=".dbf") returned 4 [0203.022] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.022] lstrlenW (lpString=".1cd") returned 4 [0203.022] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.022] lstrlenW (lpString=".jpg") returned 4 [0203.022] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.022] lstrlenW (lpString=".doc") returned 4 [0203.022] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.022] lstrlenW (lpString=".docx") returned 5 [0203.022] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.022] lstrlenW (lpString=".pdf") returned 4 [0203.022] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.022] lstrlenW (lpString=".xls") returned 4 [0203.022] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.022] lstrlenW (lpString=".xlsx") returned 5 [0203.022] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.022] lstrlenW (lpString=".ppt") returned 4 [0203.022] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.022] lstrlenW (lpString=".zip") returned 4 [0203.022] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.022] lstrlenW (lpString=".rar") returned 4 [0203.022] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.022] lstrlenW (lpString=".bz2") returned 4 [0203.022] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.022] lstrlenW (lpString=".7z") returned 3 [0203.022] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.023] lstrlenW (lpString=".dbf") returned 4 [0203.023] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.023] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.023] lstrlenW (lpString=".1cd") returned 4 [0203.023] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.023] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgsz3[1].jpg") returned 126 [0203.023] lstrlenW (lpString=".jpg") returned 4 [0203.023] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.023] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0203.023] lstrlenW (lpString="BBEgtcS[1].jpg") returned 14 [0203.023] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.024] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5915) returned 1 [0203.024] CloseHandle (hObject=0x34c) returned 1 [0203.024] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg")) returned 0x2020 [0203.024] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.024] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.024] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.024] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.025] GetLastError () returned 0x0 [0203.025] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x171b, lpOverlapped=0x0) returned 1 [0203.099] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1720, lpOverlapped=0x0) returned 1 [0203.100] ReadFile (in: hFile=0x34c, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.100] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.100] SetEndOfFile (hFile=0x350) returned 1 [0203.104] CloseHandle (hObject=0x350) returned 1 [0203.104] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.104] SetEndOfFile (hFile=0x34c) returned 1 [0203.107] CloseHandle (hObject=0x34c) returned 1 [0203.109] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.111] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegtcs[1].jpg")) returned 1 [0203.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.236] lstrlenW (lpString=".doc") returned 4 [0203.236] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.236] lstrlenW (lpString=".docx") returned 5 [0203.236] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.236] lstrlenW (lpString=".pdf") returned 4 [0203.236] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.236] lstrlenW (lpString=".xls") returned 4 [0203.236] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.236] lstrlenW (lpString=".xlsx") returned 5 [0203.236] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.236] lstrlenW (lpString=".ppt") returned 4 [0203.236] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.236] lstrlenW (lpString=".zip") returned 4 [0203.236] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.236] lstrlenW (lpString=".rar") returned 4 [0203.236] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.236] lstrlenW (lpString=".bz2") returned 4 [0203.237] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.237] lstrlenW (lpString=".7z") returned 3 [0203.237] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.237] lstrlenW (lpString=".dbf") returned 4 [0203.237] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.237] lstrlenW (lpString=".1cd") returned 4 [0203.237] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.237] lstrlenW (lpString=".jpg") returned 4 [0203.237] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.237] lstrlenW (lpString=".doc") returned 4 [0203.237] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.237] lstrlenW (lpString=".docx") returned 5 [0203.237] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.237] lstrlenW (lpString=".pdf") returned 4 [0203.237] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.237] lstrlenW (lpString=".xls") returned 4 [0203.237] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.237] lstrlenW (lpString=".xlsx") returned 5 [0203.237] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.237] lstrlenW (lpString=".ppt") returned 4 [0203.237] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.237] lstrlenW (lpString=".zip") returned 4 [0203.237] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.237] lstrlenW (lpString=".rar") returned 4 [0203.237] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.237] lstrlenW (lpString=".bz2") returned 4 [0203.237] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.237] lstrlenW (lpString=".7z") returned 3 [0203.238] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.238] lstrlenW (lpString=".dbf") returned 4 [0203.238] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.238] lstrlenW (lpString=".1cd") returned 4 [0203.238] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgtcS[1].jpg") returned 126 [0203.238] lstrlenW (lpString=".jpg") returned 4 [0203.238] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.238] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0203.238] lstrlenW (lpString="chrome-new[1].jpg") returned 17 [0203.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.379] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=68716) returned 1 [0203.379] CloseHandle (hObject=0x354) returned 1 [0203.379] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg")) returned 0x2020 [0203.379] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.379] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.379] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.380] GetLastError () returned 0x0 [0203.380] ReadFile (in: hFile=0x354, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x10c6c, lpOverlapped=0x0) returned 1 [0203.383] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x10c70, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x10c70, lpOverlapped=0x0) returned 1 [0203.385] ReadFile (in: hFile=0x354, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.385] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0203.385] SetEndOfFile (hFile=0x350) returned 1 [0203.385] CloseHandle (hObject=0x350) returned 1 [0203.385] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.385] SetEndOfFile (hFile=0x354) returned 1 [0203.386] CloseHandle (hObject=0x354) returned 1 [0203.386] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.386] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\chrome-new[1].jpg")) returned 1 [0203.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.387] lstrlenW (lpString=".doc") returned 4 [0203.387] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.387] lstrlenW (lpString=".docx") returned 5 [0203.387] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.387] lstrlenW (lpString=".pdf") returned 4 [0203.387] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.387] lstrlenW (lpString=".xls") returned 4 [0203.387] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.387] lstrlenW (lpString=".xlsx") returned 5 [0203.387] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.387] lstrlenW (lpString=".ppt") returned 4 [0203.387] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.387] lstrlenW (lpString=".zip") returned 4 [0203.387] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.387] lstrlenW (lpString=".rar") returned 4 [0203.387] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.387] lstrlenW (lpString=".bz2") returned 4 [0203.387] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.387] lstrlenW (lpString=".7z") returned 3 [0203.387] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.387] lstrlenW (lpString=".dbf") returned 4 [0203.387] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.387] lstrlenW (lpString=".1cd") returned 4 [0203.387] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.387] lstrlenW (lpString=".jpg") returned 4 [0203.387] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.388] lstrlenW (lpString=".doc") returned 4 [0203.388] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.388] lstrlenW (lpString=".docx") returned 5 [0203.388] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.388] lstrlenW (lpString=".pdf") returned 4 [0203.388] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.388] lstrlenW (lpString=".xls") returned 4 [0203.388] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.388] lstrlenW (lpString=".xlsx") returned 5 [0203.388] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.388] lstrlenW (lpString=".ppt") returned 4 [0203.388] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.388] lstrlenW (lpString=".zip") returned 4 [0203.388] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.388] lstrlenW (lpString=".rar") returned 4 [0203.388] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.388] lstrlenW (lpString=".bz2") returned 4 [0203.388] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.388] lstrlenW (lpString=".7z") returned 3 [0203.388] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.388] lstrlenW (lpString=".dbf") returned 4 [0203.388] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.388] lstrlenW (lpString=".1cd") returned 4 [0203.388] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\chrome-new[1].jpg") returned 129 [0203.388] lstrlenW (lpString=".jpg") returned 4 [0203.388] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.389] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0203.389] lstrlenW (lpString="ContainerTag[1].js") returned 18 [0203.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.390] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1969) returned 1 [0203.390] CloseHandle (hObject=0x354) returned 1 [0203.390] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js")) returned 0x2020 [0203.390] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.390] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.390] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.390] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.391] GetLastError () returned 0x0 [0203.391] ReadFile (in: hFile=0x354, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x7b1, lpOverlapped=0x0) returned 1 [0203.392] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7c0, lpOverlapped=0x0) returned 1 [0203.393] ReadFile (in: hFile=0x354, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.393] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0203.393] SetEndOfFile (hFile=0x350) returned 1 [0203.393] CloseHandle (hObject=0x350) returned 1 [0203.393] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.393] SetEndOfFile (hFile=0x354) returned 1 [0203.394] CloseHandle (hObject=0x354) returned 1 [0203.394] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.394] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[1].js")) returned 1 [0203.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.395] lstrlenW (lpString=".doc") returned 4 [0203.395] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0203.395] lstrlenW (lpString=".docx") returned 5 [0203.395] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0203.395] lstrlenW (lpString=".pdf") returned 4 [0203.395] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0203.395] lstrlenW (lpString=".xls") returned 4 [0203.395] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0203.395] lstrlenW (lpString=".xlsx") returned 5 [0203.395] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0203.395] lstrlenW (lpString=".ppt") returned 4 [0203.395] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0203.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.395] lstrlenW (lpString=".zip") returned 4 [0203.395] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0203.395] lstrlenW (lpString=".rar") returned 4 [0203.395] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0203.395] lstrlenW (lpString=".bz2") returned 4 [0203.395] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0203.395] lstrlenW (lpString=".7z") returned 3 [0203.395] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0203.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.395] lstrlenW (lpString=".dbf") returned 4 [0203.395] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0203.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.395] lstrlenW (lpString=".1cd") returned 4 [0203.395] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0203.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.395] lstrlenW (lpString=".jpg") returned 4 [0203.395] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0203.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.395] lstrlenW (lpString=".doc") returned 4 [0203.395] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0203.396] lstrlenW (lpString=".docx") returned 5 [0203.396] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0203.396] lstrlenW (lpString=".pdf") returned 4 [0203.396] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0203.396] lstrlenW (lpString=".xls") returned 4 [0203.396] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0203.396] lstrlenW (lpString=".xlsx") returned 5 [0203.396] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0203.396] lstrlenW (lpString=".ppt") returned 4 [0203.396] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0203.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.396] lstrlenW (lpString=".zip") returned 4 [0203.396] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0203.396] lstrlenW (lpString=".rar") returned 4 [0203.396] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0203.396] lstrlenW (lpString=".bz2") returned 4 [0203.396] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0203.396] lstrlenW (lpString=".7z") returned 3 [0203.396] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0203.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.396] lstrlenW (lpString=".dbf") returned 4 [0203.396] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0203.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.396] lstrlenW (lpString=".1cd") returned 4 [0203.396] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0203.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[1].js") returned 130 [0203.396] lstrlenW (lpString=".jpg") returned 4 [0203.396] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0203.396] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0203.396] lstrlenW (lpString="ContainerTag[2].js") returned 18 [0203.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.397] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=1969) returned 1 [0203.397] CloseHandle (hObject=0x354) returned 1 [0203.397] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js")) returned 0x2020 [0203.397] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.397] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.397] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.398] GetLastError () returned 0x0 [0203.398] ReadFile (in: hFile=0x354, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x7b1, lpOverlapped=0x0) returned 1 [0203.399] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x7c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7c0, lpOverlapped=0x0) returned 1 [0203.400] ReadFile (in: hFile=0x354, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.400] WriteFile (in: hFile=0x350, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0203.400] SetEndOfFile (hFile=0x350) returned 1 [0203.401] CloseHandle (hObject=0x350) returned 1 [0203.401] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.401] SetEndOfFile (hFile=0x354) returned 1 [0203.401] CloseHandle (hObject=0x354) returned 1 [0203.402] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.402] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\containertag[2].js")) returned 1 [0203.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.402] lstrlenW (lpString=".doc") returned 4 [0203.402] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0203.402] lstrlenW (lpString=".docx") returned 5 [0203.402] lstrcmpiW (lpString1=".docx", lpString2="2].js") returned -1 [0203.402] lstrlenW (lpString=".pdf") returned 4 [0203.402] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0203.402] lstrlenW (lpString=".xls") returned 4 [0203.402] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0203.402] lstrlenW (lpString=".xlsx") returned 5 [0203.402] lstrcmpiW (lpString1=".xlsx", lpString2="2].js") returned -1 [0203.402] lstrlenW (lpString=".ppt") returned 4 [0203.402] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0203.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.402] lstrlenW (lpString=".zip") returned 4 [0203.402] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0203.402] lstrlenW (lpString=".rar") returned 4 [0203.402] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0203.402] lstrlenW (lpString=".bz2") returned 4 [0203.402] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0203.402] lstrlenW (lpString=".7z") returned 3 [0203.403] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0203.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.403] lstrlenW (lpString=".dbf") returned 4 [0203.403] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0203.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.403] lstrlenW (lpString=".1cd") returned 4 [0203.403] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0203.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.403] lstrlenW (lpString=".jpg") returned 4 [0203.403] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0203.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.403] lstrlenW (lpString=".doc") returned 4 [0203.403] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0203.403] lstrlenW (lpString=".docx") returned 5 [0203.403] lstrcmpiW (lpString1=".docx", lpString2="2].js") returned -1 [0203.403] lstrlenW (lpString=".pdf") returned 4 [0203.403] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0203.403] lstrlenW (lpString=".xls") returned 4 [0203.403] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0203.403] lstrlenW (lpString=".xlsx") returned 5 [0203.403] lstrcmpiW (lpString1=".xlsx", lpString2="2].js") returned -1 [0203.403] lstrlenW (lpString=".ppt") returned 4 [0203.403] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0203.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.403] lstrlenW (lpString=".zip") returned 4 [0203.403] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0203.403] lstrlenW (lpString=".rar") returned 4 [0203.403] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0203.403] lstrlenW (lpString=".bz2") returned 4 [0203.403] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0203.403] lstrlenW (lpString=".7z") returned 3 [0203.403] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0203.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.404] lstrlenW (lpString=".dbf") returned 4 [0203.404] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0203.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.404] lstrlenW (lpString=".1cd") returned 4 [0203.404] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0203.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ContainerTag[2].js") returned 130 [0203.404] lstrlenW (lpString=".jpg") returned 4 [0203.404] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0203.404] lstrcmpiW (lpString1=".txt", lpString2=".wiki") returned -1 [0203.404] lstrlenW (lpString="css[2].txt") returned 10 [0203.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.405] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=187) returned 1 [0203.405] CloseHandle (hObject=0x378) returned 1 [0203.405] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt")) returned 0x2020 [0203.405] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.405] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.405] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.406] GetLastError () returned 0x0 [0203.406] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xbb, lpOverlapped=0x0) returned 1 [0203.407] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xc0, lpOverlapped=0x0) returned 1 [0203.408] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.408] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0203.408] SetEndOfFile (hFile=0x354) returned 1 [0203.408] CloseHandle (hObject=0x354) returned 1 [0203.408] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.408] SetEndOfFile (hFile=0x378) returned 1 [0203.409] CloseHandle (hObject=0x378) returned 1 [0203.409] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.409] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\css[2].txt")) returned 1 [0203.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.409] lstrlenW (lpString=".doc") returned 4 [0203.409] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0203.409] lstrlenW (lpString=".docx") returned 5 [0203.409] lstrcmpiW (lpString1=".docx", lpString2="].txt") returned -1 [0203.409] lstrlenW (lpString=".pdf") returned 4 [0203.409] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0203.409] lstrlenW (lpString=".xls") returned 4 [0203.409] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0203.409] lstrlenW (lpString=".xlsx") returned 5 [0203.409] lstrcmpiW (lpString1=".xlsx", lpString2="].txt") returned -1 [0203.409] lstrlenW (lpString=".ppt") returned 4 [0203.409] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0203.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.410] lstrlenW (lpString=".zip") returned 4 [0203.410] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0203.410] lstrlenW (lpString=".rar") returned 4 [0203.410] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0203.410] lstrlenW (lpString=".bz2") returned 4 [0203.410] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0203.410] lstrlenW (lpString=".7z") returned 3 [0203.410] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0203.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.410] lstrlenW (lpString=".dbf") returned 4 [0203.410] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0203.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.410] lstrlenW (lpString=".1cd") returned 4 [0203.410] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0203.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.410] lstrlenW (lpString=".jpg") returned 4 [0203.410] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0203.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.410] lstrlenW (lpString=".doc") returned 4 [0203.410] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0203.410] lstrlenW (lpString=".docx") returned 5 [0203.410] lstrcmpiW (lpString1=".docx", lpString2="].txt") returned -1 [0203.410] lstrlenW (lpString=".pdf") returned 4 [0203.410] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0203.410] lstrlenW (lpString=".xls") returned 4 [0203.410] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0203.410] lstrlenW (lpString=".xlsx") returned 5 [0203.410] lstrcmpiW (lpString1=".xlsx", lpString2="].txt") returned -1 [0203.410] lstrlenW (lpString=".ppt") returned 4 [0203.410] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0203.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.410] lstrlenW (lpString=".zip") returned 4 [0203.411] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0203.411] lstrlenW (lpString=".rar") returned 4 [0203.411] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0203.411] lstrlenW (lpString=".bz2") returned 4 [0203.411] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0203.411] lstrlenW (lpString=".7z") returned 3 [0203.411] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0203.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.411] lstrlenW (lpString=".dbf") returned 4 [0203.411] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0203.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.411] lstrlenW (lpString=".1cd") returned 4 [0203.411] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0203.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\css[2].txt") returned 122 [0203.411] lstrlenW (lpString=".jpg") returned 4 [0203.411] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0203.411] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0203.411] lstrlenW (lpString="desktop.ini") returned 11 [0203.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.412] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=67) returned 1 [0203.412] CloseHandle (hObject=0x378) returned 1 [0203.412] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini")) returned 0x2006 [0203.412] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.412] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.412] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.412] GetLastError () returned 0x0 [0203.413] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x43, lpOverlapped=0x0) returned 1 [0203.413] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x50, lpOverlapped=0x0) returned 1 [0203.414] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.414] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xea, lpOverlapped=0x0) returned 1 [0203.414] SetEndOfFile (hFile=0x354) returned 1 [0203.414] CloseHandle (hObject=0x354) returned 1 [0203.415] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.415] SetEndOfFile (hFile=0x378) returned 1 [0203.415] CloseHandle (hObject=0x378) returned 1 [0203.415] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2006) returned 1 [0203.416] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\desktop.ini")) returned 1 [0203.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.416] lstrlenW (lpString=".doc") returned 4 [0203.416] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0203.416] lstrlenW (lpString=".docx") returned 5 [0203.416] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0203.416] lstrlenW (lpString=".pdf") returned 4 [0203.416] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0203.416] lstrlenW (lpString=".xls") returned 4 [0203.416] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0203.416] lstrlenW (lpString=".xlsx") returned 5 [0203.416] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0203.416] lstrlenW (lpString=".ppt") returned 4 [0203.416] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0203.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.416] lstrlenW (lpString=".zip") returned 4 [0203.416] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0203.416] lstrlenW (lpString=".rar") returned 4 [0203.416] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0203.416] lstrlenW (lpString=".bz2") returned 4 [0203.416] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0203.416] lstrlenW (lpString=".7z") returned 3 [0203.416] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0203.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.416] lstrlenW (lpString=".dbf") returned 4 [0203.416] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0203.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.416] lstrlenW (lpString=".1cd") returned 4 [0203.417] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0203.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.417] lstrlenW (lpString=".jpg") returned 4 [0203.417] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0203.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.417] lstrlenW (lpString=".doc") returned 4 [0203.417] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0203.417] lstrlenW (lpString=".docx") returned 5 [0203.417] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0203.417] lstrlenW (lpString=".pdf") returned 4 [0203.417] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0203.417] lstrlenW (lpString=".xls") returned 4 [0203.417] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0203.417] lstrlenW (lpString=".xlsx") returned 5 [0203.417] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0203.417] lstrlenW (lpString=".ppt") returned 4 [0203.417] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0203.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.417] lstrlenW (lpString=".zip") returned 4 [0203.417] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0203.417] lstrlenW (lpString=".rar") returned 4 [0203.417] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0203.417] lstrlenW (lpString=".bz2") returned 4 [0203.417] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0203.417] lstrlenW (lpString=".7z") returned 3 [0203.417] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0203.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.417] lstrlenW (lpString=".dbf") returned 4 [0203.417] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0203.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.417] lstrlenW (lpString=".1cd") returned 4 [0203.417] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0203.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\desktop.ini") returned 123 [0203.418] lstrlenW (lpString=".jpg") returned 4 [0203.418] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0203.418] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0203.418] lstrlenW (lpString="fallback_728x90[1].jpg") returned 22 [0203.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.419] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=32632) returned 1 [0203.419] CloseHandle (hObject=0x378) returned 1 [0203.419] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg")) returned 0x2020 [0203.419] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.419] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.419] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.420] GetLastError () returned 0x0 [0203.420] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x7f78, lpOverlapped=0x0) returned 1 [0203.422] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x7f80, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x7f80, lpOverlapped=0x0) returned 1 [0203.423] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.423] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x100, lpOverlapped=0x0) returned 1 [0203.424] SetEndOfFile (hFile=0x354) returned 1 [0203.424] CloseHandle (hObject=0x354) returned 1 [0203.424] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.424] SetEndOfFile (hFile=0x378) returned 1 [0203.425] CloseHandle (hObject=0x378) returned 1 [0203.425] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.425] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\fallback_728x90[1].jpg")) returned 1 [0203.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.425] lstrlenW (lpString=".doc") returned 4 [0203.425] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.425] lstrlenW (lpString=".docx") returned 5 [0203.425] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.425] lstrlenW (lpString=".pdf") returned 4 [0203.425] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.425] lstrlenW (lpString=".xls") returned 4 [0203.425] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.425] lstrlenW (lpString=".xlsx") returned 5 [0203.426] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.426] lstrlenW (lpString=".ppt") returned 4 [0203.426] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.426] lstrlenW (lpString=".zip") returned 4 [0203.426] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.426] lstrlenW (lpString=".rar") returned 4 [0203.426] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.426] lstrlenW (lpString=".bz2") returned 4 [0203.426] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.426] lstrlenW (lpString=".7z") returned 3 [0203.426] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.426] lstrlenW (lpString=".dbf") returned 4 [0203.426] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.426] lstrlenW (lpString=".1cd") returned 4 [0203.426] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.426] lstrlenW (lpString=".jpg") returned 4 [0203.426] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.426] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.426] lstrlenW (lpString=".doc") returned 4 [0203.426] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.426] lstrlenW (lpString=".docx") returned 5 [0203.426] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.426] lstrlenW (lpString=".pdf") returned 4 [0203.426] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.426] lstrlenW (lpString=".xls") returned 4 [0203.426] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.426] lstrlenW (lpString=".xlsx") returned 5 [0203.426] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.427] lstrlenW (lpString=".ppt") returned 4 [0203.427] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.427] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.427] lstrlenW (lpString=".zip") returned 4 [0203.427] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.427] lstrlenW (lpString=".rar") returned 4 [0203.427] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.427] lstrlenW (lpString=".bz2") returned 4 [0203.427] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.427] lstrlenW (lpString=".7z") returned 3 [0203.427] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.427] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.427] lstrlenW (lpString=".dbf") returned 4 [0203.427] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.427] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.427] lstrlenW (lpString=".1cd") returned 4 [0203.427] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.427] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\fallback_728x90[1].jpg") returned 134 [0203.427] lstrlenW (lpString=".jpg") returned 4 [0203.427] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.427] lstrcmpiW (lpString1=".txt", lpString2=".wiki") returned -1 [0203.427] lstrlenW (lpString="ie8[1].txt") returned 10 [0203.427] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.428] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=102) returned 1 [0203.428] CloseHandle (hObject=0x378) returned 1 [0203.428] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt")) returned 0x2020 [0203.428] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.428] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.428] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.428] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.429] GetLastError () returned 0x0 [0203.429] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x66, lpOverlapped=0x0) returned 1 [0203.430] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x70, lpOverlapped=0x0) returned 1 [0203.431] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.431] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0203.431] SetEndOfFile (hFile=0x354) returned 1 [0203.431] CloseHandle (hObject=0x354) returned 1 [0203.432] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.432] SetEndOfFile (hFile=0x378) returned 1 [0203.432] CloseHandle (hObject=0x378) returned 1 [0203.432] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.433] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\ie8[1].txt")) returned 1 [0203.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.433] lstrlenW (lpString=".doc") returned 4 [0203.433] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0203.433] lstrlenW (lpString=".docx") returned 5 [0203.433] lstrcmpiW (lpString1=".docx", lpString2="].txt") returned -1 [0203.433] lstrlenW (lpString=".pdf") returned 4 [0203.433] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0203.433] lstrlenW (lpString=".xls") returned 4 [0203.433] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0203.433] lstrlenW (lpString=".xlsx") returned 5 [0203.433] lstrcmpiW (lpString1=".xlsx", lpString2="].txt") returned -1 [0203.433] lstrlenW (lpString=".ppt") returned 4 [0203.433] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0203.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.433] lstrlenW (lpString=".zip") returned 4 [0203.433] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0203.433] lstrlenW (lpString=".rar") returned 4 [0203.433] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0203.433] lstrlenW (lpString=".bz2") returned 4 [0203.433] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0203.433] lstrlenW (lpString=".7z") returned 3 [0203.433] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0203.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.433] lstrlenW (lpString=".dbf") returned 4 [0203.433] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0203.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.433] lstrlenW (lpString=".1cd") returned 4 [0203.434] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0203.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.434] lstrlenW (lpString=".jpg") returned 4 [0203.434] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0203.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.434] lstrlenW (lpString=".doc") returned 4 [0203.434] lstrcmpiW (lpString1=".doc", lpString2=".txt") returned -1 [0203.434] lstrlenW (lpString=".docx") returned 5 [0203.434] lstrcmpiW (lpString1=".docx", lpString2="].txt") returned -1 [0203.434] lstrlenW (lpString=".pdf") returned 4 [0203.434] lstrcmpiW (lpString1=".pdf", lpString2=".txt") returned -1 [0203.434] lstrlenW (lpString=".xls") returned 4 [0203.434] lstrcmpiW (lpString1=".xls", lpString2=".txt") returned 1 [0203.434] lstrlenW (lpString=".xlsx") returned 5 [0203.434] lstrcmpiW (lpString1=".xlsx", lpString2="].txt") returned -1 [0203.434] lstrlenW (lpString=".ppt") returned 4 [0203.434] lstrcmpiW (lpString1=".ppt", lpString2=".txt") returned -1 [0203.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.434] lstrlenW (lpString=".zip") returned 4 [0203.434] lstrcmpiW (lpString1=".zip", lpString2=".txt") returned 1 [0203.434] lstrlenW (lpString=".rar") returned 4 [0203.434] lstrcmpiW (lpString1=".rar", lpString2=".txt") returned -1 [0203.434] lstrlenW (lpString=".bz2") returned 4 [0203.434] lstrcmpiW (lpString1=".bz2", lpString2=".txt") returned -1 [0203.434] lstrlenW (lpString=".7z") returned 3 [0203.434] lstrcmpiW (lpString1=".7z", lpString2="txt") returned -1 [0203.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.434] lstrlenW (lpString=".dbf") returned 4 [0203.434] lstrcmpiW (lpString1=".dbf", lpString2=".txt") returned -1 [0203.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.434] lstrlenW (lpString=".1cd") returned 4 [0203.435] lstrcmpiW (lpString1=".1cd", lpString2=".txt") returned -1 [0203.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\ie8[1].txt") returned 122 [0203.435] lstrlenW (lpString=".jpg") returned 4 [0203.435] lstrcmpiW (lpString1=".jpg", lpString2=".txt") returned -1 [0203.435] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0203.435] lstrlenW (lpString="only[1].htm") returned 11 [0203.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\only[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.436] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=0) returned 1 [0203.436] CloseHandle (hObject=0x378) returned 1 [0203.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.436] lstrlenW (lpString=".doc") returned 4 [0203.436] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0203.436] lstrlenW (lpString=".docx") returned 5 [0203.436] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0203.436] lstrlenW (lpString=".pdf") returned 4 [0203.436] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0203.436] lstrlenW (lpString=".xls") returned 4 [0203.436] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0203.436] lstrlenW (lpString=".xlsx") returned 5 [0203.436] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0203.436] lstrlenW (lpString=".ppt") returned 4 [0203.436] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0203.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.436] lstrlenW (lpString=".zip") returned 4 [0203.436] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0203.436] lstrlenW (lpString=".rar") returned 4 [0203.437] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0203.437] lstrlenW (lpString=".bz2") returned 4 [0203.437] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0203.437] lstrlenW (lpString=".7z") returned 3 [0203.437] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0203.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.437] lstrlenW (lpString=".dbf") returned 4 [0203.437] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0203.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.437] lstrlenW (lpString=".1cd") returned 4 [0203.437] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0203.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.437] lstrlenW (lpString=".jpg") returned 4 [0203.437] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0203.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.437] lstrlenW (lpString=".doc") returned 4 [0203.437] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0203.437] lstrlenW (lpString=".docx") returned 5 [0203.437] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0203.437] lstrlenW (lpString=".pdf") returned 4 [0203.437] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0203.437] lstrlenW (lpString=".xls") returned 4 [0203.437] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0203.437] lstrlenW (lpString=".xlsx") returned 5 [0203.437] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0203.437] lstrlenW (lpString=".ppt") returned 4 [0203.437] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0203.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.437] lstrlenW (lpString=".zip") returned 4 [0203.437] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0203.437] lstrlenW (lpString=".rar") returned 4 [0203.437] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0203.438] lstrlenW (lpString=".bz2") returned 4 [0203.438] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0203.438] lstrlenW (lpString=".7z") returned 3 [0203.438] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0203.438] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.438] lstrlenW (lpString=".dbf") returned 4 [0203.438] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0203.438] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.438] lstrlenW (lpString=".1cd") returned 4 [0203.438] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0203.438] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\only[1].htm") returned 123 [0203.438] lstrlenW (lpString=".jpg") returned 4 [0203.438] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0203.438] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0203.438] lstrlenW (lpString="Passport[1].htm") returned 15 [0203.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.439] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=320) returned 1 [0203.439] CloseHandle (hObject=0x378) returned 1 [0203.439] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm")) returned 0x2020 [0203.439] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.439] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.439] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.440] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.440] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.440] GetLastError () returned 0x0 [0203.440] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x140, lpOverlapped=0x0) returned 1 [0203.442] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x150, lpOverlapped=0x0) returned 1 [0203.443] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.443] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0203.443] SetEndOfFile (hFile=0x354) returned 1 [0203.443] CloseHandle (hObject=0x354) returned 1 [0203.443] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.443] SetEndOfFile (hFile=0x378) returned 1 [0203.444] CloseHandle (hObject=0x378) returned 1 [0203.444] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.444] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\passport[1].htm")) returned 1 [0203.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.444] lstrlenW (lpString=".doc") returned 4 [0203.444] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0203.445] lstrlenW (lpString=".docx") returned 5 [0203.445] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0203.445] lstrlenW (lpString=".pdf") returned 4 [0203.445] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0203.445] lstrlenW (lpString=".xls") returned 4 [0203.445] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0203.445] lstrlenW (lpString=".xlsx") returned 5 [0203.445] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0203.445] lstrlenW (lpString=".ppt") returned 4 [0203.445] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0203.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.445] lstrlenW (lpString=".zip") returned 4 [0203.445] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0203.445] lstrlenW (lpString=".rar") returned 4 [0203.445] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0203.445] lstrlenW (lpString=".bz2") returned 4 [0203.445] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0203.445] lstrlenW (lpString=".7z") returned 3 [0203.445] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0203.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.445] lstrlenW (lpString=".dbf") returned 4 [0203.445] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0203.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.445] lstrlenW (lpString=".1cd") returned 4 [0203.445] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0203.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.445] lstrlenW (lpString=".jpg") returned 4 [0203.445] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0203.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.445] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.445] lstrlenW (lpString=".doc") returned 4 [0203.445] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0203.445] lstrlenW (lpString=".docx") returned 5 [0203.445] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0203.446] lstrlenW (lpString=".pdf") returned 4 [0203.446] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0203.446] lstrlenW (lpString=".xls") returned 4 [0203.446] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0203.446] lstrlenW (lpString=".xlsx") returned 5 [0203.446] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0203.446] lstrlenW (lpString=".ppt") returned 4 [0203.446] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0203.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.446] lstrlenW (lpString=".zip") returned 4 [0203.446] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0203.446] lstrlenW (lpString=".rar") returned 4 [0203.446] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0203.446] lstrlenW (lpString=".bz2") returned 4 [0203.446] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0203.446] lstrlenW (lpString=".7z") returned 3 [0203.446] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0203.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.446] lstrlenW (lpString=".dbf") returned 4 [0203.446] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0203.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.446] lstrlenW (lpString=".1cd") returned 4 [0203.446] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0203.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\Passport[1].htm") returned 127 [0203.446] lstrlenW (lpString=".jpg") returned 4 [0203.446] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0203.446] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0203.446] lstrlenW (lpString="plusone[1].js") returned 13 [0203.446] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.447] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=40754) returned 1 [0203.448] CloseHandle (hObject=0x378) returned 1 [0203.448] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js")) returned 0x2020 [0203.448] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.448] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.448] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.448] GetLastError () returned 0x0 [0203.448] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x9f32, lpOverlapped=0x0) returned 1 [0203.526] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x9f40, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9f40, lpOverlapped=0x0) returned 1 [0203.527] ReadFile (in: hFile=0x378, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.527] WriteFile (in: hFile=0x354, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xee, lpOverlapped=0x0) returned 1 [0203.528] SetEndOfFile (hFile=0x354) returned 1 [0203.618] CloseHandle (hObject=0x354) returned 1 [0203.618] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.618] SetEndOfFile (hFile=0x378) returned 1 [0203.631] CloseHandle (hObject=0x378) returned 1 [0203.631] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.645] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\plusone[1].js")) returned 1 [0203.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.645] lstrlenW (lpString=".doc") returned 4 [0203.645] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0203.645] lstrlenW (lpString=".docx") returned 5 [0203.645] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0203.645] lstrlenW (lpString=".pdf") returned 4 [0203.645] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0203.645] lstrlenW (lpString=".xls") returned 4 [0203.645] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0203.645] lstrlenW (lpString=".xlsx") returned 5 [0203.645] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0203.646] lstrlenW (lpString=".ppt") returned 4 [0203.646] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0203.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.646] lstrlenW (lpString=".zip") returned 4 [0203.646] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0203.646] lstrlenW (lpString=".rar") returned 4 [0203.646] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0203.646] lstrlenW (lpString=".bz2") returned 4 [0203.646] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0203.646] lstrlenW (lpString=".7z") returned 3 [0203.646] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0203.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.646] lstrlenW (lpString=".dbf") returned 4 [0203.646] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0203.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.646] lstrlenW (lpString=".1cd") returned 4 [0203.646] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0203.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.646] lstrlenW (lpString=".jpg") returned 4 [0203.646] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0203.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.646] lstrlenW (lpString=".doc") returned 4 [0203.646] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0203.646] lstrlenW (lpString=".docx") returned 5 [0203.646] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0203.646] lstrlenW (lpString=".pdf") returned 4 [0203.646] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0203.646] lstrlenW (lpString=".xls") returned 4 [0203.646] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0203.646] lstrlenW (lpString=".xlsx") returned 5 [0203.646] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0203.646] lstrlenW (lpString=".ppt") returned 4 [0203.647] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0203.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.647] lstrlenW (lpString=".zip") returned 4 [0203.647] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0203.647] lstrlenW (lpString=".rar") returned 4 [0203.647] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0203.647] lstrlenW (lpString=".bz2") returned 4 [0203.647] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0203.647] lstrlenW (lpString=".7z") returned 3 [0203.647] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0203.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.647] lstrlenW (lpString=".dbf") returned 4 [0203.647] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0203.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.647] lstrlenW (lpString=".1cd") returned 4 [0203.647] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0203.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\plusone[1].js") returned 125 [0203.647] lstrlenW (lpString=".jpg") returned 4 [0203.647] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0203.647] lstrcmpiW (lpString1=".gif", lpString2=".wiki") returned -1 [0203.647] lstrlenW (lpString="000000929096[1].gif") returned 19 [0203.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.160] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=58453) returned 1 [0204.160] CloseHandle (hObject=0x114) returned 1 [0204.160] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif")) returned 0x2020 [0204.160] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.218] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.218] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.218] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0204.228] GetLastError () returned 0x0 [0204.228] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0xe455, lpOverlapped=0x0) returned 1 [0204.231] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xe460, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xe460, lpOverlapped=0x0) returned 1 [0204.233] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.233] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0204.233] SetEndOfFile (hFile=0x150) returned 1 [0204.233] CloseHandle (hObject=0x150) returned 1 [0204.233] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.233] SetEndOfFile (hFile=0x114) returned 1 [0204.234] CloseHandle (hObject=0x114) returned 1 [0204.235] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.235] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\000000929096[1].gif")) returned 1 [0204.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.235] lstrlenW (lpString=".doc") returned 4 [0204.235] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0204.235] lstrlenW (lpString=".docx") returned 5 [0204.235] lstrcmpiW (lpString1=".docx", lpString2="].gif") returned -1 [0204.235] lstrlenW (lpString=".pdf") returned 4 [0204.235] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0204.235] lstrlenW (lpString=".xls") returned 4 [0204.235] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0204.235] lstrlenW (lpString=".xlsx") returned 5 [0204.235] lstrcmpiW (lpString1=".xlsx", lpString2="].gif") returned -1 [0204.235] lstrlenW (lpString=".ppt") returned 4 [0204.235] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0204.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.235] lstrlenW (lpString=".zip") returned 4 [0204.235] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0204.235] lstrlenW (lpString=".rar") returned 4 [0204.235] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0204.235] lstrlenW (lpString=".bz2") returned 4 [0204.235] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0204.235] lstrlenW (lpString=".7z") returned 3 [0204.236] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0204.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.236] lstrlenW (lpString=".dbf") returned 4 [0204.236] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0204.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.236] lstrlenW (lpString=".1cd") returned 4 [0204.236] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0204.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.236] lstrlenW (lpString=".jpg") returned 4 [0204.236] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0204.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.236] lstrlenW (lpString=".doc") returned 4 [0204.236] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0204.236] lstrlenW (lpString=".docx") returned 5 [0204.236] lstrcmpiW (lpString1=".docx", lpString2="].gif") returned -1 [0204.236] lstrlenW (lpString=".pdf") returned 4 [0204.236] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0204.236] lstrlenW (lpString=".xls") returned 4 [0204.236] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0204.236] lstrlenW (lpString=".xlsx") returned 5 [0204.236] lstrcmpiW (lpString1=".xlsx", lpString2="].gif") returned -1 [0204.236] lstrlenW (lpString=".ppt") returned 4 [0204.236] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0204.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.236] lstrlenW (lpString=".zip") returned 4 [0204.236] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0204.236] lstrlenW (lpString=".rar") returned 4 [0204.236] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0204.236] lstrlenW (lpString=".bz2") returned 4 [0204.236] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0204.236] lstrlenW (lpString=".7z") returned 3 [0204.236] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0204.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.237] lstrlenW (lpString=".dbf") returned 4 [0204.237] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0204.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.237] lstrlenW (lpString=".1cd") returned 4 [0204.237] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0204.237] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\000000929096[1].gif") returned 131 [0204.237] lstrlenW (lpString=".jpg") returned 4 [0204.237] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0204.237] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.237] lstrlenW (lpString="AA8Tave[1].png") returned 14 [0204.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.237] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=616) returned 1 [0204.237] CloseHandle (hObject=0x114) returned 1 [0204.238] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png")) returned 0x2020 [0204.238] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.238] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.238] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.238] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0204.238] GetLastError () returned 0x0 [0204.238] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x268, lpOverlapped=0x0) returned 1 [0204.240] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x270, lpOverlapped=0x0) returned 1 [0204.241] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.241] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.241] SetEndOfFile (hFile=0x150) returned 1 [0204.241] CloseHandle (hObject=0x150) returned 1 [0204.241] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.241] SetEndOfFile (hFile=0x114) returned 1 [0204.242] CloseHandle (hObject=0x114) returned 1 [0204.242] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.242] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa8tave[1].png")) returned 1 [0204.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.242] lstrlenW (lpString=".doc") returned 4 [0204.243] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.243] lstrlenW (lpString=".docx") returned 5 [0204.243] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.243] lstrlenW (lpString=".pdf") returned 4 [0204.243] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.243] lstrlenW (lpString=".xls") returned 4 [0204.243] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.243] lstrlenW (lpString=".xlsx") returned 5 [0204.243] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.243] lstrlenW (lpString=".ppt") returned 4 [0204.243] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.243] lstrlenW (lpString=".zip") returned 4 [0204.243] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.243] lstrlenW (lpString=".rar") returned 4 [0204.243] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.243] lstrlenW (lpString=".bz2") returned 4 [0204.243] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.243] lstrlenW (lpString=".7z") returned 3 [0204.243] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.243] lstrlenW (lpString=".dbf") returned 4 [0204.243] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.243] lstrlenW (lpString=".1cd") returned 4 [0204.243] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.243] lstrlenW (lpString=".jpg") returned 4 [0204.243] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.243] lstrlenW (lpString=".doc") returned 4 [0204.243] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.243] lstrlenW (lpString=".docx") returned 5 [0204.244] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.244] lstrlenW (lpString=".pdf") returned 4 [0204.244] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.244] lstrlenW (lpString=".xls") returned 4 [0204.244] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.244] lstrlenW (lpString=".xlsx") returned 5 [0204.244] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.244] lstrlenW (lpString=".ppt") returned 4 [0204.244] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.244] lstrlenW (lpString=".zip") returned 4 [0204.244] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.244] lstrlenW (lpString=".rar") returned 4 [0204.244] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.244] lstrlenW (lpString=".bz2") returned 4 [0204.244] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.244] lstrlenW (lpString=".7z") returned 3 [0204.244] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.244] lstrlenW (lpString=".dbf") returned 4 [0204.244] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.244] lstrlenW (lpString=".1cd") returned 4 [0204.244] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA8Tave[1].png") returned 126 [0204.244] lstrlenW (lpString=".jpg") returned 4 [0204.244] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.244] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.244] lstrlenW (lpString="AAfOIDq[1].png") returned 14 [0204.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.245] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=542) returned 1 [0204.245] CloseHandle (hObject=0x114) returned 1 [0204.245] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png")) returned 0x2020 [0204.245] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.245] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0204.246] GetLastError () returned 0x0 [0204.246] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x21e, lpOverlapped=0x0) returned 1 [0204.248] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x220, lpOverlapped=0x0) returned 1 [0204.248] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.248] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.249] SetEndOfFile (hFile=0x150) returned 1 [0204.249] CloseHandle (hObject=0x150) returned 1 [0204.249] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.249] SetEndOfFile (hFile=0x114) returned 1 [0204.250] CloseHandle (hObject=0x114) returned 1 [0204.250] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.250] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aafoidq[1].png")) returned 1 [0204.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.250] lstrlenW (lpString=".doc") returned 4 [0204.250] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.250] lstrlenW (lpString=".docx") returned 5 [0204.250] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.250] lstrlenW (lpString=".pdf") returned 4 [0204.250] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.250] lstrlenW (lpString=".xls") returned 4 [0204.250] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.250] lstrlenW (lpString=".xlsx") returned 5 [0204.250] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.250] lstrlenW (lpString=".ppt") returned 4 [0204.250] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.250] lstrlenW (lpString=".zip") returned 4 [0204.250] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.251] lstrlenW (lpString=".rar") returned 4 [0204.251] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.251] lstrlenW (lpString=".bz2") returned 4 [0204.251] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.251] lstrlenW (lpString=".7z") returned 3 [0204.251] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.251] lstrlenW (lpString=".dbf") returned 4 [0204.251] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.251] lstrlenW (lpString=".1cd") returned 4 [0204.251] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.251] lstrlenW (lpString=".jpg") returned 4 [0204.251] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.251] lstrlenW (lpString=".doc") returned 4 [0204.251] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.251] lstrlenW (lpString=".docx") returned 5 [0204.251] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.251] lstrlenW (lpString=".pdf") returned 4 [0204.251] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.251] lstrlenW (lpString=".xls") returned 4 [0204.251] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.251] lstrlenW (lpString=".xlsx") returned 5 [0204.251] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.251] lstrlenW (lpString=".ppt") returned 4 [0204.251] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.251] lstrlenW (lpString=".zip") returned 4 [0204.251] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.251] lstrlenW (lpString=".rar") returned 4 [0204.252] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.252] lstrlenW (lpString=".bz2") returned 4 [0204.252] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.252] lstrlenW (lpString=".7z") returned 3 [0204.252] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.252] lstrlenW (lpString=".dbf") returned 4 [0204.252] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.252] lstrlenW (lpString=".1cd") returned 4 [0204.252] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAfOIDq[1].png") returned 126 [0204.252] lstrlenW (lpString=".jpg") returned 4 [0204.252] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.252] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.252] lstrlenW (lpString="AAkhMz9[2].png") returned 14 [0204.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.253] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=739) returned 1 [0204.253] CloseHandle (hObject=0x114) returned 1 [0204.253] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png")) returned 0x2020 [0204.253] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.253] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.253] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0204.254] GetLastError () returned 0x0 [0204.254] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x2e3, lpOverlapped=0x0) returned 1 [0204.264] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0204.265] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.265] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.265] SetEndOfFile (hFile=0x150) returned 1 [0204.266] CloseHandle (hObject=0x150) returned 1 [0204.266] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.266] SetEndOfFile (hFile=0x114) returned 1 [0204.266] CloseHandle (hObject=0x114) returned 1 [0204.267] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.267] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aakhmz9[2].png")) returned 1 [0204.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.267] lstrlenW (lpString=".doc") returned 4 [0204.267] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.267] lstrlenW (lpString=".docx") returned 5 [0204.267] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.267] lstrlenW (lpString=".pdf") returned 4 [0204.267] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.267] lstrlenW (lpString=".xls") returned 4 [0204.267] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.267] lstrlenW (lpString=".xlsx") returned 5 [0204.267] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.267] lstrlenW (lpString=".ppt") returned 4 [0204.267] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.267] lstrlenW (lpString=".zip") returned 4 [0204.267] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.267] lstrlenW (lpString=".rar") returned 4 [0204.267] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.267] lstrlenW (lpString=".bz2") returned 4 [0204.268] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.268] lstrlenW (lpString=".7z") returned 3 [0204.268] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.268] lstrlenW (lpString=".dbf") returned 4 [0204.268] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.268] lstrlenW (lpString=".1cd") returned 4 [0204.268] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.268] lstrlenW (lpString=".jpg") returned 4 [0204.268] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.268] lstrlenW (lpString=".doc") returned 4 [0204.268] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.268] lstrlenW (lpString=".docx") returned 5 [0204.268] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.268] lstrlenW (lpString=".pdf") returned 4 [0204.268] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.268] lstrlenW (lpString=".xls") returned 4 [0204.268] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.268] lstrlenW (lpString=".xlsx") returned 5 [0204.268] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.268] lstrlenW (lpString=".ppt") returned 4 [0204.268] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.268] lstrlenW (lpString=".zip") returned 4 [0204.268] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.268] lstrlenW (lpString=".rar") returned 4 [0204.268] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.268] lstrlenW (lpString=".bz2") returned 4 [0204.269] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.269] lstrlenW (lpString=".7z") returned 3 [0204.269] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.269] lstrlenW (lpString=".dbf") returned 4 [0204.269] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.269] lstrlenW (lpString=".1cd") returned 4 [0204.269] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAkhMz9[2].png") returned 126 [0204.269] lstrlenW (lpString=".jpg") returned 4 [0204.269] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.269] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.269] lstrlenW (lpString="AAmRY2Q[1].png") returned 14 [0204.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.270] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=300) returned 1 [0204.270] CloseHandle (hObject=0x114) returned 1 [0204.270] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png")) returned 0x2020 [0204.270] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.270] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.270] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0204.271] GetLastError () returned 0x0 [0204.271] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x12c, lpOverlapped=0x0) returned 1 [0204.545] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x130, lpOverlapped=0x0) returned 1 [0204.856] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.856] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.857] SetEndOfFile (hFile=0x150) returned 1 [0204.857] CloseHandle (hObject=0x150) returned 1 [0204.857] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.857] SetEndOfFile (hFile=0x114) returned 1 [0204.858] CloseHandle (hObject=0x114) returned 1 [0204.858] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.858] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aamry2q[1].png")) returned 1 [0204.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.858] lstrlenW (lpString=".doc") returned 4 [0204.858] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.858] lstrlenW (lpString=".docx") returned 5 [0204.858] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.858] lstrlenW (lpString=".pdf") returned 4 [0204.858] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.858] lstrlenW (lpString=".xls") returned 4 [0204.858] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.858] lstrlenW (lpString=".xlsx") returned 5 [0204.858] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.858] lstrlenW (lpString=".ppt") returned 4 [0204.858] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.859] lstrlenW (lpString=".zip") returned 4 [0204.859] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.859] lstrlenW (lpString=".rar") returned 4 [0204.859] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.859] lstrlenW (lpString=".bz2") returned 4 [0204.859] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.859] lstrlenW (lpString=".7z") returned 3 [0204.859] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.859] lstrlenW (lpString=".dbf") returned 4 [0204.859] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.859] lstrlenW (lpString=".1cd") returned 4 [0204.859] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.859] lstrlenW (lpString=".jpg") returned 4 [0204.859] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.859] lstrlenW (lpString=".doc") returned 4 [0204.859] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.859] lstrlenW (lpString=".docx") returned 5 [0204.859] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.859] lstrlenW (lpString=".pdf") returned 4 [0204.859] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.859] lstrlenW (lpString=".xls") returned 4 [0204.859] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.859] lstrlenW (lpString=".xlsx") returned 5 [0204.859] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.859] lstrlenW (lpString=".ppt") returned 4 [0204.859] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.859] lstrlenW (lpString=".zip") returned 4 [0204.860] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.860] lstrlenW (lpString=".rar") returned 4 [0204.860] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.860] lstrlenW (lpString=".bz2") returned 4 [0204.860] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.860] lstrlenW (lpString=".7z") returned 3 [0204.860] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.860] lstrlenW (lpString=".dbf") returned 4 [0204.860] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.860] lstrlenW (lpString=".1cd") returned 4 [0204.860] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAmRY2Q[1].png") returned 126 [0204.860] lstrlenW (lpString=".jpg") returned 4 [0204.860] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.860] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.860] lstrlenW (lpString="BBBPmXJ[1].jpg") returned 14 [0204.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.861] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=5823) returned 1 [0204.861] CloseHandle (hObject=0x114) returned 1 [0204.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg")) returned 0x2020 [0204.861] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.861] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.861] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0204.862] GetLastError () returned 0x0 [0204.862] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x16bf, lpOverlapped=0x0) returned 1 [0204.863] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x16c0, lpOverlapped=0x0) returned 1 [0204.864] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.864] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.864] SetEndOfFile (hFile=0x150) returned 1 [0204.864] CloseHandle (hObject=0x150) returned 1 [0204.864] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.865] SetEndOfFile (hFile=0x114) returned 1 [0204.865] CloseHandle (hObject=0x114) returned 1 [0204.865] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.866] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpmxj[1].jpg")) returned 1 [0204.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.866] lstrlenW (lpString=".doc") returned 4 [0204.866] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.866] lstrlenW (lpString=".docx") returned 5 [0204.866] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.866] lstrlenW (lpString=".pdf") returned 4 [0204.866] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.866] lstrlenW (lpString=".xls") returned 4 [0204.866] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.866] lstrlenW (lpString=".xlsx") returned 5 [0204.866] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.866] lstrlenW (lpString=".ppt") returned 4 [0204.866] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.866] lstrlenW (lpString=".zip") returned 4 [0204.866] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.866] lstrlenW (lpString=".rar") returned 4 [0204.866] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.866] lstrlenW (lpString=".bz2") returned 4 [0204.866] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.866] lstrlenW (lpString=".7z") returned 3 [0204.866] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.866] lstrlenW (lpString=".dbf") returned 4 [0204.866] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.867] lstrlenW (lpString=".1cd") returned 4 [0204.867] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.867] lstrlenW (lpString=".jpg") returned 4 [0204.867] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.867] lstrlenW (lpString=".doc") returned 4 [0204.867] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.867] lstrlenW (lpString=".docx") returned 5 [0204.867] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.867] lstrlenW (lpString=".pdf") returned 4 [0204.867] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.867] lstrlenW (lpString=".xls") returned 4 [0204.867] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.867] lstrlenW (lpString=".xlsx") returned 5 [0204.867] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.867] lstrlenW (lpString=".ppt") returned 4 [0204.867] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.867] lstrlenW (lpString=".zip") returned 4 [0204.867] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.867] lstrlenW (lpString=".rar") returned 4 [0204.867] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.867] lstrlenW (lpString=".bz2") returned 4 [0204.867] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.867] lstrlenW (lpString=".7z") returned 3 [0204.867] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.867] lstrlenW (lpString=".dbf") returned 4 [0204.867] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.867] lstrlenW (lpString=".1cd") returned 4 [0204.867] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPmXJ[1].jpg") returned 126 [0204.868] lstrlenW (lpString=".jpg") returned 4 [0204.868] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.868] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.868] lstrlenW (lpString="BBBPS37[1].png") returned 14 [0204.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.868] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=139243) returned 1 [0204.868] CloseHandle (hObject=0x114) returned 1 [0204.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png")) returned 0x2020 [0204.868] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.869] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0204.869] GetLastError () returned 0x0 [0204.869] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x21feb, lpOverlapped=0x0) returned 1 [0204.873] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x21ff0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x21ff0, lpOverlapped=0x0) returned 1 [0204.876] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.876] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.877] SetEndOfFile (hFile=0x150) returned 1 [0204.877] CloseHandle (hObject=0x150) returned 1 [0204.877] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.877] SetEndOfFile (hFile=0x114) returned 1 [0204.878] CloseHandle (hObject=0x114) returned 1 [0204.878] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.878] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbps37[1].png")) returned 1 [0204.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.879] lstrlenW (lpString=".doc") returned 4 [0204.879] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.879] lstrlenW (lpString=".docx") returned 5 [0204.879] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.879] lstrlenW (lpString=".pdf") returned 4 [0204.879] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.879] lstrlenW (lpString=".xls") returned 4 [0204.879] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.879] lstrlenW (lpString=".xlsx") returned 5 [0204.879] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.879] lstrlenW (lpString=".ppt") returned 4 [0204.879] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.879] lstrlenW (lpString=".zip") returned 4 [0204.879] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.879] lstrlenW (lpString=".rar") returned 4 [0204.879] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.879] lstrlenW (lpString=".bz2") returned 4 [0204.879] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.879] lstrlenW (lpString=".7z") returned 3 [0204.879] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.879] lstrlenW (lpString=".dbf") returned 4 [0204.879] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.879] lstrlenW (lpString=".1cd") returned 4 [0204.879] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.879] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.880] lstrlenW (lpString=".jpg") returned 4 [0204.880] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.880] lstrlenW (lpString=".doc") returned 4 [0204.880] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.880] lstrlenW (lpString=".docx") returned 5 [0204.880] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.880] lstrlenW (lpString=".pdf") returned 4 [0204.880] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.880] lstrlenW (lpString=".xls") returned 4 [0204.880] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.880] lstrlenW (lpString=".xlsx") returned 5 [0204.880] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.880] lstrlenW (lpString=".ppt") returned 4 [0204.880] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.880] lstrlenW (lpString=".zip") returned 4 [0204.880] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.880] lstrlenW (lpString=".rar") returned 4 [0204.880] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.880] lstrlenW (lpString=".bz2") returned 4 [0204.880] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.880] lstrlenW (lpString=".7z") returned 3 [0204.880] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.880] lstrlenW (lpString=".dbf") returned 4 [0204.880] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.880] lstrlenW (lpString=".1cd") returned 4 [0204.880] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPS37[1].png") returned 126 [0204.880] lstrlenW (lpString=".jpg") returned 4 [0204.881] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.881] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.881] lstrlenW (lpString="BBBQiBF[1].jpg") returned 14 [0204.881] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.882] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=4857) returned 1 [0204.882] CloseHandle (hObject=0x114) returned 1 [0204.882] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg")) returned 0x2020 [0204.882] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.882] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.882] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0204.883] GetLastError () returned 0x0 [0204.883] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x12f9, lpOverlapped=0x0) returned 1 [0204.884] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x1300, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x1300, lpOverlapped=0x0) returned 1 [0204.885] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.885] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.886] SetEndOfFile (hFile=0x150) returned 1 [0204.886] CloseHandle (hObject=0x150) returned 1 [0204.886] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.886] SetEndOfFile (hFile=0x114) returned 1 [0204.887] CloseHandle (hObject=0x114) returned 1 [0204.887] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.887] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbqibf[1].jpg")) returned 1 [0204.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.887] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.887] lstrlenW (lpString=".doc") returned 4 [0204.887] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.887] lstrlenW (lpString=".docx") returned 5 [0204.887] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.887] lstrlenW (lpString=".pdf") returned 4 [0204.887] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.887] lstrlenW (lpString=".xls") returned 4 [0204.887] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.887] lstrlenW (lpString=".xlsx") returned 5 [0204.887] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.888] lstrlenW (lpString=".ppt") returned 4 [0204.888] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.888] lstrlenW (lpString=".zip") returned 4 [0204.888] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.888] lstrlenW (lpString=".rar") returned 4 [0204.888] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.888] lstrlenW (lpString=".bz2") returned 4 [0204.888] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.888] lstrlenW (lpString=".7z") returned 3 [0204.888] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.888] lstrlenW (lpString=".dbf") returned 4 [0204.888] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.888] lstrlenW (lpString=".1cd") returned 4 [0204.888] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.888] lstrlenW (lpString=".jpg") returned 4 [0204.888] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.888] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.888] lstrlenW (lpString=".doc") returned 4 [0204.888] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.888] lstrlenW (lpString=".docx") returned 5 [0204.888] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.888] lstrlenW (lpString=".pdf") returned 4 [0204.888] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.888] lstrlenW (lpString=".xls") returned 4 [0204.888] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.888] lstrlenW (lpString=".xlsx") returned 5 [0204.888] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.888] lstrlenW (lpString=".ppt") returned 4 [0204.889] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.889] lstrlenW (lpString=".zip") returned 4 [0204.889] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.889] lstrlenW (lpString=".rar") returned 4 [0204.889] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.889] lstrlenW (lpString=".bz2") returned 4 [0204.889] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.889] lstrlenW (lpString=".7z") returned 3 [0204.889] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.889] lstrlenW (lpString=".dbf") returned 4 [0204.889] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.889] lstrlenW (lpString=".1cd") returned 4 [0204.889] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBQiBF[1].jpg") returned 126 [0204.889] lstrlenW (lpString=".jpg") returned 4 [0204.889] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.889] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.889] lstrlenW (lpString="BBBty8h[1].jpg") returned 14 [0204.889] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.890] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ebff1c | out: lpFileSize=0x2ebff1c*=2473) returned 1 [0204.890] CloseHandle (hObject=0x114) returned 1 [0204.890] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg")) returned 0x2020 [0204.890] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0204.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.890] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2ebfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.890] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBty8h[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbty8h[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0204.891] GetLastError () returned 0x0 [0204.891] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x9a9, lpOverlapped=0x0) returned 1 [0204.993] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0204.994] ReadFile (in: hFile=0x114, lpBuffer=0x3610020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2ebfed4, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesRead=0x2ebfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.994] WriteFile (in: hFile=0x150, lpBuffer=0x3610020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2ebfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3610020*, lpNumberOfBytesWritten=0x2ebfc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.994] SetEndOfFile (hFile=0x150) Thread: id = 69 os_tid = 0x278 [0183.492] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x352c70 [0183.492] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x3860048 [0183.493] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310e88 [0183.493] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6) returned 0x322118 [0183.493] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310ea0 [0183.493] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x3960020 [0183.493] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310eb8 [0183.493] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310eb8, Size=0x20) returned 0x2dc638 [0183.493] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310eb8 [0183.493] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310eb8, Size=0x20) returned 0x2dc660 [0183.493] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.493] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.493] Wow64DisableWow64FsRedirection (in: OldValue=0x2ffff58 | out: OldValue=0x2ffff58*=0x0) returned 1 [0183.493] lstrlenW (lpString="kernel32.dll") returned 12 [0183.493] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc638 | out: hHeap=0x270000) returned 1 [0183.493] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.493] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc660 | out: hHeap=0x270000) returned 1 [0183.493] Sleep (dwMilliseconds=0x64) [0183.607] Sleep (dwMilliseconds=0x64) [0183.776] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.776] lstrlenW (lpString="boxed-delete.avi") returned 16 [0183.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.794] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=31744) returned 1 [0183.794] CloseHandle (hObject=0x1d0) returned 1 [0183.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0183.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.794] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.794] lstrlenW (lpString=".doc") returned 4 [0183.794] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.794] lstrlenW (lpString=".docx") returned 5 [0183.794] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0183.795] lstrlenW (lpString=".pdf") returned 4 [0183.795] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.795] lstrlenW (lpString=".xls") returned 4 [0183.795] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.795] lstrlenW (lpString=".xlsx") returned 5 [0183.795] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0183.795] lstrlenW (lpString=".ppt") returned 4 [0183.795] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.795] lstrlenW (lpString=".zip") returned 4 [0183.795] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.795] lstrlenW (lpString=".rar") returned 4 [0183.795] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.795] lstrlenW (lpString=".bz2") returned 4 [0183.795] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.795] lstrlenW (lpString=".7z") returned 3 [0183.795] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.795] lstrlenW (lpString=".dbf") returned 4 [0183.795] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.795] lstrlenW (lpString=".1cd") returned 4 [0183.795] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.795] lstrlenW (lpString=".jpg") returned 4 [0183.795] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.795] lstrlenW (lpString=".doc") returned 4 [0183.795] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.795] lstrlenW (lpString=".docx") returned 5 [0183.795] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0183.795] lstrlenW (lpString=".pdf") returned 4 [0183.796] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.796] lstrlenW (lpString=".xls") returned 4 [0183.796] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.796] lstrlenW (lpString=".xlsx") returned 5 [0183.796] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0183.796] lstrlenW (lpString=".ppt") returned 4 [0183.796] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.796] lstrlenW (lpString=".zip") returned 4 [0183.796] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.796] lstrlenW (lpString=".rar") returned 4 [0183.796] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.796] lstrlenW (lpString=".bz2") returned 4 [0183.796] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.796] lstrlenW (lpString=".7z") returned 3 [0183.796] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.796] lstrlenW (lpString=".dbf") returned 4 [0183.796] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.796] lstrlenW (lpString=".1cd") returned 4 [0183.796] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0183.796] lstrlenW (lpString=".jpg") returned 4 [0183.796] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.796] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.796] lstrlenW (lpString="correct.avi") returned 11 [0183.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.797] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=197120) returned 1 [0183.797] CloseHandle (hObject=0x1d0) returned 1 [0183.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0183.797] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.797] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.797] lstrlenW (lpString=".doc") returned 4 [0183.797] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.797] lstrlenW (lpString=".docx") returned 5 [0183.797] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0183.797] lstrlenW (lpString=".pdf") returned 4 [0183.797] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.797] lstrlenW (lpString=".xls") returned 4 [0183.797] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.797] lstrlenW (lpString=".xlsx") returned 5 [0183.797] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0183.797] lstrlenW (lpString=".ppt") returned 4 [0183.797] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.798] lstrlenW (lpString=".zip") returned 4 [0183.798] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.798] lstrlenW (lpString=".rar") returned 4 [0183.798] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.798] lstrlenW (lpString=".bz2") returned 4 [0183.798] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.798] lstrlenW (lpString=".7z") returned 3 [0183.798] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.798] lstrlenW (lpString=".dbf") returned 4 [0183.798] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.798] lstrlenW (lpString=".1cd") returned 4 [0183.798] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.798] lstrlenW (lpString=".jpg") returned 4 [0183.798] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.798] lstrlenW (lpString=".doc") returned 4 [0183.798] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.798] lstrlenW (lpString=".docx") returned 5 [0183.798] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0183.798] lstrlenW (lpString=".pdf") returned 4 [0183.798] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.798] lstrlenW (lpString=".xls") returned 4 [0183.798] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.798] lstrlenW (lpString=".xlsx") returned 5 [0183.798] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0183.798] lstrlenW (lpString=".ppt") returned 4 [0183.798] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.798] lstrlenW (lpString=".zip") returned 4 [0183.799] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.799] lstrlenW (lpString=".rar") returned 4 [0183.799] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.799] lstrlenW (lpString=".bz2") returned 4 [0183.799] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.799] lstrlenW (lpString=".7z") returned 3 [0183.799] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.799] lstrlenW (lpString=".dbf") returned 4 [0183.799] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.799] lstrlenW (lpString=".1cd") returned 4 [0183.799] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.799] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0183.799] lstrlenW (lpString=".jpg") returned 4 [0183.799] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.799] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.799] lstrlenW (lpString="delete.avi") returned 10 [0183.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.800] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=224256) returned 1 [0183.800] CloseHandle (hObject=0x1d0) returned 1 [0183.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0183.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.800] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.800] lstrlenW (lpString=".doc") returned 4 [0183.800] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.800] lstrlenW (lpString=".docx") returned 5 [0183.801] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0183.801] lstrlenW (lpString=".pdf") returned 4 [0183.801] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.801] lstrlenW (lpString=".xls") returned 4 [0183.801] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.801] lstrlenW (lpString=".xlsx") returned 5 [0183.801] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0183.801] lstrlenW (lpString=".ppt") returned 4 [0183.801] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.801] lstrlenW (lpString=".zip") returned 4 [0183.801] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.801] lstrlenW (lpString=".rar") returned 4 [0183.801] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.801] lstrlenW (lpString=".bz2") returned 4 [0183.801] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.801] lstrlenW (lpString=".7z") returned 3 [0183.801] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.801] lstrlenW (lpString=".dbf") returned 4 [0183.801] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.801] lstrlenW (lpString=".1cd") returned 4 [0183.801] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.801] lstrlenW (lpString=".jpg") returned 4 [0183.801] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.801] lstrlenW (lpString=".doc") returned 4 [0183.801] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.801] lstrlenW (lpString=".docx") returned 5 [0183.801] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0183.801] lstrlenW (lpString=".pdf") returned 4 [0183.802] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.802] lstrlenW (lpString=".xls") returned 4 [0183.802] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.802] lstrlenW (lpString=".xlsx") returned 5 [0183.802] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0183.802] lstrlenW (lpString=".ppt") returned 4 [0183.802] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.802] lstrlenW (lpString=".zip") returned 4 [0183.802] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.802] lstrlenW (lpString=".rar") returned 4 [0183.802] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.802] lstrlenW (lpString=".bz2") returned 4 [0183.802] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.802] lstrlenW (lpString=".7z") returned 3 [0183.802] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.802] lstrlenW (lpString=".dbf") returned 4 [0183.802] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.802] lstrlenW (lpString=".1cd") returned 4 [0183.802] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0183.802] lstrlenW (lpString=".jpg") returned 4 [0183.802] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.802] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.802] lstrlenW (lpString="join.avi") returned 8 [0183.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.803] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=222208) returned 1 [0183.803] CloseHandle (hObject=0x1d0) returned 1 [0183.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0183.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.803] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.803] lstrlenW (lpString=".doc") returned 4 [0183.803] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.803] lstrlenW (lpString=".docx") returned 5 [0183.803] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0183.803] lstrlenW (lpString=".pdf") returned 4 [0183.803] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.803] lstrlenW (lpString=".xls") returned 4 [0183.804] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.804] lstrlenW (lpString=".xlsx") returned 5 [0183.804] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0183.804] lstrlenW (lpString=".ppt") returned 4 [0183.804] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.804] lstrlenW (lpString=".zip") returned 4 [0183.804] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.804] lstrlenW (lpString=".rar") returned 4 [0183.804] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.804] lstrlenW (lpString=".bz2") returned 4 [0183.804] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.804] lstrlenW (lpString=".7z") returned 3 [0183.804] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.804] lstrlenW (lpString=".dbf") returned 4 [0183.804] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.804] lstrlenW (lpString=".1cd") returned 4 [0183.804] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.804] lstrlenW (lpString=".jpg") returned 4 [0183.804] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.804] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.804] lstrlenW (lpString=".doc") returned 4 [0183.804] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.804] lstrlenW (lpString=".docx") returned 5 [0183.804] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0183.804] lstrlenW (lpString=".pdf") returned 4 [0183.804] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.804] lstrlenW (lpString=".xls") returned 4 [0183.804] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.805] lstrlenW (lpString=".xlsx") returned 5 [0183.805] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0183.805] lstrlenW (lpString=".ppt") returned 4 [0183.805] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.805] lstrlenW (lpString=".zip") returned 4 [0183.805] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.805] lstrlenW (lpString=".rar") returned 4 [0183.805] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.805] lstrlenW (lpString=".bz2") returned 4 [0183.805] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.805] lstrlenW (lpString=".7z") returned 3 [0183.805] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.805] lstrlenW (lpString=".dbf") returned 4 [0183.805] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.805] lstrlenW (lpString=".1cd") returned 4 [0183.805] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.805] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0183.805] lstrlenW (lpString=".jpg") returned 4 [0183.805] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.805] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.805] lstrlenW (lpString="split.avi") returned 9 [0183.805] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.806] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=194048) returned 1 [0183.806] CloseHandle (hObject=0x1d0) returned 1 [0183.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0183.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.806] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.806] lstrlenW (lpString=".doc") returned 4 [0183.806] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.806] lstrlenW (lpString=".docx") returned 5 [0183.806] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0183.806] lstrlenW (lpString=".pdf") returned 4 [0183.806] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.806] lstrlenW (lpString=".xls") returned 4 [0183.806] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.806] lstrlenW (lpString=".xlsx") returned 5 [0183.806] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0183.806] lstrlenW (lpString=".ppt") returned 4 [0183.806] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.806] lstrlenW (lpString=".zip") returned 4 [0183.806] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.806] lstrlenW (lpString=".rar") returned 4 [0183.806] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.807] lstrlenW (lpString=".bz2") returned 4 [0183.807] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.807] lstrlenW (lpString=".7z") returned 3 [0183.807] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.807] lstrlenW (lpString=".dbf") returned 4 [0183.807] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.807] lstrlenW (lpString=".1cd") returned 4 [0183.807] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.807] lstrlenW (lpString=".jpg") returned 4 [0183.807] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.807] lstrlenW (lpString=".doc") returned 4 [0183.807] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.807] lstrlenW (lpString=".docx") returned 5 [0183.807] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0183.807] lstrlenW (lpString=".pdf") returned 4 [0183.807] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.807] lstrlenW (lpString=".xls") returned 4 [0183.807] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.807] lstrlenW (lpString=".xlsx") returned 5 [0183.807] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0183.807] lstrlenW (lpString=".ppt") returned 4 [0183.807] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.807] lstrlenW (lpString=".zip") returned 4 [0183.807] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.807] lstrlenW (lpString=".rar") returned 4 [0183.807] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.807] lstrlenW (lpString=".bz2") returned 4 [0183.807] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.808] lstrlenW (lpString=".7z") returned 3 [0183.808] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.808] lstrlenW (lpString=".dbf") returned 4 [0183.808] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.808] lstrlenW (lpString=".1cd") returned 4 [0183.808] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0183.808] lstrlenW (lpString=".jpg") returned 4 [0183.808] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.808] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.808] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0183.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.816] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1600388) returned 1 [0183.816] CloseHandle (hObject=0x1d0) returned 1 [0183.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0183.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.816] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.817] lstrlenW (lpString=".doc") returned 4 [0183.817] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.817] lstrlenW (lpString=".docx") returned 5 [0183.817] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0183.817] lstrlenW (lpString=".pdf") returned 4 [0183.817] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.817] lstrlenW (lpString=".xls") returned 4 [0183.817] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.817] lstrlenW (lpString=".xlsx") returned 5 [0183.817] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0183.817] lstrlenW (lpString=".ppt") returned 4 [0183.817] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.817] lstrlenW (lpString=".zip") returned 4 [0183.817] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.817] lstrlenW (lpString=".rar") returned 4 [0183.817] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.817] lstrlenW (lpString=".bz2") returned 4 [0183.817] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.817] lstrlenW (lpString=".7z") returned 3 [0183.817] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.817] lstrlenW (lpString=".dbf") returned 4 [0183.817] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.817] lstrlenW (lpString=".1cd") returned 4 [0183.817] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.817] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.817] lstrlenW (lpString=".jpg") returned 4 [0183.818] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.818] lstrlenW (lpString=".doc") returned 4 [0183.818] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.818] lstrlenW (lpString=".docx") returned 5 [0183.818] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0183.818] lstrlenW (lpString=".pdf") returned 4 [0183.818] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.818] lstrlenW (lpString=".xls") returned 4 [0183.818] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.818] lstrlenW (lpString=".xlsx") returned 5 [0183.818] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0183.818] lstrlenW (lpString=".ppt") returned 4 [0183.818] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.818] lstrlenW (lpString=".zip") returned 4 [0183.818] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.818] lstrlenW (lpString=".rar") returned 4 [0183.818] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.818] lstrlenW (lpString=".bz2") returned 4 [0183.818] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.818] lstrlenW (lpString=".7z") returned 3 [0183.818] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.818] lstrlenW (lpString=".dbf") returned 4 [0183.818] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.818] lstrlenW (lpString=".1cd") returned 4 [0183.818] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0183.818] lstrlenW (lpString=".jpg") returned 4 [0183.818] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.819] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.819] lstrlenW (lpString="ea.xml") returned 6 [0183.819] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.820] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=384) returned 1 [0183.820] CloseHandle (hObject=0x1d0) returned 1 [0183.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml")) returned 0x20 [0183.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\keypad\\ea.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0183.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0183.820] lstrlenW (lpString=".doc") returned 4 [0183.820] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.820] lstrlenW (lpString=".docx") returned 5 [0183.820] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0183.820] lstrlenW (lpString=".pdf") returned 4 [0183.820] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.820] lstrlenW (lpString=".xls") returned 4 [0183.820] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.820] lstrlenW (lpString=".xlsx") returned 5 [0183.820] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0183.820] lstrlenW (lpString=".ppt") returned 4 [0183.820] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\keypad\\ea.xml") returned 78 [0183.820] lstrlenW (lpString=".zip") returned 4 [0183.820] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.821] lstrlenW (lpString=".rar") returned 4 [0183.821] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.821] lstrlenW (lpString=".bz2") returned 4 [0183.821] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.821] lstrlenW (lpString=".7z") returned 3 [0183.821] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0185.265] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.265] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.266] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.358] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1837606) returned 1 [0185.358] CloseHandle (hObject=0x324) returned 1 [0185.358] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv")) returned 0x20 [0185.358] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.358] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.358] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0185.358] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0185.358] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0185.358] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0185.358] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0185.358] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0185.358] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0185.359] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0185.359] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0185.359] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0185.359] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0185.360] Sleep (dwMilliseconds=0x64) [0185.460] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.460] lstrlenW (lpString="BS00078_.WMF") returned 12 [0185.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0185.555] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1444) returned 1 [0185.555] CloseHandle (hObject=0x380) returned 1 [0185.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0185.555] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.556] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.558] lstrlenW (lpString=".doc") returned 4 [0185.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.558] lstrlenW (lpString=".docx") returned 5 [0185.558] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.558] lstrlenW (lpString=".pdf") returned 4 [0185.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.558] lstrlenW (lpString=".xls") returned 4 [0185.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.558] lstrlenW (lpString=".xlsx") returned 5 [0185.558] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.558] lstrlenW (lpString=".ppt") returned 4 [0185.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.559] lstrlenW (lpString=".zip") returned 4 [0185.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.559] lstrlenW (lpString=".rar") returned 4 [0185.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.559] lstrlenW (lpString=".bz2") returned 4 [0185.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.559] lstrlenW (lpString=".7z") returned 3 [0185.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.559] lstrlenW (lpString=".dbf") returned 4 [0185.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.559] lstrlenW (lpString=".1cd") returned 4 [0185.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.559] lstrlenW (lpString=".jpg") returned 4 [0185.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.559] lstrlenW (lpString=".doc") returned 4 [0185.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.559] lstrlenW (lpString=".docx") returned 5 [0185.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.559] lstrlenW (lpString=".pdf") returned 4 [0185.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.559] lstrlenW (lpString=".xls") returned 4 [0185.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.559] lstrlenW (lpString=".xlsx") returned 5 [0185.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.559] lstrlenW (lpString=".ppt") returned 4 [0185.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.560] lstrlenW (lpString=".zip") returned 4 [0185.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.560] lstrlenW (lpString=".rar") returned 4 [0185.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.560] lstrlenW (lpString=".bz2") returned 4 [0185.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.560] lstrlenW (lpString=".7z") returned 3 [0185.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.560] lstrlenW (lpString=".dbf") returned 4 [0185.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.560] lstrlenW (lpString=".1cd") returned 4 [0185.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0185.560] lstrlenW (lpString=".jpg") returned 4 [0185.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.560] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.560] lstrlenW (lpString="BS00100_.WMF") returned 12 [0185.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0185.608] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2378) returned 1 [0185.608] CloseHandle (hObject=0x380) returned 1 [0185.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0185.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.618] lstrlenW (lpString=".doc") returned 4 [0185.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.618] lstrlenW (lpString=".docx") returned 5 [0185.618] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.618] lstrlenW (lpString=".pdf") returned 4 [0185.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.618] lstrlenW (lpString=".xls") returned 4 [0185.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.618] lstrlenW (lpString=".xlsx") returned 5 [0185.618] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.618] lstrlenW (lpString=".ppt") returned 4 [0185.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.619] lstrlenW (lpString=".zip") returned 4 [0185.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.619] lstrlenW (lpString=".rar") returned 4 [0185.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.619] lstrlenW (lpString=".bz2") returned 4 [0185.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.619] lstrlenW (lpString=".7z") returned 3 [0185.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.619] lstrlenW (lpString=".dbf") returned 4 [0185.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.619] lstrlenW (lpString=".1cd") returned 4 [0185.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.619] lstrlenW (lpString=".jpg") returned 4 [0185.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.619] lstrlenW (lpString=".doc") returned 4 [0185.619] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.619] lstrlenW (lpString=".docx") returned 5 [0185.619] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.619] lstrlenW (lpString=".pdf") returned 4 [0185.619] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.619] lstrlenW (lpString=".xls") returned 4 [0185.619] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.619] lstrlenW (lpString=".xlsx") returned 5 [0185.619] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.619] lstrlenW (lpString=".ppt") returned 4 [0185.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.619] lstrlenW (lpString=".zip") returned 4 [0185.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.620] lstrlenW (lpString=".rar") returned 4 [0185.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.620] lstrlenW (lpString=".bz2") returned 4 [0185.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.620] lstrlenW (lpString=".7z") returned 3 [0185.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.620] lstrlenW (lpString=".dbf") returned 4 [0185.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.620] lstrlenW (lpString=".1cd") returned 4 [0185.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0185.620] lstrlenW (lpString=".jpg") returned 4 [0185.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.620] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.620] lstrlenW (lpString="BS00184_.WMF") returned 12 [0185.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0185.635] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4976) returned 1 [0185.635] CloseHandle (hObject=0x320) returned 1 [0185.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0185.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.636] lstrlenW (lpString=".doc") returned 4 [0185.636] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.636] lstrlenW (lpString=".docx") returned 5 [0185.636] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.636] lstrlenW (lpString=".pdf") returned 4 [0185.636] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.636] lstrlenW (lpString=".xls") returned 4 [0185.636] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.636] lstrlenW (lpString=".xlsx") returned 5 [0185.636] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.636] lstrlenW (lpString=".ppt") returned 4 [0185.636] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.636] lstrlenW (lpString=".zip") returned 4 [0185.636] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.636] lstrlenW (lpString=".rar") returned 4 [0185.636] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.636] lstrlenW (lpString=".bz2") returned 4 [0185.636] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.636] lstrlenW (lpString=".7z") returned 3 [0185.636] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.636] lstrlenW (lpString=".dbf") returned 4 [0185.636] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.636] lstrlenW (lpString=".1cd") returned 4 [0185.636] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.637] lstrlenW (lpString=".jpg") returned 4 [0185.637] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.637] lstrlenW (lpString=".doc") returned 4 [0185.637] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.637] lstrlenW (lpString=".docx") returned 5 [0185.637] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.637] lstrlenW (lpString=".pdf") returned 4 [0185.637] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.637] lstrlenW (lpString=".xls") returned 4 [0185.637] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.637] lstrlenW (lpString=".xlsx") returned 5 [0185.637] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.637] lstrlenW (lpString=".ppt") returned 4 [0185.637] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.637] lstrlenW (lpString=".zip") returned 4 [0185.637] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.637] lstrlenW (lpString=".rar") returned 4 [0185.637] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.637] lstrlenW (lpString=".bz2") returned 4 [0185.637] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.637] lstrlenW (lpString=".7z") returned 3 [0185.637] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.637] lstrlenW (lpString=".dbf") returned 4 [0185.637] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.637] lstrlenW (lpString=".1cd") returned 4 [0185.637] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0185.637] lstrlenW (lpString=".jpg") returned 4 [0185.638] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.638] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.638] lstrlenW (lpString="BS00224_.WMF") returned 12 [0185.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0185.638] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1588) returned 1 [0185.638] CloseHandle (hObject=0x320) returned 1 [0185.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0185.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.639] lstrlenW (lpString=".doc") returned 4 [0185.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString=".docx") returned 5 [0185.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.639] lstrlenW (lpString=".pdf") returned 4 [0185.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString=".xls") returned 4 [0185.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.639] lstrlenW (lpString=".xlsx") returned 5 [0185.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.639] lstrlenW (lpString=".ppt") returned 4 [0185.639] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.639] lstrlenW (lpString=".zip") returned 4 [0185.639] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.639] lstrlenW (lpString=".rar") returned 4 [0185.639] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString=".bz2") returned 4 [0185.639] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString=".7z") returned 3 [0185.639] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.639] lstrlenW (lpString=".dbf") returned 4 [0185.639] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.639] lstrlenW (lpString=".1cd") returned 4 [0185.639] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.639] lstrlenW (lpString=".jpg") returned 4 [0185.639] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.640] lstrlenW (lpString=".doc") returned 4 [0185.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.640] lstrlenW (lpString=".docx") returned 5 [0185.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.640] lstrlenW (lpString=".pdf") returned 4 [0185.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.640] lstrlenW (lpString=".xls") returned 4 [0185.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.640] lstrlenW (lpString=".xlsx") returned 5 [0185.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.640] lstrlenW (lpString=".ppt") returned 4 [0185.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.640] lstrlenW (lpString=".zip") returned 4 [0185.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.640] lstrlenW (lpString=".rar") returned 4 [0185.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.640] lstrlenW (lpString=".bz2") returned 4 [0185.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.640] lstrlenW (lpString=".7z") returned 3 [0185.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.640] lstrlenW (lpString=".dbf") returned 4 [0185.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.640] lstrlenW (lpString=".1cd") returned 4 [0185.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0185.640] lstrlenW (lpString=".jpg") returned 4 [0185.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.641] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.641] lstrlenW (lpString="BS00438_.WMF") returned 12 [0185.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0185.641] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1212) returned 1 [0185.641] CloseHandle (hObject=0x320) returned 1 [0185.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0185.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.641] lstrlenW (lpString=".doc") returned 4 [0185.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.641] lstrlenW (lpString=".docx") returned 5 [0185.641] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.642] lstrlenW (lpString=".pdf") returned 4 [0185.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.642] lstrlenW (lpString=".xls") returned 4 [0185.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.642] lstrlenW (lpString=".xlsx") returned 5 [0185.642] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.642] lstrlenW (lpString=".ppt") returned 4 [0185.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.642] lstrlenW (lpString=".zip") returned 4 [0185.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.642] lstrlenW (lpString=".rar") returned 4 [0185.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.642] lstrlenW (lpString=".bz2") returned 4 [0185.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.642] lstrlenW (lpString=".7z") returned 3 [0185.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.642] lstrlenW (lpString=".dbf") returned 4 [0185.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.642] lstrlenW (lpString=".1cd") returned 4 [0185.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.642] lstrlenW (lpString=".jpg") returned 4 [0185.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.642] lstrlenW (lpString=".doc") returned 4 [0185.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.642] lstrlenW (lpString=".docx") returned 5 [0185.642] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.642] lstrlenW (lpString=".pdf") returned 4 [0185.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.643] lstrlenW (lpString=".xls") returned 4 [0185.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.643] lstrlenW (lpString=".xlsx") returned 5 [0185.643] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.643] lstrlenW (lpString=".ppt") returned 4 [0185.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.643] lstrlenW (lpString=".zip") returned 4 [0185.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.643] lstrlenW (lpString=".rar") returned 4 [0185.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.643] lstrlenW (lpString=".bz2") returned 4 [0185.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.643] lstrlenW (lpString=".7z") returned 3 [0185.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.643] lstrlenW (lpString=".dbf") returned 4 [0185.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.643] lstrlenW (lpString=".1cd") returned 4 [0185.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0185.643] lstrlenW (lpString=".jpg") returned 4 [0185.643] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.643] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.643] lstrlenW (lpString="BS00439_.WMF") returned 12 [0185.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0185.827] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2052) returned 1 [0185.827] CloseHandle (hObject=0x310) returned 1 [0185.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0185.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.842] lstrlenW (lpString=".doc") returned 4 [0185.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.849] lstrlenW (lpString=".docx") returned 5 [0185.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.850] lstrlenW (lpString=".pdf") returned 4 [0185.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.851] lstrlenW (lpString=".xls") returned 4 [0185.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.855] lstrlenW (lpString=".xlsx") returned 5 [0185.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.856] lstrlenW (lpString=".ppt") returned 4 [0185.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.864] lstrlenW (lpString=".zip") returned 4 [0185.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.867] lstrlenW (lpString=".rar") returned 4 [0185.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.879] lstrlenW (lpString=".bz2") returned 4 [0185.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.881] lstrlenW (lpString=".7z") returned 3 [0185.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.881] lstrlenW (lpString=".dbf") returned 4 [0185.881] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.881] lstrlenW (lpString=".1cd") returned 4 [0185.881] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.881] lstrlenW (lpString=".jpg") returned 4 [0185.881] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.882] lstrlenW (lpString=".doc") returned 4 [0185.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.882] lstrlenW (lpString=".docx") returned 5 [0185.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.882] lstrlenW (lpString=".pdf") returned 4 [0185.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.882] lstrlenW (lpString=".xls") returned 4 [0185.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.882] lstrlenW (lpString=".xlsx") returned 5 [0185.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.882] lstrlenW (lpString=".ppt") returned 4 [0185.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.882] lstrlenW (lpString=".zip") returned 4 [0185.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.882] lstrlenW (lpString=".rar") returned 4 [0185.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.882] lstrlenW (lpString=".bz2") returned 4 [0185.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.882] lstrlenW (lpString=".7z") returned 3 [0185.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.882] lstrlenW (lpString=".dbf") returned 4 [0185.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0185.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.882] lstrlenW (lpString=".1cd") returned 4 [0185.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0185.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0185.882] lstrlenW (lpString=".jpg") returned 4 [0185.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0185.883] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.883] lstrlenW (lpString="FD01660_.WMF") returned 12 [0185.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0185.895] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=12958) returned 1 [0185.895] CloseHandle (hObject=0x310) returned 1 [0185.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0185.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0185.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0185.896] lstrlenW (lpString=".doc") returned 4 [0185.896] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0185.896] lstrlenW (lpString=".docx") returned 5 [0185.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0185.896] lstrlenW (lpString=".pdf") returned 4 [0185.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0185.896] lstrlenW (lpString=".xls") returned 4 [0185.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0185.896] lstrlenW (lpString=".xlsx") returned 5 [0185.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0185.896] lstrlenW (lpString=".ppt") returned 4 [0185.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0185.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0185.896] lstrlenW (lpString=".zip") returned 4 [0185.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0185.896] lstrlenW (lpString=".rar") returned 4 [0185.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0185.896] lstrlenW (lpString=".bz2") returned 4 [0185.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0185.896] lstrlenW (lpString=".7z") returned 3 [0185.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0185.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0186.829] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Couture.thmx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\document themes 14\\couture.thmx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHLEX.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchlex.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PSRCHSRN.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\psrchsrn.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZLIB.ACCDE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzlib.accde.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZMAIN.ACCDE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzmain.accde.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.146] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZTOOL.ACCDE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwztool.accde.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.252] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_M.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_m.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.253] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\CALNDR_U.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\calndr_u.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.659] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_M.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_m.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.661] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VSS" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Visio Content\\1033\\WEBMAP_U.VSS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visio content\\1033\\webmap_u.vss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\FiveRules.potx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\fiverules.potx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\IntroducingPowerPoint2010.potx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\introducingpowerpoint2010.potx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.814] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\designer.one"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Templates\\1033\\ONENOTE\\14\\Stationery\\DESIGNER.ONE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\templates\\1033\\onenote\\14\\stationery\\designer.one.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.176] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.176] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.176] GetLastError () returned 0x0 [0193.176] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x123, lpOverlapped=0x0) returned 1 [0193.186] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x130, lpOverlapped=0x0) returned 1 [0193.187] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.187] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.188] SetEndOfFile (hFile=0x150) returned 1 [0193.188] CloseHandle (hObject=0x150) returned 1 [0193.188] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.188] SetEndOfFile (hFile=0x154) returned 1 [0193.189] CloseHandle (hObject=0x154) returned 1 [0193.189] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.189] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json")) returned 1 [0193.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.189] lstrlenW (lpString=".doc") returned 4 [0193.189] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.189] lstrlenW (lpString=".docx") returned 5 [0193.189] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.189] lstrlenW (lpString=".pdf") returned 4 [0193.189] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.189] lstrlenW (lpString=".xls") returned 4 [0193.189] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.189] lstrlenW (lpString=".xlsx") returned 5 [0193.189] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.189] lstrlenW (lpString=".ppt") returned 4 [0193.189] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.189] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.190] lstrlenW (lpString=".zip") returned 4 [0193.190] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.190] lstrlenW (lpString=".rar") returned 4 [0193.190] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.190] lstrlenW (lpString=".bz2") returned 4 [0193.190] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.190] lstrlenW (lpString=".7z") returned 3 [0193.190] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.190] lstrlenW (lpString=".dbf") returned 4 [0193.190] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.190] lstrlenW (lpString=".1cd") returned 4 [0193.190] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.190] lstrlenW (lpString=".jpg") returned 4 [0193.190] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.190] lstrlenW (lpString=".doc") returned 4 [0193.190] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.190] lstrlenW (lpString=".docx") returned 5 [0193.190] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.190] lstrlenW (lpString=".pdf") returned 4 [0193.190] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.190] lstrlenW (lpString=".xls") returned 4 [0193.190] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.190] lstrlenW (lpString=".xlsx") returned 5 [0193.190] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.190] lstrlenW (lpString=".ppt") returned 4 [0193.190] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.190] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.190] lstrlenW (lpString=".zip") returned 4 [0193.191] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.191] lstrlenW (lpString=".rar") returned 4 [0193.191] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.191] lstrlenW (lpString=".bz2") returned 4 [0193.191] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.191] lstrlenW (lpString=".7z") returned 3 [0193.191] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.191] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.191] lstrlenW (lpString=".dbf") returned 4 [0193.191] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.191] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.191] lstrlenW (lpString=".1cd") returned 4 [0193.191] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.191] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hi\\messages.json") returned 151 [0193.191] lstrlenW (lpString=".jpg") returned 4 [0193.191] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.191] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.191] lstrlenW (lpString="messages.json") returned 13 [0193.191] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.192] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=230) returned 1 [0193.192] CloseHandle (hObject=0x154) returned 1 [0193.192] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 0x2020 [0193.192] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.192] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.192] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.192] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.192] GetLastError () returned 0x0 [0193.192] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe6, lpOverlapped=0x0) returned 1 [0193.193] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.194] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.194] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.194] SetEndOfFile (hFile=0x150) returned 1 [0193.194] CloseHandle (hObject=0x150) returned 1 [0193.194] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.195] SetEndOfFile (hFile=0x154) returned 1 [0193.195] CloseHandle (hObject=0x154) returned 1 [0193.195] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.196] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json")) returned 1 [0193.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.196] lstrlenW (lpString=".doc") returned 4 [0193.196] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.196] lstrlenW (lpString=".docx") returned 5 [0193.196] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.196] lstrlenW (lpString=".pdf") returned 4 [0193.196] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.196] lstrlenW (lpString=".xls") returned 4 [0193.196] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.196] lstrlenW (lpString=".xlsx") returned 5 [0193.196] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.196] lstrlenW (lpString=".ppt") returned 4 [0193.196] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.196] lstrlenW (lpString=".zip") returned 4 [0193.196] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.196] lstrlenW (lpString=".rar") returned 4 [0193.196] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.196] lstrlenW (lpString=".bz2") returned 4 [0193.196] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.196] lstrlenW (lpString=".7z") returned 3 [0193.196] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.196] lstrlenW (lpString=".dbf") returned 4 [0193.196] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.196] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.197] lstrlenW (lpString=".1cd") returned 4 [0193.197] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.197] lstrlenW (lpString=".jpg") returned 4 [0193.197] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.197] lstrlenW (lpString=".doc") returned 4 [0193.197] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.197] lstrlenW (lpString=".docx") returned 5 [0193.197] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.197] lstrlenW (lpString=".pdf") returned 4 [0193.197] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.197] lstrlenW (lpString=".xls") returned 4 [0193.197] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.197] lstrlenW (lpString=".xlsx") returned 5 [0193.197] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.197] lstrlenW (lpString=".ppt") returned 4 [0193.197] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.197] lstrlenW (lpString=".zip") returned 4 [0193.197] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.197] lstrlenW (lpString=".rar") returned 4 [0193.197] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.197] lstrlenW (lpString=".bz2") returned 4 [0193.197] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.197] lstrlenW (lpString=".7z") returned 3 [0193.197] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.197] lstrlenW (lpString=".dbf") returned 4 [0193.197] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.197] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.197] lstrlenW (lpString=".1cd") returned 4 [0193.198] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\hu\\messages.json") returned 151 [0193.198] lstrlenW (lpString=".jpg") returned 4 [0193.198] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.198] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.198] lstrlenW (lpString="messages.json") returned 13 [0193.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.198] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=208) returned 1 [0193.198] CloseHandle (hObject=0x154) returned 1 [0193.198] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 0x2020 [0193.198] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.198] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.199] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.199] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.199] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.199] GetLastError () returned 0x0 [0193.199] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd0, lpOverlapped=0x0) returned 1 [0193.200] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.201] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.201] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.201] SetEndOfFile (hFile=0x150) returned 1 [0193.201] CloseHandle (hObject=0x150) returned 1 [0193.201] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.201] SetEndOfFile (hFile=0x154) returned 1 [0193.202] CloseHandle (hObject=0x154) returned 1 [0193.202] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.202] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0193.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.202] lstrlenW (lpString=".doc") returned 4 [0193.202] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.202] lstrlenW (lpString=".docx") returned 5 [0193.202] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.202] lstrlenW (lpString=".pdf") returned 4 [0193.203] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.203] lstrlenW (lpString=".xls") returned 4 [0193.203] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.203] lstrlenW (lpString=".xlsx") returned 5 [0193.203] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.203] lstrlenW (lpString=".ppt") returned 4 [0193.203] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.203] lstrlenW (lpString=".zip") returned 4 [0193.203] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.203] lstrlenW (lpString=".rar") returned 4 [0193.203] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.203] lstrlenW (lpString=".bz2") returned 4 [0193.203] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.203] lstrlenW (lpString=".7z") returned 3 [0193.203] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.203] lstrlenW (lpString=".dbf") returned 4 [0193.203] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.203] lstrlenW (lpString=".1cd") returned 4 [0193.203] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.203] lstrlenW (lpString=".jpg") returned 4 [0193.203] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.203] lstrlenW (lpString=".doc") returned 4 [0193.203] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.203] lstrlenW (lpString=".docx") returned 5 [0193.203] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.203] lstrlenW (lpString=".pdf") returned 4 [0193.203] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.204] lstrlenW (lpString=".xls") returned 4 [0193.204] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.204] lstrlenW (lpString=".xlsx") returned 5 [0193.204] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.204] lstrlenW (lpString=".ppt") returned 4 [0193.204] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.204] lstrlenW (lpString=".zip") returned 4 [0193.204] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.204] lstrlenW (lpString=".rar") returned 4 [0193.204] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.204] lstrlenW (lpString=".bz2") returned 4 [0193.204] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.204] lstrlenW (lpString=".7z") returned 3 [0193.204] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.204] lstrlenW (lpString=".dbf") returned 4 [0193.204] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.204] lstrlenW (lpString=".1cd") returned 4 [0193.204] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.204] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.204] lstrlenW (lpString=".jpg") returned 4 [0193.204] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.204] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.204] lstrlenW (lpString="messages.json") returned 13 [0193.204] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.205] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=221) returned 1 [0193.205] CloseHandle (hObject=0x154) returned 1 [0193.205] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 0x2020 [0193.205] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.205] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.205] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.206] GetLastError () returned 0x0 [0193.206] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xdd, lpOverlapped=0x0) returned 1 [0193.207] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.207] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.207] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.208] SetEndOfFile (hFile=0x150) returned 1 [0193.208] CloseHandle (hObject=0x150) returned 1 [0193.208] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.208] SetEndOfFile (hFile=0x154) returned 1 [0193.208] CloseHandle (hObject=0x154) returned 1 [0193.208] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.209] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0193.209] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.209] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.209] lstrlenW (lpString=".doc") returned 4 [0193.209] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.209] lstrlenW (lpString=".docx") returned 5 [0193.209] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.209] lstrlenW (lpString=".pdf") returned 4 [0193.209] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.209] lstrlenW (lpString=".xls") returned 4 [0193.209] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.209] lstrlenW (lpString=".xlsx") returned 5 [0193.209] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.209] lstrlenW (lpString=".ppt") returned 4 [0193.209] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.209] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.209] lstrlenW (lpString=".zip") returned 4 [0193.209] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.209] lstrlenW (lpString=".rar") returned 4 [0193.209] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.209] lstrlenW (lpString=".bz2") returned 4 [0193.209] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.209] lstrlenW (lpString=".7z") returned 3 [0193.210] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.210] lstrlenW (lpString=".dbf") returned 4 [0193.210] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.210] lstrlenW (lpString=".1cd") returned 4 [0193.210] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.210] lstrlenW (lpString=".jpg") returned 4 [0193.210] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.210] lstrlenW (lpString=".doc") returned 4 [0193.210] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.210] lstrlenW (lpString=".docx") returned 5 [0193.210] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.210] lstrlenW (lpString=".pdf") returned 4 [0193.210] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.210] lstrlenW (lpString=".xls") returned 4 [0193.210] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.210] lstrlenW (lpString=".xlsx") returned 5 [0193.210] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.210] lstrlenW (lpString=".ppt") returned 4 [0193.210] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.210] lstrlenW (lpString=".zip") returned 4 [0193.210] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.210] lstrlenW (lpString=".rar") returned 4 [0193.210] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.210] lstrlenW (lpString=".bz2") returned 4 [0193.210] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.210] lstrlenW (lpString=".7z") returned 3 [0193.210] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.211] lstrlenW (lpString=".dbf") returned 4 [0193.211] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.211] lstrlenW (lpString=".1cd") returned 4 [0193.211] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.211] lstrlenW (lpString=".jpg") returned 4 [0193.211] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.211] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.211] lstrlenW (lpString="messages.json") returned 13 [0193.211] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.211] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=236) returned 1 [0193.211] CloseHandle (hObject=0x154) returned 1 [0193.211] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 0x2020 [0193.212] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.212] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.212] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.212] GetLastError () returned 0x0 [0193.212] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xec, lpOverlapped=0x0) returned 1 [0193.425] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.426] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.426] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.426] SetEndOfFile (hFile=0x150) returned 1 [0193.426] CloseHandle (hObject=0x150) returned 1 [0193.427] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.427] SetEndOfFile (hFile=0x154) returned 1 [0193.427] CloseHandle (hObject=0x154) returned 1 [0193.427] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.428] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0193.428] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.428] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.428] lstrlenW (lpString=".doc") returned 4 [0193.428] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.428] lstrlenW (lpString=".docx") returned 5 [0193.428] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.428] lstrlenW (lpString=".pdf") returned 4 [0193.428] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.428] lstrlenW (lpString=".xls") returned 4 [0193.428] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.428] lstrlenW (lpString=".xlsx") returned 5 [0193.428] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.428] lstrlenW (lpString=".ppt") returned 4 [0193.428] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.428] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.428] lstrlenW (lpString=".zip") returned 4 [0193.428] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.428] lstrlenW (lpString=".rar") returned 4 [0193.428] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.428] lstrlenW (lpString=".bz2") returned 4 [0193.428] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.428] lstrlenW (lpString=".7z") returned 3 [0193.428] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.428] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.428] lstrlenW (lpString=".dbf") returned 4 [0193.428] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.429] lstrlenW (lpString=".1cd") returned 4 [0193.429] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.429] lstrlenW (lpString=".jpg") returned 4 [0193.429] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.429] lstrlenW (lpString=".doc") returned 4 [0193.429] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.429] lstrlenW (lpString=".docx") returned 5 [0193.429] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.429] lstrlenW (lpString=".pdf") returned 4 [0193.429] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.429] lstrlenW (lpString=".xls") returned 4 [0193.429] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.429] lstrlenW (lpString=".xlsx") returned 5 [0193.429] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.429] lstrlenW (lpString=".ppt") returned 4 [0193.429] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.429] lstrlenW (lpString=".zip") returned 4 [0193.429] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.429] lstrlenW (lpString=".rar") returned 4 [0193.429] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.429] lstrlenW (lpString=".bz2") returned 4 [0193.429] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.430] lstrlenW (lpString=".7z") returned 3 [0193.430] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.430] lstrlenW (lpString=".dbf") returned 4 [0193.430] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.430] lstrlenW (lpString=".1cd") returned 4 [0193.430] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.430] lstrlenW (lpString=".jpg") returned 4 [0193.430] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.430] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.430] lstrlenW (lpString="messages.json") returned 13 [0193.430] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.430] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=260) returned 1 [0193.430] CloseHandle (hObject=0x154) returned 1 [0193.431] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 0x2020 [0193.431] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.431] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.431] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.431] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.431] GetLastError () returned 0x0 [0193.431] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x104, lpOverlapped=0x0) returned 1 [0193.432] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x110, lpOverlapped=0x0) returned 1 [0193.433] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.433] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.433] SetEndOfFile (hFile=0x150) returned 1 [0193.433] CloseHandle (hObject=0x150) returned 1 [0193.433] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.433] SetEndOfFile (hFile=0x154) returned 1 [0193.434] CloseHandle (hObject=0x154) returned 1 [0193.434] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.434] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json")) returned 1 [0193.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.435] lstrlenW (lpString=".doc") returned 4 [0193.435] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.435] lstrlenW (lpString=".docx") returned 5 [0193.435] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.435] lstrlenW (lpString=".pdf") returned 4 [0193.435] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.435] lstrlenW (lpString=".xls") returned 4 [0193.435] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.435] lstrlenW (lpString=".xlsx") returned 5 [0193.435] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.435] lstrlenW (lpString=".ppt") returned 4 [0193.435] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.435] lstrlenW (lpString=".zip") returned 4 [0193.435] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.435] lstrlenW (lpString=".rar") returned 4 [0193.435] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.435] lstrlenW (lpString=".bz2") returned 4 [0193.435] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.435] lstrlenW (lpString=".7z") returned 3 [0193.435] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.435] lstrlenW (lpString=".dbf") returned 4 [0193.435] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.435] lstrlenW (lpString=".1cd") returned 4 [0193.435] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.435] lstrlenW (lpString=".jpg") returned 4 [0193.435] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.436] lstrlenW (lpString=".doc") returned 4 [0193.436] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.436] lstrlenW (lpString=".docx") returned 5 [0193.436] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.436] lstrlenW (lpString=".pdf") returned 4 [0193.436] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.436] lstrlenW (lpString=".xls") returned 4 [0193.436] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.436] lstrlenW (lpString=".xlsx") returned 5 [0193.436] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.436] lstrlenW (lpString=".ppt") returned 4 [0193.436] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.436] lstrlenW (lpString=".zip") returned 4 [0193.436] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.436] lstrlenW (lpString=".rar") returned 4 [0193.436] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.436] lstrlenW (lpString=".bz2") returned 4 [0193.436] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.436] lstrlenW (lpString=".7z") returned 3 [0193.436] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.436] lstrlenW (lpString=".dbf") returned 4 [0193.437] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.437] lstrlenW (lpString=".1cd") returned 4 [0193.437] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sr\\messages.json") returned 151 [0193.437] lstrlenW (lpString=".jpg") returned 4 [0193.437] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.437] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.437] lstrlenW (lpString="messages.json") returned 13 [0193.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.437] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=226) returned 1 [0193.437] CloseHandle (hObject=0x154) returned 1 [0193.437] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 0x2020 [0193.437] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.438] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.438] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.438] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.438] GetLastError () returned 0x0 [0193.438] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe2, lpOverlapped=0x0) returned 1 [0193.439] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.440] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.440] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.440] SetEndOfFile (hFile=0x150) returned 1 [0193.440] CloseHandle (hObject=0x150) returned 1 [0193.440] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.440] SetEndOfFile (hFile=0x154) returned 1 [0193.441] CloseHandle (hObject=0x154) returned 1 [0193.441] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.441] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json")) returned 1 [0193.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.441] lstrlenW (lpString=".doc") returned 4 [0193.442] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.442] lstrlenW (lpString=".docx") returned 5 [0193.442] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.442] lstrlenW (lpString=".pdf") returned 4 [0193.442] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.442] lstrlenW (lpString=".xls") returned 4 [0193.442] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.442] lstrlenW (lpString=".xlsx") returned 5 [0193.442] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.442] lstrlenW (lpString=".ppt") returned 4 [0193.442] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.442] lstrlenW (lpString=".zip") returned 4 [0193.442] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.442] lstrlenW (lpString=".rar") returned 4 [0193.442] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.442] lstrlenW (lpString=".bz2") returned 4 [0193.442] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.442] lstrlenW (lpString=".7z") returned 3 [0193.442] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.442] lstrlenW (lpString=".dbf") returned 4 [0193.442] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.442] lstrlenW (lpString=".1cd") returned 4 [0193.442] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.442] lstrlenW (lpString=".jpg") returned 4 [0193.442] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.443] lstrlenW (lpString=".doc") returned 4 [0193.443] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.443] lstrlenW (lpString=".docx") returned 5 [0193.443] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.443] lstrlenW (lpString=".pdf") returned 4 [0193.443] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.443] lstrlenW (lpString=".xls") returned 4 [0193.443] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.443] lstrlenW (lpString=".xlsx") returned 5 [0193.443] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.443] lstrlenW (lpString=".ppt") returned 4 [0193.443] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.443] lstrlenW (lpString=".zip") returned 4 [0193.443] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.443] lstrlenW (lpString=".rar") returned 4 [0193.443] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.443] lstrlenW (lpString=".bz2") returned 4 [0193.443] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.443] lstrlenW (lpString=".7z") returned 3 [0193.443] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.443] lstrlenW (lpString=".dbf") returned 4 [0193.443] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.443] lstrlenW (lpString=".1cd") returned 4 [0193.443] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\sv\\messages.json") returned 151 [0193.443] lstrlenW (lpString=".jpg") returned 4 [0193.443] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.444] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.444] lstrlenW (lpString="messages.json") returned 13 [0193.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.445] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=260) returned 1 [0193.445] CloseHandle (hObject=0x154) returned 1 [0193.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 0x2020 [0193.445] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.445] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.445] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.445] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.445] GetLastError () returned 0x0 [0193.445] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x104, lpOverlapped=0x0) returned 1 [0193.446] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x110, lpOverlapped=0x0) returned 1 [0193.447] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.447] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.447] SetEndOfFile (hFile=0x150) returned 1 [0193.448] CloseHandle (hObject=0x150) returned 1 [0193.448] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.448] SetEndOfFile (hFile=0x154) returned 1 [0193.448] CloseHandle (hObject=0x154) returned 1 [0193.448] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.449] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json")) returned 1 [0193.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.449] lstrlenW (lpString=".doc") returned 4 [0193.449] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.449] lstrlenW (lpString=".docx") returned 5 [0193.449] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.449] lstrlenW (lpString=".pdf") returned 4 [0193.449] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.449] lstrlenW (lpString=".xls") returned 4 [0193.449] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.449] lstrlenW (lpString=".xlsx") returned 5 [0193.449] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.449] lstrlenW (lpString=".ppt") returned 4 [0193.449] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.449] lstrlenW (lpString=".zip") returned 4 [0193.449] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.449] lstrlenW (lpString=".rar") returned 4 [0193.449] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.449] lstrlenW (lpString=".bz2") returned 4 [0193.449] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.449] lstrlenW (lpString=".7z") returned 3 [0193.449] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.449] lstrlenW (lpString=".dbf") returned 4 [0193.450] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.450] lstrlenW (lpString=".1cd") returned 4 [0193.450] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.450] lstrlenW (lpString=".jpg") returned 4 [0193.450] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.450] lstrlenW (lpString=".doc") returned 4 [0193.450] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.450] lstrlenW (lpString=".docx") returned 5 [0193.450] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.450] lstrlenW (lpString=".pdf") returned 4 [0193.450] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.450] lstrlenW (lpString=".xls") returned 4 [0193.450] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.450] lstrlenW (lpString=".xlsx") returned 5 [0193.450] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.450] lstrlenW (lpString=".ppt") returned 4 [0193.450] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.450] lstrlenW (lpString=".zip") returned 4 [0193.450] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.450] lstrlenW (lpString=".rar") returned 4 [0193.450] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.450] lstrlenW (lpString=".bz2") returned 4 [0193.450] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.450] lstrlenW (lpString=".7z") returned 3 [0193.450] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.451] lstrlenW (lpString=".dbf") returned 4 [0193.451] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.451] lstrlenW (lpString=".1cd") returned 4 [0193.451] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.451] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\th\\messages.json") returned 151 [0193.451] lstrlenW (lpString=".jpg") returned 4 [0193.451] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.451] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.451] lstrlenW (lpString="messages.json") returned 13 [0193.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.451] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=221) returned 1 [0193.451] CloseHandle (hObject=0x154) returned 1 [0193.451] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 0x2020 [0193.452] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.452] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.452] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.452] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.452] GetLastError () returned 0x0 [0193.453] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xdd, lpOverlapped=0x0) returned 1 [0193.453] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.454] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.454] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.454] SetEndOfFile (hFile=0x150) returned 1 [0193.455] CloseHandle (hObject=0x150) returned 1 [0193.455] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.455] SetEndOfFile (hFile=0x154) returned 1 [0193.455] CloseHandle (hObject=0x154) returned 1 [0193.456] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.456] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0193.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.456] lstrlenW (lpString=".doc") returned 4 [0193.456] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.456] lstrlenW (lpString=".docx") returned 5 [0193.456] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.456] lstrlenW (lpString=".pdf") returned 4 [0193.456] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.456] lstrlenW (lpString=".xls") returned 4 [0193.456] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.456] lstrlenW (lpString=".xlsx") returned 5 [0193.456] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.456] lstrlenW (lpString=".ppt") returned 4 [0193.456] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.456] lstrlenW (lpString=".zip") returned 4 [0193.456] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.456] lstrlenW (lpString=".rar") returned 4 [0193.456] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.457] lstrlenW (lpString=".bz2") returned 4 [0193.457] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.457] lstrlenW (lpString=".7z") returned 3 [0193.457] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.457] lstrlenW (lpString=".dbf") returned 4 [0193.457] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.457] lstrlenW (lpString=".1cd") returned 4 [0193.457] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.457] lstrlenW (lpString=".jpg") returned 4 [0193.457] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.457] lstrlenW (lpString=".doc") returned 4 [0193.457] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.457] lstrlenW (lpString=".docx") returned 5 [0193.457] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.457] lstrlenW (lpString=".pdf") returned 4 [0193.457] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.457] lstrlenW (lpString=".xls") returned 4 [0193.457] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.457] lstrlenW (lpString=".xlsx") returned 5 [0193.457] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.457] lstrlenW (lpString=".ppt") returned 4 [0193.457] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.457] lstrlenW (lpString=".zip") returned 4 [0193.457] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.457] lstrlenW (lpString=".rar") returned 4 [0193.457] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.458] lstrlenW (lpString=".bz2") returned 4 [0193.458] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.458] lstrlenW (lpString=".7z") returned 3 [0193.458] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.458] lstrlenW (lpString=".dbf") returned 4 [0193.458] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.458] lstrlenW (lpString=".1cd") returned 4 [0193.458] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.458] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.458] lstrlenW (lpString=".jpg") returned 4 [0193.458] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.458] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.458] lstrlenW (lpString="messages.json") returned 13 [0193.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.458] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=270) returned 1 [0193.459] CloseHandle (hObject=0x154) returned 1 [0193.459] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 0x2020 [0193.459] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.459] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.459] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.459] GetLastError () returned 0x0 [0193.459] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x10e, lpOverlapped=0x0) returned 1 [0193.542] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x110, lpOverlapped=0x0) returned 1 [0193.543] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.543] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.543] SetEndOfFile (hFile=0x150) returned 1 [0193.543] CloseHandle (hObject=0x150) returned 1 [0193.544] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.544] SetEndOfFile (hFile=0x154) returned 1 [0193.544] CloseHandle (hObject=0x154) returned 1 [0193.544] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.544] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0193.545] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.545] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.545] lstrlenW (lpString=".doc") returned 4 [0193.545] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.545] lstrlenW (lpString=".docx") returned 5 [0193.545] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.545] lstrlenW (lpString=".pdf") returned 4 [0193.545] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.545] lstrlenW (lpString=".xls") returned 4 [0193.545] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.545] lstrlenW (lpString=".xlsx") returned 5 [0193.545] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.545] lstrlenW (lpString=".ppt") returned 4 [0193.545] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.545] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.545] lstrlenW (lpString=".zip") returned 4 [0193.545] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.545] lstrlenW (lpString=".rar") returned 4 [0193.545] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.545] lstrlenW (lpString=".bz2") returned 4 [0193.546] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.546] lstrlenW (lpString=".7z") returned 3 [0193.546] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.546] lstrlenW (lpString=".dbf") returned 4 [0193.546] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.546] lstrlenW (lpString=".1cd") returned 4 [0193.546] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.546] lstrlenW (lpString=".jpg") returned 4 [0193.546] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.546] lstrlenW (lpString=".doc") returned 4 [0193.546] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.546] lstrlenW (lpString=".docx") returned 5 [0193.546] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.546] lstrlenW (lpString=".pdf") returned 4 [0193.546] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.546] lstrlenW (lpString=".xls") returned 4 [0193.546] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.546] lstrlenW (lpString=".xlsx") returned 5 [0193.546] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.546] lstrlenW (lpString=".ppt") returned 4 [0193.546] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.546] lstrlenW (lpString=".zip") returned 4 [0193.547] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.547] lstrlenW (lpString=".rar") returned 4 [0193.547] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.547] lstrlenW (lpString=".bz2") returned 4 [0193.547] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.547] lstrlenW (lpString=".7z") returned 3 [0193.547] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.547] lstrlenW (lpString=".dbf") returned 4 [0193.547] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.547] lstrlenW (lpString=".1cd") returned 4 [0193.547] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.547] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.547] lstrlenW (lpString=".jpg") returned 4 [0193.547] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.547] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.547] lstrlenW (lpString="messages.json") returned 13 [0193.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.548] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=246) returned 1 [0193.548] CloseHandle (hObject=0x154) returned 1 [0193.548] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 0x2020 [0193.548] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.549] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.549] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.549] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.549] GetLastError () returned 0x0 [0193.549] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xf6, lpOverlapped=0x0) returned 1 [0193.550] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x100, lpOverlapped=0x0) returned 1 [0193.551] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.551] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.551] SetEndOfFile (hFile=0x150) returned 1 [0193.551] CloseHandle (hObject=0x150) returned 1 [0193.551] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.552] SetEndOfFile (hFile=0x154) returned 1 [0193.552] CloseHandle (hObject=0x154) returned 1 [0193.552] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.552] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json")) returned 1 [0193.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.553] lstrlenW (lpString=".doc") returned 4 [0193.553] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.553] lstrlenW (lpString=".docx") returned 5 [0193.553] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.553] lstrlenW (lpString=".pdf") returned 4 [0193.553] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.553] lstrlenW (lpString=".xls") returned 4 [0193.553] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.553] lstrlenW (lpString=".xlsx") returned 5 [0193.553] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.553] lstrlenW (lpString=".ppt") returned 4 [0193.553] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.553] lstrlenW (lpString=".zip") returned 4 [0193.553] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.553] lstrlenW (lpString=".rar") returned 4 [0193.553] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.553] lstrlenW (lpString=".bz2") returned 4 [0193.553] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.553] lstrlenW (lpString=".7z") returned 3 [0193.553] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.553] lstrlenW (lpString=".dbf") returned 4 [0193.553] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.554] lstrlenW (lpString=".1cd") returned 4 [0193.554] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.554] lstrlenW (lpString=".jpg") returned 4 [0193.554] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.554] lstrlenW (lpString=".doc") returned 4 [0193.554] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.554] lstrlenW (lpString=".docx") returned 5 [0193.554] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.554] lstrlenW (lpString=".pdf") returned 4 [0193.554] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.554] lstrlenW (lpString=".xls") returned 4 [0193.554] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.554] lstrlenW (lpString=".xlsx") returned 5 [0193.554] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.554] lstrlenW (lpString=".ppt") returned 4 [0193.554] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.554] lstrlenW (lpString=".zip") returned 4 [0193.554] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.554] lstrlenW (lpString=".rar") returned 4 [0193.554] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.554] lstrlenW (lpString=".bz2") returned 4 [0193.554] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.554] lstrlenW (lpString=".7z") returned 3 [0193.554] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.554] lstrlenW (lpString=".dbf") returned 4 [0193.555] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.555] lstrlenW (lpString=".1cd") returned 4 [0193.555] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ar\\messages.json") returned 151 [0193.555] lstrlenW (lpString=".jpg") returned 4 [0193.555] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.555] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.555] lstrlenW (lpString="messages.json") returned 13 [0193.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.556] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=264) returned 1 [0193.556] CloseHandle (hObject=0x154) returned 1 [0193.556] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 0x2020 [0193.556] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.556] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.557] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.557] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.557] GetLastError () returned 0x0 [0193.557] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x108, lpOverlapped=0x0) returned 1 [0193.558] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x110, lpOverlapped=0x0) returned 1 [0193.559] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.559] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.559] SetEndOfFile (hFile=0x150) returned 1 [0193.559] CloseHandle (hObject=0x150) returned 1 [0193.559] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.559] SetEndOfFile (hFile=0x154) returned 1 [0193.560] CloseHandle (hObject=0x154) returned 1 [0193.560] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.560] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json")) returned 1 [0193.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.560] lstrlenW (lpString=".doc") returned 4 [0193.560] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.560] lstrlenW (lpString=".docx") returned 5 [0193.560] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.560] lstrlenW (lpString=".pdf") returned 4 [0193.561] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.561] lstrlenW (lpString=".xls") returned 4 [0193.561] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.561] lstrlenW (lpString=".xlsx") returned 5 [0193.561] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.561] lstrlenW (lpString=".ppt") returned 4 [0193.561] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.561] lstrlenW (lpString=".zip") returned 4 [0193.561] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.561] lstrlenW (lpString=".rar") returned 4 [0193.561] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.561] lstrlenW (lpString=".bz2") returned 4 [0193.562] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.562] lstrlenW (lpString=".7z") returned 3 [0193.562] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.562] lstrlenW (lpString=".dbf") returned 4 [0193.562] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.562] lstrlenW (lpString=".1cd") returned 4 [0193.562] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.562] lstrlenW (lpString=".jpg") returned 4 [0193.562] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.562] lstrlenW (lpString=".doc") returned 4 [0193.562] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.562] lstrlenW (lpString=".docx") returned 5 [0193.562] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.562] lstrlenW (lpString=".pdf") returned 4 [0193.562] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.562] lstrlenW (lpString=".xls") returned 4 [0193.563] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.563] lstrlenW (lpString=".xlsx") returned 5 [0193.563] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.563] lstrlenW (lpString=".ppt") returned 4 [0193.563] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.563] lstrlenW (lpString=".zip") returned 4 [0193.563] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.563] lstrlenW (lpString=".rar") returned 4 [0193.563] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.563] lstrlenW (lpString=".bz2") returned 4 [0193.563] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.563] lstrlenW (lpString=".7z") returned 3 [0193.563] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.563] lstrlenW (lpString=".dbf") returned 4 [0193.563] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.563] lstrlenW (lpString=".1cd") returned 4 [0193.563] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\bg\\messages.json") returned 151 [0193.563] lstrlenW (lpString=".jpg") returned 4 [0193.563] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.563] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.563] lstrlenW (lpString="messages.json") returned 13 [0193.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.564] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=207) returned 1 [0193.564] CloseHandle (hObject=0x154) returned 1 [0193.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 0x2020 [0193.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.564] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.564] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.565] GetLastError () returned 0x0 [0193.565] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xcf, lpOverlapped=0x0) returned 1 [0193.566] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xd0, lpOverlapped=0x0) returned 1 [0193.567] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.567] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.567] SetEndOfFile (hFile=0x150) returned 1 [0193.567] CloseHandle (hObject=0x150) returned 1 [0193.567] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.567] SetEndOfFile (hFile=0x154) returned 1 [0193.568] CloseHandle (hObject=0x154) returned 1 [0193.568] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.568] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json")) returned 1 [0193.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.568] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.568] lstrlenW (lpString=".doc") returned 4 [0193.568] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.568] lstrlenW (lpString=".docx") returned 5 [0193.568] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.568] lstrlenW (lpString=".pdf") returned 4 [0193.568] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.568] lstrlenW (lpString=".xls") returned 4 [0193.569] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.569] lstrlenW (lpString=".xlsx") returned 5 [0193.569] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.569] lstrlenW (lpString=".ppt") returned 4 [0193.569] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.569] lstrlenW (lpString=".zip") returned 4 [0193.569] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.569] lstrlenW (lpString=".rar") returned 4 [0193.569] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.569] lstrlenW (lpString=".bz2") returned 4 [0193.569] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.569] lstrlenW (lpString=".7z") returned 3 [0193.569] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.569] lstrlenW (lpString=".dbf") returned 4 [0193.569] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.569] lstrlenW (lpString=".1cd") returned 4 [0193.569] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.569] lstrlenW (lpString=".jpg") returned 4 [0193.569] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.569] lstrlenW (lpString=".doc") returned 4 [0193.569] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.569] lstrlenW (lpString=".docx") returned 5 [0193.569] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.569] lstrlenW (lpString=".pdf") returned 4 [0193.569] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.570] lstrlenW (lpString=".xls") returned 4 [0193.570] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.570] lstrlenW (lpString=".xlsx") returned 5 [0193.570] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.570] lstrlenW (lpString=".ppt") returned 4 [0193.570] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.570] lstrlenW (lpString=".zip") returned 4 [0193.570] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.570] lstrlenW (lpString=".rar") returned 4 [0193.570] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.570] lstrlenW (lpString=".bz2") returned 4 [0193.570] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.570] lstrlenW (lpString=".7z") returned 3 [0193.570] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.570] lstrlenW (lpString=".dbf") returned 4 [0193.570] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.570] lstrlenW (lpString=".1cd") returned 4 [0193.570] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ca\\messages.json") returned 151 [0193.570] lstrlenW (lpString=".jpg") returned 4 [0193.570] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.570] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.570] lstrlenW (lpString="messages.json") returned 13 [0193.570] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.571] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=222) returned 1 [0193.571] CloseHandle (hObject=0x154) returned 1 [0193.571] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 0x2020 [0193.571] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.571] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.571] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.572] GetLastError () returned 0x0 [0193.572] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xde, lpOverlapped=0x0) returned 1 [0193.573] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.573] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.573] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.574] SetEndOfFile (hFile=0x150) returned 1 [0193.574] CloseHandle (hObject=0x150) returned 1 [0193.574] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.574] SetEndOfFile (hFile=0x154) returned 1 [0193.574] CloseHandle (hObject=0x154) returned 1 [0193.575] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.575] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json")) returned 1 [0193.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.575] lstrlenW (lpString=".doc") returned 4 [0193.575] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.575] lstrlenW (lpString=".docx") returned 5 [0193.575] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.575] lstrlenW (lpString=".pdf") returned 4 [0193.575] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.575] lstrlenW (lpString=".xls") returned 4 [0193.575] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.575] lstrlenW (lpString=".xlsx") returned 5 [0193.575] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.575] lstrlenW (lpString=".ppt") returned 4 [0193.575] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.575] lstrlenW (lpString=".zip") returned 4 [0193.575] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.575] lstrlenW (lpString=".rar") returned 4 [0193.575] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.575] lstrlenW (lpString=".bz2") returned 4 [0193.576] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.576] lstrlenW (lpString=".7z") returned 3 [0193.576] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.576] lstrlenW (lpString=".dbf") returned 4 [0193.576] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.576] lstrlenW (lpString=".1cd") returned 4 [0193.576] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.576] lstrlenW (lpString=".jpg") returned 4 [0193.576] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.576] lstrlenW (lpString=".doc") returned 4 [0193.576] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.576] lstrlenW (lpString=".docx") returned 5 [0193.576] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.576] lstrlenW (lpString=".pdf") returned 4 [0193.576] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.576] lstrlenW (lpString=".xls") returned 4 [0193.576] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.576] lstrlenW (lpString=".xlsx") returned 5 [0193.576] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.576] lstrlenW (lpString=".ppt") returned 4 [0193.576] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.576] lstrlenW (lpString=".zip") returned 4 [0193.576] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.576] lstrlenW (lpString=".rar") returned 4 [0193.576] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.576] lstrlenW (lpString=".bz2") returned 4 [0193.659] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.659] lstrlenW (lpString=".7z") returned 3 [0193.659] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.660] lstrlenW (lpString=".dbf") returned 4 [0193.660] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.660] lstrlenW (lpString=".1cd") returned 4 [0193.660] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\cs\\messages.json") returned 151 [0193.660] lstrlenW (lpString=".jpg") returned 4 [0193.660] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.660] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.660] lstrlenW (lpString="messages.json") returned 13 [0193.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.660] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=209) returned 1 [0193.660] CloseHandle (hObject=0x154) returned 1 [0193.660] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 0x2020 [0193.661] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.661] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.661] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.661] GetLastError () returned 0x0 [0193.661] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd1, lpOverlapped=0x0) returned 1 [0193.662] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.663] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.663] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.663] SetEndOfFile (hFile=0x150) returned 1 [0193.664] CloseHandle (hObject=0x150) returned 1 [0193.664] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.664] SetEndOfFile (hFile=0x154) returned 1 [0193.664] CloseHandle (hObject=0x154) returned 1 [0193.664] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.665] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_us\\messages.json")) returned 1 [0193.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.665] lstrlenW (lpString=".doc") returned 4 [0193.665] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.665] lstrlenW (lpString=".docx") returned 5 [0193.665] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.665] lstrlenW (lpString=".pdf") returned 4 [0193.665] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.665] lstrlenW (lpString=".xls") returned 4 [0193.665] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.665] lstrlenW (lpString=".xlsx") returned 5 [0193.665] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.665] lstrlenW (lpString=".ppt") returned 4 [0193.665] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.665] lstrlenW (lpString=".zip") returned 4 [0193.665] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.665] lstrlenW (lpString=".rar") returned 4 [0193.665] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.665] lstrlenW (lpString=".bz2") returned 4 [0193.665] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.665] lstrlenW (lpString=".7z") returned 3 [0193.665] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.666] lstrlenW (lpString=".dbf") returned 4 [0193.666] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.666] lstrlenW (lpString=".1cd") returned 4 [0193.666] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.666] lstrlenW (lpString=".jpg") returned 4 [0193.666] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.666] lstrlenW (lpString=".doc") returned 4 [0193.666] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.666] lstrlenW (lpString=".docx") returned 5 [0193.666] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.666] lstrlenW (lpString=".pdf") returned 4 [0193.666] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.666] lstrlenW (lpString=".xls") returned 4 [0193.666] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.666] lstrlenW (lpString=".xlsx") returned 5 [0193.666] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.666] lstrlenW (lpString=".ppt") returned 4 [0193.666] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.666] lstrlenW (lpString=".zip") returned 4 [0193.666] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.666] lstrlenW (lpString=".rar") returned 4 [0193.666] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.666] lstrlenW (lpString=".bz2") returned 4 [0193.666] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.666] lstrlenW (lpString=".7z") returned 3 [0193.667] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.667] lstrlenW (lpString=".dbf") returned 4 [0193.667] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.667] lstrlenW (lpString=".1cd") returned 4 [0193.667] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\en_US\\messages.json") returned 154 [0193.667] lstrlenW (lpString=".jpg") returned 4 [0193.667] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.667] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.667] lstrlenW (lpString="messages.json") returned 13 [0193.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.667] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=206) returned 1 [0193.667] CloseHandle (hObject=0x154) returned 1 [0193.667] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 0x2020 [0193.668] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.668] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.668] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.668] GetLastError () returned 0x0 [0193.668] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xce, lpOverlapped=0x0) returned 1 [0193.669] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xd0, lpOverlapped=0x0) returned 1 [0193.670] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.670] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.670] SetEndOfFile (hFile=0x150) returned 1 [0193.670] CloseHandle (hObject=0x150) returned 1 [0193.670] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.670] SetEndOfFile (hFile=0x154) returned 1 [0193.671] CloseHandle (hObject=0x154) returned 1 [0193.671] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.671] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json")) returned 1 [0193.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.672] lstrlenW (lpString=".doc") returned 4 [0193.672] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.672] lstrlenW (lpString=".docx") returned 5 [0193.672] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.672] lstrlenW (lpString=".pdf") returned 4 [0193.672] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.672] lstrlenW (lpString=".xls") returned 4 [0193.672] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.672] lstrlenW (lpString=".xlsx") returned 5 [0193.672] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.672] lstrlenW (lpString=".ppt") returned 4 [0193.672] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.672] lstrlenW (lpString=".zip") returned 4 [0193.672] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.672] lstrlenW (lpString=".rar") returned 4 [0193.672] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.672] lstrlenW (lpString=".bz2") returned 4 [0193.672] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.672] lstrlenW (lpString=".7z") returned 3 [0193.672] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.672] lstrlenW (lpString=".dbf") returned 4 [0193.672] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.672] lstrlenW (lpString=".1cd") returned 4 [0193.672] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.672] lstrlenW (lpString=".jpg") returned 4 [0193.673] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.673] lstrlenW (lpString=".doc") returned 4 [0193.673] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.673] lstrlenW (lpString=".docx") returned 5 [0193.673] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.673] lstrlenW (lpString=".pdf") returned 4 [0193.673] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.673] lstrlenW (lpString=".xls") returned 4 [0193.673] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.673] lstrlenW (lpString=".xlsx") returned 5 [0193.673] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.673] lstrlenW (lpString=".ppt") returned 4 [0193.673] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.673] lstrlenW (lpString=".zip") returned 4 [0193.673] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.673] lstrlenW (lpString=".rar") returned 4 [0193.673] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.673] lstrlenW (lpString=".bz2") returned 4 [0193.673] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.673] lstrlenW (lpString=".7z") returned 3 [0193.673] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.673] lstrlenW (lpString=".dbf") returned 4 [0193.673] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.673] lstrlenW (lpString=".1cd") returned 4 [0193.673] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es\\messages.json") returned 151 [0193.674] lstrlenW (lpString=".jpg") returned 4 [0193.674] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.674] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.674] lstrlenW (lpString="messages.json") returned 13 [0193.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.674] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=206) returned 1 [0193.674] CloseHandle (hObject=0x154) returned 1 [0193.674] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0193.674] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.674] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.675] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.675] GetLastError () returned 0x0 [0193.675] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xce, lpOverlapped=0x0) returned 1 [0193.676] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xd0, lpOverlapped=0x0) returned 1 [0193.677] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.677] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.677] SetEndOfFile (hFile=0x150) returned 1 [0193.677] CloseHandle (hObject=0x150) returned 1 [0193.678] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.678] SetEndOfFile (hFile=0x154) returned 1 [0193.678] CloseHandle (hObject=0x154) returned 1 [0193.678] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.679] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json")) returned 1 [0193.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.679] lstrlenW (lpString=".doc") returned 4 [0193.679] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.679] lstrlenW (lpString=".docx") returned 5 [0193.679] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.679] lstrlenW (lpString=".pdf") returned 4 [0193.679] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.679] lstrlenW (lpString=".xls") returned 4 [0193.679] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.679] lstrlenW (lpString=".xlsx") returned 5 [0193.679] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.679] lstrlenW (lpString=".ppt") returned 4 [0193.679] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.679] lstrlenW (lpString=".zip") returned 4 [0193.679] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.679] lstrlenW (lpString=".rar") returned 4 [0193.679] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.679] lstrlenW (lpString=".bz2") returned 4 [0193.679] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.679] lstrlenW (lpString=".7z") returned 3 [0193.679] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.679] lstrlenW (lpString=".dbf") returned 4 [0193.679] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.680] lstrlenW (lpString=".1cd") returned 4 [0193.680] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.680] lstrlenW (lpString=".jpg") returned 4 [0193.680] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.680] lstrlenW (lpString=".doc") returned 4 [0193.680] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.680] lstrlenW (lpString=".docx") returned 5 [0193.680] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.680] lstrlenW (lpString=".pdf") returned 4 [0193.680] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.680] lstrlenW (lpString=".xls") returned 4 [0193.680] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.680] lstrlenW (lpString=".xlsx") returned 5 [0193.680] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.680] lstrlenW (lpString=".ppt") returned 4 [0193.680] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.680] lstrlenW (lpString=".zip") returned 4 [0193.680] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.680] lstrlenW (lpString=".rar") returned 4 [0193.680] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.680] lstrlenW (lpString=".bz2") returned 4 [0193.680] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.680] lstrlenW (lpString=".7z") returned 3 [0193.680] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.680] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.680] lstrlenW (lpString=".dbf") returned 4 [0193.681] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.681] lstrlenW (lpString=".1cd") returned 4 [0193.681] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\es_419\\messages.json") returned 155 [0193.681] lstrlenW (lpString=".jpg") returned 4 [0193.681] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.681] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.681] lstrlenW (lpString="messages.json") returned 13 [0193.681] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.681] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=216) returned 1 [0193.681] CloseHandle (hObject=0x154) returned 1 [0193.681] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 0x2020 [0193.681] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.682] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.682] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.682] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.682] GetLastError () returned 0x0 [0193.682] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd8, lpOverlapped=0x0) returned 1 [0193.683] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.684] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.684] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.684] SetEndOfFile (hFile=0x150) returned 1 [0193.684] CloseHandle (hObject=0x150) returned 1 [0193.684] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.684] SetEndOfFile (hFile=0x154) returned 1 [0193.685] CloseHandle (hObject=0x154) returned 1 [0193.685] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.685] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0193.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.685] lstrlenW (lpString=".doc") returned 4 [0193.685] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.686] lstrlenW (lpString=".docx") returned 5 [0193.686] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.686] lstrlenW (lpString=".pdf") returned 4 [0193.686] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.686] lstrlenW (lpString=".xls") returned 4 [0193.686] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.686] lstrlenW (lpString=".xlsx") returned 5 [0193.687] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.687] lstrlenW (lpString=".ppt") returned 4 [0193.687] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.687] lstrlenW (lpString=".zip") returned 4 [0193.687] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.687] lstrlenW (lpString=".rar") returned 4 [0193.687] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.687] lstrlenW (lpString=".bz2") returned 4 [0193.687] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.687] lstrlenW (lpString=".7z") returned 3 [0193.687] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.687] lstrlenW (lpString=".dbf") returned 4 [0193.687] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.687] lstrlenW (lpString=".1cd") returned 4 [0193.687] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.687] lstrlenW (lpString=".jpg") returned 4 [0193.687] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.687] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.688] lstrlenW (lpString=".doc") returned 4 [0193.688] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.688] lstrlenW (lpString=".docx") returned 5 [0193.688] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.688] lstrlenW (lpString=".pdf") returned 4 [0193.688] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.688] lstrlenW (lpString=".xls") returned 4 [0193.688] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.688] lstrlenW (lpString=".xlsx") returned 5 [0193.688] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.688] lstrlenW (lpString=".ppt") returned 4 [0193.688] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.688] lstrlenW (lpString=".zip") returned 4 [0193.688] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.688] lstrlenW (lpString=".rar") returned 4 [0193.688] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.688] lstrlenW (lpString=".bz2") returned 4 [0193.688] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.688] lstrlenW (lpString=".7z") returned 3 [0193.688] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.688] lstrlenW (lpString=".dbf") returned 4 [0193.688] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.688] lstrlenW (lpString=".1cd") returned 4 [0193.688] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.688] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.688] lstrlenW (lpString=".jpg") returned 4 [0193.688] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.689] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.689] lstrlenW (lpString="messages.json") returned 13 [0193.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.689] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=216) returned 1 [0193.689] CloseHandle (hObject=0x154) returned 1 [0193.689] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 0x2020 [0193.689] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.689] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.689] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.689] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.690] GetLastError () returned 0x0 [0193.690] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd8, lpOverlapped=0x0) returned 1 [0193.691] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.692] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.692] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.692] SetEndOfFile (hFile=0x150) returned 1 [0193.692] CloseHandle (hObject=0x150) returned 1 [0193.692] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.692] SetEndOfFile (hFile=0x154) returned 1 [0193.693] CloseHandle (hObject=0x154) returned 1 [0193.693] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.693] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0193.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.693] lstrlenW (lpString=".doc") returned 4 [0193.693] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.693] lstrlenW (lpString=".docx") returned 5 [0193.693] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.693] lstrlenW (lpString=".pdf") returned 4 [0193.693] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.693] lstrlenW (lpString=".xls") returned 4 [0193.694] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.694] lstrlenW (lpString=".xlsx") returned 5 [0193.694] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.694] lstrlenW (lpString=".ppt") returned 4 [0193.694] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.694] lstrlenW (lpString=".zip") returned 4 [0193.694] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.694] lstrlenW (lpString=".rar") returned 4 [0193.694] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.694] lstrlenW (lpString=".bz2") returned 4 [0193.694] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.694] lstrlenW (lpString=".7z") returned 3 [0193.694] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.694] lstrlenW (lpString=".dbf") returned 4 [0193.694] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.694] lstrlenW (lpString=".1cd") returned 4 [0193.694] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.694] lstrlenW (lpString=".jpg") returned 4 [0193.694] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.694] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.694] lstrlenW (lpString=".doc") returned 4 [0193.694] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.694] lstrlenW (lpString=".docx") returned 5 [0193.694] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.694] lstrlenW (lpString=".pdf") returned 4 [0193.694] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.695] lstrlenW (lpString=".xls") returned 4 [0193.695] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.695] lstrlenW (lpString=".xlsx") returned 5 [0193.695] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.695] lstrlenW (lpString=".ppt") returned 4 [0193.695] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.695] lstrlenW (lpString=".zip") returned 4 [0193.695] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.695] lstrlenW (lpString=".rar") returned 4 [0193.695] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.695] lstrlenW (lpString=".bz2") returned 4 [0193.695] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.695] lstrlenW (lpString=".7z") returned 3 [0193.695] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.695] lstrlenW (lpString=".dbf") returned 4 [0193.695] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.695] lstrlenW (lpString=".1cd") returned 4 [0193.695] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.695] lstrlenW (lpString=".jpg") returned 4 [0193.695] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.695] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.695] lstrlenW (lpString="messages.json") returned 13 [0193.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.696] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=219) returned 1 [0193.696] CloseHandle (hObject=0x154) returned 1 [0193.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 0x2020 [0193.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.696] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.696] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.697] GetLastError () returned 0x0 [0193.697] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xdb, lpOverlapped=0x0) returned 1 [0193.880] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.881] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.881] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.881] SetEndOfFile (hFile=0x150) returned 1 [0193.881] CloseHandle (hObject=0x150) returned 1 [0193.881] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.881] SetEndOfFile (hFile=0x154) returned 1 [0193.882] CloseHandle (hObject=0x154) returned 1 [0193.882] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.882] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0193.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.882] lstrlenW (lpString=".doc") returned 4 [0193.882] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.882] lstrlenW (lpString=".docx") returned 5 [0193.882] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.882] lstrlenW (lpString=".pdf") returned 4 [0193.882] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.883] lstrlenW (lpString=".xls") returned 4 [0193.883] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.883] lstrlenW (lpString=".xlsx") returned 5 [0193.883] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.883] lstrlenW (lpString=".ppt") returned 4 [0193.883] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.883] lstrlenW (lpString=".zip") returned 4 [0193.883] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.883] lstrlenW (lpString=".rar") returned 4 [0193.883] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.883] lstrlenW (lpString=".bz2") returned 4 [0193.883] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.883] lstrlenW (lpString=".7z") returned 3 [0193.883] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.883] lstrlenW (lpString=".dbf") returned 4 [0193.883] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.883] lstrlenW (lpString=".1cd") returned 4 [0193.883] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.883] lstrlenW (lpString=".jpg") returned 4 [0193.883] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.883] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.883] lstrlenW (lpString=".doc") returned 4 [0193.883] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.883] lstrlenW (lpString=".docx") returned 5 [0193.883] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.883] lstrlenW (lpString=".pdf") returned 4 [0193.884] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.884] lstrlenW (lpString=".xls") returned 4 [0193.884] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.884] lstrlenW (lpString=".xlsx") returned 5 [0193.884] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.884] lstrlenW (lpString=".ppt") returned 4 [0193.884] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.884] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.884] lstrlenW (lpString=".zip") returned 4 [0193.884] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.884] lstrlenW (lpString=".rar") returned 4 [0193.884] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.884] lstrlenW (lpString=".bz2") returned 4 [0193.884] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.884] lstrlenW (lpString=".7z") returned 3 [0193.884] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.884] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.884] lstrlenW (lpString=".dbf") returned 4 [0193.884] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.884] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.884] lstrlenW (lpString=".1cd") returned 4 [0193.884] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.884] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.884] lstrlenW (lpString=".jpg") returned 4 [0193.884] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.884] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.884] lstrlenW (lpString="messages.json") returned 13 [0193.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.885] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=227) returned 1 [0193.885] CloseHandle (hObject=0x154) returned 1 [0193.885] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 0x2020 [0193.885] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.885] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.885] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.887] GetLastError () returned 0x0 [0193.887] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe3, lpOverlapped=0x0) returned 1 [0193.888] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.890] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.890] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.890] SetEndOfFile (hFile=0x150) returned 1 [0193.890] CloseHandle (hObject=0x150) returned 1 [0193.891] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.891] SetEndOfFile (hFile=0x154) returned 1 [0193.891] CloseHandle (hObject=0x154) returned 1 [0193.891] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.892] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json")) returned 1 [0193.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.892] lstrlenW (lpString=".doc") returned 4 [0193.892] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.892] lstrlenW (lpString=".docx") returned 5 [0193.892] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.892] lstrlenW (lpString=".pdf") returned 4 [0193.892] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.892] lstrlenW (lpString=".xls") returned 4 [0193.892] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.892] lstrlenW (lpString=".xlsx") returned 5 [0193.892] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.892] lstrlenW (lpString=".ppt") returned 4 [0193.892] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.892] lstrlenW (lpString=".zip") returned 4 [0193.892] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.892] lstrlenW (lpString=".rar") returned 4 [0193.892] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.892] lstrlenW (lpString=".bz2") returned 4 [0193.892] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.892] lstrlenW (lpString=".7z") returned 3 [0193.892] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.892] lstrlenW (lpString=".dbf") returned 4 [0193.892] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.893] lstrlenW (lpString=".1cd") returned 4 [0193.893] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.893] lstrlenW (lpString=".jpg") returned 4 [0193.893] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.893] lstrlenW (lpString=".doc") returned 4 [0193.893] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.893] lstrlenW (lpString=".docx") returned 5 [0193.893] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.893] lstrlenW (lpString=".pdf") returned 4 [0193.893] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.893] lstrlenW (lpString=".xls") returned 4 [0193.893] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.893] lstrlenW (lpString=".xlsx") returned 5 [0193.893] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.893] lstrlenW (lpString=".ppt") returned 4 [0193.893] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.893] lstrlenW (lpString=".zip") returned 4 [0193.893] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.893] lstrlenW (lpString=".rar") returned 4 [0193.893] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.893] lstrlenW (lpString=".bz2") returned 4 [0193.893] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.893] lstrlenW (lpString=".7z") returned 3 [0193.893] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.893] lstrlenW (lpString=".dbf") returned 4 [0193.894] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.894] lstrlenW (lpString=".1cd") returned 4 [0193.894] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\tr\\messages.json") returned 151 [0193.894] lstrlenW (lpString=".jpg") returned 4 [0193.894] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.894] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.894] lstrlenW (lpString="messages.json") returned 13 [0193.894] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.894] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=264) returned 1 [0193.894] CloseHandle (hObject=0x154) returned 1 [0193.894] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 0x2020 [0193.894] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.895] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.895] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.895] GetLastError () returned 0x0 [0193.895] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x108, lpOverlapped=0x0) returned 1 [0193.896] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x110, lpOverlapped=0x0) returned 1 [0193.897] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.897] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.897] SetEndOfFile (hFile=0x150) returned 1 [0193.897] CloseHandle (hObject=0x150) returned 1 [0193.897] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.897] SetEndOfFile (hFile=0x154) returned 1 [0193.898] CloseHandle (hObject=0x154) returned 1 [0193.898] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.898] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json")) returned 1 [0193.898] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.899] lstrlenW (lpString=".doc") returned 4 [0193.899] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.899] lstrlenW (lpString=".docx") returned 5 [0193.899] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.899] lstrlenW (lpString=".pdf") returned 4 [0193.899] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.899] lstrlenW (lpString=".xls") returned 4 [0193.899] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.899] lstrlenW (lpString=".xlsx") returned 5 [0193.899] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.899] lstrlenW (lpString=".ppt") returned 4 [0193.899] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.899] lstrlenW (lpString=".zip") returned 4 [0193.899] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.899] lstrlenW (lpString=".rar") returned 4 [0193.899] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.899] lstrlenW (lpString=".bz2") returned 4 [0193.899] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.899] lstrlenW (lpString=".7z") returned 3 [0193.899] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.899] lstrlenW (lpString=".dbf") returned 4 [0193.899] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.899] lstrlenW (lpString=".1cd") returned 4 [0193.899] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.899] lstrlenW (lpString=".jpg") returned 4 [0193.899] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.900] lstrlenW (lpString=".doc") returned 4 [0193.900] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.900] lstrlenW (lpString=".docx") returned 5 [0193.900] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.900] lstrlenW (lpString=".pdf") returned 4 [0193.900] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.900] lstrlenW (lpString=".xls") returned 4 [0193.900] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.900] lstrlenW (lpString=".xlsx") returned 5 [0193.900] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.900] lstrlenW (lpString=".ppt") returned 4 [0193.900] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.900] lstrlenW (lpString=".zip") returned 4 [0193.900] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.900] lstrlenW (lpString=".rar") returned 4 [0193.900] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.900] lstrlenW (lpString=".bz2") returned 4 [0193.900] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.900] lstrlenW (lpString=".7z") returned 3 [0193.900] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.900] lstrlenW (lpString=".dbf") returned 4 [0193.900] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.900] lstrlenW (lpString=".1cd") returned 4 [0193.900] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\uk\\messages.json") returned 151 [0193.900] lstrlenW (lpString=".jpg") returned 4 [0193.900] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.901] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.901] lstrlenW (lpString="messages.json") returned 13 [0193.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.901] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=225) returned 1 [0193.901] CloseHandle (hObject=0x154) returned 1 [0193.901] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 0x2020 [0193.901] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.901] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.901] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.902] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.902] GetLastError () returned 0x0 [0193.902] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe1, lpOverlapped=0x0) returned 1 [0193.903] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.904] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.904] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.904] SetEndOfFile (hFile=0x150) returned 1 [0193.904] CloseHandle (hObject=0x150) returned 1 [0193.904] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.904] SetEndOfFile (hFile=0x154) returned 1 [0193.905] CloseHandle (hObject=0x154) returned 1 [0193.905] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.905] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json")) returned 1 [0193.907] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.907] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.907] lstrlenW (lpString=".doc") returned 4 [0193.907] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.907] lstrlenW (lpString=".docx") returned 5 [0193.907] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.907] lstrlenW (lpString=".pdf") returned 4 [0193.908] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.908] lstrlenW (lpString=".xls") returned 4 [0193.908] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.908] lstrlenW (lpString=".xlsx") returned 5 [0193.908] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.908] lstrlenW (lpString=".ppt") returned 4 [0193.908] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.908] lstrlenW (lpString=".zip") returned 4 [0193.908] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.908] lstrlenW (lpString=".rar") returned 4 [0193.908] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.908] lstrlenW (lpString=".bz2") returned 4 [0193.908] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.908] lstrlenW (lpString=".7z") returned 3 [0193.908] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.908] lstrlenW (lpString=".dbf") returned 4 [0193.908] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.908] lstrlenW (lpString=".1cd") returned 4 [0193.908] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.908] lstrlenW (lpString=".jpg") returned 4 [0193.908] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.908] lstrlenW (lpString=".doc") returned 4 [0193.908] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.908] lstrlenW (lpString=".docx") returned 5 [0193.908] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.909] lstrlenW (lpString=".pdf") returned 4 [0193.909] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.909] lstrlenW (lpString=".xls") returned 4 [0193.909] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.909] lstrlenW (lpString=".xlsx") returned 5 [0193.909] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.909] lstrlenW (lpString=".ppt") returned 4 [0193.909] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.909] lstrlenW (lpString=".zip") returned 4 [0193.909] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.909] lstrlenW (lpString=".rar") returned 4 [0193.909] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.909] lstrlenW (lpString=".bz2") returned 4 [0193.909] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.909] lstrlenW (lpString=".7z") returned 3 [0193.909] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.909] lstrlenW (lpString=".dbf") returned 4 [0193.909] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.909] lstrlenW (lpString=".1cd") returned 4 [0193.909] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\vi\\messages.json") returned 151 [0193.909] lstrlenW (lpString=".jpg") returned 4 [0193.909] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.909] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.909] lstrlenW (lpString="messages.json") returned 13 [0193.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.910] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=206) returned 1 [0193.910] CloseHandle (hObject=0x154) returned 1 [0193.910] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0193.910] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.910] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.910] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.911] GetLastError () returned 0x0 [0193.911] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xce, lpOverlapped=0x0) returned 1 [0193.912] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xd0, lpOverlapped=0x0) returned 1 [0193.913] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0193.913] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.913] SetEndOfFile (hFile=0x150) returned 1 [0193.913] CloseHandle (hObject=0x150) returned 1 [0193.913] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.913] SetEndOfFile (hFile=0x154) returned 1 [0193.914] CloseHandle (hObject=0x154) returned 1 [0193.914] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.914] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_cn\\messages.json")) returned 1 [0193.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.914] lstrlenW (lpString=".doc") returned 4 [0193.914] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.914] lstrlenW (lpString=".docx") returned 5 [0193.914] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.914] lstrlenW (lpString=".pdf") returned 4 [0193.914] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.914] lstrlenW (lpString=".xls") returned 4 [0193.914] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.914] lstrlenW (lpString=".xlsx") returned 5 [0193.914] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.914] lstrlenW (lpString=".ppt") returned 4 [0193.914] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.915] lstrlenW (lpString=".zip") returned 4 [0193.915] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.915] lstrlenW (lpString=".rar") returned 4 [0193.915] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.915] lstrlenW (lpString=".bz2") returned 4 [0193.915] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.915] lstrlenW (lpString=".7z") returned 3 [0193.915] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.915] lstrlenW (lpString=".dbf") returned 4 [0193.915] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.915] lstrlenW (lpString=".1cd") returned 4 [0193.915] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.915] lstrlenW (lpString=".jpg") returned 4 [0193.915] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.915] lstrlenW (lpString=".doc") returned 4 [0193.915] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.915] lstrlenW (lpString=".docx") returned 5 [0193.915] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.915] lstrlenW (lpString=".pdf") returned 4 [0193.915] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.915] lstrlenW (lpString=".xls") returned 4 [0193.915] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.915] lstrlenW (lpString=".xlsx") returned 5 [0193.915] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.916] lstrlenW (lpString=".ppt") returned 4 [0193.916] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.916] lstrlenW (lpString=".zip") returned 4 [0193.916] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.916] lstrlenW (lpString=".rar") returned 4 [0193.916] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.916] lstrlenW (lpString=".bz2") returned 4 [0193.916] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.916] lstrlenW (lpString=".7z") returned 3 [0193.916] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.916] lstrlenW (lpString=".dbf") returned 4 [0193.916] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.916] lstrlenW (lpString=".1cd") returned 4 [0193.916] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_CN\\messages.json") returned 154 [0193.916] lstrlenW (lpString=".jpg") returned 4 [0193.916] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.916] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.916] lstrlenW (lpString="messages.json") returned 13 [0193.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.917] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=206) returned 1 [0193.917] CloseHandle (hObject=0x154) returned 1 [0193.917] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0193.917] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0193.917] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.917] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0193.917] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0193.918] GetLastError () returned 0x0 [0193.918] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xce, lpOverlapped=0x0) returned 1 [0194.000] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xd0, lpOverlapped=0x0) returned 1 [0194.092] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.092] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.092] SetEndOfFile (hFile=0x150) returned 1 [0194.092] CloseHandle (hObject=0x150) returned 1 [0194.092] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.092] SetEndOfFile (hFile=0x154) returned 1 [0194.093] CloseHandle (hObject=0x154) returned 1 [0194.093] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.093] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_tw\\messages.json")) returned 1 [0194.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.094] lstrlenW (lpString=".doc") returned 4 [0194.094] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.094] lstrlenW (lpString=".docx") returned 5 [0194.094] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.094] lstrlenW (lpString=".pdf") returned 4 [0194.094] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.094] lstrlenW (lpString=".xls") returned 4 [0194.094] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.094] lstrlenW (lpString=".xlsx") returned 5 [0194.094] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.094] lstrlenW (lpString=".ppt") returned 4 [0194.094] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.094] lstrlenW (lpString=".zip") returned 4 [0194.094] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.094] lstrlenW (lpString=".rar") returned 4 [0194.094] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.094] lstrlenW (lpString=".bz2") returned 4 [0194.094] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.094] lstrlenW (lpString=".7z") returned 3 [0194.094] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.094] lstrlenW (lpString=".dbf") returned 4 [0194.094] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.094] lstrlenW (lpString=".1cd") returned 4 [0194.094] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.094] lstrlenW (lpString=".jpg") returned 4 [0194.095] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.095] lstrlenW (lpString=".doc") returned 4 [0194.095] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.095] lstrlenW (lpString=".docx") returned 5 [0194.095] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.095] lstrlenW (lpString=".pdf") returned 4 [0194.095] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.095] lstrlenW (lpString=".xls") returned 4 [0194.095] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.095] lstrlenW (lpString=".xlsx") returned 5 [0194.095] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.095] lstrlenW (lpString=".ppt") returned 4 [0194.095] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.095] lstrlenW (lpString=".zip") returned 4 [0194.095] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.095] lstrlenW (lpString=".rar") returned 4 [0194.095] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.095] lstrlenW (lpString=".bz2") returned 4 [0194.095] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.095] lstrlenW (lpString=".7z") returned 3 [0194.095] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.095] lstrlenW (lpString=".dbf") returned 4 [0194.095] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.095] lstrlenW (lpString=".1cd") returned 4 [0194.095] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.095] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\zh_TW\\messages.json") returned 154 [0194.095] lstrlenW (lpString=".jpg") returned 4 [0194.096] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.096] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.096] lstrlenW (lpString="messages.json") returned 13 [0194.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.096] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=257) returned 1 [0194.096] CloseHandle (hObject=0x154) returned 1 [0194.096] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 0x2020 [0194.096] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.096] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.097] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.097] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.097] GetLastError () returned 0x0 [0194.097] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x101, lpOverlapped=0x0) returned 1 [0194.098] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.099] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.099] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.099] SetEndOfFile (hFile=0x150) returned 1 [0194.099] CloseHandle (hObject=0x150) returned 1 [0194.099] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.099] SetEndOfFile (hFile=0x154) returned 1 [0194.100] CloseHandle (hObject=0x154) returned 1 [0194.100] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.100] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json")) returned 1 [0194.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.100] lstrlenW (lpString=".doc") returned 4 [0194.101] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.101] lstrlenW (lpString=".docx") returned 5 [0194.101] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.101] lstrlenW (lpString=".pdf") returned 4 [0194.101] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.101] lstrlenW (lpString=".xls") returned 4 [0194.101] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.101] lstrlenW (lpString=".xlsx") returned 5 [0194.101] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.101] lstrlenW (lpString=".ppt") returned 4 [0194.101] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.101] lstrlenW (lpString=".zip") returned 4 [0194.101] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.101] lstrlenW (lpString=".rar") returned 4 [0194.101] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.101] lstrlenW (lpString=".bz2") returned 4 [0194.101] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.101] lstrlenW (lpString=".7z") returned 3 [0194.101] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.101] lstrlenW (lpString=".dbf") returned 4 [0194.101] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.101] lstrlenW (lpString=".1cd") returned 4 [0194.101] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.101] lstrlenW (lpString=".jpg") returned 4 [0194.101] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.101] lstrlenW (lpString=".doc") returned 4 [0194.102] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.102] lstrlenW (lpString=".docx") returned 5 [0194.102] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.102] lstrlenW (lpString=".pdf") returned 4 [0194.102] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.102] lstrlenW (lpString=".xls") returned 4 [0194.102] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.102] lstrlenW (lpString=".xlsx") returned 5 [0194.102] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.102] lstrlenW (lpString=".ppt") returned 4 [0194.102] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.102] lstrlenW (lpString=".zip") returned 4 [0194.102] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.102] lstrlenW (lpString=".rar") returned 4 [0194.102] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.102] lstrlenW (lpString=".bz2") returned 4 [0194.102] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.102] lstrlenW (lpString=".7z") returned 3 [0194.102] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.102] lstrlenW (lpString=".dbf") returned 4 [0194.102] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.102] lstrlenW (lpString=".1cd") returned 4 [0194.102] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fi\\messages.json") returned 152 [0194.102] lstrlenW (lpString=".jpg") returned 4 [0194.102] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.103] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.103] lstrlenW (lpString="messages.json") returned 13 [0194.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.103] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=260) returned 1 [0194.103] CloseHandle (hObject=0x154) returned 1 [0194.103] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 0x2020 [0194.103] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.103] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.103] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.104] GetLastError () returned 0x0 [0194.104] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x104, lpOverlapped=0x0) returned 1 [0194.105] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.106] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.106] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.106] SetEndOfFile (hFile=0x150) returned 1 [0194.106] CloseHandle (hObject=0x150) returned 1 [0194.106] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.106] SetEndOfFile (hFile=0x154) returned 1 [0194.107] CloseHandle (hObject=0x154) returned 1 [0194.107] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.107] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json")) returned 1 [0194.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.107] lstrlenW (lpString=".doc") returned 4 [0194.108] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.108] lstrlenW (lpString=".docx") returned 5 [0194.108] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.108] lstrlenW (lpString=".pdf") returned 4 [0194.108] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.108] lstrlenW (lpString=".xls") returned 4 [0194.108] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.108] lstrlenW (lpString=".xlsx") returned 5 [0194.108] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.108] lstrlenW (lpString=".ppt") returned 4 [0194.108] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.108] lstrlenW (lpString=".zip") returned 4 [0194.108] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.108] lstrlenW (lpString=".rar") returned 4 [0194.108] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.108] lstrlenW (lpString=".bz2") returned 4 [0194.108] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.108] lstrlenW (lpString=".7z") returned 3 [0194.108] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.108] lstrlenW (lpString=".dbf") returned 4 [0194.108] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.108] lstrlenW (lpString=".1cd") returned 4 [0194.108] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.108] lstrlenW (lpString=".jpg") returned 4 [0194.108] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.108] lstrlenW (lpString=".doc") returned 4 [0194.109] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.109] lstrlenW (lpString=".docx") returned 5 [0194.109] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.109] lstrlenW (lpString=".pdf") returned 4 [0194.109] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.109] lstrlenW (lpString=".xls") returned 4 [0194.109] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.109] lstrlenW (lpString=".xlsx") returned 5 [0194.109] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.109] lstrlenW (lpString=".ppt") returned 4 [0194.109] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.109] lstrlenW (lpString=".zip") returned 4 [0194.109] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.109] lstrlenW (lpString=".rar") returned 4 [0194.109] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.109] lstrlenW (lpString=".bz2") returned 4 [0194.109] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.109] lstrlenW (lpString=".7z") returned 3 [0194.109] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.109] lstrlenW (lpString=".dbf") returned 4 [0194.109] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.109] lstrlenW (lpString=".1cd") returned 4 [0194.109] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fil\\messages.json") returned 153 [0194.109] lstrlenW (lpString=".jpg") returned 4 [0194.109] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.110] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.110] lstrlenW (lpString="messages.json") returned 13 [0194.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.110] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=252) returned 1 [0194.110] CloseHandle (hObject=0x154) returned 1 [0194.110] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 0x2020 [0194.110] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.110] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.110] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.111] GetLastError () returned 0x0 [0194.111] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xfc, lpOverlapped=0x0) returned 1 [0194.113] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.113] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.113] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.114] SetEndOfFile (hFile=0x150) returned 1 [0194.114] CloseHandle (hObject=0x150) returned 1 [0194.114] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.114] SetEndOfFile (hFile=0x154) returned 1 [0194.115] CloseHandle (hObject=0x154) returned 1 [0194.115] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.115] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json")) returned 1 [0194.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.115] lstrlenW (lpString=".doc") returned 4 [0194.115] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.115] lstrlenW (lpString=".docx") returned 5 [0194.115] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.115] lstrlenW (lpString=".pdf") returned 4 [0194.115] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.115] lstrlenW (lpString=".xls") returned 4 [0194.115] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.115] lstrlenW (lpString=".xlsx") returned 5 [0194.115] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.115] lstrlenW (lpString=".ppt") returned 4 [0194.115] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.115] lstrlenW (lpString=".zip") returned 4 [0194.115] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.116] lstrlenW (lpString=".rar") returned 4 [0194.116] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.116] lstrlenW (lpString=".bz2") returned 4 [0194.116] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.116] lstrlenW (lpString=".7z") returned 3 [0194.116] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.116] lstrlenW (lpString=".dbf") returned 4 [0194.116] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.116] lstrlenW (lpString=".1cd") returned 4 [0194.116] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.116] lstrlenW (lpString=".jpg") returned 4 [0194.116] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.116] lstrlenW (lpString=".doc") returned 4 [0194.116] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.116] lstrlenW (lpString=".docx") returned 5 [0194.116] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.116] lstrlenW (lpString=".pdf") returned 4 [0194.116] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.116] lstrlenW (lpString=".xls") returned 4 [0194.116] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.116] lstrlenW (lpString=".xlsx") returned 5 [0194.116] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.116] lstrlenW (lpString=".ppt") returned 4 [0194.116] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.116] lstrlenW (lpString=".zip") returned 4 [0194.116] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.117] lstrlenW (lpString=".rar") returned 4 [0194.117] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.117] lstrlenW (lpString=".bz2") returned 4 [0194.117] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.117] lstrlenW (lpString=".7z") returned 3 [0194.117] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.117] lstrlenW (lpString=".dbf") returned 4 [0194.117] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.117] lstrlenW (lpString=".1cd") returned 4 [0194.117] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\fr\\messages.json") returned 152 [0194.117] lstrlenW (lpString=".jpg") returned 4 [0194.117] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.117] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.117] lstrlenW (lpString="messages.json") returned 13 [0194.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.118] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=278) returned 1 [0194.118] CloseHandle (hObject=0x154) returned 1 [0194.118] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 0x2020 [0194.118] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.118] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.118] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.118] GetLastError () returned 0x0 [0194.119] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x116, lpOverlapped=0x0) returned 1 [0194.119] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x120, lpOverlapped=0x0) returned 1 [0194.120] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.120] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.121] SetEndOfFile (hFile=0x150) returned 1 [0194.121] CloseHandle (hObject=0x150) returned 1 [0194.121] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.121] SetEndOfFile (hFile=0x154) returned 1 [0194.121] CloseHandle (hObject=0x154) returned 1 [0194.122] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.122] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json")) returned 1 [0194.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.122] lstrlenW (lpString=".doc") returned 4 [0194.122] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.122] lstrlenW (lpString=".docx") returned 5 [0194.122] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.122] lstrlenW (lpString=".pdf") returned 4 [0194.122] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.122] lstrlenW (lpString=".xls") returned 4 [0194.122] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.122] lstrlenW (lpString=".xlsx") returned 5 [0194.122] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.122] lstrlenW (lpString=".ppt") returned 4 [0194.122] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.122] lstrlenW (lpString=".zip") returned 4 [0194.122] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.122] lstrlenW (lpString=".rar") returned 4 [0194.122] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.122] lstrlenW (lpString=".bz2") returned 4 [0194.122] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.123] lstrlenW (lpString=".7z") returned 3 [0194.123] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.123] lstrlenW (lpString=".dbf") returned 4 [0194.123] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.123] lstrlenW (lpString=".1cd") returned 4 [0194.123] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.123] lstrlenW (lpString=".jpg") returned 4 [0194.123] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.123] lstrlenW (lpString=".doc") returned 4 [0194.123] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.123] lstrlenW (lpString=".docx") returned 5 [0194.123] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.123] lstrlenW (lpString=".pdf") returned 4 [0194.123] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.123] lstrlenW (lpString=".xls") returned 4 [0194.123] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.123] lstrlenW (lpString=".xlsx") returned 5 [0194.123] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.123] lstrlenW (lpString=".ppt") returned 4 [0194.124] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.124] lstrlenW (lpString=".zip") returned 4 [0194.124] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.124] lstrlenW (lpString=".rar") returned 4 [0194.124] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.124] lstrlenW (lpString=".bz2") returned 4 [0194.124] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.124] lstrlenW (lpString=".7z") returned 3 [0194.124] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.124] lstrlenW (lpString=".dbf") returned 4 [0194.124] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.124] lstrlenW (lpString=".1cd") returned 4 [0194.124] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\he\\messages.json") returned 152 [0194.124] lstrlenW (lpString=".jpg") returned 4 [0194.124] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.124] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.124] lstrlenW (lpString="messages.json") returned 13 [0194.124] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.125] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=345) returned 1 [0194.125] CloseHandle (hObject=0x154) returned 1 [0194.125] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 0x2020 [0194.125] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.125] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.125] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.126] GetLastError () returned 0x0 [0194.126] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x159, lpOverlapped=0x0) returned 1 [0194.167] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x160, lpOverlapped=0x0) returned 1 [0194.168] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.168] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.169] SetEndOfFile (hFile=0x150) returned 1 [0194.169] CloseHandle (hObject=0x150) returned 1 [0194.169] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.169] SetEndOfFile (hFile=0x154) returned 1 [0194.170] CloseHandle (hObject=0x154) returned 1 [0194.170] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.170] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json")) returned 1 [0194.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.170] lstrlenW (lpString=".doc") returned 4 [0194.170] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.170] lstrlenW (lpString=".docx") returned 5 [0194.170] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.170] lstrlenW (lpString=".pdf") returned 4 [0194.170] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.170] lstrlenW (lpString=".xls") returned 4 [0194.171] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.171] lstrlenW (lpString=".xlsx") returned 5 [0194.171] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.171] lstrlenW (lpString=".ppt") returned 4 [0194.171] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.171] lstrlenW (lpString=".zip") returned 4 [0194.171] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.171] lstrlenW (lpString=".rar") returned 4 [0194.171] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.171] lstrlenW (lpString=".bz2") returned 4 [0194.171] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.171] lstrlenW (lpString=".7z") returned 3 [0194.171] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.171] lstrlenW (lpString=".dbf") returned 4 [0194.171] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.171] lstrlenW (lpString=".1cd") returned 4 [0194.171] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.171] lstrlenW (lpString=".jpg") returned 4 [0194.171] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.171] lstrlenW (lpString=".doc") returned 4 [0194.171] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.171] lstrlenW (lpString=".docx") returned 5 [0194.171] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.171] lstrlenW (lpString=".pdf") returned 4 [0194.171] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.172] lstrlenW (lpString=".xls") returned 4 [0194.172] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.172] lstrlenW (lpString=".xlsx") returned 5 [0194.172] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.172] lstrlenW (lpString=".ppt") returned 4 [0194.172] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.172] lstrlenW (lpString=".zip") returned 4 [0194.172] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.172] lstrlenW (lpString=".rar") returned 4 [0194.172] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.172] lstrlenW (lpString=".bz2") returned 4 [0194.172] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.172] lstrlenW (lpString=".7z") returned 3 [0194.172] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.172] lstrlenW (lpString=".dbf") returned 4 [0194.172] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.172] lstrlenW (lpString=".1cd") returned 4 [0194.172] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\hi\\messages.json") returned 152 [0194.172] lstrlenW (lpString=".jpg") returned 4 [0194.172] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.172] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.172] lstrlenW (lpString="messages.json") returned 13 [0194.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.173] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=293) returned 1 [0194.173] CloseHandle (hObject=0x154) returned 1 [0194.173] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 0x2020 [0194.173] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.173] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.173] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.174] GetLastError () returned 0x0 [0194.174] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x125, lpOverlapped=0x0) returned 1 [0194.175] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x130, lpOverlapped=0x0) returned 1 [0194.176] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.176] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.176] SetEndOfFile (hFile=0x150) returned 1 [0194.176] CloseHandle (hObject=0x150) returned 1 [0194.176] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.176] SetEndOfFile (hFile=0x154) returned 1 [0194.177] CloseHandle (hObject=0x154) returned 1 [0194.177] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.177] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json")) returned 1 [0194.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.177] lstrlenW (lpString=".doc") returned 4 [0194.177] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.177] lstrlenW (lpString=".docx") returned 5 [0194.177] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.177] lstrlenW (lpString=".pdf") returned 4 [0194.177] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.177] lstrlenW (lpString=".xls") returned 4 [0194.177] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.177] lstrlenW (lpString=".xlsx") returned 5 [0194.177] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.177] lstrlenW (lpString=".ppt") returned 4 [0194.177] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.178] lstrlenW (lpString=".zip") returned 4 [0194.178] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.178] lstrlenW (lpString=".rar") returned 4 [0194.178] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.178] lstrlenW (lpString=".bz2") returned 4 [0194.178] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.178] lstrlenW (lpString=".7z") returned 3 [0194.178] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.178] lstrlenW (lpString=".dbf") returned 4 [0194.178] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.178] lstrlenW (lpString=".1cd") returned 4 [0194.178] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.178] lstrlenW (lpString=".jpg") returned 4 [0194.178] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.178] lstrlenW (lpString=".doc") returned 4 [0194.178] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.178] lstrlenW (lpString=".docx") returned 5 [0194.178] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.178] lstrlenW (lpString=".pdf") returned 4 [0194.178] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.178] lstrlenW (lpString=".xls") returned 4 [0194.178] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.178] lstrlenW (lpString=".xlsx") returned 5 [0194.178] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.178] lstrlenW (lpString=".ppt") returned 4 [0194.179] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.179] lstrlenW (lpString=".zip") returned 4 [0194.179] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.179] lstrlenW (lpString=".rar") returned 4 [0194.179] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.179] lstrlenW (lpString=".bz2") returned 4 [0194.179] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.179] lstrlenW (lpString=".7z") returned 3 [0194.179] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.179] lstrlenW (lpString=".dbf") returned 4 [0194.179] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.179] lstrlenW (lpString=".1cd") returned 4 [0194.179] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.179] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ja\\messages.json") returned 152 [0194.179] lstrlenW (lpString=".jpg") returned 4 [0194.179] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.179] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.179] lstrlenW (lpString="messages.json") returned 13 [0194.179] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.180] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=281) returned 1 [0194.180] CloseHandle (hObject=0x154) returned 1 [0194.180] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 0x2020 [0194.180] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.180] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.180] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.181] GetLastError () returned 0x0 [0194.181] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x119, lpOverlapped=0x0) returned 1 [0194.182] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x120, lpOverlapped=0x0) returned 1 [0194.183] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.183] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.183] SetEndOfFile (hFile=0x150) returned 1 [0194.183] CloseHandle (hObject=0x150) returned 1 [0194.183] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.183] SetEndOfFile (hFile=0x154) returned 1 [0194.184] CloseHandle (hObject=0x154) returned 1 [0194.184] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.184] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json")) returned 1 [0194.184] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.184] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.184] lstrlenW (lpString=".doc") returned 4 [0194.184] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.184] lstrlenW (lpString=".docx") returned 5 [0194.184] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.184] lstrlenW (lpString=".pdf") returned 4 [0194.184] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.184] lstrlenW (lpString=".xls") returned 4 [0194.184] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.184] lstrlenW (lpString=".xlsx") returned 5 [0194.184] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.185] lstrlenW (lpString=".ppt") returned 4 [0194.185] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.185] lstrlenW (lpString=".zip") returned 4 [0194.185] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.185] lstrlenW (lpString=".rar") returned 4 [0194.185] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.185] lstrlenW (lpString=".bz2") returned 4 [0194.185] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.185] lstrlenW (lpString=".7z") returned 3 [0194.185] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.185] lstrlenW (lpString=".dbf") returned 4 [0194.185] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.185] lstrlenW (lpString=".1cd") returned 4 [0194.185] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.185] lstrlenW (lpString=".jpg") returned 4 [0194.185] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.185] lstrlenW (lpString=".doc") returned 4 [0194.185] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.185] lstrlenW (lpString=".docx") returned 5 [0194.185] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.186] lstrlenW (lpString=".pdf") returned 4 [0194.186] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.186] lstrlenW (lpString=".xls") returned 4 [0194.186] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.186] lstrlenW (lpString=".xlsx") returned 5 [0194.186] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.186] lstrlenW (lpString=".ppt") returned 4 [0194.186] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.186] lstrlenW (lpString=".zip") returned 4 [0194.186] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.186] lstrlenW (lpString=".rar") returned 4 [0194.186] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.186] lstrlenW (lpString=".bz2") returned 4 [0194.186] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.186] lstrlenW (lpString=".7z") returned 3 [0194.186] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.186] lstrlenW (lpString=".dbf") returned 4 [0194.186] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.186] lstrlenW (lpString=".1cd") returned 4 [0194.186] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\ko\\messages.json") returned 152 [0194.186] lstrlenW (lpString=".jpg") returned 4 [0194.186] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.186] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.186] lstrlenW (lpString="messages.json") returned 13 [0194.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.187] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=285) returned 1 [0194.187] CloseHandle (hObject=0x154) returned 1 [0194.187] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 0x2020 [0194.187] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.187] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.187] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.188] GetLastError () returned 0x0 [0194.188] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x11d, lpOverlapped=0x0) returned 1 [0194.189] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x120, lpOverlapped=0x0) returned 1 [0194.189] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.189] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.190] SetEndOfFile (hFile=0x150) returned 1 [0194.190] CloseHandle (hObject=0x150) returned 1 [0194.190] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.190] SetEndOfFile (hFile=0x154) returned 1 [0194.191] CloseHandle (hObject=0x154) returned 1 [0194.191] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.191] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json")) returned 1 [0194.191] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.191] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.191] lstrlenW (lpString=".doc") returned 4 [0194.191] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.191] lstrlenW (lpString=".docx") returned 5 [0194.191] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.191] lstrlenW (lpString=".pdf") returned 4 [0194.191] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.191] lstrlenW (lpString=".xls") returned 4 [0194.191] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.191] lstrlenW (lpString=".xlsx") returned 5 [0194.191] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.191] lstrlenW (lpString=".ppt") returned 4 [0194.191] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.191] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.192] lstrlenW (lpString=".zip") returned 4 [0194.192] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.192] lstrlenW (lpString=".rar") returned 4 [0194.192] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.192] lstrlenW (lpString=".bz2") returned 4 [0194.192] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.192] lstrlenW (lpString=".7z") returned 3 [0194.192] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.192] lstrlenW (lpString=".dbf") returned 4 [0194.192] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.192] lstrlenW (lpString=".1cd") returned 4 [0194.192] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.192] lstrlenW (lpString=".jpg") returned 4 [0194.192] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.192] lstrlenW (lpString=".doc") returned 4 [0194.192] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.192] lstrlenW (lpString=".docx") returned 5 [0194.192] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.192] lstrlenW (lpString=".pdf") returned 4 [0194.192] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.192] lstrlenW (lpString=".xls") returned 4 [0194.192] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.192] lstrlenW (lpString=".xlsx") returned 5 [0194.192] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.192] lstrlenW (lpString=".ppt") returned 4 [0194.192] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.193] lstrlenW (lpString=".zip") returned 4 [0194.193] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.193] lstrlenW (lpString=".rar") returned 4 [0194.193] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.193] lstrlenW (lpString=".bz2") returned 4 [0194.193] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.193] lstrlenW (lpString=".7z") returned 3 [0194.193] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.193] lstrlenW (lpString=".dbf") returned 4 [0194.193] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.193] lstrlenW (lpString=".1cd") returned 4 [0194.193] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lt\\messages.json") returned 152 [0194.193] lstrlenW (lpString=".jpg") returned 4 [0194.193] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.193] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.193] lstrlenW (lpString="messages.json") returned 13 [0194.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.194] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=258) returned 1 [0194.194] CloseHandle (hObject=0x154) returned 1 [0194.194] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 0x2020 [0194.194] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0194.194] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.194] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.196] GetLastError () returned 0x0 [0194.196] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x102, lpOverlapped=0x0) returned 1 [0194.197] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.199] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.199] WriteFile (in: hFile=0x150, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.199] SetEndOfFile (hFile=0x150) returned 1 [0194.199] CloseHandle (hObject=0x150) returned 1 [0194.199] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.199] SetEndOfFile (hFile=0x154) returned 1 [0194.200] CloseHandle (hObject=0x154) returned 1 [0194.200] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.200] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json")) returned 1 [0194.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.200] lstrlenW (lpString=".doc") returned 4 [0194.200] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.200] lstrlenW (lpString=".docx") returned 5 [0194.200] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.200] lstrlenW (lpString=".pdf") returned 4 [0194.200] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.200] lstrlenW (lpString=".xls") returned 4 [0194.200] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.200] lstrlenW (lpString=".xlsx") returned 5 [0194.200] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.200] lstrlenW (lpString=".ppt") returned 4 [0194.200] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.200] lstrlenW (lpString=".zip") returned 4 [0194.318] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.318] lstrlenW (lpString=".rar") returned 4 [0194.318] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.318] lstrlenW (lpString=".bz2") returned 4 [0194.318] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.318] lstrlenW (lpString=".7z") returned 3 [0194.318] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.318] lstrlenW (lpString=".dbf") returned 4 [0194.318] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.318] lstrlenW (lpString=".1cd") returned 4 [0194.318] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.318] lstrlenW (lpString=".jpg") returned 4 [0194.318] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.319] lstrlenW (lpString=".doc") returned 4 [0194.319] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.319] lstrlenW (lpString=".docx") returned 5 [0194.319] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.319] lstrlenW (lpString=".pdf") returned 4 [0194.319] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.319] lstrlenW (lpString=".xls") returned 4 [0194.319] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.319] lstrlenW (lpString=".xlsx") returned 5 [0194.319] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.319] lstrlenW (lpString=".ppt") returned 4 [0194.319] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.319] lstrlenW (lpString=".zip") returned 4 [0194.319] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.319] lstrlenW (lpString=".rar") returned 4 [0194.319] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.319] lstrlenW (lpString=".bz2") returned 4 [0194.319] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.319] lstrlenW (lpString=".7z") returned 3 [0194.319] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.319] lstrlenW (lpString=".dbf") returned 4 [0194.319] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.319] lstrlenW (lpString=".1cd") returned 4 [0194.319] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\lv\\messages.json") returned 152 [0194.319] lstrlenW (lpString=".jpg") returned 4 [0194.319] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.320] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.320] lstrlenW (lpString="messages.json") returned 13 [0194.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.320] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=287) returned 1 [0194.320] CloseHandle (hObject=0x358) returned 1 [0194.320] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 0x2020 [0194.320] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.320] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.320] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.321] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.321] GetLastError () returned 0x0 [0194.321] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x11f, lpOverlapped=0x0) returned 1 [0194.322] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x120, lpOverlapped=0x0) returned 1 [0194.323] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.323] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.323] SetEndOfFile (hFile=0x114) returned 1 [0194.323] CloseHandle (hObject=0x114) returned 1 [0194.323] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.323] SetEndOfFile (hFile=0x358) returned 1 [0194.324] CloseHandle (hObject=0x358) returned 1 [0194.324] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.324] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json")) returned 1 [0194.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.324] lstrlenW (lpString=".doc") returned 4 [0194.324] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.324] lstrlenW (lpString=".docx") returned 5 [0194.324] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.325] lstrlenW (lpString=".pdf") returned 4 [0194.325] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.325] lstrlenW (lpString=".xls") returned 4 [0194.325] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.325] lstrlenW (lpString=".xlsx") returned 5 [0194.325] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.325] lstrlenW (lpString=".ppt") returned 4 [0194.325] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.325] lstrlenW (lpString=".zip") returned 4 [0194.325] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.325] lstrlenW (lpString=".rar") returned 4 [0194.325] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.325] lstrlenW (lpString=".bz2") returned 4 [0194.325] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.325] lstrlenW (lpString=".7z") returned 3 [0194.325] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.325] lstrlenW (lpString=".dbf") returned 4 [0194.325] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.325] lstrlenW (lpString=".1cd") returned 4 [0194.325] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.325] lstrlenW (lpString=".jpg") returned 4 [0194.325] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.326] lstrlenW (lpString=".doc") returned 4 [0194.326] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.326] lstrlenW (lpString=".docx") returned 5 [0194.326] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.326] lstrlenW (lpString=".pdf") returned 4 [0194.326] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.326] lstrlenW (lpString=".xls") returned 4 [0194.326] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.326] lstrlenW (lpString=".xlsx") returned 5 [0194.326] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.326] lstrlenW (lpString=".ppt") returned 4 [0194.326] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.326] lstrlenW (lpString=".zip") returned 4 [0194.326] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.326] lstrlenW (lpString=".rar") returned 4 [0194.326] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.326] lstrlenW (lpString=".bz2") returned 4 [0194.326] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.326] lstrlenW (lpString=".7z") returned 3 [0194.326] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.326] lstrlenW (lpString=".dbf") returned 4 [0194.326] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.326] lstrlenW (lpString=".1cd") returned 4 [0194.326] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sr\\messages.json") returned 152 [0194.326] lstrlenW (lpString=".jpg") returned 4 [0194.326] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.327] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.327] lstrlenW (lpString="messages.json") returned 13 [0194.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.328] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=253) returned 1 [0194.328] CloseHandle (hObject=0x358) returned 1 [0194.328] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 0x2020 [0194.328] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.328] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.329] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.329] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.329] GetLastError () returned 0x0 [0194.329] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xfd, lpOverlapped=0x0) returned 1 [0194.330] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.331] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.331] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.331] SetEndOfFile (hFile=0x114) returned 1 [0194.331] CloseHandle (hObject=0x114) returned 1 [0194.331] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.331] SetEndOfFile (hFile=0x358) returned 1 [0194.332] CloseHandle (hObject=0x358) returned 1 [0194.332] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.332] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json")) returned 1 [0194.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.332] lstrlenW (lpString=".doc") returned 4 [0194.332] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.332] lstrlenW (lpString=".docx") returned 5 [0194.332] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.332] lstrlenW (lpString=".pdf") returned 4 [0194.333] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.333] lstrlenW (lpString=".xls") returned 4 [0194.333] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.333] lstrlenW (lpString=".xlsx") returned 5 [0194.333] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.333] lstrlenW (lpString=".ppt") returned 4 [0194.333] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.333] lstrlenW (lpString=".zip") returned 4 [0194.333] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.333] lstrlenW (lpString=".rar") returned 4 [0194.333] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.333] lstrlenW (lpString=".bz2") returned 4 [0194.333] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.333] lstrlenW (lpString=".7z") returned 3 [0194.333] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.333] lstrlenW (lpString=".dbf") returned 4 [0194.333] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.333] lstrlenW (lpString=".1cd") returned 4 [0194.333] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.333] lstrlenW (lpString=".jpg") returned 4 [0194.333] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.333] lstrlenW (lpString=".doc") returned 4 [0194.333] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.333] lstrlenW (lpString=".docx") returned 5 [0194.333] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.334] lstrlenW (lpString=".pdf") returned 4 [0194.334] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.334] lstrlenW (lpString=".xls") returned 4 [0194.334] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.334] lstrlenW (lpString=".xlsx") returned 5 [0194.334] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.334] lstrlenW (lpString=".ppt") returned 4 [0194.334] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.334] lstrlenW (lpString=".zip") returned 4 [0194.334] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.334] lstrlenW (lpString=".rar") returned 4 [0194.334] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.334] lstrlenW (lpString=".bz2") returned 4 [0194.334] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.334] lstrlenW (lpString=".7z") returned 3 [0194.334] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.334] lstrlenW (lpString=".dbf") returned 4 [0194.334] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.334] lstrlenW (lpString=".1cd") returned 4 [0194.334] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\sv\\messages.json") returned 152 [0194.334] lstrlenW (lpString=".jpg") returned 4 [0194.334] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.334] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.334] lstrlenW (lpString="messages.json") returned 13 [0194.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.335] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=356) returned 1 [0194.335] CloseHandle (hObject=0x358) returned 1 [0194.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 0x2020 [0194.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.335] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.335] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.336] GetLastError () returned 0x0 [0194.336] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x164, lpOverlapped=0x0) returned 1 [0194.337] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x170, lpOverlapped=0x0) returned 1 [0194.337] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.337] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.338] SetEndOfFile (hFile=0x114) returned 1 [0194.338] CloseHandle (hObject=0x114) returned 1 [0194.338] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.338] SetEndOfFile (hFile=0x358) returned 1 [0194.339] CloseHandle (hObject=0x358) returned 1 [0194.339] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.339] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json")) returned 1 [0194.339] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.339] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.339] lstrlenW (lpString=".doc") returned 4 [0194.339] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.339] lstrlenW (lpString=".docx") returned 5 [0194.339] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.339] lstrlenW (lpString=".pdf") returned 4 [0194.339] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.339] lstrlenW (lpString=".xls") returned 4 [0194.339] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.339] lstrlenW (lpString=".xlsx") returned 5 [0194.339] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.339] lstrlenW (lpString=".ppt") returned 4 [0194.339] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.339] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.339] lstrlenW (lpString=".zip") returned 4 [0194.339] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.339] lstrlenW (lpString=".rar") returned 4 [0194.339] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.339] lstrlenW (lpString=".bz2") returned 4 [0194.340] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.340] lstrlenW (lpString=".7z") returned 3 [0194.340] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.340] lstrlenW (lpString=".dbf") returned 4 [0194.340] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.340] lstrlenW (lpString=".1cd") returned 4 [0194.340] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.340] lstrlenW (lpString=".jpg") returned 4 [0194.340] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.340] lstrlenW (lpString=".doc") returned 4 [0194.340] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.340] lstrlenW (lpString=".docx") returned 5 [0194.340] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.340] lstrlenW (lpString=".pdf") returned 4 [0194.340] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.340] lstrlenW (lpString=".xls") returned 4 [0194.340] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.340] lstrlenW (lpString=".xlsx") returned 5 [0194.340] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.340] lstrlenW (lpString=".ppt") returned 4 [0194.340] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.340] lstrlenW (lpString=".zip") returned 4 [0194.340] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.340] lstrlenW (lpString=".rar") returned 4 [0194.340] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.341] lstrlenW (lpString=".bz2") returned 4 [0194.341] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.341] lstrlenW (lpString=".7z") returned 3 [0194.341] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.341] lstrlenW (lpString=".dbf") returned 4 [0194.341] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.341] lstrlenW (lpString=".1cd") returned 4 [0194.341] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\th\\messages.json") returned 152 [0194.341] lstrlenW (lpString=".jpg") returned 4 [0194.341] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.341] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.341] lstrlenW (lpString="messages.json") returned 13 [0194.341] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.341] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=270) returned 1 [0194.342] CloseHandle (hObject=0x358) returned 1 [0194.342] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 0x2020 [0194.342] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.342] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.342] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.342] GetLastError () returned 0x0 [0194.342] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x10e, lpOverlapped=0x0) returned 1 [0194.343] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x110, lpOverlapped=0x0) returned 1 [0194.344] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.344] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.344] SetEndOfFile (hFile=0x114) returned 1 [0194.344] CloseHandle (hObject=0x114) returned 1 [0194.344] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.344] SetEndOfFile (hFile=0x358) returned 1 [0194.345] CloseHandle (hObject=0x358) returned 1 [0194.345] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.345] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json")) returned 1 [0194.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.346] lstrlenW (lpString=".doc") returned 4 [0194.346] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.346] lstrlenW (lpString=".docx") returned 5 [0194.346] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.346] lstrlenW (lpString=".pdf") returned 4 [0194.346] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.346] lstrlenW (lpString=".xls") returned 4 [0194.346] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.346] lstrlenW (lpString=".xlsx") returned 5 [0194.346] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.346] lstrlenW (lpString=".ppt") returned 4 [0194.346] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.346] lstrlenW (lpString=".zip") returned 4 [0194.346] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.346] lstrlenW (lpString=".rar") returned 4 [0194.346] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.346] lstrlenW (lpString=".bz2") returned 4 [0194.346] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.346] lstrlenW (lpString=".7z") returned 3 [0194.346] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.346] lstrlenW (lpString=".dbf") returned 4 [0194.346] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.346] lstrlenW (lpString=".1cd") returned 4 [0194.346] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.346] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.346] lstrlenW (lpString=".jpg") returned 4 [0194.346] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.347] lstrlenW (lpString=".doc") returned 4 [0194.347] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.347] lstrlenW (lpString=".docx") returned 5 [0194.347] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.347] lstrlenW (lpString=".pdf") returned 4 [0194.347] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.347] lstrlenW (lpString=".xls") returned 4 [0194.347] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.347] lstrlenW (lpString=".xlsx") returned 5 [0194.347] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.347] lstrlenW (lpString=".ppt") returned 4 [0194.347] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.347] lstrlenW (lpString=".zip") returned 4 [0194.347] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.347] lstrlenW (lpString=".rar") returned 4 [0194.347] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.347] lstrlenW (lpString=".bz2") returned 4 [0194.347] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.347] lstrlenW (lpString=".7z") returned 3 [0194.347] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.347] lstrlenW (lpString=".dbf") returned 4 [0194.347] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.347] lstrlenW (lpString=".1cd") returned 4 [0194.347] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\tr\\messages.json") returned 152 [0194.347] lstrlenW (lpString=".jpg") returned 4 [0194.347] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.348] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.348] lstrlenW (lpString="messages.json") returned 13 [0194.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.348] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=353) returned 1 [0194.348] CloseHandle (hObject=0x358) returned 1 [0194.348] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 0x2020 [0194.348] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.348] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.348] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.349] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.349] GetLastError () returned 0x0 [0194.349] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x161, lpOverlapped=0x0) returned 1 [0194.700] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x170, lpOverlapped=0x0) returned 1 [0194.701] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.701] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.702] SetEndOfFile (hFile=0x114) returned 1 [0194.702] CloseHandle (hObject=0x114) returned 1 [0194.702] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.702] SetEndOfFile (hFile=0x358) returned 1 [0194.702] CloseHandle (hObject=0x358) returned 1 [0194.703] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.703] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json")) returned 1 [0194.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.703] lstrlenW (lpString=".doc") returned 4 [0194.703] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.703] lstrlenW (lpString=".docx") returned 5 [0194.703] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.703] lstrlenW (lpString=".pdf") returned 4 [0194.703] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.703] lstrlenW (lpString=".xls") returned 4 [0194.703] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.703] lstrlenW (lpString=".xlsx") returned 5 [0194.703] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.703] lstrlenW (lpString=".ppt") returned 4 [0194.703] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.703] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.704] lstrlenW (lpString=".zip") returned 4 [0194.704] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.704] lstrlenW (lpString=".rar") returned 4 [0194.704] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.704] lstrlenW (lpString=".bz2") returned 4 [0194.704] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.704] lstrlenW (lpString=".7z") returned 3 [0194.704] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.704] lstrlenW (lpString=".dbf") returned 4 [0194.704] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.704] lstrlenW (lpString=".1cd") returned 4 [0194.704] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.704] lstrlenW (lpString=".jpg") returned 4 [0194.704] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.704] lstrlenW (lpString=".doc") returned 4 [0194.704] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.704] lstrlenW (lpString=".docx") returned 5 [0194.704] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.704] lstrlenW (lpString=".pdf") returned 4 [0194.704] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.704] lstrlenW (lpString=".xls") returned 4 [0194.704] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.704] lstrlenW (lpString=".xlsx") returned 5 [0194.704] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.704] lstrlenW (lpString=".ppt") returned 4 [0194.704] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.705] lstrlenW (lpString=".zip") returned 4 [0194.705] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.705] lstrlenW (lpString=".rar") returned 4 [0194.705] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.705] lstrlenW (lpString=".bz2") returned 4 [0194.705] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.705] lstrlenW (lpString=".7z") returned 3 [0194.705] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.705] lstrlenW (lpString=".dbf") returned 4 [0194.705] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.705] lstrlenW (lpString=".1cd") returned 4 [0194.705] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\apdfllckaahabafndbhieahigkjlhalf\\14.1_0\\_locales\\uk\\messages.json") returned 152 [0194.705] lstrlenW (lpString=".jpg") returned 4 [0194.705] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.705] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.705] lstrlenW (lpString="messages.json") returned 13 [0194.705] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.706] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=179) returned 1 [0194.706] CloseHandle (hObject=0x358) returned 1 [0194.706] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0194.706] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.706] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.706] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.706] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.707] GetLastError () returned 0x0 [0194.707] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.708] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.709] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.709] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.709] SetEndOfFile (hFile=0x114) returned 1 [0194.709] CloseHandle (hObject=0x114) returned 1 [0194.709] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.709] SetEndOfFile (hFile=0x358) returned 1 [0194.710] CloseHandle (hObject=0x358) returned 1 [0194.710] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.710] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_cn\\messages.json")) returned 1 [0194.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.711] lstrlenW (lpString=".doc") returned 4 [0194.711] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.711] lstrlenW (lpString=".docx") returned 5 [0194.711] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.711] lstrlenW (lpString=".pdf") returned 4 [0194.711] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.711] lstrlenW (lpString=".xls") returned 4 [0194.711] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.711] lstrlenW (lpString=".xlsx") returned 5 [0194.711] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.711] lstrlenW (lpString=".ppt") returned 4 [0194.711] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.711] lstrlenW (lpString=".zip") returned 4 [0194.711] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.711] lstrlenW (lpString=".rar") returned 4 [0194.711] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.711] lstrlenW (lpString=".bz2") returned 4 [0194.711] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.711] lstrlenW (lpString=".7z") returned 3 [0194.711] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.711] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.711] lstrlenW (lpString=".dbf") returned 4 [0194.711] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.712] lstrlenW (lpString=".1cd") returned 4 [0194.712] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.712] lstrlenW (lpString=".jpg") returned 4 [0194.712] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.712] lstrlenW (lpString=".doc") returned 4 [0194.712] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.712] lstrlenW (lpString=".docx") returned 5 [0194.712] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.712] lstrlenW (lpString=".pdf") returned 4 [0194.712] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.712] lstrlenW (lpString=".xls") returned 4 [0194.712] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.712] lstrlenW (lpString=".xlsx") returned 5 [0194.712] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.712] lstrlenW (lpString=".ppt") returned 4 [0194.712] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.712] lstrlenW (lpString=".zip") returned 4 [0194.712] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.712] lstrlenW (lpString=".rar") returned 4 [0194.712] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.712] lstrlenW (lpString=".bz2") returned 4 [0194.712] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.712] lstrlenW (lpString=".7z") returned 3 [0194.712] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.713] lstrlenW (lpString=".dbf") returned 4 [0194.713] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.713] lstrlenW (lpString=".1cd") returned 4 [0194.713] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_CN\\messages.json") returned 156 [0194.713] lstrlenW (lpString=".jpg") returned 4 [0194.713] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.713] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.713] lstrlenW (lpString="messages.json") returned 13 [0194.713] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.713] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=179) returned 1 [0194.714] CloseHandle (hObject=0x358) returned 1 [0194.714] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0194.714] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.714] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.714] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.715] GetLastError () returned 0x0 [0194.715] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.716] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.716] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.717] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.717] SetEndOfFile (hFile=0x114) returned 1 [0194.717] CloseHandle (hObject=0x114) returned 1 [0194.717] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.717] SetEndOfFile (hFile=0x358) returned 1 [0194.718] CloseHandle (hObject=0x358) returned 1 [0194.718] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.718] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_tw\\messages.json")) returned 1 [0194.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.718] lstrlenW (lpString=".doc") returned 4 [0194.718] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.718] lstrlenW (lpString=".docx") returned 5 [0194.718] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.718] lstrlenW (lpString=".pdf") returned 4 [0194.718] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.718] lstrlenW (lpString=".xls") returned 4 [0194.719] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.719] lstrlenW (lpString=".xlsx") returned 5 [0194.719] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.719] lstrlenW (lpString=".ppt") returned 4 [0194.719] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.719] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.719] lstrlenW (lpString=".zip") returned 4 [0194.719] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.719] lstrlenW (lpString=".rar") returned 4 [0194.719] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.719] lstrlenW (lpString=".bz2") returned 4 [0194.719] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.719] lstrlenW (lpString=".7z") returned 3 [0194.719] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.719] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.719] lstrlenW (lpString=".dbf") returned 4 [0194.719] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.719] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.719] lstrlenW (lpString=".1cd") returned 4 [0194.719] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.719] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.719] lstrlenW (lpString=".jpg") returned 4 [0194.719] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.719] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.719] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.719] lstrlenW (lpString=".doc") returned 4 [0194.719] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.719] lstrlenW (lpString=".docx") returned 5 [0194.719] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.719] lstrlenW (lpString=".pdf") returned 4 [0194.720] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.720] lstrlenW (lpString=".xls") returned 4 [0194.720] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.720] lstrlenW (lpString=".xlsx") returned 5 [0194.720] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.720] lstrlenW (lpString=".ppt") returned 4 [0194.720] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.720] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.720] lstrlenW (lpString=".zip") returned 4 [0194.720] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.720] lstrlenW (lpString=".rar") returned 4 [0194.720] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.720] lstrlenW (lpString=".bz2") returned 4 [0194.720] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.720] lstrlenW (lpString=".7z") returned 3 [0194.720] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.720] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.720] lstrlenW (lpString=".dbf") returned 4 [0194.720] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.720] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.720] lstrlenW (lpString=".1cd") returned 4 [0194.720] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.720] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\zh_TW\\messages.json") returned 156 [0194.720] lstrlenW (lpString=".jpg") returned 4 [0194.720] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.720] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.720] lstrlenW (lpString="verified_contents.json") returned 22 [0194.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.721] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=10089) returned 1 [0194.721] CloseHandle (hObject=0x358) returned 1 [0194.721] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 0x2020 [0194.721] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.721] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.721] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.721] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.938] GetLastError () returned 0x0 [0194.938] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x2769, lpOverlapped=0x0) returned 1 [0194.940] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2770, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2770, lpOverlapped=0x0) returned 1 [0194.941] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.941] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.941] SetEndOfFile (hFile=0x114) returned 1 [0194.941] CloseHandle (hObject=0x114) returned 1 [0194.941] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.941] SetEndOfFile (hFile=0x358) returned 1 [0194.942] CloseHandle (hObject=0x358) returned 1 [0194.942] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.942] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json")) returned 1 [0194.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.943] lstrlenW (lpString=".doc") returned 4 [0194.943] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.943] lstrlenW (lpString=".docx") returned 5 [0194.943] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.943] lstrlenW (lpString=".pdf") returned 4 [0194.943] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.943] lstrlenW (lpString=".xls") returned 4 [0194.943] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.943] lstrlenW (lpString=".xlsx") returned 5 [0194.943] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.943] lstrlenW (lpString=".ppt") returned 4 [0194.943] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.943] lstrlenW (lpString=".zip") returned 4 [0194.943] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.943] lstrlenW (lpString=".rar") returned 4 [0194.943] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.943] lstrlenW (lpString=".bz2") returned 4 [0194.943] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.943] lstrlenW (lpString=".7z") returned 3 [0194.943] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.943] lstrlenW (lpString=".dbf") returned 4 [0194.943] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.943] lstrlenW (lpString=".1cd") returned 4 [0194.943] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.943] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.943] lstrlenW (lpString=".jpg") returned 4 [0194.943] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.944] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.944] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.944] lstrlenW (lpString=".doc") returned 4 [0194.944] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.944] lstrlenW (lpString=".docx") returned 5 [0194.944] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.944] lstrlenW (lpString=".pdf") returned 4 [0194.944] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.944] lstrlenW (lpString=".xls") returned 4 [0194.944] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.944] lstrlenW (lpString=".xlsx") returned 5 [0194.944] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.944] lstrlenW (lpString=".ppt") returned 4 [0194.944] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.944] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.944] lstrlenW (lpString=".zip") returned 4 [0194.944] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.944] lstrlenW (lpString=".rar") returned 4 [0194.944] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.944] lstrlenW (lpString=".bz2") returned 4 [0194.944] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.944] lstrlenW (lpString=".7z") returned 3 [0194.944] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.944] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.944] lstrlenW (lpString=".dbf") returned 4 [0194.944] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.944] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.944] lstrlenW (lpString=".1cd") returned 4 [0194.945] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.945] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_metadata\\verified_contents.json") returned 160 [0194.945] lstrlenW (lpString=".jpg") returned 4 [0194.945] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.945] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.945] lstrlenW (lpString="messages.json") returned 13 [0194.945] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.947] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=226) returned 1 [0194.947] CloseHandle (hObject=0x358) returned 1 [0194.947] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json")) returned 0x2020 [0194.948] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.948] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.948] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.948] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.948] GetLastError () returned 0x0 [0194.948] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe2, lpOverlapped=0x0) returned 1 [0194.949] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0194.951] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.951] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.951] SetEndOfFile (hFile=0x114) returned 1 [0194.951] CloseHandle (hObject=0x114) returned 1 [0194.951] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.951] SetEndOfFile (hFile=0x358) returned 1 [0194.952] CloseHandle (hObject=0x358) returned 1 [0194.952] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.952] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json")) returned 1 [0194.952] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.952] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.952] lstrlenW (lpString=".doc") returned 4 [0194.952] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.952] lstrlenW (lpString=".docx") returned 5 [0194.952] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.952] lstrlenW (lpString=".pdf") returned 4 [0194.952] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.952] lstrlenW (lpString=".xls") returned 4 [0194.953] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.953] lstrlenW (lpString=".xlsx") returned 5 [0194.953] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.953] lstrlenW (lpString=".ppt") returned 4 [0194.953] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.953] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.953] lstrlenW (lpString=".zip") returned 4 [0194.953] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.953] lstrlenW (lpString=".rar") returned 4 [0194.953] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.953] lstrlenW (lpString=".bz2") returned 4 [0194.953] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.953] lstrlenW (lpString=".7z") returned 3 [0194.953] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.953] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.953] lstrlenW (lpString=".dbf") returned 4 [0194.953] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.953] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.953] lstrlenW (lpString=".1cd") returned 4 [0194.953] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.953] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.953] lstrlenW (lpString=".jpg") returned 4 [0194.953] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.953] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.953] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.953] lstrlenW (lpString=".doc") returned 4 [0194.953] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.953] lstrlenW (lpString=".docx") returned 5 [0194.953] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.953] lstrlenW (lpString=".pdf") returned 4 [0194.953] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.954] lstrlenW (lpString=".xls") returned 4 [0194.954] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.954] lstrlenW (lpString=".xlsx") returned 5 [0194.954] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.954] lstrlenW (lpString=".ppt") returned 4 [0194.954] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.954] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.954] lstrlenW (lpString=".zip") returned 4 [0194.954] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.954] lstrlenW (lpString=".rar") returned 4 [0194.954] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.954] lstrlenW (lpString=".bz2") returned 4 [0194.954] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.954] lstrlenW (lpString=".7z") returned 3 [0194.954] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.954] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.954] lstrlenW (lpString=".dbf") returned 4 [0194.954] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.954] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.954] lstrlenW (lpString=".1cd") returned 4 [0194.954] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.954] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fr\\messages.json") returned 151 [0194.954] lstrlenW (lpString=".jpg") returned 4 [0194.954] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.954] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.954] lstrlenW (lpString="messages.json") returned 13 [0194.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.955] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=238) returned 1 [0194.955] CloseHandle (hObject=0x358) returned 1 [0194.955] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json")) returned 0x2020 [0194.955] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.955] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.955] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.955] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.956] GetLastError () returned 0x0 [0194.956] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xee, lpOverlapped=0x0) returned 1 [0194.957] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0194.957] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.958] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.958] SetEndOfFile (hFile=0x114) returned 1 [0194.958] CloseHandle (hObject=0x114) returned 1 [0194.958] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.958] SetEndOfFile (hFile=0x358) returned 1 [0194.959] CloseHandle (hObject=0x358) returned 1 [0194.959] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.959] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json")) returned 1 [0194.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.959] lstrlenW (lpString=".doc") returned 4 [0194.959] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.959] lstrlenW (lpString=".docx") returned 5 [0194.959] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.959] lstrlenW (lpString=".pdf") returned 4 [0194.959] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.959] lstrlenW (lpString=".xls") returned 4 [0194.959] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.959] lstrlenW (lpString=".xlsx") returned 5 [0194.959] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.959] lstrlenW (lpString=".ppt") returned 4 [0194.959] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.960] lstrlenW (lpString=".zip") returned 4 [0194.960] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.960] lstrlenW (lpString=".rar") returned 4 [0194.960] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.960] lstrlenW (lpString=".bz2") returned 4 [0194.960] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.960] lstrlenW (lpString=".7z") returned 3 [0194.960] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.960] lstrlenW (lpString=".dbf") returned 4 [0194.960] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.960] lstrlenW (lpString=".1cd") returned 4 [0194.960] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.960] lstrlenW (lpString=".jpg") returned 4 [0194.960] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.960] lstrlenW (lpString=".doc") returned 4 [0194.960] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.960] lstrlenW (lpString=".docx") returned 5 [0194.960] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.960] lstrlenW (lpString=".pdf") returned 4 [0194.960] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.960] lstrlenW (lpString=".xls") returned 4 [0194.960] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.960] lstrlenW (lpString=".xlsx") returned 5 [0194.961] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.961] lstrlenW (lpString=".ppt") returned 4 [0194.961] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.961] lstrlenW (lpString=".zip") returned 4 [0194.961] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.961] lstrlenW (lpString=".rar") returned 4 [0194.961] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.961] lstrlenW (lpString=".bz2") returned 4 [0194.961] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.961] lstrlenW (lpString=".7z") returned 3 [0194.961] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.961] lstrlenW (lpString=".dbf") returned 4 [0194.961] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.961] lstrlenW (lpString=".1cd") returned 4 [0194.961] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\he\\messages.json") returned 151 [0194.961] lstrlenW (lpString=".jpg") returned 4 [0194.961] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.961] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.961] lstrlenW (lpString="messages.json") returned 13 [0194.961] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.962] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=282) returned 1 [0194.962] CloseHandle (hObject=0x358) returned 1 [0194.962] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json")) returned 0x2020 [0194.962] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.962] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.962] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.963] GetLastError () returned 0x0 [0194.963] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x11a, lpOverlapped=0x0) returned 1 [0194.964] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x120, lpOverlapped=0x0) returned 1 [0194.965] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.965] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.965] SetEndOfFile (hFile=0x114) returned 1 [0194.965] CloseHandle (hObject=0x114) returned 1 [0194.966] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.966] SetEndOfFile (hFile=0x358) returned 1 [0194.966] CloseHandle (hObject=0x358) returned 1 [0194.966] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.967] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json")) returned 1 [0194.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.967] lstrlenW (lpString=".doc") returned 4 [0194.967] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.967] lstrlenW (lpString=".docx") returned 5 [0194.967] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.967] lstrlenW (lpString=".pdf") returned 4 [0194.967] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.967] lstrlenW (lpString=".xls") returned 4 [0194.967] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.967] lstrlenW (lpString=".xlsx") returned 5 [0194.967] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.967] lstrlenW (lpString=".ppt") returned 4 [0194.967] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.967] lstrlenW (lpString=".zip") returned 4 [0194.967] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.967] lstrlenW (lpString=".rar") returned 4 [0194.967] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.967] lstrlenW (lpString=".bz2") returned 4 [0194.967] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.967] lstrlenW (lpString=".7z") returned 3 [0194.968] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.968] lstrlenW (lpString=".dbf") returned 4 [0194.968] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.968] lstrlenW (lpString=".1cd") returned 4 [0194.968] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.968] lstrlenW (lpString=".jpg") returned 4 [0194.968] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.968] lstrlenW (lpString=".doc") returned 4 [0194.968] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.968] lstrlenW (lpString=".docx") returned 5 [0194.968] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.968] lstrlenW (lpString=".pdf") returned 4 [0194.968] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.968] lstrlenW (lpString=".xls") returned 4 [0194.968] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.968] lstrlenW (lpString=".xlsx") returned 5 [0194.968] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.968] lstrlenW (lpString=".ppt") returned 4 [0194.968] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.968] lstrlenW (lpString=".zip") returned 4 [0194.968] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.968] lstrlenW (lpString=".rar") returned 4 [0194.968] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.968] lstrlenW (lpString=".bz2") returned 4 [0194.968] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.968] lstrlenW (lpString=".7z") returned 3 [0194.969] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.969] lstrlenW (lpString=".dbf") returned 4 [0194.969] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.969] lstrlenW (lpString=".1cd") returned 4 [0194.969] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hi\\messages.json") returned 151 [0194.969] lstrlenW (lpString=".jpg") returned 4 [0194.969] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.969] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.969] lstrlenW (lpString="messages.json") returned 13 [0194.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.969] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=235) returned 1 [0194.969] CloseHandle (hObject=0x358) returned 1 [0194.970] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json")) returned 0x2020 [0194.970] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.970] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.970] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.970] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.970] GetLastError () returned 0x0 [0194.970] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xeb, lpOverlapped=0x0) returned 1 [0194.971] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0194.972] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.972] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.972] SetEndOfFile (hFile=0x114) returned 1 [0194.972] CloseHandle (hObject=0x114) returned 1 [0194.973] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.973] SetEndOfFile (hFile=0x358) returned 1 [0194.973] CloseHandle (hObject=0x358) returned 1 [0194.973] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.974] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json")) returned 1 [0194.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.974] lstrlenW (lpString=".doc") returned 4 [0194.974] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.974] lstrlenW (lpString=".docx") returned 5 [0194.974] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.974] lstrlenW (lpString=".pdf") returned 4 [0194.974] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.974] lstrlenW (lpString=".xls") returned 4 [0194.974] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.974] lstrlenW (lpString=".xlsx") returned 5 [0194.974] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.974] lstrlenW (lpString=".ppt") returned 4 [0194.974] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.974] lstrlenW (lpString=".zip") returned 4 [0194.974] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.974] lstrlenW (lpString=".rar") returned 4 [0194.974] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.974] lstrlenW (lpString=".bz2") returned 4 [0194.974] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.974] lstrlenW (lpString=".7z") returned 3 [0194.974] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.974] lstrlenW (lpString=".dbf") returned 4 [0194.974] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.975] lstrlenW (lpString=".1cd") returned 4 [0194.975] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.975] lstrlenW (lpString=".jpg") returned 4 [0194.975] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.975] lstrlenW (lpString=".doc") returned 4 [0194.975] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.975] lstrlenW (lpString=".docx") returned 5 [0194.975] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.975] lstrlenW (lpString=".pdf") returned 4 [0194.975] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.975] lstrlenW (lpString=".xls") returned 4 [0194.975] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.975] lstrlenW (lpString=".xlsx") returned 5 [0194.975] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.975] lstrlenW (lpString=".ppt") returned 4 [0194.975] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.975] lstrlenW (lpString=".zip") returned 4 [0194.975] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.975] lstrlenW (lpString=".rar") returned 4 [0194.975] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.975] lstrlenW (lpString=".bz2") returned 4 [0194.975] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.975] lstrlenW (lpString=".7z") returned 3 [0194.975] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.975] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.976] lstrlenW (lpString=".dbf") returned 4 [0194.976] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.976] lstrlenW (lpString=".1cd") returned 4 [0194.976] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\hu\\messages.json") returned 151 [0194.976] lstrlenW (lpString=".jpg") returned 4 [0194.976] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.976] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.976] lstrlenW (lpString="messages.json") returned 13 [0194.976] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.977] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=216) returned 1 [0194.977] CloseHandle (hObject=0x358) returned 1 [0194.977] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json")) returned 0x2020 [0194.977] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.977] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.977] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.977] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.977] GetLastError () returned 0x0 [0194.977] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd8, lpOverlapped=0x0) returned 1 [0194.978] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0194.979] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.979] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.980] SetEndOfFile (hFile=0x114) returned 1 [0194.980] CloseHandle (hObject=0x114) returned 1 [0194.980] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.980] SetEndOfFile (hFile=0x358) returned 1 [0194.980] CloseHandle (hObject=0x358) returned 1 [0194.981] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.981] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json")) returned 1 [0194.981] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.981] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.981] lstrlenW (lpString=".doc") returned 4 [0194.981] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.981] lstrlenW (lpString=".docx") returned 5 [0194.981] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.981] lstrlenW (lpString=".pdf") returned 4 [0194.981] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.981] lstrlenW (lpString=".xls") returned 4 [0194.981] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.981] lstrlenW (lpString=".xlsx") returned 5 [0194.981] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.981] lstrlenW (lpString=".ppt") returned 4 [0194.981] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.982] lstrlenW (lpString=".zip") returned 4 [0194.982] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.982] lstrlenW (lpString=".rar") returned 4 [0194.982] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.982] lstrlenW (lpString=".bz2") returned 4 [0194.982] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.982] lstrlenW (lpString=".7z") returned 3 [0194.982] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.982] lstrlenW (lpString=".dbf") returned 4 [0194.982] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.982] lstrlenW (lpString=".1cd") returned 4 [0194.982] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.982] lstrlenW (lpString=".jpg") returned 4 [0194.982] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.982] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.982] lstrlenW (lpString=".doc") returned 4 [0194.982] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.982] lstrlenW (lpString=".docx") returned 5 [0194.982] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.982] lstrlenW (lpString=".pdf") returned 4 [0194.982] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.982] lstrlenW (lpString=".xls") returned 4 [0194.982] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.982] lstrlenW (lpString=".xlsx") returned 5 [0194.983] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.983] lstrlenW (lpString=".ppt") returned 4 [0194.983] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.983] lstrlenW (lpString=".zip") returned 4 [0194.983] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.983] lstrlenW (lpString=".rar") returned 4 [0194.983] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.983] lstrlenW (lpString=".bz2") returned 4 [0194.983] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.983] lstrlenW (lpString=".7z") returned 3 [0194.983] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.983] lstrlenW (lpString=".dbf") returned 4 [0194.983] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.983] lstrlenW (lpString=".1cd") returned 4 [0194.983] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.983] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\id\\messages.json") returned 151 [0194.983] lstrlenW (lpString=".jpg") returned 4 [0194.983] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.983] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.983] lstrlenW (lpString="messages.json") returned 13 [0194.983] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.984] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=215) returned 1 [0194.984] CloseHandle (hObject=0x358) returned 1 [0194.984] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json")) returned 0x2020 [0194.984] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.984] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.984] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.984] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.985] GetLastError () returned 0x0 [0194.985] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd7, lpOverlapped=0x0) returned 1 [0194.987] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0194.988] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0194.988] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.988] SetEndOfFile (hFile=0x114) returned 1 [0194.988] CloseHandle (hObject=0x114) returned 1 [0194.988] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.988] SetEndOfFile (hFile=0x358) returned 1 [0194.989] CloseHandle (hObject=0x358) returned 1 [0194.989] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.993] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json")) returned 1 [0194.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.994] lstrlenW (lpString=".doc") returned 4 [0194.994] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.994] lstrlenW (lpString=".docx") returned 5 [0194.994] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.994] lstrlenW (lpString=".pdf") returned 4 [0194.994] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.994] lstrlenW (lpString=".xls") returned 4 [0194.994] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.994] lstrlenW (lpString=".xlsx") returned 5 [0194.994] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.994] lstrlenW (lpString=".ppt") returned 4 [0194.994] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.994] lstrlenW (lpString=".zip") returned 4 [0194.994] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.994] lstrlenW (lpString=".rar") returned 4 [0194.994] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.994] lstrlenW (lpString=".bz2") returned 4 [0194.994] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.994] lstrlenW (lpString=".7z") returned 3 [0194.994] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.994] lstrlenW (lpString=".dbf") returned 4 [0194.994] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.994] lstrlenW (lpString=".1cd") returned 4 [0194.994] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.995] lstrlenW (lpString=".jpg") returned 4 [0194.995] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.995] lstrlenW (lpString=".doc") returned 4 [0194.995] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.995] lstrlenW (lpString=".docx") returned 5 [0194.995] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.995] lstrlenW (lpString=".pdf") returned 4 [0194.995] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.995] lstrlenW (lpString=".xls") returned 4 [0194.995] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.995] lstrlenW (lpString=".xlsx") returned 5 [0194.995] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.995] lstrlenW (lpString=".ppt") returned 4 [0194.995] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.995] lstrlenW (lpString=".zip") returned 4 [0194.995] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.995] lstrlenW (lpString=".rar") returned 4 [0194.995] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.995] lstrlenW (lpString=".bz2") returned 4 [0194.995] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.995] lstrlenW (lpString=".7z") returned 3 [0194.995] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.995] lstrlenW (lpString=".dbf") returned 4 [0194.995] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.995] lstrlenW (lpString=".1cd") returned 4 [0194.995] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.995] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\it\\messages.json") returned 151 [0194.996] lstrlenW (lpString=".jpg") returned 4 [0194.996] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.996] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.996] lstrlenW (lpString="messages.json") returned 13 [0194.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.996] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=245) returned 1 [0194.997] CloseHandle (hObject=0x358) returned 1 [0194.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json")) returned 0x2020 [0194.997] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0194.997] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.997] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0194.997] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0194.998] GetLastError () returned 0x0 [0194.998] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xf5, lpOverlapped=0x0) returned 1 [0194.999] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.999] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.000] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.000] SetEndOfFile (hFile=0x114) returned 1 [0195.000] CloseHandle (hObject=0x114) returned 1 [0195.000] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.000] SetEndOfFile (hFile=0x358) returned 1 [0195.001] CloseHandle (hObject=0x358) returned 1 [0195.001] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.001] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json")) returned 1 [0195.001] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.001] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.001] lstrlenW (lpString=".doc") returned 4 [0195.001] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.001] lstrlenW (lpString=".docx") returned 5 [0195.001] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.001] lstrlenW (lpString=".pdf") returned 4 [0195.001] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.001] lstrlenW (lpString=".xls") returned 4 [0195.001] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.001] lstrlenW (lpString=".xlsx") returned 5 [0195.001] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.001] lstrlenW (lpString=".ppt") returned 4 [0195.001] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.001] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.001] lstrlenW (lpString=".zip") returned 4 [0195.002] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.002] lstrlenW (lpString=".rar") returned 4 [0195.002] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.002] lstrlenW (lpString=".bz2") returned 4 [0195.002] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.002] lstrlenW (lpString=".7z") returned 3 [0195.002] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.002] lstrlenW (lpString=".dbf") returned 4 [0195.002] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.002] lstrlenW (lpString=".1cd") returned 4 [0195.002] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.002] lstrlenW (lpString=".jpg") returned 4 [0195.002] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.002] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.002] lstrlenW (lpString=".doc") returned 4 [0195.002] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.002] lstrlenW (lpString=".docx") returned 5 [0195.002] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.002] lstrlenW (lpString=".pdf") returned 4 [0195.002] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.002] lstrlenW (lpString=".xls") returned 4 [0195.002] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.002] lstrlenW (lpString=".xlsx") returned 5 [0195.002] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.003] lstrlenW (lpString=".ppt") returned 4 [0195.003] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.003] lstrlenW (lpString=".zip") returned 4 [0195.003] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.003] lstrlenW (lpString=".rar") returned 4 [0195.003] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.003] lstrlenW (lpString=".bz2") returned 4 [0195.003] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.003] lstrlenW (lpString=".7z") returned 3 [0195.003] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.003] lstrlenW (lpString=".dbf") returned 4 [0195.003] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.003] lstrlenW (lpString=".1cd") returned 4 [0195.003] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.003] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ja\\messages.json") returned 151 [0195.003] lstrlenW (lpString=".jpg") returned 4 [0195.003] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.003] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.003] lstrlenW (lpString="messages.json") returned 13 [0195.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.004] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=224) returned 1 [0195.004] CloseHandle (hObject=0x358) returned 1 [0195.004] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json")) returned 0x2020 [0195.004] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.004] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.004] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.005] GetLastError () returned 0x0 [0195.005] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe0, lpOverlapped=0x0) returned 1 [0195.008] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.009] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.009] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.009] SetEndOfFile (hFile=0x114) returned 1 [0195.009] CloseHandle (hObject=0x114) returned 1 [0195.009] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.009] SetEndOfFile (hFile=0x358) returned 1 [0195.010] CloseHandle (hObject=0x358) returned 1 [0195.010] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.010] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json")) returned 1 [0195.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.011] lstrlenW (lpString=".doc") returned 4 [0195.011] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.011] lstrlenW (lpString=".docx") returned 5 [0195.011] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.011] lstrlenW (lpString=".pdf") returned 4 [0195.011] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.011] lstrlenW (lpString=".xls") returned 4 [0195.011] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.011] lstrlenW (lpString=".xlsx") returned 5 [0195.011] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.011] lstrlenW (lpString=".ppt") returned 4 [0195.011] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.011] lstrlenW (lpString=".zip") returned 4 [0195.011] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.011] lstrlenW (lpString=".rar") returned 4 [0195.011] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.011] lstrlenW (lpString=".bz2") returned 4 [0195.011] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.011] lstrlenW (lpString=".7z") returned 3 [0195.011] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.011] lstrlenW (lpString=".dbf") returned 4 [0195.011] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.011] lstrlenW (lpString=".1cd") returned 4 [0195.011] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.011] lstrlenW (lpString=".jpg") returned 4 [0195.012] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.012] lstrlenW (lpString=".doc") returned 4 [0195.012] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.012] lstrlenW (lpString=".docx") returned 5 [0195.012] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.012] lstrlenW (lpString=".pdf") returned 4 [0195.012] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.012] lstrlenW (lpString=".xls") returned 4 [0195.012] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.012] lstrlenW (lpString=".xlsx") returned 5 [0195.012] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.012] lstrlenW (lpString=".ppt") returned 4 [0195.012] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.012] lstrlenW (lpString=".zip") returned 4 [0195.012] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.012] lstrlenW (lpString=".rar") returned 4 [0195.012] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.012] lstrlenW (lpString=".bz2") returned 4 [0195.012] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.012] lstrlenW (lpString=".7z") returned 3 [0195.013] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.013] lstrlenW (lpString=".dbf") returned 4 [0195.013] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.013] lstrlenW (lpString=".1cd") returned 4 [0195.013] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ko\\messages.json") returned 151 [0195.013] lstrlenW (lpString=".jpg") returned 4 [0195.013] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.013] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.013] lstrlenW (lpString="messages.json") returned 13 [0195.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.014] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=235) returned 1 [0195.014] CloseHandle (hObject=0x358) returned 1 [0195.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json")) returned 0x2020 [0195.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.014] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.014] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.014] GetLastError () returned 0x0 [0195.014] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xeb, lpOverlapped=0x0) returned 1 [0195.015] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.017] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.017] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.017] SetEndOfFile (hFile=0x114) returned 1 [0195.017] CloseHandle (hObject=0x114) returned 1 [0195.017] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.017] SetEndOfFile (hFile=0x358) returned 1 [0195.018] CloseHandle (hObject=0x358) returned 1 [0195.018] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.018] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json")) returned 1 [0195.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.018] lstrlenW (lpString=".doc") returned 4 [0195.018] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.018] lstrlenW (lpString=".docx") returned 5 [0195.018] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.018] lstrlenW (lpString=".pdf") returned 4 [0195.018] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.018] lstrlenW (lpString=".xls") returned 4 [0195.019] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.019] lstrlenW (lpString=".xlsx") returned 5 [0195.019] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.019] lstrlenW (lpString=".ppt") returned 4 [0195.019] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.019] lstrlenW (lpString=".zip") returned 4 [0195.019] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.019] lstrlenW (lpString=".rar") returned 4 [0195.019] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.019] lstrlenW (lpString=".bz2") returned 4 [0195.019] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.019] lstrlenW (lpString=".7z") returned 3 [0195.019] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.019] lstrlenW (lpString=".dbf") returned 4 [0195.019] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.019] lstrlenW (lpString=".1cd") returned 4 [0195.019] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.019] lstrlenW (lpString=".jpg") returned 4 [0195.019] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.019] lstrlenW (lpString=".doc") returned 4 [0195.019] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.019] lstrlenW (lpString=".docx") returned 5 [0195.019] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.019] lstrlenW (lpString=".pdf") returned 4 [0195.019] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.020] lstrlenW (lpString=".xls") returned 4 [0195.020] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.020] lstrlenW (lpString=".xlsx") returned 5 [0195.020] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.020] lstrlenW (lpString=".ppt") returned 4 [0195.020] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.020] lstrlenW (lpString=".zip") returned 4 [0195.020] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.020] lstrlenW (lpString=".rar") returned 4 [0195.020] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.020] lstrlenW (lpString=".bz2") returned 4 [0195.020] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.020] lstrlenW (lpString=".7z") returned 3 [0195.020] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.020] lstrlenW (lpString=".dbf") returned 4 [0195.020] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.020] lstrlenW (lpString=".1cd") returned 4 [0195.020] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lt\\messages.json") returned 151 [0195.020] lstrlenW (lpString=".jpg") returned 4 [0195.020] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.020] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.020] lstrlenW (lpString="messages.json") returned 13 [0195.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.021] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=229) returned 1 [0195.021] CloseHandle (hObject=0x358) returned 1 [0195.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json")) returned 0x2020 [0195.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.021] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.021] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.022] GetLastError () returned 0x0 [0195.022] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe5, lpOverlapped=0x0) returned 1 [0195.023] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.024] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.024] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.024] SetEndOfFile (hFile=0x114) returned 1 [0195.024] CloseHandle (hObject=0x114) returned 1 [0195.024] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.024] SetEndOfFile (hFile=0x358) returned 1 [0195.025] CloseHandle (hObject=0x358) returned 1 [0195.025] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.025] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json")) returned 1 [0195.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.025] lstrlenW (lpString=".doc") returned 4 [0195.026] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.026] lstrlenW (lpString=".docx") returned 5 [0195.026] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.026] lstrlenW (lpString=".pdf") returned 4 [0195.026] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.026] lstrlenW (lpString=".xls") returned 4 [0195.026] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.026] lstrlenW (lpString=".xlsx") returned 5 [0195.026] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.026] lstrlenW (lpString=".ppt") returned 4 [0195.026] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.026] lstrlenW (lpString=".zip") returned 4 [0195.026] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.026] lstrlenW (lpString=".rar") returned 4 [0195.026] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.026] lstrlenW (lpString=".bz2") returned 4 [0195.026] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.026] lstrlenW (lpString=".7z") returned 3 [0195.026] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.026] lstrlenW (lpString=".dbf") returned 4 [0195.026] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.026] lstrlenW (lpString=".1cd") returned 4 [0195.026] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.026] lstrlenW (lpString=".jpg") returned 4 [0195.026] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.027] lstrlenW (lpString=".doc") returned 4 [0195.027] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.027] lstrlenW (lpString=".docx") returned 5 [0195.027] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.027] lstrlenW (lpString=".pdf") returned 4 [0195.027] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.027] lstrlenW (lpString=".xls") returned 4 [0195.027] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.027] lstrlenW (lpString=".xlsx") returned 5 [0195.027] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.027] lstrlenW (lpString=".ppt") returned 4 [0195.027] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.027] lstrlenW (lpString=".zip") returned 4 [0195.027] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.027] lstrlenW (lpString=".rar") returned 4 [0195.027] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.027] lstrlenW (lpString=".bz2") returned 4 [0195.027] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.027] lstrlenW (lpString=".7z") returned 3 [0195.027] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.027] lstrlenW (lpString=".dbf") returned 4 [0195.027] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.028] lstrlenW (lpString=".1cd") returned 4 [0195.028] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\lv\\messages.json") returned 151 [0195.028] lstrlenW (lpString=".jpg") returned 4 [0195.028] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.028] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.028] lstrlenW (lpString="messages.json") returned 13 [0195.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.028] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=208) returned 1 [0195.029] CloseHandle (hObject=0x358) returned 1 [0195.029] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json")) returned 0x2020 [0195.029] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.029] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.029] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.029] GetLastError () returned 0x0 [0195.029] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd0, lpOverlapped=0x0) returned 1 [0195.030] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.031] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.031] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.031] SetEndOfFile (hFile=0x114) returned 1 [0195.031] CloseHandle (hObject=0x114) returned 1 [0195.031] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.032] SetEndOfFile (hFile=0x358) returned 1 [0195.032] CloseHandle (hObject=0x358) returned 1 [0195.032] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.032] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json")) returned 1 [0195.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.033] lstrlenW (lpString=".doc") returned 4 [0195.033] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.033] lstrlenW (lpString=".docx") returned 5 [0195.033] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.033] lstrlenW (lpString=".pdf") returned 4 [0195.033] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.033] lstrlenW (lpString=".xls") returned 4 [0195.033] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.033] lstrlenW (lpString=".xlsx") returned 5 [0195.033] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.033] lstrlenW (lpString=".ppt") returned 4 [0195.033] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.033] lstrlenW (lpString=".zip") returned 4 [0195.033] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.033] lstrlenW (lpString=".rar") returned 4 [0195.033] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.033] lstrlenW (lpString=".bz2") returned 4 [0195.033] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.033] lstrlenW (lpString=".7z") returned 3 [0195.033] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.033] lstrlenW (lpString=".dbf") returned 4 [0195.033] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.034] lstrlenW (lpString=".1cd") returned 4 [0195.034] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.034] lstrlenW (lpString=".jpg") returned 4 [0195.034] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.034] lstrlenW (lpString=".doc") returned 4 [0195.034] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.034] lstrlenW (lpString=".docx") returned 5 [0195.034] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.034] lstrlenW (lpString=".pdf") returned 4 [0195.034] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.034] lstrlenW (lpString=".xls") returned 4 [0195.034] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.034] lstrlenW (lpString=".xlsx") returned 5 [0195.034] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.034] lstrlenW (lpString=".ppt") returned 4 [0195.034] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.034] lstrlenW (lpString=".zip") returned 4 [0195.034] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.034] lstrlenW (lpString=".rar") returned 4 [0195.034] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.034] lstrlenW (lpString=".bz2") returned 4 [0195.034] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.034] lstrlenW (lpString=".7z") returned 3 [0195.034] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.034] lstrlenW (lpString=".dbf") returned 4 [0195.034] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.035] lstrlenW (lpString=".1cd") returned 4 [0195.035] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\ms\\messages.json") returned 151 [0195.035] lstrlenW (lpString=".jpg") returned 4 [0195.035] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.035] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.035] lstrlenW (lpString="messages.json") returned 13 [0195.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.035] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=221) returned 1 [0195.036] CloseHandle (hObject=0x358) returned 1 [0195.038] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json")) returned 0x2020 [0195.038] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.038] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.038] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.038] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.039] GetLastError () returned 0x0 [0195.039] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xdd, lpOverlapped=0x0) returned 1 [0195.040] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.041] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.041] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.041] SetEndOfFile (hFile=0x114) returned 1 [0195.041] CloseHandle (hObject=0x114) returned 1 [0195.041] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.041] SetEndOfFile (hFile=0x358) returned 1 [0195.042] CloseHandle (hObject=0x358) returned 1 [0195.042] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.042] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json")) returned 1 [0195.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.043] lstrlenW (lpString=".doc") returned 4 [0195.043] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.043] lstrlenW (lpString=".docx") returned 5 [0195.043] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.043] lstrlenW (lpString=".pdf") returned 4 [0195.043] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.043] lstrlenW (lpString=".xls") returned 4 [0195.043] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.043] lstrlenW (lpString=".xlsx") returned 5 [0195.043] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.043] lstrlenW (lpString=".ppt") returned 4 [0195.043] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.043] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.043] lstrlenW (lpString=".zip") returned 4 [0195.043] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.044] lstrlenW (lpString=".rar") returned 4 [0195.044] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.044] lstrlenW (lpString=".bz2") returned 4 [0195.044] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.044] lstrlenW (lpString=".7z") returned 3 [0195.044] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.044] lstrlenW (lpString=".dbf") returned 4 [0195.044] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.044] lstrlenW (lpString=".1cd") returned 4 [0195.044] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.044] lstrlenW (lpString=".jpg") returned 4 [0195.044] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.044] lstrlenW (lpString=".doc") returned 4 [0195.044] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.044] lstrlenW (lpString=".docx") returned 5 [0195.044] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.044] lstrlenW (lpString=".pdf") returned 4 [0195.044] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.044] lstrlenW (lpString=".xls") returned 4 [0195.044] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.044] lstrlenW (lpString=".xlsx") returned 5 [0195.044] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.044] lstrlenW (lpString=".ppt") returned 4 [0195.044] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.044] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.045] lstrlenW (lpString=".zip") returned 4 [0195.045] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.045] lstrlenW (lpString=".rar") returned 4 [0195.045] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.045] lstrlenW (lpString=".bz2") returned 4 [0195.045] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.045] lstrlenW (lpString=".7z") returned 3 [0195.045] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.045] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.045] lstrlenW (lpString=".dbf") returned 4 [0195.045] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.045] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.045] lstrlenW (lpString=".1cd") returned 4 [0195.045] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.045] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\nl\\messages.json") returned 151 [0195.045] lstrlenW (lpString=".jpg") returned 4 [0195.045] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.045] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.045] lstrlenW (lpString="messages.json") returned 13 [0195.045] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.046] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=191) returned 1 [0195.046] CloseHandle (hObject=0x358) returned 1 [0195.046] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json")) returned 0x2020 [0195.046] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.046] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.046] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.047] GetLastError () returned 0x0 [0195.047] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xbf, lpOverlapped=0x0) returned 1 [0195.048] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.049] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.049] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.049] SetEndOfFile (hFile=0x114) returned 1 [0195.049] CloseHandle (hObject=0x114) returned 1 [0195.049] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.049] SetEndOfFile (hFile=0x358) returned 1 [0195.050] CloseHandle (hObject=0x358) returned 1 [0195.050] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.050] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json")) returned 1 [0195.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.050] lstrlenW (lpString=".doc") returned 4 [0195.050] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.051] lstrlenW (lpString=".docx") returned 5 [0195.051] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.051] lstrlenW (lpString=".pdf") returned 4 [0195.051] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.051] lstrlenW (lpString=".xls") returned 4 [0195.051] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.051] lstrlenW (lpString=".xlsx") returned 5 [0195.051] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.051] lstrlenW (lpString=".ppt") returned 4 [0195.051] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.051] lstrlenW (lpString=".zip") returned 4 [0195.051] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.051] lstrlenW (lpString=".rar") returned 4 [0195.051] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.051] lstrlenW (lpString=".bz2") returned 4 [0195.051] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.051] lstrlenW (lpString=".7z") returned 3 [0195.051] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.051] lstrlenW (lpString=".dbf") returned 4 [0195.051] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.051] lstrlenW (lpString=".1cd") returned 4 [0195.051] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.051] lstrlenW (lpString=".jpg") returned 4 [0195.051] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.051] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.052] lstrlenW (lpString=".doc") returned 4 [0195.052] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.052] lstrlenW (lpString=".docx") returned 5 [0195.052] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.052] lstrlenW (lpString=".pdf") returned 4 [0195.052] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.052] lstrlenW (lpString=".xls") returned 4 [0195.052] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.052] lstrlenW (lpString=".xlsx") returned 5 [0195.052] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.052] lstrlenW (lpString=".ppt") returned 4 [0195.052] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.052] lstrlenW (lpString=".zip") returned 4 [0195.052] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.052] lstrlenW (lpString=".rar") returned 4 [0195.052] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.052] lstrlenW (lpString=".bz2") returned 4 [0195.052] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.052] lstrlenW (lpString=".7z") returned 3 [0195.052] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.052] lstrlenW (lpString=".dbf") returned 4 [0195.052] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.052] lstrlenW (lpString=".1cd") returned 4 [0195.052] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.052] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\no\\messages.json") returned 151 [0195.052] lstrlenW (lpString=".jpg") returned 4 [0195.053] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.053] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.053] lstrlenW (lpString="messages.json") returned 13 [0195.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.053] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=209) returned 1 [0195.053] CloseHandle (hObject=0x358) returned 1 [0195.053] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json")) returned 0x2020 [0195.053] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.053] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.054] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.054] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0195.054] GetLastError () returned 0x0 [0195.054] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd1, lpOverlapped=0x0) returned 1 [0195.055] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.056] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.056] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.056] SetEndOfFile (hFile=0x114) returned 1 [0195.056] CloseHandle (hObject=0x114) returned 1 [0195.056] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.056] SetEndOfFile (hFile=0x358) returned 1 [0195.057] CloseHandle (hObject=0x358) returned 1 [0195.057] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.057] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json")) returned 1 [0195.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.058] lstrlenW (lpString=".doc") returned 4 [0195.058] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.058] lstrlenW (lpString=".docx") returned 5 [0195.058] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.058] lstrlenW (lpString=".pdf") returned 4 [0195.058] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.058] lstrlenW (lpString=".xls") returned 4 [0195.058] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.058] lstrlenW (lpString=".xlsx") returned 5 [0195.058] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.058] lstrlenW (lpString=".ppt") returned 4 [0195.058] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.058] lstrlenW (lpString=".zip") returned 4 [0195.058] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.058] lstrlenW (lpString=".rar") returned 4 [0195.058] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.058] lstrlenW (lpString=".bz2") returned 4 [0195.058] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.058] lstrlenW (lpString=".7z") returned 3 [0195.058] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.058] lstrlenW (lpString=".dbf") returned 4 [0195.058] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.058] lstrlenW (lpString=".1cd") returned 4 [0195.058] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.168] lstrlenW (lpString=".jpg") returned 4 [0195.168] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.168] lstrlenW (lpString=".doc") returned 4 [0195.168] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.168] lstrlenW (lpString=".docx") returned 5 [0195.168] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.168] lstrlenW (lpString=".pdf") returned 4 [0195.168] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.168] lstrlenW (lpString=".xls") returned 4 [0195.168] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.169] lstrlenW (lpString=".xlsx") returned 5 [0195.169] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.169] lstrlenW (lpString=".ppt") returned 4 [0195.169] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.169] lstrlenW (lpString=".zip") returned 4 [0195.169] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.169] lstrlenW (lpString=".rar") returned 4 [0195.169] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.169] lstrlenW (lpString=".bz2") returned 4 [0195.169] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.169] lstrlenW (lpString=".7z") returned 3 [0195.169] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.169] lstrlenW (lpString=".dbf") returned 4 [0195.169] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.169] lstrlenW (lpString=".1cd") returned 4 [0195.169] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\pl\\messages.json") returned 151 [0195.169] lstrlenW (lpString=".jpg") returned 4 [0195.169] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.169] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.169] lstrlenW (lpString="messages.json") returned 13 [0195.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.170] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=212) returned 1 [0195.170] CloseHandle (hObject=0x120) returned 1 [0195.170] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0195.170] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.170] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.170] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.171] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.171] GetLastError () returned 0x0 [0195.171] ReadFile (in: hFile=0x120, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd4, lpOverlapped=0x0) returned 1 [0195.172] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.173] ReadFile (in: hFile=0x120, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.173] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.173] SetEndOfFile (hFile=0x388) returned 1 [0195.173] CloseHandle (hObject=0x388) returned 1 [0195.173] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.173] SetEndOfFile (hFile=0x120) returned 1 [0195.174] CloseHandle (hObject=0x120) returned 1 [0195.174] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.174] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0195.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.174] lstrlenW (lpString=".doc") returned 4 [0195.174] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.174] lstrlenW (lpString=".docx") returned 5 [0195.174] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.175] lstrlenW (lpString=".pdf") returned 4 [0195.175] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.175] lstrlenW (lpString=".xls") returned 4 [0195.175] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.175] lstrlenW (lpString=".xlsx") returned 5 [0195.175] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.175] lstrlenW (lpString=".ppt") returned 4 [0195.175] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.175] lstrlenW (lpString=".zip") returned 4 [0195.175] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.175] lstrlenW (lpString=".rar") returned 4 [0195.175] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.175] lstrlenW (lpString=".bz2") returned 4 [0195.175] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.175] lstrlenW (lpString=".7z") returned 3 [0195.175] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.175] lstrlenW (lpString=".dbf") returned 4 [0195.175] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.175] lstrlenW (lpString=".1cd") returned 4 [0195.175] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.175] lstrlenW (lpString=".jpg") returned 4 [0195.175] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.175] lstrlenW (lpString=".doc") returned 4 [0195.176] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.176] lstrlenW (lpString=".docx") returned 5 [0195.176] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.176] lstrlenW (lpString=".pdf") returned 4 [0195.176] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.176] lstrlenW (lpString=".xls") returned 4 [0195.176] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.176] lstrlenW (lpString=".xlsx") returned 5 [0195.176] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.176] lstrlenW (lpString=".ppt") returned 4 [0195.176] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.176] lstrlenW (lpString=".zip") returned 4 [0195.176] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.176] lstrlenW (lpString=".rar") returned 4 [0195.176] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.176] lstrlenW (lpString=".bz2") returned 4 [0195.176] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.176] lstrlenW (lpString=".7z") returned 3 [0195.176] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.176] lstrlenW (lpString=".dbf") returned 4 [0195.176] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.176] lstrlenW (lpString=".1cd") returned 4 [0195.176] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0195.176] lstrlenW (lpString=".jpg") returned 4 [0195.176] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.177] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.177] lstrlenW (lpString="computed_hashes.json") returned 20 [0195.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.497] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=352) returned 1 [0195.497] CloseHandle (hObject=0x35c) returned 1 [0195.497] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0195.497] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.497] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.497] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.498] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.498] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.712] GetLastError () returned 0x0 [0195.713] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x160, lpOverlapped=0x0) returned 1 [0195.714] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x170, lpOverlapped=0x0) returned 1 [0195.715] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.715] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0195.715] SetEndOfFile (hFile=0x388) returned 1 [0195.715] CloseHandle (hObject=0x388) returned 1 [0195.715] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.715] SetEndOfFile (hFile=0x35c) returned 1 [0195.716] CloseHandle (hObject=0x35c) returned 1 [0195.716] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.716] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json")) returned 1 [0195.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.717] lstrlenW (lpString=".doc") returned 4 [0195.717] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.717] lstrlenW (lpString=".docx") returned 5 [0195.717] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.717] lstrlenW (lpString=".pdf") returned 4 [0195.717] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.717] lstrlenW (lpString=".xls") returned 4 [0195.717] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.717] lstrlenW (lpString=".xlsx") returned 5 [0195.717] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.717] lstrlenW (lpString=".ppt") returned 4 [0195.717] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.717] lstrlenW (lpString=".zip") returned 4 [0195.717] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.717] lstrlenW (lpString=".rar") returned 4 [0195.717] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.717] lstrlenW (lpString=".bz2") returned 4 [0195.717] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.717] lstrlenW (lpString=".7z") returned 3 [0195.717] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.717] lstrlenW (lpString=".dbf") returned 4 [0195.717] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.717] lstrlenW (lpString=".1cd") returned 4 [0195.717] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.717] lstrlenW (lpString=".jpg") returned 4 [0195.718] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.718] lstrlenW (lpString=".doc") returned 4 [0195.718] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.718] lstrlenW (lpString=".docx") returned 5 [0195.718] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.718] lstrlenW (lpString=".pdf") returned 4 [0195.718] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.718] lstrlenW (lpString=".xls") returned 4 [0195.718] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.718] lstrlenW (lpString=".xlsx") returned 5 [0195.718] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.718] lstrlenW (lpString=".ppt") returned 4 [0195.718] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.718] lstrlenW (lpString=".zip") returned 4 [0195.718] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.718] lstrlenW (lpString=".rar") returned 4 [0195.718] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.718] lstrlenW (lpString=".bz2") returned 4 [0195.718] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.718] lstrlenW (lpString=".7z") returned 3 [0195.718] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.718] lstrlenW (lpString=".dbf") returned 4 [0195.718] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.718] lstrlenW (lpString=".1cd") returned 4 [0195.718] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_metadata\\computed_hashes.json") returned 156 [0195.718] lstrlenW (lpString=".jpg") returned 4 [0195.718] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.719] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.719] lstrlenW (lpString="messages.json") returned 13 [0195.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.719] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=387) returned 1 [0195.719] CloseHandle (hObject=0x35c) returned 1 [0195.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json")) returned 0x2020 [0195.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.720] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.720] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.720] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.720] GetLastError () returned 0x0 [0195.720] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x183, lpOverlapped=0x0) returned 1 [0195.722] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x190, lpOverlapped=0x0) returned 1 [0195.723] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.723] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.725] SetEndOfFile (hFile=0x388) returned 1 [0195.725] CloseHandle (hObject=0x388) returned 1 [0195.725] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.725] SetEndOfFile (hFile=0x35c) returned 1 [0195.726] CloseHandle (hObject=0x35c) returned 1 [0195.726] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.726] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json")) returned 1 [0195.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.726] lstrlenW (lpString=".doc") returned 4 [0195.726] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.726] lstrlenW (lpString=".docx") returned 5 [0195.727] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.727] lstrlenW (lpString=".pdf") returned 4 [0195.727] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.727] lstrlenW (lpString=".xls") returned 4 [0195.727] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.727] lstrlenW (lpString=".xlsx") returned 5 [0195.727] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.727] lstrlenW (lpString=".ppt") returned 4 [0195.727] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.727] lstrlenW (lpString=".zip") returned 4 [0195.727] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.727] lstrlenW (lpString=".rar") returned 4 [0195.727] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.727] lstrlenW (lpString=".bz2") returned 4 [0195.727] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.727] lstrlenW (lpString=".7z") returned 3 [0195.727] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.727] lstrlenW (lpString=".dbf") returned 4 [0195.727] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.727] lstrlenW (lpString=".1cd") returned 4 [0195.727] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.727] lstrlenW (lpString=".jpg") returned 4 [0195.727] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.727] lstrlenW (lpString=".doc") returned 4 [0195.727] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.727] lstrlenW (lpString=".docx") returned 5 [0195.727] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.728] lstrlenW (lpString=".pdf") returned 4 [0195.728] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.728] lstrlenW (lpString=".xls") returned 4 [0195.728] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.728] lstrlenW (lpString=".xlsx") returned 5 [0195.728] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.728] lstrlenW (lpString=".ppt") returned 4 [0195.728] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.728] lstrlenW (lpString=".zip") returned 4 [0195.728] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.728] lstrlenW (lpString=".rar") returned 4 [0195.728] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.728] lstrlenW (lpString=".bz2") returned 4 [0195.728] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.728] lstrlenW (lpString=".7z") returned 3 [0195.728] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.728] lstrlenW (lpString=".dbf") returned 4 [0195.728] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.728] lstrlenW (lpString=".1cd") returned 4 [0195.728] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ml\\messages.json") returned 151 [0195.728] lstrlenW (lpString=".jpg") returned 4 [0195.728] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.728] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.728] lstrlenW (lpString="messages.json") returned 13 [0195.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.729] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=451) returned 1 [0195.729] CloseHandle (hObject=0x35c) returned 1 [0195.729] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json")) returned 0x2020 [0195.729] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.730] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.730] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.730] GetLastError () returned 0x0 [0195.730] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x1c3, lpOverlapped=0x0) returned 1 [0195.731] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0195.732] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.732] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.733] SetEndOfFile (hFile=0x388) returned 1 [0195.733] CloseHandle (hObject=0x388) returned 1 [0195.733] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.733] SetEndOfFile (hFile=0x35c) returned 1 [0195.733] CloseHandle (hObject=0x35c) returned 1 [0195.734] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.734] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json")) returned 1 [0195.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.734] lstrlenW (lpString=".doc") returned 4 [0195.734] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.734] lstrlenW (lpString=".docx") returned 5 [0195.734] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.734] lstrlenW (lpString=".pdf") returned 4 [0195.734] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.734] lstrlenW (lpString=".xls") returned 4 [0195.734] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.734] lstrlenW (lpString=".xlsx") returned 5 [0195.734] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.734] lstrlenW (lpString=".ppt") returned 4 [0195.734] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.735] lstrlenW (lpString=".zip") returned 4 [0195.735] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.735] lstrlenW (lpString=".rar") returned 4 [0195.735] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.735] lstrlenW (lpString=".bz2") returned 4 [0195.735] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.735] lstrlenW (lpString=".7z") returned 3 [0195.735] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.735] lstrlenW (lpString=".dbf") returned 4 [0195.735] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.735] lstrlenW (lpString=".1cd") returned 4 [0195.735] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.735] lstrlenW (lpString=".jpg") returned 4 [0195.735] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.735] lstrlenW (lpString=".doc") returned 4 [0195.735] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.735] lstrlenW (lpString=".docx") returned 5 [0195.735] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.735] lstrlenW (lpString=".pdf") returned 4 [0195.735] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.735] lstrlenW (lpString=".xls") returned 4 [0195.735] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.735] lstrlenW (lpString=".xlsx") returned 5 [0195.735] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.735] lstrlenW (lpString=".ppt") returned 4 [0195.735] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.736] lstrlenW (lpString=".zip") returned 4 [0195.736] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.736] lstrlenW (lpString=".rar") returned 4 [0195.736] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.736] lstrlenW (lpString=".bz2") returned 4 [0195.736] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.736] lstrlenW (lpString=".7z") returned 3 [0195.736] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.736] lstrlenW (lpString=".dbf") returned 4 [0195.736] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.736] lstrlenW (lpString=".1cd") returned 4 [0195.736] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mn\\messages.json") returned 151 [0195.736] lstrlenW (lpString=".jpg") returned 4 [0195.736] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.736] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.736] lstrlenW (lpString="messages.json") returned 13 [0195.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.737] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=300) returned 1 [0195.737] CloseHandle (hObject=0x35c) returned 1 [0195.737] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json")) returned 0x2020 [0195.737] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.737] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.737] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.738] GetLastError () returned 0x0 [0195.738] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x12c, lpOverlapped=0x0) returned 1 [0195.739] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x130, lpOverlapped=0x0) returned 1 [0195.739] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.740] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.740] SetEndOfFile (hFile=0x388) returned 1 [0195.740] CloseHandle (hObject=0x388) returned 1 [0195.740] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.740] SetEndOfFile (hFile=0x35c) returned 1 [0195.741] CloseHandle (hObject=0x35c) returned 1 [0195.741] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.741] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json")) returned 1 [0195.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.741] lstrlenW (lpString=".doc") returned 4 [0195.741] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.741] lstrlenW (lpString=".docx") returned 5 [0195.741] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.741] lstrlenW (lpString=".pdf") returned 4 [0195.741] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.741] lstrlenW (lpString=".xls") returned 4 [0195.741] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.741] lstrlenW (lpString=".xlsx") returned 5 [0195.742] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.742] lstrlenW (lpString=".ppt") returned 4 [0195.742] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.742] lstrlenW (lpString=".zip") returned 4 [0195.742] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.742] lstrlenW (lpString=".rar") returned 4 [0195.742] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.742] lstrlenW (lpString=".bz2") returned 4 [0195.742] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.742] lstrlenW (lpString=".7z") returned 3 [0195.742] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.742] lstrlenW (lpString=".dbf") returned 4 [0195.742] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.742] lstrlenW (lpString=".1cd") returned 4 [0195.742] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.742] lstrlenW (lpString=".jpg") returned 4 [0195.742] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.742] lstrlenW (lpString=".doc") returned 4 [0195.742] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.742] lstrlenW (lpString=".docx") returned 5 [0195.742] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.742] lstrlenW (lpString=".pdf") returned 4 [0195.742] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.742] lstrlenW (lpString=".xls") returned 4 [0195.742] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.742] lstrlenW (lpString=".xlsx") returned 5 [0195.742] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.743] lstrlenW (lpString=".ppt") returned 4 [0195.743] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.743] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.743] lstrlenW (lpString=".zip") returned 4 [0195.743] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.743] lstrlenW (lpString=".rar") returned 4 [0195.743] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.743] lstrlenW (lpString=".bz2") returned 4 [0195.743] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.743] lstrlenW (lpString=".7z") returned 3 [0195.743] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.743] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.743] lstrlenW (lpString=".dbf") returned 4 [0195.743] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.743] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.743] lstrlenW (lpString=".1cd") returned 4 [0195.743] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.743] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\mr\\messages.json") returned 151 [0195.743] lstrlenW (lpString=".jpg") returned 4 [0195.743] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.743] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.743] lstrlenW (lpString="messages.json") returned 13 [0195.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.744] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=203) returned 1 [0195.744] CloseHandle (hObject=0x35c) returned 1 [0195.744] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 0x2020 [0195.744] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.744] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.744] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.744] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.745] GetLastError () returned 0x0 [0195.745] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xcb, lpOverlapped=0x0) returned 1 [0195.864] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.865] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.865] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.865] SetEndOfFile (hFile=0x388) returned 1 [0195.865] CloseHandle (hObject=0x388) returned 1 [0195.865] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.865] SetEndOfFile (hFile=0x35c) returned 1 [0195.866] CloseHandle (hObject=0x35c) returned 1 [0195.866] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.866] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json")) returned 1 [0195.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.866] lstrlenW (lpString=".doc") returned 4 [0195.866] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.866] lstrlenW (lpString=".docx") returned 5 [0195.866] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.866] lstrlenW (lpString=".pdf") returned 4 [0195.866] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.866] lstrlenW (lpString=".xls") returned 4 [0195.866] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.866] lstrlenW (lpString=".xlsx") returned 5 [0195.866] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.866] lstrlenW (lpString=".ppt") returned 4 [0195.867] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.867] lstrlenW (lpString=".zip") returned 4 [0195.867] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.867] lstrlenW (lpString=".rar") returned 4 [0195.867] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.867] lstrlenW (lpString=".bz2") returned 4 [0195.867] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.867] lstrlenW (lpString=".7z") returned 3 [0195.867] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.867] lstrlenW (lpString=".dbf") returned 4 [0195.867] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.867] lstrlenW (lpString=".1cd") returned 4 [0195.867] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.867] lstrlenW (lpString=".jpg") returned 4 [0195.867] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.867] lstrlenW (lpString=".doc") returned 4 [0195.867] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.867] lstrlenW (lpString=".docx") returned 5 [0195.867] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.867] lstrlenW (lpString=".pdf") returned 4 [0195.867] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.867] lstrlenW (lpString=".xls") returned 4 [0195.867] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.867] lstrlenW (lpString=".xlsx") returned 5 [0195.867] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.867] lstrlenW (lpString=".ppt") returned 4 [0195.867] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.867] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.868] lstrlenW (lpString=".zip") returned 4 [0195.868] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.868] lstrlenW (lpString=".rar") returned 4 [0195.868] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.868] lstrlenW (lpString=".bz2") returned 4 [0195.868] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.868] lstrlenW (lpString=".7z") returned 3 [0195.868] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.868] lstrlenW (lpString=".dbf") returned 4 [0195.868] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.868] lstrlenW (lpString=".1cd") returned 4 [0195.868] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.868] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ms\\messages.json") returned 151 [0195.868] lstrlenW (lpString=".jpg") returned 4 [0195.868] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.868] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.868] lstrlenW (lpString="messages.json") returned 13 [0195.868] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.869] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=277) returned 1 [0195.869] CloseHandle (hObject=0x35c) returned 1 [0195.869] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json")) returned 0x2020 [0195.869] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.869] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.869] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.869] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.869] GetLastError () returned 0x0 [0195.869] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x115, lpOverlapped=0x0) returned 1 [0195.870] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x120, lpOverlapped=0x0) returned 1 [0195.872] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.872] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.872] SetEndOfFile (hFile=0x388) returned 1 [0195.872] CloseHandle (hObject=0x388) returned 1 [0195.872] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.872] SetEndOfFile (hFile=0x35c) returned 1 [0195.873] CloseHandle (hObject=0x35c) returned 1 [0195.873] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.873] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json")) returned 1 [0195.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.874] lstrlenW (lpString=".doc") returned 4 [0195.874] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.874] lstrlenW (lpString=".docx") returned 5 [0195.874] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.874] lstrlenW (lpString=".pdf") returned 4 [0195.874] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.874] lstrlenW (lpString=".xls") returned 4 [0195.874] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.874] lstrlenW (lpString=".xlsx") returned 5 [0195.874] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.874] lstrlenW (lpString=".ppt") returned 4 [0195.874] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.874] lstrlenW (lpString=".zip") returned 4 [0195.874] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.874] lstrlenW (lpString=".rar") returned 4 [0195.874] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.874] lstrlenW (lpString=".bz2") returned 4 [0195.874] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.874] lstrlenW (lpString=".7z") returned 3 [0195.874] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.874] lstrlenW (lpString=".dbf") returned 4 [0195.874] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.874] lstrlenW (lpString=".1cd") returned 4 [0195.874] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.874] lstrlenW (lpString=".jpg") returned 4 [0195.874] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.875] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.875] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.875] lstrlenW (lpString=".doc") returned 4 [0195.875] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.875] lstrlenW (lpString=".docx") returned 5 [0195.875] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.875] lstrlenW (lpString=".pdf") returned 4 [0195.875] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.875] lstrlenW (lpString=".xls") returned 4 [0195.875] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.875] lstrlenW (lpString=".xlsx") returned 5 [0195.875] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.875] lstrlenW (lpString=".ppt") returned 4 [0195.875] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.875] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.875] lstrlenW (lpString=".zip") returned 4 [0195.875] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.875] lstrlenW (lpString=".rar") returned 4 [0195.875] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.875] lstrlenW (lpString=".bz2") returned 4 [0195.875] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.875] lstrlenW (lpString=".7z") returned 3 [0195.875] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.875] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.875] lstrlenW (lpString=".dbf") returned 4 [0195.875] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.875] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.875] lstrlenW (lpString=".1cd") returned 4 [0195.875] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.875] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\te\\messages.json") returned 151 [0195.875] lstrlenW (lpString=".jpg") returned 4 [0195.875] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.876] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.876] lstrlenW (lpString="messages.json") returned 13 [0195.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.876] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=293) returned 1 [0195.876] CloseHandle (hObject=0x35c) returned 1 [0195.876] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json")) returned 0x2020 [0195.876] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.876] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.876] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.877] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.877] GetLastError () returned 0x0 [0195.877] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x125, lpOverlapped=0x0) returned 1 [0195.878] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x130, lpOverlapped=0x0) returned 1 [0195.879] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.879] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.879] SetEndOfFile (hFile=0x388) returned 1 [0195.879] CloseHandle (hObject=0x388) returned 1 [0195.879] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.879] SetEndOfFile (hFile=0x35c) returned 1 [0195.880] CloseHandle (hObject=0x35c) returned 1 [0195.880] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.880] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json")) returned 1 [0195.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.880] lstrlenW (lpString=".doc") returned 4 [0195.880] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.880] lstrlenW (lpString=".docx") returned 5 [0195.880] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.880] lstrlenW (lpString=".pdf") returned 4 [0195.881] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.881] lstrlenW (lpString=".xls") returned 4 [0195.881] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.881] lstrlenW (lpString=".xlsx") returned 5 [0195.881] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.881] lstrlenW (lpString=".ppt") returned 4 [0195.881] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.881] lstrlenW (lpString=".zip") returned 4 [0195.881] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.881] lstrlenW (lpString=".rar") returned 4 [0195.881] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.881] lstrlenW (lpString=".bz2") returned 4 [0195.881] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.881] lstrlenW (lpString=".7z") returned 3 [0195.881] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.881] lstrlenW (lpString=".dbf") returned 4 [0195.881] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.881] lstrlenW (lpString=".1cd") returned 4 [0195.881] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.881] lstrlenW (lpString=".jpg") returned 4 [0195.881] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.881] lstrlenW (lpString=".doc") returned 4 [0195.881] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.881] lstrlenW (lpString=".docx") returned 5 [0195.881] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.881] lstrlenW (lpString=".pdf") returned 4 [0195.881] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.881] lstrlenW (lpString=".xls") returned 4 [0195.882] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.882] lstrlenW (lpString=".xlsx") returned 5 [0195.882] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.882] lstrlenW (lpString=".ppt") returned 4 [0195.882] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.882] lstrlenW (lpString=".zip") returned 4 [0195.882] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.882] lstrlenW (lpString=".rar") returned 4 [0195.882] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.882] lstrlenW (lpString=".bz2") returned 4 [0195.882] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.882] lstrlenW (lpString=".7z") returned 3 [0195.882] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.882] lstrlenW (lpString=".dbf") returned 4 [0195.882] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.882] lstrlenW (lpString=".1cd") returned 4 [0195.882] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\th\\messages.json") returned 151 [0195.882] lstrlenW (lpString=".jpg") returned 4 [0195.882] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.882] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x4ba0020, Size=0x40000) returned 0x4ba0020 [0195.884] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.884] lstrlenW (lpString="messages.json") returned 13 [0195.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.884] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=205) returned 1 [0195.884] CloseHandle (hObject=0x35c) returned 1 [0195.884] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json")) returned 0x2020 [0195.884] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.885] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.885] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.885] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.885] GetLastError () returned 0x0 [0195.885] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xcd, lpOverlapped=0x0) returned 1 [0195.886] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.887] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.887] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.887] SetEndOfFile (hFile=0x388) returned 1 [0195.887] CloseHandle (hObject=0x388) returned 1 [0195.887] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.888] SetEndOfFile (hFile=0x35c) returned 1 [0195.888] CloseHandle (hObject=0x35c) returned 1 [0195.888] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.888] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json")) returned 1 [0195.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.889] lstrlenW (lpString=".doc") returned 4 [0195.889] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.889] lstrlenW (lpString=".docx") returned 5 [0195.889] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.889] lstrlenW (lpString=".pdf") returned 4 [0195.889] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.889] lstrlenW (lpString=".xls") returned 4 [0195.889] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.889] lstrlenW (lpString=".xlsx") returned 5 [0195.889] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.889] lstrlenW (lpString=".ppt") returned 4 [0195.889] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.889] lstrlenW (lpString=".zip") returned 4 [0195.889] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.889] lstrlenW (lpString=".rar") returned 4 [0195.889] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.889] lstrlenW (lpString=".bz2") returned 4 [0195.889] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.889] lstrlenW (lpString=".7z") returned 3 [0195.889] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.889] lstrlenW (lpString=".dbf") returned 4 [0195.889] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.889] lstrlenW (lpString=".1cd") returned 4 [0195.889] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.889] lstrlenW (lpString=".jpg") returned 4 [0195.889] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.890] lstrlenW (lpString=".doc") returned 4 [0195.890] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.890] lstrlenW (lpString=".docx") returned 5 [0195.890] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.890] lstrlenW (lpString=".pdf") returned 4 [0195.890] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.890] lstrlenW (lpString=".xls") returned 4 [0195.890] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.890] lstrlenW (lpString=".xlsx") returned 5 [0195.890] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.890] lstrlenW (lpString=".ppt") returned 4 [0195.890] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.890] lstrlenW (lpString=".zip") returned 4 [0195.890] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.890] lstrlenW (lpString=".rar") returned 4 [0195.890] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.890] lstrlenW (lpString=".bz2") returned 4 [0195.890] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.890] lstrlenW (lpString=".7z") returned 3 [0195.890] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.890] lstrlenW (lpString=".dbf") returned 4 [0195.890] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.890] lstrlenW (lpString=".1cd") returned 4 [0195.890] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\tr\\messages.json") returned 151 [0195.890] lstrlenW (lpString=".jpg") returned 4 [0195.890] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.891] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.891] lstrlenW (lpString="messages.json") returned 13 [0195.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.891] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=277) returned 1 [0195.891] CloseHandle (hObject=0x35c) returned 1 [0195.891] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json")) returned 0x2020 [0195.891] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.891] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.892] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.892] GetLastError () returned 0x0 [0195.892] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x115, lpOverlapped=0x0) returned 1 [0195.893] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x120, lpOverlapped=0x0) returned 1 [0195.894] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0195.894] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.894] SetEndOfFile (hFile=0x388) returned 1 [0195.894] CloseHandle (hObject=0x388) returned 1 [0195.894] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.894] SetEndOfFile (hFile=0x35c) returned 1 [0195.895] CloseHandle (hObject=0x35c) returned 1 [0195.895] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.895] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json")) returned 1 [0195.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.896] lstrlenW (lpString=".doc") returned 4 [0195.896] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.896] lstrlenW (lpString=".docx") returned 5 [0195.896] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.896] lstrlenW (lpString=".pdf") returned 4 [0195.896] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.896] lstrlenW (lpString=".xls") returned 4 [0195.896] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.896] lstrlenW (lpString=".xlsx") returned 5 [0195.896] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.896] lstrlenW (lpString=".ppt") returned 4 [0195.896] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.896] lstrlenW (lpString=".zip") returned 4 [0195.896] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.896] lstrlenW (lpString=".rar") returned 4 [0195.896] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.896] lstrlenW (lpString=".bz2") returned 4 [0195.896] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.896] lstrlenW (lpString=".7z") returned 3 [0195.896] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.896] lstrlenW (lpString=".dbf") returned 4 [0195.896] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.896] lstrlenW (lpString=".1cd") returned 4 [0195.896] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.896] lstrlenW (lpString=".jpg") returned 4 [0195.896] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.896] lstrlenW (lpString=".doc") returned 4 [0195.896] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.897] lstrlenW (lpString=".docx") returned 5 [0195.897] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.897] lstrlenW (lpString=".pdf") returned 4 [0195.897] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.897] lstrlenW (lpString=".xls") returned 4 [0195.897] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.897] lstrlenW (lpString=".xlsx") returned 5 [0195.897] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.897] lstrlenW (lpString=".ppt") returned 4 [0195.897] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.897] lstrlenW (lpString=".zip") returned 4 [0195.897] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.897] lstrlenW (lpString=".rar") returned 4 [0195.897] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.897] lstrlenW (lpString=".bz2") returned 4 [0195.897] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.897] lstrlenW (lpString=".7z") returned 3 [0195.897] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.897] lstrlenW (lpString=".dbf") returned 4 [0195.897] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.897] lstrlenW (lpString=".1cd") returned 4 [0195.897] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\uk\\messages.json") returned 151 [0195.897] lstrlenW (lpString=".jpg") returned 4 [0195.897] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.897] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.897] lstrlenW (lpString="messages.json") returned 13 [0195.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.898] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=375) returned 1 [0195.898] CloseHandle (hObject=0x35c) returned 1 [0195.898] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 0x2020 [0195.898] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.898] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.898] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0195.898] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.899] GetLastError () returned 0x0 [0195.899] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x177, lpOverlapped=0x0) returned 1 [0196.027] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x180, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x180, lpOverlapped=0x0) returned 1 [0196.028] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.028] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.028] SetEndOfFile (hFile=0x388) returned 1 [0196.028] CloseHandle (hObject=0x388) returned 1 [0196.029] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.029] SetEndOfFile (hFile=0x35c) returned 1 [0196.029] CloseHandle (hObject=0x35c) returned 1 [0196.029] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.029] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json")) returned 1 [0196.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.030] lstrlenW (lpString=".doc") returned 4 [0196.030] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.030] lstrlenW (lpString=".docx") returned 5 [0196.030] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.030] lstrlenW (lpString=".pdf") returned 4 [0196.030] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.030] lstrlenW (lpString=".xls") returned 4 [0196.030] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.030] lstrlenW (lpString=".xlsx") returned 5 [0196.030] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.030] lstrlenW (lpString=".ppt") returned 4 [0196.030] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.030] lstrlenW (lpString=".zip") returned 4 [0196.030] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.030] lstrlenW (lpString=".rar") returned 4 [0196.030] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.030] lstrlenW (lpString=".bz2") returned 4 [0196.030] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.030] lstrlenW (lpString=".7z") returned 3 [0196.030] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.030] lstrlenW (lpString=".dbf") returned 4 [0196.030] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.030] lstrlenW (lpString=".1cd") returned 4 [0196.030] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.031] lstrlenW (lpString=".jpg") returned 4 [0196.031] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.031] lstrlenW (lpString=".doc") returned 4 [0196.031] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.031] lstrlenW (lpString=".docx") returned 5 [0196.031] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.031] lstrlenW (lpString=".pdf") returned 4 [0196.031] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.031] lstrlenW (lpString=".xls") returned 4 [0196.031] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.031] lstrlenW (lpString=".xlsx") returned 5 [0196.031] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.031] lstrlenW (lpString=".ppt") returned 4 [0196.031] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.031] lstrlenW (lpString=".zip") returned 4 [0196.031] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.031] lstrlenW (lpString=".rar") returned 4 [0196.031] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.031] lstrlenW (lpString=".bz2") returned 4 [0196.031] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.031] lstrlenW (lpString=".7z") returned 3 [0196.031] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.031] lstrlenW (lpString=".dbf") returned 4 [0196.031] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.031] lstrlenW (lpString=".1cd") returned 4 [0196.031] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ur\\messages.json") returned 151 [0196.031] lstrlenW (lpString=".jpg") returned 4 [0196.031] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.032] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0196.032] lstrlenW (lpString="craw_background.js") returned 18 [0196.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.032] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=207406) returned 1 [0196.032] CloseHandle (hObject=0x35c) returned 1 [0196.032] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 0x2020 [0196.032] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.033] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.033] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.033] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.033] GetLastError () returned 0x0 [0196.033] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x32a2e, lpOverlapped=0x0) returned 1 [0196.041] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x32a30, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x32a30, lpOverlapped=0x0) returned 1 [0196.045] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.045] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf8, lpOverlapped=0x0) returned 1 [0196.045] SetEndOfFile (hFile=0x388) returned 1 [0196.046] CloseHandle (hObject=0x388) returned 1 [0196.046] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.046] SetEndOfFile (hFile=0x35c) returned 1 [0196.047] CloseHandle (hObject=0x35c) returned 1 [0196.048] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.048] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js")) returned 1 [0196.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.048] lstrlenW (lpString=".doc") returned 4 [0196.048] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0196.048] lstrlenW (lpString=".docx") returned 5 [0196.048] lstrcmpiW (lpString1=".docx", lpString2="nd.js") returned -1 [0196.048] lstrlenW (lpString=".pdf") returned 4 [0196.048] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0196.048] lstrlenW (lpString=".xls") returned 4 [0196.048] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0196.048] lstrlenW (lpString=".xlsx") returned 5 [0196.048] lstrcmpiW (lpString1=".xlsx", lpString2="nd.js") returned -1 [0196.048] lstrlenW (lpString=".ppt") returned 4 [0196.048] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0196.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.048] lstrlenW (lpString=".zip") returned 4 [0196.048] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0196.048] lstrlenW (lpString=".rar") returned 4 [0196.048] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0196.048] lstrlenW (lpString=".bz2") returned 4 [0196.049] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0196.049] lstrlenW (lpString=".7z") returned 3 [0196.049] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0196.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.049] lstrlenW (lpString=".dbf") returned 4 [0196.049] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0196.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.049] lstrlenW (lpString=".1cd") returned 4 [0196.049] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0196.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.049] lstrlenW (lpString=".jpg") returned 4 [0196.049] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0196.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.049] lstrlenW (lpString=".doc") returned 4 [0196.049] lstrcmpiW (lpString1=".doc", lpString2="d.js") returned -1 [0196.049] lstrlenW (lpString=".docx") returned 5 [0196.049] lstrcmpiW (lpString1=".docx", lpString2="nd.js") returned -1 [0196.049] lstrlenW (lpString=".pdf") returned 4 [0196.049] lstrcmpiW (lpString1=".pdf", lpString2="d.js") returned -1 [0196.049] lstrlenW (lpString=".xls") returned 4 [0196.049] lstrcmpiW (lpString1=".xls", lpString2="d.js") returned -1 [0196.049] lstrlenW (lpString=".xlsx") returned 5 [0196.049] lstrcmpiW (lpString1=".xlsx", lpString2="nd.js") returned -1 [0196.049] lstrlenW (lpString=".ppt") returned 4 [0196.049] lstrcmpiW (lpString1=".ppt", lpString2="d.js") returned -1 [0196.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.049] lstrlenW (lpString=".zip") returned 4 [0196.049] lstrcmpiW (lpString1=".zip", lpString2="d.js") returned -1 [0196.049] lstrlenW (lpString=".rar") returned 4 [0196.049] lstrcmpiW (lpString1=".rar", lpString2="d.js") returned -1 [0196.049] lstrlenW (lpString=".bz2") returned 4 [0196.049] lstrcmpiW (lpString1=".bz2", lpString2="d.js") returned -1 [0196.050] lstrlenW (lpString=".7z") returned 3 [0196.050] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0196.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.050] lstrlenW (lpString=".dbf") returned 4 [0196.050] lstrcmpiW (lpString1=".dbf", lpString2="d.js") returned -1 [0196.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.050] lstrlenW (lpString=".1cd") returned 4 [0196.050] lstrcmpiW (lpString1=".1cd", lpString2="d.js") returned -1 [0196.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_background.js") returned 148 [0196.050] lstrlenW (lpString=".jpg") returned 4 [0196.050] lstrcmpiW (lpString1=".jpg", lpString2="d.js") returned -1 [0196.050] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0196.050] lstrlenW (lpString="craw_window.js") returned 14 [0196.050] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.051] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=241753) returned 1 [0196.051] CloseHandle (hObject=0x35c) returned 1 [0196.051] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 0x2020 [0196.051] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.051] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.051] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.051] GetLastError () returned 0x0 [0196.052] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x3b059, lpOverlapped=0x0) returned 1 [0196.059] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3b060, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3b060, lpOverlapped=0x0) returned 1 [0196.063] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.063] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0196.063] SetEndOfFile (hFile=0x388) returned 1 [0196.063] CloseHandle (hObject=0x388) returned 1 [0196.063] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.063] SetEndOfFile (hFile=0x35c) returned 1 [0196.065] CloseHandle (hObject=0x35c) returned 1 [0196.065] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.065] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js")) returned 1 [0196.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.065] lstrlenW (lpString=".doc") returned 4 [0196.066] lstrcmpiW (lpString1=".doc", lpString2="w.js") returned -1 [0196.066] lstrlenW (lpString=".docx") returned 5 [0196.066] lstrcmpiW (lpString1=".docx", lpString2="ow.js") returned -1 [0196.066] lstrlenW (lpString=".pdf") returned 4 [0196.066] lstrcmpiW (lpString1=".pdf", lpString2="w.js") returned -1 [0196.066] lstrlenW (lpString=".xls") returned 4 [0196.066] lstrcmpiW (lpString1=".xls", lpString2="w.js") returned -1 [0196.066] lstrlenW (lpString=".xlsx") returned 5 [0196.066] lstrcmpiW (lpString1=".xlsx", lpString2="ow.js") returned -1 [0196.066] lstrlenW (lpString=".ppt") returned 4 [0196.066] lstrcmpiW (lpString1=".ppt", lpString2="w.js") returned -1 [0196.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.066] lstrlenW (lpString=".zip") returned 4 [0196.066] lstrcmpiW (lpString1=".zip", lpString2="w.js") returned -1 [0196.066] lstrlenW (lpString=".rar") returned 4 [0196.066] lstrcmpiW (lpString1=".rar", lpString2="w.js") returned -1 [0196.066] lstrlenW (lpString=".bz2") returned 4 [0196.066] lstrcmpiW (lpString1=".bz2", lpString2="w.js") returned -1 [0196.066] lstrlenW (lpString=".7z") returned 3 [0196.066] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0196.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.066] lstrlenW (lpString=".dbf") returned 4 [0196.066] lstrcmpiW (lpString1=".dbf", lpString2="w.js") returned -1 [0196.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.066] lstrlenW (lpString=".1cd") returned 4 [0196.066] lstrcmpiW (lpString1=".1cd", lpString2="w.js") returned -1 [0196.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.066] lstrlenW (lpString=".jpg") returned 4 [0196.066] lstrcmpiW (lpString1=".jpg", lpString2="w.js") returned -1 [0196.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.066] lstrlenW (lpString=".doc") returned 4 [0196.067] lstrcmpiW (lpString1=".doc", lpString2="w.js") returned -1 [0196.067] lstrlenW (lpString=".docx") returned 5 [0196.067] lstrcmpiW (lpString1=".docx", lpString2="ow.js") returned -1 [0196.067] lstrlenW (lpString=".pdf") returned 4 [0196.067] lstrcmpiW (lpString1=".pdf", lpString2="w.js") returned -1 [0196.067] lstrlenW (lpString=".xls") returned 4 [0196.067] lstrcmpiW (lpString1=".xls", lpString2="w.js") returned -1 [0196.067] lstrlenW (lpString=".xlsx") returned 5 [0196.067] lstrcmpiW (lpString1=".xlsx", lpString2="ow.js") returned -1 [0196.067] lstrlenW (lpString=".ppt") returned 4 [0196.067] lstrcmpiW (lpString1=".ppt", lpString2="w.js") returned -1 [0196.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.067] lstrlenW (lpString=".zip") returned 4 [0196.067] lstrcmpiW (lpString1=".zip", lpString2="w.js") returned -1 [0196.067] lstrlenW (lpString=".rar") returned 4 [0196.067] lstrcmpiW (lpString1=".rar", lpString2="w.js") returned -1 [0196.067] lstrlenW (lpString=".bz2") returned 4 [0196.067] lstrcmpiW (lpString1=".bz2", lpString2="w.js") returned -1 [0196.067] lstrlenW (lpString=".7z") returned 3 [0196.067] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0196.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.067] lstrlenW (lpString=".dbf") returned 4 [0196.067] lstrcmpiW (lpString1=".dbf", lpString2="w.js") returned -1 [0196.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.067] lstrlenW (lpString=".1cd") returned 4 [0196.067] lstrcmpiW (lpString1=".1cd", lpString2="w.js") returned -1 [0196.067] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\craw_window.js") returned 144 [0196.067] lstrlenW (lpString=".jpg") returned 4 [0196.067] lstrcmpiW (lpString1=".jpg", lpString2="w.js") returned -1 [0196.067] lstrcmpiW (lpString1=".css", lpString2=".wiki") returned -1 [0196.068] lstrlenW (lpString="craw_window.css") returned 15 [0196.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.068] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1741) returned 1 [0196.068] CloseHandle (hObject=0x35c) returned 1 [0196.068] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 0x2020 [0196.068] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.068] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.069] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.069] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.069] GetLastError () returned 0x0 [0196.069] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x6cd, lpOverlapped=0x0) returned 1 [0196.141] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0196.142] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.142] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf2, lpOverlapped=0x0) returned 1 [0196.142] SetEndOfFile (hFile=0x388) returned 1 [0196.142] CloseHandle (hObject=0x388) returned 1 [0196.142] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.143] SetEndOfFile (hFile=0x35c) returned 1 [0196.144] CloseHandle (hObject=0x35c) returned 1 [0196.144] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.144] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css")) returned 1 [0196.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.145] lstrlenW (lpString=".doc") returned 4 [0196.145] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0196.145] lstrlenW (lpString=".docx") returned 5 [0196.145] lstrcmpiW (lpString1=".docx", lpString2="w.css") returned -1 [0196.145] lstrlenW (lpString=".pdf") returned 4 [0196.145] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0196.145] lstrlenW (lpString=".xls") returned 4 [0196.145] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0196.145] lstrlenW (lpString=".xlsx") returned 5 [0196.145] lstrcmpiW (lpString1=".xlsx", lpString2="w.css") returned -1 [0196.145] lstrlenW (lpString=".ppt") returned 4 [0196.145] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0196.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.145] lstrlenW (lpString=".zip") returned 4 [0196.145] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0196.145] lstrlenW (lpString=".rar") returned 4 [0196.145] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0196.145] lstrlenW (lpString=".bz2") returned 4 [0196.145] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0196.145] lstrlenW (lpString=".7z") returned 3 [0196.145] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0196.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.145] lstrlenW (lpString=".dbf") returned 4 [0196.145] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0196.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.145] lstrlenW (lpString=".1cd") returned 4 [0196.145] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0196.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.145] lstrlenW (lpString=".jpg") returned 4 [0196.145] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0196.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.146] lstrlenW (lpString=".doc") returned 4 [0196.146] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0196.146] lstrlenW (lpString=".docx") returned 5 [0196.146] lstrcmpiW (lpString1=".docx", lpString2="w.css") returned -1 [0196.146] lstrlenW (lpString=".pdf") returned 4 [0196.146] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0196.146] lstrlenW (lpString=".xls") returned 4 [0196.146] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0196.146] lstrlenW (lpString=".xlsx") returned 5 [0196.146] lstrcmpiW (lpString1=".xlsx", lpString2="w.css") returned -1 [0196.146] lstrlenW (lpString=".ppt") returned 4 [0196.146] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0196.146] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.146] lstrlenW (lpString=".zip") returned 4 [0196.146] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0196.146] lstrlenW (lpString=".rar") returned 4 [0196.146] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0196.146] lstrlenW (lpString=".bz2") returned 4 [0196.146] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0196.146] lstrlenW (lpString=".7z") returned 3 [0196.146] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0196.146] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.146] lstrlenW (lpString=".dbf") returned 4 [0196.146] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0196.146] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.146] lstrlenW (lpString=".1cd") returned 4 [0196.146] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0196.146] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\css\\craw_window.css") returned 149 [0196.146] lstrlenW (lpString=".jpg") returned 4 [0196.146] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0196.147] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0196.147] lstrlenW (lpString="topbar_floating_button_close.png") returned 32 [0196.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.147] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=252) returned 1 [0196.147] CloseHandle (hObject=0x35c) returned 1 [0196.147] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 0x2020 [0196.147] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.147] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.148] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.148] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.148] GetLastError () returned 0x0 [0196.148] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xfc, lpOverlapped=0x0) returned 1 [0196.149] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x100, lpOverlapped=0x0) returned 1 [0196.150] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.150] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x114, lpOverlapped=0x0) returned 1 [0196.150] SetEndOfFile (hFile=0x388) returned 1 [0196.150] CloseHandle (hObject=0x388) returned 1 [0196.150] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.150] SetEndOfFile (hFile=0x35c) returned 1 [0196.151] CloseHandle (hObject=0x35c) returned 1 [0196.151] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.152] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png")) returned 1 [0196.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.152] lstrlenW (lpString=".doc") returned 4 [0196.152] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.152] lstrlenW (lpString=".docx") returned 5 [0196.152] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0196.152] lstrlenW (lpString=".pdf") returned 4 [0196.152] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.152] lstrlenW (lpString=".xls") returned 4 [0196.152] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.152] lstrlenW (lpString=".xlsx") returned 5 [0196.152] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0196.152] lstrlenW (lpString=".ppt") returned 4 [0196.152] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.152] lstrlenW (lpString=".zip") returned 4 [0196.152] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.152] lstrlenW (lpString=".rar") returned 4 [0196.152] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.152] lstrlenW (lpString=".bz2") returned 4 [0196.152] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.152] lstrlenW (lpString=".7z") returned 3 [0196.152] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.153] lstrlenW (lpString=".dbf") returned 4 [0196.153] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.153] lstrlenW (lpString=".1cd") returned 4 [0196.153] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.153] lstrlenW (lpString=".jpg") returned 4 [0196.153] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.153] lstrlenW (lpString=".doc") returned 4 [0196.153] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.153] lstrlenW (lpString=".docx") returned 5 [0196.153] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0196.153] lstrlenW (lpString=".pdf") returned 4 [0196.153] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.153] lstrlenW (lpString=".xls") returned 4 [0196.153] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.153] lstrlenW (lpString=".xlsx") returned 5 [0196.153] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0196.153] lstrlenW (lpString=".ppt") returned 4 [0196.153] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.153] lstrlenW (lpString=".zip") returned 4 [0196.153] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.153] lstrlenW (lpString=".rar") returned 4 [0196.153] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.153] lstrlenW (lpString=".bz2") returned 4 [0196.153] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.153] lstrlenW (lpString=".7z") returned 3 [0196.153] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.154] lstrlenW (lpString=".dbf") returned 4 [0196.154] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.154] lstrlenW (lpString=".1cd") returned 4 [0196.154] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.154] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_close.png") returned 169 [0196.154] lstrlenW (lpString=".jpg") returned 4 [0196.154] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.154] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0196.154] lstrlenW (lpString="topbar_floating_button_hover.png") returned 32 [0196.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.154] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=160) returned 1 [0196.154] CloseHandle (hObject=0x35c) returned 1 [0196.155] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 0x2020 [0196.155] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.155] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.155] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.155] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.155] GetLastError () returned 0x0 [0196.155] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xa0, lpOverlapped=0x0) returned 1 [0196.156] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xb0, lpOverlapped=0x0) returned 1 [0196.157] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.157] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x114, lpOverlapped=0x0) returned 1 [0196.157] SetEndOfFile (hFile=0x388) returned 1 [0196.157] CloseHandle (hObject=0x388) returned 1 [0196.158] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.158] SetEndOfFile (hFile=0x35c) returned 1 [0196.158] CloseHandle (hObject=0x35c) returned 1 [0196.158] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.158] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png")) returned 1 [0196.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.159] lstrlenW (lpString=".doc") returned 4 [0196.159] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.159] lstrlenW (lpString=".docx") returned 5 [0196.159] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0196.159] lstrlenW (lpString=".pdf") returned 4 [0196.159] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.159] lstrlenW (lpString=".xls") returned 4 [0196.159] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.159] lstrlenW (lpString=".xlsx") returned 5 [0196.159] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0196.159] lstrlenW (lpString=".ppt") returned 4 [0196.159] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.159] lstrlenW (lpString=".zip") returned 4 [0196.159] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.159] lstrlenW (lpString=".rar") returned 4 [0196.159] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.159] lstrlenW (lpString=".bz2") returned 4 [0196.159] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.159] lstrlenW (lpString=".7z") returned 3 [0196.159] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.159] lstrlenW (lpString=".dbf") returned 4 [0196.159] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.160] lstrlenW (lpString=".1cd") returned 4 [0196.160] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.160] lstrlenW (lpString=".jpg") returned 4 [0196.160] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.160] lstrlenW (lpString=".doc") returned 4 [0196.160] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.160] lstrlenW (lpString=".docx") returned 5 [0196.160] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0196.160] lstrlenW (lpString=".pdf") returned 4 [0196.160] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.160] lstrlenW (lpString=".xls") returned 4 [0196.160] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.160] lstrlenW (lpString=".xlsx") returned 5 [0196.160] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0196.160] lstrlenW (lpString=".ppt") returned 4 [0196.160] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.160] lstrlenW (lpString=".zip") returned 4 [0196.160] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.160] lstrlenW (lpString=".rar") returned 4 [0196.160] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.160] lstrlenW (lpString=".bz2") returned 4 [0196.160] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.160] lstrlenW (lpString=".7z") returned 3 [0196.160] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.160] lstrlenW (lpString=".dbf") returned 4 [0196.160] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.160] lstrlenW (lpString=".1cd") returned 4 [0196.161] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_hover.png") returned 169 [0196.161] lstrlenW (lpString=".jpg") returned 4 [0196.161] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.161] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0196.161] lstrlenW (lpString="topbar_floating_button_maximize.png") returned 35 [0196.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.161] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=166) returned 1 [0196.161] CloseHandle (hObject=0x35c) returned 1 [0196.161] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 0x2020 [0196.162] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.162] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.162] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.162] GetLastError () returned 0x0 [0196.162] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xa6, lpOverlapped=0x0) returned 1 [0196.163] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xb0, lpOverlapped=0x0) returned 1 [0196.165] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.165] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x11a, lpOverlapped=0x0) returned 1 [0196.165] SetEndOfFile (hFile=0x388) returned 1 [0196.165] CloseHandle (hObject=0x388) returned 1 [0196.166] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.166] SetEndOfFile (hFile=0x35c) returned 1 [0196.166] CloseHandle (hObject=0x35c) returned 1 [0196.167] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.167] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png")) returned 1 [0196.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.167] lstrlenW (lpString=".doc") returned 4 [0196.167] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.167] lstrlenW (lpString=".docx") returned 5 [0196.167] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0196.167] lstrlenW (lpString=".pdf") returned 4 [0196.167] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.167] lstrlenW (lpString=".xls") returned 4 [0196.167] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.167] lstrlenW (lpString=".xlsx") returned 5 [0196.167] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0196.167] lstrlenW (lpString=".ppt") returned 4 [0196.167] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.167] lstrlenW (lpString=".zip") returned 4 [0196.167] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.167] lstrlenW (lpString=".rar") returned 4 [0196.167] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.168] lstrlenW (lpString=".bz2") returned 4 [0196.168] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.168] lstrlenW (lpString=".7z") returned 3 [0196.168] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.168] lstrlenW (lpString=".dbf") returned 4 [0196.168] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.168] lstrlenW (lpString=".1cd") returned 4 [0196.168] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.168] lstrlenW (lpString=".jpg") returned 4 [0196.168] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.168] lstrlenW (lpString=".doc") returned 4 [0196.168] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.168] lstrlenW (lpString=".docx") returned 5 [0196.168] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0196.168] lstrlenW (lpString=".pdf") returned 4 [0196.168] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.168] lstrlenW (lpString=".xls") returned 4 [0196.168] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.168] lstrlenW (lpString=".xlsx") returned 5 [0196.168] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0196.168] lstrlenW (lpString=".ppt") returned 4 [0196.168] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.168] lstrlenW (lpString=".zip") returned 4 [0196.168] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.168] lstrlenW (lpString=".rar") returned 4 [0196.168] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.168] lstrlenW (lpString=".bz2") returned 4 [0196.169] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.169] lstrlenW (lpString=".7z") returned 3 [0196.169] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.169] lstrlenW (lpString=".dbf") returned 4 [0196.169] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.169] lstrlenW (lpString=".1cd") returned 4 [0196.169] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_maximize.png") returned 172 [0196.169] lstrlenW (lpString=".jpg") returned 4 [0196.169] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.169] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0196.169] lstrlenW (lpString="topbar_floating_button_pressed.png") returned 34 [0196.169] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.169] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=160) returned 1 [0196.169] CloseHandle (hObject=0x35c) returned 1 [0196.170] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 0x2020 [0196.170] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.170] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.170] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.170] GetLastError () returned 0x0 [0196.170] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xa0, lpOverlapped=0x0) returned 1 [0196.171] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xb0, lpOverlapped=0x0) returned 1 [0196.172] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.172] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x118, lpOverlapped=0x0) returned 1 [0196.172] SetEndOfFile (hFile=0x388) returned 1 [0196.173] CloseHandle (hObject=0x388) returned 1 [0196.173] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.173] SetEndOfFile (hFile=0x35c) returned 1 [0196.173] CloseHandle (hObject=0x35c) returned 1 [0196.173] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.174] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png")) returned 1 [0196.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.174] lstrlenW (lpString=".doc") returned 4 [0196.174] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.174] lstrlenW (lpString=".docx") returned 5 [0196.174] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0196.174] lstrlenW (lpString=".pdf") returned 4 [0196.174] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.174] lstrlenW (lpString=".xls") returned 4 [0196.174] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.174] lstrlenW (lpString=".xlsx") returned 5 [0196.174] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0196.174] lstrlenW (lpString=".ppt") returned 4 [0196.174] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.174] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.174] lstrlenW (lpString=".zip") returned 4 [0196.174] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.174] lstrlenW (lpString=".rar") returned 4 [0196.174] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.174] lstrlenW (lpString=".bz2") returned 4 [0196.175] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.175] lstrlenW (lpString=".7z") returned 3 [0196.175] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.175] lstrlenW (lpString=".dbf") returned 4 [0196.175] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.175] lstrlenW (lpString=".1cd") returned 4 [0196.175] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.175] lstrlenW (lpString=".jpg") returned 4 [0196.175] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.175] lstrlenW (lpString=".doc") returned 4 [0196.175] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0196.175] lstrlenW (lpString=".docx") returned 5 [0196.175] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0196.175] lstrlenW (lpString=".pdf") returned 4 [0196.175] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0196.175] lstrlenW (lpString=".xls") returned 4 [0196.175] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0196.175] lstrlenW (lpString=".xlsx") returned 5 [0196.175] lstrcmpiW (lpString1=".xlsx", lpString2="d.png") returned -1 [0196.175] lstrlenW (lpString=".ppt") returned 4 [0196.175] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0196.175] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.175] lstrlenW (lpString=".zip") returned 4 [0196.175] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0196.175] lstrlenW (lpString=".rar") returned 4 [0196.175] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0196.175] lstrlenW (lpString=".bz2") returned 4 [0196.175] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0196.176] lstrlenW (lpString=".7z") returned 3 [0196.176] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0196.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.176] lstrlenW (lpString=".dbf") returned 4 [0196.176] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0196.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.176] lstrlenW (lpString=".1cd") returned 4 [0196.176] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0196.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\images\\topbar_floating_button_pressed.png") returned 171 [0196.176] lstrlenW (lpString=".jpg") returned 4 [0196.176] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0196.176] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.176] lstrlenW (lpString="manifest.json") returned 13 [0196.176] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.176] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1322) returned 1 [0196.176] CloseHandle (hObject=0x35c) returned 1 [0196.177] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json")) returned 0x2020 [0196.177] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.177] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.177] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.177] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.177] GetLastError () returned 0x0 [0196.177] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x52a, lpOverlapped=0x0) returned 1 [0196.386] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x530, lpOverlapped=0x0) returned 1 [0196.387] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.387] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.387] SetEndOfFile (hFile=0x388) returned 1 [0196.387] CloseHandle (hObject=0x388) returned 1 [0196.387] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.387] SetEndOfFile (hFile=0x35c) returned 1 [0196.388] CloseHandle (hObject=0x35c) returned 1 [0196.388] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.388] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json")) returned 1 [0196.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.389] lstrlenW (lpString=".doc") returned 4 [0196.389] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.389] lstrlenW (lpString=".docx") returned 5 [0196.389] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.389] lstrlenW (lpString=".pdf") returned 4 [0196.389] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.389] lstrlenW (lpString=".xls") returned 4 [0196.389] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.389] lstrlenW (lpString=".xlsx") returned 5 [0196.389] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.389] lstrlenW (lpString=".ppt") returned 4 [0196.389] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.389] lstrlenW (lpString=".zip") returned 4 [0196.389] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.389] lstrlenW (lpString=".rar") returned 4 [0196.389] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.389] lstrlenW (lpString=".bz2") returned 4 [0196.389] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.389] lstrlenW (lpString=".7z") returned 3 [0196.389] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.389] lstrlenW (lpString=".dbf") returned 4 [0196.389] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.389] lstrlenW (lpString=".1cd") returned 4 [0196.389] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.389] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.389] lstrlenW (lpString=".jpg") returned 4 [0196.389] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.390] lstrlenW (lpString=".doc") returned 4 [0196.390] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.390] lstrlenW (lpString=".docx") returned 5 [0196.390] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.390] lstrlenW (lpString=".pdf") returned 4 [0196.390] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.390] lstrlenW (lpString=".xls") returned 4 [0196.390] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.390] lstrlenW (lpString=".xlsx") returned 5 [0196.390] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.390] lstrlenW (lpString=".ppt") returned 4 [0196.390] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.390] lstrlenW (lpString=".zip") returned 4 [0196.390] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.390] lstrlenW (lpString=".rar") returned 4 [0196.390] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.390] lstrlenW (lpString=".bz2") returned 4 [0196.390] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.390] lstrlenW (lpString=".7z") returned 3 [0196.390] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.390] lstrlenW (lpString=".dbf") returned 4 [0196.390] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.390] lstrlenW (lpString=".1cd") returned 4 [0196.390] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.390] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\manifest.json") returned 143 [0196.390] lstrlenW (lpString=".jpg") returned 4 [0196.390] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.391] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.391] lstrlenW (lpString="messages.json") returned 13 [0196.391] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.391] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=941) returned 1 [0196.391] CloseHandle (hObject=0x35c) returned 1 [0196.391] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json")) returned 0x2020 [0196.391] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.392] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.392] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.392] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.392] GetLastError () returned 0x0 [0196.392] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x3ad, lpOverlapped=0x0) returned 1 [0196.394] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0196.395] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.395] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.395] SetEndOfFile (hFile=0x388) returned 1 [0196.395] CloseHandle (hObject=0x388) returned 1 [0196.395] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.395] SetEndOfFile (hFile=0x35c) returned 1 [0196.396] CloseHandle (hObject=0x35c) returned 1 [0196.396] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.396] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json")) returned 1 [0196.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.396] lstrlenW (lpString=".doc") returned 4 [0196.396] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.396] lstrlenW (lpString=".docx") returned 5 [0196.396] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.396] lstrlenW (lpString=".pdf") returned 4 [0196.397] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.397] lstrlenW (lpString=".xls") returned 4 [0196.397] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.397] lstrlenW (lpString=".xlsx") returned 5 [0196.397] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.397] lstrlenW (lpString=".ppt") returned 4 [0196.397] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.397] lstrlenW (lpString=".zip") returned 4 [0196.397] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.397] lstrlenW (lpString=".rar") returned 4 [0196.397] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.397] lstrlenW (lpString=".bz2") returned 4 [0196.397] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.397] lstrlenW (lpString=".7z") returned 3 [0196.397] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.397] lstrlenW (lpString=".dbf") returned 4 [0196.397] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.397] lstrlenW (lpString=".1cd") returned 4 [0196.397] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.397] lstrlenW (lpString=".jpg") returned 4 [0196.397] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.397] lstrlenW (lpString=".doc") returned 4 [0196.397] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.397] lstrlenW (lpString=".docx") returned 5 [0196.397] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.397] lstrlenW (lpString=".pdf") returned 4 [0196.397] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.397] lstrlenW (lpString=".xls") returned 4 [0196.398] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.398] lstrlenW (lpString=".xlsx") returned 5 [0196.398] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.398] lstrlenW (lpString=".ppt") returned 4 [0196.398] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.398] lstrlenW (lpString=".zip") returned 4 [0196.398] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.398] lstrlenW (lpString=".rar") returned 4 [0196.398] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.398] lstrlenW (lpString=".bz2") returned 4 [0196.398] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.398] lstrlenW (lpString=".7z") returned 3 [0196.398] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.398] lstrlenW (lpString=".dbf") returned 4 [0196.398] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.398] lstrlenW (lpString=".1cd") returned 4 [0196.398] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hi\\messages.json") returned 155 [0196.398] lstrlenW (lpString=".jpg") returned 4 [0196.398] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.398] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.398] lstrlenW (lpString="messages.json") returned 13 [0196.398] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.399] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=633) returned 1 [0196.399] CloseHandle (hObject=0x35c) returned 1 [0196.399] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json")) returned 0x2020 [0196.399] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.399] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.399] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.400] GetLastError () returned 0x0 [0196.400] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x279, lpOverlapped=0x0) returned 1 [0196.401] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x280, lpOverlapped=0x0) returned 1 [0196.402] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.402] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.402] SetEndOfFile (hFile=0x388) returned 1 [0196.402] CloseHandle (hObject=0x388) returned 1 [0196.402] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.402] SetEndOfFile (hFile=0x35c) returned 1 [0196.403] CloseHandle (hObject=0x35c) returned 1 [0196.403] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.403] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json")) returned 1 [0196.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.403] lstrlenW (lpString=".doc") returned 4 [0196.404] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.404] lstrlenW (lpString=".docx") returned 5 [0196.404] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.404] lstrlenW (lpString=".pdf") returned 4 [0196.404] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.404] lstrlenW (lpString=".xls") returned 4 [0196.404] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.404] lstrlenW (lpString=".xlsx") returned 5 [0196.404] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.404] lstrlenW (lpString=".ppt") returned 4 [0196.404] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.404] lstrlenW (lpString=".zip") returned 4 [0196.404] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.404] lstrlenW (lpString=".rar") returned 4 [0196.404] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.404] lstrlenW (lpString=".bz2") returned 4 [0196.404] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.404] lstrlenW (lpString=".7z") returned 3 [0196.404] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.404] lstrlenW (lpString=".dbf") returned 4 [0196.404] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.404] lstrlenW (lpString=".1cd") returned 4 [0196.404] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.404] lstrlenW (lpString=".jpg") returned 4 [0196.404] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.404] lstrlenW (lpString=".doc") returned 4 [0196.404] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.404] lstrlenW (lpString=".docx") returned 5 [0196.405] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.405] lstrlenW (lpString=".pdf") returned 4 [0196.405] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.405] lstrlenW (lpString=".xls") returned 4 [0196.405] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.405] lstrlenW (lpString=".xlsx") returned 5 [0196.405] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.405] lstrlenW (lpString=".ppt") returned 4 [0196.405] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.405] lstrlenW (lpString=".zip") returned 4 [0196.405] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.405] lstrlenW (lpString=".rar") returned 4 [0196.405] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.405] lstrlenW (lpString=".bz2") returned 4 [0196.405] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.405] lstrlenW (lpString=".7z") returned 3 [0196.405] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.405] lstrlenW (lpString=".dbf") returned 4 [0196.405] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.405] lstrlenW (lpString=".1cd") returned 4 [0196.405] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.405] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hr\\messages.json") returned 155 [0196.405] lstrlenW (lpString=".jpg") returned 4 [0196.405] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.405] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.405] lstrlenW (lpString="messages.json") returned 13 [0196.405] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.406] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=710) returned 1 [0196.406] CloseHandle (hObject=0x35c) returned 1 [0196.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json")) returned 0x2020 [0196.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.406] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.406] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.407] GetLastError () returned 0x0 [0196.407] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x2c6, lpOverlapped=0x0) returned 1 [0196.408] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0196.409] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.409] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.409] SetEndOfFile (hFile=0x388) returned 1 [0196.409] CloseHandle (hObject=0x388) returned 1 [0196.410] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.410] SetEndOfFile (hFile=0x35c) returned 1 [0196.410] CloseHandle (hObject=0x35c) returned 1 [0196.410] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.410] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json")) returned 1 [0196.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.411] lstrlenW (lpString=".doc") returned 4 [0196.411] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.411] lstrlenW (lpString=".docx") returned 5 [0196.411] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.411] lstrlenW (lpString=".pdf") returned 4 [0196.411] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.411] lstrlenW (lpString=".xls") returned 4 [0196.411] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.411] lstrlenW (lpString=".xlsx") returned 5 [0196.411] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.411] lstrlenW (lpString=".ppt") returned 4 [0196.411] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.411] lstrlenW (lpString=".zip") returned 4 [0196.411] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.411] lstrlenW (lpString=".rar") returned 4 [0196.411] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.411] lstrlenW (lpString=".bz2") returned 4 [0196.411] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.411] lstrlenW (lpString=".7z") returned 3 [0196.411] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.411] lstrlenW (lpString=".dbf") returned 4 [0196.411] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.411] lstrlenW (lpString=".1cd") returned 4 [0196.412] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.412] lstrlenW (lpString=".jpg") returned 4 [0196.412] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.412] lstrlenW (lpString=".doc") returned 4 [0196.412] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.412] lstrlenW (lpString=".docx") returned 5 [0196.412] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.412] lstrlenW (lpString=".pdf") returned 4 [0196.412] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.412] lstrlenW (lpString=".xls") returned 4 [0196.412] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.412] lstrlenW (lpString=".xlsx") returned 5 [0196.412] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.412] lstrlenW (lpString=".ppt") returned 4 [0196.412] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.412] lstrlenW (lpString=".zip") returned 4 [0196.412] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.412] lstrlenW (lpString=".rar") returned 4 [0196.412] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.412] lstrlenW (lpString=".bz2") returned 4 [0196.412] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.412] lstrlenW (lpString=".7z") returned 3 [0196.412] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.412] lstrlenW (lpString=".dbf") returned 4 [0196.412] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.412] lstrlenW (lpString=".1cd") returned 4 [0196.412] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.412] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\hu\\messages.json") returned 155 [0196.413] lstrlenW (lpString=".jpg") returned 4 [0196.413] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.413] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.413] lstrlenW (lpString="messages.json") returned 13 [0196.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.413] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=617) returned 1 [0196.413] CloseHandle (hObject=0x35c) returned 1 [0196.413] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json")) returned 0x2020 [0196.413] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.413] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.414] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.414] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.414] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.414] GetLastError () returned 0x0 [0196.414] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x269, lpOverlapped=0x0) returned 1 [0196.416] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x270, lpOverlapped=0x0) returned 1 [0196.416] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.416] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.417] SetEndOfFile (hFile=0x388) returned 1 [0196.417] CloseHandle (hObject=0x388) returned 1 [0196.417] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.417] SetEndOfFile (hFile=0x35c) returned 1 [0196.417] CloseHandle (hObject=0x35c) returned 1 [0196.418] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.418] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json")) returned 1 [0196.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.418] lstrlenW (lpString=".doc") returned 4 [0196.418] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.418] lstrlenW (lpString=".docx") returned 5 [0196.418] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.418] lstrlenW (lpString=".pdf") returned 4 [0196.418] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.418] lstrlenW (lpString=".xls") returned 4 [0196.418] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.418] lstrlenW (lpString=".xlsx") returned 5 [0196.418] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.418] lstrlenW (lpString=".ppt") returned 4 [0196.418] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.418] lstrlenW (lpString=".zip") returned 4 [0196.418] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.418] lstrlenW (lpString=".rar") returned 4 [0196.419] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.419] lstrlenW (lpString=".bz2") returned 4 [0196.419] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.419] lstrlenW (lpString=".7z") returned 3 [0196.419] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.419] lstrlenW (lpString=".dbf") returned 4 [0196.419] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.419] lstrlenW (lpString=".1cd") returned 4 [0196.419] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.419] lstrlenW (lpString=".jpg") returned 4 [0196.419] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.419] lstrlenW (lpString=".doc") returned 4 [0196.419] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.419] lstrlenW (lpString=".docx") returned 5 [0196.419] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.419] lstrlenW (lpString=".pdf") returned 4 [0196.419] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.419] lstrlenW (lpString=".xls") returned 4 [0196.419] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.419] lstrlenW (lpString=".xlsx") returned 5 [0196.419] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.419] lstrlenW (lpString=".ppt") returned 4 [0196.419] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.419] lstrlenW (lpString=".zip") returned 4 [0196.419] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.419] lstrlenW (lpString=".rar") returned 4 [0196.419] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.419] lstrlenW (lpString=".bz2") returned 4 [0196.420] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.420] lstrlenW (lpString=".7z") returned 3 [0196.420] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.420] lstrlenW (lpString=".dbf") returned 4 [0196.420] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.420] lstrlenW (lpString=".1cd") returned 4 [0196.420] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\id\\messages.json") returned 155 [0196.420] lstrlenW (lpString=".jpg") returned 4 [0196.420] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.420] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.420] lstrlenW (lpString="messages.json") returned 13 [0196.420] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.420] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=622) returned 1 [0196.420] CloseHandle (hObject=0x35c) returned 1 [0196.421] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json")) returned 0x2020 [0196.421] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.421] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.421] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.421] GetLastError () returned 0x0 [0196.421] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x26e, lpOverlapped=0x0) returned 1 [0196.610] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x270, lpOverlapped=0x0) returned 1 [0196.611] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.611] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.611] SetEndOfFile (hFile=0x388) returned 1 [0196.611] CloseHandle (hObject=0x388) returned 1 [0196.612] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.612] SetEndOfFile (hFile=0x35c) returned 1 [0196.612] CloseHandle (hObject=0x35c) returned 1 [0196.612] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.612] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json")) returned 1 [0196.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.613] lstrlenW (lpString=".doc") returned 4 [0196.613] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.613] lstrlenW (lpString=".docx") returned 5 [0196.613] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.613] lstrlenW (lpString=".pdf") returned 4 [0196.613] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.613] lstrlenW (lpString=".xls") returned 4 [0196.613] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.613] lstrlenW (lpString=".xlsx") returned 5 [0196.613] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.613] lstrlenW (lpString=".ppt") returned 4 [0196.613] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.613] lstrlenW (lpString=".zip") returned 4 [0196.613] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.613] lstrlenW (lpString=".rar") returned 4 [0196.613] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.613] lstrlenW (lpString=".bz2") returned 4 [0196.613] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.613] lstrlenW (lpString=".7z") returned 3 [0196.613] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.613] lstrlenW (lpString=".dbf") returned 4 [0196.613] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.613] lstrlenW (lpString=".1cd") returned 4 [0196.613] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.614] lstrlenW (lpString=".jpg") returned 4 [0196.614] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.614] lstrlenW (lpString=".doc") returned 4 [0196.614] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.614] lstrlenW (lpString=".docx") returned 5 [0196.614] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.614] lstrlenW (lpString=".pdf") returned 4 [0196.614] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.614] lstrlenW (lpString=".xls") returned 4 [0196.614] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.614] lstrlenW (lpString=".xlsx") returned 5 [0196.614] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.614] lstrlenW (lpString=".ppt") returned 4 [0196.614] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.614] lstrlenW (lpString=".zip") returned 4 [0196.614] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.614] lstrlenW (lpString=".rar") returned 4 [0196.614] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.614] lstrlenW (lpString=".bz2") returned 4 [0196.614] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.614] lstrlenW (lpString=".7z") returned 3 [0196.614] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.614] lstrlenW (lpString=".dbf") returned 4 [0196.614] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.614] lstrlenW (lpString=".1cd") returned 4 [0196.614] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\it\\messages.json") returned 155 [0196.615] lstrlenW (lpString=".jpg") returned 4 [0196.615] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.615] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.615] lstrlenW (lpString="messages.json") returned 13 [0196.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.615] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=649) returned 1 [0196.615] CloseHandle (hObject=0x35c) returned 1 [0196.616] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 0x2020 [0196.616] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.616] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.616] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.616] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.616] GetLastError () returned 0x0 [0196.616] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x289, lpOverlapped=0x0) returned 1 [0196.618] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x290, lpOverlapped=0x0) returned 1 [0196.619] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.619] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.619] SetEndOfFile (hFile=0x388) returned 1 [0196.619] CloseHandle (hObject=0x388) returned 1 [0196.619] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.619] SetEndOfFile (hFile=0x35c) returned 1 [0196.620] CloseHandle (hObject=0x35c) returned 1 [0196.620] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.620] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json")) returned 1 [0196.620] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.620] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.620] lstrlenW (lpString=".doc") returned 4 [0196.621] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.621] lstrlenW (lpString=".docx") returned 5 [0196.621] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.621] lstrlenW (lpString=".pdf") returned 4 [0196.621] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.621] lstrlenW (lpString=".xls") returned 4 [0196.621] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.621] lstrlenW (lpString=".xlsx") returned 5 [0196.621] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.621] lstrlenW (lpString=".ppt") returned 4 [0196.621] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.621] lstrlenW (lpString=".zip") returned 4 [0196.621] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.621] lstrlenW (lpString=".rar") returned 4 [0196.621] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.621] lstrlenW (lpString=".bz2") returned 4 [0196.621] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.621] lstrlenW (lpString=".7z") returned 3 [0196.621] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.621] lstrlenW (lpString=".dbf") returned 4 [0196.621] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.621] lstrlenW (lpString=".1cd") returned 4 [0196.621] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.621] lstrlenW (lpString=".jpg") returned 4 [0196.621] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.621] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.621] lstrlenW (lpString=".doc") returned 4 [0196.621] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.621] lstrlenW (lpString=".docx") returned 5 [0196.622] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.622] lstrlenW (lpString=".pdf") returned 4 [0196.622] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.622] lstrlenW (lpString=".xls") returned 4 [0196.622] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.622] lstrlenW (lpString=".xlsx") returned 5 [0196.622] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.622] lstrlenW (lpString=".ppt") returned 4 [0196.622] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.622] lstrlenW (lpString=".zip") returned 4 [0196.622] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.622] lstrlenW (lpString=".rar") returned 4 [0196.622] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.622] lstrlenW (lpString=".bz2") returned 4 [0196.622] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.622] lstrlenW (lpString=".7z") returned 3 [0196.622] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.622] lstrlenW (lpString=".dbf") returned 4 [0196.622] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.622] lstrlenW (lpString=".1cd") returned 4 [0196.622] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\sv\\messages.json") returned 155 [0196.622] lstrlenW (lpString=".jpg") returned 4 [0196.622] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.622] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.622] lstrlenW (lpString="messages.json") returned 13 [0196.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.623] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1099) returned 1 [0196.623] CloseHandle (hObject=0x35c) returned 1 [0196.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 0x2020 [0196.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.623] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.623] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.624] GetLastError () returned 0x0 [0196.624] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x44b, lpOverlapped=0x0) returned 1 [0196.625] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x450, lpOverlapped=0x0) returned 1 [0196.626] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.626] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.626] SetEndOfFile (hFile=0x388) returned 1 [0196.626] CloseHandle (hObject=0x388) returned 1 [0196.626] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.626] SetEndOfFile (hFile=0x35c) returned 1 [0196.627] CloseHandle (hObject=0x35c) returned 1 [0196.627] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.627] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json")) returned 1 [0196.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.628] lstrlenW (lpString=".doc") returned 4 [0196.628] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.628] lstrlenW (lpString=".docx") returned 5 [0196.628] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.628] lstrlenW (lpString=".pdf") returned 4 [0196.628] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.628] lstrlenW (lpString=".xls") returned 4 [0196.628] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.628] lstrlenW (lpString=".xlsx") returned 5 [0196.628] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.628] lstrlenW (lpString=".ppt") returned 4 [0196.628] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.628] lstrlenW (lpString=".zip") returned 4 [0196.628] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.628] lstrlenW (lpString=".rar") returned 4 [0196.628] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.628] lstrlenW (lpString=".bz2") returned 4 [0196.628] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.628] lstrlenW (lpString=".7z") returned 3 [0196.628] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.628] lstrlenW (lpString=".dbf") returned 4 [0196.628] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.628] lstrlenW (lpString=".1cd") returned 4 [0196.628] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.628] lstrlenW (lpString=".jpg") returned 4 [0196.628] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.629] lstrlenW (lpString=".doc") returned 4 [0196.629] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.629] lstrlenW (lpString=".docx") returned 5 [0196.629] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.629] lstrlenW (lpString=".pdf") returned 4 [0196.629] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.629] lstrlenW (lpString=".xls") returned 4 [0196.629] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.629] lstrlenW (lpString=".xlsx") returned 5 [0196.629] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.629] lstrlenW (lpString=".ppt") returned 4 [0196.629] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.629] lstrlenW (lpString=".zip") returned 4 [0196.629] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.629] lstrlenW (lpString=".rar") returned 4 [0196.629] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.629] lstrlenW (lpString=".bz2") returned 4 [0196.629] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.629] lstrlenW (lpString=".7z") returned 3 [0196.629] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.629] lstrlenW (lpString=".dbf") returned 4 [0196.629] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.629] lstrlenW (lpString=".1cd") returned 4 [0196.629] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\th\\messages.json") returned 155 [0196.629] lstrlenW (lpString=".jpg") returned 4 [0196.629] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.630] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.630] lstrlenW (lpString="messages.json") returned 13 [0196.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.630] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=650) returned 1 [0196.630] CloseHandle (hObject=0x35c) returned 1 [0196.630] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 0x2020 [0196.630] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.630] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.630] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.631] GetLastError () returned 0x0 [0196.631] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x28a, lpOverlapped=0x0) returned 1 [0196.632] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x290, lpOverlapped=0x0) returned 1 [0196.633] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.633] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.633] SetEndOfFile (hFile=0x388) returned 1 [0196.633] CloseHandle (hObject=0x388) returned 1 [0196.633] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.633] SetEndOfFile (hFile=0x35c) returned 1 [0196.635] CloseHandle (hObject=0x35c) returned 1 [0196.636] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.636] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json")) returned 1 [0196.636] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.636] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.636] lstrlenW (lpString=".doc") returned 4 [0196.636] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.636] lstrlenW (lpString=".docx") returned 5 [0196.636] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.636] lstrlenW (lpString=".pdf") returned 4 [0196.636] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.636] lstrlenW (lpString=".xls") returned 4 [0196.636] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.636] lstrlenW (lpString=".xlsx") returned 5 [0196.636] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.636] lstrlenW (lpString=".ppt") returned 4 [0196.636] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.636] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.636] lstrlenW (lpString=".zip") returned 4 [0196.636] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.636] lstrlenW (lpString=".rar") returned 4 [0196.636] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.636] lstrlenW (lpString=".bz2") returned 4 [0196.637] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.637] lstrlenW (lpString=".7z") returned 3 [0196.637] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.637] lstrlenW (lpString=".dbf") returned 4 [0196.637] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.637] lstrlenW (lpString=".1cd") returned 4 [0196.637] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.637] lstrlenW (lpString=".jpg") returned 4 [0196.637] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.637] lstrlenW (lpString=".doc") returned 4 [0196.637] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.637] lstrlenW (lpString=".docx") returned 5 [0196.637] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.637] lstrlenW (lpString=".pdf") returned 4 [0196.637] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.637] lstrlenW (lpString=".xls") returned 4 [0196.637] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.637] lstrlenW (lpString=".xlsx") returned 5 [0196.637] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.637] lstrlenW (lpString=".ppt") returned 4 [0196.637] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.637] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.637] lstrlenW (lpString=".zip") returned 4 [0196.637] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.637] lstrlenW (lpString=".rar") returned 4 [0196.637] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.637] lstrlenW (lpString=".bz2") returned 4 [0196.637] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.637] lstrlenW (lpString=".7z") returned 3 [0196.638] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.638] lstrlenW (lpString=".dbf") returned 4 [0196.638] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.638] lstrlenW (lpString=".1cd") returned 4 [0196.638] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.638] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\tr\\messages.json") returned 155 [0196.638] lstrlenW (lpString=".jpg") returned 4 [0196.638] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.638] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.638] lstrlenW (lpString="messages.json") returned 13 [0196.638] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.638] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=789) returned 1 [0196.638] CloseHandle (hObject=0x35c) returned 1 [0196.639] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 0x2020 [0196.639] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.639] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.639] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.639] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.639] GetLastError () returned 0x0 [0196.639] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x315, lpOverlapped=0x0) returned 1 [0196.641] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x320, lpOverlapped=0x0) returned 1 [0196.642] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.642] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.642] SetEndOfFile (hFile=0x388) returned 1 [0196.642] CloseHandle (hObject=0x388) returned 1 [0196.642] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.642] SetEndOfFile (hFile=0x35c) returned 1 [0196.643] CloseHandle (hObject=0x35c) returned 1 [0196.643] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.643] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json")) returned 1 [0196.643] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.643] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.643] lstrlenW (lpString=".doc") returned 4 [0196.643] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.643] lstrlenW (lpString=".docx") returned 5 [0196.643] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.643] lstrlenW (lpString=".pdf") returned 4 [0196.643] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.643] lstrlenW (lpString=".xls") returned 4 [0196.643] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.644] lstrlenW (lpString=".xlsx") returned 5 [0196.644] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.644] lstrlenW (lpString=".ppt") returned 4 [0196.644] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.644] lstrlenW (lpString=".zip") returned 4 [0196.644] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.644] lstrlenW (lpString=".rar") returned 4 [0196.644] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.644] lstrlenW (lpString=".bz2") returned 4 [0196.644] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.644] lstrlenW (lpString=".7z") returned 3 [0196.644] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.644] lstrlenW (lpString=".dbf") returned 4 [0196.644] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.644] lstrlenW (lpString=".1cd") returned 4 [0196.644] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.644] lstrlenW (lpString=".jpg") returned 4 [0196.644] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.644] lstrlenW (lpString=".doc") returned 4 [0196.644] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.644] lstrlenW (lpString=".docx") returned 5 [0196.644] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.644] lstrlenW (lpString=".pdf") returned 4 [0196.644] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.644] lstrlenW (lpString=".xls") returned 4 [0196.644] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.644] lstrlenW (lpString=".xlsx") returned 5 [0196.644] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.645] lstrlenW (lpString=".ppt") returned 4 [0196.645] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.645] lstrlenW (lpString=".zip") returned 4 [0196.645] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.645] lstrlenW (lpString=".rar") returned 4 [0196.645] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.645] lstrlenW (lpString=".bz2") returned 4 [0196.645] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.645] lstrlenW (lpString=".7z") returned 3 [0196.645] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.645] lstrlenW (lpString=".dbf") returned 4 [0196.645] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.645] lstrlenW (lpString=".1cd") returned 4 [0196.645] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\uk\\messages.json") returned 155 [0196.645] lstrlenW (lpString=".jpg") returned 4 [0196.645] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.645] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.645] lstrlenW (lpString="messages.json") returned 13 [0196.645] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.646] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=720) returned 1 [0196.646] CloseHandle (hObject=0x35c) returned 1 [0196.646] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 0x2020 [0196.646] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.646] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.646] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.646] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.647] GetLastError () returned 0x0 [0196.647] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x2d0, lpOverlapped=0x0) returned 1 [0196.775] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0196.776] ReadFile (in: hFile=0x35c, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.776] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.776] SetEndOfFile (hFile=0x388) returned 1 [0196.776] CloseHandle (hObject=0x388) returned 1 [0196.776] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.776] SetEndOfFile (hFile=0x35c) returned 1 [0196.777] CloseHandle (hObject=0x35c) returned 1 [0196.777] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.777] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json")) returned 1 [0196.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.777] lstrlenW (lpString=".doc") returned 4 [0196.777] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.777] lstrlenW (lpString=".docx") returned 5 [0196.777] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.777] lstrlenW (lpString=".pdf") returned 4 [0196.777] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.778] lstrlenW (lpString=".xls") returned 4 [0196.778] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.778] lstrlenW (lpString=".xlsx") returned 5 [0196.778] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.778] lstrlenW (lpString=".ppt") returned 4 [0196.778] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.778] lstrlenW (lpString=".zip") returned 4 [0196.778] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.778] lstrlenW (lpString=".rar") returned 4 [0196.778] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.778] lstrlenW (lpString=".bz2") returned 4 [0196.778] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.778] lstrlenW (lpString=".7z") returned 3 [0196.778] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.778] lstrlenW (lpString=".dbf") returned 4 [0196.778] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.778] lstrlenW (lpString=".1cd") returned 4 [0196.778] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.778] lstrlenW (lpString=".jpg") returned 4 [0196.778] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.778] lstrlenW (lpString=".doc") returned 4 [0196.778] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.778] lstrlenW (lpString=".docx") returned 5 [0196.778] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.778] lstrlenW (lpString=".pdf") returned 4 [0196.778] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.779] lstrlenW (lpString=".xls") returned 4 [0196.779] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.779] lstrlenW (lpString=".xlsx") returned 5 [0196.779] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.779] lstrlenW (lpString=".ppt") returned 4 [0196.779] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.779] lstrlenW (lpString=".zip") returned 4 [0196.779] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.779] lstrlenW (lpString=".rar") returned 4 [0196.779] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.779] lstrlenW (lpString=".bz2") returned 4 [0196.779] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.779] lstrlenW (lpString=".7z") returned 3 [0196.779] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.779] lstrlenW (lpString=".dbf") returned 4 [0196.779] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.779] lstrlenW (lpString=".1cd") returned 4 [0196.779] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\vi\\messages.json") returned 155 [0196.779] lstrlenW (lpString=".jpg") returned 4 [0196.779] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.779] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.779] lstrlenW (lpString="messages.json") returned 13 [0196.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.823] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=215) returned 1 [0196.825] CloseHandle (hObject=0x154) returned 1 [0196.828] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 0x2020 [0196.832] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.834] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.834] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.835] GetLastError () returned 0x0 [0196.835] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd7, lpOverlapped=0x0) returned 1 [0196.835] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0196.836] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.836] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.837] SetEndOfFile (hFile=0x114) returned 1 [0196.837] CloseHandle (hObject=0x114) returned 1 [0196.837] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.837] SetEndOfFile (hFile=0x154) returned 1 [0196.838] CloseHandle (hObject=0x154) returned 1 [0196.838] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.838] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json")) returned 1 [0196.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.838] lstrlenW (lpString=".doc") returned 4 [0196.838] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.838] lstrlenW (lpString=".docx") returned 5 [0196.838] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.838] lstrlenW (lpString=".pdf") returned 4 [0196.838] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.838] lstrlenW (lpString=".xls") returned 4 [0196.838] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.838] lstrlenW (lpString=".xlsx") returned 5 [0196.838] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.838] lstrlenW (lpString=".ppt") returned 4 [0196.838] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.838] lstrlenW (lpString=".zip") returned 4 [0196.838] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.838] lstrlenW (lpString=".rar") returned 4 [0196.838] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.839] lstrlenW (lpString=".bz2") returned 4 [0196.839] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.839] lstrlenW (lpString=".7z") returned 3 [0196.839] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.839] lstrlenW (lpString=".dbf") returned 4 [0196.839] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.839] lstrlenW (lpString=".1cd") returned 4 [0196.839] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.839] lstrlenW (lpString=".jpg") returned 4 [0196.839] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.839] lstrlenW (lpString=".doc") returned 4 [0196.839] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.839] lstrlenW (lpString=".docx") returned 5 [0196.839] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.839] lstrlenW (lpString=".pdf") returned 4 [0196.839] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.839] lstrlenW (lpString=".xls") returned 4 [0196.839] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.839] lstrlenW (lpString=".xlsx") returned 5 [0196.839] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.839] lstrlenW (lpString=".ppt") returned 4 [0196.839] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.839] lstrlenW (lpString=".zip") returned 4 [0196.839] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.839] lstrlenW (lpString=".rar") returned 4 [0196.839] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.839] lstrlenW (lpString=".bz2") returned 4 [0196.839] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.840] lstrlenW (lpString=".7z") returned 3 [0196.840] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.840] lstrlenW (lpString=".dbf") returned 4 [0196.840] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.840] lstrlenW (lpString=".1cd") returned 4 [0196.840] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\en\\messages.json") returned 151 [0196.840] lstrlenW (lpString=".jpg") returned 4 [0196.840] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.840] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.840] lstrlenW (lpString="messages.json") returned 13 [0196.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.840] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=268) returned 1 [0196.840] CloseHandle (hObject=0x154) returned 1 [0196.841] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 0x2020 [0196.841] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.841] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.841] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.841] GetLastError () returned 0x0 [0196.841] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x10c, lpOverlapped=0x0) returned 1 [0196.842] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x110, lpOverlapped=0x0) returned 1 [0196.843] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.843] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.843] SetEndOfFile (hFile=0x114) returned 1 [0196.843] CloseHandle (hObject=0x114) returned 1 [0196.843] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.843] SetEndOfFile (hFile=0x154) returned 1 [0196.844] CloseHandle (hObject=0x154) returned 1 [0196.844] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.844] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json")) returned 1 [0196.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.845] lstrlenW (lpString=".doc") returned 4 [0196.845] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.845] lstrlenW (lpString=".docx") returned 5 [0196.845] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.845] lstrlenW (lpString=".pdf") returned 4 [0196.845] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.845] lstrlenW (lpString=".xls") returned 4 [0196.845] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.845] lstrlenW (lpString=".xlsx") returned 5 [0196.845] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.845] lstrlenW (lpString=".ppt") returned 4 [0196.845] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.845] lstrlenW (lpString=".zip") returned 4 [0196.845] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.845] lstrlenW (lpString=".rar") returned 4 [0196.845] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.845] lstrlenW (lpString=".bz2") returned 4 [0196.845] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.845] lstrlenW (lpString=".7z") returned 3 [0196.845] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.845] lstrlenW (lpString=".dbf") returned 4 [0196.845] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.845] lstrlenW (lpString=".1cd") returned 4 [0196.845] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.845] lstrlenW (lpString=".jpg") returned 4 [0196.845] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.846] lstrlenW (lpString=".doc") returned 4 [0196.846] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.846] lstrlenW (lpString=".docx") returned 5 [0196.846] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.846] lstrlenW (lpString=".pdf") returned 4 [0196.846] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.846] lstrlenW (lpString=".xls") returned 4 [0196.846] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.846] lstrlenW (lpString=".xlsx") returned 5 [0196.846] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.846] lstrlenW (lpString=".ppt") returned 4 [0196.846] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.846] lstrlenW (lpString=".zip") returned 4 [0196.846] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.846] lstrlenW (lpString=".rar") returned 4 [0196.846] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.846] lstrlenW (lpString=".bz2") returned 4 [0196.846] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.846] lstrlenW (lpString=".7z") returned 3 [0196.846] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.846] lstrlenW (lpString=".dbf") returned 4 [0196.846] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.846] lstrlenW (lpString=".1cd") returned 4 [0196.846] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fr\\messages.json") returned 151 [0196.846] lstrlenW (lpString=".jpg") returned 4 [0196.846] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.847] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.847] lstrlenW (lpString="messages.json") returned 13 [0196.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.847] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=289) returned 1 [0196.847] CloseHandle (hObject=0x154) returned 1 [0196.847] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 0x2020 [0196.847] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.847] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.847] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.848] GetLastError () returned 0x0 [0196.848] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x121, lpOverlapped=0x0) returned 1 [0196.849] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x130, lpOverlapped=0x0) returned 1 [0196.850] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.850] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.850] SetEndOfFile (hFile=0x114) returned 1 [0196.850] CloseHandle (hObject=0x114) returned 1 [0196.850] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.850] SetEndOfFile (hFile=0x154) returned 1 [0196.851] CloseHandle (hObject=0x154) returned 1 [0196.851] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.851] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json")) returned 1 [0196.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.851] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.851] lstrlenW (lpString=".doc") returned 4 [0196.851] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.851] lstrlenW (lpString=".docx") returned 5 [0196.851] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.851] lstrlenW (lpString=".pdf") returned 4 [0196.851] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.851] lstrlenW (lpString=".xls") returned 4 [0196.851] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.851] lstrlenW (lpString=".xlsx") returned 5 [0196.851] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.852] lstrlenW (lpString=".ppt") returned 4 [0196.852] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.852] lstrlenW (lpString=".zip") returned 4 [0196.852] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.852] lstrlenW (lpString=".rar") returned 4 [0196.852] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.852] lstrlenW (lpString=".bz2") returned 4 [0196.852] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.852] lstrlenW (lpString=".7z") returned 3 [0196.852] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.852] lstrlenW (lpString=".dbf") returned 4 [0196.852] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.852] lstrlenW (lpString=".1cd") returned 4 [0196.852] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.852] lstrlenW (lpString=".jpg") returned 4 [0196.852] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.852] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.852] lstrlenW (lpString=".doc") returned 4 [0196.852] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.852] lstrlenW (lpString=".docx") returned 5 [0196.852] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.852] lstrlenW (lpString=".pdf") returned 4 [0196.852] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.852] lstrlenW (lpString=".xls") returned 4 [0196.852] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.852] lstrlenW (lpString=".xlsx") returned 5 [0196.852] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.852] lstrlenW (lpString=".ppt") returned 4 [0196.852] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.853] lstrlenW (lpString=".zip") returned 4 [0196.853] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.853] lstrlenW (lpString=".rar") returned 4 [0196.853] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.853] lstrlenW (lpString=".bz2") returned 4 [0196.853] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.853] lstrlenW (lpString=".7z") returned 3 [0196.853] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.853] lstrlenW (lpString=".dbf") returned 4 [0196.853] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.853] lstrlenW (lpString=".1cd") returned 4 [0196.853] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hi\\messages.json") returned 151 [0196.853] lstrlenW (lpString=".jpg") returned 4 [0196.853] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.854] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.854] lstrlenW (lpString="messages.json") returned 13 [0196.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.854] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=230) returned 1 [0196.854] CloseHandle (hObject=0x154) returned 1 [0196.854] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 0x2020 [0196.854] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.854] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.854] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.854] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.855] GetLastError () returned 0x0 [0196.855] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe6, lpOverlapped=0x0) returned 1 [0196.856] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0196.857] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.857] WriteFile (in: hFile=0x114, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.857] SetEndOfFile (hFile=0x114) returned 1 [0196.857] CloseHandle (hObject=0x114) returned 1 [0196.857] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.857] SetEndOfFile (hFile=0x154) returned 1 [0196.858] CloseHandle (hObject=0x154) returned 1 [0196.858] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.858] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json")) returned 1 [0196.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.858] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.858] lstrlenW (lpString=".doc") returned 4 [0196.858] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.858] lstrlenW (lpString=".docx") returned 5 [0196.858] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.858] lstrlenW (lpString=".pdf") returned 4 [0196.858] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.858] lstrlenW (lpString=".xls") returned 4 [0196.858] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.858] lstrlenW (lpString=".xlsx") returned 5 [0196.858] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.858] lstrlenW (lpString=".ppt") returned 4 [0196.858] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.859] lstrlenW (lpString=".zip") returned 4 [0196.859] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.859] lstrlenW (lpString=".rar") returned 4 [0196.859] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.859] lstrlenW (lpString=".bz2") returned 4 [0196.859] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.859] lstrlenW (lpString=".7z") returned 3 [0196.859] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.859] lstrlenW (lpString=".dbf") returned 4 [0196.859] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.859] lstrlenW (lpString=".1cd") returned 4 [0196.859] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.859] lstrlenW (lpString=".jpg") returned 4 [0196.859] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.859] lstrlenW (lpString=".doc") returned 4 [0196.859] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.859] lstrlenW (lpString=".docx") returned 5 [0196.859] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.859] lstrlenW (lpString=".pdf") returned 4 [0196.859] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.859] lstrlenW (lpString=".xls") returned 4 [0196.859] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.859] lstrlenW (lpString=".xlsx") returned 5 [0196.859] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.859] lstrlenW (lpString=".ppt") returned 4 [0196.859] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.859] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.860] lstrlenW (lpString=".zip") returned 4 [0196.860] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.860] lstrlenW (lpString=".rar") returned 4 [0196.860] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.860] lstrlenW (lpString=".bz2") returned 4 [0196.860] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.860] lstrlenW (lpString=".7z") returned 3 [0196.860] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.860] lstrlenW (lpString=".dbf") returned 4 [0196.860] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.860] lstrlenW (lpString=".1cd") returned 4 [0196.860] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.860] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hr\\messages.json") returned 151 [0196.860] lstrlenW (lpString=".jpg") returned 4 [0196.860] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.860] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.860] lstrlenW (lpString="messages.json") returned 13 [0196.860] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.968] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=226) returned 1 [0196.968] CloseHandle (hObject=0x388) returned 1 [0196.968] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 0x2020 [0196.968] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.969] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.969] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.969] GetLastError () returned 0x0 [0196.969] ReadFile (in: hFile=0x388, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe2, lpOverlapped=0x0) returned 1 [0196.970] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0196.971] ReadFile (in: hFile=0x388, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.971] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.971] SetEndOfFile (hFile=0x358) returned 1 [0196.971] CloseHandle (hObject=0x358) returned 1 [0196.971] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.971] SetEndOfFile (hFile=0x388) returned 1 [0196.972] CloseHandle (hObject=0x388) returned 1 [0196.972] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.972] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json")) returned 1 [0196.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.972] lstrlenW (lpString=".doc") returned 4 [0196.972] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.972] lstrlenW (lpString=".docx") returned 5 [0196.972] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.973] lstrlenW (lpString=".pdf") returned 4 [0196.973] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.973] lstrlenW (lpString=".xls") returned 4 [0196.973] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.973] lstrlenW (lpString=".xlsx") returned 5 [0196.973] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.973] lstrlenW (lpString=".ppt") returned 4 [0196.973] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.973] lstrlenW (lpString=".zip") returned 4 [0196.973] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.973] lstrlenW (lpString=".rar") returned 4 [0196.973] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.973] lstrlenW (lpString=".bz2") returned 4 [0196.973] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.973] lstrlenW (lpString=".7z") returned 3 [0196.973] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.973] lstrlenW (lpString=".dbf") returned 4 [0196.973] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.973] lstrlenW (lpString=".1cd") returned 4 [0196.973] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.973] lstrlenW (lpString=".jpg") returned 4 [0196.973] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.973] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.973] lstrlenW (lpString=".doc") returned 4 [0196.973] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.973] lstrlenW (lpString=".docx") returned 5 [0196.973] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.973] lstrlenW (lpString=".pdf") returned 4 [0196.973] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.974] lstrlenW (lpString=".xls") returned 4 [0196.974] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.974] lstrlenW (lpString=".xlsx") returned 5 [0196.974] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.974] lstrlenW (lpString=".ppt") returned 4 [0196.974] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.974] lstrlenW (lpString=".zip") returned 4 [0196.974] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.974] lstrlenW (lpString=".rar") returned 4 [0196.974] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.974] lstrlenW (lpString=".bz2") returned 4 [0196.974] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.974] lstrlenW (lpString=".7z") returned 3 [0196.974] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.974] lstrlenW (lpString=".dbf") returned 4 [0196.974] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.974] lstrlenW (lpString=".1cd") returned 4 [0196.974] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.974] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\hu\\messages.json") returned 151 [0196.974] lstrlenW (lpString=".jpg") returned 4 [0196.974] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.974] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.974] lstrlenW (lpString="messages.json") returned 13 [0196.974] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.975] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=232) returned 1 [0196.975] CloseHandle (hObject=0x388) returned 1 [0196.975] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 0x2020 [0196.975] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.975] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.975] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.975] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0196.976] GetLastError () returned 0x0 [0196.976] ReadFile (in: hFile=0x388, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe8, lpOverlapped=0x0) returned 1 [0196.977] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0196.978] ReadFile (in: hFile=0x388, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0196.978] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.978] SetEndOfFile (hFile=0x358) returned 1 [0196.978] CloseHandle (hObject=0x358) returned 1 [0196.978] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0196.978] SetEndOfFile (hFile=0x388) returned 1 [0196.979] CloseHandle (hObject=0x388) returned 1 [0196.979] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.979] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json")) returned 1 [0196.979] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.979] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.979] lstrlenW (lpString=".doc") returned 4 [0196.979] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.979] lstrlenW (lpString=".docx") returned 5 [0196.979] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.979] lstrlenW (lpString=".pdf") returned 4 [0196.979] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.979] lstrlenW (lpString=".xls") returned 4 [0196.979] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.979] lstrlenW (lpString=".xlsx") returned 5 [0196.979] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.979] lstrlenW (lpString=".ppt") returned 4 [0196.979] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.979] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.979] lstrlenW (lpString=".zip") returned 4 [0196.980] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.980] lstrlenW (lpString=".rar") returned 4 [0196.980] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.980] lstrlenW (lpString=".bz2") returned 4 [0196.980] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.980] lstrlenW (lpString=".7z") returned 3 [0196.980] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.980] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.980] lstrlenW (lpString=".dbf") returned 4 [0196.980] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.980] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.980] lstrlenW (lpString=".1cd") returned 4 [0196.980] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.980] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.980] lstrlenW (lpString=".jpg") returned 4 [0196.980] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.980] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.980] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.980] lstrlenW (lpString=".doc") returned 4 [0196.980] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.980] lstrlenW (lpString=".docx") returned 5 [0196.980] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.980] lstrlenW (lpString=".pdf") returned 4 [0196.980] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.980] lstrlenW (lpString=".xls") returned 4 [0196.980] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.980] lstrlenW (lpString=".xlsx") returned 5 [0196.980] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.980] lstrlenW (lpString=".ppt") returned 4 [0196.980] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.980] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.980] lstrlenW (lpString=".zip") returned 4 [0196.980] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.980] lstrlenW (lpString=".rar") returned 4 [0196.981] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.981] lstrlenW (lpString=".bz2") returned 4 [0196.981] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.981] lstrlenW (lpString=".7z") returned 3 [0196.981] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.981] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.981] lstrlenW (lpString=".dbf") returned 4 [0196.981] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.981] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.981] lstrlenW (lpString=".1cd") returned 4 [0196.981] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.981] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\nl\\messages.json") returned 151 [0196.981] lstrlenW (lpString=".jpg") returned 4 [0196.981] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.981] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.981] lstrlenW (lpString="messages.json") returned 13 [0196.981] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.026] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=210) returned 1 [0197.026] CloseHandle (hObject=0x358) returned 1 [0197.026] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 0x2020 [0197.026] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.026] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.026] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.026] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0197.027] GetLastError () returned 0x0 [0197.027] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd2, lpOverlapped=0x0) returned 1 [0197.028] WriteFile (in: hFile=0x120, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0197.029] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.029] WriteFile (in: hFile=0x120, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.029] SetEndOfFile (hFile=0x120) returned 1 [0197.029] CloseHandle (hObject=0x120) returned 1 [0197.029] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.029] SetEndOfFile (hFile=0x358) returned 1 [0197.032] CloseHandle (hObject=0x358) returned 1 [0197.032] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.032] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json")) returned 1 [0197.032] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.032] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.032] lstrlenW (lpString=".doc") returned 4 [0197.032] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.032] lstrlenW (lpString=".docx") returned 5 [0197.032] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.032] lstrlenW (lpString=".pdf") returned 4 [0197.032] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.032] lstrlenW (lpString=".xls") returned 4 [0197.032] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.032] lstrlenW (lpString=".xlsx") returned 5 [0197.032] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.032] lstrlenW (lpString=".ppt") returned 4 [0197.032] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.032] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.032] lstrlenW (lpString=".zip") returned 4 [0197.032] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.033] lstrlenW (lpString=".rar") returned 4 [0197.033] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.033] lstrlenW (lpString=".bz2") returned 4 [0197.033] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.033] lstrlenW (lpString=".7z") returned 3 [0197.033] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.033] lstrlenW (lpString=".dbf") returned 4 [0197.033] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.033] lstrlenW (lpString=".1cd") returned 4 [0197.033] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.033] lstrlenW (lpString=".jpg") returned 4 [0197.033] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.033] lstrlenW (lpString=".doc") returned 4 [0197.033] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.033] lstrlenW (lpString=".docx") returned 5 [0197.033] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.033] lstrlenW (lpString=".pdf") returned 4 [0197.033] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.033] lstrlenW (lpString=".xls") returned 4 [0197.033] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.033] lstrlenW (lpString=".xlsx") returned 5 [0197.033] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.033] lstrlenW (lpString=".ppt") returned 4 [0197.033] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.033] lstrlenW (lpString=".zip") returned 4 [0197.033] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.033] lstrlenW (lpString=".rar") returned 4 [0197.034] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.034] lstrlenW (lpString=".bz2") returned 4 [0197.034] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.034] lstrlenW (lpString=".7z") returned 3 [0197.034] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.034] lstrlenW (lpString=".dbf") returned 4 [0197.034] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.034] lstrlenW (lpString=".1cd") returned 4 [0197.034] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\no\\messages.json") returned 151 [0197.034] lstrlenW (lpString=".jpg") returned 4 [0197.034] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.034] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.034] lstrlenW (lpString="messages.json") returned 13 [0197.034] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.035] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=210) returned 1 [0197.035] CloseHandle (hObject=0x358) returned 1 [0197.035] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 0x2020 [0197.035] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.035] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.035] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.035] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0197.035] GetLastError () returned 0x0 [0197.036] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xd2, lpOverlapped=0x0) returned 1 [0197.036] WriteFile (in: hFile=0x120, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0197.038] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.038] WriteFile (in: hFile=0x120, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.038] SetEndOfFile (hFile=0x120) returned 1 [0197.038] CloseHandle (hObject=0x120) returned 1 [0197.038] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.038] SetEndOfFile (hFile=0x358) returned 1 [0197.039] CloseHandle (hObject=0x358) returned 1 [0197.039] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.039] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json")) returned 1 [0197.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.039] lstrlenW (lpString=".doc") returned 4 [0197.039] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.039] lstrlenW (lpString=".docx") returned 5 [0197.039] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.039] lstrlenW (lpString=".pdf") returned 4 [0197.039] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.039] lstrlenW (lpString=".xls") returned 4 [0197.039] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.039] lstrlenW (lpString=".xlsx") returned 5 [0197.040] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.040] lstrlenW (lpString=".ppt") returned 4 [0197.040] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.040] lstrlenW (lpString=".zip") returned 4 [0197.040] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.040] lstrlenW (lpString=".rar") returned 4 [0197.040] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.040] lstrlenW (lpString=".bz2") returned 4 [0197.040] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.040] lstrlenW (lpString=".7z") returned 3 [0197.040] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.040] lstrlenW (lpString=".dbf") returned 4 [0197.040] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.040] lstrlenW (lpString=".1cd") returned 4 [0197.040] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.040] lstrlenW (lpString=".jpg") returned 4 [0197.040] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.040] lstrlenW (lpString=".doc") returned 4 [0197.040] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.041] lstrlenW (lpString=".docx") returned 5 [0197.041] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.041] lstrlenW (lpString=".pdf") returned 4 [0197.041] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.041] lstrlenW (lpString=".xls") returned 4 [0197.041] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.041] lstrlenW (lpString=".xlsx") returned 5 [0197.041] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.041] lstrlenW (lpString=".ppt") returned 4 [0197.041] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.041] lstrlenW (lpString=".zip") returned 4 [0197.041] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.041] lstrlenW (lpString=".rar") returned 4 [0197.041] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.041] lstrlenW (lpString=".bz2") returned 4 [0197.041] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.041] lstrlenW (lpString=".7z") returned 3 [0197.041] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.041] lstrlenW (lpString=".dbf") returned 4 [0197.041] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.041] lstrlenW (lpString=".1cd") returned 4 [0197.041] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.041] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\se\\messages.json") returned 151 [0197.041] lstrlenW (lpString=".jpg") returned 4 [0197.041] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.041] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.041] lstrlenW (lpString="messages.json") returned 13 [0197.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.042] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=222) returned 1 [0197.042] CloseHandle (hObject=0x358) returned 1 [0197.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 0x2020 [0197.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.042] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.042] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0197.043] GetLastError () returned 0x0 [0197.043] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xde, lpOverlapped=0x0) returned 1 [0197.193] WriteFile (in: hFile=0x120, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe0, lpOverlapped=0x0) returned 1 [0197.232] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.232] WriteFile (in: hFile=0x120, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.232] SetEndOfFile (hFile=0x120) returned 1 [0197.233] CloseHandle (hObject=0x120) returned 1 [0197.233] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.233] SetEndOfFile (hFile=0x358) returned 1 [0197.233] CloseHandle (hObject=0x358) returned 1 [0197.233] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.234] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json")) returned 1 [0197.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.234] lstrlenW (lpString=".doc") returned 4 [0197.234] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.234] lstrlenW (lpString=".docx") returned 5 [0197.234] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.234] lstrlenW (lpString=".pdf") returned 4 [0197.234] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.234] lstrlenW (lpString=".xls") returned 4 [0197.234] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.234] lstrlenW (lpString=".xlsx") returned 5 [0197.234] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.234] lstrlenW (lpString=".ppt") returned 4 [0197.234] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.234] lstrlenW (lpString=".zip") returned 4 [0197.234] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.234] lstrlenW (lpString=".rar") returned 4 [0197.234] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.234] lstrlenW (lpString=".bz2") returned 4 [0197.234] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.234] lstrlenW (lpString=".7z") returned 3 [0197.234] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.235] lstrlenW (lpString=".dbf") returned 4 [0197.235] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.235] lstrlenW (lpString=".1cd") returned 4 [0197.235] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.235] lstrlenW (lpString=".jpg") returned 4 [0197.235] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.235] lstrlenW (lpString=".doc") returned 4 [0197.235] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.235] lstrlenW (lpString=".docx") returned 5 [0197.235] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.235] lstrlenW (lpString=".pdf") returned 4 [0197.235] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.235] lstrlenW (lpString=".xls") returned 4 [0197.235] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.235] lstrlenW (lpString=".xlsx") returned 5 [0197.235] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.235] lstrlenW (lpString=".ppt") returned 4 [0197.235] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.235] lstrlenW (lpString=".zip") returned 4 [0197.235] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.235] lstrlenW (lpString=".rar") returned 4 [0197.235] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.235] lstrlenW (lpString=".bz2") returned 4 [0197.235] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.235] lstrlenW (lpString=".7z") returned 3 [0197.235] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.235] lstrlenW (lpString=".dbf") returned 4 [0197.236] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.236] lstrlenW (lpString=".1cd") returned 4 [0197.236] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.236] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\sk\\messages.json") returned 151 [0197.236] lstrlenW (lpString=".jpg") returned 4 [0197.236] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.236] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.236] lstrlenW (lpString="cast_game_sender.js") returned 19 [0197.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.258] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=98730) returned 1 [0197.258] CloseHandle (hObject=0x154) returned 1 [0197.258] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 0x2020 [0197.258] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.258] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.259] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.259] GetLastError () returned 0x0 [0197.259] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x181aa, lpOverlapped=0x0) returned 1 [0197.263] WriteFile (in: hFile=0x15c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x181b0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x181b0, lpOverlapped=0x0) returned 1 [0197.265] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.266] WriteFile (in: hFile=0x15c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xfa, lpOverlapped=0x0) returned 1 [0197.266] SetEndOfFile (hFile=0x15c) returned 1 [0197.266] CloseHandle (hObject=0x15c) returned 1 [0197.266] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.266] SetEndOfFile (hFile=0x154) returned 1 [0197.267] CloseHandle (hObject=0x154) returned 1 [0197.267] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.267] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js")) returned 1 [0197.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.268] lstrlenW (lpString=".doc") returned 4 [0197.268] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0197.268] lstrlenW (lpString=".docx") returned 5 [0197.268] lstrcmpiW (lpString1=".docx", lpString2="er.js") returned -1 [0197.268] lstrlenW (lpString=".pdf") returned 4 [0197.268] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0197.268] lstrlenW (lpString=".xls") returned 4 [0197.268] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0197.268] lstrlenW (lpString=".xlsx") returned 5 [0197.268] lstrcmpiW (lpString1=".xlsx", lpString2="er.js") returned -1 [0197.268] lstrlenW (lpString=".ppt") returned 4 [0197.268] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0197.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.268] lstrlenW (lpString=".zip") returned 4 [0197.268] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0197.268] lstrlenW (lpString=".rar") returned 4 [0197.268] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0197.268] lstrlenW (lpString=".bz2") returned 4 [0197.268] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0197.268] lstrlenW (lpString=".7z") returned 3 [0197.268] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.268] lstrlenW (lpString=".dbf") returned 4 [0197.268] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0197.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.268] lstrlenW (lpString=".1cd") returned 4 [0197.268] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0197.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.268] lstrlenW (lpString=".jpg") returned 4 [0197.268] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0197.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.269] lstrlenW (lpString=".doc") returned 4 [0197.269] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0197.269] lstrlenW (lpString=".docx") returned 5 [0197.269] lstrcmpiW (lpString1=".docx", lpString2="er.js") returned -1 [0197.269] lstrlenW (lpString=".pdf") returned 4 [0197.269] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0197.269] lstrlenW (lpString=".xls") returned 4 [0197.269] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0197.269] lstrlenW (lpString=".xlsx") returned 5 [0197.269] lstrcmpiW (lpString1=".xlsx", lpString2="er.js") returned -1 [0197.269] lstrlenW (lpString=".ppt") returned 4 [0197.269] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0197.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.269] lstrlenW (lpString=".zip") returned 4 [0197.269] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0197.269] lstrlenW (lpString=".rar") returned 4 [0197.269] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0197.269] lstrlenW (lpString=".bz2") returned 4 [0197.269] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0197.269] lstrlenW (lpString=".7z") returned 3 [0197.269] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.269] lstrlenW (lpString=".dbf") returned 4 [0197.269] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0197.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.269] lstrlenW (lpString=".1cd") returned 4 [0197.269] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0197.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_game_sender.js") returned 154 [0197.269] lstrlenW (lpString=".jpg") returned 4 [0197.269] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0197.270] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.270] lstrlenW (lpString="cast_sender.js") returned 14 [0197.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.270] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=52759) returned 1 [0197.270] CloseHandle (hObject=0x154) returned 1 [0197.270] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 0x2020 [0197.270] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.270] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.270] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.271] GetLastError () returned 0x0 [0197.271] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xce17, lpOverlapped=0x0) returned 1 [0197.277] WriteFile (in: hFile=0x15c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xce20, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xce20, lpOverlapped=0x0) returned 1 [0197.279] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.279] WriteFile (in: hFile=0x15c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0197.279] SetEndOfFile (hFile=0x15c) returned 1 [0197.279] CloseHandle (hObject=0x15c) returned 1 [0197.279] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.279] SetEndOfFile (hFile=0x154) returned 1 [0197.280] CloseHandle (hObject=0x154) returned 1 [0197.280] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.280] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js")) returned 1 [0197.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.281] lstrlenW (lpString=".doc") returned 4 [0197.281] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0197.281] lstrlenW (lpString=".docx") returned 5 [0197.281] lstrcmpiW (lpString1=".docx", lpString2="er.js") returned -1 [0197.281] lstrlenW (lpString=".pdf") returned 4 [0197.281] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0197.281] lstrlenW (lpString=".xls") returned 4 [0197.281] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0197.281] lstrlenW (lpString=".xlsx") returned 5 [0197.281] lstrcmpiW (lpString1=".xlsx", lpString2="er.js") returned -1 [0197.281] lstrlenW (lpString=".ppt") returned 4 [0197.281] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0197.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.281] lstrlenW (lpString=".zip") returned 4 [0197.281] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0197.281] lstrlenW (lpString=".rar") returned 4 [0197.281] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0197.281] lstrlenW (lpString=".bz2") returned 4 [0197.281] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0197.281] lstrlenW (lpString=".7z") returned 3 [0197.281] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.281] lstrlenW (lpString=".dbf") returned 4 [0197.281] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0197.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.281] lstrlenW (lpString=".1cd") returned 4 [0197.281] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0197.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.281] lstrlenW (lpString=".jpg") returned 4 [0197.281] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0197.282] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.282] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.282] lstrlenW (lpString=".doc") returned 4 [0197.282] lstrcmpiW (lpString1=".doc", lpString2="r.js") returned -1 [0197.282] lstrlenW (lpString=".docx") returned 5 [0197.282] lstrcmpiW (lpString1=".docx", lpString2="er.js") returned -1 [0197.282] lstrlenW (lpString=".pdf") returned 4 [0197.282] lstrcmpiW (lpString1=".pdf", lpString2="r.js") returned -1 [0197.282] lstrlenW (lpString=".xls") returned 4 [0197.282] lstrcmpiW (lpString1=".xls", lpString2="r.js") returned -1 [0197.282] lstrlenW (lpString=".xlsx") returned 5 [0197.282] lstrcmpiW (lpString1=".xlsx", lpString2="er.js") returned -1 [0197.282] lstrlenW (lpString=".ppt") returned 4 [0197.282] lstrcmpiW (lpString1=".ppt", lpString2="r.js") returned -1 [0197.282] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.282] lstrlenW (lpString=".zip") returned 4 [0197.282] lstrcmpiW (lpString1=".zip", lpString2="r.js") returned -1 [0197.282] lstrlenW (lpString=".rar") returned 4 [0197.282] lstrcmpiW (lpString1=".rar", lpString2="r.js") returned -1 [0197.282] lstrlenW (lpString=".bz2") returned 4 [0197.282] lstrcmpiW (lpString1=".bz2", lpString2="r.js") returned -1 [0197.282] lstrlenW (lpString=".7z") returned 3 [0197.282] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.282] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.282] lstrlenW (lpString=".dbf") returned 4 [0197.282] lstrcmpiW (lpString1=".dbf", lpString2="r.js") returned -1 [0197.282] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.282] lstrlenW (lpString=".1cd") returned 4 [0197.282] lstrcmpiW (lpString1=".1cd", lpString2="r.js") returned -1 [0197.282] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_sender.js") returned 149 [0197.282] lstrlenW (lpString=".jpg") returned 4 [0197.282] lstrcmpiW (lpString1=".jpg", lpString2="r.js") returned -1 [0197.283] lstrcmpiW (lpString1=".css", lpString2=".wiki") returned -1 [0197.283] lstrlenW (lpString="cast_app.css") returned 12 [0197.283] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.284] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=6685) returned 1 [0197.284] CloseHandle (hObject=0x154) returned 1 [0197.284] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 0x2020 [0197.284] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.284] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.284] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.284] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.285] GetLastError () returned 0x0 [0197.285] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x1a1d, lpOverlapped=0x0) returned 1 [0197.394] WriteFile (in: hFile=0x15c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0197.396] ReadFile (in: hFile=0x154, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.396] WriteFile (in: hFile=0x15c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0197.396] SetEndOfFile (hFile=0x15c) returned 1 [0197.449] CloseHandle (hObject=0x15c) returned 1 [0197.452] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.452] SetEndOfFile (hFile=0x154) returned 1 [0197.461] CloseHandle (hObject=0x154) returned 1 [0197.471] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.471] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css")) returned 1 [0197.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.472] lstrlenW (lpString=".doc") returned 4 [0197.472] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0197.472] lstrlenW (lpString=".docx") returned 5 [0197.472] lstrcmpiW (lpString1=".docx", lpString2="p.css") returned -1 [0197.472] lstrlenW (lpString=".pdf") returned 4 [0197.472] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0197.472] lstrlenW (lpString=".xls") returned 4 [0197.472] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0197.472] lstrlenW (lpString=".xlsx") returned 5 [0197.472] lstrcmpiW (lpString1=".xlsx", lpString2="p.css") returned -1 [0197.472] lstrlenW (lpString=".ppt") returned 4 [0197.472] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0197.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.472] lstrlenW (lpString=".zip") returned 4 [0197.472] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0197.472] lstrlenW (lpString=".rar") returned 4 [0197.472] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0197.472] lstrlenW (lpString=".bz2") returned 4 [0197.472] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0197.472] lstrlenW (lpString=".7z") returned 3 [0197.472] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0197.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.472] lstrlenW (lpString=".dbf") returned 4 [0197.472] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0197.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.472] lstrlenW (lpString=".1cd") returned 4 [0197.472] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0197.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.472] lstrlenW (lpString=".jpg") returned 4 [0197.472] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0197.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.472] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.473] lstrlenW (lpString=".doc") returned 4 [0197.473] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0197.473] lstrlenW (lpString=".docx") returned 5 [0197.473] lstrcmpiW (lpString1=".docx", lpString2="p.css") returned -1 [0197.473] lstrlenW (lpString=".pdf") returned 4 [0197.473] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0197.473] lstrlenW (lpString=".xls") returned 4 [0197.473] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0197.473] lstrlenW (lpString=".xlsx") returned 5 [0197.473] lstrcmpiW (lpString1=".xlsx", lpString2="p.css") returned -1 [0197.473] lstrlenW (lpString=".ppt") returned 4 [0197.473] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0197.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.473] lstrlenW (lpString=".zip") returned 4 [0197.473] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0197.473] lstrlenW (lpString=".rar") returned 4 [0197.473] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0197.473] lstrlenW (lpString=".bz2") returned 4 [0197.473] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0197.473] lstrlenW (lpString=".7z") returned 3 [0197.473] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0197.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.473] lstrlenW (lpString=".dbf") returned 4 [0197.473] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0197.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.473] lstrlenW (lpString=".1cd") returned 4 [0197.473] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0197.473] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.css") returned 158 [0197.473] lstrlenW (lpString=".jpg") returned 4 [0197.473] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0197.473] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.474] lstrlenW (lpString="feedback_script.js") returned 18 [0197.474] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.573] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=11040) returned 1 [0197.574] CloseHandle (hObject=0x358) returned 1 [0197.574] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js")) returned 0x2020 [0197.574] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.602] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.602] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.602] GetLastError () returned 0x0 [0197.602] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x2b20, lpOverlapped=0x0) returned 1 [0197.604] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2b30, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2b30, lpOverlapped=0x0) returned 1 [0197.605] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.605] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf8, lpOverlapped=0x0) returned 1 [0197.605] SetEndOfFile (hFile=0x358) returned 1 [0197.606] CloseHandle (hObject=0x358) returned 1 [0197.606] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.606] SetEndOfFile (hFile=0x150) returned 1 [0197.606] CloseHandle (hObject=0x150) returned 1 [0197.606] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.607] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js")) returned 1 [0197.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.607] lstrlenW (lpString=".doc") returned 4 [0197.607] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0197.607] lstrlenW (lpString=".docx") returned 5 [0197.607] lstrcmpiW (lpString1=".docx", lpString2="pt.js") returned -1 [0197.607] lstrlenW (lpString=".pdf") returned 4 [0197.607] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0197.607] lstrlenW (lpString=".xls") returned 4 [0197.607] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0197.607] lstrlenW (lpString=".xlsx") returned 5 [0197.607] lstrcmpiW (lpString1=".xlsx", lpString2="pt.js") returned -1 [0197.607] lstrlenW (lpString=".ppt") returned 4 [0197.607] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0197.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.607] lstrlenW (lpString=".zip") returned 4 [0197.607] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0197.607] lstrlenW (lpString=".rar") returned 4 [0197.607] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0197.607] lstrlenW (lpString=".bz2") returned 4 [0197.607] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0197.607] lstrlenW (lpString=".7z") returned 3 [0197.607] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.607] lstrlenW (lpString=".dbf") returned 4 [0197.608] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.608] lstrlenW (lpString=".1cd") returned 4 [0197.608] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.608] lstrlenW (lpString=".jpg") returned 4 [0197.608] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.608] lstrlenW (lpString=".doc") returned 4 [0197.608] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString=".docx") returned 5 [0197.608] lstrcmpiW (lpString1=".docx", lpString2="pt.js") returned -1 [0197.608] lstrlenW (lpString=".pdf") returned 4 [0197.608] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString=".xls") returned 4 [0197.608] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString=".xlsx") returned 5 [0197.608] lstrcmpiW (lpString1=".xlsx", lpString2="pt.js") returned -1 [0197.608] lstrlenW (lpString=".ppt") returned 4 [0197.608] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.608] lstrlenW (lpString=".zip") returned 4 [0197.608] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString=".rar") returned 4 [0197.608] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString=".bz2") returned 4 [0197.608] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString=".7z") returned 3 [0197.608] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.608] lstrlenW (lpString=".dbf") returned 4 [0197.608] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0197.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.608] lstrlenW (lpString=".1cd") returned 4 [0197.609] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0197.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\feedback_script.js") returned 153 [0197.609] lstrlenW (lpString=".jpg") returned 4 [0197.609] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0197.609] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.609] lstrlenW (lpString="messages.json") returned 13 [0197.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.610] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=18471) returned 1 [0197.610] CloseHandle (hObject=0x150) returned 1 [0197.610] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json")) returned 0x2020 [0197.610] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.610] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.610] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.611] GetLastError () returned 0x0 [0197.611] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x4827, lpOverlapped=0x0) returned 1 [0197.619] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4830, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4830, lpOverlapped=0x0) returned 1 [0197.620] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.620] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.620] SetEndOfFile (hFile=0x358) returned 1 [0197.620] CloseHandle (hObject=0x358) returned 1 [0197.620] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.620] SetEndOfFile (hFile=0x150) returned 1 [0197.621] CloseHandle (hObject=0x150) returned 1 [0197.621] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.621] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json")) returned 1 [0197.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.622] lstrlenW (lpString=".doc") returned 4 [0197.622] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.622] lstrlenW (lpString=".docx") returned 5 [0197.622] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.622] lstrlenW (lpString=".pdf") returned 4 [0197.622] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.622] lstrlenW (lpString=".xls") returned 4 [0197.622] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.622] lstrlenW (lpString=".xlsx") returned 5 [0197.622] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.622] lstrlenW (lpString=".ppt") returned 4 [0197.622] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.622] lstrlenW (lpString=".zip") returned 4 [0197.622] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.622] lstrlenW (lpString=".rar") returned 4 [0197.622] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.622] lstrlenW (lpString=".bz2") returned 4 [0197.622] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.622] lstrlenW (lpString=".7z") returned 3 [0197.622] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.622] lstrlenW (lpString=".dbf") returned 4 [0197.622] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.622] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.622] lstrlenW (lpString=".1cd") returned 4 [0197.622] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.623] lstrlenW (lpString=".jpg") returned 4 [0197.623] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.623] lstrlenW (lpString=".doc") returned 4 [0197.623] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.623] lstrlenW (lpString=".docx") returned 5 [0197.623] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.623] lstrlenW (lpString=".pdf") returned 4 [0197.623] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.623] lstrlenW (lpString=".xls") returned 4 [0197.623] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.623] lstrlenW (lpString=".xlsx") returned 5 [0197.623] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.623] lstrlenW (lpString=".ppt") returned 4 [0197.623] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.623] lstrlenW (lpString=".zip") returned 4 [0197.623] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.623] lstrlenW (lpString=".rar") returned 4 [0197.623] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.623] lstrlenW (lpString=".bz2") returned 4 [0197.623] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.623] lstrlenW (lpString=".7z") returned 3 [0197.623] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.623] lstrlenW (lpString=".dbf") returned 4 [0197.623] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.623] lstrlenW (lpString=".1cd") returned 4 [0197.623] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.623] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\am\\messages.json") returned 160 [0197.624] lstrlenW (lpString=".jpg") returned 4 [0197.624] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.624] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.624] lstrlenW (lpString="messages.json") returned 13 [0197.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.624] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=17855) returned 1 [0197.624] CloseHandle (hObject=0x150) returned 1 [0197.624] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json")) returned 0x2020 [0197.624] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.624] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.625] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.625] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.625] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.625] GetLastError () returned 0x0 [0197.625] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x45bf, lpOverlapped=0x0) returned 1 [0197.627] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0197.628] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.628] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.628] SetEndOfFile (hFile=0x358) returned 1 [0197.628] CloseHandle (hObject=0x358) returned 1 [0197.629] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.629] SetEndOfFile (hFile=0x150) returned 1 [0197.629] CloseHandle (hObject=0x150) returned 1 [0197.630] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.630] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json")) returned 1 [0197.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.630] lstrlenW (lpString=".doc") returned 4 [0197.630] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.630] lstrlenW (lpString=".docx") returned 5 [0197.630] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.630] lstrlenW (lpString=".pdf") returned 4 [0197.630] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.630] lstrlenW (lpString=".xls") returned 4 [0197.630] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.630] lstrlenW (lpString=".xlsx") returned 5 [0197.630] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.630] lstrlenW (lpString=".ppt") returned 4 [0197.630] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.630] lstrlenW (lpString=".zip") returned 4 [0197.630] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.630] lstrlenW (lpString=".rar") returned 4 [0197.630] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.630] lstrlenW (lpString=".bz2") returned 4 [0197.630] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.631] lstrlenW (lpString=".7z") returned 3 [0197.631] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.631] lstrlenW (lpString=".dbf") returned 4 [0197.631] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.631] lstrlenW (lpString=".1cd") returned 4 [0197.631] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.631] lstrlenW (lpString=".jpg") returned 4 [0197.631] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.631] lstrlenW (lpString=".doc") returned 4 [0197.631] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.631] lstrlenW (lpString=".docx") returned 5 [0197.631] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.631] lstrlenW (lpString=".pdf") returned 4 [0197.631] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.631] lstrlenW (lpString=".xls") returned 4 [0197.631] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.631] lstrlenW (lpString=".xlsx") returned 5 [0197.631] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.631] lstrlenW (lpString=".ppt") returned 4 [0197.631] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.631] lstrlenW (lpString=".zip") returned 4 [0197.631] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.631] lstrlenW (lpString=".rar") returned 4 [0197.631] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.631] lstrlenW (lpString=".bz2") returned 4 [0197.631] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.631] lstrlenW (lpString=".7z") returned 3 [0197.632] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.632] lstrlenW (lpString=".dbf") returned 4 [0197.632] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.632] lstrlenW (lpString=".1cd") returned 4 [0197.632] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ar\\messages.json") returned 160 [0197.632] lstrlenW (lpString=".jpg") returned 4 [0197.632] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.632] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.632] lstrlenW (lpString="messages.json") returned 13 [0197.632] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.632] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=19299) returned 1 [0197.632] CloseHandle (hObject=0x150) returned 1 [0197.633] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json")) returned 0x2020 [0197.633] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.633] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.633] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.634] GetLastError () returned 0x0 [0197.634] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x4b63, lpOverlapped=0x0) returned 1 [0197.804] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4b70, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4b70, lpOverlapped=0x0) returned 1 [0197.805] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.805] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.805] SetEndOfFile (hFile=0x358) returned 1 [0197.805] CloseHandle (hObject=0x358) returned 1 [0197.805] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.805] SetEndOfFile (hFile=0x150) returned 1 [0197.806] CloseHandle (hObject=0x150) returned 1 [0197.806] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.806] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json")) returned 1 [0197.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.807] lstrlenW (lpString=".doc") returned 4 [0197.807] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.807] lstrlenW (lpString=".docx") returned 5 [0197.807] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.807] lstrlenW (lpString=".pdf") returned 4 [0197.807] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.807] lstrlenW (lpString=".xls") returned 4 [0197.807] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.807] lstrlenW (lpString=".xlsx") returned 5 [0197.807] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.807] lstrlenW (lpString=".ppt") returned 4 [0197.807] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.807] lstrlenW (lpString=".zip") returned 4 [0197.807] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.807] lstrlenW (lpString=".rar") returned 4 [0197.807] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.807] lstrlenW (lpString=".bz2") returned 4 [0197.807] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.807] lstrlenW (lpString=".7z") returned 3 [0197.807] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.807] lstrlenW (lpString=".dbf") returned 4 [0197.807] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.807] lstrlenW (lpString=".1cd") returned 4 [0197.807] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.808] lstrlenW (lpString=".jpg") returned 4 [0197.808] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.808] lstrlenW (lpString=".doc") returned 4 [0197.808] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.808] lstrlenW (lpString=".docx") returned 5 [0197.808] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.808] lstrlenW (lpString=".pdf") returned 4 [0197.808] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.808] lstrlenW (lpString=".xls") returned 4 [0197.808] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.808] lstrlenW (lpString=".xlsx") returned 5 [0197.808] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.808] lstrlenW (lpString=".ppt") returned 4 [0197.808] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.808] lstrlenW (lpString=".zip") returned 4 [0197.808] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.808] lstrlenW (lpString=".rar") returned 4 [0197.808] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.808] lstrlenW (lpString=".bz2") returned 4 [0197.808] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.808] lstrlenW (lpString=".7z") returned 3 [0197.808] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.808] lstrlenW (lpString=".dbf") returned 4 [0197.808] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.808] lstrlenW (lpString=".1cd") returned 4 [0197.808] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bg\\messages.json") returned 160 [0197.808] lstrlenW (lpString=".jpg") returned 4 [0197.808] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.809] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.809] lstrlenW (lpString="messages.json") returned 13 [0197.809] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.809] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16799) returned 1 [0197.809] CloseHandle (hObject=0x150) returned 1 [0197.809] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json")) returned 0x2020 [0197.810] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.810] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.810] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.810] GetLastError () returned 0x0 [0197.810] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x419f, lpOverlapped=0x0) returned 1 [0197.812] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x41a0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x41a0, lpOverlapped=0x0) returned 1 [0197.813] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.813] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.814] SetEndOfFile (hFile=0x358) returned 1 [0197.814] CloseHandle (hObject=0x358) returned 1 [0197.814] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.814] SetEndOfFile (hFile=0x150) returned 1 [0197.815] CloseHandle (hObject=0x150) returned 1 [0197.815] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.815] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json")) returned 1 [0197.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.815] lstrlenW (lpString=".doc") returned 4 [0197.815] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.815] lstrlenW (lpString=".docx") returned 5 [0197.815] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.815] lstrlenW (lpString=".pdf") returned 4 [0197.815] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.815] lstrlenW (lpString=".xls") returned 4 [0197.815] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.815] lstrlenW (lpString=".xlsx") returned 5 [0197.815] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.815] lstrlenW (lpString=".ppt") returned 4 [0197.815] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.815] lstrlenW (lpString=".zip") returned 4 [0197.815] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.815] lstrlenW (lpString=".rar") returned 4 [0197.815] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.816] lstrlenW (lpString=".bz2") returned 4 [0197.816] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.816] lstrlenW (lpString=".7z") returned 3 [0197.816] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.816] lstrlenW (lpString=".dbf") returned 4 [0197.816] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.816] lstrlenW (lpString=".1cd") returned 4 [0197.816] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.816] lstrlenW (lpString=".jpg") returned 4 [0197.816] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.816] lstrlenW (lpString=".doc") returned 4 [0197.816] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.816] lstrlenW (lpString=".docx") returned 5 [0197.816] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.816] lstrlenW (lpString=".pdf") returned 4 [0197.816] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.816] lstrlenW (lpString=".xls") returned 4 [0197.816] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.816] lstrlenW (lpString=".xlsx") returned 5 [0197.816] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.816] lstrlenW (lpString=".ppt") returned 4 [0197.816] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.816] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.816] lstrlenW (lpString=".zip") returned 4 [0197.816] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.816] lstrlenW (lpString=".rar") returned 4 [0197.816] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.816] lstrlenW (lpString=".bz2") returned 4 [0197.817] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.817] lstrlenW (lpString=".7z") returned 3 [0197.817] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.817] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.817] lstrlenW (lpString=".dbf") returned 4 [0197.817] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.817] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.817] lstrlenW (lpString=".1cd") returned 4 [0197.817] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.817] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\fr\\messages.json") returned 160 [0197.817] lstrlenW (lpString=".jpg") returned 4 [0197.817] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.817] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.817] lstrlenW (lpString="messages.json") returned 13 [0197.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.818] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=20601) returned 1 [0197.818] CloseHandle (hObject=0x150) returned 1 [0197.818] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json")) returned 0x2020 [0197.818] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.818] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.818] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.818] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.818] GetLastError () returned 0x0 [0197.819] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x5079, lpOverlapped=0x0) returned 1 [0197.821] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x5080, lpOverlapped=0x0) returned 1 [0197.822] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.822] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.822] SetEndOfFile (hFile=0x358) returned 1 [0197.822] CloseHandle (hObject=0x358) returned 1 [0197.822] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.823] SetEndOfFile (hFile=0x150) returned 1 [0197.823] CloseHandle (hObject=0x150) returned 1 [0197.823] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.824] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json")) returned 1 [0197.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.824] lstrlenW (lpString=".doc") returned 4 [0197.824] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.824] lstrlenW (lpString=".docx") returned 5 [0197.824] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.824] lstrlenW (lpString=".pdf") returned 4 [0197.824] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.824] lstrlenW (lpString=".xls") returned 4 [0197.824] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.824] lstrlenW (lpString=".xlsx") returned 5 [0197.824] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.824] lstrlenW (lpString=".ppt") returned 4 [0197.824] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.824] lstrlenW (lpString=".zip") returned 4 [0197.824] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.824] lstrlenW (lpString=".rar") returned 4 [0197.824] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.824] lstrlenW (lpString=".bz2") returned 4 [0197.824] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.824] lstrlenW (lpString=".7z") returned 3 [0197.824] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.824] lstrlenW (lpString=".dbf") returned 4 [0197.824] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.825] lstrlenW (lpString=".1cd") returned 4 [0197.825] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.825] lstrlenW (lpString=".jpg") returned 4 [0197.825] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.825] lstrlenW (lpString=".doc") returned 4 [0197.825] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.825] lstrlenW (lpString=".docx") returned 5 [0197.825] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.825] lstrlenW (lpString=".pdf") returned 4 [0197.825] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.825] lstrlenW (lpString=".xls") returned 4 [0197.825] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.825] lstrlenW (lpString=".xlsx") returned 5 [0197.825] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.825] lstrlenW (lpString=".ppt") returned 4 [0197.825] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.825] lstrlenW (lpString=".zip") returned 4 [0197.825] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.825] lstrlenW (lpString=".rar") returned 4 [0197.825] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.825] lstrlenW (lpString=".bz2") returned 4 [0197.825] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.825] lstrlenW (lpString=".7z") returned 3 [0197.825] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.825] lstrlenW (lpString=".dbf") returned 4 [0197.825] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.825] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.825] lstrlenW (lpString=".1cd") returned 4 [0197.826] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\gu\\messages.json") returned 160 [0197.826] lstrlenW (lpString=".jpg") returned 4 [0197.826] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.826] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.826] lstrlenW (lpString="messages.json") returned 13 [0197.826] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.826] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=20727) returned 1 [0197.826] CloseHandle (hObject=0x150) returned 1 [0197.826] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json")) returned 0x2020 [0197.827] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.827] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.827] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.827] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.827] GetLastError () returned 0x0 [0197.827] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x50f7, lpOverlapped=0x0) returned 1 [0197.829] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5100, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x5100, lpOverlapped=0x0) returned 1 [0197.830] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.830] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.830] SetEndOfFile (hFile=0x358) returned 1 [0197.831] CloseHandle (hObject=0x358) returned 1 [0197.831] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.831] SetEndOfFile (hFile=0x150) returned 1 [0197.831] CloseHandle (hObject=0x150) returned 1 [0197.832] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.832] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json")) returned 1 [0197.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.832] lstrlenW (lpString=".doc") returned 4 [0197.832] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.832] lstrlenW (lpString=".docx") returned 5 [0197.832] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.832] lstrlenW (lpString=".pdf") returned 4 [0197.832] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.832] lstrlenW (lpString=".xls") returned 4 [0197.832] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.832] lstrlenW (lpString=".xlsx") returned 5 [0197.832] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.832] lstrlenW (lpString=".ppt") returned 4 [0197.832] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.832] lstrlenW (lpString=".zip") returned 4 [0197.832] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.832] lstrlenW (lpString=".rar") returned 4 [0197.832] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.832] lstrlenW (lpString=".bz2") returned 4 [0197.832] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.832] lstrlenW (lpString=".7z") returned 3 [0197.832] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.833] lstrlenW (lpString=".dbf") returned 4 [0197.833] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.833] lstrlenW (lpString=".1cd") returned 4 [0197.833] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.833] lstrlenW (lpString=".jpg") returned 4 [0197.833] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.833] lstrlenW (lpString=".doc") returned 4 [0197.833] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.833] lstrlenW (lpString=".docx") returned 5 [0197.833] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.833] lstrlenW (lpString=".pdf") returned 4 [0197.833] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.833] lstrlenW (lpString=".xls") returned 4 [0197.833] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.833] lstrlenW (lpString=".xlsx") returned 5 [0197.833] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.833] lstrlenW (lpString=".ppt") returned 4 [0197.833] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.833] lstrlenW (lpString=".zip") returned 4 [0197.833] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.833] lstrlenW (lpString=".rar") returned 4 [0197.833] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.833] lstrlenW (lpString=".bz2") returned 4 [0197.833] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.833] lstrlenW (lpString=".7z") returned 3 [0197.833] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.833] lstrlenW (lpString=".dbf") returned 4 [0197.833] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.834] lstrlenW (lpString=".1cd") returned 4 [0197.834] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hi\\messages.json") returned 160 [0197.834] lstrlenW (lpString=".jpg") returned 4 [0197.834] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.834] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.834] lstrlenW (lpString="messages.json") returned 13 [0197.834] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.834] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16370) returned 1 [0197.834] CloseHandle (hObject=0x150) returned 1 [0197.834] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json")) returned 0x2020 [0197.835] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.835] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.835] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.835] GetLastError () returned 0x0 [0197.836] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x3ff2, lpOverlapped=0x0) returned 1 [0197.838] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4000, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4000, lpOverlapped=0x0) returned 1 [0197.839] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0197.839] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.839] SetEndOfFile (hFile=0x358) returned 1 [0197.839] CloseHandle (hObject=0x358) returned 1 [0197.840] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.840] SetEndOfFile (hFile=0x150) returned 1 [0197.840] CloseHandle (hObject=0x150) returned 1 [0197.840] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.841] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json")) returned 1 [0197.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.841] lstrlenW (lpString=".doc") returned 4 [0197.841] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.841] lstrlenW (lpString=".docx") returned 5 [0197.841] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.841] lstrlenW (lpString=".pdf") returned 4 [0197.841] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.841] lstrlenW (lpString=".xls") returned 4 [0197.841] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.841] lstrlenW (lpString=".xlsx") returned 5 [0197.841] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.841] lstrlenW (lpString=".ppt") returned 4 [0197.841] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.841] lstrlenW (lpString=".zip") returned 4 [0197.841] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.841] lstrlenW (lpString=".rar") returned 4 [0197.841] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.841] lstrlenW (lpString=".bz2") returned 4 [0197.841] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.841] lstrlenW (lpString=".7z") returned 3 [0197.841] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.841] lstrlenW (lpString=".dbf") returned 4 [0197.841] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.842] lstrlenW (lpString=".1cd") returned 4 [0197.842] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.842] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.842] lstrlenW (lpString=".jpg") returned 4 [0197.842] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.842] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.842] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.842] lstrlenW (lpString=".doc") returned 4 [0197.842] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.842] lstrlenW (lpString=".docx") returned 5 [0197.842] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.842] lstrlenW (lpString=".pdf") returned 4 [0197.842] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.842] lstrlenW (lpString=".xls") returned 4 [0197.842] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.842] lstrlenW (lpString=".xlsx") returned 5 [0197.842] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.842] lstrlenW (lpString=".ppt") returned 4 [0197.842] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.842] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.842] lstrlenW (lpString=".zip") returned 4 [0197.842] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.842] lstrlenW (lpString=".rar") returned 4 [0197.842] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.842] lstrlenW (lpString=".bz2") returned 4 [0197.842] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.842] lstrlenW (lpString=".7z") returned 3 [0197.842] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.842] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.842] lstrlenW (lpString=".dbf") returned 4 [0197.842] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.842] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.842] lstrlenW (lpString=".1cd") returned 4 [0197.842] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hr\\messages.json") returned 160 [0197.843] lstrlenW (lpString=".jpg") returned 4 [0197.843] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.843] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.843] lstrlenW (lpString="messages.json") returned 13 [0197.843] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.843] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16596) returned 1 [0197.843] CloseHandle (hObject=0x150) returned 1 [0197.843] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json")) returned 0x2020 [0197.843] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.844] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.844] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0197.844] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.844] GetLastError () returned 0x0 [0197.844] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x40d4, lpOverlapped=0x0) returned 1 [0198.008] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x40e0, lpOverlapped=0x0) returned 1 [0198.009] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.009] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.009] SetEndOfFile (hFile=0x358) returned 1 [0198.010] CloseHandle (hObject=0x358) returned 1 [0198.010] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.010] SetEndOfFile (hFile=0x150) returned 1 [0198.010] CloseHandle (hObject=0x150) returned 1 [0198.011] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.011] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json")) returned 1 [0198.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.011] lstrlenW (lpString=".doc") returned 4 [0198.011] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.011] lstrlenW (lpString=".docx") returned 5 [0198.011] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.011] lstrlenW (lpString=".pdf") returned 4 [0198.011] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.011] lstrlenW (lpString=".xls") returned 4 [0198.011] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.011] lstrlenW (lpString=".xlsx") returned 5 [0198.011] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.011] lstrlenW (lpString=".ppt") returned 4 [0198.011] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.011] lstrlenW (lpString=".zip") returned 4 [0198.011] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.011] lstrlenW (lpString=".rar") returned 4 [0198.011] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.011] lstrlenW (lpString=".bz2") returned 4 [0198.011] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.011] lstrlenW (lpString=".7z") returned 3 [0198.011] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.012] lstrlenW (lpString=".dbf") returned 4 [0198.012] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.012] lstrlenW (lpString=".1cd") returned 4 [0198.012] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.012] lstrlenW (lpString=".jpg") returned 4 [0198.012] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.012] lstrlenW (lpString=".doc") returned 4 [0198.012] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.012] lstrlenW (lpString=".docx") returned 5 [0198.012] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.012] lstrlenW (lpString=".pdf") returned 4 [0198.012] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.012] lstrlenW (lpString=".xls") returned 4 [0198.012] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.012] lstrlenW (lpString=".xlsx") returned 5 [0198.012] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.012] lstrlenW (lpString=".ppt") returned 4 [0198.012] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.012] lstrlenW (lpString=".zip") returned 4 [0198.012] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.012] lstrlenW (lpString=".rar") returned 4 [0198.012] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.012] lstrlenW (lpString=".bz2") returned 4 [0198.012] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.012] lstrlenW (lpString=".7z") returned 3 [0198.012] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.012] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.012] lstrlenW (lpString=".dbf") returned 4 [0198.013] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.013] lstrlenW (lpString=".1cd") returned 4 [0198.013] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.013] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\hu\\messages.json") returned 160 [0198.013] lstrlenW (lpString=".jpg") returned 4 [0198.013] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.013] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.013] lstrlenW (lpString="messages.json") returned 13 [0198.013] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.013] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16348) returned 1 [0198.013] CloseHandle (hObject=0x150) returned 1 [0198.013] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json")) returned 0x2020 [0198.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.014] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.014] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.014] GetLastError () returned 0x0 [0198.014] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x3fdc, lpOverlapped=0x0) returned 1 [0198.016] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0198.017] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.017] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.017] SetEndOfFile (hFile=0x358) returned 1 [0198.018] CloseHandle (hObject=0x358) returned 1 [0198.018] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.018] SetEndOfFile (hFile=0x150) returned 1 [0198.018] CloseHandle (hObject=0x150) returned 1 [0198.018] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.019] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json")) returned 1 [0198.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.019] lstrlenW (lpString=".doc") returned 4 [0198.019] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.019] lstrlenW (lpString=".docx") returned 5 [0198.019] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.019] lstrlenW (lpString=".pdf") returned 4 [0198.019] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.019] lstrlenW (lpString=".xls") returned 4 [0198.019] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.019] lstrlenW (lpString=".xlsx") returned 5 [0198.019] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.019] lstrlenW (lpString=".ppt") returned 4 [0198.019] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.019] lstrlenW (lpString=".zip") returned 4 [0198.019] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.019] lstrlenW (lpString=".rar") returned 4 [0198.019] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.019] lstrlenW (lpString=".bz2") returned 4 [0198.019] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.019] lstrlenW (lpString=".7z") returned 3 [0198.019] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.020] lstrlenW (lpString=".dbf") returned 4 [0198.020] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.020] lstrlenW (lpString=".1cd") returned 4 [0198.020] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.020] lstrlenW (lpString=".jpg") returned 4 [0198.020] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.020] lstrlenW (lpString=".doc") returned 4 [0198.020] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.020] lstrlenW (lpString=".docx") returned 5 [0198.020] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.020] lstrlenW (lpString=".pdf") returned 4 [0198.020] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.020] lstrlenW (lpString=".xls") returned 4 [0198.020] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.020] lstrlenW (lpString=".xlsx") returned 5 [0198.020] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.020] lstrlenW (lpString=".ppt") returned 4 [0198.020] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.020] lstrlenW (lpString=".zip") returned 4 [0198.020] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.020] lstrlenW (lpString=".rar") returned 4 [0198.020] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.020] lstrlenW (lpString=".bz2") returned 4 [0198.020] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.020] lstrlenW (lpString=".7z") returned 3 [0198.020] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.020] lstrlenW (lpString=".dbf") returned 4 [0198.020] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.021] lstrlenW (lpString=".1cd") returned 4 [0198.021] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt\\messages.json") returned 160 [0198.021] lstrlenW (lpString=".jpg") returned 4 [0198.021] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.021] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.021] lstrlenW (lpString="messages.json") returned 13 [0198.021] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.021] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16348) returned 1 [0198.021] CloseHandle (hObject=0x150) returned 1 [0198.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0198.021] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.022] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.022] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.022] GetLastError () returned 0x0 [0198.022] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x3fdc, lpOverlapped=0x0) returned 1 [0198.026] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0198.027] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.028] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.028] SetEndOfFile (hFile=0x358) returned 1 [0198.028] CloseHandle (hObject=0x358) returned 1 [0198.028] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.028] SetEndOfFile (hFile=0x150) returned 1 [0198.029] CloseHandle (hObject=0x150) returned 1 [0198.029] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.029] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_br\\messages.json")) returned 1 [0198.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.029] lstrlenW (lpString=".doc") returned 4 [0198.029] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.029] lstrlenW (lpString=".docx") returned 5 [0198.029] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.029] lstrlenW (lpString=".pdf") returned 4 [0198.029] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.029] lstrlenW (lpString=".xls") returned 4 [0198.029] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.030] lstrlenW (lpString=".xlsx") returned 5 [0198.030] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.030] lstrlenW (lpString=".ppt") returned 4 [0198.030] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.030] lstrlenW (lpString=".zip") returned 4 [0198.030] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.030] lstrlenW (lpString=".rar") returned 4 [0198.030] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.030] lstrlenW (lpString=".bz2") returned 4 [0198.030] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.030] lstrlenW (lpString=".7z") returned 3 [0198.030] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.030] lstrlenW (lpString=".dbf") returned 4 [0198.030] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.030] lstrlenW (lpString=".1cd") returned 4 [0198.030] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.030] lstrlenW (lpString=".jpg") returned 4 [0198.030] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.030] lstrlenW (lpString=".doc") returned 4 [0198.030] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.030] lstrlenW (lpString=".docx") returned 5 [0198.030] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.030] lstrlenW (lpString=".pdf") returned 4 [0198.030] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.030] lstrlenW (lpString=".xls") returned 4 [0198.030] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.030] lstrlenW (lpString=".xlsx") returned 5 [0198.031] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.031] lstrlenW (lpString=".ppt") returned 4 [0198.031] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.031] lstrlenW (lpString=".zip") returned 4 [0198.031] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.031] lstrlenW (lpString=".rar") returned 4 [0198.031] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.031] lstrlenW (lpString=".bz2") returned 4 [0198.031] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.031] lstrlenW (lpString=".7z") returned 3 [0198.031] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.031] lstrlenW (lpString=".dbf") returned 4 [0198.031] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.031] lstrlenW (lpString=".1cd") returned 4 [0198.031] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.031] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_BR\\messages.json") returned 163 [0198.031] lstrlenW (lpString=".jpg") returned 4 [0198.031] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.031] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.031] lstrlenW (lpString="messages.json") returned 13 [0198.031] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.032] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16348) returned 1 [0198.032] CloseHandle (hObject=0x150) returned 1 [0198.032] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0198.032] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.032] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.032] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.032] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.033] GetLastError () returned 0x0 [0198.033] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x3fdc, lpOverlapped=0x0) returned 1 [0198.035] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0198.036] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.036] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.036] SetEndOfFile (hFile=0x358) returned 1 [0198.036] CloseHandle (hObject=0x358) returned 1 [0198.036] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.036] SetEndOfFile (hFile=0x150) returned 1 [0198.037] CloseHandle (hObject=0x150) returned 1 [0198.037] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.037] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_pt\\messages.json")) returned 1 [0198.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.038] lstrlenW (lpString=".doc") returned 4 [0198.038] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.038] lstrlenW (lpString=".docx") returned 5 [0198.038] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.038] lstrlenW (lpString=".pdf") returned 4 [0198.038] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.038] lstrlenW (lpString=".xls") returned 4 [0198.038] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.038] lstrlenW (lpString=".xlsx") returned 5 [0198.038] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.038] lstrlenW (lpString=".ppt") returned 4 [0198.038] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.038] lstrlenW (lpString=".zip") returned 4 [0198.038] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.038] lstrlenW (lpString=".rar") returned 4 [0198.038] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.038] lstrlenW (lpString=".bz2") returned 4 [0198.038] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.038] lstrlenW (lpString=".7z") returned 3 [0198.038] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.039] lstrlenW (lpString=".dbf") returned 4 [0198.039] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.039] lstrlenW (lpString=".1cd") returned 4 [0198.039] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.039] lstrlenW (lpString=".jpg") returned 4 [0198.039] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.039] lstrlenW (lpString=".doc") returned 4 [0198.039] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.039] lstrlenW (lpString=".docx") returned 5 [0198.039] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.039] lstrlenW (lpString=".pdf") returned 4 [0198.039] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.039] lstrlenW (lpString=".xls") returned 4 [0198.039] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.039] lstrlenW (lpString=".xlsx") returned 5 [0198.039] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.039] lstrlenW (lpString=".ppt") returned 4 [0198.039] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.039] lstrlenW (lpString=".zip") returned 4 [0198.039] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.039] lstrlenW (lpString=".rar") returned 4 [0198.039] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.039] lstrlenW (lpString=".bz2") returned 4 [0198.039] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.039] lstrlenW (lpString=".7z") returned 3 [0198.039] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.039] lstrlenW (lpString=".dbf") returned 4 [0198.040] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.040] lstrlenW (lpString=".1cd") returned 4 [0198.040] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\pt_PT\\messages.json") returned 163 [0198.040] lstrlenW (lpString=".jpg") returned 4 [0198.040] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.040] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.040] lstrlenW (lpString="messages.json") returned 13 [0198.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.041] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16603) returned 1 [0198.041] CloseHandle (hObject=0x150) returned 1 [0198.041] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json")) returned 0x2020 [0198.041] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.041] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.041] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.042] GetLastError () returned 0x0 [0198.042] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x40db, lpOverlapped=0x0) returned 1 [0198.043] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x40e0, lpOverlapped=0x0) returned 1 [0198.044] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.044] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.045] SetEndOfFile (hFile=0x358) returned 1 [0198.045] CloseHandle (hObject=0x358) returned 1 [0198.045] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.045] SetEndOfFile (hFile=0x150) returned 1 [0198.046] CloseHandle (hObject=0x150) returned 1 [0198.046] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.046] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json")) returned 1 [0198.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.046] lstrlenW (lpString=".doc") returned 4 [0198.046] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.046] lstrlenW (lpString=".docx") returned 5 [0198.046] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.046] lstrlenW (lpString=".pdf") returned 4 [0198.046] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.046] lstrlenW (lpString=".xls") returned 4 [0198.046] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.046] lstrlenW (lpString=".xlsx") returned 5 [0198.046] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.046] lstrlenW (lpString=".ppt") returned 4 [0198.046] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.046] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.046] lstrlenW (lpString=".zip") returned 4 [0198.047] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.047] lstrlenW (lpString=".rar") returned 4 [0198.047] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.047] lstrlenW (lpString=".bz2") returned 4 [0198.047] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.047] lstrlenW (lpString=".7z") returned 3 [0198.047] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.047] lstrlenW (lpString=".dbf") returned 4 [0198.047] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.047] lstrlenW (lpString=".1cd") returned 4 [0198.047] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.047] lstrlenW (lpString=".jpg") returned 4 [0198.047] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.047] lstrlenW (lpString=".doc") returned 4 [0198.047] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.047] lstrlenW (lpString=".docx") returned 5 [0198.047] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.047] lstrlenW (lpString=".pdf") returned 4 [0198.047] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.047] lstrlenW (lpString=".xls") returned 4 [0198.047] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.047] lstrlenW (lpString=".xlsx") returned 5 [0198.047] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.047] lstrlenW (lpString=".ppt") returned 4 [0198.047] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.047] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.047] lstrlenW (lpString=".zip") returned 4 [0198.047] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.048] lstrlenW (lpString=".rar") returned 4 [0198.048] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.048] lstrlenW (lpString=".bz2") returned 4 [0198.048] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.048] lstrlenW (lpString=".7z") returned 3 [0198.048] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.048] lstrlenW (lpString=".dbf") returned 4 [0198.048] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.048] lstrlenW (lpString=".1cd") returned 4 [0198.048] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.048] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ro\\messages.json") returned 160 [0198.048] lstrlenW (lpString=".jpg") returned 4 [0198.048] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.048] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.048] lstrlenW (lpString="messages.json") returned 13 [0198.048] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.049] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=18702) returned 1 [0198.049] CloseHandle (hObject=0x150) returned 1 [0198.049] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json")) returned 0x2020 [0198.049] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.049] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.049] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.049] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.050] GetLastError () returned 0x0 [0198.050] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x490e, lpOverlapped=0x0) returned 1 [0198.230] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4910, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4910, lpOverlapped=0x0) returned 1 [0198.231] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.231] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.231] SetEndOfFile (hFile=0x358) returned 1 [0198.232] CloseHandle (hObject=0x358) returned 1 [0198.232] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.232] SetEndOfFile (hFile=0x150) returned 1 [0198.232] CloseHandle (hObject=0x150) returned 1 [0198.233] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.233] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json")) returned 1 [0198.233] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.233] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.233] lstrlenW (lpString=".doc") returned 4 [0198.233] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.233] lstrlenW (lpString=".docx") returned 5 [0198.233] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.233] lstrlenW (lpString=".pdf") returned 4 [0198.233] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.233] lstrlenW (lpString=".xls") returned 4 [0198.233] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.233] lstrlenW (lpString=".xlsx") returned 5 [0198.233] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.233] lstrlenW (lpString=".ppt") returned 4 [0198.233] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.233] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.233] lstrlenW (lpString=".zip") returned 4 [0198.233] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.233] lstrlenW (lpString=".rar") returned 4 [0198.233] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.233] lstrlenW (lpString=".bz2") returned 4 [0198.234] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.234] lstrlenW (lpString=".7z") returned 3 [0198.234] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.234] lstrlenW (lpString=".dbf") returned 4 [0198.234] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.234] lstrlenW (lpString=".1cd") returned 4 [0198.234] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.234] lstrlenW (lpString=".jpg") returned 4 [0198.234] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.234] lstrlenW (lpString=".doc") returned 4 [0198.234] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.234] lstrlenW (lpString=".docx") returned 5 [0198.234] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.234] lstrlenW (lpString=".pdf") returned 4 [0198.234] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.234] lstrlenW (lpString=".xls") returned 4 [0198.234] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.234] lstrlenW (lpString=".xlsx") returned 5 [0198.234] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.234] lstrlenW (lpString=".ppt") returned 4 [0198.234] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.234] lstrlenW (lpString=".zip") returned 4 [0198.234] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.234] lstrlenW (lpString=".rar") returned 4 [0198.234] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.234] lstrlenW (lpString=".bz2") returned 4 [0198.234] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.235] lstrlenW (lpString=".7z") returned 3 [0198.235] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.235] lstrlenW (lpString=".dbf") returned 4 [0198.235] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.235] lstrlenW (lpString=".1cd") returned 4 [0198.235] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ru\\messages.json") returned 160 [0198.235] lstrlenW (lpString=".jpg") returned 4 [0198.235] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.235] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.235] lstrlenW (lpString="messages.json") returned 13 [0198.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.236] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=15730) returned 1 [0198.236] CloseHandle (hObject=0x150) returned 1 [0198.236] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0198.236] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.236] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.236] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.237] GetLastError () returned 0x0 [0198.237] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x3d72, lpOverlapped=0x0) returned 1 [0198.238] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0198.239] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.239] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.240] SetEndOfFile (hFile=0x358) returned 1 [0198.240] CloseHandle (hObject=0x358) returned 1 [0198.240] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.240] SetEndOfFile (hFile=0x150) returned 1 [0198.241] CloseHandle (hObject=0x150) returned 1 [0198.241] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.241] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_tw\\messages.json")) returned 1 [0198.241] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.241] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.241] lstrlenW (lpString=".doc") returned 4 [0198.241] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.241] lstrlenW (lpString=".docx") returned 5 [0198.241] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.242] lstrlenW (lpString=".pdf") returned 4 [0198.242] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.242] lstrlenW (lpString=".xls") returned 4 [0198.242] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.242] lstrlenW (lpString=".xlsx") returned 5 [0198.242] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.242] lstrlenW (lpString=".ppt") returned 4 [0198.242] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.242] lstrlenW (lpString=".zip") returned 4 [0198.242] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.242] lstrlenW (lpString=".rar") returned 4 [0198.242] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.242] lstrlenW (lpString=".bz2") returned 4 [0198.242] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.242] lstrlenW (lpString=".7z") returned 3 [0198.242] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.242] lstrlenW (lpString=".dbf") returned 4 [0198.242] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.242] lstrlenW (lpString=".1cd") returned 4 [0198.242] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.242] lstrlenW (lpString=".jpg") returned 4 [0198.242] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.242] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.242] lstrlenW (lpString=".doc") returned 4 [0198.242] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.242] lstrlenW (lpString=".docx") returned 5 [0198.242] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.242] lstrlenW (lpString=".pdf") returned 4 [0198.243] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.243] lstrlenW (lpString=".xls") returned 4 [0198.243] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.243] lstrlenW (lpString=".xlsx") returned 5 [0198.243] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.243] lstrlenW (lpString=".ppt") returned 4 [0198.243] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.243] lstrlenW (lpString=".zip") returned 4 [0198.243] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.243] lstrlenW (lpString=".rar") returned 4 [0198.243] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.243] lstrlenW (lpString=".bz2") returned 4 [0198.243] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.243] lstrlenW (lpString=".7z") returned 3 [0198.243] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.243] lstrlenW (lpString=".dbf") returned 4 [0198.243] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.243] lstrlenW (lpString=".1cd") returned 4 [0198.243] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\zh_TW\\messages.json") returned 163 [0198.243] lstrlenW (lpString=".jpg") returned 4 [0198.243] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.243] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.243] lstrlenW (lpString="computed_hashes.json") returned 20 [0198.243] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.244] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=29337) returned 1 [0198.244] CloseHandle (hObject=0x150) returned 1 [0198.244] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0198.244] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.244] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.244] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.244] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.246] GetLastError () returned 0x0 [0198.246] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x7299, lpOverlapped=0x0) returned 1 [0198.249] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x72a0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x72a0, lpOverlapped=0x0) returned 1 [0198.250] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.250] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xfc, lpOverlapped=0x0) returned 1 [0198.250] SetEndOfFile (hFile=0x358) returned 1 [0198.250] CloseHandle (hObject=0x358) returned 1 [0198.250] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.250] SetEndOfFile (hFile=0x150) returned 1 [0198.251] CloseHandle (hObject=0x150) returned 1 [0198.251] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.251] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json")) returned 1 [0198.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.252] lstrlenW (lpString=".doc") returned 4 [0198.252] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.252] lstrlenW (lpString=".docx") returned 5 [0198.252] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.252] lstrlenW (lpString=".pdf") returned 4 [0198.252] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.252] lstrlenW (lpString=".xls") returned 4 [0198.252] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.252] lstrlenW (lpString=".xlsx") returned 5 [0198.252] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.252] lstrlenW (lpString=".ppt") returned 4 [0198.252] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.252] lstrlenW (lpString=".zip") returned 4 [0198.252] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.252] lstrlenW (lpString=".rar") returned 4 [0198.252] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.252] lstrlenW (lpString=".bz2") returned 4 [0198.252] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.252] lstrlenW (lpString=".7z") returned 3 [0198.252] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.252] lstrlenW (lpString=".dbf") returned 4 [0198.252] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.252] lstrlenW (lpString=".1cd") returned 4 [0198.252] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.253] lstrlenW (lpString=".jpg") returned 4 [0198.253] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.253] lstrlenW (lpString=".doc") returned 4 [0198.253] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.253] lstrlenW (lpString=".docx") returned 5 [0198.253] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.253] lstrlenW (lpString=".pdf") returned 4 [0198.253] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.253] lstrlenW (lpString=".xls") returned 4 [0198.253] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.253] lstrlenW (lpString=".xlsx") returned 5 [0198.253] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.253] lstrlenW (lpString=".ppt") returned 4 [0198.253] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.253] lstrlenW (lpString=".zip") returned 4 [0198.253] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.253] lstrlenW (lpString=".rar") returned 4 [0198.253] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.253] lstrlenW (lpString=".bz2") returned 4 [0198.253] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.253] lstrlenW (lpString=".7z") returned 3 [0198.253] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.253] lstrlenW (lpString=".dbf") returned 4 [0198.253] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.253] lstrlenW (lpString=".1cd") returned 4 [0198.253] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\computed_hashes.json") returned 165 [0198.254] lstrlenW (lpString=".jpg") returned 4 [0198.254] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.254] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.254] lstrlenW (lpString="verified_contents.json") returned 22 [0198.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.254] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=15929) returned 1 [0198.254] CloseHandle (hObject=0x150) returned 1 [0198.257] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json")) returned 0x2020 [0198.257] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.257] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.258] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.258] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.258] GetLastError () returned 0x0 [0198.258] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x3e39, lpOverlapped=0x0) returned 1 [0198.260] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x3e40, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x3e40, lpOverlapped=0x0) returned 1 [0198.261] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.261] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x100, lpOverlapped=0x0) returned 1 [0198.261] SetEndOfFile (hFile=0x358) returned 1 [0198.261] CloseHandle (hObject=0x358) returned 1 [0198.262] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.262] SetEndOfFile (hFile=0x150) returned 1 [0198.262] CloseHandle (hObject=0x150) returned 1 [0198.262] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.263] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json")) returned 1 [0198.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.263] lstrlenW (lpString=".doc") returned 4 [0198.263] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.263] lstrlenW (lpString=".docx") returned 5 [0198.263] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.263] lstrlenW (lpString=".pdf") returned 4 [0198.263] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.263] lstrlenW (lpString=".xls") returned 4 [0198.263] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.263] lstrlenW (lpString=".xlsx") returned 5 [0198.263] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.263] lstrlenW (lpString=".ppt") returned 4 [0198.263] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.263] lstrlenW (lpString=".zip") returned 4 [0198.263] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.263] lstrlenW (lpString=".rar") returned 4 [0198.263] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.263] lstrlenW (lpString=".bz2") returned 4 [0198.263] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.263] lstrlenW (lpString=".7z") returned 3 [0198.263] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.263] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.263] lstrlenW (lpString=".dbf") returned 4 [0198.264] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.264] lstrlenW (lpString=".1cd") returned 4 [0198.264] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.264] lstrlenW (lpString=".jpg") returned 4 [0198.264] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.264] lstrlenW (lpString=".doc") returned 4 [0198.264] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.264] lstrlenW (lpString=".docx") returned 5 [0198.264] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.264] lstrlenW (lpString=".pdf") returned 4 [0198.264] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.264] lstrlenW (lpString=".xls") returned 4 [0198.264] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.264] lstrlenW (lpString=".xlsx") returned 5 [0198.264] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.264] lstrlenW (lpString=".ppt") returned 4 [0198.264] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.264] lstrlenW (lpString=".zip") returned 4 [0198.264] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.264] lstrlenW (lpString=".rar") returned 4 [0198.264] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.264] lstrlenW (lpString=".bz2") returned 4 [0198.264] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.264] lstrlenW (lpString=".7z") returned 3 [0198.264] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.264] lstrlenW (lpString=".dbf") returned 4 [0198.264] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.265] lstrlenW (lpString=".1cd") returned 4 [0198.265] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_metadata\\verified_contents.json") returned 167 [0198.265] lstrlenW (lpString=".jpg") returned 4 [0198.265] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.265] lstrcmpiW (lpString1=".log", lpString2=".wiki") returned -1 [0198.265] lstrlenW (lpString="000003.log") returned 10 [0198.265] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.266] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=0) returned 1 [0198.266] CloseHandle (hObject=0x150) returned 1 [0198.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.266] lstrlenW (lpString=".doc") returned 4 [0198.266] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0198.266] lstrlenW (lpString=".docx") returned 5 [0198.266] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0198.266] lstrlenW (lpString=".pdf") returned 4 [0198.266] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0198.266] lstrlenW (lpString=".xls") returned 4 [0198.266] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0198.266] lstrlenW (lpString=".xlsx") returned 5 [0198.266] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0198.266] lstrlenW (lpString=".ppt") returned 4 [0198.266] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0198.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.267] lstrlenW (lpString=".zip") returned 4 [0198.267] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0198.267] lstrlenW (lpString=".rar") returned 4 [0198.267] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0198.267] lstrlenW (lpString=".bz2") returned 4 [0198.267] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0198.267] lstrlenW (lpString=".7z") returned 3 [0198.267] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0198.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.267] lstrlenW (lpString=".dbf") returned 4 [0198.267] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0198.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.267] lstrlenW (lpString=".1cd") returned 4 [0198.267] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0198.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.267] lstrlenW (lpString=".jpg") returned 4 [0198.267] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0198.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.267] lstrlenW (lpString=".doc") returned 4 [0198.267] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0198.267] lstrlenW (lpString=".docx") returned 5 [0198.267] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0198.267] lstrlenW (lpString=".pdf") returned 4 [0198.267] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0198.267] lstrlenW (lpString=".xls") returned 4 [0198.267] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0198.267] lstrlenW (lpString=".xlsx") returned 5 [0198.267] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0198.267] lstrlenW (lpString=".ppt") returned 4 [0198.267] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0198.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.267] lstrlenW (lpString=".zip") returned 4 [0198.268] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0198.268] lstrlenW (lpString=".rar") returned 4 [0198.268] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0198.268] lstrlenW (lpString=".bz2") returned 4 [0198.268] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0198.268] lstrlenW (lpString=".7z") returned 3 [0198.268] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0198.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.268] lstrlenW (lpString=".dbf") returned 4 [0198.268] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0198.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.268] lstrlenW (lpString=".1cd") returned 4 [0198.268] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0198.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\000003.log") returned 144 [0198.268] lstrlenW (lpString=".jpg") returned 4 [0198.268] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0198.268] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.268] lstrlenW (lpString="previews_opt_out.db") returned 19 [0198.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.269] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16384) returned 1 [0198.269] CloseHandle (hObject=0x150) returned 1 [0198.269] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 0x2020 [0198.269] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.269] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.269] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.269] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0198.270] GetLastError () returned 0x0 [0198.270] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x4000, lpOverlapped=0x0) returned 1 [0198.470] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4010, lpOverlapped=0x0) returned 1 [0198.473] ReadFile (in: hFile=0x150, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.473] WriteFile (in: hFile=0x358, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xfa, lpOverlapped=0x0) returned 1 [0198.473] SetEndOfFile (hFile=0x358) returned 1 [0198.473] CloseHandle (hObject=0x358) returned 1 [0198.473] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.473] SetEndOfFile (hFile=0x150) returned 1 [0198.474] CloseHandle (hObject=0x150) returned 1 [0198.474] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.474] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db")) returned 1 [0198.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.475] lstrlenW (lpString=".doc") returned 4 [0198.475] lstrcmpiW (lpString1=".doc", lpString2="t.db") returned -1 [0198.475] lstrlenW (lpString=".docx") returned 5 [0198.475] lstrcmpiW (lpString1=".docx", lpString2="ut.db") returned -1 [0198.475] lstrlenW (lpString=".pdf") returned 4 [0198.475] lstrcmpiW (lpString1=".pdf", lpString2="t.db") returned -1 [0198.475] lstrlenW (lpString=".xls") returned 4 [0198.475] lstrcmpiW (lpString1=".xls", lpString2="t.db") returned -1 [0198.475] lstrlenW (lpString=".xlsx") returned 5 [0198.475] lstrcmpiW (lpString1=".xlsx", lpString2="ut.db") returned -1 [0198.475] lstrlenW (lpString=".ppt") returned 4 [0198.475] lstrcmpiW (lpString1=".ppt", lpString2="t.db") returned -1 [0198.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.475] lstrlenW (lpString=".zip") returned 4 [0198.475] lstrcmpiW (lpString1=".zip", lpString2="t.db") returned -1 [0198.475] lstrlenW (lpString=".rar") returned 4 [0198.475] lstrcmpiW (lpString1=".rar", lpString2="t.db") returned -1 [0198.475] lstrlenW (lpString=".bz2") returned 4 [0198.475] lstrcmpiW (lpString1=".bz2", lpString2="t.db") returned -1 [0198.475] lstrlenW (lpString=".7z") returned 3 [0198.475] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.475] lstrlenW (lpString=".dbf") returned 4 [0198.475] lstrcmpiW (lpString1=".dbf", lpString2="t.db") returned -1 [0198.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.475] lstrlenW (lpString=".1cd") returned 4 [0198.475] lstrcmpiW (lpString1=".1cd", lpString2="t.db") returned -1 [0198.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.475] lstrlenW (lpString=".jpg") returned 4 [0198.475] lstrcmpiW (lpString1=".jpg", lpString2="t.db") returned -1 [0198.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.476] lstrlenW (lpString=".doc") returned 4 [0198.476] lstrcmpiW (lpString1=".doc", lpString2="t.db") returned -1 [0198.476] lstrlenW (lpString=".docx") returned 5 [0198.476] lstrcmpiW (lpString1=".docx", lpString2="ut.db") returned -1 [0198.476] lstrlenW (lpString=".pdf") returned 4 [0198.476] lstrcmpiW (lpString1=".pdf", lpString2="t.db") returned -1 [0198.476] lstrlenW (lpString=".xls") returned 4 [0198.476] lstrcmpiW (lpString1=".xls", lpString2="t.db") returned -1 [0198.476] lstrlenW (lpString=".xlsx") returned 5 [0198.476] lstrcmpiW (lpString1=".xlsx", lpString2="ut.db") returned -1 [0198.476] lstrlenW (lpString=".ppt") returned 4 [0198.476] lstrcmpiW (lpString1=".ppt", lpString2="t.db") returned -1 [0198.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.476] lstrlenW (lpString=".zip") returned 4 [0198.476] lstrcmpiW (lpString1=".zip", lpString2="t.db") returned -1 [0198.476] lstrlenW (lpString=".rar") returned 4 [0198.476] lstrcmpiW (lpString1=".rar", lpString2="t.db") returned -1 [0198.476] lstrlenW (lpString=".bz2") returned 4 [0198.476] lstrcmpiW (lpString1=".bz2", lpString2="t.db") returned -1 [0198.476] lstrlenW (lpString=".7z") returned 3 [0198.476] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.476] lstrlenW (lpString=".dbf") returned 4 [0198.476] lstrcmpiW (lpString1=".dbf", lpString2="t.db") returned -1 [0198.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.476] lstrlenW (lpString=".1cd") returned 4 [0198.476] lstrcmpiW (lpString1=".1cd", lpString2="t.db") returned -1 [0198.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db") returned 95 [0198.476] lstrlenW (lpString=".jpg") returned 4 [0198.476] lstrcmpiW (lpString1=".jpg", lpString2="t.db") returned -1 [0198.477] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0198.477] lstrlenW (lpString="desktop.ini") returned 11 [0198.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.559] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=67) returned 1 [0198.559] CloseHandle (hObject=0x354) returned 1 [0198.559] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 0x2026 [0198.559] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.559] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.559] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.559] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.560] GetLastError () returned 0x0 [0198.560] ReadFile (in: hFile=0x354, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x43, lpOverlapped=0x0) returned 1 [0198.561] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x50, lpOverlapped=0x0) returned 1 [0198.562] ReadFile (in: hFile=0x354, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.562] WriteFile (in: hFile=0x388, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0198.562] SetEndOfFile (hFile=0x388) returned 1 [0198.562] CloseHandle (hObject=0x388) returned 1 [0198.562] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.562] SetEndOfFile (hFile=0x354) returned 1 [0198.563] CloseHandle (hObject=0x354) returned 1 [0198.563] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0198.563] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\desktop.ini")) returned 1 [0198.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.563] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.563] lstrlenW (lpString=".doc") returned 4 [0198.563] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.563] lstrlenW (lpString=".docx") returned 5 [0198.563] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.563] lstrlenW (lpString=".pdf") returned 4 [0198.563] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.563] lstrlenW (lpString=".xls") returned 4 [0198.563] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.563] lstrlenW (lpString=".xlsx") returned 5 [0198.563] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.563] lstrlenW (lpString=".ppt") returned 4 [0198.564] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.564] lstrlenW (lpString=".zip") returned 4 [0198.564] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.564] lstrlenW (lpString=".rar") returned 4 [0198.564] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.564] lstrlenW (lpString=".bz2") returned 4 [0198.564] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.564] lstrlenW (lpString=".7z") returned 3 [0198.564] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.564] lstrlenW (lpString=".dbf") returned 4 [0198.564] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.564] lstrlenW (lpString=".1cd") returned 4 [0198.564] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.564] lstrlenW (lpString=".jpg") returned 4 [0198.564] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.564] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.564] lstrlenW (lpString=".doc") returned 4 [0198.564] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.564] lstrlenW (lpString=".docx") returned 5 [0198.564] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.564] lstrlenW (lpString=".pdf") returned 4 [0198.564] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.564] lstrlenW (lpString=".xls") returned 4 [0198.564] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.564] lstrlenW (lpString=".xlsx") returned 5 [0198.564] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.564] lstrlenW (lpString=".ppt") returned 4 [0198.565] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.565] lstrlenW (lpString=".zip") returned 4 [0198.565] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.565] lstrlenW (lpString=".rar") returned 4 [0198.565] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.565] lstrlenW (lpString=".bz2") returned 4 [0198.565] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.565] lstrlenW (lpString=".7z") returned 3 [0198.565] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.565] lstrlenW (lpString=".dbf") returned 4 [0198.565] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.565] lstrlenW (lpString=".1cd") returned 4 [0198.565] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.565] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\desktop.ini") returned 86 [0198.565] lstrlenW (lpString=".jpg") returned 4 [0198.565] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.565] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0198.565] lstrlenW (lpString="index.dat") returned 9 [0198.565] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.633] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=32768) returned 1 [0198.633] CloseHandle (hObject=0x114) returned 1 [0198.634] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 0x2026 [0198.634] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.634] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.635] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.636] GetLastError () returned 0x0 [0198.636] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x8000, lpOverlapped=0x0) returned 1 [0198.644] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x8010, lpOverlapped=0x0) returned 1 [0198.645] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.646] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0198.646] SetEndOfFile (hFile=0x2d8) returned 1 [0198.646] CloseHandle (hObject=0x2d8) returned 1 [0198.646] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.646] SetEndOfFile (hFile=0x114) returned 1 [0198.647] CloseHandle (hObject=0x114) returned 1 [0198.647] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0198.647] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\index.dat")) returned 1 [0198.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.647] lstrlenW (lpString=".doc") returned 4 [0198.648] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.648] lstrlenW (lpString=".docx") returned 5 [0198.648] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0198.648] lstrlenW (lpString=".pdf") returned 4 [0198.648] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.648] lstrlenW (lpString=".xls") returned 4 [0198.648] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.648] lstrlenW (lpString=".xlsx") returned 5 [0198.648] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0198.648] lstrlenW (lpString=".ppt") returned 4 [0198.648] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.648] lstrlenW (lpString=".zip") returned 4 [0198.648] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.648] lstrlenW (lpString=".rar") returned 4 [0198.648] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.648] lstrlenW (lpString=".bz2") returned 4 [0198.648] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.648] lstrlenW (lpString=".7z") returned 3 [0198.648] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.648] lstrlenW (lpString=".dbf") returned 4 [0198.648] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.648] lstrlenW (lpString=".1cd") returned 4 [0198.648] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.648] lstrlenW (lpString=".jpg") returned 4 [0198.648] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.648] lstrlenW (lpString=".doc") returned 4 [0198.648] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.649] lstrlenW (lpString=".docx") returned 5 [0198.649] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0198.649] lstrlenW (lpString=".pdf") returned 4 [0198.649] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.649] lstrlenW (lpString=".xls") returned 4 [0198.649] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.649] lstrlenW (lpString=".xlsx") returned 5 [0198.649] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0198.649] lstrlenW (lpString=".ppt") returned 4 [0198.649] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.649] lstrlenW (lpString=".zip") returned 4 [0198.649] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.649] lstrlenW (lpString=".rar") returned 4 [0198.649] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.649] lstrlenW (lpString=".bz2") returned 4 [0198.649] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.649] lstrlenW (lpString=".7z") returned 3 [0198.649] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.649] lstrlenW (lpString=".dbf") returned 4 [0198.649] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.649] lstrlenW (lpString=".1cd") returned 4 [0198.649] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\index.dat") returned 75 [0198.649] lstrlenW (lpString=".jpg") returned 4 [0198.649] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.649] lstrcmpiW (lpString1=".DAT", lpString2=".wiki") returned -1 [0198.649] lstrlenW (lpString="MSIMGSIZ.DAT") returned 12 [0198.650] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.651] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16384) returned 1 [0198.651] CloseHandle (hObject=0x114) returned 1 [0198.651] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 0x2020 [0198.651] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.651] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.651] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.651] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.652] GetLastError () returned 0x0 [0198.652] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x4000, lpOverlapped=0x0) returned 1 [0198.653] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4010, lpOverlapped=0x0) returned 1 [0198.654] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.654] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.654] SetEndOfFile (hFile=0x2d8) returned 1 [0198.655] CloseHandle (hObject=0x2d8) returned 1 [0198.655] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.655] SetEndOfFile (hFile=0x114) returned 1 [0198.655] CloseHandle (hObject=0x114) returned 1 [0198.656] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.656] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\msimgsiz.dat")) returned 1 [0198.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.656] lstrlenW (lpString=".doc") returned 4 [0198.656] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0198.656] lstrlenW (lpString=".docx") returned 5 [0198.656] lstrcmpiW (lpString1=".docx", lpString2="Z.DAT") returned -1 [0198.656] lstrlenW (lpString=".pdf") returned 4 [0198.656] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0198.656] lstrlenW (lpString=".xls") returned 4 [0198.656] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0198.656] lstrlenW (lpString=".xlsx") returned 5 [0198.656] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DAT") returned -1 [0198.656] lstrlenW (lpString=".ppt") returned 4 [0198.656] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0198.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.656] lstrlenW (lpString=".zip") returned 4 [0198.656] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0198.656] lstrlenW (lpString=".rar") returned 4 [0198.656] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0198.656] lstrlenW (lpString=".bz2") returned 4 [0198.656] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0198.656] lstrlenW (lpString=".7z") returned 3 [0198.656] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0198.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.657] lstrlenW (lpString=".dbf") returned 4 [0198.657] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0198.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.657] lstrlenW (lpString=".1cd") returned 4 [0198.657] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0198.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.657] lstrlenW (lpString=".jpg") returned 4 [0198.657] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0198.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.657] lstrlenW (lpString=".doc") returned 4 [0198.657] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0198.657] lstrlenW (lpString=".docx") returned 5 [0198.657] lstrcmpiW (lpString1=".docx", lpString2="Z.DAT") returned -1 [0198.657] lstrlenW (lpString=".pdf") returned 4 [0198.657] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0198.657] lstrlenW (lpString=".xls") returned 4 [0198.657] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0198.657] lstrlenW (lpString=".xlsx") returned 5 [0198.657] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DAT") returned -1 [0198.657] lstrlenW (lpString=".ppt") returned 4 [0198.657] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0198.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.657] lstrlenW (lpString=".zip") returned 4 [0198.657] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0198.657] lstrlenW (lpString=".rar") returned 4 [0198.657] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0198.657] lstrlenW (lpString=".bz2") returned 4 [0198.657] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0198.657] lstrlenW (lpString=".7z") returned 3 [0198.657] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0198.657] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.658] lstrlenW (lpString=".dbf") returned 4 [0198.658] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0198.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.658] lstrlenW (lpString=".1cd") returned 4 [0198.658] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0198.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT") returned 84 [0198.658] lstrlenW (lpString=".jpg") returned 4 [0198.658] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0198.658] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0198.658] lstrlenW (lpString="RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 56 [0198.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.659] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=3584) returned 1 [0198.659] CloseHandle (hObject=0x114) returned 1 [0198.659] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 0x2020 [0198.659] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.659] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.659] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.659] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.660] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.660] GetLastError () returned 0x0 [0198.660] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xe00, lpOverlapped=0x0) returned 1 [0198.662] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe10, lpOverlapped=0x0) returned 1 [0198.663] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.663] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x144, lpOverlapped=0x0) returned 1 [0198.663] SetEndOfFile (hFile=0x2d8) returned 1 [0198.664] CloseHandle (hObject=0x2d8) returned 1 [0198.664] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.664] SetEndOfFile (hFile=0x114) returned 1 [0198.664] CloseHandle (hObject=0x114) returned 1 [0198.665] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.665] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{4bd650f1-c8f9-11e7-b5bf-c43dc7584a00}.dat")) returned 1 [0198.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.665] lstrlenW (lpString=".doc") returned 4 [0198.665] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.665] lstrlenW (lpString=".docx") returned 5 [0198.665] lstrcmpiW (lpString1=".docx", lpString2="}.dat") returned -1 [0198.665] lstrlenW (lpString=".pdf") returned 4 [0198.665] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.665] lstrlenW (lpString=".xls") returned 4 [0198.665] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.665] lstrlenW (lpString=".xlsx") returned 5 [0198.665] lstrcmpiW (lpString1=".xlsx", lpString2="}.dat") returned -1 [0198.665] lstrlenW (lpString=".ppt") returned 4 [0198.665] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.665] lstrlenW (lpString=".zip") returned 4 [0198.665] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.665] lstrlenW (lpString=".rar") returned 4 [0198.665] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.665] lstrlenW (lpString=".bz2") returned 4 [0198.665] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.665] lstrlenW (lpString=".7z") returned 3 [0198.665] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.666] lstrlenW (lpString=".dbf") returned 4 [0198.666] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.666] lstrlenW (lpString=".1cd") returned 4 [0198.666] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.666] lstrlenW (lpString=".jpg") returned 4 [0198.666] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.666] lstrlenW (lpString=".doc") returned 4 [0198.666] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.666] lstrlenW (lpString=".docx") returned 5 [0198.666] lstrcmpiW (lpString1=".docx", lpString2="}.dat") returned -1 [0198.666] lstrlenW (lpString=".pdf") returned 4 [0198.666] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.666] lstrlenW (lpString=".xls") returned 4 [0198.666] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.666] lstrlenW (lpString=".xlsx") returned 5 [0198.666] lstrcmpiW (lpString1=".xlsx", lpString2="}.dat") returned -1 [0198.666] lstrlenW (lpString=".ppt") returned 4 [0198.666] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.666] lstrlenW (lpString=".zip") returned 4 [0198.666] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.666] lstrlenW (lpString=".rar") returned 4 [0198.666] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.666] lstrlenW (lpString=".bz2") returned 4 [0198.666] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.666] lstrlenW (lpString=".7z") returned 3 [0198.666] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.667] lstrlenW (lpString=".dbf") returned 4 [0198.667] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.667] lstrlenW (lpString=".1cd") returned 4 [0198.667] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{4BD650F1-C8F9-11E7-B5BF-C43DC7584A00}.dat") returned 149 [0198.667] lstrlenW (lpString=".jpg") returned 4 [0198.667] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.667] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0198.667] lstrlenW (lpString="RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 56 [0198.667] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.667] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=4608) returned 1 [0198.667] CloseHandle (hObject=0x114) returned 1 [0198.667] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat")) returned 0x2020 [0198.668] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.668] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.668] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.668] GetLastError () returned 0x0 [0198.668] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x1200, lpOverlapped=0x0) returned 1 [0198.789] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1210, lpOverlapped=0x0) returned 1 [0198.790] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.790] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x144, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x144, lpOverlapped=0x0) returned 1 [0198.790] SetEndOfFile (hFile=0x2d8) returned 1 [0198.790] CloseHandle (hObject=0x2d8) returned 1 [0198.790] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.790] SetEndOfFile (hFile=0x114) returned 1 [0198.791] CloseHandle (hObject=0x114) returned 1 [0198.791] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.791] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\recovery\\last active\\recoverystore.{aae6bf5c-4991-11e7-8e2b-c43dc7584a00}.dat")) returned 1 [0198.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.791] lstrlenW (lpString=".doc") returned 4 [0198.791] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.791] lstrlenW (lpString=".docx") returned 5 [0198.791] lstrcmpiW (lpString1=".docx", lpString2="}.dat") returned -1 [0198.791] lstrlenW (lpString=".pdf") returned 4 [0198.791] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.791] lstrlenW (lpString=".xls") returned 4 [0198.791] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.791] lstrlenW (lpString=".xlsx") returned 5 [0198.791] lstrcmpiW (lpString1=".xlsx", lpString2="}.dat") returned -1 [0198.792] lstrlenW (lpString=".ppt") returned 4 [0198.792] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.792] lstrlenW (lpString=".zip") returned 4 [0198.792] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.792] lstrlenW (lpString=".rar") returned 4 [0198.792] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.792] lstrlenW (lpString=".bz2") returned 4 [0198.792] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.792] lstrlenW (lpString=".7z") returned 3 [0198.792] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.792] lstrlenW (lpString=".dbf") returned 4 [0198.792] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.792] lstrlenW (lpString=".1cd") returned 4 [0198.792] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.792] lstrlenW (lpString=".jpg") returned 4 [0198.792] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.792] lstrlenW (lpString=".doc") returned 4 [0198.792] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0198.792] lstrlenW (lpString=".docx") returned 5 [0198.792] lstrcmpiW (lpString1=".docx", lpString2="}.dat") returned -1 [0198.792] lstrlenW (lpString=".pdf") returned 4 [0198.792] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0198.792] lstrlenW (lpString=".xls") returned 4 [0198.792] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0198.792] lstrlenW (lpString=".xlsx") returned 5 [0198.792] lstrcmpiW (lpString1=".xlsx", lpString2="}.dat") returned -1 [0198.792] lstrlenW (lpString=".ppt") returned 4 [0198.792] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0198.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.793] lstrlenW (lpString=".zip") returned 4 [0198.793] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0198.793] lstrlenW (lpString=".rar") returned 4 [0198.793] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0198.793] lstrlenW (lpString=".bz2") returned 4 [0198.793] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0198.793] lstrlenW (lpString=".7z") returned 3 [0198.793] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0198.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.793] lstrlenW (lpString=".dbf") returned 4 [0198.793] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0198.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.793] lstrlenW (lpString=".1cd") returned 4 [0198.793] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0198.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\Recovery\\Last Active\\RecoveryStore.{AAE6BF5C-4991-11E7-8E2B-C43DC7584A00}.dat") returned 149 [0198.793] lstrlenW (lpString=".jpg") returned 4 [0198.793] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0198.793] lstrcmpiW (lpString1=".bin", lpString2=".wiki") returned -1 [0198.793] lstrlenW (lpString="StructuredQuerySchema.bin") returned 25 [0198.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.794] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=299160) returned 1 [0198.794] CloseHandle (hObject=0x114) returned 1 [0198.794] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 0x2020 [0198.794] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.794] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.795] GetLastError () returned 0x0 [0198.795] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x49098, lpOverlapped=0x0) returned 1 [0198.802] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x490a0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x490a0, lpOverlapped=0x0) returned 1 [0198.808] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.808] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x106, lpOverlapped=0x0) returned 1 [0198.808] SetEndOfFile (hFile=0x2d8) returned 1 [0198.809] CloseHandle (hObject=0x2d8) returned 1 [0198.809] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.809] SetEndOfFile (hFile=0x114) returned 1 [0198.812] CloseHandle (hObject=0x114) returned 1 [0198.812] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.812] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\1033\\structuredqueryschema.bin")) returned 1 [0198.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.812] lstrlenW (lpString=".doc") returned 4 [0198.812] lstrcmpiW (lpString1=".doc", lpString2=".bin") returned 1 [0198.812] lstrlenW (lpString=".docx") returned 5 [0198.812] lstrcmpiW (lpString1=".docx", lpString2="a.bin") returned -1 [0198.812] lstrlenW (lpString=".pdf") returned 4 [0198.812] lstrcmpiW (lpString1=".pdf", lpString2=".bin") returned 1 [0198.812] lstrlenW (lpString=".xls") returned 4 [0198.812] lstrcmpiW (lpString1=".xls", lpString2=".bin") returned 1 [0198.812] lstrlenW (lpString=".xlsx") returned 5 [0198.812] lstrcmpiW (lpString1=".xlsx", lpString2="a.bin") returned -1 [0198.812] lstrlenW (lpString=".ppt") returned 4 [0198.812] lstrcmpiW (lpString1=".ppt", lpString2=".bin") returned 1 [0198.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.812] lstrlenW (lpString=".zip") returned 4 [0198.812] lstrcmpiW (lpString1=".zip", lpString2=".bin") returned 1 [0198.812] lstrlenW (lpString=".rar") returned 4 [0198.812] lstrcmpiW (lpString1=".rar", lpString2=".bin") returned 1 [0198.813] lstrlenW (lpString=".bz2") returned 4 [0198.813] lstrcmpiW (lpString1=".bz2", lpString2=".bin") returned 1 [0198.813] lstrlenW (lpString=".7z") returned 3 [0198.813] lstrcmpiW (lpString1=".7z", lpString2="bin") returned -1 [0198.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.813] lstrlenW (lpString=".dbf") returned 4 [0198.813] lstrcmpiW (lpString1=".dbf", lpString2=".bin") returned 1 [0198.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.813] lstrlenW (lpString=".1cd") returned 4 [0198.813] lstrcmpiW (lpString1=".1cd", lpString2=".bin") returned -1 [0198.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.813] lstrlenW (lpString=".jpg") returned 4 [0198.813] lstrcmpiW (lpString1=".jpg", lpString2=".bin") returned 1 [0198.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.813] lstrlenW (lpString=".doc") returned 4 [0198.813] lstrcmpiW (lpString1=".doc", lpString2=".bin") returned 1 [0198.813] lstrlenW (lpString=".docx") returned 5 [0198.813] lstrcmpiW (lpString1=".docx", lpString2="a.bin") returned -1 [0198.813] lstrlenW (lpString=".pdf") returned 4 [0198.813] lstrcmpiW (lpString1=".pdf", lpString2=".bin") returned 1 [0198.813] lstrlenW (lpString=".xls") returned 4 [0198.813] lstrcmpiW (lpString1=".xls", lpString2=".bin") returned 1 [0198.813] lstrlenW (lpString=".xlsx") returned 5 [0198.813] lstrcmpiW (lpString1=".xlsx", lpString2="a.bin") returned -1 [0198.813] lstrlenW (lpString=".ppt") returned 4 [0198.813] lstrcmpiW (lpString1=".ppt", lpString2=".bin") returned 1 [0198.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.813] lstrlenW (lpString=".zip") returned 4 [0198.813] lstrcmpiW (lpString1=".zip", lpString2=".bin") returned 1 [0198.813] lstrlenW (lpString=".rar") returned 4 [0198.813] lstrcmpiW (lpString1=".rar", lpString2=".bin") returned 1 [0198.813] lstrlenW (lpString=".bz2") returned 4 [0198.813] lstrcmpiW (lpString1=".bz2", lpString2=".bin") returned 1 [0198.814] lstrlenW (lpString=".7z") returned 3 [0198.814] lstrcmpiW (lpString1=".7z", lpString2="bin") returned -1 [0198.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.814] lstrlenW (lpString=".dbf") returned 4 [0198.814] lstrcmpiW (lpString1=".dbf", lpString2=".bin") returned 1 [0198.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.814] lstrlenW (lpString=".1cd") returned 4 [0198.814] lstrcmpiW (lpString1=".1cd", lpString2=".bin") returned -1 [0198.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\1033\\StructuredQuerySchema.bin") returned 92 [0198.814] lstrlenW (lpString=".jpg") returned 4 [0198.814] lstrcmpiW (lpString1=".jpg", lpString2=".bin") returned 1 [0198.814] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0198.814] lstrlenW (lpString="desktop.ini") returned 11 [0198.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.814] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=174) returned 1 [0198.814] CloseHandle (hObject=0x114) returned 1 [0198.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 0x26 [0198.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.815] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.815] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.816] GetLastError () returned 0x0 [0198.816] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xae, lpOverlapped=0x0) returned 1 [0198.816] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xb0, lpOverlapped=0x0) returned 1 [0198.817] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.817] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0198.817] SetEndOfFile (hFile=0x2d8) returned 1 [0198.818] CloseHandle (hObject=0x2d8) returned 1 [0198.818] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.818] SetEndOfFile (hFile=0x114) returned 1 [0198.819] CloseHandle (hObject=0x114) returned 1 [0198.819] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x26) returned 1 [0198.819] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn\\desktop.ini")) returned 1 [0198.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.819] lstrlenW (lpString=".doc") returned 4 [0198.819] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.819] lstrlenW (lpString=".docx") returned 5 [0198.819] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.819] lstrlenW (lpString=".pdf") returned 4 [0198.819] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.819] lstrlenW (lpString=".xls") returned 4 [0198.819] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.819] lstrlenW (lpString=".xlsx") returned 5 [0198.819] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.819] lstrlenW (lpString=".ppt") returned 4 [0198.819] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.819] lstrlenW (lpString=".zip") returned 4 [0198.820] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.820] lstrlenW (lpString=".rar") returned 4 [0198.820] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.820] lstrlenW (lpString=".bz2") returned 4 [0198.820] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.820] lstrlenW (lpString=".7z") returned 3 [0198.820] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.820] lstrlenW (lpString=".dbf") returned 4 [0198.820] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.820] lstrlenW (lpString=".1cd") returned 4 [0198.820] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.820] lstrlenW (lpString=".jpg") returned 4 [0198.820] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.820] lstrlenW (lpString=".doc") returned 4 [0198.820] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.820] lstrlenW (lpString=".docx") returned 5 [0198.820] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.820] lstrlenW (lpString=".pdf") returned 4 [0198.820] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.820] lstrlenW (lpString=".xls") returned 4 [0198.820] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.820] lstrlenW (lpString=".xlsx") returned 5 [0198.820] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.820] lstrlenW (lpString=".ppt") returned 4 [0198.820] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.820] lstrlenW (lpString=".zip") returned 4 [0198.820] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.820] lstrlenW (lpString=".rar") returned 4 [0198.821] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.821] lstrlenW (lpString=".bz2") returned 4 [0198.821] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.821] lstrlenW (lpString=".7z") returned 3 [0198.821] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.821] lstrlenW (lpString=".dbf") returned 4 [0198.821] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.821] lstrlenW (lpString=".1cd") returned 4 [0198.821] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn\\desktop.ini") returned 83 [0198.821] lstrlenW (lpString=".jpg") returned 4 [0198.821] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.821] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0198.821] lstrlenW (lpString="desktop.ini") returned 11 [0198.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.822] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=174) returned 1 [0198.822] CloseHandle (hObject=0x114) returned 1 [0198.823] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 0x6 [0198.823] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.823] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.823] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.824] GetLastError () returned 0x0 [0198.824] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xae, lpOverlapped=0x0) returned 1 [0198.824] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xb0, lpOverlapped=0x0) returned 1 [0198.826] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.826] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0198.826] SetEndOfFile (hFile=0x2d8) returned 1 [0198.826] CloseHandle (hObject=0x2d8) returned 1 [0198.826] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.826] SetEndOfFile (hFile=0x114) returned 1 [0198.827] CloseHandle (hObject=0x114) returned 1 [0198.827] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x6) returned 1 [0198.827] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn1\\desktop.ini")) returned 1 [0198.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.827] lstrlenW (lpString=".doc") returned 4 [0198.827] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.827] lstrlenW (lpString=".docx") returned 5 [0198.827] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.827] lstrlenW (lpString=".pdf") returned 4 [0198.827] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.828] lstrlenW (lpString=".xls") returned 4 [0198.828] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.828] lstrlenW (lpString=".xlsx") returned 5 [0198.828] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.828] lstrlenW (lpString=".ppt") returned 4 [0198.828] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.828] lstrlenW (lpString=".zip") returned 4 [0198.828] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.828] lstrlenW (lpString=".rar") returned 4 [0198.828] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.828] lstrlenW (lpString=".bz2") returned 4 [0198.828] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.828] lstrlenW (lpString=".7z") returned 3 [0198.828] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.828] lstrlenW (lpString=".dbf") returned 4 [0198.828] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.828] lstrlenW (lpString=".1cd") returned 4 [0198.828] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.828] lstrlenW (lpString=".jpg") returned 4 [0198.828] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.828] lstrlenW (lpString=".doc") returned 4 [0198.828] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.828] lstrlenW (lpString=".docx") returned 5 [0198.828] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.828] lstrlenW (lpString=".pdf") returned 4 [0198.828] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.828] lstrlenW (lpString=".xls") returned 4 [0198.828] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.828] lstrlenW (lpString=".xlsx") returned 5 [0198.829] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.829] lstrlenW (lpString=".ppt") returned 4 [0198.829] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.829] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.829] lstrlenW (lpString=".zip") returned 4 [0198.829] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.829] lstrlenW (lpString=".rar") returned 4 [0198.829] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.829] lstrlenW (lpString=".bz2") returned 4 [0198.829] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.829] lstrlenW (lpString=".7z") returned 3 [0198.829] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.829] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.829] lstrlenW (lpString=".dbf") returned 4 [0198.829] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.829] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.829] lstrlenW (lpString=".1cd") returned 4 [0198.829] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.829] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn1\\desktop.ini") returned 84 [0198.829] lstrlenW (lpString=".jpg") returned 4 [0198.829] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.829] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0198.829] lstrlenW (lpString="desktop.ini") returned 11 [0198.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.830] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=174) returned 1 [0198.830] CloseHandle (hObject=0x114) returned 1 [0198.830] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 0x6 [0198.831] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.831] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.831] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.832] GetLastError () returned 0x0 [0198.832] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xae, lpOverlapped=0x0) returned 1 [0198.833] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xb0, lpOverlapped=0x0) returned 1 [0198.834] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.834] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xea, lpOverlapped=0x0) returned 1 [0198.834] SetEndOfFile (hFile=0x2d8) returned 1 [0198.834] CloseHandle (hObject=0x2d8) returned 1 [0198.834] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.834] SetEndOfFile (hFile=0x114) returned 1 [0198.835] CloseHandle (hObject=0x114) returned 1 [0198.835] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x6) returned 1 [0198.835] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\burn\\burn2\\desktop.ini")) returned 1 [0198.835] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.835] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.835] lstrlenW (lpString=".doc") returned 4 [0198.835] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.835] lstrlenW (lpString=".docx") returned 5 [0198.835] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.835] lstrlenW (lpString=".pdf") returned 4 [0198.835] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.835] lstrlenW (lpString=".xls") returned 4 [0198.835] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.836] lstrlenW (lpString=".xlsx") returned 5 [0198.836] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.836] lstrlenW (lpString=".ppt") returned 4 [0198.836] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.836] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.836] lstrlenW (lpString=".zip") returned 4 [0198.836] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.836] lstrlenW (lpString=".rar") returned 4 [0198.836] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.836] lstrlenW (lpString=".bz2") returned 4 [0198.836] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.836] lstrlenW (lpString=".7z") returned 3 [0198.836] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.836] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.836] lstrlenW (lpString=".dbf") returned 4 [0198.836] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.836] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.836] lstrlenW (lpString=".1cd") returned 4 [0198.836] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.836] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.836] lstrlenW (lpString=".jpg") returned 4 [0198.836] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.836] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.836] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.836] lstrlenW (lpString=".doc") returned 4 [0198.836] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.836] lstrlenW (lpString=".docx") returned 5 [0198.836] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.836] lstrlenW (lpString=".pdf") returned 4 [0198.836] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.836] lstrlenW (lpString=".xls") returned 4 [0198.836] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.837] lstrlenW (lpString=".xlsx") returned 5 [0198.837] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.837] lstrlenW (lpString=".ppt") returned 4 [0198.837] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.837] lstrlenW (lpString=".zip") returned 4 [0198.837] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.837] lstrlenW (lpString=".rar") returned 4 [0198.837] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.837] lstrlenW (lpString=".bz2") returned 4 [0198.837] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.837] lstrlenW (lpString=".7z") returned 3 [0198.837] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.837] lstrlenW (lpString=".dbf") returned 4 [0198.837] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.837] lstrlenW (lpString=".1cd") returned 4 [0198.837] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Burn\\Burn2\\desktop.ini") returned 84 [0198.837] lstrlenW (lpString=".jpg") returned 4 [0198.837] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.837] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.837] lstrlenW (lpString="cversions.1.db") returned 14 [0198.837] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.838] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=16384) returned 1 [0198.838] CloseHandle (hObject=0x114) returned 1 [0198.838] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 0x2020 [0198.838] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.838] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.838] GetLastError () returned 0x0 [0198.838] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x4000, lpOverlapped=0x0) returned 1 [0198.839] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4010, lpOverlapped=0x0) returned 1 [0198.841] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.841] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0198.841] SetEndOfFile (hFile=0x2d8) returned 1 [0198.841] CloseHandle (hObject=0x2d8) returned 1 [0198.842] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.842] SetEndOfFile (hFile=0x114) returned 1 [0198.842] CloseHandle (hObject=0x114) returned 1 [0198.842] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.843] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\cversions.1.db")) returned 1 [0198.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.843] lstrlenW (lpString=".doc") returned 4 [0198.843] lstrcmpiW (lpString1=".doc", lpString2="1.db") returned -1 [0198.843] lstrlenW (lpString=".docx") returned 5 [0198.843] lstrcmpiW (lpString1=".docx", lpString2=".1.db") returned 1 [0198.843] lstrlenW (lpString=".pdf") returned 4 [0198.843] lstrcmpiW (lpString1=".pdf", lpString2="1.db") returned -1 [0198.843] lstrlenW (lpString=".xls") returned 4 [0198.843] lstrcmpiW (lpString1=".xls", lpString2="1.db") returned -1 [0198.843] lstrlenW (lpString=".xlsx") returned 5 [0198.843] lstrcmpiW (lpString1=".xlsx", lpString2=".1.db") returned 1 [0198.843] lstrlenW (lpString=".ppt") returned 4 [0198.843] lstrcmpiW (lpString1=".ppt", lpString2="1.db") returned -1 [0198.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.843] lstrlenW (lpString=".zip") returned 4 [0198.843] lstrcmpiW (lpString1=".zip", lpString2="1.db") returned -1 [0198.843] lstrlenW (lpString=".rar") returned 4 [0198.843] lstrcmpiW (lpString1=".rar", lpString2="1.db") returned -1 [0198.843] lstrlenW (lpString=".bz2") returned 4 [0198.843] lstrcmpiW (lpString1=".bz2", lpString2="1.db") returned -1 [0198.843] lstrlenW (lpString=".7z") returned 3 [0198.843] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.843] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.843] lstrlenW (lpString=".dbf") returned 4 [0198.843] lstrcmpiW (lpString1=".dbf", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.844] lstrlenW (lpString=".1cd") returned 4 [0198.844] lstrcmpiW (lpString1=".1cd", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.844] lstrlenW (lpString=".jpg") returned 4 [0198.844] lstrcmpiW (lpString1=".jpg", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.844] lstrlenW (lpString=".doc") returned 4 [0198.844] lstrcmpiW (lpString1=".doc", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString=".docx") returned 5 [0198.844] lstrcmpiW (lpString1=".docx", lpString2=".1.db") returned 1 [0198.844] lstrlenW (lpString=".pdf") returned 4 [0198.844] lstrcmpiW (lpString1=".pdf", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString=".xls") returned 4 [0198.844] lstrcmpiW (lpString1=".xls", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString=".xlsx") returned 5 [0198.844] lstrcmpiW (lpString1=".xlsx", lpString2=".1.db") returned 1 [0198.844] lstrlenW (lpString=".ppt") returned 4 [0198.844] lstrcmpiW (lpString1=".ppt", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.844] lstrlenW (lpString=".zip") returned 4 [0198.844] lstrcmpiW (lpString1=".zip", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString=".rar") returned 4 [0198.844] lstrcmpiW (lpString1=".rar", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString=".bz2") returned 4 [0198.844] lstrcmpiW (lpString1=".bz2", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString=".7z") returned 3 [0198.844] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.844] lstrlenW (lpString=".dbf") returned 4 [0198.844] lstrcmpiW (lpString1=".dbf", lpString2="1.db") returned -1 [0198.844] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.844] lstrlenW (lpString=".1cd") returned 4 [0198.845] lstrcmpiW (lpString1=".1cd", lpString2="1.db") returned -1 [0198.845] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\cversions.1.db") returned 83 [0198.845] lstrlenW (lpString=".jpg") returned 4 [0198.845] lstrcmpiW (lpString1=".jpg", lpString2="1.db") returned -1 [0198.845] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.845] lstrlenW (lpString="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 65 [0198.845] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.846] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=125448) returned 1 [0198.846] CloseHandle (hObject=0x114) returned 1 [0198.846] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")) returned 0x2020 [0198.846] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.846] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.846] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.847] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.847] GetLastError () returned 0x0 [0198.847] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x1ea08, lpOverlapped=0x0) returned 1 [0198.851] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1ea10, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1ea10, lpOverlapped=0x0) returned 1 [0198.853] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.853] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x156, lpOverlapped=0x0) returned 1 [0198.853] SetEndOfFile (hFile=0x2d8) returned 1 [0198.853] CloseHandle (hObject=0x2d8) returned 1 [0198.854] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.854] SetEndOfFile (hFile=0x114) returned 1 [0198.855] CloseHandle (hObject=0x114) returned 1 [0198.855] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.855] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000016.db")) returned 1 [0198.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.855] lstrlenW (lpString=".doc") returned 4 [0198.855] lstrcmpiW (lpString1=".doc", lpString2="6.db") returned -1 [0198.855] lstrlenW (lpString=".docx") returned 5 [0198.855] lstrcmpiW (lpString1=".docx", lpString2="16.db") returned -1 [0198.856] lstrlenW (lpString=".pdf") returned 4 [0198.856] lstrcmpiW (lpString1=".pdf", lpString2="6.db") returned -1 [0198.856] lstrlenW (lpString=".xls") returned 4 [0198.856] lstrcmpiW (lpString1=".xls", lpString2="6.db") returned -1 [0198.856] lstrlenW (lpString=".xlsx") returned 5 [0198.856] lstrcmpiW (lpString1=".xlsx", lpString2="16.db") returned -1 [0198.856] lstrlenW (lpString=".ppt") returned 4 [0198.856] lstrcmpiW (lpString1=".ppt", lpString2="6.db") returned -1 [0198.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.856] lstrlenW (lpString=".zip") returned 4 [0198.856] lstrcmpiW (lpString1=".zip", lpString2="6.db") returned -1 [0198.856] lstrlenW (lpString=".rar") returned 4 [0198.856] lstrcmpiW (lpString1=".rar", lpString2="6.db") returned -1 [0198.856] lstrlenW (lpString=".bz2") returned 4 [0198.856] lstrcmpiW (lpString1=".bz2", lpString2="6.db") returned -1 [0198.856] lstrlenW (lpString=".7z") returned 3 [0198.856] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.856] lstrlenW (lpString=".dbf") returned 4 [0198.856] lstrcmpiW (lpString1=".dbf", lpString2="6.db") returned -1 [0198.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.856] lstrlenW (lpString=".1cd") returned 4 [0198.856] lstrcmpiW (lpString1=".1cd", lpString2="6.db") returned -1 [0198.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.856] lstrlenW (lpString=".jpg") returned 4 [0198.856] lstrcmpiW (lpString1=".jpg", lpString2="6.db") returned -1 [0198.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.856] lstrlenW (lpString=".doc") returned 4 [0198.856] lstrcmpiW (lpString1=".doc", lpString2="6.db") returned -1 [0198.856] lstrlenW (lpString=".docx") returned 5 [0198.856] lstrcmpiW (lpString1=".docx", lpString2="16.db") returned -1 [0198.856] lstrlenW (lpString=".pdf") returned 4 [0198.856] lstrcmpiW (lpString1=".pdf", lpString2="6.db") returned -1 [0198.857] lstrlenW (lpString=".xls") returned 4 [0198.857] lstrcmpiW (lpString1=".xls", lpString2="6.db") returned -1 [0198.857] lstrlenW (lpString=".xlsx") returned 5 [0198.857] lstrcmpiW (lpString1=".xlsx", lpString2="16.db") returned -1 [0198.857] lstrlenW (lpString=".ppt") returned 4 [0198.857] lstrcmpiW (lpString1=".ppt", lpString2="6.db") returned -1 [0198.857] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.857] lstrlenW (lpString=".zip") returned 4 [0198.857] lstrcmpiW (lpString1=".zip", lpString2="6.db") returned -1 [0198.857] lstrlenW (lpString=".rar") returned 4 [0198.857] lstrcmpiW (lpString1=".rar", lpString2="6.db") returned -1 [0198.857] lstrlenW (lpString=".bz2") returned 4 [0198.857] lstrcmpiW (lpString1=".bz2", lpString2="6.db") returned -1 [0198.857] lstrlenW (lpString=".7z") returned 3 [0198.857] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.857] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.857] lstrlenW (lpString=".dbf") returned 4 [0198.857] lstrcmpiW (lpString1=".dbf", lpString2="6.db") returned -1 [0198.857] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.857] lstrlenW (lpString=".1cd") returned 4 [0198.857] lstrcmpiW (lpString1=".1cd", lpString2="6.db") returned -1 [0198.857] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000016.db") returned 134 [0198.857] lstrlenW (lpString=".jpg") returned 4 [0198.857] lstrcmpiW (lpString1=".jpg", lpString2="6.db") returned -1 [0198.857] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.857] lstrlenW (lpString="{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 65 [0198.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.858] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=130432) returned 1 [0198.858] CloseHandle (hObject=0x114) returned 1 [0198.858] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db")) returned 0x2020 [0198.858] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.858] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.858] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.858] GetLastError () returned 0x0 [0198.859] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x1fd80, lpOverlapped=0x0) returned 1 [0198.909] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1fd90, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1fd90, lpOverlapped=0x0) returned 1 [0198.912] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.912] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x156, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x156, lpOverlapped=0x0) returned 1 [0198.912] SetEndOfFile (hFile=0x2d8) returned 1 [0198.912] CloseHandle (hObject=0x2d8) returned 1 [0198.912] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.912] SetEndOfFile (hFile=0x114) returned 0 [0198.912] CloseHandle (hObject=0x114) returned 1 [0198.913] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.913] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\caches\\{afbf9f1a-8ee8-4c77-af34-c647e37ca0d9}.1.ver0x0000000000000017.db")) returned 0 [0198.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.913] lstrlenW (lpString=".doc") returned 4 [0198.913] lstrcmpiW (lpString1=".doc", lpString2="7.db") returned -1 [0198.913] lstrlenW (lpString=".docx") returned 5 [0198.913] lstrcmpiW (lpString1=".docx", lpString2="17.db") returned -1 [0198.913] lstrlenW (lpString=".pdf") returned 4 [0198.913] lstrcmpiW (lpString1=".pdf", lpString2="7.db") returned -1 [0198.913] lstrlenW (lpString=".xls") returned 4 [0198.913] lstrcmpiW (lpString1=".xls", lpString2="7.db") returned -1 [0198.913] lstrlenW (lpString=".xlsx") returned 5 [0198.913] lstrcmpiW (lpString1=".xlsx", lpString2="17.db") returned -1 [0198.913] lstrlenW (lpString=".ppt") returned 4 [0198.913] lstrcmpiW (lpString1=".ppt", lpString2="7.db") returned -1 [0198.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.913] lstrlenW (lpString=".zip") returned 4 [0198.913] lstrcmpiW (lpString1=".zip", lpString2="7.db") returned -1 [0198.913] lstrlenW (lpString=".rar") returned 4 [0198.913] lstrcmpiW (lpString1=".rar", lpString2="7.db") returned -1 [0198.913] lstrlenW (lpString=".bz2") returned 4 [0198.913] lstrcmpiW (lpString1=".bz2", lpString2="7.db") returned -1 [0198.913] lstrlenW (lpString=".7z") returned 3 [0198.913] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.914] lstrlenW (lpString=".dbf") returned 4 [0198.914] lstrcmpiW (lpString1=".dbf", lpString2="7.db") returned -1 [0198.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.914] lstrlenW (lpString=".1cd") returned 4 [0198.914] lstrcmpiW (lpString1=".1cd", lpString2="7.db") returned -1 [0198.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.914] lstrlenW (lpString=".jpg") returned 4 [0198.914] lstrcmpiW (lpString1=".jpg", lpString2="7.db") returned -1 [0198.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.914] lstrlenW (lpString=".doc") returned 4 [0198.914] lstrcmpiW (lpString1=".doc", lpString2="7.db") returned -1 [0198.914] lstrlenW (lpString=".docx") returned 5 [0198.914] lstrcmpiW (lpString1=".docx", lpString2="17.db") returned -1 [0198.914] lstrlenW (lpString=".pdf") returned 4 [0198.914] lstrcmpiW (lpString1=".pdf", lpString2="7.db") returned -1 [0198.914] lstrlenW (lpString=".xls") returned 4 [0198.914] lstrcmpiW (lpString1=".xls", lpString2="7.db") returned -1 [0198.914] lstrlenW (lpString=".xlsx") returned 5 [0198.914] lstrcmpiW (lpString1=".xlsx", lpString2="17.db") returned -1 [0198.914] lstrlenW (lpString=".ppt") returned 4 [0198.914] lstrcmpiW (lpString1=".ppt", lpString2="7.db") returned -1 [0198.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.914] lstrlenW (lpString=".zip") returned 4 [0198.914] lstrcmpiW (lpString1=".zip", lpString2="7.db") returned -1 [0198.914] lstrlenW (lpString=".rar") returned 4 [0198.914] lstrcmpiW (lpString1=".rar", lpString2="7.db") returned -1 [0198.914] lstrlenW (lpString=".bz2") returned 4 [0198.914] lstrcmpiW (lpString1=".bz2", lpString2="7.db") returned -1 [0198.914] lstrlenW (lpString=".7z") returned 3 [0198.914] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.915] lstrlenW (lpString=".dbf") returned 4 [0198.915] lstrcmpiW (lpString1=".dbf", lpString2="7.db") returned -1 [0198.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.915] lstrlenW (lpString=".1cd") returned 4 [0198.915] lstrcmpiW (lpString1=".1cd", lpString2="7.db") returned -1 [0198.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000017.db") returned 134 [0198.915] lstrlenW (lpString=".jpg") returned 4 [0198.915] lstrcmpiW (lpString1=".jpg", lpString2="7.db") returned -1 [0198.915] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.915] lstrlenW (lpString="thumbcache_32.db") returned 16 [0198.915] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.915] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=24) returned 1 [0198.915] CloseHandle (hObject=0x114) returned 1 [0198.916] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 0x2020 [0198.916] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.916] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.916] GetLastError () returned 0x0 [0198.916] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x18, lpOverlapped=0x0) returned 1 [0198.917] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x20, lpOverlapped=0x0) returned 1 [0198.918] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0198.918] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0198.918] SetEndOfFile (hFile=0x2d8) returned 1 [0198.918] CloseHandle (hObject=0x2d8) returned 1 [0198.918] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.918] SetEndOfFile (hFile=0x114) returned 0 [0198.918] CloseHandle (hObject=0x114) returned 1 [0198.918] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.919] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_32.db")) returned 0 [0198.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.919] lstrlenW (lpString=".doc") returned 4 [0198.919] lstrcmpiW (lpString1=".doc", lpString2="2.db") returned -1 [0198.919] lstrlenW (lpString=".docx") returned 5 [0198.919] lstrcmpiW (lpString1=".docx", lpString2="32.db") returned -1 [0198.919] lstrlenW (lpString=".pdf") returned 4 [0198.919] lstrcmpiW (lpString1=".pdf", lpString2="2.db") returned -1 [0198.919] lstrlenW (lpString=".xls") returned 4 [0198.919] lstrcmpiW (lpString1=".xls", lpString2="2.db") returned -1 [0198.919] lstrlenW (lpString=".xlsx") returned 5 [0198.919] lstrcmpiW (lpString1=".xlsx", lpString2="32.db") returned -1 [0198.919] lstrlenW (lpString=".ppt") returned 4 [0198.919] lstrcmpiW (lpString1=".ppt", lpString2="2.db") returned -1 [0198.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.919] lstrlenW (lpString=".zip") returned 4 [0198.919] lstrcmpiW (lpString1=".zip", lpString2="2.db") returned -1 [0198.919] lstrlenW (lpString=".rar") returned 4 [0198.919] lstrcmpiW (lpString1=".rar", lpString2="2.db") returned -1 [0198.919] lstrlenW (lpString=".bz2") returned 4 [0198.919] lstrcmpiW (lpString1=".bz2", lpString2="2.db") returned -1 [0198.919] lstrlenW (lpString=".7z") returned 3 [0198.919] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.919] lstrlenW (lpString=".dbf") returned 4 [0198.919] lstrcmpiW (lpString1=".dbf", lpString2="2.db") returned -1 [0198.919] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.920] lstrlenW (lpString=".1cd") returned 4 [0198.920] lstrcmpiW (lpString1=".1cd", lpString2="2.db") returned -1 [0198.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.920] lstrlenW (lpString=".jpg") returned 4 [0198.920] lstrcmpiW (lpString1=".jpg", lpString2="2.db") returned -1 [0198.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.920] lstrlenW (lpString=".doc") returned 4 [0198.920] lstrcmpiW (lpString1=".doc", lpString2="2.db") returned -1 [0198.920] lstrlenW (lpString=".docx") returned 5 [0198.920] lstrcmpiW (lpString1=".docx", lpString2="32.db") returned -1 [0198.920] lstrlenW (lpString=".pdf") returned 4 [0198.920] lstrcmpiW (lpString1=".pdf", lpString2="2.db") returned -1 [0198.920] lstrlenW (lpString=".xls") returned 4 [0198.920] lstrcmpiW (lpString1=".xls", lpString2="2.db") returned -1 [0198.920] lstrlenW (lpString=".xlsx") returned 5 [0198.920] lstrcmpiW (lpString1=".xlsx", lpString2="32.db") returned -1 [0198.920] lstrlenW (lpString=".ppt") returned 4 [0198.920] lstrcmpiW (lpString1=".ppt", lpString2="2.db") returned -1 [0198.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.920] lstrlenW (lpString=".zip") returned 4 [0198.920] lstrcmpiW (lpString1=".zip", lpString2="2.db") returned -1 [0198.920] lstrlenW (lpString=".rar") returned 4 [0198.920] lstrcmpiW (lpString1=".rar", lpString2="2.db") returned -1 [0198.920] lstrlenW (lpString=".bz2") returned 4 [0198.920] lstrcmpiW (lpString1=".bz2", lpString2="2.db") returned -1 [0198.920] lstrlenW (lpString=".7z") returned 3 [0198.920] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.920] lstrlenW (lpString=".dbf") returned 4 [0198.920] lstrcmpiW (lpString1=".dbf", lpString2="2.db") returned -1 [0198.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.920] lstrlenW (lpString=".1cd") returned 4 [0198.920] lstrcmpiW (lpString1=".1cd", lpString2="2.db") returned -1 [0198.921] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_32.db") returned 87 [0198.921] lstrlenW (lpString=".jpg") returned 4 [0198.921] lstrcmpiW (lpString1=".jpg", lpString2="2.db") returned -1 [0198.921] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.921] lstrlenW (lpString="thumbcache_96.db") returned 16 [0198.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.921] GetFileSizeEx (in: hFile=0x114, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=1048576) returned 1 [0198.921] CloseHandle (hObject=0x114) returned 1 [0198.921] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 0x2020 [0198.921] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.921] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0198.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.921] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0198.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0198.922] GetLastError () returned 0x0 [0198.922] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0xffff0, lpOverlapped=0x0) returned 1 [0199.065] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0199.084] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x10, lpOverlapped=0x0) returned 1 [0199.084] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x20, lpOverlapped=0x0) returned 1 [0199.087] ReadFile (in: hFile=0x114, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0199.087] WriteFile (in: hFile=0x2d8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf4, lpOverlapped=0x0) returned 1 [0199.087] SetEndOfFile (hFile=0x2d8) returned 1 [0199.087] CloseHandle (hObject=0x2d8) returned 1 [0199.087] SetFilePointerEx (in: hFile=0x114, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0199.088] SetEndOfFile (hFile=0x114) returned 0 [0199.088] CloseHandle (hObject=0x114) returned 1 [0199.088] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.088] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\thumbcache_96.db")) returned 0 [0199.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.088] lstrlenW (lpString=".doc") returned 4 [0199.088] lstrcmpiW (lpString1=".doc", lpString2="6.db") returned -1 [0199.088] lstrlenW (lpString=".docx") returned 5 [0199.088] lstrcmpiW (lpString1=".docx", lpString2="96.db") returned -1 [0199.088] lstrlenW (lpString=".pdf") returned 4 [0199.088] lstrcmpiW (lpString1=".pdf", lpString2="6.db") returned -1 [0199.088] lstrlenW (lpString=".xls") returned 4 [0199.088] lstrcmpiW (lpString1=".xls", lpString2="6.db") returned -1 [0199.088] lstrlenW (lpString=".xlsx") returned 5 [0199.088] lstrcmpiW (lpString1=".xlsx", lpString2="96.db") returned -1 [0199.088] lstrlenW (lpString=".ppt") returned 4 [0199.088] lstrcmpiW (lpString1=".ppt", lpString2="6.db") returned -1 [0199.088] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.088] lstrlenW (lpString=".zip") returned 4 [0199.088] lstrcmpiW (lpString1=".zip", lpString2="6.db") returned -1 [0199.088] lstrlenW (lpString=".rar") returned 4 [0199.089] lstrcmpiW (lpString1=".rar", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString=".bz2") returned 4 [0199.089] lstrcmpiW (lpString1=".bz2", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString=".7z") returned 3 [0199.089] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0199.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.089] lstrlenW (lpString=".dbf") returned 4 [0199.089] lstrcmpiW (lpString1=".dbf", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.089] lstrlenW (lpString=".1cd") returned 4 [0199.089] lstrcmpiW (lpString1=".1cd", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.089] lstrlenW (lpString=".jpg") returned 4 [0199.089] lstrcmpiW (lpString1=".jpg", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.089] lstrlenW (lpString=".doc") returned 4 [0199.089] lstrcmpiW (lpString1=".doc", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString=".docx") returned 5 [0199.089] lstrcmpiW (lpString1=".docx", lpString2="96.db") returned -1 [0199.089] lstrlenW (lpString=".pdf") returned 4 [0199.089] lstrcmpiW (lpString1=".pdf", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString=".xls") returned 4 [0199.089] lstrcmpiW (lpString1=".xls", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString=".xlsx") returned 5 [0199.089] lstrcmpiW (lpString1=".xlsx", lpString2="96.db") returned -1 [0199.089] lstrlenW (lpString=".ppt") returned 4 [0199.089] lstrcmpiW (lpString1=".ppt", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.089] lstrlenW (lpString=".zip") returned 4 [0199.089] lstrcmpiW (lpString1=".zip", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString=".rar") returned 4 [0199.089] lstrcmpiW (lpString1=".rar", lpString2="6.db") returned -1 [0199.089] lstrlenW (lpString=".bz2") returned 4 [0199.090] lstrcmpiW (lpString1=".bz2", lpString2="6.db") returned -1 [0199.090] lstrlenW (lpString=".7z") returned 3 [0199.090] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0199.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.090] lstrlenW (lpString=".dbf") returned 4 [0199.090] lstrcmpiW (lpString1=".dbf", lpString2="6.db") returned -1 [0199.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.090] lstrlenW (lpString=".1cd") returned 4 [0199.090] lstrcmpiW (lpString1=".1cd", lpString2="6.db") returned -1 [0199.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\thumbcache_96.db") returned 87 [0199.090] lstrlenW (lpString=".jpg") returned 4 [0199.090] lstrcmpiW (lpString1=".jpg", lpString2="6.db") returned -1 [0199.090] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0199.090] lstrlenW (lpString="index.dat") returned 9 [0199.090] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019102120191022\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0199.370] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=65536) returned 1 [0199.370] CloseHandle (hObject=0x350) returned 1 [0199.370] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019102120191022\\index.dat")) returned 0x2026 [0199.371] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019102120191022\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019102120191022\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0199.371] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0199.371] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0199.371] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019102120191022\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0199.371] GetLastError () returned 0x0 [0199.371] ReadFile (in: hFile=0x350, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x10000, lpOverlapped=0x0) returned 1 [0199.507] WriteFile (in: hFile=0x154, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x10010, lpOverlapped=0x0) returned 1 [0199.508] ReadFile (in: hFile=0x350, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0199.508] WriteFile (in: hFile=0x154, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.508] SetEndOfFile (hFile=0x154) returned 1 [0199.509] CloseHandle (hObject=0x154) returned 1 [0199.509] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0199.509] SetEndOfFile (hFile=0x350) returned 1 [0199.510] CloseHandle (hObject=0x350) returned 1 [0199.510] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.510] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\mshist012019102120191022\\index.dat")) returned 1 [0199.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.510] lstrlenW (lpString=".doc") returned 4 [0199.510] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.510] lstrlenW (lpString=".docx") returned 5 [0199.510] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0199.510] lstrlenW (lpString=".pdf") returned 4 [0199.510] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.510] lstrlenW (lpString=".xls") returned 4 [0199.510] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.511] lstrlenW (lpString=".xlsx") returned 5 [0199.511] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0199.511] lstrlenW (lpString=".ppt") returned 4 [0199.511] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.511] lstrlenW (lpString=".zip") returned 4 [0199.511] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.511] lstrlenW (lpString=".rar") returned 4 [0199.511] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.511] lstrlenW (lpString=".bz2") returned 4 [0199.511] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.511] lstrlenW (lpString=".7z") returned 3 [0199.511] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.511] lstrlenW (lpString=".dbf") returned 4 [0199.511] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.511] lstrlenW (lpString=".1cd") returned 4 [0199.511] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.511] lstrlenW (lpString=".jpg") returned 4 [0199.511] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.511] lstrlenW (lpString=".doc") returned 4 [0199.511] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.511] lstrlenW (lpString=".docx") returned 5 [0199.511] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0199.511] lstrlenW (lpString=".pdf") returned 4 [0199.511] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.511] lstrlenW (lpString=".xls") returned 4 [0199.511] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.511] lstrlenW (lpString=".xlsx") returned 5 [0199.512] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0199.512] lstrlenW (lpString=".ppt") returned 4 [0199.512] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.512] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.512] lstrlenW (lpString=".zip") returned 4 [0199.512] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.512] lstrlenW (lpString=".rar") returned 4 [0199.512] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.512] lstrlenW (lpString=".bz2") returned 4 [0199.512] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.512] lstrlenW (lpString=".7z") returned 3 [0199.512] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.512] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.512] lstrlenW (lpString=".dbf") returned 4 [0199.512] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.512] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.512] lstrlenW (lpString=".1cd") returned 4 [0199.512] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.512] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\MSHist012019102120191022\\index.dat") returned 116 [0199.512] lstrlenW (lpString=".jpg") returned 4 [0199.512] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.512] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.512] lstrlenW (lpString="AA42EP9[1].png") returned 14 [0199.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0199.513] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=461) returned 1 [0199.513] CloseHandle (hObject=0x350) returned 1 [0199.513] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png")) returned 0x2020 [0199.513] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.513] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0199.514] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0199.514] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0199.514] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0199.514] GetLastError () returned 0x0 [0199.514] ReadFile (in: hFile=0x350, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x1cd, lpOverlapped=0x0) returned 1 [0199.546] WriteFile (in: hFile=0x154, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1d0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1d0, lpOverlapped=0x0) returned 1 [0199.547] ReadFile (in: hFile=0x350, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0199.547] WriteFile (in: hFile=0x154, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.548] SetEndOfFile (hFile=0x154) returned 1 [0199.548] CloseHandle (hObject=0x154) returned 1 [0199.548] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0199.548] SetEndOfFile (hFile=0x350) returned 1 [0199.549] CloseHandle (hObject=0x350) returned 1 [0199.549] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.549] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa42ep9[1].png")) returned 1 [0199.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.738] lstrlenW (lpString=".doc") returned 4 [0199.738] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.738] lstrlenW (lpString=".docx") returned 5 [0199.738] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.738] lstrlenW (lpString=".pdf") returned 4 [0199.738] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.738] lstrlenW (lpString=".xls") returned 4 [0199.738] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.738] lstrlenW (lpString=".xlsx") returned 5 [0199.738] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.738] lstrlenW (lpString=".ppt") returned 4 [0199.738] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.738] lstrlenW (lpString=".zip") returned 4 [0199.738] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.738] lstrlenW (lpString=".rar") returned 4 [0199.738] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.738] lstrlenW (lpString=".bz2") returned 4 [0199.738] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.738] lstrlenW (lpString=".7z") returned 3 [0199.738] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.738] lstrlenW (lpString=".dbf") returned 4 [0199.738] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.738] lstrlenW (lpString=".1cd") returned 4 [0199.738] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.738] lstrlenW (lpString=".jpg") returned 4 [0199.738] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.739] lstrlenW (lpString=".doc") returned 4 [0199.739] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.739] lstrlenW (lpString=".docx") returned 5 [0199.739] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.739] lstrlenW (lpString=".pdf") returned 4 [0199.739] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.739] lstrlenW (lpString=".xls") returned 4 [0199.739] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.739] lstrlenW (lpString=".xlsx") returned 5 [0199.739] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.739] lstrlenW (lpString=".ppt") returned 4 [0199.739] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.739] lstrlenW (lpString=".zip") returned 4 [0199.739] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.739] lstrlenW (lpString=".rar") returned 4 [0199.739] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.739] lstrlenW (lpString=".bz2") returned 4 [0199.739] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.739] lstrlenW (lpString=".7z") returned 3 [0199.739] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.739] lstrlenW (lpString=".dbf") returned 4 [0199.739] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.740] lstrlenW (lpString=".1cd") returned 4 [0199.740] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA42EP9[1].png") returned 126 [0199.740] lstrlenW (lpString=".jpg") returned 4 [0199.740] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.740] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.740] lstrlenW (lpString="BB5kJAC[1].png") returned 14 [0199.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0200.803] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=288) returned 1 [0200.803] CloseHandle (hObject=0x378) returned 1 [0200.803] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png")) returned 0x2020 [0200.813] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0200.904] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0200.905] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0200.925] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.284] GetLastError () returned 0x0 [0202.284] ReadFile (in: hFile=0x378, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x120, lpOverlapped=0x0) returned 1 [0202.286] WriteFile (in: hFile=0x2d4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x130, lpOverlapped=0x0) returned 1 [0202.287] ReadFile (in: hFile=0x378, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0202.287] WriteFile (in: hFile=0x2d4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.287] SetEndOfFile (hFile=0x2d4) returned 1 [0202.287] CloseHandle (hObject=0x2d4) returned 1 [0202.287] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0202.287] SetEndOfFile (hFile=0x378) returned 1 [0202.288] CloseHandle (hObject=0x378) returned 1 [0202.288] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.288] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb5kjac[1].png")) returned 1 [0202.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.647] lstrlenW (lpString=".doc") returned 4 [0202.647] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0202.647] lstrlenW (lpString=".docx") returned 5 [0202.647] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0202.647] lstrlenW (lpString=".pdf") returned 4 [0202.648] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0202.648] lstrlenW (lpString=".xls") returned 4 [0202.648] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0202.648] lstrlenW (lpString=".xlsx") returned 5 [0202.648] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0202.648] lstrlenW (lpString=".ppt") returned 4 [0202.648] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0202.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.648] lstrlenW (lpString=".zip") returned 4 [0202.648] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0202.648] lstrlenW (lpString=".rar") returned 4 [0202.648] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0202.648] lstrlenW (lpString=".bz2") returned 4 [0202.648] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0202.648] lstrlenW (lpString=".7z") returned 3 [0202.648] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0202.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.648] lstrlenW (lpString=".dbf") returned 4 [0202.648] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0202.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.648] lstrlenW (lpString=".1cd") returned 4 [0202.648] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0202.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.648] lstrlenW (lpString=".jpg") returned 4 [0202.648] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0202.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.648] lstrlenW (lpString=".doc") returned 4 [0202.648] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0202.648] lstrlenW (lpString=".docx") returned 5 [0202.648] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0202.648] lstrlenW (lpString=".pdf") returned 4 [0202.649] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0202.649] lstrlenW (lpString=".xls") returned 4 [0202.649] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0202.649] lstrlenW (lpString=".xlsx") returned 5 [0202.649] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0202.649] lstrlenW (lpString=".ppt") returned 4 [0202.649] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0202.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.649] lstrlenW (lpString=".zip") returned 4 [0202.649] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0202.649] lstrlenW (lpString=".rar") returned 4 [0202.649] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0202.649] lstrlenW (lpString=".bz2") returned 4 [0202.649] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0202.649] lstrlenW (lpString=".7z") returned 3 [0202.649] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0202.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.649] lstrlenW (lpString=".dbf") returned 4 [0202.649] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0202.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.649] lstrlenW (lpString=".1cd") returned 4 [0202.649] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0202.649] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB5kJAC[1].png") returned 126 [0202.649] lstrlenW (lpString=".jpg") returned 4 [0202.649] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0202.649] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.649] lstrlenW (lpString="BBEgiYw[1].jpg") returned 14 [0202.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.107] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=9213) returned 1 [0203.107] CloseHandle (hObject=0x34c) returned 1 [0203.107] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg")) returned 0x2020 [0203.108] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.109] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0203.109] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0203.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.165] GetLastError () returned 0x0 [0203.165] ReadFile (in: hFile=0x344, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x23fd, lpOverlapped=0x0) returned 1 [0203.198] WriteFile (in: hFile=0x354, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2400, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2400, lpOverlapped=0x0) returned 1 [0203.231] ReadFile (in: hFile=0x344, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0203.231] WriteFile (in: hFile=0x354, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.231] SetEndOfFile (hFile=0x354) returned 1 [0203.231] CloseHandle (hObject=0x354) returned 1 [0203.231] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0203.231] SetEndOfFile (hFile=0x344) returned 1 [0203.232] CloseHandle (hObject=0x344) returned 1 [0203.232] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.232] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegiyw[1].jpg")) returned 1 [0203.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.232] lstrlenW (lpString=".doc") returned 4 [0203.232] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.232] lstrlenW (lpString=".docx") returned 5 [0203.232] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.233] lstrlenW (lpString=".pdf") returned 4 [0203.233] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.233] lstrlenW (lpString=".xls") returned 4 [0203.233] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.233] lstrlenW (lpString=".xlsx") returned 5 [0203.233] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.233] lstrlenW (lpString=".ppt") returned 4 [0203.233] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.233] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.233] lstrlenW (lpString=".zip") returned 4 [0203.233] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.233] lstrlenW (lpString=".rar") returned 4 [0203.233] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.233] lstrlenW (lpString=".bz2") returned 4 [0203.233] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.233] lstrlenW (lpString=".7z") returned 3 [0203.233] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.233] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.233] lstrlenW (lpString=".dbf") returned 4 [0203.233] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.233] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.233] lstrlenW (lpString=".1cd") returned 4 [0203.233] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.233] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.233] lstrlenW (lpString=".jpg") returned 4 [0203.233] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.234] lstrlenW (lpString=".doc") returned 4 [0203.234] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.234] lstrlenW (lpString=".docx") returned 5 [0203.234] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.234] lstrlenW (lpString=".pdf") returned 4 [0203.234] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.234] lstrlenW (lpString=".xls") returned 4 [0203.234] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.234] lstrlenW (lpString=".xlsx") returned 5 [0203.234] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.234] lstrlenW (lpString=".ppt") returned 4 [0203.234] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.234] lstrlenW (lpString=".zip") returned 4 [0203.234] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.234] lstrlenW (lpString=".rar") returned 4 [0203.234] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.234] lstrlenW (lpString=".bz2") returned 4 [0203.234] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.234] lstrlenW (lpString=".7z") returned 3 [0203.234] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.234] lstrlenW (lpString=".dbf") returned 4 [0203.234] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.234] lstrlenW (lpString=".1cd") returned 4 [0203.234] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgiYw[1].jpg") returned 126 [0203.234] lstrlenW (lpString=".jpg") returned 4 [0203.234] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.235] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0203.235] lstrlenW (lpString="benefits-5-mobile[1].png") returned 24 [0203.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.759] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=10733) returned 1 [0203.759] CloseHandle (hObject=0x354) returned 1 [0203.759] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png")) returned 0x2020 [0203.759] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.759] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0203.759] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0203.760] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0203.760] GetLastError () returned 0x0 [0203.760] ReadFile (in: hFile=0x354, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x29ed, lpOverlapped=0x0) returned 1 [0203.762] WriteFile (in: hFile=0x15c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x29f0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x29f0, lpOverlapped=0x0) returned 1 [0203.763] ReadFile (in: hFile=0x354, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0203.763] WriteFile (in: hFile=0x15c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x104, lpOverlapped=0x0) returned 1 [0203.763] SetEndOfFile (hFile=0x15c) returned 1 [0203.763] CloseHandle (hObject=0x15c) returned 1 [0203.764] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0203.764] SetEndOfFile (hFile=0x354) returned 1 [0203.764] CloseHandle (hObject=0x354) returned 1 [0203.765] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.765] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\benefits-5-mobile[1].png")) returned 1 [0203.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.765] lstrlenW (lpString=".doc") returned 4 [0203.765] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.765] lstrlenW (lpString=".docx") returned 5 [0203.765] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.765] lstrlenW (lpString=".pdf") returned 4 [0203.765] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.765] lstrlenW (lpString=".xls") returned 4 [0203.765] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.765] lstrlenW (lpString=".xlsx") returned 5 [0203.765] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.765] lstrlenW (lpString=".ppt") returned 4 [0203.765] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.765] lstrlenW (lpString=".zip") returned 4 [0203.765] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.765] lstrlenW (lpString=".rar") returned 4 [0203.765] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.765] lstrlenW (lpString=".bz2") returned 4 [0203.766] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.766] lstrlenW (lpString=".7z") returned 3 [0203.766] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.766] lstrlenW (lpString=".dbf") returned 4 [0203.766] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.766] lstrlenW (lpString=".1cd") returned 4 [0203.766] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.766] lstrlenW (lpString=".jpg") returned 4 [0203.766] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.766] lstrlenW (lpString=".doc") returned 4 [0203.766] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.766] lstrlenW (lpString=".docx") returned 5 [0203.766] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.766] lstrlenW (lpString=".pdf") returned 4 [0203.766] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.766] lstrlenW (lpString=".xls") returned 4 [0203.766] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.766] lstrlenW (lpString=".xlsx") returned 5 [0203.766] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.766] lstrlenW (lpString=".ppt") returned 4 [0203.766] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.766] lstrlenW (lpString=".zip") returned 4 [0203.766] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.766] lstrlenW (lpString=".rar") returned 4 [0203.766] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.766] lstrlenW (lpString=".bz2") returned 4 [0203.767] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.767] lstrlenW (lpString=".7z") returned 3 [0203.767] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.767] lstrlenW (lpString=".dbf") returned 4 [0203.767] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.767] lstrlenW (lpString=".1cd") returned 4 [0203.767] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.767] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\benefits-5-mobile[1].png") returned 136 [0203.767] lstrlenW (lpString=".jpg") returned 4 [0203.767] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.767] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0203.767] lstrlenW (lpString="1223855322-postmessagerelay[1].js") returned 33 [0203.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.045] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=10537) returned 1 [0204.045] CloseHandle (hObject=0x2d8) returned 1 [0204.045] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js")) returned 0x2020 [0204.045] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.045] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.045] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.045] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0204.049] GetLastError () returned 0x0 [0204.049] ReadFile (in: hFile=0x2d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x2929, lpOverlapped=0x0) returned 1 [0204.070] WriteFile (in: hFile=0x370, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2930, lpOverlapped=0x0) returned 1 [0204.071] ReadFile (in: hFile=0x2d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0204.071] WriteFile (in: hFile=0x370, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x116, lpOverlapped=0x0) returned 1 [0204.071] SetEndOfFile (hFile=0x370) returned 1 [0204.071] CloseHandle (hObject=0x370) returned 1 [0204.071] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.071] SetEndOfFile (hFile=0x2d8) returned 1 [0204.072] CloseHandle (hObject=0x2d8) returned 1 [0204.072] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.072] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\1223855322-postmessagerelay[1].js")) returned 1 [0204.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.073] lstrlenW (lpString=".doc") returned 4 [0204.073] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0204.073] lstrlenW (lpString=".docx") returned 5 [0204.073] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0204.073] lstrlenW (lpString=".pdf") returned 4 [0204.073] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0204.073] lstrlenW (lpString=".xls") returned 4 [0204.073] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0204.073] lstrlenW (lpString=".xlsx") returned 5 [0204.073] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0204.073] lstrlenW (lpString=".ppt") returned 4 [0204.073] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0204.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.073] lstrlenW (lpString=".zip") returned 4 [0204.073] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0204.073] lstrlenW (lpString=".rar") returned 4 [0204.073] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0204.073] lstrlenW (lpString=".bz2") returned 4 [0204.073] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0204.073] lstrlenW (lpString=".7z") returned 3 [0204.073] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0204.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.073] lstrlenW (lpString=".dbf") returned 4 [0204.073] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0204.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.073] lstrlenW (lpString=".1cd") returned 4 [0204.073] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0204.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.073] lstrlenW (lpString=".jpg") returned 4 [0204.073] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0204.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.074] lstrlenW (lpString=".doc") returned 4 [0204.074] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0204.074] lstrlenW (lpString=".docx") returned 5 [0204.074] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0204.074] lstrlenW (lpString=".pdf") returned 4 [0204.074] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0204.074] lstrlenW (lpString=".xls") returned 4 [0204.074] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0204.074] lstrlenW (lpString=".xlsx") returned 5 [0204.074] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0204.074] lstrlenW (lpString=".ppt") returned 4 [0204.074] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0204.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.074] lstrlenW (lpString=".zip") returned 4 [0204.074] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0204.074] lstrlenW (lpString=".rar") returned 4 [0204.074] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0204.074] lstrlenW (lpString=".bz2") returned 4 [0204.074] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0204.074] lstrlenW (lpString=".7z") returned 3 [0204.074] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0204.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.074] lstrlenW (lpString=".dbf") returned 4 [0204.074] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0204.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.074] lstrlenW (lpString=".1cd") returned 4 [0204.074] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0204.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\1223855322-postmessagerelay[1].js") returned 145 [0204.074] lstrlenW (lpString=".jpg") returned 4 [0204.074] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0204.075] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.075] lstrlenW (lpString="AA42pjY[1].png") returned 14 [0204.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.075] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=594) returned 1 [0204.075] CloseHandle (hObject=0x2d8) returned 1 [0204.075] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png")) returned 0x2020 [0204.076] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.076] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.076] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0204.076] GetLastError () returned 0x0 [0204.076] ReadFile (in: hFile=0x2d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x252, lpOverlapped=0x0) returned 1 [0204.087] WriteFile (in: hFile=0x370, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x260, lpOverlapped=0x0) returned 1 [0204.088] ReadFile (in: hFile=0x2d8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0204.088] WriteFile (in: hFile=0x370, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.088] SetEndOfFile (hFile=0x370) returned 1 [0204.088] CloseHandle (hObject=0x370) returned 1 [0204.088] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.088] SetEndOfFile (hFile=0x2d8) returned 1 [0204.089] CloseHandle (hObject=0x2d8) returned 1 [0204.089] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.089] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa42pjy[1].png")) returned 1 [0204.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.089] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.089] lstrlenW (lpString=".doc") returned 4 [0204.089] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.089] lstrlenW (lpString=".docx") returned 5 [0204.089] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.089] lstrlenW (lpString=".pdf") returned 4 [0204.089] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.089] lstrlenW (lpString=".xls") returned 4 [0204.089] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.089] lstrlenW (lpString=".xlsx") returned 5 [0204.090] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.090] lstrlenW (lpString=".ppt") returned 4 [0204.090] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.090] lstrlenW (lpString=".zip") returned 4 [0204.090] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.090] lstrlenW (lpString=".rar") returned 4 [0204.090] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.090] lstrlenW (lpString=".bz2") returned 4 [0204.090] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.090] lstrlenW (lpString=".7z") returned 3 [0204.090] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.090] lstrlenW (lpString=".dbf") returned 4 [0204.090] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.090] lstrlenW (lpString=".1cd") returned 4 [0204.090] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.090] lstrlenW (lpString=".jpg") returned 4 [0204.090] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.090] lstrlenW (lpString=".doc") returned 4 [0204.090] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.090] lstrlenW (lpString=".docx") returned 5 [0204.090] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.090] lstrlenW (lpString=".pdf") returned 4 [0204.090] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.090] lstrlenW (lpString=".xls") returned 4 [0204.090] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.090] lstrlenW (lpString=".xlsx") returned 5 [0204.091] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.091] lstrlenW (lpString=".ppt") returned 4 [0204.091] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.091] lstrlenW (lpString=".zip") returned 4 [0204.091] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.091] lstrlenW (lpString=".rar") returned 4 [0204.091] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.091] lstrlenW (lpString=".bz2") returned 4 [0204.091] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.091] lstrlenW (lpString=".7z") returned 3 [0204.091] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.091] lstrlenW (lpString=".dbf") returned 4 [0204.091] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.091] lstrlenW (lpString=".1cd") returned 4 [0204.091] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA42pjY[1].png") returned 126 [0204.091] lstrlenW (lpString=".jpg") returned 4 [0204.091] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.091] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.091] lstrlenW (lpString="AA61AKN[2].png") returned 14 [0204.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.107] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=584) returned 1 [0204.107] CloseHandle (hObject=0x358) returned 1 [0204.108] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png")) returned 0x2020 [0204.108] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.108] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.108] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0204.109] GetLastError () returned 0x0 [0204.109] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x248, lpOverlapped=0x0) returned 1 [0204.129] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x250, lpOverlapped=0x0) returned 1 [0204.130] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0204.130] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.130] SetEndOfFile (hFile=0x378) returned 1 [0204.130] CloseHandle (hObject=0x378) returned 1 [0204.130] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.131] SetEndOfFile (hFile=0x358) returned 1 [0204.131] CloseHandle (hObject=0x358) returned 1 [0204.131] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.132] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa61akn[2].png")) returned 1 [0204.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.132] lstrlenW (lpString=".doc") returned 4 [0204.132] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.132] lstrlenW (lpString=".docx") returned 5 [0204.132] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.132] lstrlenW (lpString=".pdf") returned 4 [0204.132] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.132] lstrlenW (lpString=".xls") returned 4 [0204.132] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.132] lstrlenW (lpString=".xlsx") returned 5 [0204.132] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.132] lstrlenW (lpString=".ppt") returned 4 [0204.132] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.132] lstrlenW (lpString=".zip") returned 4 [0204.132] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.132] lstrlenW (lpString=".rar") returned 4 [0204.132] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.132] lstrlenW (lpString=".bz2") returned 4 [0204.132] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.132] lstrlenW (lpString=".7z") returned 3 [0204.132] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.132] lstrlenW (lpString=".dbf") returned 4 [0204.132] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.132] lstrlenW (lpString=".1cd") returned 4 [0204.133] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.133] lstrlenW (lpString=".jpg") returned 4 [0204.133] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.133] lstrlenW (lpString=".doc") returned 4 [0204.133] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.133] lstrlenW (lpString=".docx") returned 5 [0204.133] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.133] lstrlenW (lpString=".pdf") returned 4 [0204.133] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.133] lstrlenW (lpString=".xls") returned 4 [0204.133] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.133] lstrlenW (lpString=".xlsx") returned 5 [0204.133] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.133] lstrlenW (lpString=".ppt") returned 4 [0204.133] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.133] lstrlenW (lpString=".zip") returned 4 [0204.133] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.133] lstrlenW (lpString=".rar") returned 4 [0204.133] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.133] lstrlenW (lpString=".bz2") returned 4 [0204.133] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.133] lstrlenW (lpString=".7z") returned 3 [0204.133] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.133] lstrlenW (lpString=".dbf") returned 4 [0204.133] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.133] lstrlenW (lpString=".1cd") returned 4 [0204.133] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA61AKN[2].png") returned 126 [0204.134] lstrlenW (lpString=".jpg") returned 4 [0204.134] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.134] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.134] lstrlenW (lpString="AA6KizP[2].png") returned 14 [0204.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.134] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=539) returned 1 [0204.134] CloseHandle (hObject=0x358) returned 1 [0204.134] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png")) returned 0x2020 [0204.134] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.135] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.135] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0204.135] GetLastError () returned 0x0 [0204.135] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x21b, lpOverlapped=0x0) returned 1 [0204.140] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x220, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x220, lpOverlapped=0x0) returned 1 [0204.141] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0204.141] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.141] SetEndOfFile (hFile=0x378) returned 1 [0204.141] CloseHandle (hObject=0x378) returned 1 [0204.141] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.141] SetEndOfFile (hFile=0x358) returned 1 [0204.142] CloseHandle (hObject=0x358) returned 1 [0204.142] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.142] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa6kizp[2].png")) returned 1 [0204.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.142] lstrlenW (lpString=".doc") returned 4 [0204.143] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.143] lstrlenW (lpString=".docx") returned 5 [0204.143] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.143] lstrlenW (lpString=".pdf") returned 4 [0204.143] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.143] lstrlenW (lpString=".xls") returned 4 [0204.143] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.143] lstrlenW (lpString=".xlsx") returned 5 [0204.143] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.143] lstrlenW (lpString=".ppt") returned 4 [0204.143] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.143] lstrlenW (lpString=".zip") returned 4 [0204.143] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.143] lstrlenW (lpString=".rar") returned 4 [0204.143] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.143] lstrlenW (lpString=".bz2") returned 4 [0204.143] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.143] lstrlenW (lpString=".7z") returned 3 [0204.143] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.143] lstrlenW (lpString=".dbf") returned 4 [0204.143] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.143] lstrlenW (lpString=".1cd") returned 4 [0204.143] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.143] lstrlenW (lpString=".jpg") returned 4 [0204.143] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.143] lstrlenW (lpString=".doc") returned 4 [0204.144] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.144] lstrlenW (lpString=".docx") returned 5 [0204.144] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.144] lstrlenW (lpString=".pdf") returned 4 [0204.144] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.144] lstrlenW (lpString=".xls") returned 4 [0204.144] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.144] lstrlenW (lpString=".xlsx") returned 5 [0204.144] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.144] lstrlenW (lpString=".ppt") returned 4 [0204.144] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.144] lstrlenW (lpString=".zip") returned 4 [0204.144] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.144] lstrlenW (lpString=".rar") returned 4 [0204.144] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.144] lstrlenW (lpString=".bz2") returned 4 [0204.144] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.144] lstrlenW (lpString=".7z") returned 3 [0204.144] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.144] lstrlenW (lpString=".dbf") returned 4 [0204.144] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.144] lstrlenW (lpString=".1cd") returned 4 [0204.144] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA6KizP[2].png") returned 126 [0204.144] lstrlenW (lpString=".jpg") returned 4 [0204.144] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.144] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.145] lstrlenW (lpString="AA7XCQ3[1].png") returned 14 [0204.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.146] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=635) returned 1 [0204.146] CloseHandle (hObject=0x358) returned 1 [0204.146] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png")) returned 0x2020 [0204.146] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.146] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.146] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0204.147] GetLastError () returned 0x0 [0204.147] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x27b, lpOverlapped=0x0) returned 1 [0204.449] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x280, lpOverlapped=0x0) returned 1 [0204.811] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0204.811] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.811] SetEndOfFile (hFile=0x378) returned 1 [0204.811] CloseHandle (hObject=0x378) returned 1 [0204.811] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.812] SetEndOfFile (hFile=0x358) returned 1 [0204.812] CloseHandle (hObject=0x358) returned 1 [0204.812] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.813] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa7xcq3[1].png")) returned 1 [0204.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.813] lstrlenW (lpString=".doc") returned 4 [0204.813] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.813] lstrlenW (lpString=".docx") returned 5 [0204.813] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.813] lstrlenW (lpString=".pdf") returned 4 [0204.813] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.813] lstrlenW (lpString=".xls") returned 4 [0204.813] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.813] lstrlenW (lpString=".xlsx") returned 5 [0204.813] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.813] lstrlenW (lpString=".ppt") returned 4 [0204.813] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.813] lstrlenW (lpString=".zip") returned 4 [0204.813] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.813] lstrlenW (lpString=".rar") returned 4 [0204.813] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.813] lstrlenW (lpString=".bz2") returned 4 [0204.813] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.813] lstrlenW (lpString=".7z") returned 3 [0204.813] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.813] lstrlenW (lpString=".dbf") returned 4 [0204.813] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.814] lstrlenW (lpString=".1cd") returned 4 [0204.814] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.814] lstrlenW (lpString=".jpg") returned 4 [0204.814] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.814] lstrlenW (lpString=".doc") returned 4 [0204.814] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.814] lstrlenW (lpString=".docx") returned 5 [0204.814] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.814] lstrlenW (lpString=".pdf") returned 4 [0204.814] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.814] lstrlenW (lpString=".xls") returned 4 [0204.814] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.814] lstrlenW (lpString=".xlsx") returned 5 [0204.814] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.814] lstrlenW (lpString=".ppt") returned 4 [0204.814] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.814] lstrlenW (lpString=".zip") returned 4 [0204.814] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.814] lstrlenW (lpString=".rar") returned 4 [0204.814] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.814] lstrlenW (lpString=".bz2") returned 4 [0204.814] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.814] lstrlenW (lpString=".7z") returned 3 [0204.814] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.814] lstrlenW (lpString=".dbf") returned 4 [0204.814] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.815] lstrlenW (lpString=".1cd") returned 4 [0204.815] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.815] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA7XCQ3[1].png") returned 126 [0204.815] lstrlenW (lpString=".jpg") returned 4 [0204.815] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.815] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.815] lstrlenW (lpString="BBBL4R9[1].jpg") returned 14 [0204.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.816] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=9577) returned 1 [0204.816] CloseHandle (hObject=0x358) returned 1 [0204.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg")) returned 0x2020 [0204.816] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.816] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.817] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.817] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0204.817] GetLastError () returned 0x0 [0204.817] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x2569, lpOverlapped=0x0) returned 1 [0204.819] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2570, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x2570, lpOverlapped=0x0) returned 1 [0204.820] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0204.820] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.820] SetEndOfFile (hFile=0x378) returned 1 [0204.820] CloseHandle (hObject=0x378) returned 1 [0204.820] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.821] SetEndOfFile (hFile=0x358) returned 1 [0204.821] CloseHandle (hObject=0x358) returned 1 [0204.821] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.822] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbl4r9[1].jpg")) returned 1 [0204.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.822] lstrlenW (lpString=".doc") returned 4 [0204.822] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.822] lstrlenW (lpString=".docx") returned 5 [0204.822] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.822] lstrlenW (lpString=".pdf") returned 4 [0204.822] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.822] lstrlenW (lpString=".xls") returned 4 [0204.822] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.822] lstrlenW (lpString=".xlsx") returned 5 [0204.822] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.822] lstrlenW (lpString=".ppt") returned 4 [0204.822] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.822] lstrlenW (lpString=".zip") returned 4 [0204.822] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.822] lstrlenW (lpString=".rar") returned 4 [0204.822] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.822] lstrlenW (lpString=".bz2") returned 4 [0204.822] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.822] lstrlenW (lpString=".7z") returned 3 [0204.822] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.822] lstrlenW (lpString=".dbf") returned 4 [0204.822] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.822] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.823] lstrlenW (lpString=".1cd") returned 4 [0204.823] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.823] lstrlenW (lpString=".jpg") returned 4 [0204.823] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.823] lstrlenW (lpString=".doc") returned 4 [0204.823] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.823] lstrlenW (lpString=".docx") returned 5 [0204.823] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.823] lstrlenW (lpString=".pdf") returned 4 [0204.823] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.823] lstrlenW (lpString=".xls") returned 4 [0204.823] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.823] lstrlenW (lpString=".xlsx") returned 5 [0204.823] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.823] lstrlenW (lpString=".ppt") returned 4 [0204.823] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.823] lstrlenW (lpString=".zip") returned 4 [0204.823] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.823] lstrlenW (lpString=".rar") returned 4 [0204.823] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.823] lstrlenW (lpString=".bz2") returned 4 [0204.823] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.823] lstrlenW (lpString=".7z") returned 3 [0204.823] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.823] lstrlenW (lpString=".dbf") returned 4 [0204.823] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.823] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.823] lstrlenW (lpString=".1cd") returned 4 [0204.823] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.824] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBL4R9[1].jpg") returned 126 [0204.824] lstrlenW (lpString=".jpg") returned 4 [0204.824] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.824] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.824] lstrlenW (lpString="BBBLhTZ[1].jpg") returned 14 [0204.824] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.825] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=12498) returned 1 [0204.825] CloseHandle (hObject=0x358) returned 1 [0204.825] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg")) returned 0x2020 [0204.825] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.825] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.825] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0204.826] GetLastError () returned 0x0 [0204.826] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x30d2, lpOverlapped=0x0) returned 1 [0204.828] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x30e0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x30e0, lpOverlapped=0x0) returned 1 [0204.829] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0204.829] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.829] SetEndOfFile (hFile=0x378) returned 1 [0204.829] CloseHandle (hObject=0x378) returned 1 [0204.829] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.829] SetEndOfFile (hFile=0x358) returned 1 [0204.830] CloseHandle (hObject=0x358) returned 1 [0204.830] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.830] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbblhtz[1].jpg")) returned 1 [0204.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.830] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.830] lstrlenW (lpString=".doc") returned 4 [0204.830] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.830] lstrlenW (lpString=".docx") returned 5 [0204.831] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.831] lstrlenW (lpString=".pdf") returned 4 [0204.831] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.831] lstrlenW (lpString=".xls") returned 4 [0204.831] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.831] lstrlenW (lpString=".xlsx") returned 5 [0204.831] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.831] lstrlenW (lpString=".ppt") returned 4 [0204.831] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.831] lstrlenW (lpString=".zip") returned 4 [0204.831] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.831] lstrlenW (lpString=".rar") returned 4 [0204.831] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.831] lstrlenW (lpString=".bz2") returned 4 [0204.831] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.831] lstrlenW (lpString=".7z") returned 3 [0204.831] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.831] lstrlenW (lpString=".dbf") returned 4 [0204.831] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.831] lstrlenW (lpString=".1cd") returned 4 [0204.831] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.831] lstrlenW (lpString=".jpg") returned 4 [0204.831] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.831] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.831] lstrlenW (lpString=".doc") returned 4 [0204.831] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.831] lstrlenW (lpString=".docx") returned 5 [0204.831] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.831] lstrlenW (lpString=".pdf") returned 4 [0204.832] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.832] lstrlenW (lpString=".xls") returned 4 [0204.832] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.832] lstrlenW (lpString=".xlsx") returned 5 [0204.832] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.832] lstrlenW (lpString=".ppt") returned 4 [0204.832] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.832] lstrlenW (lpString=".zip") returned 4 [0204.832] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.832] lstrlenW (lpString=".rar") returned 4 [0204.832] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.832] lstrlenW (lpString=".bz2") returned 4 [0204.832] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.832] lstrlenW (lpString=".7z") returned 3 [0204.832] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.832] lstrlenW (lpString=".dbf") returned 4 [0204.832] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.832] lstrlenW (lpString=".1cd") returned 4 [0204.832] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.832] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBLhTZ[1].jpg") returned 126 [0204.832] lstrlenW (lpString=".jpg") returned 4 [0204.832] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.832] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.832] lstrlenW (lpString="BBBnhZY[1].jpg") returned 14 [0204.832] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.833] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=2489) returned 1 [0204.833] CloseHandle (hObject=0x358) returned 1 [0204.833] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg")) returned 0x2020 [0204.833] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.833] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.833] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.833] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0204.834] GetLastError () returned 0x0 [0204.834] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x9b9, lpOverlapped=0x0) returned 1 [0204.835] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0204.836] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0204.836] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.836] SetEndOfFile (hFile=0x378) returned 1 [0204.837] CloseHandle (hObject=0x378) returned 1 [0204.837] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.837] SetEndOfFile (hFile=0x358) returned 1 [0204.837] CloseHandle (hObject=0x358) returned 1 [0204.837] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.838] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbnhzy[1].jpg")) returned 1 [0204.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.838] lstrlenW (lpString=".doc") returned 4 [0204.838] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.838] lstrlenW (lpString=".docx") returned 5 [0204.838] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.838] lstrlenW (lpString=".pdf") returned 4 [0204.838] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.838] lstrlenW (lpString=".xls") returned 4 [0204.838] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.838] lstrlenW (lpString=".xlsx") returned 5 [0204.838] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.838] lstrlenW (lpString=".ppt") returned 4 [0204.838] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.838] lstrlenW (lpString=".zip") returned 4 [0204.838] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.838] lstrlenW (lpString=".rar") returned 4 [0204.838] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.838] lstrlenW (lpString=".bz2") returned 4 [0204.838] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.838] lstrlenW (lpString=".7z") returned 3 [0204.838] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.838] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.838] lstrlenW (lpString=".dbf") returned 4 [0204.839] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.839] lstrlenW (lpString=".1cd") returned 4 [0204.839] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.839] lstrlenW (lpString=".jpg") returned 4 [0204.839] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.839] lstrlenW (lpString=".doc") returned 4 [0204.839] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.839] lstrlenW (lpString=".docx") returned 5 [0204.839] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.839] lstrlenW (lpString=".pdf") returned 4 [0204.839] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.839] lstrlenW (lpString=".xls") returned 4 [0204.839] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.839] lstrlenW (lpString=".xlsx") returned 5 [0204.839] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.839] lstrlenW (lpString=".ppt") returned 4 [0204.839] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.839] lstrlenW (lpString=".zip") returned 4 [0204.839] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.839] lstrlenW (lpString=".rar") returned 4 [0204.839] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.839] lstrlenW (lpString=".bz2") returned 4 [0204.839] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.839] lstrlenW (lpString=".7z") returned 3 [0204.839] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.839] lstrlenW (lpString=".dbf") returned 4 [0204.839] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.839] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.840] lstrlenW (lpString=".1cd") returned 4 [0204.840] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBnhZY[1].jpg") returned 126 [0204.840] lstrlenW (lpString=".jpg") returned 4 [0204.840] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.840] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.840] lstrlenW (lpString="BBBPhAr[1].jpg") returned 14 [0204.840] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.840] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=18676) returned 1 [0204.840] CloseHandle (hObject=0x358) returned 1 [0204.840] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg")) returned 0x2020 [0204.841] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.841] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.841] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.841] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0204.841] GetLastError () returned 0x0 [0204.841] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x48f4, lpOverlapped=0x0) returned 1 [0204.843] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x4900, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x4900, lpOverlapped=0x0) returned 1 [0204.844] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0204.845] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.845] SetEndOfFile (hFile=0x378) returned 1 [0204.845] CloseHandle (hObject=0x378) returned 1 [0204.845] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.845] SetEndOfFile (hFile=0x358) returned 1 [0204.846] CloseHandle (hObject=0x358) returned 1 [0204.846] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.846] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbphar[1].jpg")) returned 1 [0204.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.846] lstrlenW (lpString=".doc") returned 4 [0204.846] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.846] lstrlenW (lpString=".docx") returned 5 [0204.846] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.846] lstrlenW (lpString=".pdf") returned 4 [0204.846] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.846] lstrlenW (lpString=".xls") returned 4 [0204.846] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.846] lstrlenW (lpString=".xlsx") returned 5 [0204.846] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.846] lstrlenW (lpString=".ppt") returned 4 [0204.846] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.847] lstrlenW (lpString=".zip") returned 4 [0204.847] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.847] lstrlenW (lpString=".rar") returned 4 [0204.847] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.847] lstrlenW (lpString=".bz2") returned 4 [0204.847] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.847] lstrlenW (lpString=".7z") returned 3 [0204.847] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.847] lstrlenW (lpString=".dbf") returned 4 [0204.847] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.847] lstrlenW (lpString=".1cd") returned 4 [0204.847] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.847] lstrlenW (lpString=".jpg") returned 4 [0204.847] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.847] lstrlenW (lpString=".doc") returned 4 [0204.847] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.847] lstrlenW (lpString=".docx") returned 5 [0204.847] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.847] lstrlenW (lpString=".pdf") returned 4 [0204.847] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.847] lstrlenW (lpString=".xls") returned 4 [0204.847] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.847] lstrlenW (lpString=".xlsx") returned 5 [0204.847] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.847] lstrlenW (lpString=".ppt") returned 4 [0204.847] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.847] lstrlenW (lpString=".zip") returned 4 [0204.848] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.848] lstrlenW (lpString=".rar") returned 4 [0204.848] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.848] lstrlenW (lpString=".bz2") returned 4 [0204.848] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.848] lstrlenW (lpString=".7z") returned 3 [0204.848] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.848] lstrlenW (lpString=".dbf") returned 4 [0204.848] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.848] lstrlenW (lpString=".1cd") returned 4 [0204.848] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPhAr[1].jpg") returned 126 [0204.848] lstrlenW (lpString=".jpg") returned 4 [0204.848] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.848] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.848] lstrlenW (lpString="BBBPiby[1].jpg") returned 14 [0204.848] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.849] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x2ffff1c | out: lpFileSize=0x2ffff1c*=7201) returned 1 [0204.849] CloseHandle (hObject=0x358) returned 1 [0204.849] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg")) returned 0x2020 [0204.849] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.849] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.849] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2fffec8 | out: lpNewFilePointer=0x0) returned 1 [0204.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBPiby[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbpiby[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0204.850] GetLastError () returned 0x0 [0204.850] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x1c21, lpOverlapped=0x0) returned 1 [0204.991] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0x1c30, lpOverlapped=0x0) returned 1 [0204.992] ReadFile (in: hFile=0x358, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2fffed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2fffed4*=0x0, lpOverlapped=0x0) returned 1 [0204.992] WriteFile (in: hFile=0x378, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2fffc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2fffc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.993] SetEndOfFile (hFile=0x378) Thread: id = 70 os_tid = 0x7c0 [0183.495] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x3870050 [0183.496] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x3880058 [0183.496] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310eb8 [0183.496] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6) returned 0x322148 [0183.496] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310ed0 [0183.496] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x3cf0020 [0183.496] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310ee8 [0183.497] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310ee8, Size=0x20) returned 0x2dc638 [0183.497] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x310ee8 [0183.497] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x310ee8, Size=0x20) returned 0x2dc660 [0183.497] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.497] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.497] Wow64DisableWow64FsRedirection (in: OldValue=0x313ff58 | out: OldValue=0x313ff58*=0x0) returned 1 [0183.497] lstrlenW (lpString="kernel32.dll") returned 12 [0183.497] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc638 | out: hHeap=0x270000) returned 1 [0183.497] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.497] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x2dc660 | out: hHeap=0x270000) returned 1 [0183.497] Sleep (dwMilliseconds=0x64) [0183.607] Sleep (dwMilliseconds=0x64) [0183.776] lstrcmpiW (lpString1=".avi", lpString2=".wiki") returned -1 [0183.776] lstrlenW (lpString="boxed-correct.avi") returned 17 [0183.776] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.824] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=89600) returned 1 [0183.824] CloseHandle (hObject=0x1d0) returned 1 [0183.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0183.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.824] lstrlenW (lpString=".doc") returned 4 [0183.824] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.824] lstrlenW (lpString=".docx") returned 5 [0183.825] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0183.825] lstrlenW (lpString=".pdf") returned 4 [0183.825] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.825] lstrlenW (lpString=".xls") returned 4 [0183.825] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.825] lstrlenW (lpString=".xlsx") returned 5 [0183.825] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0183.825] lstrlenW (lpString=".ppt") returned 4 [0183.825] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.825] lstrlenW (lpString=".zip") returned 4 [0183.825] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.825] lstrlenW (lpString=".rar") returned 4 [0183.825] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.825] lstrlenW (lpString=".bz2") returned 4 [0183.825] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.825] lstrlenW (lpString=".7z") returned 3 [0183.825] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.825] lstrlenW (lpString=".dbf") returned 4 [0183.825] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.825] lstrlenW (lpString=".1cd") returned 4 [0183.825] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.825] lstrlenW (lpString=".jpg") returned 4 [0183.825] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.825] lstrlenW (lpString=".doc") returned 4 [0183.825] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0183.826] lstrlenW (lpString=".docx") returned 5 [0183.826] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0183.826] lstrlenW (lpString=".pdf") returned 4 [0183.826] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0183.826] lstrlenW (lpString=".xls") returned 4 [0183.826] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0183.826] lstrlenW (lpString=".xlsx") returned 5 [0183.826] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0183.826] lstrlenW (lpString=".ppt") returned 4 [0183.826] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0183.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.826] lstrlenW (lpString=".zip") returned 4 [0183.826] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0183.826] lstrlenW (lpString=".rar") returned 4 [0183.826] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0183.826] lstrlenW (lpString=".bz2") returned 4 [0183.826] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0183.826] lstrlenW (lpString=".7z") returned 3 [0183.826] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0183.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.826] lstrlenW (lpString=".dbf") returned 4 [0183.826] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0183.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.826] lstrlenW (lpString=".1cd") returned 4 [0183.826] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0183.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0183.826] lstrlenW (lpString=".jpg") returned 4 [0183.826] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0183.826] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.826] lstrlenW (lpString="base.xml") returned 8 [0183.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.864] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3150) returned 1 [0183.864] CloseHandle (hObject=0x1d0) returned 1 [0183.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml")) returned 0x20 [0183.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\main\\base.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.865] lstrlenW (lpString=".doc") returned 4 [0183.865] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.865] lstrlenW (lpString=".docx") returned 5 [0183.865] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.865] lstrlenW (lpString=".pdf") returned 4 [0183.865] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.865] lstrlenW (lpString=".xls") returned 4 [0183.865] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.865] lstrlenW (lpString=".xlsx") returned 5 [0183.865] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0183.865] lstrlenW (lpString=".ppt") returned 4 [0183.865] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.865] lstrlenW (lpString=".zip") returned 4 [0183.865] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.865] lstrlenW (lpString=".rar") returned 4 [0183.865] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.865] lstrlenW (lpString=".bz2") returned 4 [0183.865] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.865] lstrlenW (lpString=".7z") returned 3 [0183.865] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.865] lstrlenW (lpString=".dbf") returned 4 [0183.865] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.865] lstrlenW (lpString=".1cd") returned 4 [0183.865] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.865] lstrlenW (lpString=".jpg") returned 4 [0183.865] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.866] lstrlenW (lpString=".doc") returned 4 [0183.866] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.866] lstrlenW (lpString=".docx") returned 5 [0183.866] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0183.866] lstrlenW (lpString=".pdf") returned 4 [0183.866] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.866] lstrlenW (lpString=".xls") returned 4 [0183.866] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.866] lstrlenW (lpString=".xlsx") returned 5 [0183.866] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0183.866] lstrlenW (lpString=".ppt") returned 4 [0183.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.866] lstrlenW (lpString=".zip") returned 4 [0183.866] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.866] lstrlenW (lpString=".rar") returned 4 [0183.866] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.866] lstrlenW (lpString=".bz2") returned 4 [0183.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.866] lstrlenW (lpString=".7z") returned 3 [0183.867] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0183.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.867] lstrlenW (lpString=".dbf") returned 4 [0183.867] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0183.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.867] lstrlenW (lpString=".1cd") returned 4 [0183.867] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0183.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\main\\base.xml") returned 78 [0183.867] lstrlenW (lpString=".jpg") returned 4 [0183.867] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0183.867] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0183.867] lstrlenW (lpString="hwrenclm.dat") returned 12 [0183.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.870] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=815680) returned 1 [0183.870] CloseHandle (hObject=0x1d0) returned 1 [0183.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat")) returned 0x20 [0183.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrenclm.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.870] lstrlenW (lpString=".doc") returned 4 [0183.870] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0183.870] lstrlenW (lpString=".docx") returned 5 [0183.870] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0183.870] lstrlenW (lpString=".pdf") returned 4 [0183.870] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0183.870] lstrlenW (lpString=".xls") returned 4 [0183.870] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0183.870] lstrlenW (lpString=".xlsx") returned 5 [0183.870] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0183.870] lstrlenW (lpString=".ppt") returned 4 [0183.870] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0183.870] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.870] lstrlenW (lpString=".zip") returned 4 [0183.870] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0183.870] lstrlenW (lpString=".rar") returned 4 [0183.870] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0183.870] lstrlenW (lpString=".bz2") returned 4 [0183.870] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0183.870] lstrlenW (lpString=".7z") returned 3 [0183.871] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0183.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.871] lstrlenW (lpString=".dbf") returned 4 [0183.871] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0183.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.871] lstrlenW (lpString=".1cd") returned 4 [0183.871] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0183.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.871] lstrlenW (lpString=".jpg") returned 4 [0183.871] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0183.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.871] lstrlenW (lpString=".doc") returned 4 [0183.871] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0183.871] lstrlenW (lpString=".docx") returned 5 [0183.871] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0183.871] lstrlenW (lpString=".pdf") returned 4 [0183.871] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0183.871] lstrlenW (lpString=".xls") returned 4 [0183.871] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0183.871] lstrlenW (lpString=".xlsx") returned 5 [0183.871] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0183.871] lstrlenW (lpString=".ppt") returned 4 [0183.871] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0183.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.871] lstrlenW (lpString=".zip") returned 4 [0183.871] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0183.871] lstrlenW (lpString=".rar") returned 4 [0183.871] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0183.871] lstrlenW (lpString=".bz2") returned 4 [0183.871] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0183.871] lstrlenW (lpString=".7z") returned 3 [0183.871] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0183.871] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.871] lstrlenW (lpString=".dbf") returned 4 [0183.872] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0183.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.872] lstrlenW (lpString=".1cd") returned 4 [0183.872] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0183.872] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrenclm.dat") returned 63 [0183.872] lstrlenW (lpString=".jpg") returned 4 [0183.872] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0183.872] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0183.872] lstrlenW (lpString="hwruksh.dat") returned 11 [0183.872] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.872] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2227968) returned 1 [0183.872] CloseHandle (hObject=0x1d0) returned 1 [0183.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat")) returned 0x20 [0183.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.872] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.873] lstrlenW (lpString=".doc") returned 4 [0183.873] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0183.873] lstrlenW (lpString=".docx") returned 5 [0183.873] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0183.873] lstrlenW (lpString=".pdf") returned 4 [0183.873] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0183.873] lstrlenW (lpString=".xls") returned 4 [0183.873] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0183.873] lstrlenW (lpString=".xlsx") returned 5 [0183.873] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0183.873] lstrlenW (lpString=".ppt") returned 4 [0183.873] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0183.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.873] lstrlenW (lpString=".zip") returned 4 [0183.873] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0183.873] lstrlenW (lpString=".rar") returned 4 [0183.873] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0183.873] lstrlenW (lpString=".bz2") returned 4 [0183.873] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0183.873] lstrlenW (lpString=".7z") returned 3 [0183.873] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0183.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.873] lstrlenW (lpString=".dbf") returned 4 [0183.873] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0183.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.873] lstrlenW (lpString=".1cd") returned 4 [0183.873] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0183.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.873] lstrlenW (lpString=".jpg") returned 4 [0183.873] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0183.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.874] lstrlenW (lpString=".doc") returned 4 [0183.874] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0183.874] lstrlenW (lpString=".docx") returned 5 [0183.874] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0183.874] lstrlenW (lpString=".pdf") returned 4 [0183.874] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0183.874] lstrlenW (lpString=".xls") returned 4 [0183.874] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0183.874] lstrlenW (lpString=".xlsx") returned 5 [0183.874] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0183.874] lstrlenW (lpString=".ppt") returned 4 [0183.874] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0183.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.874] lstrlenW (lpString=".zip") returned 4 [0183.874] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0183.874] lstrlenW (lpString=".rar") returned 4 [0183.874] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0183.874] lstrlenW (lpString=".bz2") returned 4 [0183.874] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0183.874] lstrlenW (lpString=".7z") returned 3 [0183.874] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0183.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.874] lstrlenW (lpString=".dbf") returned 4 [0183.874] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0183.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.874] lstrlenW (lpString=".1cd") returned 4 [0183.874] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0183.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat") returned 62 [0183.874] lstrlenW (lpString=".jpg") returned 4 [0183.874] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0183.875] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0183.875] lstrlenW (lpString="hwrusalm.dat") returned 12 [0183.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.877] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3195696) returned 1 [0183.877] CloseHandle (hObject=0x1d0) returned 1 [0183.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat")) returned 0x20 [0183.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.877] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.877] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.877] lstrlenW (lpString=".doc") returned 4 [0183.878] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0183.878] lstrlenW (lpString=".docx") returned 5 [0183.878] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0183.878] lstrlenW (lpString=".pdf") returned 4 [0183.878] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0183.878] lstrlenW (lpString=".xls") returned 4 [0183.878] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0183.878] lstrlenW (lpString=".xlsx") returned 5 [0183.878] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0183.878] lstrlenW (lpString=".ppt") returned 4 [0183.878] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0183.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.878] lstrlenW (lpString=".zip") returned 4 [0183.878] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0183.878] lstrlenW (lpString=".rar") returned 4 [0183.878] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0183.878] lstrlenW (lpString=".bz2") returned 4 [0183.878] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0183.878] lstrlenW (lpString=".7z") returned 3 [0183.878] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0183.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.878] lstrlenW (lpString=".dbf") returned 4 [0183.878] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0183.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.878] lstrlenW (lpString=".1cd") returned 4 [0183.878] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0183.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.878] lstrlenW (lpString=".jpg") returned 4 [0183.878] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0183.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.878] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.878] lstrlenW (lpString=".doc") returned 4 [0183.878] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0183.879] lstrlenW (lpString=".docx") returned 5 [0183.879] lstrcmpiW (lpString1=".docx", lpString2="m.dat") returned -1 [0183.879] lstrlenW (lpString=".pdf") returned 4 [0183.879] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0183.879] lstrlenW (lpString=".xls") returned 4 [0183.879] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0183.879] lstrlenW (lpString=".xlsx") returned 5 [0183.879] lstrcmpiW (lpString1=".xlsx", lpString2="m.dat") returned -1 [0183.879] lstrlenW (lpString=".ppt") returned 4 [0183.879] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0183.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.879] lstrlenW (lpString=".zip") returned 4 [0183.879] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0183.879] lstrlenW (lpString=".rar") returned 4 [0183.879] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0183.879] lstrlenW (lpString=".bz2") returned 4 [0183.879] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0183.879] lstrlenW (lpString=".7z") returned 3 [0183.879] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0183.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.879] lstrlenW (lpString=".dbf") returned 4 [0183.879] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0183.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.879] lstrlenW (lpString=".1cd") returned 4 [0183.879] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0183.879] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat") returned 63 [0183.879] lstrlenW (lpString=".jpg") returned 4 [0183.879] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0183.879] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0183.879] lstrlenW (lpString="hwrusash.dat") returned 12 [0183.880] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.880] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=4120784) returned 1 [0183.880] CloseHandle (hObject=0x1d0) returned 1 [0183.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat")) returned 0x20 [0183.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.880] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0183.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.880] lstrlenW (lpString=".doc") returned 4 [0183.880] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0183.880] lstrlenW (lpString=".docx") returned 5 [0183.880] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0183.880] lstrlenW (lpString=".pdf") returned 4 [0183.880] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0183.880] lstrlenW (lpString=".xls") returned 4 [0183.880] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0183.881] lstrlenW (lpString=".xlsx") returned 5 [0183.881] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0183.881] lstrlenW (lpString=".ppt") returned 4 [0183.881] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0183.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.881] lstrlenW (lpString=".zip") returned 4 [0183.881] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0183.881] lstrlenW (lpString=".rar") returned 4 [0183.881] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0183.881] lstrlenW (lpString=".bz2") returned 4 [0183.881] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0183.881] lstrlenW (lpString=".7z") returned 3 [0183.881] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0183.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.881] lstrlenW (lpString=".dbf") returned 4 [0183.881] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0183.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.881] lstrlenW (lpString=".1cd") returned 4 [0183.881] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0183.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.881] lstrlenW (lpString=".jpg") returned 4 [0183.881] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0183.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.881] lstrlenW (lpString=".doc") returned 4 [0183.881] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0183.881] lstrlenW (lpString=".docx") returned 5 [0183.881] lstrcmpiW (lpString1=".docx", lpString2="h.dat") returned -1 [0183.881] lstrlenW (lpString=".pdf") returned 4 [0183.881] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0183.881] lstrlenW (lpString=".xls") returned 4 [0183.881] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0183.881] lstrlenW (lpString=".xlsx") returned 5 [0183.881] lstrcmpiW (lpString1=".xlsx", lpString2="h.dat") returned -1 [0183.882] lstrlenW (lpString=".ppt") returned 4 [0183.882] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0183.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.882] lstrlenW (lpString=".zip") returned 4 [0183.882] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0183.882] lstrlenW (lpString=".rar") returned 4 [0183.882] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0183.882] lstrlenW (lpString=".bz2") returned 4 [0183.882] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0183.882] lstrlenW (lpString=".7z") returned 3 [0183.882] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0183.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.882] lstrlenW (lpString=".dbf") returned 4 [0183.882] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0183.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.882] lstrlenW (lpString=".1cd") returned 4 [0183.882] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0183.882] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat") returned 63 [0183.882] lstrlenW (lpString=".jpg") returned 4 [0183.882] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0183.882] lstrcmpiW (lpString1=".xml", lpString2=".wiki") returned 1 [0183.882] lstrlenW (lpString="ipscat.xml") returned 10 [0183.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d0 [0183.883] GetFileSizeEx (in: hFile=0x1d0, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2592) returned 1 [0183.883] CloseHandle (hObject=0x1d0) returned 1 [0183.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml")) returned 0x20 [0183.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.883] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipscat.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0183.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0183.883] lstrlenW (lpString=".doc") returned 4 [0183.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0183.883] lstrlenW (lpString=".docx") returned 5 [0183.883] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0183.883] lstrlenW (lpString=".pdf") returned 4 [0183.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0183.883] lstrlenW (lpString=".xls") returned 4 [0183.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0183.883] lstrlenW (lpString=".xlsx") returned 5 [0183.883] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0183.883] lstrlenW (lpString=".ppt") returned 4 [0183.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0183.883] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipscat.xml") returned 61 [0183.883] lstrlenW (lpString=".zip") returned 4 [0183.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0183.883] lstrlenW (lpString=".rar") returned 4 [0183.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0183.884] lstrlenW (lpString=".bz2") returned 4 [0183.884] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0183.884] lstrlenW (lpString=".7z") returned 3 [0183.884] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0185.347] GetFileSizeEx (in: hFile=0x324, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3808) returned 1 [0185.348] CloseHandle (hObject=0x324) returned 1 [0185.350] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png")) returned 0x20 [0185.350] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.351] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\NextMenuButtonIcon.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\nextmenubuttonicon.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.351] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.351] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0185.352] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.352] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.352] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0185.352] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.352] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.352] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.352] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.352] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.352] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.352] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.352] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.352] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0185.352] lstrcmpiW (lpString1=".docx", lpString2="n.png") returned -1 [0185.352] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0185.352] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0185.352] lstrcmpiW (lpString1=".xlsx", lpString2="n.png") returned -1 [0185.352] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0185.352] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0185.352] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0185.352] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0185.353] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0185.353] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0185.353] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0185.353] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0185.353] lstrcmpiW (lpString1=".WMF", lpString2=".wiki") returned 1 [0185.911] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1528) returned 1 [0185.911] CloseHandle (hObject=0x310) returned 1 [0185.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0185.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.215] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\document parts\\1033\\14\\built-in building blocks.dotx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.216] lstrlenW (lpString=".doc") returned 4 [0188.216] lstrcmpiW (lpString1=".doc", lpString2="dotx") returned -1 [0188.216] lstrlenW (lpString=".docx") returned 5 [0188.216] lstrcmpiW (lpString1=".docx", lpString2=".dotx") returned -1 [0188.216] lstrlenW (lpString=".pdf") returned 4 [0188.216] lstrcmpiW (lpString1=".pdf", lpString2="dotx") returned -1 [0188.216] lstrlenW (lpString=".xls") returned 4 [0188.216] lstrcmpiW (lpString1=".xls", lpString2="dotx") returned -1 [0188.216] lstrlenW (lpString=".xlsx") returned 5 [0188.216] lstrcmpiW (lpString1=".xlsx", lpString2=".dotx") returned 1 [0188.216] lstrlenW (lpString=".ppt") returned 4 [0188.216] lstrcmpiW (lpString1=".ppt", lpString2="dotx") returned -1 [0188.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.216] lstrlenW (lpString=".zip") returned 4 [0188.216] lstrcmpiW (lpString1=".zip", lpString2="dotx") returned -1 [0188.216] lstrlenW (lpString=".rar") returned 4 [0188.216] lstrcmpiW (lpString1=".rar", lpString2="dotx") returned -1 [0188.216] lstrlenW (lpString=".bz2") returned 4 [0188.216] lstrcmpiW (lpString1=".bz2", lpString2="dotx") returned -1 [0188.216] lstrlenW (lpString=".7z") returned 3 [0188.216] lstrcmpiW (lpString1=".7z", lpString2="otx") returned -1 [0188.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.216] lstrlenW (lpString=".dbf") returned 4 [0188.216] lstrcmpiW (lpString1=".dbf", lpString2="dotx") returned -1 [0188.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.216] lstrlenW (lpString=".1cd") returned 4 [0188.216] lstrcmpiW (lpString1=".1cd", lpString2="dotx") returned -1 [0188.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.216] lstrlenW (lpString=".jpg") returned 4 [0188.217] lstrcmpiW (lpString1=".jpg", lpString2="dotx") returned -1 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.217] lstrlenW (lpString=".doc") returned 4 [0188.217] lstrcmpiW (lpString1=".doc", lpString2="dotx") returned -1 [0188.217] lstrlenW (lpString=".docx") returned 5 [0188.217] lstrcmpiW (lpString1=".docx", lpString2=".dotx") returned -1 [0188.217] lstrlenW (lpString=".pdf") returned 4 [0188.217] lstrcmpiW (lpString1=".pdf", lpString2="dotx") returned -1 [0188.217] lstrlenW (lpString=".xls") returned 4 [0188.217] lstrcmpiW (lpString1=".xls", lpString2="dotx") returned -1 [0188.217] lstrlenW (lpString=".xlsx") returned 5 [0188.217] lstrcmpiW (lpString1=".xlsx", lpString2=".dotx") returned 1 [0188.217] lstrlenW (lpString=".ppt") returned 4 [0188.217] lstrcmpiW (lpString1=".ppt", lpString2="dotx") returned -1 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.217] lstrlenW (lpString=".zip") returned 4 [0188.217] lstrcmpiW (lpString1=".zip", lpString2="dotx") returned -1 [0188.217] lstrlenW (lpString=".rar") returned 4 [0188.217] lstrcmpiW (lpString1=".rar", lpString2="dotx") returned -1 [0188.217] lstrlenW (lpString=".bz2") returned 4 [0188.217] lstrcmpiW (lpString1=".bz2", lpString2="dotx") returned -1 [0188.217] lstrlenW (lpString=".7z") returned 3 [0188.217] lstrcmpiW (lpString1=".7z", lpString2="otx") returned -1 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.217] lstrlenW (lpString=".dbf") returned 4 [0188.217] lstrcmpiW (lpString1=".dbf", lpString2="dotx") returned -1 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.217] lstrlenW (lpString=".1cd") returned 4 [0188.217] lstrcmpiW (lpString1=".1cd", lpString2="dotx") returned -1 [0188.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Document Parts\\1033\\14\\Built-In Building Blocks.dotx") returned 95 [0188.217] lstrlenW (lpString=".jpg") returned 4 [0188.217] lstrcmpiW (lpString1=".jpg", lpString2="dotx") returned -1 [0188.218] lstrcmpiW (lpString1=".DAT", lpString2=".wiki") returned -1 [0188.218] lstrlenW (lpString="ENGDIC.DAT") returned 10 [0188.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.218] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=289926) returned 1 [0188.218] CloseHandle (hObject=0x1e8) returned 1 [0188.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat")) returned 0x20 [0188.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engdic.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.219] lstrlenW (lpString=".doc") returned 4 [0188.219] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0188.219] lstrlenW (lpString=".docx") returned 5 [0188.219] lstrcmpiW (lpString1=".docx", lpString2="C.DAT") returned -1 [0188.219] lstrlenW (lpString=".pdf") returned 4 [0188.219] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0188.219] lstrlenW (lpString=".xls") returned 4 [0188.219] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0188.219] lstrlenW (lpString=".xlsx") returned 5 [0188.219] lstrcmpiW (lpString1=".xlsx", lpString2="C.DAT") returned -1 [0188.219] lstrlenW (lpString=".ppt") returned 4 [0188.219] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0188.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.219] lstrlenW (lpString=".zip") returned 4 [0188.219] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0188.219] lstrlenW (lpString=".rar") returned 4 [0188.219] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0188.219] lstrlenW (lpString=".bz2") returned 4 [0188.219] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0188.219] lstrlenW (lpString=".7z") returned 3 [0188.219] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0188.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.219] lstrlenW (lpString=".dbf") returned 4 [0188.219] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0188.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.219] lstrlenW (lpString=".1cd") returned 4 [0188.219] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0188.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.220] lstrlenW (lpString=".jpg") returned 4 [0188.220] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.220] lstrlenW (lpString=".doc") returned 4 [0188.220] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0188.220] lstrlenW (lpString=".docx") returned 5 [0188.220] lstrcmpiW (lpString1=".docx", lpString2="C.DAT") returned -1 [0188.220] lstrlenW (lpString=".pdf") returned 4 [0188.220] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0188.220] lstrlenW (lpString=".xls") returned 4 [0188.220] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0188.220] lstrlenW (lpString=".xlsx") returned 5 [0188.220] lstrcmpiW (lpString1=".xlsx", lpString2="C.DAT") returned -1 [0188.220] lstrlenW (lpString=".ppt") returned 4 [0188.220] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.220] lstrlenW (lpString=".zip") returned 4 [0188.220] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0188.220] lstrlenW (lpString=".rar") returned 4 [0188.220] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0188.220] lstrlenW (lpString=".bz2") returned 4 [0188.220] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0188.220] lstrlenW (lpString=".7z") returned 3 [0188.220] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.220] lstrlenW (lpString=".dbf") returned 4 [0188.220] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.220] lstrlenW (lpString=".1cd") returned 4 [0188.220] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0188.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGDIC.DAT") returned 53 [0188.220] lstrlenW (lpString=".jpg") returned 4 [0188.220] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0188.221] lstrcmpiW (lpString1=".DAT", lpString2=".wiki") returned -1 [0188.221] lstrlenW (lpString="ENGIDX.DAT") returned 10 [0188.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.221] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=34168) returned 1 [0188.221] CloseHandle (hObject=0x1e8) returned 1 [0188.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat")) returned 0x20 [0188.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\engidx.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.222] lstrlenW (lpString=".doc") returned 4 [0188.222] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0188.222] lstrlenW (lpString=".docx") returned 5 [0188.222] lstrcmpiW (lpString1=".docx", lpString2="X.DAT") returned -1 [0188.222] lstrlenW (lpString=".pdf") returned 4 [0188.222] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0188.222] lstrlenW (lpString=".xls") returned 4 [0188.222] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0188.222] lstrlenW (lpString=".xlsx") returned 5 [0188.222] lstrcmpiW (lpString1=".xlsx", lpString2="X.DAT") returned -1 [0188.222] lstrlenW (lpString=".ppt") returned 4 [0188.222] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0188.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.222] lstrlenW (lpString=".zip") returned 4 [0188.222] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0188.222] lstrlenW (lpString=".rar") returned 4 [0188.222] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0188.222] lstrlenW (lpString=".bz2") returned 4 [0188.222] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0188.222] lstrlenW (lpString=".7z") returned 3 [0188.222] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0188.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.222] lstrlenW (lpString=".dbf") returned 4 [0188.222] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0188.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.222] lstrlenW (lpString=".1cd") returned 4 [0188.222] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0188.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.222] lstrlenW (lpString=".jpg") returned 4 [0188.222] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0188.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.223] lstrlenW (lpString=".doc") returned 4 [0188.223] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0188.223] lstrlenW (lpString=".docx") returned 5 [0188.223] lstrcmpiW (lpString1=".docx", lpString2="X.DAT") returned -1 [0188.223] lstrlenW (lpString=".pdf") returned 4 [0188.223] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0188.223] lstrlenW (lpString=".xls") returned 4 [0188.223] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0188.223] lstrlenW (lpString=".xlsx") returned 5 [0188.223] lstrcmpiW (lpString1=".xlsx", lpString2="X.DAT") returned -1 [0188.223] lstrlenW (lpString=".ppt") returned 4 [0188.223] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0188.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.223] lstrlenW (lpString=".zip") returned 4 [0188.223] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0188.223] lstrlenW (lpString=".rar") returned 4 [0188.223] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0188.223] lstrlenW (lpString=".bz2") returned 4 [0188.223] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0188.223] lstrlenW (lpString=".7z") returned 3 [0188.223] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0188.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.223] lstrlenW (lpString=".dbf") returned 4 [0188.223] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0188.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.223] lstrlenW (lpString=".1cd") returned 4 [0188.223] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0188.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGIDX.DAT") returned 53 [0188.223] lstrlenW (lpString=".jpg") returned 4 [0188.223] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0188.224] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0188.224] lstrlenW (lpString="EXLIRM.XML") returned 10 [0188.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.224] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=79660) returned 1 [0188.224] CloseHandle (hObject=0x1e8) returned 1 [0188.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml")) returned 0x20 [0188.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirm.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.224] lstrlenW (lpString=".doc") returned 4 [0188.224] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0188.224] lstrlenW (lpString=".docx") returned 5 [0188.224] lstrcmpiW (lpString1=".docx", lpString2="M.XML") returned -1 [0188.224] lstrlenW (lpString=".pdf") returned 4 [0188.224] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0188.225] lstrlenW (lpString=".xls") returned 4 [0188.225] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0188.225] lstrlenW (lpString=".xlsx") returned 5 [0188.225] lstrcmpiW (lpString1=".xlsx", lpString2="M.XML") returned -1 [0188.225] lstrlenW (lpString=".ppt") returned 4 [0188.225] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.225] lstrlenW (lpString=".zip") returned 4 [0188.225] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0188.225] lstrlenW (lpString=".rar") returned 4 [0188.225] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0188.225] lstrlenW (lpString=".bz2") returned 4 [0188.225] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0188.225] lstrlenW (lpString=".7z") returned 3 [0188.225] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.225] lstrlenW (lpString=".dbf") returned 4 [0188.225] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.225] lstrlenW (lpString=".1cd") returned 4 [0188.225] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.225] lstrlenW (lpString=".jpg") returned 4 [0188.225] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.225] lstrlenW (lpString=".doc") returned 4 [0188.225] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0188.225] lstrlenW (lpString=".docx") returned 5 [0188.225] lstrcmpiW (lpString1=".docx", lpString2="M.XML") returned -1 [0188.225] lstrlenW (lpString=".pdf") returned 4 [0188.225] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0188.225] lstrlenW (lpString=".xls") returned 4 [0188.226] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0188.226] lstrlenW (lpString=".xlsx") returned 5 [0188.226] lstrcmpiW (lpString1=".xlsx", lpString2="M.XML") returned -1 [0188.226] lstrlenW (lpString=".ppt") returned 4 [0188.226] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.226] lstrlenW (lpString=".zip") returned 4 [0188.226] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0188.226] lstrlenW (lpString=".rar") returned 4 [0188.226] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0188.226] lstrlenW (lpString=".bz2") returned 4 [0188.226] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0188.226] lstrlenW (lpString=".7z") returned 3 [0188.226] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.226] lstrlenW (lpString=".dbf") returned 4 [0188.226] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.226] lstrlenW (lpString=".1cd") returned 4 [0188.226] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0188.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRM.XML") returned 53 [0188.226] lstrlenW (lpString=".jpg") returned 4 [0188.226] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0188.226] lstrcmpiW (lpString1=".XML", lpString2=".wiki") returned 1 [0188.226] lstrlenW (lpString="EXLIRMV.XML") returned 11 [0188.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.227] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=79220) returned 1 [0188.227] CloseHandle (hObject=0x1e8) returned 1 [0188.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml")) returned 0x20 [0188.227] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML" (normalized: "c:\\program files\\microsoft office\\office14\\exlirmv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.228] lstrlenW (lpString=".doc") returned 4 [0188.228] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0188.228] lstrlenW (lpString=".docx") returned 5 [0188.228] lstrcmpiW (lpString1=".docx", lpString2="V.XML") returned -1 [0188.228] lstrlenW (lpString=".pdf") returned 4 [0188.228] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0188.228] lstrlenW (lpString=".xls") returned 4 [0188.228] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0188.228] lstrlenW (lpString=".xlsx") returned 5 [0188.228] lstrcmpiW (lpString1=".xlsx", lpString2="V.XML") returned -1 [0188.228] lstrlenW (lpString=".ppt") returned 4 [0188.228] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0188.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.228] lstrlenW (lpString=".zip") returned 4 [0188.228] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0188.228] lstrlenW (lpString=".rar") returned 4 [0188.228] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0188.228] lstrlenW (lpString=".bz2") returned 4 [0188.228] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0188.228] lstrlenW (lpString=".7z") returned 3 [0188.228] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0188.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.228] lstrlenW (lpString=".dbf") returned 4 [0188.228] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0188.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.228] lstrlenW (lpString=".1cd") returned 4 [0188.228] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0188.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.229] lstrlenW (lpString=".jpg") returned 4 [0188.229] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0188.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.229] lstrlenW (lpString=".doc") returned 4 [0188.229] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0188.229] lstrlenW (lpString=".docx") returned 5 [0188.229] lstrcmpiW (lpString1=".docx", lpString2="V.XML") returned -1 [0188.229] lstrlenW (lpString=".pdf") returned 4 [0188.229] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0188.229] lstrlenW (lpString=".xls") returned 4 [0188.229] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0188.229] lstrlenW (lpString=".xlsx") returned 5 [0188.229] lstrcmpiW (lpString1=".xlsx", lpString2="V.XML") returned -1 [0188.229] lstrlenW (lpString=".ppt") returned 4 [0188.229] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0188.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.229] lstrlenW (lpString=".zip") returned 4 [0188.229] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0188.229] lstrlenW (lpString=".rar") returned 4 [0188.229] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0188.229] lstrlenW (lpString=".bz2") returned 4 [0188.229] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0188.229] lstrlenW (lpString=".7z") returned 3 [0188.229] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0188.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.229] lstrlenW (lpString=".dbf") returned 4 [0188.229] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0188.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.229] lstrlenW (lpString=".1cd") returned 4 [0188.229] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0188.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXLIRMV.XML") returned 54 [0188.229] lstrlenW (lpString=".jpg") returned 4 [0188.230] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0188.230] lstrcmpiW (lpString1=".cer", lpString2=".wiki") returned -1 [0188.230] lstrlenW (lpString="SignedComponents.cer") returned 20 [0188.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.230] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=734) returned 1 [0188.230] CloseHandle (hObject=0x1e8) returned 1 [0188.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer")) returned 0x20 [0188.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\components\\signedcomponents.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.231] lstrlenW (lpString=".doc") returned 4 [0188.231] lstrcmpiW (lpString1=".doc", lpString2=".cer") returned 1 [0188.231] lstrlenW (lpString=".docx") returned 5 [0188.231] lstrcmpiW (lpString1=".docx", lpString2="s.cer") returned -1 [0188.231] lstrlenW (lpString=".pdf") returned 4 [0188.231] lstrcmpiW (lpString1=".pdf", lpString2=".cer") returned 1 [0188.231] lstrlenW (lpString=".xls") returned 4 [0188.231] lstrcmpiW (lpString1=".xls", lpString2=".cer") returned 1 [0188.231] lstrlenW (lpString=".xlsx") returned 5 [0188.231] lstrcmpiW (lpString1=".xlsx", lpString2="s.cer") returned -1 [0188.231] lstrlenW (lpString=".ppt") returned 4 [0188.231] lstrcmpiW (lpString1=".ppt", lpString2=".cer") returned 1 [0188.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.231] lstrlenW (lpString=".zip") returned 4 [0188.231] lstrcmpiW (lpString1=".zip", lpString2=".cer") returned 1 [0188.231] lstrlenW (lpString=".rar") returned 4 [0188.231] lstrcmpiW (lpString1=".rar", lpString2=".cer") returned 1 [0188.231] lstrlenW (lpString=".bz2") returned 4 [0188.231] lstrcmpiW (lpString1=".bz2", lpString2=".cer") returned -1 [0188.231] lstrlenW (lpString=".7z") returned 3 [0188.231] lstrcmpiW (lpString1=".7z", lpString2="cer") returned -1 [0188.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.231] lstrlenW (lpString=".dbf") returned 4 [0188.231] lstrcmpiW (lpString1=".dbf", lpString2=".cer") returned 1 [0188.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.231] lstrlenW (lpString=".1cd") returned 4 [0188.231] lstrcmpiW (lpString1=".1cd", lpString2=".cer") returned -1 [0188.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.231] lstrlenW (lpString=".jpg") returned 4 [0188.231] lstrcmpiW (lpString1=".jpg", lpString2=".cer") returned 1 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.232] lstrlenW (lpString=".doc") returned 4 [0188.232] lstrcmpiW (lpString1=".doc", lpString2=".cer") returned 1 [0188.232] lstrlenW (lpString=".docx") returned 5 [0188.232] lstrcmpiW (lpString1=".docx", lpString2="s.cer") returned -1 [0188.232] lstrlenW (lpString=".pdf") returned 4 [0188.232] lstrcmpiW (lpString1=".pdf", lpString2=".cer") returned 1 [0188.232] lstrlenW (lpString=".xls") returned 4 [0188.232] lstrcmpiW (lpString1=".xls", lpString2=".cer") returned 1 [0188.232] lstrlenW (lpString=".xlsx") returned 5 [0188.232] lstrcmpiW (lpString1=".xlsx", lpString2="s.cer") returned -1 [0188.232] lstrlenW (lpString=".ppt") returned 4 [0188.232] lstrcmpiW (lpString1=".ppt", lpString2=".cer") returned 1 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.232] lstrlenW (lpString=".zip") returned 4 [0188.232] lstrcmpiW (lpString1=".zip", lpString2=".cer") returned 1 [0188.232] lstrlenW (lpString=".rar") returned 4 [0188.232] lstrcmpiW (lpString1=".rar", lpString2=".cer") returned 1 [0188.232] lstrlenW (lpString=".bz2") returned 4 [0188.232] lstrcmpiW (lpString1=".bz2", lpString2=".cer") returned -1 [0188.232] lstrlenW (lpString=".7z") returned 3 [0188.232] lstrcmpiW (lpString1=".7z", lpString2="cer") returned -1 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.232] lstrlenW (lpString=".dbf") returned 4 [0188.232] lstrcmpiW (lpString1=".dbf", lpString2=".cer") returned 1 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.232] lstrlenW (lpString=".1cd") returned 4 [0188.232] lstrcmpiW (lpString1=".1cd", lpString2=".cer") returned -1 [0188.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\Components\\SignedComponents.cer") returned 105 [0188.232] lstrlenW (lpString=".jpg") returned 4 [0188.232] lstrcmpiW (lpString1=".jpg", lpString2=".cer") returned 1 [0188.233] lstrcmpiW (lpString1=".cer", lpString2=".wiki") returned -1 [0188.233] lstrlenW (lpString="SignedManagedObjects.cer") returned 24 [0188.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0188.233] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=656) returned 1 [0188.233] CloseHandle (hObject=0x1e8) returned 1 [0188.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer")) returned 0x20 [0188.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\certificates\\groove.net\\managedobjects\\signedmanagedobjects.cer"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned 113 [0188.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned 113 [0188.233] lstrlenW (lpString=".doc") returned 4 [0188.233] lstrcmpiW (lpString1=".doc", lpString2=".cer") returned 1 [0188.234] lstrlenW (lpString=".docx") returned 5 [0188.234] lstrcmpiW (lpString1=".docx", lpString2="s.cer") returned -1 [0188.234] lstrlenW (lpString=".pdf") returned 4 [0188.234] lstrcmpiW (lpString1=".pdf", lpString2=".cer") returned 1 [0188.234] lstrlenW (lpString=".xls") returned 4 [0188.234] lstrcmpiW (lpString1=".xls", lpString2=".cer") returned 1 [0188.234] lstrlenW (lpString=".xlsx") returned 5 [0188.234] lstrcmpiW (lpString1=".xlsx", lpString2="s.cer") returned -1 [0188.234] lstrlenW (lpString=".ppt") returned 4 [0188.234] lstrcmpiW (lpString1=".ppt", lpString2=".cer") returned 1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned 113 [0188.234] lstrlenW (lpString=".zip") returned 4 [0188.234] lstrcmpiW (lpString1=".zip", lpString2=".cer") returned 1 [0188.234] lstrlenW (lpString=".rar") returned 4 [0188.234] lstrcmpiW (lpString1=".rar", lpString2=".cer") returned 1 [0188.234] lstrlenW (lpString=".bz2") returned 4 [0188.234] lstrcmpiW (lpString1=".bz2", lpString2=".cer") returned -1 [0188.234] lstrlenW (lpString=".7z") returned 3 [0188.234] lstrcmpiW (lpString1=".7z", lpString2="cer") returned -1 [0188.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\Certificates\\groove.net\\ManagedObjects\\SignedManagedObjects.cer") returned 113 [0188.234] lstrlenW (lpString=".dbf") returned 4 [0188.234] lstrcmpiW (lpString1=".dbf", lpString2=".cer") returned 1 [0188.396] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=185) returned 1 [0188.397] CloseHandle (hObject=0x3a0) returned 1 [0188.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif")) returned 0x20 [0188.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\button_mid.gif" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\button_mid.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0188.399] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=13964) returned 1 [0188.399] CloseHandle (hObject=0x3a0) returned 1 [0188.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg")) returned 0x20 [0188.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0188.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Groove\\ToolData\\groove.net\\GrooveForms\\FieldTypePreview\\Attachments.jpg" (normalized: "c:\\program files\\microsoft office\\office14\\groove\\tooldata\\groove.net\\grooveforms\\fieldtypepreview\\attachments.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0189.015] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLFLTR.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\outlfltr.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0192.652] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrome.7z.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrome.7z.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0192.930] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.930] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0192.931] GetLastError () returned 0x0 [0192.931] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x1a918, lpOverlapped=0x0) returned 1 [0192.944] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1a920, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x1a920, lpOverlapped=0x0) returned 1 [0192.947] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.947] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0192.947] SetEndOfFile (hFile=0x35c) returned 1 [0192.947] CloseHandle (hObject=0x35c) returned 1 [0192.947] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.947] SetEndOfFile (hFile=0x15c) returned 1 [0192.948] CloseHandle (hObject=0x15c) returned 1 [0192.949] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0192.949] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\gdipfontcachev1.dat")) returned 1 [0192.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.949] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.949] lstrlenW (lpString=".doc") returned 4 [0192.949] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0192.949] lstrlenW (lpString=".docx") returned 5 [0192.949] lstrcmpiW (lpString1=".docx", lpString2="1.DAT") returned -1 [0192.949] lstrlenW (lpString=".pdf") returned 4 [0192.949] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0192.949] lstrlenW (lpString=".xls") returned 4 [0192.949] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0192.949] lstrlenW (lpString=".xlsx") returned 5 [0192.949] lstrcmpiW (lpString1=".xlsx", lpString2="1.DAT") returned -1 [0192.949] lstrlenW (lpString=".ppt") returned 4 [0192.949] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0192.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.950] lstrlenW (lpString=".zip") returned 4 [0192.950] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0192.950] lstrlenW (lpString=".rar") returned 4 [0192.950] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0192.950] lstrlenW (lpString=".bz2") returned 4 [0192.950] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0192.950] lstrlenW (lpString=".7z") returned 3 [0192.950] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0192.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.950] lstrlenW (lpString=".dbf") returned 4 [0192.950] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0192.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.950] lstrlenW (lpString=".1cd") returned 4 [0192.950] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0192.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.950] lstrlenW (lpString=".jpg") returned 4 [0192.950] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0192.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.950] lstrlenW (lpString=".doc") returned 4 [0192.950] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0192.950] lstrlenW (lpString=".docx") returned 5 [0192.950] lstrcmpiW (lpString1=".docx", lpString2="1.DAT") returned -1 [0192.950] lstrlenW (lpString=".pdf") returned 4 [0192.950] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0192.950] lstrlenW (lpString=".xls") returned 4 [0192.950] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0192.950] lstrlenW (lpString=".xlsx") returned 5 [0192.950] lstrcmpiW (lpString1=".xlsx", lpString2="1.DAT") returned -1 [0192.950] lstrlenW (lpString=".ppt") returned 4 [0192.950] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0192.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.951] lstrlenW (lpString=".zip") returned 4 [0192.951] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0192.951] lstrlenW (lpString=".rar") returned 4 [0192.951] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0192.951] lstrlenW (lpString=".bz2") returned 4 [0192.951] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0192.951] lstrlenW (lpString=".7z") returned 3 [0192.951] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0192.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.951] lstrlenW (lpString=".dbf") returned 4 [0192.951] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0192.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.951] lstrlenW (lpString=".1cd") returned 4 [0192.951] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0192.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\GDIPFONTCACHEV1.DAT") returned 63 [0192.951] lstrlenW (lpString=".jpg") returned 4 [0192.951] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0192.951] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0192.951] lstrlenW (lpString="settings.dat") returned 12 [0192.951] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.952] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=40) returned 1 [0192.952] CloseHandle (hObject=0x15c) returned 1 [0192.952] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 0x2020 [0192.952] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.952] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.952] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0192.952] GetLastError () returned 0x0 [0192.953] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x28, lpOverlapped=0x0) returned 1 [0192.954] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x30, lpOverlapped=0x0) returned 1 [0192.955] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.955] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.955] SetEndOfFile (hFile=0x35c) returned 1 [0192.955] CloseHandle (hObject=0x35c) returned 1 [0192.955] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.955] SetEndOfFile (hFile=0x15c) returned 1 [0192.956] CloseHandle (hObject=0x15c) returned 1 [0192.956] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0192.956] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\settings.dat")) returned 1 [0192.956] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.956] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.956] lstrlenW (lpString=".doc") returned 4 [0192.956] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0192.956] lstrlenW (lpString=".docx") returned 5 [0192.956] lstrcmpiW (lpString1=".docx", lpString2="s.dat") returned -1 [0192.956] lstrlenW (lpString=".pdf") returned 4 [0192.956] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0192.956] lstrlenW (lpString=".xls") returned 4 [0192.956] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0192.957] lstrlenW (lpString=".xlsx") returned 5 [0192.957] lstrcmpiW (lpString1=".xlsx", lpString2="s.dat") returned -1 [0192.957] lstrlenW (lpString=".ppt") returned 4 [0192.957] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0192.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.957] lstrlenW (lpString=".zip") returned 4 [0192.957] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0192.957] lstrlenW (lpString=".rar") returned 4 [0192.957] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0192.957] lstrlenW (lpString=".bz2") returned 4 [0192.957] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0192.957] lstrlenW (lpString=".7z") returned 3 [0192.957] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0192.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.957] lstrlenW (lpString=".dbf") returned 4 [0192.957] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0192.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.957] lstrlenW (lpString=".1cd") returned 4 [0192.957] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0192.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.957] lstrlenW (lpString=".jpg") returned 4 [0192.957] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0192.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.957] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.957] lstrlenW (lpString=".doc") returned 4 [0192.957] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0192.957] lstrlenW (lpString=".docx") returned 5 [0192.957] lstrcmpiW (lpString1=".docx", lpString2="s.dat") returned -1 [0192.957] lstrlenW (lpString=".pdf") returned 4 [0192.957] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0192.957] lstrlenW (lpString=".xls") returned 4 [0192.957] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0192.957] lstrlenW (lpString=".xlsx") returned 5 [0192.957] lstrcmpiW (lpString1=".xlsx", lpString2="s.dat") returned -1 [0192.958] lstrlenW (lpString=".ppt") returned 4 [0192.958] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0192.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.958] lstrlenW (lpString=".zip") returned 4 [0192.958] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0192.958] lstrlenW (lpString=".rar") returned 4 [0192.958] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0192.958] lstrlenW (lpString=".bz2") returned 4 [0192.958] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0192.958] lstrlenW (lpString=".7z") returned 3 [0192.958] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0192.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.958] lstrlenW (lpString=".dbf") returned 4 [0192.958] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0192.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.958] lstrlenW (lpString=".1cd") returned 4 [0192.958] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0192.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\settings.dat") returned 89 [0192.958] lstrlenW (lpString=".jpg") returned 4 [0192.958] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0192.958] lstrcmpiW (lpString1=".log", lpString2=".wiki") returned -1 [0192.958] lstrlenW (lpString="000003.log") returned 10 [0192.958] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.960] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=0) returned 1 [0192.960] CloseHandle (hObject=0x15c) returned 1 [0192.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.960] lstrlenW (lpString=".doc") returned 4 [0192.960] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0192.960] lstrlenW (lpString=".docx") returned 5 [0192.960] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0192.960] lstrlenW (lpString=".pdf") returned 4 [0192.960] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0192.960] lstrlenW (lpString=".xls") returned 4 [0192.960] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0192.960] lstrlenW (lpString=".xlsx") returned 5 [0192.960] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0192.960] lstrlenW (lpString=".ppt") returned 4 [0192.960] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0192.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.960] lstrlenW (lpString=".zip") returned 4 [0192.960] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0192.960] lstrlenW (lpString=".rar") returned 4 [0192.960] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0192.960] lstrlenW (lpString=".bz2") returned 4 [0192.960] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0192.960] lstrlenW (lpString=".7z") returned 3 [0192.960] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0192.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.961] lstrlenW (lpString=".dbf") returned 4 [0192.961] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0192.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.961] lstrlenW (lpString=".1cd") returned 4 [0192.961] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0192.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.961] lstrlenW (lpString=".jpg") returned 4 [0192.961] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0192.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.961] lstrlenW (lpString=".doc") returned 4 [0192.961] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0192.961] lstrlenW (lpString=".docx") returned 5 [0192.961] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0192.961] lstrlenW (lpString=".pdf") returned 4 [0192.961] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0192.961] lstrlenW (lpString=".xls") returned 4 [0192.961] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0192.961] lstrlenW (lpString=".xlsx") returned 5 [0192.961] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0192.961] lstrlenW (lpString=".ppt") returned 4 [0192.961] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0192.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.961] lstrlenW (lpString=".zip") returned 4 [0192.961] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0192.961] lstrlenW (lpString=".rar") returned 4 [0192.961] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0192.961] lstrlenW (lpString=".bz2") returned 4 [0192.961] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0192.961] lstrlenW (lpString=".7z") returned 3 [0192.961] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0192.961] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.961] lstrlenW (lpString=".dbf") returned 4 [0192.962] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0192.962] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.962] lstrlenW (lpString=".1cd") returned 4 [0192.962] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0192.962] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\000003.log") returned 115 [0192.962] lstrlenW (lpString=".jpg") returned 4 [0192.962] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0192.962] lstrcmpiW (lpString1=".log", lpString2=".wiki") returned -1 [0192.962] lstrlenW (lpString="000003.log") returned 10 [0192.962] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.963] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=342) returned 1 [0192.963] CloseHandle (hObject=0x15c) returned 1 [0192.963] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 0x2020 [0192.963] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.963] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.963] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.963] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.964] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0192.964] GetLastError () returned 0x0 [0192.964] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x156, lpOverlapped=0x0) returned 1 [0192.965] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x160, lpOverlapped=0x0) returned 1 [0192.965] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.966] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0192.966] SetEndOfFile (hFile=0x35c) returned 1 [0192.966] CloseHandle (hObject=0x35c) returned 1 [0192.966] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.966] SetEndOfFile (hFile=0x15c) returned 1 [0192.967] CloseHandle (hObject=0x15c) returned 1 [0192.967] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0192.967] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\000003.log")) returned 1 [0192.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.967] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.967] lstrlenW (lpString=".doc") returned 4 [0192.967] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0192.967] lstrlenW (lpString=".docx") returned 5 [0192.967] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0192.967] lstrlenW (lpString=".pdf") returned 4 [0192.967] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0192.967] lstrlenW (lpString=".xls") returned 4 [0192.967] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0192.968] lstrlenW (lpString=".xlsx") returned 5 [0192.968] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0192.968] lstrlenW (lpString=".ppt") returned 4 [0192.968] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0192.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.968] lstrlenW (lpString=".zip") returned 4 [0192.968] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0192.968] lstrlenW (lpString=".rar") returned 4 [0192.968] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0192.968] lstrlenW (lpString=".bz2") returned 4 [0192.968] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0192.968] lstrlenW (lpString=".7z") returned 3 [0192.968] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0192.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.968] lstrlenW (lpString=".dbf") returned 4 [0192.968] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0192.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.968] lstrlenW (lpString=".1cd") returned 4 [0192.968] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0192.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.968] lstrlenW (lpString=".jpg") returned 4 [0192.968] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0192.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.968] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.968] lstrlenW (lpString=".doc") returned 4 [0192.968] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0192.968] lstrlenW (lpString=".docx") returned 5 [0192.968] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0192.968] lstrlenW (lpString=".pdf") returned 4 [0192.969] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0192.969] lstrlenW (lpString=".xls") returned 4 [0192.969] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0192.969] lstrlenW (lpString=".xlsx") returned 5 [0192.969] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0192.969] lstrlenW (lpString=".ppt") returned 4 [0192.969] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0192.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.969] lstrlenW (lpString=".zip") returned 4 [0192.969] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0192.969] lstrlenW (lpString=".rar") returned 4 [0192.969] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0192.969] lstrlenW (lpString=".bz2") returned 4 [0192.969] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0192.969] lstrlenW (lpString=".7z") returned 3 [0192.969] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0192.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.969] lstrlenW (lpString=".dbf") returned 4 [0192.969] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0192.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.969] lstrlenW (lpString=".1cd") returned 4 [0192.969] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0192.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\000003.log") returned 102 [0192.969] lstrlenW (lpString=".jpg") returned 4 [0192.969] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0192.969] lstrcmpiW (lpString1=".log", lpString2=".wiki") returned -1 [0192.969] lstrlenW (lpString="000003.log") returned 10 [0192.969] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.971] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1197) returned 1 [0192.971] CloseHandle (hObject=0x15c) returned 1 [0192.971] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 0x2020 [0192.971] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.971] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.971] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.972] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0192.972] GetLastError () returned 0x0 [0192.972] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x4ad, lpOverlapped=0x0) returned 1 [0192.974] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0192.974] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.975] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0192.975] SetEndOfFile (hFile=0x35c) returned 1 [0192.975] CloseHandle (hObject=0x35c) returned 1 [0192.975] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.975] SetEndOfFile (hFile=0x15c) returned 1 [0192.976] CloseHandle (hObject=0x15c) returned 1 [0192.976] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0192.976] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\000003.log")) returned 1 [0192.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.976] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.976] lstrlenW (lpString=".doc") returned 4 [0192.976] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0192.976] lstrlenW (lpString=".docx") returned 5 [0192.976] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0192.976] lstrlenW (lpString=".pdf") returned 4 [0192.976] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0192.976] lstrlenW (lpString=".xls") returned 4 [0192.976] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0192.976] lstrlenW (lpString=".xlsx") returned 5 [0192.976] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0192.977] lstrlenW (lpString=".ppt") returned 4 [0192.977] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0192.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.977] lstrlenW (lpString=".zip") returned 4 [0192.977] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0192.977] lstrlenW (lpString=".rar") returned 4 [0192.977] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0192.977] lstrlenW (lpString=".bz2") returned 4 [0192.977] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0192.977] lstrlenW (lpString=".7z") returned 3 [0192.977] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0192.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.977] lstrlenW (lpString=".dbf") returned 4 [0192.977] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0192.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.977] lstrlenW (lpString=".1cd") returned 4 [0192.977] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0192.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.977] lstrlenW (lpString=".jpg") returned 4 [0192.977] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0192.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.977] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.977] lstrlenW (lpString=".doc") returned 4 [0192.977] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0192.977] lstrlenW (lpString=".docx") returned 5 [0192.977] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0192.977] lstrlenW (lpString=".pdf") returned 4 [0192.977] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0192.977] lstrlenW (lpString=".xls") returned 4 [0192.977] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0192.977] lstrlenW (lpString=".xlsx") returned 5 [0192.977] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0192.977] lstrlenW (lpString=".ppt") returned 4 [0192.978] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0192.978] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.978] lstrlenW (lpString=".zip") returned 4 [0192.978] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0192.978] lstrlenW (lpString=".rar") returned 4 [0192.978] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0192.978] lstrlenW (lpString=".bz2") returned 4 [0192.978] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0192.978] lstrlenW (lpString=".7z") returned 3 [0192.978] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0192.978] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.978] lstrlenW (lpString=".dbf") returned 4 [0192.978] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0192.978] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.978] lstrlenW (lpString=".1cd") returned 4 [0192.978] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0192.978] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\000003.log") returned 102 [0192.978] lstrlenW (lpString=".jpg") returned 4 [0192.978] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0192.978] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0192.978] lstrlenW (lpString="icon_128.png") returned 12 [0192.978] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.979] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=3372) returned 1 [0192.979] CloseHandle (hObject=0x15c) returned 1 [0192.980] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 0x2020 [0192.980] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.980] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.980] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.980] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0192.980] GetLastError () returned 0x0 [0192.980] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd2c, lpOverlapped=0x0) returned 1 [0192.982] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xd30, lpOverlapped=0x0) returned 1 [0192.983] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.983] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0192.983] SetEndOfFile (hFile=0x35c) returned 1 [0192.983] CloseHandle (hObject=0x35c) returned 1 [0192.983] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.983] SetEndOfFile (hFile=0x15c) returned 1 [0192.984] CloseHandle (hObject=0x15c) returned 1 [0192.984] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0192.985] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png")) returned 1 [0192.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.985] lstrlenW (lpString=".doc") returned 4 [0192.985] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0192.985] lstrlenW (lpString=".docx") returned 5 [0192.985] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0192.985] lstrlenW (lpString=".pdf") returned 4 [0192.985] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0192.985] lstrlenW (lpString=".xls") returned 4 [0192.985] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0192.985] lstrlenW (lpString=".xlsx") returned 5 [0192.985] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0192.985] lstrlenW (lpString=".ppt") returned 4 [0192.985] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0192.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.985] lstrlenW (lpString=".zip") returned 4 [0192.985] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0192.985] lstrlenW (lpString=".rar") returned 4 [0192.985] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0192.985] lstrlenW (lpString=".bz2") returned 4 [0192.985] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0192.985] lstrlenW (lpString=".7z") returned 3 [0192.985] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0192.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.986] lstrlenW (lpString=".dbf") returned 4 [0192.986] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0192.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.986] lstrlenW (lpString=".1cd") returned 4 [0192.986] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0192.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.986] lstrlenW (lpString=".jpg") returned 4 [0192.986] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0192.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.986] lstrlenW (lpString=".doc") returned 4 [0192.986] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0192.986] lstrlenW (lpString=".docx") returned 5 [0192.986] lstrcmpiW (lpString1=".docx", lpString2="8.png") returned -1 [0192.986] lstrlenW (lpString=".pdf") returned 4 [0192.986] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0192.986] lstrlenW (lpString=".xls") returned 4 [0192.986] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0192.986] lstrlenW (lpString=".xlsx") returned 5 [0192.986] lstrcmpiW (lpString1=".xlsx", lpString2="8.png") returned -1 [0192.986] lstrlenW (lpString=".ppt") returned 4 [0192.986] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0192.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.986] lstrlenW (lpString=".zip") returned 4 [0192.986] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0192.986] lstrlenW (lpString=".rar") returned 4 [0192.986] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0192.986] lstrlenW (lpString=".bz2") returned 4 [0192.986] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0192.986] lstrlenW (lpString=".7z") returned 3 [0192.986] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0192.987] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.987] lstrlenW (lpString=".dbf") returned 4 [0192.987] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0192.987] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.987] lstrlenW (lpString=".1cd") returned 4 [0192.987] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0192.987] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_128.png") returned 138 [0192.987] lstrlenW (lpString=".jpg") returned 4 [0192.987] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0192.987] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0192.987] lstrlenW (lpString="icon_16.png") returned 11 [0192.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.987] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=160) returned 1 [0192.987] CloseHandle (hObject=0x15c) returned 1 [0192.987] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 0x2020 [0192.987] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.988] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.988] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0192.988] GetLastError () returned 0x0 [0192.988] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xa0, lpOverlapped=0x0) returned 1 [0192.989] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0192.990] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.990] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0192.990] SetEndOfFile (hFile=0x35c) returned 1 [0192.990] CloseHandle (hObject=0x35c) returned 1 [0192.991] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.991] SetEndOfFile (hFile=0x15c) returned 1 [0192.991] CloseHandle (hObject=0x15c) returned 1 [0192.991] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0192.992] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png")) returned 1 [0192.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.992] lstrlenW (lpString=".doc") returned 4 [0192.992] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0192.992] lstrlenW (lpString=".docx") returned 5 [0192.992] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0192.992] lstrlenW (lpString=".pdf") returned 4 [0192.992] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0192.992] lstrlenW (lpString=".xls") returned 4 [0192.992] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0192.992] lstrlenW (lpString=".xlsx") returned 5 [0192.992] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0192.992] lstrlenW (lpString=".ppt") returned 4 [0192.992] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0192.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.992] lstrlenW (lpString=".zip") returned 4 [0192.992] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0192.992] lstrlenW (lpString=".rar") returned 4 [0192.992] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0192.992] lstrlenW (lpString=".bz2") returned 4 [0192.992] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0192.992] lstrlenW (lpString=".7z") returned 3 [0192.992] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0192.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.992] lstrlenW (lpString=".dbf") returned 4 [0192.992] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0192.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.993] lstrlenW (lpString=".1cd") returned 4 [0192.993] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0192.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.993] lstrlenW (lpString=".jpg") returned 4 [0192.993] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0192.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.993] lstrlenW (lpString=".doc") returned 4 [0192.993] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0192.993] lstrlenW (lpString=".docx") returned 5 [0192.993] lstrcmpiW (lpString1=".docx", lpString2="6.png") returned -1 [0192.993] lstrlenW (lpString=".pdf") returned 4 [0192.993] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0192.993] lstrlenW (lpString=".xls") returned 4 [0192.993] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0192.993] lstrlenW (lpString=".xlsx") returned 5 [0192.993] lstrcmpiW (lpString1=".xlsx", lpString2="6.png") returned -1 [0192.993] lstrlenW (lpString=".ppt") returned 4 [0192.993] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0192.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.993] lstrlenW (lpString=".zip") returned 4 [0192.993] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0192.993] lstrlenW (lpString=".rar") returned 4 [0192.993] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0192.993] lstrlenW (lpString=".bz2") returned 4 [0192.993] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0192.993] lstrlenW (lpString=".7z") returned 3 [0192.993] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0192.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.993] lstrlenW (lpString=".dbf") returned 4 [0192.993] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0192.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.994] lstrlenW (lpString=".1cd") returned 4 [0192.994] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0192.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\icon_16.png") returned 137 [0192.994] lstrlenW (lpString=".jpg") returned 4 [0192.994] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0192.994] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0192.994] lstrlenW (lpString="main.html") returned 9 [0192.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.994] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=92) returned 1 [0192.994] CloseHandle (hObject=0x15c) returned 1 [0192.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 0x2020 [0192.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0192.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0192.995] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.995] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0192.995] GetLastError () returned 0x0 [0192.995] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x5c, lpOverlapped=0x0) returned 1 [0192.996] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x60, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x60, lpOverlapped=0x0) returned 1 [0192.997] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0192.997] WriteFile (in: hFile=0x35c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0192.997] SetEndOfFile (hFile=0x35c) returned 1 [0192.999] CloseHandle (hObject=0x35c) returned 1 [0192.999] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0192.999] SetEndOfFile (hFile=0x15c) returned 1 [0193.029] CloseHandle (hObject=0x15c) returned 1 [0193.029] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.109] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html")) returned 1 [0193.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.109] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.109] lstrlenW (lpString=".doc") returned 4 [0193.109] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0193.109] lstrlenW (lpString=".docx") returned 5 [0193.109] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0193.109] lstrlenW (lpString=".pdf") returned 4 [0193.109] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0193.110] lstrlenW (lpString=".xls") returned 4 [0193.110] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0193.110] lstrlenW (lpString=".xlsx") returned 5 [0193.110] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0193.110] lstrlenW (lpString=".ppt") returned 4 [0193.110] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0193.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.110] lstrlenW (lpString=".zip") returned 4 [0193.110] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0193.110] lstrlenW (lpString=".rar") returned 4 [0193.110] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0193.110] lstrlenW (lpString=".bz2") returned 4 [0193.110] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0193.110] lstrlenW (lpString=".7z") returned 3 [0193.110] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0193.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.110] lstrlenW (lpString=".dbf") returned 4 [0193.110] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0193.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.110] lstrlenW (lpString=".1cd") returned 4 [0193.110] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0193.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.110] lstrlenW (lpString=".jpg") returned 4 [0193.110] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0193.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.110] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.110] lstrlenW (lpString=".doc") returned 4 [0193.110] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0193.110] lstrlenW (lpString=".docx") returned 5 [0193.110] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0193.110] lstrlenW (lpString=".pdf") returned 4 [0193.110] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0193.110] lstrlenW (lpString=".xls") returned 4 [0193.111] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0193.111] lstrlenW (lpString=".xlsx") returned 5 [0193.111] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0193.111] lstrlenW (lpString=".ppt") returned 4 [0193.111] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0193.111] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.111] lstrlenW (lpString=".zip") returned 4 [0193.111] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0193.111] lstrlenW (lpString=".rar") returned 4 [0193.111] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0193.111] lstrlenW (lpString=".bz2") returned 4 [0193.111] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0193.111] lstrlenW (lpString=".7z") returned 3 [0193.111] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0193.111] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.111] lstrlenW (lpString=".dbf") returned 4 [0193.111] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0193.111] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.111] lstrlenW (lpString=".1cd") returned 4 [0193.111] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0193.111] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\main.html") returned 135 [0193.111] lstrlenW (lpString=".jpg") returned 4 [0193.111] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0193.111] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.111] lstrlenW (lpString="messages.json") returned 13 [0193.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.112] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=214) returned 1 [0193.112] CloseHandle (hObject=0x15c) returned 1 [0193.112] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 0x2020 [0193.112] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.112] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.112] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.112] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.113] GetLastError () returned 0x0 [0193.113] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd6, lpOverlapped=0x0) returned 1 [0193.113] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.114] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.114] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.115] SetEndOfFile (hFile=0x358) returned 1 [0193.115] CloseHandle (hObject=0x358) returned 1 [0193.115] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.115] SetEndOfFile (hFile=0x15c) returned 1 [0193.115] CloseHandle (hObject=0x15c) returned 1 [0193.116] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.116] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json")) returned 1 [0193.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.116] lstrlenW (lpString=".doc") returned 4 [0193.116] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.116] lstrlenW (lpString=".docx") returned 5 [0193.116] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.116] lstrlenW (lpString=".pdf") returned 4 [0193.116] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.116] lstrlenW (lpString=".xls") returned 4 [0193.116] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.116] lstrlenW (lpString=".xlsx") returned 5 [0193.116] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.116] lstrlenW (lpString=".ppt") returned 4 [0193.116] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.116] lstrlenW (lpString=".zip") returned 4 [0193.116] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.116] lstrlenW (lpString=".rar") returned 4 [0193.116] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.116] lstrlenW (lpString=".bz2") returned 4 [0193.116] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.116] lstrlenW (lpString=".7z") returned 3 [0193.117] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.117] lstrlenW (lpString=".dbf") returned 4 [0193.117] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.117] lstrlenW (lpString=".1cd") returned 4 [0193.117] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.117] lstrlenW (lpString=".jpg") returned 4 [0193.117] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.117] lstrlenW (lpString=".doc") returned 4 [0193.117] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.117] lstrlenW (lpString=".docx") returned 5 [0193.117] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.117] lstrlenW (lpString=".pdf") returned 4 [0193.117] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.117] lstrlenW (lpString=".xls") returned 4 [0193.117] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.117] lstrlenW (lpString=".xlsx") returned 5 [0193.117] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.117] lstrlenW (lpString=".ppt") returned 4 [0193.117] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.117] lstrlenW (lpString=".zip") returned 4 [0193.117] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.117] lstrlenW (lpString=".rar") returned 4 [0193.117] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.117] lstrlenW (lpString=".bz2") returned 4 [0193.117] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.117] lstrlenW (lpString=".7z") returned 3 [0193.117] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.117] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.117] lstrlenW (lpString=".dbf") returned 4 [0193.118] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.118] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.118] lstrlenW (lpString=".1cd") returned 4 [0193.118] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.118] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\et\\messages.json") returned 151 [0193.118] lstrlenW (lpString=".jpg") returned 4 [0193.118] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.118] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.118] lstrlenW (lpString="messages.json") returned 13 [0193.118] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.118] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=217) returned 1 [0193.118] CloseHandle (hObject=0x15c) returned 1 [0193.118] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 0x2020 [0193.118] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.119] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.119] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.119] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.119] GetLastError () returned 0x0 [0193.119] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd9, lpOverlapped=0x0) returned 1 [0193.120] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.121] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.121] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.121] SetEndOfFile (hFile=0x358) returned 1 [0193.121] CloseHandle (hObject=0x358) returned 1 [0193.121] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.121] SetEndOfFile (hFile=0x15c) returned 1 [0193.122] CloseHandle (hObject=0x15c) returned 1 [0193.122] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.122] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json")) returned 1 [0193.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.122] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.122] lstrlenW (lpString=".doc") returned 4 [0193.123] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.123] lstrlenW (lpString=".docx") returned 5 [0193.123] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.123] lstrlenW (lpString=".pdf") returned 4 [0193.123] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.123] lstrlenW (lpString=".xls") returned 4 [0193.123] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.123] lstrlenW (lpString=".xlsx") returned 5 [0193.123] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.123] lstrlenW (lpString=".ppt") returned 4 [0193.123] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.123] lstrlenW (lpString=".zip") returned 4 [0193.123] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.123] lstrlenW (lpString=".rar") returned 4 [0193.123] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.123] lstrlenW (lpString=".bz2") returned 4 [0193.123] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.123] lstrlenW (lpString=".7z") returned 3 [0193.123] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.123] lstrlenW (lpString=".dbf") returned 4 [0193.123] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.123] lstrlenW (lpString=".1cd") returned 4 [0193.123] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.123] lstrlenW (lpString=".jpg") returned 4 [0193.123] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.123] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.123] lstrlenW (lpString=".doc") returned 4 [0193.123] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.124] lstrlenW (lpString=".docx") returned 5 [0193.124] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.124] lstrlenW (lpString=".pdf") returned 4 [0193.124] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.124] lstrlenW (lpString=".xls") returned 4 [0193.124] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.124] lstrlenW (lpString=".xlsx") returned 5 [0193.124] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.124] lstrlenW (lpString=".ppt") returned 4 [0193.124] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.124] lstrlenW (lpString=".zip") returned 4 [0193.124] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.124] lstrlenW (lpString=".rar") returned 4 [0193.124] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.124] lstrlenW (lpString=".bz2") returned 4 [0193.124] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.124] lstrlenW (lpString=".7z") returned 3 [0193.124] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.124] lstrlenW (lpString=".dbf") returned 4 [0193.124] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.124] lstrlenW (lpString=".1cd") returned 4 [0193.124] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fi\\messages.json") returned 151 [0193.125] lstrlenW (lpString=".jpg") returned 4 [0193.125] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.125] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.125] lstrlenW (lpString="messages.json") returned 13 [0193.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.125] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=224) returned 1 [0193.125] CloseHandle (hObject=0x15c) returned 1 [0193.125] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 0x2020 [0193.125] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.125] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.126] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.126] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.126] GetLastError () returned 0x0 [0193.126] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe0, lpOverlapped=0x0) returned 1 [0193.127] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.128] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.128] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.128] SetEndOfFile (hFile=0x358) returned 1 [0193.128] CloseHandle (hObject=0x358) returned 1 [0193.128] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.128] SetEndOfFile (hFile=0x15c) returned 1 [0193.129] CloseHandle (hObject=0x15c) returned 1 [0193.129] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.129] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json")) returned 1 [0193.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.129] lstrlenW (lpString=".doc") returned 4 [0193.129] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.129] lstrlenW (lpString=".docx") returned 5 [0193.129] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.129] lstrlenW (lpString=".pdf") returned 4 [0193.130] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.130] lstrlenW (lpString=".xls") returned 4 [0193.130] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.130] lstrlenW (lpString=".xlsx") returned 5 [0193.130] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.130] lstrlenW (lpString=".ppt") returned 4 [0193.130] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.130] lstrlenW (lpString=".zip") returned 4 [0193.130] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.130] lstrlenW (lpString=".rar") returned 4 [0193.130] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.130] lstrlenW (lpString=".bz2") returned 4 [0193.130] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.130] lstrlenW (lpString=".7z") returned 3 [0193.130] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.130] lstrlenW (lpString=".dbf") returned 4 [0193.130] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.130] lstrlenW (lpString=".1cd") returned 4 [0193.130] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.130] lstrlenW (lpString=".jpg") returned 4 [0193.130] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.130] lstrlenW (lpString=".doc") returned 4 [0193.130] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.130] lstrlenW (lpString=".docx") returned 5 [0193.130] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.130] lstrlenW (lpString=".pdf") returned 4 [0193.130] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.131] lstrlenW (lpString=".xls") returned 4 [0193.131] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.131] lstrlenW (lpString=".xlsx") returned 5 [0193.131] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.131] lstrlenW (lpString=".ppt") returned 4 [0193.131] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.131] lstrlenW (lpString=".zip") returned 4 [0193.131] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.131] lstrlenW (lpString=".rar") returned 4 [0193.131] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.131] lstrlenW (lpString=".bz2") returned 4 [0193.131] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.131] lstrlenW (lpString=".7z") returned 3 [0193.131] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.131] lstrlenW (lpString=".dbf") returned 4 [0193.131] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.131] lstrlenW (lpString=".1cd") returned 4 [0193.131] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fil\\messages.json") returned 152 [0193.131] lstrlenW (lpString=".jpg") returned 4 [0193.131] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.131] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.131] lstrlenW (lpString="messages.json") returned 13 [0193.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.132] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=222) returned 1 [0193.132] CloseHandle (hObject=0x15c) returned 1 [0193.132] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 0x2020 [0193.132] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.132] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.132] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.133] GetLastError () returned 0x0 [0193.133] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xde, lpOverlapped=0x0) returned 1 [0193.133] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.134] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.134] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.135] SetEndOfFile (hFile=0x358) returned 1 [0193.135] CloseHandle (hObject=0x358) returned 1 [0193.135] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.135] SetEndOfFile (hFile=0x15c) returned 1 [0193.135] CloseHandle (hObject=0x15c) returned 1 [0193.135] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.136] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json")) returned 1 [0193.136] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.136] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.136] lstrlenW (lpString=".doc") returned 4 [0193.136] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.136] lstrlenW (lpString=".docx") returned 5 [0193.136] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.136] lstrlenW (lpString=".pdf") returned 4 [0193.136] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.136] lstrlenW (lpString=".xls") returned 4 [0193.136] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.136] lstrlenW (lpString=".xlsx") returned 5 [0193.136] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.136] lstrlenW (lpString=".ppt") returned 4 [0193.136] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.136] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.136] lstrlenW (lpString=".zip") returned 4 [0193.136] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.136] lstrlenW (lpString=".rar") returned 4 [0193.136] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.136] lstrlenW (lpString=".bz2") returned 4 [0193.136] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.136] lstrlenW (lpString=".7z") returned 3 [0193.136] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.136] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.137] lstrlenW (lpString=".dbf") returned 4 [0193.137] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.137] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.137] lstrlenW (lpString=".1cd") returned 4 [0193.137] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.137] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.137] lstrlenW (lpString=".jpg") returned 4 [0193.137] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.137] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.137] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.137] lstrlenW (lpString=".doc") returned 4 [0193.137] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.137] lstrlenW (lpString=".docx") returned 5 [0193.137] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.137] lstrlenW (lpString=".pdf") returned 4 [0193.137] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.137] lstrlenW (lpString=".xls") returned 4 [0193.137] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.137] lstrlenW (lpString=".xlsx") returned 5 [0193.137] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.137] lstrlenW (lpString=".ppt") returned 4 [0193.137] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.137] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.137] lstrlenW (lpString=".zip") returned 4 [0193.137] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.137] lstrlenW (lpString=".rar") returned 4 [0193.137] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.137] lstrlenW (lpString=".bz2") returned 4 [0193.137] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.137] lstrlenW (lpString=".7z") returned 3 [0193.137] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.137] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.137] lstrlenW (lpString=".dbf") returned 4 [0193.138] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.138] lstrlenW (lpString=".1cd") returned 4 [0193.138] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.138] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\fr\\messages.json") returned 151 [0193.138] lstrlenW (lpString=".jpg") returned 4 [0193.138] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.138] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.138] lstrlenW (lpString="messages.json") returned 13 [0193.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.138] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=225) returned 1 [0193.138] CloseHandle (hObject=0x15c) returned 1 [0193.138] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 0x2020 [0193.138] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.139] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.139] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.139] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.139] GetLastError () returned 0x0 [0193.139] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe1, lpOverlapped=0x0) returned 1 [0193.306] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.307] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.307] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.307] SetEndOfFile (hFile=0x358) returned 1 [0193.307] CloseHandle (hObject=0x358) returned 1 [0193.307] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.307] SetEndOfFile (hFile=0x15c) returned 1 [0193.308] CloseHandle (hObject=0x15c) returned 1 [0193.308] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.308] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json")) returned 1 [0193.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.308] lstrlenW (lpString=".doc") returned 4 [0193.308] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.308] lstrlenW (lpString=".docx") returned 5 [0193.308] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.308] lstrlenW (lpString=".pdf") returned 4 [0193.308] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.308] lstrlenW (lpString=".xls") returned 4 [0193.308] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.308] lstrlenW (lpString=".xlsx") returned 5 [0193.308] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.309] lstrlenW (lpString=".ppt") returned 4 [0193.309] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.309] lstrlenW (lpString=".zip") returned 4 [0193.309] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.309] lstrlenW (lpString=".rar") returned 4 [0193.309] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.309] lstrlenW (lpString=".bz2") returned 4 [0193.309] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.309] lstrlenW (lpString=".7z") returned 3 [0193.309] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.309] lstrlenW (lpString=".dbf") returned 4 [0193.309] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.309] lstrlenW (lpString=".1cd") returned 4 [0193.309] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.309] lstrlenW (lpString=".jpg") returned 4 [0193.309] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.309] lstrlenW (lpString=".doc") returned 4 [0193.309] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.309] lstrlenW (lpString=".docx") returned 5 [0193.309] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.309] lstrlenW (lpString=".pdf") returned 4 [0193.309] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.309] lstrlenW (lpString=".xls") returned 4 [0193.309] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.309] lstrlenW (lpString=".xlsx") returned 5 [0193.309] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.309] lstrlenW (lpString=".ppt") returned 4 [0193.309] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.310] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.310] lstrlenW (lpString=".zip") returned 4 [0193.310] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.310] lstrlenW (lpString=".rar") returned 4 [0193.310] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.310] lstrlenW (lpString=".bz2") returned 4 [0193.310] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.310] lstrlenW (lpString=".7z") returned 3 [0193.310] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.310] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.310] lstrlenW (lpString=".dbf") returned 4 [0193.310] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.310] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.310] lstrlenW (lpString=".1cd") returned 4 [0193.310] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.310] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\he\\messages.json") returned 151 [0193.310] lstrlenW (lpString=".jpg") returned 4 [0193.310] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.310] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.310] lstrlenW (lpString="messages.json") returned 13 [0193.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.311] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=221) returned 1 [0193.311] CloseHandle (hObject=0x15c) returned 1 [0193.311] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 0x2020 [0193.311] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.311] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.311] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.312] GetLastError () returned 0x0 [0193.312] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xdd, lpOverlapped=0x0) returned 1 [0193.313] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.314] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.314] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.314] SetEndOfFile (hFile=0x358) returned 1 [0193.314] CloseHandle (hObject=0x358) returned 1 [0193.314] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.314] SetEndOfFile (hFile=0x15c) returned 1 [0193.315] CloseHandle (hObject=0x15c) returned 1 [0193.315] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.315] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0193.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.315] lstrlenW (lpString=".doc") returned 4 [0193.315] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.315] lstrlenW (lpString=".docx") returned 5 [0193.315] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.315] lstrlenW (lpString=".pdf") returned 4 [0193.315] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.315] lstrlenW (lpString=".xls") returned 4 [0193.315] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.315] lstrlenW (lpString=".xlsx") returned 5 [0193.315] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.315] lstrlenW (lpString=".ppt") returned 4 [0193.315] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.316] lstrlenW (lpString=".zip") returned 4 [0193.316] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.316] lstrlenW (lpString=".rar") returned 4 [0193.316] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.316] lstrlenW (lpString=".bz2") returned 4 [0193.316] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.316] lstrlenW (lpString=".7z") returned 3 [0193.316] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.316] lstrlenW (lpString=".dbf") returned 4 [0193.316] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.316] lstrlenW (lpString=".1cd") returned 4 [0193.316] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.316] lstrlenW (lpString=".jpg") returned 4 [0193.316] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.316] lstrlenW (lpString=".doc") returned 4 [0193.316] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.316] lstrlenW (lpString=".docx") returned 5 [0193.316] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.316] lstrlenW (lpString=".pdf") returned 4 [0193.316] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.316] lstrlenW (lpString=".xls") returned 4 [0193.316] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.316] lstrlenW (lpString=".xlsx") returned 5 [0193.316] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.316] lstrlenW (lpString=".ppt") returned 4 [0193.316] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.316] lstrlenW (lpString=".zip") returned 4 [0193.317] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.317] lstrlenW (lpString=".rar") returned 4 [0193.317] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.317] lstrlenW (lpString=".bz2") returned 4 [0193.317] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.317] lstrlenW (lpString=".7z") returned 3 [0193.317] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.317] lstrlenW (lpString=".dbf") returned 4 [0193.317] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.317] lstrlenW (lpString=".1cd") returned 4 [0193.317] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.317] lstrlenW (lpString=".jpg") returned 4 [0193.317] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.317] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.317] lstrlenW (lpString="messages.json") returned 13 [0193.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.317] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=203) returned 1 [0193.318] CloseHandle (hObject=0x15c) returned 1 [0193.318] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 0x2020 [0193.318] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.318] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.318] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.318] GetLastError () returned 0x0 [0193.318] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xcb, lpOverlapped=0x0) returned 1 [0193.319] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0193.320] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.320] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.320] SetEndOfFile (hFile=0x358) returned 1 [0193.320] CloseHandle (hObject=0x358) returned 1 [0193.320] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.320] SetEndOfFile (hFile=0x15c) returned 1 [0193.321] CloseHandle (hObject=0x15c) returned 1 [0193.321] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.321] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0193.322] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.322] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.322] lstrlenW (lpString=".doc") returned 4 [0193.322] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.322] lstrlenW (lpString=".docx") returned 5 [0193.322] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.322] lstrlenW (lpString=".pdf") returned 4 [0193.322] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.322] lstrlenW (lpString=".xls") returned 4 [0193.322] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.322] lstrlenW (lpString=".xlsx") returned 5 [0193.322] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.322] lstrlenW (lpString=".ppt") returned 4 [0193.322] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.322] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.322] lstrlenW (lpString=".zip") returned 4 [0193.322] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.322] lstrlenW (lpString=".rar") returned 4 [0193.322] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.322] lstrlenW (lpString=".bz2") returned 4 [0193.322] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.322] lstrlenW (lpString=".7z") returned 3 [0193.322] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.322] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.322] lstrlenW (lpString=".dbf") returned 4 [0193.322] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.322] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.322] lstrlenW (lpString=".1cd") returned 4 [0193.322] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.322] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.322] lstrlenW (lpString=".jpg") returned 4 [0193.323] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.323] lstrlenW (lpString=".doc") returned 4 [0193.323] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.323] lstrlenW (lpString=".docx") returned 5 [0193.323] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.323] lstrlenW (lpString=".pdf") returned 4 [0193.323] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.323] lstrlenW (lpString=".xls") returned 4 [0193.323] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.323] lstrlenW (lpString=".xlsx") returned 5 [0193.323] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.323] lstrlenW (lpString=".ppt") returned 4 [0193.323] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.323] lstrlenW (lpString=".zip") returned 4 [0193.323] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.323] lstrlenW (lpString=".rar") returned 4 [0193.323] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.323] lstrlenW (lpString=".bz2") returned 4 [0193.323] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.323] lstrlenW (lpString=".7z") returned 3 [0193.323] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.323] lstrlenW (lpString=".dbf") returned 4 [0193.323] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.323] lstrlenW (lpString=".1cd") returned 4 [0193.323] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.323] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.323] lstrlenW (lpString=".jpg") returned 4 [0193.323] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.324] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.324] lstrlenW (lpString="messages.json") returned 13 [0193.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.324] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=217) returned 1 [0193.324] CloseHandle (hObject=0x15c) returned 1 [0193.324] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 0x2020 [0193.324] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.324] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.324] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.325] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.325] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.325] GetLastError () returned 0x0 [0193.325] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd9, lpOverlapped=0x0) returned 1 [0193.326] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.327] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.328] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.328] SetEndOfFile (hFile=0x358) returned 1 [0193.328] CloseHandle (hObject=0x358) returned 1 [0193.328] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.328] SetEndOfFile (hFile=0x15c) returned 1 [0193.329] CloseHandle (hObject=0x15c) returned 1 [0193.329] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.329] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0193.329] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.329] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.329] lstrlenW (lpString=".doc") returned 4 [0193.329] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.329] lstrlenW (lpString=".docx") returned 5 [0193.329] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.329] lstrlenW (lpString=".pdf") returned 4 [0193.329] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.329] lstrlenW (lpString=".xls") returned 4 [0193.329] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.329] lstrlenW (lpString=".xlsx") returned 5 [0193.329] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.329] lstrlenW (lpString=".ppt") returned 4 [0193.330] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.330] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.330] lstrlenW (lpString=".zip") returned 4 [0193.330] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.330] lstrlenW (lpString=".rar") returned 4 [0193.330] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.330] lstrlenW (lpString=".bz2") returned 4 [0193.330] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.330] lstrlenW (lpString=".7z") returned 3 [0193.330] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.330] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.330] lstrlenW (lpString=".dbf") returned 4 [0193.330] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.330] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.330] lstrlenW (lpString=".1cd") returned 4 [0193.330] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.330] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.330] lstrlenW (lpString=".jpg") returned 4 [0193.330] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.330] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.330] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.330] lstrlenW (lpString=".doc") returned 4 [0193.330] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.330] lstrlenW (lpString=".docx") returned 5 [0193.330] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.330] lstrlenW (lpString=".pdf") returned 4 [0193.330] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.330] lstrlenW (lpString=".xls") returned 4 [0193.330] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.330] lstrlenW (lpString=".xlsx") returned 5 [0193.330] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.330] lstrlenW (lpString=".ppt") returned 4 [0193.330] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.331] lstrlenW (lpString=".zip") returned 4 [0193.331] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.331] lstrlenW (lpString=".rar") returned 4 [0193.331] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.331] lstrlenW (lpString=".bz2") returned 4 [0193.331] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.331] lstrlenW (lpString=".7z") returned 3 [0193.331] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.331] lstrlenW (lpString=".dbf") returned 4 [0193.331] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.331] lstrlenW (lpString=".1cd") returned 4 [0193.331] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.331] lstrlenW (lpString=".jpg") returned 4 [0193.331] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.331] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.331] lstrlenW (lpString="messages.json") returned 13 [0193.331] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.332] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=222) returned 1 [0193.332] CloseHandle (hObject=0x15c) returned 1 [0193.332] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0193.332] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.332] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.332] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.332] GetLastError () returned 0x0 [0193.332] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xde, lpOverlapped=0x0) returned 1 [0193.333] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.334] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.334] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.334] SetEndOfFile (hFile=0x358) returned 1 [0193.334] CloseHandle (hObject=0x358) returned 1 [0193.335] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.335] SetEndOfFile (hFile=0x15c) returned 1 [0193.335] CloseHandle (hObject=0x15c) returned 1 [0193.335] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.336] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0193.336] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.336] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.336] lstrlenW (lpString=".doc") returned 4 [0193.336] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.336] lstrlenW (lpString=".docx") returned 5 [0193.336] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.336] lstrlenW (lpString=".pdf") returned 4 [0193.336] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.336] lstrlenW (lpString=".xls") returned 4 [0193.336] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.336] lstrlenW (lpString=".xlsx") returned 5 [0193.336] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.336] lstrlenW (lpString=".ppt") returned 4 [0193.336] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.336] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.336] lstrlenW (lpString=".zip") returned 4 [0193.336] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.336] lstrlenW (lpString=".rar") returned 4 [0193.336] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.336] lstrlenW (lpString=".bz2") returned 4 [0193.336] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.336] lstrlenW (lpString=".7z") returned 3 [0193.336] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.336] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.336] lstrlenW (lpString=".dbf") returned 4 [0193.336] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.336] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.337] lstrlenW (lpString=".1cd") returned 4 [0193.337] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.337] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.337] lstrlenW (lpString=".jpg") returned 4 [0193.337] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.337] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.337] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.337] lstrlenW (lpString=".doc") returned 4 [0193.337] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.337] lstrlenW (lpString=".docx") returned 5 [0193.337] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.337] lstrlenW (lpString=".pdf") returned 4 [0193.337] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.337] lstrlenW (lpString=".xls") returned 4 [0193.337] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.337] lstrlenW (lpString=".xlsx") returned 5 [0193.337] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.337] lstrlenW (lpString=".ppt") returned 4 [0193.337] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.337] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.337] lstrlenW (lpString=".zip") returned 4 [0193.337] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.337] lstrlenW (lpString=".rar") returned 4 [0193.337] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.337] lstrlenW (lpString=".bz2") returned 4 [0193.337] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.337] lstrlenW (lpString=".7z") returned 3 [0193.337] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.337] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.337] lstrlenW (lpString=".dbf") returned 4 [0193.337] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.337] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.337] lstrlenW (lpString=".1cd") returned 4 [0193.338] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.338] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.338] lstrlenW (lpString=".jpg") returned 4 [0193.338] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.338] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.338] lstrlenW (lpString="messages.json") returned 13 [0193.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.338] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=224) returned 1 [0193.338] CloseHandle (hObject=0x15c) returned 1 [0193.338] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0193.338] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.338] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.339] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.339] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.339] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0193.339] GetLastError () returned 0x0 [0193.339] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe0, lpOverlapped=0x0) returned 1 [0193.495] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.497] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.497] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.497] SetEndOfFile (hFile=0x358) returned 1 [0193.497] CloseHandle (hObject=0x358) returned 1 [0193.497] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.497] SetEndOfFile (hFile=0x15c) returned 1 [0193.498] CloseHandle (hObject=0x15c) returned 1 [0193.498] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.498] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0193.498] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.498] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.498] lstrlenW (lpString=".doc") returned 4 [0193.498] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.498] lstrlenW (lpString=".docx") returned 5 [0193.498] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.499] lstrlenW (lpString=".pdf") returned 4 [0193.499] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.499] lstrlenW (lpString=".xls") returned 4 [0193.499] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.499] lstrlenW (lpString=".xlsx") returned 5 [0193.499] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.499] lstrlenW (lpString=".ppt") returned 4 [0193.499] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.499] lstrlenW (lpString=".zip") returned 4 [0193.499] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.499] lstrlenW (lpString=".rar") returned 4 [0193.499] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.499] lstrlenW (lpString=".bz2") returned 4 [0193.499] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.499] lstrlenW (lpString=".7z") returned 3 [0193.499] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.499] lstrlenW (lpString=".dbf") returned 4 [0193.499] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.499] lstrlenW (lpString=".1cd") returned 4 [0193.499] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.499] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.499] lstrlenW (lpString=".jpg") returned 4 [0193.499] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.500] lstrlenW (lpString=".doc") returned 4 [0193.500] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.500] lstrlenW (lpString=".docx") returned 5 [0193.500] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.500] lstrlenW (lpString=".pdf") returned 4 [0193.500] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.500] lstrlenW (lpString=".xls") returned 4 [0193.500] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.500] lstrlenW (lpString=".xlsx") returned 5 [0193.500] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.500] lstrlenW (lpString=".ppt") returned 4 [0193.500] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.500] lstrlenW (lpString=".zip") returned 4 [0193.500] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.500] lstrlenW (lpString=".rar") returned 4 [0193.500] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.500] lstrlenW (lpString=".bz2") returned 4 [0193.500] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.500] lstrlenW (lpString=".7z") returned 3 [0193.500] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.500] lstrlenW (lpString=".dbf") returned 4 [0193.500] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.500] lstrlenW (lpString=".1cd") returned 4 [0193.500] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.500] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.500] lstrlenW (lpString=".jpg") returned 4 [0193.500] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.501] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.501] lstrlenW (lpString="verified_contents.json") returned 22 [0193.501] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.733] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=11094) returned 1 [0193.733] CloseHandle (hObject=0x35c) returned 1 [0193.733] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 0x2020 [0193.733] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.733] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.733] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.733] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.734] GetLastError () returned 0x0 [0193.734] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2b56, lpOverlapped=0x0) returned 1 [0193.737] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2b60, lpOverlapped=0x0) returned 1 [0193.738] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.738] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0193.738] SetEndOfFile (hFile=0x15c) returned 1 [0193.739] CloseHandle (hObject=0x15c) returned 1 [0193.739] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.739] SetEndOfFile (hFile=0x35c) returned 1 [0193.740] CloseHandle (hObject=0x35c) returned 1 [0193.740] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.740] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json")) returned 1 [0193.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.740] lstrlenW (lpString=".doc") returned 4 [0193.740] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.740] lstrlenW (lpString=".docx") returned 5 [0193.740] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.740] lstrlenW (lpString=".pdf") returned 4 [0193.740] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.740] lstrlenW (lpString=".xls") returned 4 [0193.740] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.740] lstrlenW (lpString=".xlsx") returned 5 [0193.740] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.740] lstrlenW (lpString=".ppt") returned 4 [0193.740] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.741] lstrlenW (lpString=".zip") returned 4 [0193.741] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.741] lstrlenW (lpString=".rar") returned 4 [0193.741] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.741] lstrlenW (lpString=".bz2") returned 4 [0193.741] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.741] lstrlenW (lpString=".7z") returned 3 [0193.741] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.741] lstrlenW (lpString=".dbf") returned 4 [0193.741] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.741] lstrlenW (lpString=".1cd") returned 4 [0193.741] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.741] lstrlenW (lpString=".jpg") returned 4 [0193.741] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.741] lstrlenW (lpString=".doc") returned 4 [0193.741] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.741] lstrlenW (lpString=".docx") returned 5 [0193.741] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.741] lstrlenW (lpString=".pdf") returned 4 [0193.741] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.741] lstrlenW (lpString=".xls") returned 4 [0193.741] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.741] lstrlenW (lpString=".xlsx") returned 5 [0193.741] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.741] lstrlenW (lpString=".ppt") returned 4 [0193.742] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.742] lstrlenW (lpString=".zip") returned 4 [0193.742] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.742] lstrlenW (lpString=".rar") returned 4 [0193.742] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.742] lstrlenW (lpString=".bz2") returned 4 [0193.742] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.742] lstrlenW (lpString=".7z") returned 3 [0193.742] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.742] lstrlenW (lpString=".dbf") returned 4 [0193.742] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.742] lstrlenW (lpString=".1cd") returned 4 [0193.742] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aapocclcgogkmnckokdopfmhonfmgoek\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0193.742] lstrlenW (lpString=".jpg") returned 4 [0193.742] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.742] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.742] lstrlenW (lpString="messages.json") returned 13 [0193.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.743] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=209) returned 1 [0193.743] CloseHandle (hObject=0x35c) returned 1 [0193.743] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 0x2020 [0193.743] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.743] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.743] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.744] GetLastError () returned 0x0 [0193.744] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd1, lpOverlapped=0x0) returned 1 [0193.745] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.745] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.745] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.746] SetEndOfFile (hFile=0x15c) returned 1 [0193.746] CloseHandle (hObject=0x15c) returned 1 [0193.746] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.746] SetEndOfFile (hFile=0x35c) returned 1 [0193.747] CloseHandle (hObject=0x35c) returned 1 [0193.747] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.747] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json")) returned 1 [0193.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.747] lstrlenW (lpString=".doc") returned 4 [0193.747] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.747] lstrlenW (lpString=".docx") returned 5 [0193.747] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.747] lstrlenW (lpString=".pdf") returned 4 [0193.747] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.747] lstrlenW (lpString=".xls") returned 4 [0193.747] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.747] lstrlenW (lpString=".xlsx") returned 5 [0193.747] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.747] lstrlenW (lpString=".ppt") returned 4 [0193.747] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.748] lstrlenW (lpString=".zip") returned 4 [0193.748] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.748] lstrlenW (lpString=".rar") returned 4 [0193.748] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.748] lstrlenW (lpString=".bz2") returned 4 [0193.748] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.748] lstrlenW (lpString=".7z") returned 3 [0193.748] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.748] lstrlenW (lpString=".dbf") returned 4 [0193.748] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.748] lstrlenW (lpString=".1cd") returned 4 [0193.748] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.748] lstrlenW (lpString=".jpg") returned 4 [0193.748] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.748] lstrlenW (lpString=".doc") returned 4 [0193.748] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.748] lstrlenW (lpString=".docx") returned 5 [0193.748] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.749] lstrlenW (lpString=".pdf") returned 4 [0193.749] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.749] lstrlenW (lpString=".xls") returned 4 [0193.749] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.749] lstrlenW (lpString=".xlsx") returned 5 [0193.749] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.749] lstrlenW (lpString=".ppt") returned 4 [0193.749] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.749] lstrlenW (lpString=".zip") returned 4 [0193.749] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.749] lstrlenW (lpString=".rar") returned 4 [0193.749] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.749] lstrlenW (lpString=".bz2") returned 4 [0193.749] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.749] lstrlenW (lpString=".7z") returned 3 [0193.749] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.749] lstrlenW (lpString=".dbf") returned 4 [0193.749] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.749] lstrlenW (lpString=".1cd") returned 4 [0193.749] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\id\\messages.json") returned 151 [0193.749] lstrlenW (lpString=".jpg") returned 4 [0193.749] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.749] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.750] lstrlenW (lpString="messages.json") returned 13 [0193.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.750] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=213) returned 1 [0193.750] CloseHandle (hObject=0x35c) returned 1 [0193.750] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 0x2020 [0193.750] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.750] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.750] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.751] GetLastError () returned 0x0 [0193.751] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd5, lpOverlapped=0x0) returned 1 [0193.752] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.753] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.753] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.753] SetEndOfFile (hFile=0x15c) returned 1 [0193.753] CloseHandle (hObject=0x15c) returned 1 [0193.753] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.753] SetEndOfFile (hFile=0x35c) returned 1 [0193.754] CloseHandle (hObject=0x35c) returned 1 [0193.754] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.754] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json")) returned 1 [0193.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.754] lstrlenW (lpString=".doc") returned 4 [0193.754] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.754] lstrlenW (lpString=".docx") returned 5 [0193.754] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.754] lstrlenW (lpString=".pdf") returned 4 [0193.754] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.754] lstrlenW (lpString=".xls") returned 4 [0193.754] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.754] lstrlenW (lpString=".xlsx") returned 5 [0193.754] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.754] lstrlenW (lpString=".ppt") returned 4 [0193.755] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.755] lstrlenW (lpString=".zip") returned 4 [0193.755] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.755] lstrlenW (lpString=".rar") returned 4 [0193.755] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.755] lstrlenW (lpString=".bz2") returned 4 [0193.755] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.755] lstrlenW (lpString=".7z") returned 3 [0193.755] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.755] lstrlenW (lpString=".dbf") returned 4 [0193.755] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.755] lstrlenW (lpString=".1cd") returned 4 [0193.755] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.755] lstrlenW (lpString=".jpg") returned 4 [0193.755] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.755] lstrlenW (lpString=".doc") returned 4 [0193.755] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.755] lstrlenW (lpString=".docx") returned 5 [0193.755] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.755] lstrlenW (lpString=".pdf") returned 4 [0193.755] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.755] lstrlenW (lpString=".xls") returned 4 [0193.755] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.755] lstrlenW (lpString=".xlsx") returned 5 [0193.756] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.756] lstrlenW (lpString=".ppt") returned 4 [0193.756] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.756] lstrlenW (lpString=".zip") returned 4 [0193.756] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.756] lstrlenW (lpString=".rar") returned 4 [0193.756] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.756] lstrlenW (lpString=".bz2") returned 4 [0193.756] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.756] lstrlenW (lpString=".7z") returned 3 [0193.756] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.756] lstrlenW (lpString=".dbf") returned 4 [0193.756] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.756] lstrlenW (lpString=".1cd") returned 4 [0193.756] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\it\\messages.json") returned 151 [0193.756] lstrlenW (lpString=".jpg") returned 4 [0193.756] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.756] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.756] lstrlenW (lpString="messages.json") returned 13 [0193.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.757] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=221) returned 1 [0193.757] CloseHandle (hObject=0x35c) returned 1 [0193.757] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 0x2020 [0193.757] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.757] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.757] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.758] GetLastError () returned 0x0 [0193.758] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xdd, lpOverlapped=0x0) returned 1 [0193.759] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.760] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.760] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.760] SetEndOfFile (hFile=0x15c) returned 1 [0193.760] CloseHandle (hObject=0x15c) returned 1 [0193.760] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.760] SetEndOfFile (hFile=0x35c) returned 1 [0193.761] CloseHandle (hObject=0x35c) returned 1 [0193.761] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.761] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json")) returned 1 [0193.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.761] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.761] lstrlenW (lpString=".doc") returned 4 [0193.761] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.761] lstrlenW (lpString=".docx") returned 5 [0193.761] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.761] lstrlenW (lpString=".pdf") returned 4 [0193.761] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.761] lstrlenW (lpString=".xls") returned 4 [0193.761] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.762] lstrlenW (lpString=".xlsx") returned 5 [0193.762] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.762] lstrlenW (lpString=".ppt") returned 4 [0193.762] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.762] lstrlenW (lpString=".zip") returned 4 [0193.762] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.762] lstrlenW (lpString=".rar") returned 4 [0193.762] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.762] lstrlenW (lpString=".bz2") returned 4 [0193.762] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.762] lstrlenW (lpString=".7z") returned 3 [0193.762] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.762] lstrlenW (lpString=".dbf") returned 4 [0193.762] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.762] lstrlenW (lpString=".1cd") returned 4 [0193.762] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.762] lstrlenW (lpString=".jpg") returned 4 [0193.762] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.762] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.762] lstrlenW (lpString=".doc") returned 4 [0193.762] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.762] lstrlenW (lpString=".docx") returned 5 [0193.762] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.762] lstrlenW (lpString=".pdf") returned 4 [0193.762] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.763] lstrlenW (lpString=".xls") returned 4 [0193.763] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.763] lstrlenW (lpString=".xlsx") returned 5 [0193.763] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.763] lstrlenW (lpString=".ppt") returned 4 [0193.763] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.763] lstrlenW (lpString=".zip") returned 4 [0193.763] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.763] lstrlenW (lpString=".rar") returned 4 [0193.763] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.763] lstrlenW (lpString=".bz2") returned 4 [0193.763] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.763] lstrlenW (lpString=".7z") returned 3 [0193.763] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.763] lstrlenW (lpString=".dbf") returned 4 [0193.763] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.763] lstrlenW (lpString=".1cd") returned 4 [0193.763] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.763] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ja\\messages.json") returned 151 [0193.763] lstrlenW (lpString=".jpg") returned 4 [0193.763] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.763] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.763] lstrlenW (lpString="messages.json") returned 13 [0193.763] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.764] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=218) returned 1 [0193.764] CloseHandle (hObject=0x35c) returned 1 [0193.764] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 0x2020 [0193.765] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.765] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.765] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.765] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.765] GetLastError () returned 0x0 [0193.765] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xda, lpOverlapped=0x0) returned 1 [0193.766] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.767] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.767] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.767] SetEndOfFile (hFile=0x15c) returned 1 [0193.767] CloseHandle (hObject=0x15c) returned 1 [0193.767] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.767] SetEndOfFile (hFile=0x35c) returned 1 [0193.768] CloseHandle (hObject=0x35c) returned 1 [0193.768] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.768] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json")) returned 1 [0193.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.769] lstrlenW (lpString=".doc") returned 4 [0193.769] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.769] lstrlenW (lpString=".docx") returned 5 [0193.769] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.769] lstrlenW (lpString=".pdf") returned 4 [0193.769] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.769] lstrlenW (lpString=".xls") returned 4 [0193.769] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.769] lstrlenW (lpString=".xlsx") returned 5 [0193.769] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.769] lstrlenW (lpString=".ppt") returned 4 [0193.769] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.769] lstrlenW (lpString=".zip") returned 4 [0193.769] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.769] lstrlenW (lpString=".rar") returned 4 [0193.769] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.769] lstrlenW (lpString=".bz2") returned 4 [0193.769] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.769] lstrlenW (lpString=".7z") returned 3 [0193.769] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.769] lstrlenW (lpString=".dbf") returned 4 [0193.769] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.769] lstrlenW (lpString=".1cd") returned 4 [0193.769] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.769] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.769] lstrlenW (lpString=".jpg") returned 4 [0193.769] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.770] lstrlenW (lpString=".doc") returned 4 [0193.770] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.770] lstrlenW (lpString=".docx") returned 5 [0193.770] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.770] lstrlenW (lpString=".pdf") returned 4 [0193.770] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.770] lstrlenW (lpString=".xls") returned 4 [0193.770] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.770] lstrlenW (lpString=".xlsx") returned 5 [0193.770] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.770] lstrlenW (lpString=".ppt") returned 4 [0193.770] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.770] lstrlenW (lpString=".zip") returned 4 [0193.770] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.770] lstrlenW (lpString=".rar") returned 4 [0193.770] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.770] lstrlenW (lpString=".bz2") returned 4 [0193.770] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.770] lstrlenW (lpString=".7z") returned 3 [0193.770] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.770] lstrlenW (lpString=".dbf") returned 4 [0193.770] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.770] lstrlenW (lpString=".1cd") returned 4 [0193.770] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.770] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ko\\messages.json") returned 151 [0193.771] lstrlenW (lpString=".jpg") returned 4 [0193.771] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.771] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.771] lstrlenW (lpString="messages.json") returned 13 [0193.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.771] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=228) returned 1 [0193.771] CloseHandle (hObject=0x35c) returned 1 [0193.771] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 0x2020 [0193.771] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.771] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.772] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.772] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.772] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.772] GetLastError () returned 0x0 [0193.772] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe4, lpOverlapped=0x0) returned 1 [0193.773] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.774] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.774] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.774] SetEndOfFile (hFile=0x15c) returned 1 [0193.775] CloseHandle (hObject=0x15c) returned 1 [0193.775] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.775] SetEndOfFile (hFile=0x35c) returned 1 [0193.775] CloseHandle (hObject=0x35c) returned 1 [0193.775] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.776] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json")) returned 1 [0193.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.776] lstrlenW (lpString=".doc") returned 4 [0193.776] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.776] lstrlenW (lpString=".docx") returned 5 [0193.776] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.776] lstrlenW (lpString=".pdf") returned 4 [0193.776] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.776] lstrlenW (lpString=".xls") returned 4 [0193.776] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.776] lstrlenW (lpString=".xlsx") returned 5 [0193.776] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.776] lstrlenW (lpString=".ppt") returned 4 [0193.776] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.776] lstrlenW (lpString=".zip") returned 4 [0193.776] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.776] lstrlenW (lpString=".rar") returned 4 [0193.776] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.776] lstrlenW (lpString=".bz2") returned 4 [0193.777] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.777] lstrlenW (lpString=".7z") returned 3 [0193.777] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.777] lstrlenW (lpString=".dbf") returned 4 [0193.777] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.777] lstrlenW (lpString=".1cd") returned 4 [0193.777] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.777] lstrlenW (lpString=".jpg") returned 4 [0193.777] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.777] lstrlenW (lpString=".doc") returned 4 [0193.777] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.777] lstrlenW (lpString=".docx") returned 5 [0193.777] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.777] lstrlenW (lpString=".pdf") returned 4 [0193.777] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.777] lstrlenW (lpString=".xls") returned 4 [0193.777] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.777] lstrlenW (lpString=".xlsx") returned 5 [0193.777] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.777] lstrlenW (lpString=".ppt") returned 4 [0193.777] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.777] lstrlenW (lpString=".zip") returned 4 [0193.777] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.777] lstrlenW (lpString=".rar") returned 4 [0193.777] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.778] lstrlenW (lpString=".bz2") returned 4 [0193.778] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.778] lstrlenW (lpString=".7z") returned 3 [0193.778] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.778] lstrlenW (lpString=".dbf") returned 4 [0193.778] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.778] lstrlenW (lpString=".1cd") returned 4 [0193.778] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lt\\messages.json") returned 151 [0193.778] lstrlenW (lpString=".jpg") returned 4 [0193.778] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.778] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.778] lstrlenW (lpString="messages.json") returned 13 [0193.778] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.778] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=224) returned 1 [0193.778] CloseHandle (hObject=0x35c) returned 1 [0193.779] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 0x2020 [0193.779] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.779] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.779] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.780] GetLastError () returned 0x0 [0193.780] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe0, lpOverlapped=0x0) returned 1 [0193.780] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0193.781] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.781] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.781] SetEndOfFile (hFile=0x15c) returned 1 [0193.782] CloseHandle (hObject=0x15c) returned 1 [0193.782] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.782] SetEndOfFile (hFile=0x35c) returned 1 [0193.782] CloseHandle (hObject=0x35c) returned 1 [0193.782] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.783] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json")) returned 1 [0193.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.783] lstrlenW (lpString=".doc") returned 4 [0193.783] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.783] lstrlenW (lpString=".docx") returned 5 [0193.783] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.783] lstrlenW (lpString=".pdf") returned 4 [0193.783] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.783] lstrlenW (lpString=".xls") returned 4 [0193.783] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.783] lstrlenW (lpString=".xlsx") returned 5 [0193.783] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.783] lstrlenW (lpString=".ppt") returned 4 [0193.783] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.783] lstrlenW (lpString=".zip") returned 4 [0193.783] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.783] lstrlenW (lpString=".rar") returned 4 [0193.783] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.783] lstrlenW (lpString=".bz2") returned 4 [0193.783] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.783] lstrlenW (lpString=".7z") returned 3 [0193.784] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.784] lstrlenW (lpString=".dbf") returned 4 [0193.784] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.784] lstrlenW (lpString=".1cd") returned 4 [0193.784] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.784] lstrlenW (lpString=".jpg") returned 4 [0193.784] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.784] lstrlenW (lpString=".doc") returned 4 [0193.784] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.784] lstrlenW (lpString=".docx") returned 5 [0193.784] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.784] lstrlenW (lpString=".pdf") returned 4 [0193.784] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.784] lstrlenW (lpString=".xls") returned 4 [0193.784] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.784] lstrlenW (lpString=".xlsx") returned 5 [0193.784] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.784] lstrlenW (lpString=".ppt") returned 4 [0193.784] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.784] lstrlenW (lpString=".zip") returned 4 [0193.784] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.784] lstrlenW (lpString=".rar") returned 4 [0193.784] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.784] lstrlenW (lpString=".bz2") returned 4 [0193.784] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.784] lstrlenW (lpString=".7z") returned 3 [0193.785] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.785] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.785] lstrlenW (lpString=".dbf") returned 4 [0193.785] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.785] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.785] lstrlenW (lpString=".1cd") returned 4 [0193.785] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.785] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\lv\\messages.json") returned 151 [0193.785] lstrlenW (lpString=".jpg") returned 4 [0193.785] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.785] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.785] lstrlenW (lpString="messages.json") returned 13 [0193.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.785] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=207) returned 1 [0193.785] CloseHandle (hObject=0x35c) returned 1 [0193.785] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 0x2020 [0193.786] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.786] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.786] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.786] GetLastError () returned 0x0 [0193.786] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xcf, lpOverlapped=0x0) returned 1 [0193.787] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0193.788] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.788] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.788] SetEndOfFile (hFile=0x15c) returned 1 [0193.788] CloseHandle (hObject=0x15c) returned 1 [0193.789] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.789] SetEndOfFile (hFile=0x35c) returned 1 [0193.789] CloseHandle (hObject=0x35c) returned 1 [0193.789] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.789] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json")) returned 1 [0193.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.790] lstrlenW (lpString=".doc") returned 4 [0193.790] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.790] lstrlenW (lpString=".docx") returned 5 [0193.790] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.790] lstrlenW (lpString=".pdf") returned 4 [0193.790] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.790] lstrlenW (lpString=".xls") returned 4 [0193.790] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.790] lstrlenW (lpString=".xlsx") returned 5 [0193.790] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.790] lstrlenW (lpString=".ppt") returned 4 [0193.790] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.790] lstrlenW (lpString=".zip") returned 4 [0193.790] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.790] lstrlenW (lpString=".rar") returned 4 [0193.790] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.790] lstrlenW (lpString=".bz2") returned 4 [0193.790] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.790] lstrlenW (lpString=".7z") returned 3 [0193.790] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.790] lstrlenW (lpString=".dbf") returned 4 [0193.790] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.791] lstrlenW (lpString=".1cd") returned 4 [0193.791] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.791] lstrlenW (lpString=".jpg") returned 4 [0193.791] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.791] lstrlenW (lpString=".doc") returned 4 [0193.791] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.791] lstrlenW (lpString=".docx") returned 5 [0193.791] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.791] lstrlenW (lpString=".pdf") returned 4 [0193.791] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.791] lstrlenW (lpString=".xls") returned 4 [0193.791] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.791] lstrlenW (lpString=".xlsx") returned 5 [0193.791] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.791] lstrlenW (lpString=".ppt") returned 4 [0193.791] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.791] lstrlenW (lpString=".zip") returned 4 [0193.791] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.791] lstrlenW (lpString=".rar") returned 4 [0193.791] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.791] lstrlenW (lpString=".bz2") returned 4 [0193.791] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.791] lstrlenW (lpString=".7z") returned 3 [0193.791] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.792] lstrlenW (lpString=".dbf") returned 4 [0193.792] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.792] lstrlenW (lpString=".1cd") returned 4 [0193.792] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ms\\messages.json") returned 151 [0193.792] lstrlenW (lpString=".jpg") returned 4 [0193.792] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.792] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.792] lstrlenW (lpString="messages.json") returned 13 [0193.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.792] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=217) returned 1 [0193.792] CloseHandle (hObject=0x35c) returned 1 [0193.792] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 0x2020 [0193.793] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.793] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.793] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.793] GetLastError () returned 0x0 [0193.793] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd9, lpOverlapped=0x0) returned 1 [0193.794] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.795] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.795] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.795] SetEndOfFile (hFile=0x15c) returned 1 [0193.795] CloseHandle (hObject=0x15c) returned 1 [0193.795] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.795] SetEndOfFile (hFile=0x35c) returned 1 [0193.796] CloseHandle (hObject=0x35c) returned 1 [0193.796] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.796] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json")) returned 1 [0193.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.797] lstrlenW (lpString=".doc") returned 4 [0193.797] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.797] lstrlenW (lpString=".docx") returned 5 [0193.797] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.797] lstrlenW (lpString=".pdf") returned 4 [0193.797] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.797] lstrlenW (lpString=".xls") returned 4 [0193.797] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.797] lstrlenW (lpString=".xlsx") returned 5 [0193.797] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.797] lstrlenW (lpString=".ppt") returned 4 [0193.797] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.797] lstrlenW (lpString=".zip") returned 4 [0193.797] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.797] lstrlenW (lpString=".rar") returned 4 [0193.797] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.797] lstrlenW (lpString=".bz2") returned 4 [0193.797] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.797] lstrlenW (lpString=".7z") returned 3 [0193.797] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.797] lstrlenW (lpString=".dbf") returned 4 [0193.797] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.797] lstrlenW (lpString=".1cd") returned 4 [0193.797] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.798] lstrlenW (lpString=".jpg") returned 4 [0193.798] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.798] lstrlenW (lpString=".doc") returned 4 [0193.798] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.798] lstrlenW (lpString=".docx") returned 5 [0193.798] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.798] lstrlenW (lpString=".pdf") returned 4 [0193.798] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.798] lstrlenW (lpString=".xls") returned 4 [0193.798] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.798] lstrlenW (lpString=".xlsx") returned 5 [0193.798] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.798] lstrlenW (lpString=".ppt") returned 4 [0193.798] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.798] lstrlenW (lpString=".zip") returned 4 [0193.798] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.798] lstrlenW (lpString=".rar") returned 4 [0193.798] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.798] lstrlenW (lpString=".bz2") returned 4 [0193.798] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.798] lstrlenW (lpString=".7z") returned 3 [0193.798] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.798] lstrlenW (lpString=".dbf") returned 4 [0193.798] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.798] lstrlenW (lpString=".1cd") returned 4 [0193.798] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\nl\\messages.json") returned 151 [0193.799] lstrlenW (lpString=".jpg") returned 4 [0193.799] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.799] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.799] lstrlenW (lpString="messages.json") returned 13 [0193.799] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.801] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=195) returned 1 [0193.801] CloseHandle (hObject=0x35c) returned 1 [0193.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 0x2020 [0193.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.801] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.801] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.802] GetLastError () returned 0x0 [0193.802] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xc3, lpOverlapped=0x0) returned 1 [0193.803] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0193.804] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.804] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.804] SetEndOfFile (hFile=0x15c) returned 1 [0193.804] CloseHandle (hObject=0x15c) returned 1 [0193.804] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.804] SetEndOfFile (hFile=0x35c) returned 1 [0193.805] CloseHandle (hObject=0x35c) returned 1 [0193.805] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.805] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json")) returned 1 [0193.805] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.805] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.805] lstrlenW (lpString=".doc") returned 4 [0193.805] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.805] lstrlenW (lpString=".docx") returned 5 [0193.805] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.805] lstrlenW (lpString=".pdf") returned 4 [0193.805] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.805] lstrlenW (lpString=".xls") returned 4 [0193.805] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.805] lstrlenW (lpString=".xlsx") returned 5 [0193.805] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.806] lstrlenW (lpString=".ppt") returned 4 [0193.806] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.806] lstrlenW (lpString=".zip") returned 4 [0193.806] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.806] lstrlenW (lpString=".rar") returned 4 [0193.806] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.806] lstrlenW (lpString=".bz2") returned 4 [0193.806] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.806] lstrlenW (lpString=".7z") returned 3 [0193.806] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.806] lstrlenW (lpString=".dbf") returned 4 [0193.806] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.806] lstrlenW (lpString=".1cd") returned 4 [0193.806] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.806] lstrlenW (lpString=".jpg") returned 4 [0193.806] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.806] lstrlenW (lpString=".doc") returned 4 [0193.806] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.806] lstrlenW (lpString=".docx") returned 5 [0193.806] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.806] lstrlenW (lpString=".pdf") returned 4 [0193.806] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.806] lstrlenW (lpString=".xls") returned 4 [0193.806] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.806] lstrlenW (lpString=".xlsx") returned 5 [0193.807] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.807] lstrlenW (lpString=".ppt") returned 4 [0193.807] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.807] lstrlenW (lpString=".zip") returned 4 [0193.807] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.807] lstrlenW (lpString=".rar") returned 4 [0193.807] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.807] lstrlenW (lpString=".bz2") returned 4 [0193.807] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.807] lstrlenW (lpString=".7z") returned 3 [0193.807] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.807] lstrlenW (lpString=".dbf") returned 4 [0193.807] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.807] lstrlenW (lpString=".1cd") returned 4 [0193.807] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\no\\messages.json") returned 151 [0193.807] lstrlenW (lpString=".jpg") returned 4 [0193.807] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.807] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.807] lstrlenW (lpString="messages.json") returned 13 [0193.807] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.808] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=213) returned 1 [0193.808] CloseHandle (hObject=0x35c) returned 1 [0193.808] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 0x2020 [0193.808] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.808] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.808] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.809] GetLastError () returned 0x0 [0193.809] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd5, lpOverlapped=0x0) returned 1 [0193.809] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.810] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.810] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.811] SetEndOfFile (hFile=0x15c) returned 1 [0193.811] CloseHandle (hObject=0x15c) returned 1 [0193.811] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.811] SetEndOfFile (hFile=0x35c) returned 1 [0193.812] CloseHandle (hObject=0x35c) returned 1 [0193.812] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.812] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json")) returned 1 [0193.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.812] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.812] lstrlenW (lpString=".doc") returned 4 [0193.812] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.812] lstrlenW (lpString=".docx") returned 5 [0193.812] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.812] lstrlenW (lpString=".pdf") returned 4 [0193.812] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.812] lstrlenW (lpString=".xls") returned 4 [0193.812] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.812] lstrlenW (lpString=".xlsx") returned 5 [0193.812] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.813] lstrlenW (lpString=".ppt") returned 4 [0193.813] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.813] lstrlenW (lpString=".zip") returned 4 [0193.813] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.813] lstrlenW (lpString=".rar") returned 4 [0193.813] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.813] lstrlenW (lpString=".bz2") returned 4 [0193.813] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.813] lstrlenW (lpString=".7z") returned 3 [0193.813] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.813] lstrlenW (lpString=".dbf") returned 4 [0193.813] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.813] lstrlenW (lpString=".1cd") returned 4 [0193.813] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.813] lstrlenW (lpString=".jpg") returned 4 [0193.813] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.813] lstrlenW (lpString=".doc") returned 4 [0193.813] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.813] lstrlenW (lpString=".docx") returned 5 [0193.813] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.813] lstrlenW (lpString=".pdf") returned 4 [0193.813] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.813] lstrlenW (lpString=".xls") returned 4 [0193.813] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.813] lstrlenW (lpString=".xlsx") returned 5 [0193.813] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.814] lstrlenW (lpString=".ppt") returned 4 [0193.814] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.814] lstrlenW (lpString=".zip") returned 4 [0193.814] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.814] lstrlenW (lpString=".rar") returned 4 [0193.814] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.814] lstrlenW (lpString=".bz2") returned 4 [0193.814] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.814] lstrlenW (lpString=".7z") returned 3 [0193.814] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.814] lstrlenW (lpString=".dbf") returned 4 [0193.814] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.814] lstrlenW (lpString=".1cd") returned 4 [0193.814] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pl\\messages.json") returned 151 [0193.814] lstrlenW (lpString=".jpg") returned 4 [0193.814] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.814] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.814] lstrlenW (lpString="messages.json") returned 13 [0193.814] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.815] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=206) returned 1 [0193.815] CloseHandle (hObject=0x35c) returned 1 [0193.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0193.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.815] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.815] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.816] GetLastError () returned 0x0 [0193.816] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xce, lpOverlapped=0x0) returned 1 [0193.817] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0193.817] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.817] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.818] SetEndOfFile (hFile=0x15c) returned 1 [0193.818] CloseHandle (hObject=0x15c) returned 1 [0193.818] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.818] SetEndOfFile (hFile=0x35c) returned 1 [0193.819] CloseHandle (hObject=0x35c) returned 1 [0193.819] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.819] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_br\\messages.json")) returned 1 [0193.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.819] lstrlenW (lpString=".doc") returned 4 [0193.819] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.819] lstrlenW (lpString=".docx") returned 5 [0193.819] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.819] lstrlenW (lpString=".pdf") returned 4 [0193.819] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.819] lstrlenW (lpString=".xls") returned 4 [0193.819] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.819] lstrlenW (lpString=".xlsx") returned 5 [0193.819] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.819] lstrlenW (lpString=".ppt") returned 4 [0193.819] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.819] lstrlenW (lpString=".zip") returned 4 [0193.819] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.819] lstrlenW (lpString=".rar") returned 4 [0193.820] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.820] lstrlenW (lpString=".bz2") returned 4 [0193.820] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.820] lstrlenW (lpString=".7z") returned 3 [0193.820] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.820] lstrlenW (lpString=".dbf") returned 4 [0193.820] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.820] lstrlenW (lpString=".1cd") returned 4 [0193.820] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.820] lstrlenW (lpString=".jpg") returned 4 [0193.820] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.820] lstrlenW (lpString=".doc") returned 4 [0193.820] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.820] lstrlenW (lpString=".docx") returned 5 [0193.820] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.820] lstrlenW (lpString=".pdf") returned 4 [0193.820] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.820] lstrlenW (lpString=".xls") returned 4 [0193.820] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.820] lstrlenW (lpString=".xlsx") returned 5 [0193.820] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.820] lstrlenW (lpString=".ppt") returned 4 [0193.820] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.820] lstrlenW (lpString=".zip") returned 4 [0193.820] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.821] lstrlenW (lpString=".rar") returned 4 [0193.821] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.821] lstrlenW (lpString=".bz2") returned 4 [0193.821] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.821] lstrlenW (lpString=".7z") returned 3 [0193.821] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.821] lstrlenW (lpString=".dbf") returned 4 [0193.821] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.821] lstrlenW (lpString=".1cd") returned 4 [0193.821] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_BR\\messages.json") returned 154 [0193.821] lstrlenW (lpString=".jpg") returned 4 [0193.821] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.821] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.821] lstrlenW (lpString="messages.json") returned 13 [0193.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.822] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=208) returned 1 [0193.822] CloseHandle (hObject=0x35c) returned 1 [0193.822] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0193.822] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.822] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.822] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.823] GetLastError () returned 0x0 [0193.823] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd0, lpOverlapped=0x0) returned 1 [0193.824] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.825] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.825] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.825] SetEndOfFile (hFile=0x15c) returned 1 [0193.825] CloseHandle (hObject=0x15c) returned 1 [0193.825] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.825] SetEndOfFile (hFile=0x35c) returned 1 [0193.826] CloseHandle (hObject=0x35c) returned 1 [0193.826] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.826] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_pt\\messages.json")) returned 1 [0193.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.826] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.826] lstrlenW (lpString=".doc") returned 4 [0193.826] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.826] lstrlenW (lpString=".docx") returned 5 [0193.826] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.826] lstrlenW (lpString=".pdf") returned 4 [0193.826] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.826] lstrlenW (lpString=".xls") returned 4 [0193.826] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.826] lstrlenW (lpString=".xlsx") returned 5 [0193.827] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.827] lstrlenW (lpString=".ppt") returned 4 [0193.827] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.827] lstrlenW (lpString=".zip") returned 4 [0193.827] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.827] lstrlenW (lpString=".rar") returned 4 [0193.827] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.827] lstrlenW (lpString=".bz2") returned 4 [0193.827] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.827] lstrlenW (lpString=".7z") returned 3 [0193.827] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.827] lstrlenW (lpString=".dbf") returned 4 [0193.827] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.827] lstrlenW (lpString=".1cd") returned 4 [0193.827] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.827] lstrlenW (lpString=".jpg") returned 4 [0193.827] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.827] lstrlenW (lpString=".doc") returned 4 [0193.827] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.827] lstrlenW (lpString=".docx") returned 5 [0193.827] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.827] lstrlenW (lpString=".pdf") returned 4 [0193.827] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.827] lstrlenW (lpString=".xls") returned 4 [0193.827] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.828] lstrlenW (lpString=".xlsx") returned 5 [0193.828] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.828] lstrlenW (lpString=".ppt") returned 4 [0193.828] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.828] lstrlenW (lpString=".zip") returned 4 [0193.828] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.828] lstrlenW (lpString=".rar") returned 4 [0193.828] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.828] lstrlenW (lpString=".bz2") returned 4 [0193.828] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.828] lstrlenW (lpString=".7z") returned 3 [0193.828] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.828] lstrlenW (lpString=".dbf") returned 4 [0193.828] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.828] lstrlenW (lpString=".1cd") returned 4 [0193.828] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\pt_PT\\messages.json") returned 154 [0193.828] lstrlenW (lpString=".jpg") returned 4 [0193.828] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.828] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.828] lstrlenW (lpString="messages.json") returned 13 [0193.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.829] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=213) returned 1 [0193.829] CloseHandle (hObject=0x35c) returned 1 [0193.829] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 0x2020 [0193.829] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.829] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.829] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.830] GetLastError () returned 0x0 [0193.830] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd5, lpOverlapped=0x0) returned 1 [0193.831] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0193.831] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.831] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.832] SetEndOfFile (hFile=0x15c) returned 1 [0193.832] CloseHandle (hObject=0x15c) returned 1 [0193.832] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.832] SetEndOfFile (hFile=0x35c) returned 1 [0193.832] CloseHandle (hObject=0x35c) returned 1 [0193.833] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.833] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json")) returned 1 [0193.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.833] lstrlenW (lpString=".doc") returned 4 [0193.833] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.833] lstrlenW (lpString=".docx") returned 5 [0193.833] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.833] lstrlenW (lpString=".pdf") returned 4 [0193.833] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.833] lstrlenW (lpString=".xls") returned 4 [0193.833] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.833] lstrlenW (lpString=".xlsx") returned 5 [0193.833] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.833] lstrlenW (lpString=".ppt") returned 4 [0193.833] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.833] lstrlenW (lpString=".zip") returned 4 [0193.833] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.833] lstrlenW (lpString=".rar") returned 4 [0193.833] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.833] lstrlenW (lpString=".bz2") returned 4 [0193.833] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.834] lstrlenW (lpString=".7z") returned 3 [0193.834] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.834] lstrlenW (lpString=".dbf") returned 4 [0193.834] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.834] lstrlenW (lpString=".1cd") returned 4 [0193.834] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.834] lstrlenW (lpString=".jpg") returned 4 [0193.834] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.834] lstrlenW (lpString=".doc") returned 4 [0193.834] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.834] lstrlenW (lpString=".docx") returned 5 [0193.834] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.834] lstrlenW (lpString=".pdf") returned 4 [0193.834] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.834] lstrlenW (lpString=".xls") returned 4 [0193.834] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.834] lstrlenW (lpString=".xlsx") returned 5 [0193.834] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.834] lstrlenW (lpString=".ppt") returned 4 [0193.834] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.834] lstrlenW (lpString=".zip") returned 4 [0193.834] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.834] lstrlenW (lpString=".rar") returned 4 [0193.834] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.834] lstrlenW (lpString=".bz2") returned 4 [0193.835] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.835] lstrlenW (lpString=".7z") returned 3 [0193.835] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.835] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.835] lstrlenW (lpString=".dbf") returned 4 [0193.835] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.835] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.835] lstrlenW (lpString=".1cd") returned 4 [0193.835] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.835] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ro\\messages.json") returned 151 [0193.835] lstrlenW (lpString=".jpg") returned 4 [0193.835] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.835] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.835] lstrlenW (lpString="messages.json") returned 13 [0193.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.835] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=266) returned 1 [0193.835] CloseHandle (hObject=0x35c) returned 1 [0193.836] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 0x2020 [0193.836] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0193.836] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.836] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.836] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0193.836] GetLastError () returned 0x0 [0193.836] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x10a, lpOverlapped=0x0) returned 1 [0193.837] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x110, lpOverlapped=0x0) returned 1 [0193.838] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0193.838] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0193.838] SetEndOfFile (hFile=0x15c) returned 1 [0193.838] CloseHandle (hObject=0x15c) returned 1 [0193.838] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0193.839] SetEndOfFile (hFile=0x35c) returned 1 [0193.839] CloseHandle (hObject=0x35c) returned 1 [0193.839] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0193.839] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json")) returned 1 [0193.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.840] lstrlenW (lpString=".doc") returned 4 [0193.840] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.840] lstrlenW (lpString=".docx") returned 5 [0193.840] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.840] lstrlenW (lpString=".pdf") returned 4 [0193.840] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.840] lstrlenW (lpString=".xls") returned 4 [0193.840] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.840] lstrlenW (lpString=".xlsx") returned 5 [0193.840] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.840] lstrlenW (lpString=".ppt") returned 4 [0193.840] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.840] lstrlenW (lpString=".zip") returned 4 [0193.840] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.840] lstrlenW (lpString=".rar") returned 4 [0193.840] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.840] lstrlenW (lpString=".bz2") returned 4 [0193.840] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.840] lstrlenW (lpString=".7z") returned 3 [0193.840] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.840] lstrlenW (lpString=".dbf") returned 4 [0193.840] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.840] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.840] lstrlenW (lpString=".1cd") returned 4 [0193.841] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.841] lstrlenW (lpString=".jpg") returned 4 [0193.841] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.841] lstrlenW (lpString=".doc") returned 4 [0193.841] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0193.841] lstrlenW (lpString=".docx") returned 5 [0193.841] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0193.841] lstrlenW (lpString=".pdf") returned 4 [0193.841] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0193.841] lstrlenW (lpString=".xls") returned 4 [0193.841] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0193.841] lstrlenW (lpString=".xlsx") returned 5 [0193.841] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0193.841] lstrlenW (lpString=".ppt") returned 4 [0193.841] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0193.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.841] lstrlenW (lpString=".zip") returned 4 [0193.841] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0193.841] lstrlenW (lpString=".rar") returned 4 [0193.841] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0193.841] lstrlenW (lpString=".bz2") returned 4 [0193.841] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0193.841] lstrlenW (lpString=".7z") returned 3 [0193.841] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0193.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.841] lstrlenW (lpString=".dbf") returned 4 [0193.841] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0193.841] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.842] lstrlenW (lpString=".1cd") returned 4 [0193.842] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0193.842] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_locales\\ru\\messages.json") returned 151 [0193.842] lstrlenW (lpString=".jpg") returned 4 [0193.842] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0193.949] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0193.949] lstrlenW (lpString="verified_contents.json") returned 22 [0193.949] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.248] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=11094) returned 1 [0194.248] CloseHandle (hObject=0x150) returned 1 [0194.248] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 0x2020 [0194.248] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.248] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.248] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.249] GetLastError () returned 0x0 [0194.249] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2b56, lpOverlapped=0x0) returned 1 [0194.406] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2b60, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2b60, lpOverlapped=0x0) returned 1 [0194.407] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.407] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0194.407] SetEndOfFile (hFile=0x15c) returned 1 [0194.407] CloseHandle (hObject=0x15c) returned 1 [0194.407] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.408] SetEndOfFile (hFile=0x150) returned 1 [0194.408] CloseHandle (hObject=0x150) returned 1 [0194.408] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.409] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json")) returned 1 [0194.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.409] lstrlenW (lpString=".doc") returned 4 [0194.409] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.409] lstrlenW (lpString=".docx") returned 5 [0194.409] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.409] lstrlenW (lpString=".pdf") returned 4 [0194.409] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.409] lstrlenW (lpString=".xls") returned 4 [0194.409] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.409] lstrlenW (lpString=".xlsx") returned 5 [0194.409] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.409] lstrlenW (lpString=".ppt") returned 4 [0194.409] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.409] lstrlenW (lpString=".zip") returned 4 [0194.409] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.409] lstrlenW (lpString=".rar") returned 4 [0194.409] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.409] lstrlenW (lpString=".bz2") returned 4 [0194.409] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.409] lstrlenW (lpString=".7z") returned 3 [0194.409] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.410] lstrlenW (lpString=".dbf") returned 4 [0194.410] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.410] lstrlenW (lpString=".1cd") returned 4 [0194.410] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.410] lstrlenW (lpString=".jpg") returned 4 [0194.410] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.410] lstrlenW (lpString=".doc") returned 4 [0194.410] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.410] lstrlenW (lpString=".docx") returned 5 [0194.410] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.410] lstrlenW (lpString=".pdf") returned 4 [0194.410] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.410] lstrlenW (lpString=".xls") returned 4 [0194.410] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.410] lstrlenW (lpString=".xlsx") returned 5 [0194.410] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.410] lstrlenW (lpString=".ppt") returned 4 [0194.410] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.410] lstrlenW (lpString=".zip") returned 4 [0194.410] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.410] lstrlenW (lpString=".rar") returned 4 [0194.410] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.410] lstrlenW (lpString=".bz2") returned 4 [0194.410] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.411] lstrlenW (lpString=".7z") returned 3 [0194.411] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.411] lstrlenW (lpString=".dbf") returned 4 [0194.411] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.411] lstrlenW (lpString=".1cd") returned 4 [0194.411] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\aohghmighlieiainnegkcijnfilokake\\0.9_0\\_metadata\\verified_contents.json") returned 158 [0194.411] lstrlenW (lpString=".jpg") returned 4 [0194.411] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.411] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.411] lstrlenW (lpString="manifest.json") returned 13 [0194.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.411] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=728) returned 1 [0194.411] CloseHandle (hObject=0x150) returned 1 [0194.412] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 0x2020 [0194.412] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.412] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.412] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.412] GetLastError () returned 0x0 [0194.412] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2d8, lpOverlapped=0x0) returned 1 [0194.443] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2e0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2e0, lpOverlapped=0x0) returned 1 [0194.444] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.444] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.444] SetEndOfFile (hFile=0x15c) returned 1 [0194.444] CloseHandle (hObject=0x15c) returned 1 [0194.444] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.444] SetEndOfFile (hFile=0x150) returned 1 [0194.445] CloseHandle (hObject=0x150) returned 1 [0194.445] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.445] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json")) returned 1 [0194.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.446] lstrlenW (lpString=".doc") returned 4 [0194.446] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.446] lstrlenW (lpString=".docx") returned 5 [0194.446] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.446] lstrlenW (lpString=".pdf") returned 4 [0194.446] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.446] lstrlenW (lpString=".xls") returned 4 [0194.446] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.446] lstrlenW (lpString=".xlsx") returned 5 [0194.446] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.446] lstrlenW (lpString=".ppt") returned 4 [0194.446] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.446] lstrlenW (lpString=".zip") returned 4 [0194.446] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.446] lstrlenW (lpString=".rar") returned 4 [0194.446] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.446] lstrlenW (lpString=".bz2") returned 4 [0194.446] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.446] lstrlenW (lpString=".7z") returned 3 [0194.446] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.446] lstrlenW (lpString=".dbf") returned 4 [0194.446] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.446] lstrlenW (lpString=".1cd") returned 4 [0194.446] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.447] lstrlenW (lpString=".jpg") returned 4 [0194.447] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.447] lstrlenW (lpString=".doc") returned 4 [0194.447] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.447] lstrlenW (lpString=".docx") returned 5 [0194.447] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.447] lstrlenW (lpString=".pdf") returned 4 [0194.447] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.447] lstrlenW (lpString=".xls") returned 4 [0194.447] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.447] lstrlenW (lpString=".xlsx") returned 5 [0194.447] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.447] lstrlenW (lpString=".ppt") returned 4 [0194.447] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.447] lstrlenW (lpString=".zip") returned 4 [0194.447] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.447] lstrlenW (lpString=".rar") returned 4 [0194.447] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.447] lstrlenW (lpString=".bz2") returned 4 [0194.447] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.447] lstrlenW (lpString=".7z") returned 3 [0194.447] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.447] lstrlenW (lpString=".dbf") returned 4 [0194.447] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.447] lstrlenW (lpString=".1cd") returned 4 [0194.448] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\manifest.json") returned 141 [0194.448] lstrlenW (lpString=".jpg") returned 4 [0194.448] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.448] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.448] lstrlenW (lpString="messages.json") returned 13 [0194.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.448] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.448] CloseHandle (hObject=0x150) returned 1 [0194.448] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 0x2020 [0194.448] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.449] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.449] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.449] GetLastError () returned 0x0 [0194.449] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.450] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.451] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.451] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.451] SetEndOfFile (hFile=0x15c) returned 1 [0194.451] CloseHandle (hObject=0x15c) returned 1 [0194.451] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.451] SetEndOfFile (hFile=0x150) returned 1 [0194.452] CloseHandle (hObject=0x150) returned 1 [0194.452] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.452] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json")) returned 1 [0194.452] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.453] lstrlenW (lpString=".doc") returned 4 [0194.453] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.453] lstrlenW (lpString=".docx") returned 5 [0194.453] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.453] lstrlenW (lpString=".pdf") returned 4 [0194.453] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.453] lstrlenW (lpString=".xls") returned 4 [0194.453] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.453] lstrlenW (lpString=".xlsx") returned 5 [0194.453] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.453] lstrlenW (lpString=".ppt") returned 4 [0194.453] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.453] lstrlenW (lpString=".zip") returned 4 [0194.453] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.453] lstrlenW (lpString=".rar") returned 4 [0194.453] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.453] lstrlenW (lpString=".bz2") returned 4 [0194.453] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.453] lstrlenW (lpString=".7z") returned 3 [0194.453] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.453] lstrlenW (lpString=".dbf") returned 4 [0194.453] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.453] lstrlenW (lpString=".1cd") returned 4 [0194.453] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.453] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.453] lstrlenW (lpString=".jpg") returned 4 [0194.453] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.454] lstrlenW (lpString=".doc") returned 4 [0194.454] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.454] lstrlenW (lpString=".docx") returned 5 [0194.454] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.454] lstrlenW (lpString=".pdf") returned 4 [0194.454] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.454] lstrlenW (lpString=".xls") returned 4 [0194.454] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.454] lstrlenW (lpString=".xlsx") returned 5 [0194.454] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.454] lstrlenW (lpString=".ppt") returned 4 [0194.454] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.454] lstrlenW (lpString=".zip") returned 4 [0194.454] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.454] lstrlenW (lpString=".rar") returned 4 [0194.454] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.454] lstrlenW (lpString=".bz2") returned 4 [0194.454] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.454] lstrlenW (lpString=".7z") returned 3 [0194.454] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.454] lstrlenW (lpString=".dbf") returned 4 [0194.454] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.454] lstrlenW (lpString=".1cd") returned 4 [0194.454] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.454] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\da\\messages.json") returned 153 [0194.454] lstrlenW (lpString=".jpg") returned 4 [0194.455] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.455] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.455] lstrlenW (lpString="messages.json") returned 13 [0194.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.455] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.455] CloseHandle (hObject=0x150) returned 1 [0194.455] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 0x2020 [0194.455] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.455] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.456] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.456] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.456] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.456] GetLastError () returned 0x0 [0194.456] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.457] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.458] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.458] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.458] SetEndOfFile (hFile=0x15c) returned 1 [0194.458] CloseHandle (hObject=0x15c) returned 1 [0194.458] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.458] SetEndOfFile (hFile=0x150) returned 1 [0194.459] CloseHandle (hObject=0x150) returned 1 [0194.459] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.459] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json")) returned 1 [0194.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.459] lstrlenW (lpString=".doc") returned 4 [0194.460] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.460] lstrlenW (lpString=".docx") returned 5 [0194.460] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.460] lstrlenW (lpString=".pdf") returned 4 [0194.460] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.460] lstrlenW (lpString=".xls") returned 4 [0194.460] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.460] lstrlenW (lpString=".xlsx") returned 5 [0194.460] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.460] lstrlenW (lpString=".ppt") returned 4 [0194.460] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.460] lstrlenW (lpString=".zip") returned 4 [0194.460] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.460] lstrlenW (lpString=".rar") returned 4 [0194.460] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.460] lstrlenW (lpString=".bz2") returned 4 [0194.460] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.460] lstrlenW (lpString=".7z") returned 3 [0194.460] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.460] lstrlenW (lpString=".dbf") returned 4 [0194.460] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.460] lstrlenW (lpString=".1cd") returned 4 [0194.460] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.460] lstrlenW (lpString=".jpg") returned 4 [0194.460] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.461] lstrlenW (lpString=".doc") returned 4 [0194.461] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.461] lstrlenW (lpString=".docx") returned 5 [0194.461] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.461] lstrlenW (lpString=".pdf") returned 4 [0194.461] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.461] lstrlenW (lpString=".xls") returned 4 [0194.461] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.461] lstrlenW (lpString=".xlsx") returned 5 [0194.461] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.461] lstrlenW (lpString=".ppt") returned 4 [0194.461] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.461] lstrlenW (lpString=".zip") returned 4 [0194.461] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.461] lstrlenW (lpString=".rar") returned 4 [0194.461] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.461] lstrlenW (lpString=".bz2") returned 4 [0194.461] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.461] lstrlenW (lpString=".7z") returned 3 [0194.461] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.461] lstrlenW (lpString=".dbf") returned 4 [0194.461] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.461] lstrlenW (lpString=".1cd") returned 4 [0194.461] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\de\\messages.json") returned 153 [0194.461] lstrlenW (lpString=".jpg") returned 4 [0194.461] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.462] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.462] lstrlenW (lpString="messages.json") returned 13 [0194.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.462] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.462] CloseHandle (hObject=0x150) returned 1 [0194.462] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 0x2020 [0194.462] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.462] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.462] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.463] GetLastError () returned 0x0 [0194.463] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.464] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.465] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.465] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.465] SetEndOfFile (hFile=0x15c) returned 1 [0194.465] CloseHandle (hObject=0x15c) returned 1 [0194.465] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.465] SetEndOfFile (hFile=0x150) returned 1 [0194.466] CloseHandle (hObject=0x150) returned 1 [0194.466] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.466] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json")) returned 1 [0194.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.466] lstrlenW (lpString=".doc") returned 4 [0194.467] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.467] lstrlenW (lpString=".docx") returned 5 [0194.467] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.467] lstrlenW (lpString=".pdf") returned 4 [0194.467] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.467] lstrlenW (lpString=".xls") returned 4 [0194.467] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.467] lstrlenW (lpString=".xlsx") returned 5 [0194.467] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.467] lstrlenW (lpString=".ppt") returned 4 [0194.467] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.467] lstrlenW (lpString=".zip") returned 4 [0194.467] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.467] lstrlenW (lpString=".rar") returned 4 [0194.467] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.467] lstrlenW (lpString=".bz2") returned 4 [0194.467] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.467] lstrlenW (lpString=".7z") returned 3 [0194.467] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.467] lstrlenW (lpString=".dbf") returned 4 [0194.467] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.467] lstrlenW (lpString=".1cd") returned 4 [0194.467] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.467] lstrlenW (lpString=".jpg") returned 4 [0194.467] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.468] lstrlenW (lpString=".doc") returned 4 [0194.468] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.468] lstrlenW (lpString=".docx") returned 5 [0194.468] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.468] lstrlenW (lpString=".pdf") returned 4 [0194.468] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.468] lstrlenW (lpString=".xls") returned 4 [0194.468] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.468] lstrlenW (lpString=".xlsx") returned 5 [0194.468] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.468] lstrlenW (lpString=".ppt") returned 4 [0194.468] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.468] lstrlenW (lpString=".zip") returned 4 [0194.468] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.468] lstrlenW (lpString=".rar") returned 4 [0194.468] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.468] lstrlenW (lpString=".bz2") returned 4 [0194.468] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.468] lstrlenW (lpString=".7z") returned 3 [0194.468] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.468] lstrlenW (lpString=".dbf") returned 4 [0194.468] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.468] lstrlenW (lpString=".1cd") returned 4 [0194.468] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\el\\messages.json") returned 153 [0194.468] lstrlenW (lpString=".jpg") returned 4 [0194.468] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.469] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.469] lstrlenW (lpString="messages.json") returned 13 [0194.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.469] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.469] CloseHandle (hObject=0x150) returned 1 [0194.469] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 0x2020 [0194.469] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.470] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.470] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.470] GetLastError () returned 0x0 [0194.470] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.520] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.521] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.521] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.522] SetEndOfFile (hFile=0x15c) returned 1 [0194.522] CloseHandle (hObject=0x15c) returned 1 [0194.522] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.522] SetEndOfFile (hFile=0x150) returned 1 [0194.522] CloseHandle (hObject=0x150) returned 1 [0194.523] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.523] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json")) returned 1 [0194.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.523] lstrlenW (lpString=".doc") returned 4 [0194.523] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.523] lstrlenW (lpString=".docx") returned 5 [0194.523] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.523] lstrlenW (lpString=".pdf") returned 4 [0194.523] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.523] lstrlenW (lpString=".xls") returned 4 [0194.523] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.523] lstrlenW (lpString=".xlsx") returned 5 [0194.523] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.523] lstrlenW (lpString=".ppt") returned 4 [0194.523] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.523] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.523] lstrlenW (lpString=".zip") returned 4 [0194.523] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.523] lstrlenW (lpString=".rar") returned 4 [0194.523] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.524] lstrlenW (lpString=".bz2") returned 4 [0194.524] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.524] lstrlenW (lpString=".7z") returned 3 [0194.524] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.524] lstrlenW (lpString=".dbf") returned 4 [0194.524] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.524] lstrlenW (lpString=".1cd") returned 4 [0194.524] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.524] lstrlenW (lpString=".jpg") returned 4 [0194.524] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.524] lstrlenW (lpString=".doc") returned 4 [0194.524] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.524] lstrlenW (lpString=".docx") returned 5 [0194.524] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.524] lstrlenW (lpString=".pdf") returned 4 [0194.524] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.524] lstrlenW (lpString=".xls") returned 4 [0194.524] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.524] lstrlenW (lpString=".xlsx") returned 5 [0194.524] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.524] lstrlenW (lpString=".ppt") returned 4 [0194.524] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.524] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.524] lstrlenW (lpString=".zip") returned 4 [0194.524] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.525] lstrlenW (lpString=".rar") returned 4 [0194.525] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.525] lstrlenW (lpString=".bz2") returned 4 [0194.525] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.525] lstrlenW (lpString=".7z") returned 3 [0194.525] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.525] lstrlenW (lpString=".dbf") returned 4 [0194.525] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.525] lstrlenW (lpString=".1cd") returned 4 [0194.525] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.525] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\en\\messages.json") returned 153 [0194.525] lstrlenW (lpString=".jpg") returned 4 [0194.525] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.525] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.525] lstrlenW (lpString="messages.json") returned 13 [0194.525] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.526] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.526] CloseHandle (hObject=0x150) returned 1 [0194.526] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 0x2020 [0194.526] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.526] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.526] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.526] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.526] GetLastError () returned 0x0 [0194.526] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.527] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.529] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.529] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.529] SetEndOfFile (hFile=0x15c) returned 1 [0194.529] CloseHandle (hObject=0x15c) returned 1 [0194.529] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.529] SetEndOfFile (hFile=0x150) returned 1 [0194.530] CloseHandle (hObject=0x150) returned 1 [0194.530] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.530] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json")) returned 1 [0194.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.530] lstrlenW (lpString=".doc") returned 4 [0194.530] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.530] lstrlenW (lpString=".docx") returned 5 [0194.530] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.530] lstrlenW (lpString=".pdf") returned 4 [0194.530] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.531] lstrlenW (lpString=".xls") returned 4 [0194.531] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.531] lstrlenW (lpString=".xlsx") returned 5 [0194.531] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.531] lstrlenW (lpString=".ppt") returned 4 [0194.531] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.531] lstrlenW (lpString=".zip") returned 4 [0194.531] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.531] lstrlenW (lpString=".rar") returned 4 [0194.531] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.531] lstrlenW (lpString=".bz2") returned 4 [0194.531] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.531] lstrlenW (lpString=".7z") returned 3 [0194.531] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.531] lstrlenW (lpString=".dbf") returned 4 [0194.531] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.531] lstrlenW (lpString=".1cd") returned 4 [0194.531] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.531] lstrlenW (lpString=".jpg") returned 4 [0194.531] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.531] lstrlenW (lpString=".doc") returned 4 [0194.531] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.531] lstrlenW (lpString=".docx") returned 5 [0194.531] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.532] lstrlenW (lpString=".pdf") returned 4 [0194.532] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.532] lstrlenW (lpString=".xls") returned 4 [0194.532] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.532] lstrlenW (lpString=".xlsx") returned 5 [0194.532] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.532] lstrlenW (lpString=".ppt") returned 4 [0194.532] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.532] lstrlenW (lpString=".zip") returned 4 [0194.532] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.532] lstrlenW (lpString=".rar") returned 4 [0194.532] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.532] lstrlenW (lpString=".bz2") returned 4 [0194.532] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.532] lstrlenW (lpString=".7z") returned 3 [0194.532] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.532] lstrlenW (lpString=".dbf") returned 4 [0194.532] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.532] lstrlenW (lpString=".1cd") returned 4 [0194.532] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.532] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hi\\messages.json") returned 153 [0194.532] lstrlenW (lpString=".jpg") returned 4 [0194.532] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.532] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.533] lstrlenW (lpString="messages.json") returned 13 [0194.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.533] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.533] CloseHandle (hObject=0x150) returned 1 [0194.533] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 0x2020 [0194.533] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.533] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.533] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.534] GetLastError () returned 0x0 [0194.534] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.535] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.536] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.536] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.536] SetEndOfFile (hFile=0x15c) returned 1 [0194.536] CloseHandle (hObject=0x15c) returned 1 [0194.536] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.536] SetEndOfFile (hFile=0x150) returned 1 [0194.537] CloseHandle (hObject=0x150) returned 1 [0194.537] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.537] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json")) returned 1 [0194.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.537] lstrlenW (lpString=".doc") returned 4 [0194.537] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.537] lstrlenW (lpString=".docx") returned 5 [0194.537] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.537] lstrlenW (lpString=".pdf") returned 4 [0194.537] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.537] lstrlenW (lpString=".xls") returned 4 [0194.537] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.537] lstrlenW (lpString=".xlsx") returned 5 [0194.537] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.537] lstrlenW (lpString=".ppt") returned 4 [0194.537] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.537] lstrlenW (lpString=".zip") returned 4 [0194.538] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.538] lstrlenW (lpString=".rar") returned 4 [0194.538] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.538] lstrlenW (lpString=".bz2") returned 4 [0194.538] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.538] lstrlenW (lpString=".7z") returned 3 [0194.538] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.538] lstrlenW (lpString=".dbf") returned 4 [0194.538] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.538] lstrlenW (lpString=".1cd") returned 4 [0194.538] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.538] lstrlenW (lpString=".jpg") returned 4 [0194.538] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.538] lstrlenW (lpString=".doc") returned 4 [0194.538] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.538] lstrlenW (lpString=".docx") returned 5 [0194.538] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.538] lstrlenW (lpString=".pdf") returned 4 [0194.538] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.538] lstrlenW (lpString=".xls") returned 4 [0194.538] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.538] lstrlenW (lpString=".xlsx") returned 5 [0194.538] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.538] lstrlenW (lpString=".ppt") returned 4 [0194.538] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.538] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.539] lstrlenW (lpString=".zip") returned 4 [0194.539] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.539] lstrlenW (lpString=".rar") returned 4 [0194.539] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.539] lstrlenW (lpString=".bz2") returned 4 [0194.539] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.539] lstrlenW (lpString=".7z") returned 3 [0194.539] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.539] lstrlenW (lpString=".dbf") returned 4 [0194.539] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.539] lstrlenW (lpString=".1cd") returned 4 [0194.539] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hr\\messages.json") returned 153 [0194.539] lstrlenW (lpString=".jpg") returned 4 [0194.539] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.539] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.539] lstrlenW (lpString="messages.json") returned 13 [0194.539] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.540] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.540] CloseHandle (hObject=0x150) returned 1 [0194.540] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 0x2020 [0194.540] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.540] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.540] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.540] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.541] GetLastError () returned 0x0 [0194.541] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.541] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.542] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.542] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.542] SetEndOfFile (hFile=0x15c) returned 1 [0194.543] CloseHandle (hObject=0x15c) returned 1 [0194.543] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.543] SetEndOfFile (hFile=0x150) returned 1 [0194.543] CloseHandle (hObject=0x150) returned 1 [0194.543] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.544] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json")) returned 1 [0194.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.544] lstrlenW (lpString=".doc") returned 4 [0194.544] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.544] lstrlenW (lpString=".docx") returned 5 [0194.544] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.544] lstrlenW (lpString=".pdf") returned 4 [0194.544] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.544] lstrlenW (lpString=".xls") returned 4 [0194.544] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.544] lstrlenW (lpString=".xlsx") returned 5 [0194.544] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.544] lstrlenW (lpString=".ppt") returned 4 [0194.544] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.544] lstrlenW (lpString=".zip") returned 4 [0194.545] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.545] lstrlenW (lpString=".rar") returned 4 [0194.545] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.545] lstrlenW (lpString=".bz2") returned 4 [0194.545] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.545] lstrlenW (lpString=".7z") returned 3 [0194.545] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.545] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.545] lstrlenW (lpString=".dbf") returned 4 [0194.545] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.545] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.545] lstrlenW (lpString=".1cd") returned 4 [0194.545] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.545] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.545] lstrlenW (lpString=".jpg") returned 4 [0194.545] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.545] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.545] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.545] lstrlenW (lpString=".doc") returned 4 [0194.545] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.545] lstrlenW (lpString=".docx") returned 5 [0194.545] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.545] lstrlenW (lpString=".pdf") returned 4 [0194.545] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.545] lstrlenW (lpString=".xls") returned 4 [0194.545] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.545] lstrlenW (lpString=".xlsx") returned 5 [0194.545] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.545] lstrlenW (lpString=".ppt") returned 4 [0194.545] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.545] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.545] lstrlenW (lpString=".zip") returned 4 [0194.546] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.546] lstrlenW (lpString=".rar") returned 4 [0194.546] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.546] lstrlenW (lpString=".bz2") returned 4 [0194.546] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.546] lstrlenW (lpString=".7z") returned 3 [0194.546] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.546] lstrlenW (lpString=".dbf") returned 4 [0194.546] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.546] lstrlenW (lpString=".1cd") returned 4 [0194.546] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.546] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\hu\\messages.json") returned 153 [0194.546] lstrlenW (lpString=".jpg") returned 4 [0194.546] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.546] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.546] lstrlenW (lpString="messages.json") returned 13 [0194.546] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.547] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.547] CloseHandle (hObject=0x150) returned 1 [0194.547] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 0x2020 [0194.547] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.547] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.547] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.547] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.547] GetLastError () returned 0x0 [0194.547] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.548] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.549] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.549] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.550] SetEndOfFile (hFile=0x15c) returned 1 [0194.550] CloseHandle (hObject=0x15c) returned 1 [0194.550] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.550] SetEndOfFile (hFile=0x150) returned 1 [0194.550] CloseHandle (hObject=0x150) returned 1 [0194.550] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.551] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json")) returned 1 [0194.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.551] lstrlenW (lpString=".doc") returned 4 [0194.551] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.551] lstrlenW (lpString=".docx") returned 5 [0194.551] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.551] lstrlenW (lpString=".pdf") returned 4 [0194.551] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.551] lstrlenW (lpString=".xls") returned 4 [0194.551] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.551] lstrlenW (lpString=".xlsx") returned 5 [0194.551] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.551] lstrlenW (lpString=".ppt") returned 4 [0194.551] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.551] lstrlenW (lpString=".zip") returned 4 [0194.551] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.551] lstrlenW (lpString=".rar") returned 4 [0194.551] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.551] lstrlenW (lpString=".bz2") returned 4 [0194.551] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.551] lstrlenW (lpString=".7z") returned 3 [0194.552] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.552] lstrlenW (lpString=".dbf") returned 4 [0194.552] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.552] lstrlenW (lpString=".1cd") returned 4 [0194.552] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.552] lstrlenW (lpString=".jpg") returned 4 [0194.552] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.552] lstrlenW (lpString=".doc") returned 4 [0194.552] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.552] lstrlenW (lpString=".docx") returned 5 [0194.552] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.552] lstrlenW (lpString=".pdf") returned 4 [0194.552] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.552] lstrlenW (lpString=".xls") returned 4 [0194.552] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.552] lstrlenW (lpString=".xlsx") returned 5 [0194.552] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.552] lstrlenW (lpString=".ppt") returned 4 [0194.552] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.552] lstrlenW (lpString=".zip") returned 4 [0194.552] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.552] lstrlenW (lpString=".rar") returned 4 [0194.552] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.552] lstrlenW (lpString=".bz2") returned 4 [0194.553] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.553] lstrlenW (lpString=".7z") returned 3 [0194.553] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.553] lstrlenW (lpString=".dbf") returned 4 [0194.553] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.553] lstrlenW (lpString=".1cd") returned 4 [0194.553] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\id\\messages.json") returned 153 [0194.553] lstrlenW (lpString=".jpg") returned 4 [0194.553] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.553] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.553] lstrlenW (lpString="messages.json") returned 13 [0194.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.591] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.591] CloseHandle (hObject=0x150) returned 1 [0194.591] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 0x2020 [0194.591] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.591] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.591] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.591] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.592] GetLastError () returned 0x0 [0194.592] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.593] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.593] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.594] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.594] SetEndOfFile (hFile=0x15c) returned 1 [0194.594] CloseHandle (hObject=0x15c) returned 1 [0194.594] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.594] SetEndOfFile (hFile=0x150) returned 1 [0194.595] CloseHandle (hObject=0x150) returned 1 [0194.595] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.595] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json")) returned 1 [0194.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.595] lstrlenW (lpString=".doc") returned 4 [0194.595] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.595] lstrlenW (lpString=".docx") returned 5 [0194.595] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.595] lstrlenW (lpString=".pdf") returned 4 [0194.595] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.595] lstrlenW (lpString=".xls") returned 4 [0194.595] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.595] lstrlenW (lpString=".xlsx") returned 5 [0194.595] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.595] lstrlenW (lpString=".ppt") returned 4 [0194.595] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.595] lstrlenW (lpString=".zip") returned 4 [0194.595] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.596] lstrlenW (lpString=".rar") returned 4 [0194.596] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.596] lstrlenW (lpString=".bz2") returned 4 [0194.596] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.596] lstrlenW (lpString=".7z") returned 3 [0194.596] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.596] lstrlenW (lpString=".dbf") returned 4 [0194.596] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.596] lstrlenW (lpString=".1cd") returned 4 [0194.596] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.596] lstrlenW (lpString=".jpg") returned 4 [0194.596] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.596] lstrlenW (lpString=".doc") returned 4 [0194.596] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.596] lstrlenW (lpString=".docx") returned 5 [0194.596] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.596] lstrlenW (lpString=".pdf") returned 4 [0194.596] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.596] lstrlenW (lpString=".xls") returned 4 [0194.596] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.596] lstrlenW (lpString=".xlsx") returned 5 [0194.596] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.596] lstrlenW (lpString=".ppt") returned 4 [0194.596] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.596] lstrlenW (lpString=".zip") returned 4 [0194.597] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.597] lstrlenW (lpString=".rar") returned 4 [0194.597] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.597] lstrlenW (lpString=".bz2") returned 4 [0194.597] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.597] lstrlenW (lpString=".7z") returned 3 [0194.597] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.597] lstrlenW (lpString=".dbf") returned 4 [0194.597] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.597] lstrlenW (lpString=".1cd") returned 4 [0194.597] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\it\\messages.json") returned 153 [0194.597] lstrlenW (lpString=".jpg") returned 4 [0194.597] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.597] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.597] lstrlenW (lpString="messages.json") returned 13 [0194.597] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.598] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=159) returned 1 [0194.598] CloseHandle (hObject=0x150) returned 1 [0194.598] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 0x2020 [0194.598] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.598] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.598] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.599] GetLastError () returned 0x0 [0194.599] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x9f, lpOverlapped=0x0) returned 1 [0194.599] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0194.600] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.600] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.601] SetEndOfFile (hFile=0x15c) returned 1 [0194.601] CloseHandle (hObject=0x15c) returned 1 [0194.601] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.601] SetEndOfFile (hFile=0x150) returned 1 [0194.602] CloseHandle (hObject=0x150) returned 1 [0194.602] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.602] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json")) returned 1 [0194.602] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.602] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.602] lstrlenW (lpString=".doc") returned 4 [0194.602] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.602] lstrlenW (lpString=".docx") returned 5 [0194.602] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.602] lstrlenW (lpString=".pdf") returned 4 [0194.602] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.602] lstrlenW (lpString=".xls") returned 4 [0194.602] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.602] lstrlenW (lpString=".xlsx") returned 5 [0194.602] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.602] lstrlenW (lpString=".ppt") returned 4 [0194.602] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.602] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.602] lstrlenW (lpString=".zip") returned 4 [0194.602] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.602] lstrlenW (lpString=".rar") returned 4 [0194.602] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.603] lstrlenW (lpString=".bz2") returned 4 [0194.603] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.603] lstrlenW (lpString=".7z") returned 3 [0194.603] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.603] lstrlenW (lpString=".dbf") returned 4 [0194.603] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.603] lstrlenW (lpString=".1cd") returned 4 [0194.603] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.603] lstrlenW (lpString=".jpg") returned 4 [0194.603] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.603] lstrlenW (lpString=".doc") returned 4 [0194.603] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.603] lstrlenW (lpString=".docx") returned 5 [0194.603] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.603] lstrlenW (lpString=".pdf") returned 4 [0194.603] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.603] lstrlenW (lpString=".xls") returned 4 [0194.603] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.603] lstrlenW (lpString=".xlsx") returned 5 [0194.603] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.603] lstrlenW (lpString=".ppt") returned 4 [0194.603] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.603] lstrlenW (lpString=".zip") returned 4 [0194.603] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.603] lstrlenW (lpString=".rar") returned 4 [0194.603] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.604] lstrlenW (lpString=".bz2") returned 4 [0194.604] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.604] lstrlenW (lpString=".7z") returned 3 [0194.604] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.604] lstrlenW (lpString=".dbf") returned 4 [0194.604] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.604] lstrlenW (lpString=".1cd") returned 4 [0194.604] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\no\\messages.json") returned 153 [0194.604] lstrlenW (lpString=".jpg") returned 4 [0194.604] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.604] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.604] lstrlenW (lpString="messages.json") returned 13 [0194.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.604] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.605] CloseHandle (hObject=0x150) returned 1 [0194.605] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 0x2020 [0194.605] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.605] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.605] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.605] GetLastError () returned 0x0 [0194.605] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.606] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.607] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.607] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.607] SetEndOfFile (hFile=0x15c) returned 1 [0194.608] CloseHandle (hObject=0x15c) returned 1 [0194.608] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.608] SetEndOfFile (hFile=0x150) returned 1 [0194.608] CloseHandle (hObject=0x150) returned 1 [0194.608] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.609] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json")) returned 1 [0194.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.609] lstrlenW (lpString=".doc") returned 4 [0194.609] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.609] lstrlenW (lpString=".docx") returned 5 [0194.609] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.609] lstrlenW (lpString=".pdf") returned 4 [0194.609] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.609] lstrlenW (lpString=".xls") returned 4 [0194.609] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.609] lstrlenW (lpString=".xlsx") returned 5 [0194.609] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.609] lstrlenW (lpString=".ppt") returned 4 [0194.609] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.609] lstrlenW (lpString=".zip") returned 4 [0194.609] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.609] lstrlenW (lpString=".rar") returned 4 [0194.609] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.609] lstrlenW (lpString=".bz2") returned 4 [0194.609] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.609] lstrlenW (lpString=".7z") returned 3 [0194.609] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.610] lstrlenW (lpString=".dbf") returned 4 [0194.610] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.610] lstrlenW (lpString=".1cd") returned 4 [0194.610] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.610] lstrlenW (lpString=".jpg") returned 4 [0194.610] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.610] lstrlenW (lpString=".doc") returned 4 [0194.610] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.610] lstrlenW (lpString=".docx") returned 5 [0194.610] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.610] lstrlenW (lpString=".pdf") returned 4 [0194.610] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.610] lstrlenW (lpString=".xls") returned 4 [0194.610] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.610] lstrlenW (lpString=".xlsx") returned 5 [0194.610] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.610] lstrlenW (lpString=".ppt") returned 4 [0194.610] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.610] lstrlenW (lpString=".zip") returned 4 [0194.610] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.610] lstrlenW (lpString=".rar") returned 4 [0194.610] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.610] lstrlenW (lpString=".bz2") returned 4 [0194.610] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.610] lstrlenW (lpString=".7z") returned 3 [0194.611] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.611] lstrlenW (lpString=".dbf") returned 4 [0194.611] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.611] lstrlenW (lpString=".1cd") returned 4 [0194.611] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pl\\messages.json") returned 153 [0194.611] lstrlenW (lpString=".jpg") returned 4 [0194.611] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.611] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.611] lstrlenW (lpString="messages.json") returned 13 [0194.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.613] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.613] CloseHandle (hObject=0x150) returned 1 [0194.613] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0194.613] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.614] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.614] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.614] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.614] GetLastError () returned 0x0 [0194.614] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.615] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.616] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.616] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.616] SetEndOfFile (hFile=0x15c) returned 1 [0194.616] CloseHandle (hObject=0x15c) returned 1 [0194.616] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.616] SetEndOfFile (hFile=0x150) returned 1 [0194.617] CloseHandle (hObject=0x150) returned 1 [0194.617] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.617] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_br\\messages.json")) returned 1 [0194.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.617] lstrlenW (lpString=".doc") returned 4 [0194.617] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.617] lstrlenW (lpString=".docx") returned 5 [0194.618] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.618] lstrlenW (lpString=".pdf") returned 4 [0194.618] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.618] lstrlenW (lpString=".xls") returned 4 [0194.618] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.618] lstrlenW (lpString=".xlsx") returned 5 [0194.618] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.618] lstrlenW (lpString=".ppt") returned 4 [0194.618] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.618] lstrlenW (lpString=".zip") returned 4 [0194.618] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.618] lstrlenW (lpString=".rar") returned 4 [0194.618] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.618] lstrlenW (lpString=".bz2") returned 4 [0194.618] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.618] lstrlenW (lpString=".7z") returned 3 [0194.618] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.618] lstrlenW (lpString=".dbf") returned 4 [0194.618] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.618] lstrlenW (lpString=".1cd") returned 4 [0194.618] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.618] lstrlenW (lpString=".jpg") returned 4 [0194.618] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.618] lstrlenW (lpString=".doc") returned 4 [0194.618] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.618] lstrlenW (lpString=".docx") returned 5 [0194.619] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.619] lstrlenW (lpString=".pdf") returned 4 [0194.619] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.619] lstrlenW (lpString=".xls") returned 4 [0194.619] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.619] lstrlenW (lpString=".xlsx") returned 5 [0194.619] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.619] lstrlenW (lpString=".ppt") returned 4 [0194.619] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.619] lstrlenW (lpString=".zip") returned 4 [0194.619] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.619] lstrlenW (lpString=".rar") returned 4 [0194.619] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.619] lstrlenW (lpString=".bz2") returned 4 [0194.619] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.619] lstrlenW (lpString=".7z") returned 3 [0194.619] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.619] lstrlenW (lpString=".dbf") returned 4 [0194.619] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.619] lstrlenW (lpString=".1cd") returned 4 [0194.619] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_BR\\messages.json") returned 156 [0194.619] lstrlenW (lpString=".jpg") returned 4 [0194.619] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.619] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.620] lstrlenW (lpString="messages.json") returned 13 [0194.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.620] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.620] CloseHandle (hObject=0x150) returned 1 [0194.620] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0194.620] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.620] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.620] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.621] GetLastError () returned 0x0 [0194.621] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.622] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.623] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.623] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.623] SetEndOfFile (hFile=0x15c) returned 1 [0194.623] CloseHandle (hObject=0x15c) returned 1 [0194.623] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.623] SetEndOfFile (hFile=0x150) returned 1 [0194.624] CloseHandle (hObject=0x150) returned 1 [0194.624] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.624] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_pt\\messages.json")) returned 1 [0194.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.624] lstrlenW (lpString=".doc") returned 4 [0194.624] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.624] lstrlenW (lpString=".docx") returned 5 [0194.624] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.624] lstrlenW (lpString=".pdf") returned 4 [0194.624] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.624] lstrlenW (lpString=".xls") returned 4 [0194.624] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.624] lstrlenW (lpString=".xlsx") returned 5 [0194.624] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.624] lstrlenW (lpString=".ppt") returned 4 [0194.624] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.624] lstrlenW (lpString=".zip") returned 4 [0194.625] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.625] lstrlenW (lpString=".rar") returned 4 [0194.625] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.625] lstrlenW (lpString=".bz2") returned 4 [0194.625] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.625] lstrlenW (lpString=".7z") returned 3 [0194.625] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.625] lstrlenW (lpString=".dbf") returned 4 [0194.625] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.625] lstrlenW (lpString=".1cd") returned 4 [0194.625] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.625] lstrlenW (lpString=".jpg") returned 4 [0194.625] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.625] lstrlenW (lpString=".doc") returned 4 [0194.625] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.625] lstrlenW (lpString=".docx") returned 5 [0194.625] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.625] lstrlenW (lpString=".pdf") returned 4 [0194.625] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.625] lstrlenW (lpString=".xls") returned 4 [0194.625] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.625] lstrlenW (lpString=".xlsx") returned 5 [0194.625] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.625] lstrlenW (lpString=".ppt") returned 4 [0194.625] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.626] lstrlenW (lpString=".zip") returned 4 [0194.626] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.626] lstrlenW (lpString=".rar") returned 4 [0194.626] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.626] lstrlenW (lpString=".bz2") returned 4 [0194.626] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.626] lstrlenW (lpString=".7z") returned 3 [0194.626] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.626] lstrlenW (lpString=".dbf") returned 4 [0194.626] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.626] lstrlenW (lpString=".1cd") returned 4 [0194.626] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\pt_PT\\messages.json") returned 156 [0194.626] lstrlenW (lpString=".jpg") returned 4 [0194.626] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.626] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.626] lstrlenW (lpString="messages.json") returned 13 [0194.626] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.627] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.627] CloseHandle (hObject=0x150) returned 1 [0194.627] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 0x2020 [0194.627] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.627] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.627] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.627] GetLastError () returned 0x0 [0194.627] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.628] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.629] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.629] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.629] SetEndOfFile (hFile=0x15c) returned 1 [0194.630] CloseHandle (hObject=0x15c) returned 1 [0194.630] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.630] SetEndOfFile (hFile=0x150) returned 1 [0194.630] CloseHandle (hObject=0x150) returned 1 [0194.630] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.631] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json")) returned 1 [0194.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.631] lstrlenW (lpString=".doc") returned 4 [0194.631] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.631] lstrlenW (lpString=".docx") returned 5 [0194.631] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.631] lstrlenW (lpString=".pdf") returned 4 [0194.631] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.631] lstrlenW (lpString=".xls") returned 4 [0194.631] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.631] lstrlenW (lpString=".xlsx") returned 5 [0194.631] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.631] lstrlenW (lpString=".ppt") returned 4 [0194.631] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.631] lstrlenW (lpString=".zip") returned 4 [0194.631] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.631] lstrlenW (lpString=".rar") returned 4 [0194.631] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.631] lstrlenW (lpString=".bz2") returned 4 [0194.631] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.631] lstrlenW (lpString=".7z") returned 3 [0194.631] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.631] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.632] lstrlenW (lpString=".dbf") returned 4 [0194.632] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.632] lstrlenW (lpString=".1cd") returned 4 [0194.632] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.632] lstrlenW (lpString=".jpg") returned 4 [0194.632] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.632] lstrlenW (lpString=".doc") returned 4 [0194.632] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.632] lstrlenW (lpString=".docx") returned 5 [0194.632] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.632] lstrlenW (lpString=".pdf") returned 4 [0194.632] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.632] lstrlenW (lpString=".xls") returned 4 [0194.632] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.632] lstrlenW (lpString=".xlsx") returned 5 [0194.632] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.632] lstrlenW (lpString=".ppt") returned 4 [0194.632] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.632] lstrlenW (lpString=".zip") returned 4 [0194.632] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.632] lstrlenW (lpString=".rar") returned 4 [0194.632] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.632] lstrlenW (lpString=".bz2") returned 4 [0194.632] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.632] lstrlenW (lpString=".7z") returned 3 [0194.632] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.633] lstrlenW (lpString=".dbf") returned 4 [0194.633] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.633] lstrlenW (lpString=".1cd") returned 4 [0194.633] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ro\\messages.json") returned 153 [0194.633] lstrlenW (lpString=".jpg") returned 4 [0194.633] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.633] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.633] lstrlenW (lpString="messages.json") returned 13 [0194.633] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.633] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.633] CloseHandle (hObject=0x150) returned 1 [0194.633] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 0x2020 [0194.634] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.634] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.634] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.635] GetLastError () returned 0x0 [0194.635] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.636] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.637] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.637] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.637] SetEndOfFile (hFile=0x15c) returned 1 [0194.638] CloseHandle (hObject=0x15c) returned 1 [0194.638] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.638] SetEndOfFile (hFile=0x150) returned 1 [0194.639] CloseHandle (hObject=0x150) returned 1 [0194.639] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.639] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json")) returned 1 [0194.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.639] lstrlenW (lpString=".doc") returned 4 [0194.639] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.639] lstrlenW (lpString=".docx") returned 5 [0194.639] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.639] lstrlenW (lpString=".pdf") returned 4 [0194.639] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.639] lstrlenW (lpString=".xls") returned 4 [0194.639] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.639] lstrlenW (lpString=".xlsx") returned 5 [0194.639] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.639] lstrlenW (lpString=".ppt") returned 4 [0194.639] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.639] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.639] lstrlenW (lpString=".zip") returned 4 [0194.639] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.639] lstrlenW (lpString=".rar") returned 4 [0194.639] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.639] lstrlenW (lpString=".bz2") returned 4 [0194.640] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.640] lstrlenW (lpString=".7z") returned 3 [0194.640] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.640] lstrlenW (lpString=".dbf") returned 4 [0194.640] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.640] lstrlenW (lpString=".1cd") returned 4 [0194.640] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.640] lstrlenW (lpString=".jpg") returned 4 [0194.640] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.640] lstrlenW (lpString=".doc") returned 4 [0194.640] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.640] lstrlenW (lpString=".docx") returned 5 [0194.640] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.640] lstrlenW (lpString=".pdf") returned 4 [0194.640] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.640] lstrlenW (lpString=".xls") returned 4 [0194.640] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.640] lstrlenW (lpString=".xlsx") returned 5 [0194.640] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.640] lstrlenW (lpString=".ppt") returned 4 [0194.640] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.640] lstrlenW (lpString=".zip") returned 4 [0194.640] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.640] lstrlenW (lpString=".rar") returned 4 [0194.640] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.641] lstrlenW (lpString=".bz2") returned 4 [0194.641] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.641] lstrlenW (lpString=".7z") returned 3 [0194.641] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.641] lstrlenW (lpString=".dbf") returned 4 [0194.641] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.641] lstrlenW (lpString=".1cd") returned 4 [0194.641] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\ru\\messages.json") returned 153 [0194.641] lstrlenW (lpString=".jpg") returned 4 [0194.641] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.641] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.641] lstrlenW (lpString="messages.json") returned 13 [0194.641] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.641] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.642] CloseHandle (hObject=0x150) returned 1 [0194.642] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 0x2020 [0194.642] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.642] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.642] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.642] GetLastError () returned 0x0 [0194.642] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.643] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.644] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.644] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.644] SetEndOfFile (hFile=0x15c) returned 1 [0194.644] CloseHandle (hObject=0x15c) returned 1 [0194.645] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.645] SetEndOfFile (hFile=0x150) returned 1 [0194.645] CloseHandle (hObject=0x150) returned 1 [0194.645] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.646] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json")) returned 1 [0194.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.646] lstrlenW (lpString=".doc") returned 4 [0194.646] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.646] lstrlenW (lpString=".docx") returned 5 [0194.646] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.646] lstrlenW (lpString=".pdf") returned 4 [0194.646] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.646] lstrlenW (lpString=".xls") returned 4 [0194.646] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.646] lstrlenW (lpString=".xlsx") returned 5 [0194.646] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.646] lstrlenW (lpString=".ppt") returned 4 [0194.646] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.646] lstrlenW (lpString=".zip") returned 4 [0194.646] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.646] lstrlenW (lpString=".rar") returned 4 [0194.646] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.646] lstrlenW (lpString=".bz2") returned 4 [0194.646] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.646] lstrlenW (lpString=".7z") returned 3 [0194.646] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.647] lstrlenW (lpString=".dbf") returned 4 [0194.647] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.647] lstrlenW (lpString=".1cd") returned 4 [0194.647] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.647] lstrlenW (lpString=".jpg") returned 4 [0194.647] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.647] lstrlenW (lpString=".doc") returned 4 [0194.647] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.647] lstrlenW (lpString=".docx") returned 5 [0194.647] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.647] lstrlenW (lpString=".pdf") returned 4 [0194.647] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.647] lstrlenW (lpString=".xls") returned 4 [0194.647] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.647] lstrlenW (lpString=".xlsx") returned 5 [0194.647] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.647] lstrlenW (lpString=".ppt") returned 4 [0194.647] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.647] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.647] lstrlenW (lpString=".zip") returned 4 [0194.647] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.647] lstrlenW (lpString=".rar") returned 4 [0194.647] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.647] lstrlenW (lpString=".bz2") returned 4 [0194.647] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.647] lstrlenW (lpString=".7z") returned 3 [0194.648] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.648] lstrlenW (lpString=".dbf") returned 4 [0194.648] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.648] lstrlenW (lpString=".1cd") returned 4 [0194.648] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.648] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sk\\messages.json") returned 153 [0194.648] lstrlenW (lpString=".jpg") returned 4 [0194.648] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.648] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.648] lstrlenW (lpString="messages.json") returned 13 [0194.648] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.648] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.648] CloseHandle (hObject=0x150) returned 1 [0194.649] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 0x2020 [0194.649] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.649] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.649] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.649] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.649] GetLastError () returned 0x0 [0194.649] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.650] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.651] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.651] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.651] SetEndOfFile (hFile=0x15c) returned 1 [0194.652] CloseHandle (hObject=0x15c) returned 1 [0194.652] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.652] SetEndOfFile (hFile=0x150) returned 1 [0194.652] CloseHandle (hObject=0x150) returned 1 [0194.653] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.653] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json")) returned 1 [0194.653] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.654] lstrlenW (lpString=".doc") returned 4 [0194.654] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.654] lstrlenW (lpString=".docx") returned 5 [0194.654] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.654] lstrlenW (lpString=".pdf") returned 4 [0194.654] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.654] lstrlenW (lpString=".xls") returned 4 [0194.654] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.654] lstrlenW (lpString=".xlsx") returned 5 [0194.654] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.654] lstrlenW (lpString=".ppt") returned 4 [0194.654] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.654] lstrlenW (lpString=".zip") returned 4 [0194.654] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.654] lstrlenW (lpString=".rar") returned 4 [0194.654] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.654] lstrlenW (lpString=".bz2") returned 4 [0194.654] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.654] lstrlenW (lpString=".7z") returned 3 [0194.654] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.654] lstrlenW (lpString=".dbf") returned 4 [0194.654] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.654] lstrlenW (lpString=".1cd") returned 4 [0194.654] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.654] lstrlenW (lpString=".jpg") returned 4 [0194.655] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.655] lstrlenW (lpString=".doc") returned 4 [0194.655] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.655] lstrlenW (lpString=".docx") returned 5 [0194.655] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.655] lstrlenW (lpString=".pdf") returned 4 [0194.655] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.655] lstrlenW (lpString=".xls") returned 4 [0194.655] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.655] lstrlenW (lpString=".xlsx") returned 5 [0194.655] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.655] lstrlenW (lpString=".ppt") returned 4 [0194.655] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.655] lstrlenW (lpString=".zip") returned 4 [0194.655] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.655] lstrlenW (lpString=".rar") returned 4 [0194.655] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.655] lstrlenW (lpString=".bz2") returned 4 [0194.655] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.655] lstrlenW (lpString=".7z") returned 3 [0194.655] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.655] lstrlenW (lpString=".dbf") returned 4 [0194.655] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.655] lstrlenW (lpString=".1cd") returned 4 [0194.656] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sl\\messages.json") returned 153 [0194.656] lstrlenW (lpString=".jpg") returned 4 [0194.656] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.656] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.656] lstrlenW (lpString="messages.json") returned 13 [0194.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.656] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.656] CloseHandle (hObject=0x150) returned 1 [0194.656] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 0x2020 [0194.656] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.657] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.657] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.657] GetLastError () returned 0x0 [0194.657] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.658] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.659] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.659] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.659] SetEndOfFile (hFile=0x15c) returned 1 [0194.659] CloseHandle (hObject=0x15c) returned 1 [0194.659] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.660] SetEndOfFile (hFile=0x150) returned 1 [0194.660] CloseHandle (hObject=0x150) returned 1 [0194.660] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.661] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json")) returned 1 [0194.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.661] lstrlenW (lpString=".doc") returned 4 [0194.661] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.661] lstrlenW (lpString=".docx") returned 5 [0194.661] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.661] lstrlenW (lpString=".pdf") returned 4 [0194.661] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.661] lstrlenW (lpString=".xls") returned 4 [0194.661] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.661] lstrlenW (lpString=".xlsx") returned 5 [0194.661] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.661] lstrlenW (lpString=".ppt") returned 4 [0194.661] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.661] lstrlenW (lpString=".zip") returned 4 [0194.661] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.661] lstrlenW (lpString=".rar") returned 4 [0194.661] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.661] lstrlenW (lpString=".bz2") returned 4 [0194.661] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.661] lstrlenW (lpString=".7z") returned 3 [0194.661] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.661] lstrlenW (lpString=".dbf") returned 4 [0194.662] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.662] lstrlenW (lpString=".1cd") returned 4 [0194.662] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.662] lstrlenW (lpString=".jpg") returned 4 [0194.662] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.662] lstrlenW (lpString=".doc") returned 4 [0194.662] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.662] lstrlenW (lpString=".docx") returned 5 [0194.662] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.662] lstrlenW (lpString=".pdf") returned 4 [0194.662] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.662] lstrlenW (lpString=".xls") returned 4 [0194.662] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.662] lstrlenW (lpString=".xlsx") returned 5 [0194.662] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.662] lstrlenW (lpString=".ppt") returned 4 [0194.662] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.662] lstrlenW (lpString=".zip") returned 4 [0194.662] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.662] lstrlenW (lpString=".rar") returned 4 [0194.662] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.662] lstrlenW (lpString=".bz2") returned 4 [0194.662] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.662] lstrlenW (lpString=".7z") returned 3 [0194.662] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.663] lstrlenW (lpString=".dbf") returned 4 [0194.663] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.663] lstrlenW (lpString=".1cd") returned 4 [0194.663] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sr\\messages.json") returned 153 [0194.663] lstrlenW (lpString=".jpg") returned 4 [0194.663] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.663] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.663] lstrlenW (lpString="messages.json") returned 13 [0194.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.663] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.664] CloseHandle (hObject=0x150) returned 1 [0194.664] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 0x2020 [0194.664] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.664] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.664] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.664] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.664] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.664] GetLastError () returned 0x0 [0194.664] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.665] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.667] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.667] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.667] SetEndOfFile (hFile=0x15c) returned 1 [0194.667] CloseHandle (hObject=0x15c) returned 1 [0194.667] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.667] SetEndOfFile (hFile=0x150) returned 1 [0194.668] CloseHandle (hObject=0x150) returned 1 [0194.668] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.668] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json")) returned 1 [0194.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.668] lstrlenW (lpString=".doc") returned 4 [0194.668] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.668] lstrlenW (lpString=".docx") returned 5 [0194.668] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.669] lstrlenW (lpString=".pdf") returned 4 [0194.669] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.669] lstrlenW (lpString=".xls") returned 4 [0194.669] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.669] lstrlenW (lpString=".xlsx") returned 5 [0194.669] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.669] lstrlenW (lpString=".ppt") returned 4 [0194.669] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.669] lstrlenW (lpString=".zip") returned 4 [0194.669] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.669] lstrlenW (lpString=".rar") returned 4 [0194.669] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.669] lstrlenW (lpString=".bz2") returned 4 [0194.669] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.669] lstrlenW (lpString=".7z") returned 3 [0194.669] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.669] lstrlenW (lpString=".dbf") returned 4 [0194.669] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.669] lstrlenW (lpString=".1cd") returned 4 [0194.670] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.670] lstrlenW (lpString=".jpg") returned 4 [0194.670] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.670] lstrlenW (lpString=".doc") returned 4 [0194.670] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.670] lstrlenW (lpString=".docx") returned 5 [0194.670] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.670] lstrlenW (lpString=".pdf") returned 4 [0194.670] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.670] lstrlenW (lpString=".xls") returned 4 [0194.670] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.670] lstrlenW (lpString=".xlsx") returned 5 [0194.670] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.670] lstrlenW (lpString=".ppt") returned 4 [0194.670] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.670] lstrlenW (lpString=".zip") returned 4 [0194.670] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.670] lstrlenW (lpString=".rar") returned 4 [0194.670] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.670] lstrlenW (lpString=".bz2") returned 4 [0194.670] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.670] lstrlenW (lpString=".7z") returned 3 [0194.670] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.671] lstrlenW (lpString=".dbf") returned 4 [0194.671] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.671] lstrlenW (lpString=".1cd") returned 4 [0194.671] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\sv\\messages.json") returned 153 [0194.671] lstrlenW (lpString=".jpg") returned 4 [0194.671] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.671] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.671] lstrlenW (lpString="messages.json") returned 13 [0194.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.672] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.672] CloseHandle (hObject=0x150) returned 1 [0194.672] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 0x2020 [0194.672] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.672] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.672] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.673] GetLastError () returned 0x0 [0194.673] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.674] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.675] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.675] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.675] SetEndOfFile (hFile=0x15c) returned 1 [0194.675] CloseHandle (hObject=0x15c) returned 1 [0194.675] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.675] SetEndOfFile (hFile=0x150) returned 1 [0194.676] CloseHandle (hObject=0x150) returned 1 [0194.676] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.676] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json")) returned 1 [0194.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.677] lstrlenW (lpString=".doc") returned 4 [0194.677] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.677] lstrlenW (lpString=".docx") returned 5 [0194.677] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.677] lstrlenW (lpString=".pdf") returned 4 [0194.677] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.677] lstrlenW (lpString=".xls") returned 4 [0194.677] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.677] lstrlenW (lpString=".xlsx") returned 5 [0194.677] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.677] lstrlenW (lpString=".ppt") returned 4 [0194.677] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.677] lstrlenW (lpString=".zip") returned 4 [0194.677] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.677] lstrlenW (lpString=".rar") returned 4 [0194.677] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.677] lstrlenW (lpString=".bz2") returned 4 [0194.677] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.677] lstrlenW (lpString=".7z") returned 3 [0194.677] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.677] lstrlenW (lpString=".dbf") returned 4 [0194.677] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.677] lstrlenW (lpString=".1cd") returned 4 [0194.677] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.677] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.677] lstrlenW (lpString=".jpg") returned 4 [0194.678] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.678] lstrlenW (lpString=".doc") returned 4 [0194.678] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.678] lstrlenW (lpString=".docx") returned 5 [0194.678] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.678] lstrlenW (lpString=".pdf") returned 4 [0194.678] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.678] lstrlenW (lpString=".xls") returned 4 [0194.678] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.678] lstrlenW (lpString=".xlsx") returned 5 [0194.678] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.678] lstrlenW (lpString=".ppt") returned 4 [0194.678] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.678] lstrlenW (lpString=".zip") returned 4 [0194.678] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.678] lstrlenW (lpString=".rar") returned 4 [0194.678] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.678] lstrlenW (lpString=".bz2") returned 4 [0194.678] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.678] lstrlenW (lpString=".7z") returned 3 [0194.678] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.678] lstrlenW (lpString=".dbf") returned 4 [0194.678] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.678] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.679] lstrlenW (lpString=".1cd") returned 4 [0194.679] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.679] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\th\\messages.json") returned 153 [0194.679] lstrlenW (lpString=".jpg") returned 4 [0194.679] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.679] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.679] lstrlenW (lpString="messages.json") returned 13 [0194.679] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.679] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.679] CloseHandle (hObject=0x150) returned 1 [0194.680] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 0x2020 [0194.680] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.680] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.680] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.680] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.680] GetLastError () returned 0x0 [0194.680] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.681] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.682] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.682] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.682] SetEndOfFile (hFile=0x15c) returned 1 [0194.683] CloseHandle (hObject=0x15c) returned 1 [0194.683] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.683] SetEndOfFile (hFile=0x150) returned 1 [0194.683] CloseHandle (hObject=0x150) returned 1 [0194.684] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.684] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json")) returned 1 [0194.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.684] lstrlenW (lpString=".doc") returned 4 [0194.684] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.684] lstrlenW (lpString=".docx") returned 5 [0194.684] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.684] lstrlenW (lpString=".pdf") returned 4 [0194.684] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.684] lstrlenW (lpString=".xls") returned 4 [0194.684] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.684] lstrlenW (lpString=".xlsx") returned 5 [0194.684] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.684] lstrlenW (lpString=".ppt") returned 4 [0194.684] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.685] lstrlenW (lpString=".zip") returned 4 [0194.685] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.685] lstrlenW (lpString=".rar") returned 4 [0194.685] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.685] lstrlenW (lpString=".bz2") returned 4 [0194.685] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.685] lstrlenW (lpString=".7z") returned 3 [0194.685] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.685] lstrlenW (lpString=".dbf") returned 4 [0194.685] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.685] lstrlenW (lpString=".1cd") returned 4 [0194.685] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.685] lstrlenW (lpString=".jpg") returned 4 [0194.685] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.685] lstrlenW (lpString=".doc") returned 4 [0194.685] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.685] lstrlenW (lpString=".docx") returned 5 [0194.685] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.685] lstrlenW (lpString=".pdf") returned 4 [0194.685] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.685] lstrlenW (lpString=".xls") returned 4 [0194.685] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.685] lstrlenW (lpString=".xlsx") returned 5 [0194.685] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.685] lstrlenW (lpString=".ppt") returned 4 [0194.686] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.686] lstrlenW (lpString=".zip") returned 4 [0194.686] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.686] lstrlenW (lpString=".rar") returned 4 [0194.686] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.686] lstrlenW (lpString=".bz2") returned 4 [0194.686] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.686] lstrlenW (lpString=".7z") returned 3 [0194.686] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.686] lstrlenW (lpString=".dbf") returned 4 [0194.686] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.686] lstrlenW (lpString=".1cd") returned 4 [0194.686] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\tr\\messages.json") returned 153 [0194.686] lstrlenW (lpString=".jpg") returned 4 [0194.686] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.686] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.686] lstrlenW (lpString="messages.json") returned 13 [0194.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.687] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.687] CloseHandle (hObject=0x150) returned 1 [0194.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 0x2020 [0194.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.687] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.687] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.688] GetLastError () returned 0x0 [0194.688] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.689] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.690] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.690] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.690] SetEndOfFile (hFile=0x15c) returned 1 [0194.690] CloseHandle (hObject=0x15c) returned 1 [0194.690] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.690] SetEndOfFile (hFile=0x150) returned 1 [0194.691] CloseHandle (hObject=0x150) returned 1 [0194.691] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.691] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json")) returned 1 [0194.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.692] lstrlenW (lpString=".doc") returned 4 [0194.692] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.692] lstrlenW (lpString=".docx") returned 5 [0194.692] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.692] lstrlenW (lpString=".pdf") returned 4 [0194.692] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.692] lstrlenW (lpString=".xls") returned 4 [0194.692] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.692] lstrlenW (lpString=".xlsx") returned 5 [0194.692] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.692] lstrlenW (lpString=".ppt") returned 4 [0194.692] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.692] lstrlenW (lpString=".zip") returned 4 [0194.692] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.692] lstrlenW (lpString=".rar") returned 4 [0194.692] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.692] lstrlenW (lpString=".bz2") returned 4 [0194.692] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.692] lstrlenW (lpString=".7z") returned 3 [0194.692] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.692] lstrlenW (lpString=".dbf") returned 4 [0194.692] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.692] lstrlenW (lpString=".1cd") returned 4 [0194.692] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.692] lstrlenW (lpString=".jpg") returned 4 [0194.693] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.693] lstrlenW (lpString=".doc") returned 4 [0194.693] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.693] lstrlenW (lpString=".docx") returned 5 [0194.693] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.693] lstrlenW (lpString=".pdf") returned 4 [0194.693] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.693] lstrlenW (lpString=".xls") returned 4 [0194.693] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.693] lstrlenW (lpString=".xlsx") returned 5 [0194.693] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.693] lstrlenW (lpString=".ppt") returned 4 [0194.693] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.693] lstrlenW (lpString=".zip") returned 4 [0194.693] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.693] lstrlenW (lpString=".rar") returned 4 [0194.693] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.693] lstrlenW (lpString=".bz2") returned 4 [0194.693] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.693] lstrlenW (lpString=".7z") returned 3 [0194.693] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.693] lstrlenW (lpString=".dbf") returned 4 [0194.693] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.693] lstrlenW (lpString=".1cd") returned 4 [0194.693] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.693] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\uk\\messages.json") returned 153 [0194.694] lstrlenW (lpString=".jpg") returned 4 [0194.694] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.694] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.694] lstrlenW (lpString="messages.json") returned 13 [0194.694] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.694] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=179) returned 1 [0194.694] CloseHandle (hObject=0x150) returned 1 [0194.694] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 0x2020 [0194.694] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0194.695] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.695] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.695] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0194.695] GetLastError () returned 0x0 [0194.695] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb3, lpOverlapped=0x0) returned 1 [0194.696] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0194.697] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.697] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.697] SetEndOfFile (hFile=0x15c) returned 1 [0194.698] CloseHandle (hObject=0x15c) returned 1 [0194.698] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.698] SetEndOfFile (hFile=0x150) returned 1 [0194.698] CloseHandle (hObject=0x150) returned 1 [0194.698] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.699] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json")) returned 1 [0194.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.699] lstrlenW (lpString=".doc") returned 4 [0194.699] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.699] lstrlenW (lpString=".docx") returned 5 [0194.699] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.699] lstrlenW (lpString=".pdf") returned 4 [0194.699] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.699] lstrlenW (lpString=".xls") returned 4 [0194.699] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.699] lstrlenW (lpString=".xlsx") returned 5 [0194.699] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.699] lstrlenW (lpString=".ppt") returned 4 [0194.699] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.699] lstrlenW (lpString=".zip") returned 4 [0194.699] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.699] lstrlenW (lpString=".rar") returned 4 [0194.699] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.699] lstrlenW (lpString=".bz2") returned 4 [0194.699] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.700] lstrlenW (lpString=".7z") returned 3 [0194.700] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.700] lstrlenW (lpString=".dbf") returned 4 [0194.700] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.700] lstrlenW (lpString=".1cd") returned 4 [0194.805] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.805] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.836] lstrlenW (lpString=".jpg") returned 4 [0194.836] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.836] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.837] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.837] lstrlenW (lpString=".doc") returned 4 [0194.837] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.903] lstrlenW (lpString=".docx") returned 5 [0194.903] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.903] lstrlenW (lpString=".pdf") returned 4 [0194.903] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.903] lstrlenW (lpString=".xls") returned 4 [0194.903] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.903] lstrlenW (lpString=".xlsx") returned 5 [0194.903] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.903] lstrlenW (lpString=".ppt") returned 4 [0194.903] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.903] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.903] lstrlenW (lpString=".zip") returned 4 [0194.903] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.903] lstrlenW (lpString=".rar") returned 4 [0194.903] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.903] lstrlenW (lpString=".bz2") returned 4 [0194.903] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.903] lstrlenW (lpString=".7z") returned 3 [0194.903] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.904] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.904] lstrlenW (lpString=".dbf") returned 4 [0194.904] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.904] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.904] lstrlenW (lpString=".1cd") returned 4 [0194.904] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.904] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\blpcfgokakmgnkcojhhkbfbldkacnbeo\\4.2.8_0\\_locales\\vi\\messages.json") returned 153 [0194.904] lstrlenW (lpString=".jpg") returned 4 [0194.904] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.904] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.904] lstrlenW (lpString="messages.json") returned 13 [0194.904] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.904] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=229) returned 1 [0194.904] CloseHandle (hObject=0x120) returned 1 [0194.904] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json")) returned 0x2020 [0194.905] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.905] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.905] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.905] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.905] GetLastError () returned 0x0 [0194.905] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe5, lpOverlapped=0x0) returned 1 [0194.906] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0194.907] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.907] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.907] SetEndOfFile (hFile=0x388) returned 1 [0194.908] CloseHandle (hObject=0x388) returned 1 [0194.908] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.908] SetEndOfFile (hFile=0x120) returned 1 [0194.908] CloseHandle (hObject=0x120) returned 1 [0194.908] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.909] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json")) returned 1 [0194.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.909] lstrlenW (lpString=".doc") returned 4 [0194.909] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.909] lstrlenW (lpString=".docx") returned 5 [0194.909] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.909] lstrlenW (lpString=".pdf") returned 4 [0194.909] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.909] lstrlenW (lpString=".xls") returned 4 [0194.909] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.909] lstrlenW (lpString=".xlsx") returned 5 [0194.909] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.909] lstrlenW (lpString=".ppt") returned 4 [0194.909] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.909] lstrlenW (lpString=".zip") returned 4 [0194.909] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.909] lstrlenW (lpString=".rar") returned 4 [0194.909] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.909] lstrlenW (lpString=".bz2") returned 4 [0194.909] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.910] lstrlenW (lpString=".7z") returned 3 [0194.910] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.910] lstrlenW (lpString=".dbf") returned 4 [0194.910] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.910] lstrlenW (lpString=".1cd") returned 4 [0194.910] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.910] lstrlenW (lpString=".jpg") returned 4 [0194.910] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.910] lstrlenW (lpString=".doc") returned 4 [0194.910] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.910] lstrlenW (lpString=".docx") returned 5 [0194.910] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.910] lstrlenW (lpString=".pdf") returned 4 [0194.910] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.910] lstrlenW (lpString=".xls") returned 4 [0194.910] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.910] lstrlenW (lpString=".xlsx") returned 5 [0194.910] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.910] lstrlenW (lpString=".ppt") returned 4 [0194.910] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.910] lstrlenW (lpString=".zip") returned 4 [0194.910] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.910] lstrlenW (lpString=".rar") returned 4 [0194.910] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.910] lstrlenW (lpString=".bz2") returned 4 [0194.911] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.911] lstrlenW (lpString=".7z") returned 3 [0194.911] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.911] lstrlenW (lpString=".dbf") returned 4 [0194.911] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.911] lstrlenW (lpString=".1cd") returned 4 [0194.911] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es\\messages.json") returned 151 [0194.911] lstrlenW (lpString=".jpg") returned 4 [0194.911] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.911] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.911] lstrlenW (lpString="messages.json") returned 13 [0194.911] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.912] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=229) returned 1 [0194.912] CloseHandle (hObject=0x120) returned 1 [0194.912] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json")) returned 0x2020 [0194.912] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.912] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.912] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.912] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.913] GetLastError () returned 0x0 [0194.913] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe5, lpOverlapped=0x0) returned 1 [0194.914] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0194.914] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.915] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.915] SetEndOfFile (hFile=0x388) returned 1 [0194.915] CloseHandle (hObject=0x388) returned 1 [0194.915] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.915] SetEndOfFile (hFile=0x120) returned 1 [0194.916] CloseHandle (hObject=0x120) returned 1 [0194.916] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.916] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json")) returned 1 [0194.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.916] lstrlenW (lpString=".doc") returned 4 [0194.916] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.916] lstrlenW (lpString=".docx") returned 5 [0194.916] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.916] lstrlenW (lpString=".pdf") returned 4 [0194.916] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.916] lstrlenW (lpString=".xls") returned 4 [0194.916] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.916] lstrlenW (lpString=".xlsx") returned 5 [0194.916] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.916] lstrlenW (lpString=".ppt") returned 4 [0194.916] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.916] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.916] lstrlenW (lpString=".zip") returned 4 [0194.916] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.916] lstrlenW (lpString=".rar") returned 4 [0194.917] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.917] lstrlenW (lpString=".bz2") returned 4 [0194.917] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.917] lstrlenW (lpString=".7z") returned 3 [0194.917] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.917] lstrlenW (lpString=".dbf") returned 4 [0194.917] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.917] lstrlenW (lpString=".1cd") returned 4 [0194.917] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.917] lstrlenW (lpString=".jpg") returned 4 [0194.917] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.917] lstrlenW (lpString=".doc") returned 4 [0194.917] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.917] lstrlenW (lpString=".docx") returned 5 [0194.917] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.917] lstrlenW (lpString=".pdf") returned 4 [0194.917] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.917] lstrlenW (lpString=".xls") returned 4 [0194.917] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.917] lstrlenW (lpString=".xlsx") returned 5 [0194.917] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.917] lstrlenW (lpString=".ppt") returned 4 [0194.917] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.917] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.917] lstrlenW (lpString=".zip") returned 4 [0194.917] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.918] lstrlenW (lpString=".rar") returned 4 [0194.918] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.918] lstrlenW (lpString=".bz2") returned 4 [0194.918] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.918] lstrlenW (lpString=".7z") returned 3 [0194.918] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.918] lstrlenW (lpString=".dbf") returned 4 [0194.918] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.918] lstrlenW (lpString=".1cd") returned 4 [0194.918] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.918] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\es_419\\messages.json") returned 155 [0194.918] lstrlenW (lpString=".jpg") returned 4 [0194.918] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.918] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.918] lstrlenW (lpString="messages.json") returned 13 [0194.918] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.919] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=226) returned 1 [0194.919] CloseHandle (hObject=0x120) returned 1 [0194.919] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json")) returned 0x2020 [0194.919] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.919] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.919] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.919] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.920] GetLastError () returned 0x0 [0194.920] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe2, lpOverlapped=0x0) returned 1 [0194.921] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0194.921] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.921] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.922] SetEndOfFile (hFile=0x388) returned 1 [0194.922] CloseHandle (hObject=0x388) returned 1 [0194.922] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.922] SetEndOfFile (hFile=0x120) returned 1 [0194.923] CloseHandle (hObject=0x120) returned 1 [0194.923] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.923] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json")) returned 1 [0194.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.923] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.923] lstrlenW (lpString=".doc") returned 4 [0194.923] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.923] lstrlenW (lpString=".docx") returned 5 [0194.923] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.923] lstrlenW (lpString=".pdf") returned 4 [0194.923] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.923] lstrlenW (lpString=".xls") returned 4 [0194.923] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.924] lstrlenW (lpString=".xlsx") returned 5 [0194.924] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.924] lstrlenW (lpString=".ppt") returned 4 [0194.924] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.924] lstrlenW (lpString=".zip") returned 4 [0194.924] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.924] lstrlenW (lpString=".rar") returned 4 [0194.924] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.924] lstrlenW (lpString=".bz2") returned 4 [0194.924] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.924] lstrlenW (lpString=".7z") returned 3 [0194.924] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.924] lstrlenW (lpString=".dbf") returned 4 [0194.924] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.924] lstrlenW (lpString=".1cd") returned 4 [0194.924] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.924] lstrlenW (lpString=".jpg") returned 4 [0194.924] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.924] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.924] lstrlenW (lpString=".doc") returned 4 [0194.924] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.924] lstrlenW (lpString=".docx") returned 5 [0194.924] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.924] lstrlenW (lpString=".pdf") returned 4 [0194.925] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.925] lstrlenW (lpString=".xls") returned 4 [0194.925] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.925] lstrlenW (lpString=".xlsx") returned 5 [0194.925] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.925] lstrlenW (lpString=".ppt") returned 4 [0194.925] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.925] lstrlenW (lpString=".zip") returned 4 [0194.925] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.925] lstrlenW (lpString=".rar") returned 4 [0194.925] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.925] lstrlenW (lpString=".bz2") returned 4 [0194.925] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.925] lstrlenW (lpString=".7z") returned 3 [0194.925] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.925] lstrlenW (lpString=".dbf") returned 4 [0194.925] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.925] lstrlenW (lpString=".1cd") returned 4 [0194.925] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.925] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\et\\messages.json") returned 151 [0194.925] lstrlenW (lpString=".jpg") returned 4 [0194.925] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.925] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.925] lstrlenW (lpString="messages.json") returned 13 [0194.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.926] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=220) returned 1 [0194.926] CloseHandle (hObject=0x120) returned 1 [0194.926] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json")) returned 0x2020 [0194.926] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.926] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.926] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.927] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.927] GetLastError () returned 0x0 [0194.927] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xdc, lpOverlapped=0x0) returned 1 [0194.928] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0194.929] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0194.929] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0194.929] SetEndOfFile (hFile=0x388) returned 1 [0194.929] CloseHandle (hObject=0x388) returned 1 [0194.929] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.929] SetEndOfFile (hFile=0x120) returned 1 [0194.930] CloseHandle (hObject=0x120) returned 1 [0194.930] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0194.930] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json")) returned 1 [0194.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.931] lstrlenW (lpString=".doc") returned 4 [0194.931] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.931] lstrlenW (lpString=".docx") returned 5 [0194.931] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.931] lstrlenW (lpString=".pdf") returned 4 [0194.931] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.931] lstrlenW (lpString=".xls") returned 4 [0194.931] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.931] lstrlenW (lpString=".xlsx") returned 5 [0194.931] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.931] lstrlenW (lpString=".ppt") returned 4 [0194.931] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.931] lstrlenW (lpString=".zip") returned 4 [0194.931] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.931] lstrlenW (lpString=".rar") returned 4 [0194.931] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.931] lstrlenW (lpString=".bz2") returned 4 [0194.931] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.931] lstrlenW (lpString=".7z") returned 3 [0194.931] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.931] lstrlenW (lpString=".dbf") returned 4 [0194.931] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.931] lstrlenW (lpString=".1cd") returned 4 [0194.932] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.932] lstrlenW (lpString=".jpg") returned 4 [0194.932] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.932] lstrlenW (lpString=".doc") returned 4 [0194.932] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0194.932] lstrlenW (lpString=".docx") returned 5 [0194.932] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0194.932] lstrlenW (lpString=".pdf") returned 4 [0194.932] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0194.932] lstrlenW (lpString=".xls") returned 4 [0194.932] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0194.932] lstrlenW (lpString=".xlsx") returned 5 [0194.932] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0194.932] lstrlenW (lpString=".ppt") returned 4 [0194.932] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0194.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.932] lstrlenW (lpString=".zip") returned 4 [0194.932] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0194.932] lstrlenW (lpString=".rar") returned 4 [0194.932] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0194.932] lstrlenW (lpString=".bz2") returned 4 [0194.932] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0194.932] lstrlenW (lpString=".7z") returned 3 [0194.932] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0194.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.932] lstrlenW (lpString=".dbf") returned 4 [0194.933] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0194.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.933] lstrlenW (lpString=".1cd") returned 4 [0194.933] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0194.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fi\\messages.json") returned 151 [0194.933] lstrlenW (lpString=".jpg") returned 4 [0194.933] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0194.933] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0194.933] lstrlenW (lpString="messages.json") returned 13 [0194.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.933] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=223) returned 1 [0194.933] CloseHandle (hObject=0x120) returned 1 [0194.934] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json")) returned 0x2020 [0194.934] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0194.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0194.935] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.935] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0194.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0194.935] GetLastError () returned 0x0 [0194.935] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xdf, lpOverlapped=0x0) returned 1 [0195.132] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.133] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.133] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.133] SetEndOfFile (hFile=0x388) returned 1 [0195.133] CloseHandle (hObject=0x388) returned 1 [0195.133] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.133] SetEndOfFile (hFile=0x120) returned 1 [0195.134] CloseHandle (hObject=0x120) returned 1 [0195.134] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.134] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json")) returned 1 [0195.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.134] lstrlenW (lpString=".doc") returned 4 [0195.134] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.134] lstrlenW (lpString=".docx") returned 5 [0195.134] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.134] lstrlenW (lpString=".pdf") returned 4 [0195.134] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.134] lstrlenW (lpString=".xls") returned 4 [0195.134] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.134] lstrlenW (lpString=".xlsx") returned 5 [0195.135] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.135] lstrlenW (lpString=".ppt") returned 4 [0195.135] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.135] lstrlenW (lpString=".zip") returned 4 [0195.135] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.135] lstrlenW (lpString=".rar") returned 4 [0195.135] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.135] lstrlenW (lpString=".bz2") returned 4 [0195.135] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.135] lstrlenW (lpString=".7z") returned 3 [0195.135] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.135] lstrlenW (lpString=".dbf") returned 4 [0195.135] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.135] lstrlenW (lpString=".1cd") returned 4 [0195.135] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.135] lstrlenW (lpString=".jpg") returned 4 [0195.135] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.135] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.135] lstrlenW (lpString=".doc") returned 4 [0195.135] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.135] lstrlenW (lpString=".docx") returned 5 [0195.135] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.135] lstrlenW (lpString=".pdf") returned 4 [0195.135] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.135] lstrlenW (lpString=".xls") returned 4 [0195.136] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.136] lstrlenW (lpString=".xlsx") returned 5 [0195.136] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.136] lstrlenW (lpString=".ppt") returned 4 [0195.136] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.136] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.136] lstrlenW (lpString=".zip") returned 4 [0195.136] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.136] lstrlenW (lpString=".rar") returned 4 [0195.136] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.136] lstrlenW (lpString=".bz2") returned 4 [0195.136] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.136] lstrlenW (lpString=".7z") returned 3 [0195.136] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.136] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.136] lstrlenW (lpString=".dbf") returned 4 [0195.136] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.136] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.136] lstrlenW (lpString=".1cd") returned 4 [0195.136] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.136] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\fil\\messages.json") returned 152 [0195.136] lstrlenW (lpString=".jpg") returned 4 [0195.136] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.136] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.137] lstrlenW (lpString="messages.json") returned 13 [0195.137] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.138] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=225) returned 1 [0195.138] CloseHandle (hObject=0x120) returned 1 [0195.138] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 0x2020 [0195.138] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.138] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.138] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.138] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.140] GetLastError () returned 0x0 [0195.140] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe1, lpOverlapped=0x0) returned 1 [0195.141] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.141] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.141] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.142] SetEndOfFile (hFile=0x388) returned 1 [0195.142] CloseHandle (hObject=0x388) returned 1 [0195.142] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.142] SetEndOfFile (hFile=0x120) returned 1 [0195.143] CloseHandle (hObject=0x120) returned 1 [0195.143] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.143] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json")) returned 1 [0195.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.143] lstrlenW (lpString=".doc") returned 4 [0195.143] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.143] lstrlenW (lpString=".docx") returned 5 [0195.143] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.143] lstrlenW (lpString=".pdf") returned 4 [0195.143] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.143] lstrlenW (lpString=".xls") returned 4 [0195.143] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.143] lstrlenW (lpString=".xlsx") returned 5 [0195.143] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.143] lstrlenW (lpString=".ppt") returned 4 [0195.144] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.144] lstrlenW (lpString=".zip") returned 4 [0195.144] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.144] lstrlenW (lpString=".rar") returned 4 [0195.144] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.144] lstrlenW (lpString=".bz2") returned 4 [0195.144] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.144] lstrlenW (lpString=".7z") returned 3 [0195.144] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.144] lstrlenW (lpString=".dbf") returned 4 [0195.144] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.144] lstrlenW (lpString=".1cd") returned 4 [0195.144] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.144] lstrlenW (lpString=".jpg") returned 4 [0195.144] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.144] lstrlenW (lpString=".doc") returned 4 [0195.144] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.144] lstrlenW (lpString=".docx") returned 5 [0195.144] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.144] lstrlenW (lpString=".pdf") returned 4 [0195.144] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.144] lstrlenW (lpString=".xls") returned 4 [0195.144] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.144] lstrlenW (lpString=".xlsx") returned 5 [0195.144] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.145] lstrlenW (lpString=".ppt") returned 4 [0195.145] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.145] lstrlenW (lpString=".zip") returned 4 [0195.145] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.145] lstrlenW (lpString=".rar") returned 4 [0195.145] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.145] lstrlenW (lpString=".bz2") returned 4 [0195.145] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.145] lstrlenW (lpString=".7z") returned 3 [0195.145] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.145] lstrlenW (lpString=".dbf") returned 4 [0195.145] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.145] lstrlenW (lpString=".1cd") returned 4 [0195.145] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\tr\\messages.json") returned 151 [0195.145] lstrlenW (lpString=".jpg") returned 4 [0195.145] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.145] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.145] lstrlenW (lpString="messages.json") returned 13 [0195.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.146] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=254) returned 1 [0195.146] CloseHandle (hObject=0x120) returned 1 [0195.146] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 0x2020 [0195.146] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.146] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.146] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.147] GetLastError () returned 0x0 [0195.147] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xfe, lpOverlapped=0x0) returned 1 [0195.148] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0195.149] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.149] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.149] SetEndOfFile (hFile=0x388) returned 1 [0195.149] CloseHandle (hObject=0x388) returned 1 [0195.149] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.149] SetEndOfFile (hFile=0x120) returned 1 [0195.150] CloseHandle (hObject=0x120) returned 1 [0195.150] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.150] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json")) returned 1 [0195.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.150] lstrlenW (lpString=".doc") returned 4 [0195.151] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.151] lstrlenW (lpString=".docx") returned 5 [0195.151] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.151] lstrlenW (lpString=".pdf") returned 4 [0195.151] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.151] lstrlenW (lpString=".xls") returned 4 [0195.151] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.151] lstrlenW (lpString=".xlsx") returned 5 [0195.151] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.151] lstrlenW (lpString=".ppt") returned 4 [0195.151] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.151] lstrlenW (lpString=".zip") returned 4 [0195.151] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.151] lstrlenW (lpString=".rar") returned 4 [0195.151] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.151] lstrlenW (lpString=".bz2") returned 4 [0195.151] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.151] lstrlenW (lpString=".7z") returned 3 [0195.151] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.151] lstrlenW (lpString=".dbf") returned 4 [0195.151] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.151] lstrlenW (lpString=".1cd") returned 4 [0195.151] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.151] lstrlenW (lpString=".jpg") returned 4 [0195.151] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.151] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.152] lstrlenW (lpString=".doc") returned 4 [0195.152] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.152] lstrlenW (lpString=".docx") returned 5 [0195.152] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.152] lstrlenW (lpString=".pdf") returned 4 [0195.152] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.152] lstrlenW (lpString=".xls") returned 4 [0195.152] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.152] lstrlenW (lpString=".xlsx") returned 5 [0195.152] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.152] lstrlenW (lpString=".ppt") returned 4 [0195.152] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.152] lstrlenW (lpString=".zip") returned 4 [0195.152] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.152] lstrlenW (lpString=".rar") returned 4 [0195.152] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.152] lstrlenW (lpString=".bz2") returned 4 [0195.152] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.152] lstrlenW (lpString=".7z") returned 3 [0195.152] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.152] lstrlenW (lpString=".dbf") returned 4 [0195.152] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.153] lstrlenW (lpString=".1cd") returned 4 [0195.153] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\uk\\messages.json") returned 151 [0195.153] lstrlenW (lpString=".jpg") returned 4 [0195.153] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.153] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.153] lstrlenW (lpString="messages.json") returned 13 [0195.153] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.153] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=227) returned 1 [0195.153] CloseHandle (hObject=0x120) returned 1 [0195.154] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json")) returned 0x2020 [0195.154] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.154] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.154] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.154] GetLastError () returned 0x0 [0195.154] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe3, lpOverlapped=0x0) returned 1 [0195.155] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.156] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.156] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.156] SetEndOfFile (hFile=0x388) returned 1 [0195.157] CloseHandle (hObject=0x388) returned 1 [0195.157] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.157] SetEndOfFile (hFile=0x120) returned 1 [0195.157] CloseHandle (hObject=0x120) returned 1 [0195.158] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.158] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json")) returned 1 [0195.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.158] lstrlenW (lpString=".doc") returned 4 [0195.158] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.158] lstrlenW (lpString=".docx") returned 5 [0195.158] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.158] lstrlenW (lpString=".pdf") returned 4 [0195.158] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.158] lstrlenW (lpString=".xls") returned 4 [0195.158] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.158] lstrlenW (lpString=".xlsx") returned 5 [0195.158] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.158] lstrlenW (lpString=".ppt") returned 4 [0195.158] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.158] lstrlenW (lpString=".zip") returned 4 [0195.158] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.159] lstrlenW (lpString=".rar") returned 4 [0195.159] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.159] lstrlenW (lpString=".bz2") returned 4 [0195.159] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.159] lstrlenW (lpString=".7z") returned 3 [0195.159] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.159] lstrlenW (lpString=".dbf") returned 4 [0195.159] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.159] lstrlenW (lpString=".1cd") returned 4 [0195.159] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.159] lstrlenW (lpString=".jpg") returned 4 [0195.159] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.159] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.159] lstrlenW (lpString=".doc") returned 4 [0195.159] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.159] lstrlenW (lpString=".docx") returned 5 [0195.159] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.159] lstrlenW (lpString=".pdf") returned 4 [0195.159] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.159] lstrlenW (lpString=".xls") returned 4 [0195.159] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.159] lstrlenW (lpString=".xlsx") returned 5 [0195.159] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.159] lstrlenW (lpString=".ppt") returned 4 [0195.159] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.160] lstrlenW (lpString=".zip") returned 4 [0195.160] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.160] lstrlenW (lpString=".rar") returned 4 [0195.160] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.160] lstrlenW (lpString=".bz2") returned 4 [0195.160] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.160] lstrlenW (lpString=".7z") returned 3 [0195.160] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.160] lstrlenW (lpString=".dbf") returned 4 [0195.160] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.160] lstrlenW (lpString=".1cd") returned 4 [0195.160] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\vi\\messages.json") returned 151 [0195.160] lstrlenW (lpString=".jpg") returned 4 [0195.160] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.160] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.160] lstrlenW (lpString="messages.json") returned 13 [0195.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.161] GetFileSizeEx (in: hFile=0x120, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=212) returned 1 [0195.161] CloseHandle (hObject=0x120) returned 1 [0195.161] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0195.161] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x120 [0195.161] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.161] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.161] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.162] GetLastError () returned 0x0 [0195.162] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xd4, lpOverlapped=0x0) returned 1 [0195.163] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0195.164] ReadFile (in: hFile=0x120, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.164] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.164] SetEndOfFile (hFile=0x388) returned 1 [0195.164] CloseHandle (hObject=0x388) returned 1 [0195.164] SetFilePointerEx (in: hFile=0x120, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.164] SetEndOfFile (hFile=0x120) returned 1 [0195.165] CloseHandle (hObject=0x120) returned 1 [0195.165] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.165] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0195.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.166] lstrlenW (lpString=".doc") returned 4 [0195.166] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.166] lstrlenW (lpString=".docx") returned 5 [0195.166] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.166] lstrlenW (lpString=".pdf") returned 4 [0195.166] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.166] lstrlenW (lpString=".xls") returned 4 [0195.166] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.166] lstrlenW (lpString=".xlsx") returned 5 [0195.166] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.166] lstrlenW (lpString=".ppt") returned 4 [0195.166] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.166] lstrlenW (lpString=".zip") returned 4 [0195.166] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.166] lstrlenW (lpString=".rar") returned 4 [0195.166] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.166] lstrlenW (lpString=".bz2") returned 4 [0195.166] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.166] lstrlenW (lpString=".7z") returned 3 [0195.166] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.166] lstrlenW (lpString=".dbf") returned 4 [0195.167] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.167] lstrlenW (lpString=".1cd") returned 4 [0195.167] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.167] lstrlenW (lpString=".jpg") returned 4 [0195.167] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.167] lstrlenW (lpString=".doc") returned 4 [0195.167] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.167] lstrlenW (lpString=".docx") returned 5 [0195.167] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.167] lstrlenW (lpString=".pdf") returned 4 [0195.167] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.167] lstrlenW (lpString=".xls") returned 4 [0195.167] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.167] lstrlenW (lpString=".xlsx") returned 5 [0195.167] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.167] lstrlenW (lpString=".ppt") returned 4 [0195.167] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.167] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.167] lstrlenW (lpString=".zip") returned 4 [0195.167] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.167] lstrlenW (lpString=".rar") returned 4 [0195.167] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.167] lstrlenW (lpString=".bz2") returned 4 [0195.167] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.167] lstrlenW (lpString=".7z") returned 3 [0195.167] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.168] lstrlenW (lpString=".dbf") returned 4 [0195.168] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.168] lstrlenW (lpString=".1cd") returned 4 [0195.168] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\felcaaldnbdncclmgdcncolpebgiejap\\1.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0195.168] lstrlenW (lpString=".jpg") returned 4 [0195.284] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.301] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.301] lstrlenW (lpString="dasherSettingSchema.json") returned 24 [0195.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.310] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=854) returned 1 [0195.311] CloseHandle (hObject=0x35c) returned 1 [0195.311] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json")) returned 0x2020 [0195.311] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.311] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.311] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.312] GetLastError () returned 0x0 [0195.312] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x356, lpOverlapped=0x0) returned 1 [0195.313] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x360, lpOverlapped=0x0) returned 1 [0195.315] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.315] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x104, lpOverlapped=0x0) returned 1 [0195.315] SetEndOfFile (hFile=0x358) returned 1 [0195.315] CloseHandle (hObject=0x358) returned 1 [0195.315] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.315] SetEndOfFile (hFile=0x35c) returned 1 [0195.316] CloseHandle (hObject=0x35c) returned 1 [0195.316] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.316] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dashersettingschema.json")) returned 1 [0195.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.316] lstrlenW (lpString=".doc") returned 4 [0195.316] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.316] lstrlenW (lpString=".docx") returned 5 [0195.317] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.317] lstrlenW (lpString=".pdf") returned 4 [0195.317] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.317] lstrlenW (lpString=".xls") returned 4 [0195.317] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.317] lstrlenW (lpString=".xlsx") returned 5 [0195.317] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.317] lstrlenW (lpString=".ppt") returned 4 [0195.317] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.317] lstrlenW (lpString=".zip") returned 4 [0195.317] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.317] lstrlenW (lpString=".rar") returned 4 [0195.317] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.317] lstrlenW (lpString=".bz2") returned 4 [0195.317] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.317] lstrlenW (lpString=".7z") returned 3 [0195.317] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.317] lstrlenW (lpString=".dbf") returned 4 [0195.317] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.317] lstrlenW (lpString=".1cd") returned 4 [0195.317] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.317] lstrlenW (lpString=".jpg") returned 4 [0195.317] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.317] lstrlenW (lpString=".doc") returned 4 [0195.317] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.318] lstrlenW (lpString=".docx") returned 5 [0195.318] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.318] lstrlenW (lpString=".pdf") returned 4 [0195.318] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.318] lstrlenW (lpString=".xls") returned 4 [0195.318] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.318] lstrlenW (lpString=".xlsx") returned 5 [0195.318] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.318] lstrlenW (lpString=".ppt") returned 4 [0195.318] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.318] lstrlenW (lpString=".zip") returned 4 [0195.318] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.318] lstrlenW (lpString=".rar") returned 4 [0195.318] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.318] lstrlenW (lpString=".bz2") returned 4 [0195.318] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.318] lstrlenW (lpString=".7z") returned 3 [0195.318] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.318] lstrlenW (lpString=".dbf") returned 4 [0195.318] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.318] lstrlenW (lpString=".1cd") returned 4 [0195.318] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\dasherSettingSchema.json") returned 150 [0195.318] lstrlenW (lpString=".jpg") returned 4 [0195.318] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.319] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0195.319] lstrlenW (lpString="page_embed_script.js") returned 20 [0195.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.319] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=224) returned 1 [0195.319] CloseHandle (hObject=0x35c) returned 1 [0195.319] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 0x2020 [0195.319] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.319] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.320] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.320] GetLastError () returned 0x0 [0195.320] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe0, lpOverlapped=0x0) returned 1 [0195.321] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.322] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.322] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0195.322] SetEndOfFile (hFile=0x358) returned 1 [0195.322] CloseHandle (hObject=0x358) returned 1 [0195.322] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.322] SetEndOfFile (hFile=0x35c) returned 1 [0195.323] CloseHandle (hObject=0x35c) returned 1 [0195.323] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.323] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js")) returned 1 [0195.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.324] lstrlenW (lpString=".doc") returned 4 [0195.324] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0195.324] lstrlenW (lpString=".docx") returned 5 [0195.324] lstrcmpiW (lpString1=".docx", lpString2="pt.js") returned -1 [0195.324] lstrlenW (lpString=".pdf") returned 4 [0195.324] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0195.324] lstrlenW (lpString=".xls") returned 4 [0195.324] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0195.324] lstrlenW (lpString=".xlsx") returned 5 [0195.324] lstrcmpiW (lpString1=".xlsx", lpString2="pt.js") returned -1 [0195.324] lstrlenW (lpString=".ppt") returned 4 [0195.324] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0195.324] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.324] lstrlenW (lpString=".zip") returned 4 [0195.324] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0195.324] lstrlenW (lpString=".rar") returned 4 [0195.324] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0195.325] lstrlenW (lpString=".bz2") returned 4 [0195.325] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0195.325] lstrlenW (lpString=".7z") returned 3 [0195.325] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0195.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.325] lstrlenW (lpString=".dbf") returned 4 [0195.325] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0195.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.325] lstrlenW (lpString=".1cd") returned 4 [0195.325] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0195.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.325] lstrlenW (lpString=".jpg") returned 4 [0195.325] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0195.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.325] lstrlenW (lpString=".doc") returned 4 [0195.325] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0195.325] lstrlenW (lpString=".docx") returned 5 [0195.325] lstrcmpiW (lpString1=".docx", lpString2="pt.js") returned -1 [0195.325] lstrlenW (lpString=".pdf") returned 4 [0195.325] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0195.325] lstrlenW (lpString=".xls") returned 4 [0195.325] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0195.325] lstrlenW (lpString=".xlsx") returned 5 [0195.325] lstrcmpiW (lpString1=".xlsx", lpString2="pt.js") returned -1 [0195.325] lstrlenW (lpString=".ppt") returned 4 [0195.325] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0195.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.325] lstrlenW (lpString=".zip") returned 4 [0195.325] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0195.325] lstrlenW (lpString=".rar") returned 4 [0195.325] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0195.326] lstrlenW (lpString=".bz2") returned 4 [0195.326] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0195.326] lstrlenW (lpString=".7z") returned 3 [0195.326] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0195.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.326] lstrlenW (lpString=".dbf") returned 4 [0195.326] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0195.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.326] lstrlenW (lpString=".1cd") returned 4 [0195.326] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0195.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\page_embed_script.js") returned 146 [0195.326] lstrlenW (lpString=".jpg") returned 4 [0195.326] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0195.326] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.326] lstrlenW (lpString="messages.json") returned 13 [0195.326] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.327] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=132) returned 1 [0195.327] CloseHandle (hObject=0x35c) returned 1 [0195.327] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json")) returned 0x2020 [0195.327] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.328] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.328] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.328] GetLastError () returned 0x0 [0195.328] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x84, lpOverlapped=0x0) returned 1 [0195.329] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x90, lpOverlapped=0x0) returned 1 [0195.330] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.330] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.330] SetEndOfFile (hFile=0x358) returned 1 [0195.330] CloseHandle (hObject=0x358) returned 1 [0195.330] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.330] SetEndOfFile (hFile=0x35c) returned 1 [0195.331] CloseHandle (hObject=0x35c) returned 1 [0195.331] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.331] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json")) returned 1 [0195.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.332] lstrlenW (lpString=".doc") returned 4 [0195.332] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.332] lstrlenW (lpString=".docx") returned 5 [0195.332] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.332] lstrlenW (lpString=".pdf") returned 4 [0195.332] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.332] lstrlenW (lpString=".xls") returned 4 [0195.332] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.332] lstrlenW (lpString=".xlsx") returned 5 [0195.332] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.332] lstrlenW (lpString=".ppt") returned 4 [0195.332] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.332] lstrlenW (lpString=".zip") returned 4 [0195.332] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.332] lstrlenW (lpString=".rar") returned 4 [0195.332] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.332] lstrlenW (lpString=".bz2") returned 4 [0195.332] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.332] lstrlenW (lpString=".7z") returned 3 [0195.332] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.332] lstrlenW (lpString=".dbf") returned 4 [0195.332] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.332] lstrlenW (lpString=".1cd") returned 4 [0195.332] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.333] lstrlenW (lpString=".jpg") returned 4 [0195.333] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.333] lstrlenW (lpString=".doc") returned 4 [0195.333] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.333] lstrlenW (lpString=".docx") returned 5 [0195.333] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.333] lstrlenW (lpString=".pdf") returned 4 [0195.333] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.333] lstrlenW (lpString=".xls") returned 4 [0195.333] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.333] lstrlenW (lpString=".xlsx") returned 5 [0195.333] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.333] lstrlenW (lpString=".ppt") returned 4 [0195.333] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.333] lstrlenW (lpString=".zip") returned 4 [0195.333] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.333] lstrlenW (lpString=".rar") returned 4 [0195.333] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.333] lstrlenW (lpString=".bz2") returned 4 [0195.333] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.333] lstrlenW (lpString=".7z") returned 3 [0195.333] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.333] lstrlenW (lpString=".dbf") returned 4 [0195.333] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.334] lstrlenW (lpString=".1cd") returned 4 [0195.334] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\af\\messages.json") returned 151 [0195.334] lstrlenW (lpString=".jpg") returned 4 [0195.334] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.334] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.334] lstrlenW (lpString="messages.json") returned 13 [0195.334] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.334] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=259) returned 1 [0195.334] CloseHandle (hObject=0x35c) returned 1 [0195.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json")) returned 0x2020 [0195.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.335] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.335] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.335] GetLastError () returned 0x0 [0195.335] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x103, lpOverlapped=0x0) returned 1 [0195.336] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x110, lpOverlapped=0x0) returned 1 [0195.337] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.337] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.338] SetEndOfFile (hFile=0x358) returned 1 [0195.338] CloseHandle (hObject=0x358) returned 1 [0195.338] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.338] SetEndOfFile (hFile=0x35c) returned 1 [0195.339] CloseHandle (hObject=0x35c) returned 1 [0195.339] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.339] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json")) returned 1 [0195.339] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.339] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.339] lstrlenW (lpString=".doc") returned 4 [0195.339] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.339] lstrlenW (lpString=".docx") returned 5 [0195.339] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.339] lstrlenW (lpString=".pdf") returned 4 [0195.339] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.339] lstrlenW (lpString=".xls") returned 4 [0195.340] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.340] lstrlenW (lpString=".xlsx") returned 5 [0195.340] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.340] lstrlenW (lpString=".ppt") returned 4 [0195.340] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.340] lstrlenW (lpString=".zip") returned 4 [0195.340] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.340] lstrlenW (lpString=".rar") returned 4 [0195.340] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.340] lstrlenW (lpString=".bz2") returned 4 [0195.340] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.340] lstrlenW (lpString=".7z") returned 3 [0195.340] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.340] lstrlenW (lpString=".dbf") returned 4 [0195.340] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.340] lstrlenW (lpString=".1cd") returned 4 [0195.340] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.340] lstrlenW (lpString=".jpg") returned 4 [0195.340] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.340] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.340] lstrlenW (lpString=".doc") returned 4 [0195.340] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.340] lstrlenW (lpString=".docx") returned 5 [0195.340] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.340] lstrlenW (lpString=".pdf") returned 4 [0195.340] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.341] lstrlenW (lpString=".xls") returned 4 [0195.341] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.341] lstrlenW (lpString=".xlsx") returned 5 [0195.341] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.341] lstrlenW (lpString=".ppt") returned 4 [0195.341] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.341] lstrlenW (lpString=".zip") returned 4 [0195.341] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.341] lstrlenW (lpString=".rar") returned 4 [0195.341] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.341] lstrlenW (lpString=".bz2") returned 4 [0195.341] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.341] lstrlenW (lpString=".7z") returned 3 [0195.341] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.341] lstrlenW (lpString=".dbf") returned 4 [0195.341] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.341] lstrlenW (lpString=".1cd") returned 4 [0195.341] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.341] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\am\\messages.json") returned 151 [0195.341] lstrlenW (lpString=".jpg") returned 4 [0195.341] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.341] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.341] lstrlenW (lpString="messages.json") returned 13 [0195.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.342] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=237) returned 1 [0195.342] CloseHandle (hObject=0x35c) returned 1 [0195.342] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json")) returned 0x2020 [0195.342] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.342] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.342] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.342] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.343] GetLastError () returned 0x0 [0195.343] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xed, lpOverlapped=0x0) returned 1 [0195.344] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0195.345] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.345] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.345] SetEndOfFile (hFile=0x358) returned 1 [0195.345] CloseHandle (hObject=0x358) returned 1 [0195.345] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.346] SetEndOfFile (hFile=0x35c) returned 1 [0195.346] CloseHandle (hObject=0x35c) returned 1 [0195.346] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.347] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json")) returned 1 [0195.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.347] lstrlenW (lpString=".doc") returned 4 [0195.347] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.347] lstrlenW (lpString=".docx") returned 5 [0195.347] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.347] lstrlenW (lpString=".pdf") returned 4 [0195.347] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.347] lstrlenW (lpString=".xls") returned 4 [0195.347] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.347] lstrlenW (lpString=".xlsx") returned 5 [0195.347] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.347] lstrlenW (lpString=".ppt") returned 4 [0195.347] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.347] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.347] lstrlenW (lpString=".zip") returned 4 [0195.347] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.347] lstrlenW (lpString=".rar") returned 4 [0195.347] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.347] lstrlenW (lpString=".bz2") returned 4 [0195.347] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.347] lstrlenW (lpString=".7z") returned 3 [0195.348] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.348] lstrlenW (lpString=".dbf") returned 4 [0195.348] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.348] lstrlenW (lpString=".1cd") returned 4 [0195.348] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.348] lstrlenW (lpString=".jpg") returned 4 [0195.348] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.348] lstrlenW (lpString=".doc") returned 4 [0195.348] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.348] lstrlenW (lpString=".docx") returned 5 [0195.348] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.348] lstrlenW (lpString=".pdf") returned 4 [0195.348] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.348] lstrlenW (lpString=".xls") returned 4 [0195.348] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.348] lstrlenW (lpString=".xlsx") returned 5 [0195.348] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.348] lstrlenW (lpString=".ppt") returned 4 [0195.348] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.348] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.348] lstrlenW (lpString=".zip") returned 4 [0195.348] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.348] lstrlenW (lpString=".rar") returned 4 [0195.348] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.348] lstrlenW (lpString=".bz2") returned 4 [0195.348] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.348] lstrlenW (lpString=".7z") returned 3 [0195.349] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.349] lstrlenW (lpString=".dbf") returned 4 [0195.349] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.349] lstrlenW (lpString=".1cd") returned 4 [0195.349] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.349] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ar\\messages.json") returned 151 [0195.349] lstrlenW (lpString=".jpg") returned 4 [0195.349] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.349] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.349] lstrlenW (lpString="messages.json") returned 13 [0195.349] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.349] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=167) returned 1 [0195.350] CloseHandle (hObject=0x35c) returned 1 [0195.350] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json")) returned 0x2020 [0195.350] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.350] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.350] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.351] GetLastError () returned 0x0 [0195.351] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xa7, lpOverlapped=0x0) returned 1 [0195.352] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0195.353] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.353] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.353] SetEndOfFile (hFile=0x358) returned 1 [0195.353] CloseHandle (hObject=0x358) returned 1 [0195.353] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.353] SetEndOfFile (hFile=0x35c) returned 1 [0195.354] CloseHandle (hObject=0x35c) returned 1 [0195.354] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.354] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json")) returned 1 [0195.354] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.354] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.354] lstrlenW (lpString=".doc") returned 4 [0195.354] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.354] lstrlenW (lpString=".docx") returned 5 [0195.354] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.354] lstrlenW (lpString=".pdf") returned 4 [0195.354] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.355] lstrlenW (lpString=".xls") returned 4 [0195.355] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.355] lstrlenW (lpString=".xlsx") returned 5 [0195.355] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.355] lstrlenW (lpString=".ppt") returned 4 [0195.355] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.355] lstrlenW (lpString=".zip") returned 4 [0195.355] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.355] lstrlenW (lpString=".rar") returned 4 [0195.355] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.355] lstrlenW (lpString=".bz2") returned 4 [0195.355] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.355] lstrlenW (lpString=".7z") returned 3 [0195.355] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.355] lstrlenW (lpString=".dbf") returned 4 [0195.355] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.355] lstrlenW (lpString=".1cd") returned 4 [0195.356] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.356] lstrlenW (lpString=".jpg") returned 4 [0195.356] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.356] lstrlenW (lpString=".doc") returned 4 [0195.356] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.356] lstrlenW (lpString=".docx") returned 5 [0195.356] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.356] lstrlenW (lpString=".pdf") returned 4 [0195.356] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.356] lstrlenW (lpString=".xls") returned 4 [0195.356] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.356] lstrlenW (lpString=".xlsx") returned 5 [0195.356] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.356] lstrlenW (lpString=".ppt") returned 4 [0195.356] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.356] lstrlenW (lpString=".zip") returned 4 [0195.356] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.356] lstrlenW (lpString=".rar") returned 4 [0195.356] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.356] lstrlenW (lpString=".bz2") returned 4 [0195.356] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.356] lstrlenW (lpString=".7z") returned 3 [0195.356] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.356] lstrlenW (lpString=".dbf") returned 4 [0195.356] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.356] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.356] lstrlenW (lpString=".1cd") returned 4 [0195.356] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\az\\messages.json") returned 151 [0195.357] lstrlenW (lpString=".jpg") returned 4 [0195.357] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.357] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.357] lstrlenW (lpString="messages.json") returned 13 [0195.357] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.357] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=276) returned 1 [0195.357] CloseHandle (hObject=0x35c) returned 1 [0195.357] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 0x2020 [0195.357] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.358] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.358] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.358] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.358] GetLastError () returned 0x0 [0195.358] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x114, lpOverlapped=0x0) returned 1 [0195.359] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x120, lpOverlapped=0x0) returned 1 [0195.360] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.360] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.361] SetEndOfFile (hFile=0x358) returned 1 [0195.361] CloseHandle (hObject=0x358) returned 1 [0195.361] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.361] SetEndOfFile (hFile=0x35c) returned 1 [0195.362] CloseHandle (hObject=0x35c) returned 1 [0195.362] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.362] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json")) returned 1 [0195.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.362] lstrlenW (lpString=".doc") returned 4 [0195.362] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.362] lstrlenW (lpString=".docx") returned 5 [0195.362] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.362] lstrlenW (lpString=".pdf") returned 4 [0195.362] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.362] lstrlenW (lpString=".xls") returned 4 [0195.362] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.362] lstrlenW (lpString=".xlsx") returned 5 [0195.362] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.362] lstrlenW (lpString=".ppt") returned 4 [0195.362] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.363] lstrlenW (lpString=".zip") returned 4 [0195.363] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.363] lstrlenW (lpString=".rar") returned 4 [0195.363] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.363] lstrlenW (lpString=".bz2") returned 4 [0195.363] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.363] lstrlenW (lpString=".7z") returned 3 [0195.363] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.363] lstrlenW (lpString=".dbf") returned 4 [0195.363] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.363] lstrlenW (lpString=".1cd") returned 4 [0195.363] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.363] lstrlenW (lpString=".jpg") returned 4 [0195.363] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.363] lstrlenW (lpString=".doc") returned 4 [0195.363] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.363] lstrlenW (lpString=".docx") returned 5 [0195.363] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.363] lstrlenW (lpString=".pdf") returned 4 [0195.363] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.363] lstrlenW (lpString=".xls") returned 4 [0195.363] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.363] lstrlenW (lpString=".xlsx") returned 5 [0195.363] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.363] lstrlenW (lpString=".ppt") returned 4 [0195.363] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.363] lstrlenW (lpString=".zip") returned 4 [0195.364] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.364] lstrlenW (lpString=".rar") returned 4 [0195.364] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.364] lstrlenW (lpString=".bz2") returned 4 [0195.364] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.364] lstrlenW (lpString=".7z") returned 3 [0195.364] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.364] lstrlenW (lpString=".dbf") returned 4 [0195.364] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.364] lstrlenW (lpString=".1cd") returned 4 [0195.364] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bg\\messages.json") returned 151 [0195.364] lstrlenW (lpString=".jpg") returned 4 [0195.364] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.364] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.364] lstrlenW (lpString="messages.json") returned 13 [0195.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.365] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=331) returned 1 [0195.365] CloseHandle (hObject=0x35c) returned 1 [0195.365] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json")) returned 0x2020 [0195.365] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.365] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.365] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.365] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.366] GetLastError () returned 0x0 [0195.366] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x14b, lpOverlapped=0x0) returned 1 [0195.367] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x150, lpOverlapped=0x0) returned 1 [0195.368] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.368] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.368] SetEndOfFile (hFile=0x358) returned 1 [0195.368] CloseHandle (hObject=0x358) returned 1 [0195.368] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.368] SetEndOfFile (hFile=0x35c) returned 1 [0195.369] CloseHandle (hObject=0x35c) returned 1 [0195.369] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.369] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json")) returned 1 [0195.369] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.369] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.369] lstrlenW (lpString=".doc") returned 4 [0195.369] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.370] lstrlenW (lpString=".docx") returned 5 [0195.370] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.370] lstrlenW (lpString=".pdf") returned 4 [0195.370] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.370] lstrlenW (lpString=".xls") returned 4 [0195.370] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.370] lstrlenW (lpString=".xlsx") returned 5 [0195.370] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.370] lstrlenW (lpString=".ppt") returned 4 [0195.370] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.370] lstrlenW (lpString=".zip") returned 4 [0195.370] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.370] lstrlenW (lpString=".rar") returned 4 [0195.370] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.370] lstrlenW (lpString=".bz2") returned 4 [0195.370] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.370] lstrlenW (lpString=".7z") returned 3 [0195.370] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.370] lstrlenW (lpString=".dbf") returned 4 [0195.370] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.370] lstrlenW (lpString=".1cd") returned 4 [0195.370] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.370] lstrlenW (lpString=".jpg") returned 4 [0195.370] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.370] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.371] lstrlenW (lpString=".doc") returned 4 [0195.371] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.371] lstrlenW (lpString=".docx") returned 5 [0195.371] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.371] lstrlenW (lpString=".pdf") returned 4 [0195.371] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.371] lstrlenW (lpString=".xls") returned 4 [0195.371] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.371] lstrlenW (lpString=".xlsx") returned 5 [0195.371] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.371] lstrlenW (lpString=".ppt") returned 4 [0195.371] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.371] lstrlenW (lpString=".zip") returned 4 [0195.371] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.371] lstrlenW (lpString=".rar") returned 4 [0195.371] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.371] lstrlenW (lpString=".bz2") returned 4 [0195.371] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.371] lstrlenW (lpString=".7z") returned 3 [0195.371] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.371] lstrlenW (lpString=".dbf") returned 4 [0195.371] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.371] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.371] lstrlenW (lpString=".1cd") returned 4 [0195.372] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\bn\\messages.json") returned 151 [0195.372] lstrlenW (lpString=".jpg") returned 4 [0195.372] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.372] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.372] lstrlenW (lpString="messages.json") returned 13 [0195.372] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.372] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=207) returned 1 [0195.372] CloseHandle (hObject=0x35c) returned 1 [0195.373] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json")) returned 0x2020 [0195.373] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.373] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.373] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.373] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.373] GetLastError () returned 0x0 [0195.373] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xcf, lpOverlapped=0x0) returned 1 [0195.374] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.375] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.375] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.375] SetEndOfFile (hFile=0x358) returned 1 [0195.376] CloseHandle (hObject=0x358) returned 1 [0195.376] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.376] SetEndOfFile (hFile=0x35c) returned 1 [0195.376] CloseHandle (hObject=0x35c) returned 1 [0195.376] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.377] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json")) returned 1 [0195.377] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.377] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.377] lstrlenW (lpString=".doc") returned 4 [0195.377] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.377] lstrlenW (lpString=".docx") returned 5 [0195.377] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.377] lstrlenW (lpString=".pdf") returned 4 [0195.377] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.377] lstrlenW (lpString=".xls") returned 4 [0195.377] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.377] lstrlenW (lpString=".xlsx") returned 5 [0195.377] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.377] lstrlenW (lpString=".ppt") returned 4 [0195.377] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.377] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.377] lstrlenW (lpString=".zip") returned 4 [0195.377] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.377] lstrlenW (lpString=".rar") returned 4 [0195.377] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.377] lstrlenW (lpString=".bz2") returned 4 [0195.377] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.377] lstrlenW (lpString=".7z") returned 3 [0195.378] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.378] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.378] lstrlenW (lpString=".dbf") returned 4 [0195.378] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.378] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.378] lstrlenW (lpString=".1cd") returned 4 [0195.378] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.378] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.378] lstrlenW (lpString=".jpg") returned 4 [0195.378] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.378] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.378] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.378] lstrlenW (lpString=".doc") returned 4 [0195.378] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.378] lstrlenW (lpString=".docx") returned 5 [0195.378] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.378] lstrlenW (lpString=".pdf") returned 4 [0195.378] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.378] lstrlenW (lpString=".xls") returned 4 [0195.378] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.378] lstrlenW (lpString=".xlsx") returned 5 [0195.378] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.378] lstrlenW (lpString=".ppt") returned 4 [0195.378] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.378] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.378] lstrlenW (lpString=".zip") returned 4 [0195.378] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.378] lstrlenW (lpString=".rar") returned 4 [0195.378] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.378] lstrlenW (lpString=".bz2") returned 4 [0195.378] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.378] lstrlenW (lpString=".7z") returned 3 [0195.379] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.379] lstrlenW (lpString=".dbf") returned 4 [0195.379] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.379] lstrlenW (lpString=".1cd") returned 4 [0195.379] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.379] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ca\\messages.json") returned 151 [0195.379] lstrlenW (lpString=".jpg") returned 4 [0195.379] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.379] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.379] lstrlenW (lpString="messages.json") returned 13 [0195.379] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.379] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=173) returned 1 [0195.380] CloseHandle (hObject=0x35c) returned 1 [0195.380] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json")) returned 0x2020 [0195.380] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.380] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.380] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.380] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.380] GetLastError () returned 0x0 [0195.380] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xad, lpOverlapped=0x0) returned 1 [0195.384] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0195.385] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.385] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.385] SetEndOfFile (hFile=0x358) returned 1 [0195.385] CloseHandle (hObject=0x358) returned 1 [0195.385] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.385] SetEndOfFile (hFile=0x35c) returned 1 [0195.386] CloseHandle (hObject=0x35c) returned 1 [0195.386] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.386] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json")) returned 1 [0195.386] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.386] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.386] lstrlenW (lpString=".doc") returned 4 [0195.386] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.386] lstrlenW (lpString=".docx") returned 5 [0195.386] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.386] lstrlenW (lpString=".pdf") returned 4 [0195.386] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.386] lstrlenW (lpString=".xls") returned 4 [0195.387] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.387] lstrlenW (lpString=".xlsx") returned 5 [0195.387] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.387] lstrlenW (lpString=".ppt") returned 4 [0195.387] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.387] lstrlenW (lpString=".zip") returned 4 [0195.387] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.387] lstrlenW (lpString=".rar") returned 4 [0195.387] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.387] lstrlenW (lpString=".bz2") returned 4 [0195.387] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.387] lstrlenW (lpString=".7z") returned 3 [0195.387] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.387] lstrlenW (lpString=".dbf") returned 4 [0195.387] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.387] lstrlenW (lpString=".1cd") returned 4 [0195.387] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.387] lstrlenW (lpString=".jpg") returned 4 [0195.387] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.387] lstrlenW (lpString=".doc") returned 4 [0195.387] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.387] lstrlenW (lpString=".docx") returned 5 [0195.387] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.387] lstrlenW (lpString=".pdf") returned 4 [0195.387] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.387] lstrlenW (lpString=".xls") returned 4 [0195.388] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.388] lstrlenW (lpString=".xlsx") returned 5 [0195.388] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.388] lstrlenW (lpString=".ppt") returned 4 [0195.388] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.388] lstrlenW (lpString=".zip") returned 4 [0195.388] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.388] lstrlenW (lpString=".rar") returned 4 [0195.388] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.388] lstrlenW (lpString=".bz2") returned 4 [0195.388] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.388] lstrlenW (lpString=".7z") returned 3 [0195.388] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.388] lstrlenW (lpString=".dbf") returned 4 [0195.388] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.388] lstrlenW (lpString=".1cd") returned 4 [0195.388] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.388] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\cs\\messages.json") returned 151 [0195.388] lstrlenW (lpString=".jpg") returned 4 [0195.388] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.388] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.388] lstrlenW (lpString="messages.json") returned 13 [0195.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.389] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=172) returned 1 [0195.389] CloseHandle (hObject=0x35c) returned 1 [0195.389] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json")) returned 0x2020 [0195.389] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.389] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.389] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.389] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.390] GetLastError () returned 0x0 [0195.390] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xac, lpOverlapped=0x0) returned 1 [0195.391] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0195.392] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.392] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.392] SetEndOfFile (hFile=0x358) returned 1 [0195.392] CloseHandle (hObject=0x358) returned 1 [0195.392] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.392] SetEndOfFile (hFile=0x35c) returned 1 [0195.393] CloseHandle (hObject=0x35c) returned 1 [0195.393] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.393] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json")) returned 1 [0195.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.393] lstrlenW (lpString=".doc") returned 4 [0195.393] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.393] lstrlenW (lpString=".docx") returned 5 [0195.393] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.393] lstrlenW (lpString=".pdf") returned 4 [0195.393] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.394] lstrlenW (lpString=".xls") returned 4 [0195.394] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.394] lstrlenW (lpString=".xlsx") returned 5 [0195.394] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.394] lstrlenW (lpString=".ppt") returned 4 [0195.394] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.394] lstrlenW (lpString=".zip") returned 4 [0195.394] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.394] lstrlenW (lpString=".rar") returned 4 [0195.394] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.394] lstrlenW (lpString=".bz2") returned 4 [0195.394] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.394] lstrlenW (lpString=".7z") returned 3 [0195.394] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.394] lstrlenW (lpString=".dbf") returned 4 [0195.394] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.394] lstrlenW (lpString=".1cd") returned 4 [0195.394] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.394] lstrlenW (lpString=".jpg") returned 4 [0195.394] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.394] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.394] lstrlenW (lpString=".doc") returned 4 [0195.394] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.394] lstrlenW (lpString=".docx") returned 5 [0195.394] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.394] lstrlenW (lpString=".pdf") returned 4 [0195.394] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.395] lstrlenW (lpString=".xls") returned 4 [0195.395] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.395] lstrlenW (lpString=".xlsx") returned 5 [0195.395] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.395] lstrlenW (lpString=".ppt") returned 4 [0195.395] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.395] lstrlenW (lpString=".zip") returned 4 [0195.395] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.395] lstrlenW (lpString=".rar") returned 4 [0195.395] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.395] lstrlenW (lpString=".bz2") returned 4 [0195.395] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.395] lstrlenW (lpString=".7z") returned 3 [0195.395] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.395] lstrlenW (lpString=".dbf") returned 4 [0195.395] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.395] lstrlenW (lpString=".1cd") returned 4 [0195.395] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.395] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\da\\messages.json") returned 151 [0195.395] lstrlenW (lpString=".jpg") returned 4 [0195.395] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.395] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.395] lstrlenW (lpString="messages.json") returned 13 [0195.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.396] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=193) returned 1 [0195.396] CloseHandle (hObject=0x35c) returned 1 [0195.396] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json")) returned 0x2020 [0195.396] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.396] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.396] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.396] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.397] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.397] GetLastError () returned 0x0 [0195.397] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xc1, lpOverlapped=0x0) returned 1 [0195.398] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.399] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.399] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.399] SetEndOfFile (hFile=0x358) returned 1 [0195.399] CloseHandle (hObject=0x358) returned 1 [0195.399] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.399] SetEndOfFile (hFile=0x35c) returned 1 [0195.400] CloseHandle (hObject=0x35c) returned 1 [0195.400] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.400] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json")) returned 1 [0195.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.401] lstrlenW (lpString=".doc") returned 4 [0195.401] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.401] lstrlenW (lpString=".docx") returned 5 [0195.401] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.401] lstrlenW (lpString=".pdf") returned 4 [0195.401] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.401] lstrlenW (lpString=".xls") returned 4 [0195.401] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.401] lstrlenW (lpString=".xlsx") returned 5 [0195.401] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.401] lstrlenW (lpString=".ppt") returned 4 [0195.401] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.401] lstrlenW (lpString=".zip") returned 4 [0195.401] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.401] lstrlenW (lpString=".rar") returned 4 [0195.401] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.401] lstrlenW (lpString=".bz2") returned 4 [0195.401] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.401] lstrlenW (lpString=".7z") returned 3 [0195.401] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.401] lstrlenW (lpString=".dbf") returned 4 [0195.401] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.401] lstrlenW (lpString=".1cd") returned 4 [0195.401] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.401] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.402] lstrlenW (lpString=".jpg") returned 4 [0195.402] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.402] lstrlenW (lpString=".doc") returned 4 [0195.402] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.402] lstrlenW (lpString=".docx") returned 5 [0195.402] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.402] lstrlenW (lpString=".pdf") returned 4 [0195.402] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.402] lstrlenW (lpString=".xls") returned 4 [0195.402] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.402] lstrlenW (lpString=".xlsx") returned 5 [0195.402] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.402] lstrlenW (lpString=".ppt") returned 4 [0195.402] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.402] lstrlenW (lpString=".zip") returned 4 [0195.402] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.402] lstrlenW (lpString=".rar") returned 4 [0195.402] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.402] lstrlenW (lpString=".bz2") returned 4 [0195.403] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.403] lstrlenW (lpString=".7z") returned 3 [0195.403] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.403] lstrlenW (lpString=".dbf") returned 4 [0195.403] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.403] lstrlenW (lpString=".1cd") returned 4 [0195.403] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\de\\messages.json") returned 151 [0195.403] lstrlenW (lpString=".jpg") returned 4 [0195.403] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.403] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.403] lstrlenW (lpString="messages.json") returned 13 [0195.403] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.404] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=298) returned 1 [0195.404] CloseHandle (hObject=0x35c) returned 1 [0195.404] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json")) returned 0x2020 [0195.404] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.404] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.404] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.404] GetLastError () returned 0x0 [0195.404] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x12a, lpOverlapped=0x0) returned 1 [0195.406] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x130, lpOverlapped=0x0) returned 1 [0195.407] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.407] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.407] SetEndOfFile (hFile=0x358) returned 1 [0195.408] CloseHandle (hObject=0x358) returned 1 [0195.408] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.408] SetEndOfFile (hFile=0x35c) returned 1 [0195.408] CloseHandle (hObject=0x35c) returned 1 [0195.409] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.409] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json")) returned 1 [0195.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.409] lstrlenW (lpString=".doc") returned 4 [0195.409] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.409] lstrlenW (lpString=".docx") returned 5 [0195.409] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.409] lstrlenW (lpString=".pdf") returned 4 [0195.409] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.409] lstrlenW (lpString=".xls") returned 4 [0195.409] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.409] lstrlenW (lpString=".xlsx") returned 5 [0195.409] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.409] lstrlenW (lpString=".ppt") returned 4 [0195.409] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.409] lstrlenW (lpString=".zip") returned 4 [0195.409] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.409] lstrlenW (lpString=".rar") returned 4 [0195.409] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.410] lstrlenW (lpString=".bz2") returned 4 [0195.410] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.410] lstrlenW (lpString=".7z") returned 3 [0195.410] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.410] lstrlenW (lpString=".dbf") returned 4 [0195.410] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.410] lstrlenW (lpString=".1cd") returned 4 [0195.410] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.410] lstrlenW (lpString=".jpg") returned 4 [0195.410] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.410] lstrlenW (lpString=".doc") returned 4 [0195.410] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.410] lstrlenW (lpString=".docx") returned 5 [0195.410] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.410] lstrlenW (lpString=".pdf") returned 4 [0195.410] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.410] lstrlenW (lpString=".xls") returned 4 [0195.410] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.410] lstrlenW (lpString=".xlsx") returned 5 [0195.410] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.410] lstrlenW (lpString=".ppt") returned 4 [0195.410] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.410] lstrlenW (lpString=".zip") returned 4 [0195.410] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.410] lstrlenW (lpString=".rar") returned 4 [0195.410] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.410] lstrlenW (lpString=".bz2") returned 4 [0195.411] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.411] lstrlenW (lpString=".7z") returned 3 [0195.411] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.411] lstrlenW (lpString=".dbf") returned 4 [0195.411] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.411] lstrlenW (lpString=".1cd") returned 4 [0195.411] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.411] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\el\\messages.json") returned 151 [0195.411] lstrlenW (lpString=".jpg") returned 4 [0195.411] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.411] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.411] lstrlenW (lpString="messages.json") returned 13 [0195.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.412] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=178) returned 1 [0195.412] CloseHandle (hObject=0x35c) returned 1 [0195.412] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0195.412] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0195.412] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.412] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0195.413] GetLastError () returned 0x0 [0195.413] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb2, lpOverlapped=0x0) returned 1 [0195.414] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.415] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.415] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.415] SetEndOfFile (hFile=0x358) returned 1 [0195.415] CloseHandle (hObject=0x358) returned 1 [0195.415] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.415] SetEndOfFile (hFile=0x35c) returned 1 [0195.416] CloseHandle (hObject=0x35c) returned 1 [0195.416] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.416] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_gb\\messages.json")) returned 1 [0195.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.416] lstrlenW (lpString=".doc") returned 4 [0195.416] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.416] lstrlenW (lpString=".docx") returned 5 [0195.416] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.416] lstrlenW (lpString=".pdf") returned 4 [0195.416] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.416] lstrlenW (lpString=".xls") returned 4 [0195.416] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.416] lstrlenW (lpString=".xlsx") returned 5 [0195.416] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.416] lstrlenW (lpString=".ppt") returned 4 [0195.417] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.417] lstrlenW (lpString=".zip") returned 4 [0195.417] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.417] lstrlenW (lpString=".rar") returned 4 [0195.417] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.417] lstrlenW (lpString=".bz2") returned 4 [0195.417] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.417] lstrlenW (lpString=".7z") returned 3 [0195.417] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.417] lstrlenW (lpString=".dbf") returned 4 [0195.417] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.417] lstrlenW (lpString=".1cd") returned 4 [0195.417] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.417] lstrlenW (lpString=".jpg") returned 4 [0195.417] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.417] lstrlenW (lpString=".doc") returned 4 [0195.417] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.417] lstrlenW (lpString=".docx") returned 5 [0195.417] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.417] lstrlenW (lpString=".pdf") returned 4 [0195.498] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.498] lstrlenW (lpString=".xls") returned 4 [0195.498] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.498] lstrlenW (lpString=".xlsx") returned 5 [0195.498] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.502] lstrlenW (lpString=".ppt") returned 4 [0195.502] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.502] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.502] lstrlenW (lpString=".zip") returned 4 [0195.502] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.502] lstrlenW (lpString=".rar") returned 4 [0195.502] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.502] lstrlenW (lpString=".bz2") returned 4 [0195.502] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.502] lstrlenW (lpString=".7z") returned 3 [0195.502] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.588] lstrlenW (lpString=".dbf") returned 4 [0195.588] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.588] lstrlenW (lpString=".1cd") returned 4 [0195.588] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.588] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\en_GB\\messages.json") returned 154 [0195.588] lstrlenW (lpString=".jpg") returned 4 [0195.588] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.605] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.605] lstrlenW (lpString="messages.json") returned 13 [0195.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.605] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=182) returned 1 [0195.605] CloseHandle (hObject=0x388) returned 1 [0195.605] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json")) returned 0x2020 [0195.605] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.606] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.606] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.606] GetLastError () returned 0x0 [0195.606] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xb6, lpOverlapped=0x0) returned 1 [0195.607] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0195.608] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.608] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.608] SetEndOfFile (hFile=0x15c) returned 1 [0195.608] CloseHandle (hObject=0x15c) returned 1 [0195.608] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.608] SetEndOfFile (hFile=0x388) returned 1 [0195.609] CloseHandle (hObject=0x388) returned 1 [0195.609] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.609] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json")) returned 1 [0195.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.610] lstrlenW (lpString=".doc") returned 4 [0195.610] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.610] lstrlenW (lpString=".docx") returned 5 [0195.610] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.610] lstrlenW (lpString=".pdf") returned 4 [0195.610] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.610] lstrlenW (lpString=".xls") returned 4 [0195.610] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.610] lstrlenW (lpString=".xlsx") returned 5 [0195.610] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.610] lstrlenW (lpString=".ppt") returned 4 [0195.610] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.610] lstrlenW (lpString=".zip") returned 4 [0195.610] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.610] lstrlenW (lpString=".rar") returned 4 [0195.610] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.610] lstrlenW (lpString=".bz2") returned 4 [0195.610] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.610] lstrlenW (lpString=".7z") returned 3 [0195.610] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.610] lstrlenW (lpString=".dbf") returned 4 [0195.610] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.610] lstrlenW (lpString=".1cd") returned 4 [0195.610] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.610] lstrlenW (lpString=".jpg") returned 4 [0195.610] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.611] lstrlenW (lpString=".doc") returned 4 [0195.611] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.611] lstrlenW (lpString=".docx") returned 5 [0195.611] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.611] lstrlenW (lpString=".pdf") returned 4 [0195.611] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.611] lstrlenW (lpString=".xls") returned 4 [0195.611] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.611] lstrlenW (lpString=".xlsx") returned 5 [0195.611] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.611] lstrlenW (lpString=".ppt") returned 4 [0195.611] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.611] lstrlenW (lpString=".zip") returned 4 [0195.611] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.611] lstrlenW (lpString=".rar") returned 4 [0195.611] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.611] lstrlenW (lpString=".bz2") returned 4 [0195.611] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.611] lstrlenW (lpString=".7z") returned 3 [0195.611] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.611] lstrlenW (lpString=".dbf") returned 4 [0195.611] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.611] lstrlenW (lpString=".1cd") returned 4 [0195.611] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\it\\messages.json") returned 151 [0195.612] lstrlenW (lpString=".jpg") returned 4 [0195.612] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.612] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.612] lstrlenW (lpString="messages.json") returned 13 [0195.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.612] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=362) returned 1 [0195.612] CloseHandle (hObject=0x388) returned 1 [0195.612] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json")) returned 0x2020 [0195.612] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.612] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.613] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.613] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.613] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.613] GetLastError () returned 0x0 [0195.613] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x16a, lpOverlapped=0x0) returned 1 [0195.614] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x170, lpOverlapped=0x0) returned 1 [0195.615] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.615] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.615] SetEndOfFile (hFile=0x15c) returned 1 [0195.616] CloseHandle (hObject=0x15c) returned 1 [0195.616] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.616] SetEndOfFile (hFile=0x388) returned 1 [0195.617] CloseHandle (hObject=0x388) returned 1 [0195.617] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.617] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json")) returned 1 [0195.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.617] lstrlenW (lpString=".doc") returned 4 [0195.617] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.617] lstrlenW (lpString=".docx") returned 5 [0195.617] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.617] lstrlenW (lpString=".pdf") returned 4 [0195.617] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.617] lstrlenW (lpString=".xls") returned 4 [0195.617] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.617] lstrlenW (lpString=".xlsx") returned 5 [0195.617] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.617] lstrlenW (lpString=".ppt") returned 4 [0195.617] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.617] lstrlenW (lpString=".zip") returned 4 [0195.618] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.618] lstrlenW (lpString=".rar") returned 4 [0195.618] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.618] lstrlenW (lpString=".bz2") returned 4 [0195.618] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.618] lstrlenW (lpString=".7z") returned 3 [0195.618] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.618] lstrlenW (lpString=".dbf") returned 4 [0195.618] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.618] lstrlenW (lpString=".1cd") returned 4 [0195.618] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.618] lstrlenW (lpString=".jpg") returned 4 [0195.618] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.618] lstrlenW (lpString=".doc") returned 4 [0195.618] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.618] lstrlenW (lpString=".docx") returned 5 [0195.618] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.618] lstrlenW (lpString=".pdf") returned 4 [0195.618] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.618] lstrlenW (lpString=".xls") returned 4 [0195.618] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.618] lstrlenW (lpString=".xlsx") returned 5 [0195.618] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.618] lstrlenW (lpString=".ppt") returned 4 [0195.618] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.618] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.618] lstrlenW (lpString=".zip") returned 4 [0195.618] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.619] lstrlenW (lpString=".rar") returned 4 [0195.619] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.619] lstrlenW (lpString=".bz2") returned 4 [0195.619] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.619] lstrlenW (lpString=".7z") returned 3 [0195.619] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.619] lstrlenW (lpString=".dbf") returned 4 [0195.619] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.619] lstrlenW (lpString=".1cd") returned 4 [0195.619] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.619] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\iw\\messages.json") returned 151 [0195.619] lstrlenW (lpString=".jpg") returned 4 [0195.619] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.619] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.619] lstrlenW (lpString="messages.json") returned 13 [0195.619] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.620] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=251) returned 1 [0195.620] CloseHandle (hObject=0x388) returned 1 [0195.620] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json")) returned 0x2020 [0195.620] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.620] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.620] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.620] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.621] GetLastError () returned 0x0 [0195.621] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xfb, lpOverlapped=0x0) returned 1 [0195.622] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0195.623] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.623] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.623] SetEndOfFile (hFile=0x15c) returned 1 [0195.623] CloseHandle (hObject=0x15c) returned 1 [0195.623] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.623] SetEndOfFile (hFile=0x388) returned 1 [0195.624] CloseHandle (hObject=0x388) returned 1 [0195.624] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.624] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json")) returned 1 [0195.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.624] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.624] lstrlenW (lpString=".doc") returned 4 [0195.624] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.624] lstrlenW (lpString=".docx") returned 5 [0195.624] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.625] lstrlenW (lpString=".pdf") returned 4 [0195.625] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.625] lstrlenW (lpString=".xls") returned 4 [0195.625] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.625] lstrlenW (lpString=".xlsx") returned 5 [0195.625] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.625] lstrlenW (lpString=".ppt") returned 4 [0195.625] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.625] lstrlenW (lpString=".zip") returned 4 [0195.625] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.625] lstrlenW (lpString=".rar") returned 4 [0195.625] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.625] lstrlenW (lpString=".bz2") returned 4 [0195.625] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.625] lstrlenW (lpString=".7z") returned 3 [0195.625] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.625] lstrlenW (lpString=".dbf") returned 4 [0195.625] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.625] lstrlenW (lpString=".1cd") returned 4 [0195.625] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.625] lstrlenW (lpString=".jpg") returned 4 [0195.625] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.625] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.625] lstrlenW (lpString=".doc") returned 4 [0195.625] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.625] lstrlenW (lpString=".docx") returned 5 [0195.625] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.625] lstrlenW (lpString=".pdf") returned 4 [0195.625] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.626] lstrlenW (lpString=".xls") returned 4 [0195.626] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.626] lstrlenW (lpString=".xlsx") returned 5 [0195.626] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.626] lstrlenW (lpString=".ppt") returned 4 [0195.626] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.626] lstrlenW (lpString=".zip") returned 4 [0195.626] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.626] lstrlenW (lpString=".rar") returned 4 [0195.626] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.626] lstrlenW (lpString=".bz2") returned 4 [0195.626] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.626] lstrlenW (lpString=".7z") returned 3 [0195.626] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.626] lstrlenW (lpString=".dbf") returned 4 [0195.626] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.626] lstrlenW (lpString=".1cd") returned 4 [0195.626] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ja\\messages.json") returned 151 [0195.626] lstrlenW (lpString=".jpg") returned 4 [0195.626] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.626] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.626] lstrlenW (lpString="messages.json") returned 13 [0195.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.627] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=357) returned 1 [0195.627] CloseHandle (hObject=0x388) returned 1 [0195.627] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json")) returned 0x2020 [0195.627] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.627] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.627] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.627] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.628] GetLastError () returned 0x0 [0195.628] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x165, lpOverlapped=0x0) returned 1 [0195.629] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x170, lpOverlapped=0x0) returned 1 [0195.630] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.630] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.630] SetEndOfFile (hFile=0x15c) returned 1 [0195.630] CloseHandle (hObject=0x15c) returned 1 [0195.630] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.630] SetEndOfFile (hFile=0x388) returned 1 [0195.631] CloseHandle (hObject=0x388) returned 1 [0195.631] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.631] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json")) returned 1 [0195.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.632] lstrlenW (lpString=".doc") returned 4 [0195.632] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.632] lstrlenW (lpString=".docx") returned 5 [0195.632] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.632] lstrlenW (lpString=".pdf") returned 4 [0195.632] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.632] lstrlenW (lpString=".xls") returned 4 [0195.632] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.632] lstrlenW (lpString=".xlsx") returned 5 [0195.632] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.632] lstrlenW (lpString=".ppt") returned 4 [0195.632] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.632] lstrlenW (lpString=".zip") returned 4 [0195.632] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.632] lstrlenW (lpString=".rar") returned 4 [0195.632] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.632] lstrlenW (lpString=".bz2") returned 4 [0195.632] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.632] lstrlenW (lpString=".7z") returned 3 [0195.632] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.632] lstrlenW (lpString=".dbf") returned 4 [0195.632] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.632] lstrlenW (lpString=".1cd") returned 4 [0195.632] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.632] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.632] lstrlenW (lpString=".jpg") returned 4 [0195.632] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.633] lstrlenW (lpString=".doc") returned 4 [0195.633] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.633] lstrlenW (lpString=".docx") returned 5 [0195.633] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.633] lstrlenW (lpString=".pdf") returned 4 [0195.633] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.633] lstrlenW (lpString=".xls") returned 4 [0195.633] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.633] lstrlenW (lpString=".xlsx") returned 5 [0195.633] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.633] lstrlenW (lpString=".ppt") returned 4 [0195.633] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.633] lstrlenW (lpString=".zip") returned 4 [0195.633] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.633] lstrlenW (lpString=".rar") returned 4 [0195.633] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.633] lstrlenW (lpString=".bz2") returned 4 [0195.633] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.633] lstrlenW (lpString=".7z") returned 3 [0195.633] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.633] lstrlenW (lpString=".dbf") returned 4 [0195.633] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.633] lstrlenW (lpString=".1cd") returned 4 [0195.633] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.633] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ka\\messages.json") returned 151 [0195.633] lstrlenW (lpString=".jpg") returned 4 [0195.633] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.634] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.634] lstrlenW (lpString="messages.json") returned 13 [0195.634] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0195.635] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=607) returned 1 [0195.636] CloseHandle (hObject=0x388) returned 1 [0195.784] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json")) returned 0x2020 [0195.784] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.784] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.784] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0195.784] GetLastError () returned 0x0 [0195.784] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x25f, lpOverlapped=0x0) returned 1 [0195.788] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x260, lpOverlapped=0x0) returned 1 [0195.789] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.789] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.789] SetEndOfFile (hFile=0x154) returned 1 [0195.789] CloseHandle (hObject=0x154) returned 1 [0195.789] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.789] SetEndOfFile (hFile=0x15c) returned 1 [0195.790] CloseHandle (hObject=0x15c) returned 1 [0195.790] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.790] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json")) returned 1 [0195.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.791] lstrlenW (lpString=".doc") returned 4 [0195.791] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.791] lstrlenW (lpString=".docx") returned 5 [0195.791] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.791] lstrlenW (lpString=".pdf") returned 4 [0195.791] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.791] lstrlenW (lpString=".xls") returned 4 [0195.791] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.791] lstrlenW (lpString=".xlsx") returned 5 [0195.791] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.791] lstrlenW (lpString=".ppt") returned 4 [0195.791] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.791] lstrlenW (lpString=".zip") returned 4 [0195.791] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.791] lstrlenW (lpString=".rar") returned 4 [0195.791] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.791] lstrlenW (lpString=".bz2") returned 4 [0195.791] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.791] lstrlenW (lpString=".7z") returned 3 [0195.791] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.791] lstrlenW (lpString=".dbf") returned 4 [0195.791] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.791] lstrlenW (lpString=".1cd") returned 4 [0195.791] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.792] lstrlenW (lpString=".jpg") returned 4 [0195.792] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.792] lstrlenW (lpString=".doc") returned 4 [0195.792] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.792] lstrlenW (lpString=".docx") returned 5 [0195.792] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.792] lstrlenW (lpString=".pdf") returned 4 [0195.792] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.792] lstrlenW (lpString=".xls") returned 4 [0195.792] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.792] lstrlenW (lpString=".xlsx") returned 5 [0195.792] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.792] lstrlenW (lpString=".ppt") returned 4 [0195.792] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.792] lstrlenW (lpString=".zip") returned 4 [0195.792] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.792] lstrlenW (lpString=".rar") returned 4 [0195.792] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.792] lstrlenW (lpString=".bz2") returned 4 [0195.792] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.792] lstrlenW (lpString=".7z") returned 3 [0195.792] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.793] lstrlenW (lpString=".dbf") returned 4 [0195.793] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.793] lstrlenW (lpString=".1cd") returned 4 [0195.793] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\km\\messages.json") returned 151 [0195.793] lstrlenW (lpString=".jpg") returned 4 [0195.793] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.793] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.793] lstrlenW (lpString="messages.json") returned 13 [0195.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.793] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=198) returned 1 [0195.793] CloseHandle (hObject=0x15c) returned 1 [0195.794] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0195.794] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.794] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.794] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0195.794] GetLastError () returned 0x0 [0195.794] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xc6, lpOverlapped=0x0) returned 1 [0195.795] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.797] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.797] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.797] SetEndOfFile (hFile=0x154) returned 1 [0195.797] CloseHandle (hObject=0x154) returned 1 [0195.797] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.797] SetEndOfFile (hFile=0x15c) returned 1 [0195.798] CloseHandle (hObject=0x15c) returned 1 [0195.798] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.798] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_pt\\messages.json")) returned 1 [0195.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.798] lstrlenW (lpString=".doc") returned 4 [0195.798] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.798] lstrlenW (lpString=".docx") returned 5 [0195.798] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.799] lstrlenW (lpString=".pdf") returned 4 [0195.799] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.799] lstrlenW (lpString=".xls") returned 4 [0195.799] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.799] lstrlenW (lpString=".xlsx") returned 5 [0195.799] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.799] lstrlenW (lpString=".ppt") returned 4 [0195.799] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.799] lstrlenW (lpString=".zip") returned 4 [0195.799] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.799] lstrlenW (lpString=".rar") returned 4 [0195.799] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.799] lstrlenW (lpString=".bz2") returned 4 [0195.799] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.799] lstrlenW (lpString=".7z") returned 3 [0195.799] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.799] lstrlenW (lpString=".dbf") returned 4 [0195.799] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.799] lstrlenW (lpString=".1cd") returned 4 [0195.799] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.799] lstrlenW (lpString=".jpg") returned 4 [0195.799] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.799] lstrlenW (lpString=".doc") returned 4 [0195.799] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.799] lstrlenW (lpString=".docx") returned 5 [0195.799] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.799] lstrlenW (lpString=".pdf") returned 4 [0195.799] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.800] lstrlenW (lpString=".xls") returned 4 [0195.800] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.800] lstrlenW (lpString=".xlsx") returned 5 [0195.800] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.800] lstrlenW (lpString=".ppt") returned 4 [0195.800] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.800] lstrlenW (lpString=".zip") returned 4 [0195.800] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.800] lstrlenW (lpString=".rar") returned 4 [0195.800] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.800] lstrlenW (lpString=".bz2") returned 4 [0195.800] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.800] lstrlenW (lpString=".7z") returned 3 [0195.800] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.800] lstrlenW (lpString=".dbf") returned 4 [0195.800] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.800] lstrlenW (lpString=".1cd") returned 4 [0195.800] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\pt_PT\\messages.json") returned 154 [0195.800] lstrlenW (lpString=".jpg") returned 4 [0195.800] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.800] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.800] lstrlenW (lpString="messages.json") returned 13 [0195.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.801] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=175) returned 1 [0195.801] CloseHandle (hObject=0x15c) returned 1 [0195.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 0x2020 [0195.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.801] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.801] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0195.802] GetLastError () returned 0x0 [0195.802] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xaf, lpOverlapped=0x0) returned 1 [0195.803] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0195.804] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.804] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.804] SetEndOfFile (hFile=0x154) returned 1 [0195.804] CloseHandle (hObject=0x154) returned 1 [0195.804] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.804] SetEndOfFile (hFile=0x15c) returned 1 [0195.805] CloseHandle (hObject=0x15c) returned 1 [0195.805] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.805] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json")) returned 1 [0195.805] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.805] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.805] lstrlenW (lpString=".doc") returned 4 [0195.805] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.805] lstrlenW (lpString=".docx") returned 5 [0195.805] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.805] lstrlenW (lpString=".pdf") returned 4 [0195.805] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.805] lstrlenW (lpString=".xls") returned 4 [0195.805] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.805] lstrlenW (lpString=".xlsx") returned 5 [0195.805] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.805] lstrlenW (lpString=".ppt") returned 4 [0195.806] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.806] lstrlenW (lpString=".zip") returned 4 [0195.806] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.806] lstrlenW (lpString=".rar") returned 4 [0195.806] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.806] lstrlenW (lpString=".bz2") returned 4 [0195.806] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.806] lstrlenW (lpString=".7z") returned 3 [0195.806] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.806] lstrlenW (lpString=".dbf") returned 4 [0195.806] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.806] lstrlenW (lpString=".1cd") returned 4 [0195.806] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.806] lstrlenW (lpString=".jpg") returned 4 [0195.806] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.806] lstrlenW (lpString=".doc") returned 4 [0195.806] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.806] lstrlenW (lpString=".docx") returned 5 [0195.806] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.806] lstrlenW (lpString=".pdf") returned 4 [0195.806] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.806] lstrlenW (lpString=".xls") returned 4 [0195.806] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.806] lstrlenW (lpString=".xlsx") returned 5 [0195.806] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.806] lstrlenW (lpString=".ppt") returned 4 [0195.806] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.807] lstrlenW (lpString=".zip") returned 4 [0195.807] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.807] lstrlenW (lpString=".rar") returned 4 [0195.807] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.807] lstrlenW (lpString=".bz2") returned 4 [0195.807] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.807] lstrlenW (lpString=".7z") returned 3 [0195.807] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.807] lstrlenW (lpString=".dbf") returned 4 [0195.807] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.807] lstrlenW (lpString=".1cd") returned 4 [0195.807] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ro\\messages.json") returned 151 [0195.807] lstrlenW (lpString=".jpg") returned 4 [0195.807] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.807] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.807] lstrlenW (lpString="messages.json") returned 13 [0195.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.808] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=281) returned 1 [0195.808] CloseHandle (hObject=0x15c) returned 1 [0195.808] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json")) returned 0x2020 [0195.808] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.808] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.808] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.809] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0195.809] GetLastError () returned 0x0 [0195.809] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x119, lpOverlapped=0x0) returned 1 [0195.810] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x120, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x120, lpOverlapped=0x0) returned 1 [0195.811] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.811] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.811] SetEndOfFile (hFile=0x154) returned 1 [0195.811] CloseHandle (hObject=0x154) returned 1 [0195.811] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.811] SetEndOfFile (hFile=0x15c) returned 1 [0195.812] CloseHandle (hObject=0x15c) returned 1 [0195.812] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.812] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json")) returned 1 [0195.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.813] lstrlenW (lpString=".doc") returned 4 [0195.813] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.813] lstrlenW (lpString=".docx") returned 5 [0195.813] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.813] lstrlenW (lpString=".pdf") returned 4 [0195.813] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.813] lstrlenW (lpString=".xls") returned 4 [0195.813] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.813] lstrlenW (lpString=".xlsx") returned 5 [0195.813] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.813] lstrlenW (lpString=".ppt") returned 4 [0195.813] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.813] lstrlenW (lpString=".zip") returned 4 [0195.813] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.813] lstrlenW (lpString=".rar") returned 4 [0195.813] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.813] lstrlenW (lpString=".bz2") returned 4 [0195.813] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.813] lstrlenW (lpString=".7z") returned 3 [0195.813] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.813] lstrlenW (lpString=".dbf") returned 4 [0195.813] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.813] lstrlenW (lpString=".1cd") returned 4 [0195.813] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.813] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.813] lstrlenW (lpString=".jpg") returned 4 [0195.813] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.814] lstrlenW (lpString=".doc") returned 4 [0195.814] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.814] lstrlenW (lpString=".docx") returned 5 [0195.814] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.814] lstrlenW (lpString=".pdf") returned 4 [0195.814] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.814] lstrlenW (lpString=".xls") returned 4 [0195.814] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.814] lstrlenW (lpString=".xlsx") returned 5 [0195.814] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.814] lstrlenW (lpString=".ppt") returned 4 [0195.814] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.814] lstrlenW (lpString=".zip") returned 4 [0195.814] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.814] lstrlenW (lpString=".rar") returned 4 [0195.814] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.814] lstrlenW (lpString=".bz2") returned 4 [0195.814] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.814] lstrlenW (lpString=".7z") returned 3 [0195.814] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.814] lstrlenW (lpString=".dbf") returned 4 [0195.814] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.814] lstrlenW (lpString=".1cd") returned 4 [0195.814] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.814] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\ru\\messages.json") returned 151 [0195.814] lstrlenW (lpString=".jpg") returned 4 [0195.814] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.815] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.815] lstrlenW (lpString="messages.json") returned 13 [0195.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.815] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=334) returned 1 [0195.815] CloseHandle (hObject=0x15c) returned 1 [0195.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json")) returned 0x2020 [0195.815] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.815] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.816] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.816] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.816] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0195.816] GetLastError () returned 0x0 [0195.816] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x14e, lpOverlapped=0x0) returned 1 [0195.817] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x150, lpOverlapped=0x0) returned 1 [0195.818] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.818] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.818] SetEndOfFile (hFile=0x154) returned 1 [0195.818] CloseHandle (hObject=0x154) returned 1 [0195.818] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.818] SetEndOfFile (hFile=0x15c) returned 1 [0195.819] CloseHandle (hObject=0x15c) returned 1 [0195.819] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.819] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json")) returned 1 [0195.819] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.820] lstrlenW (lpString=".doc") returned 4 [0195.820] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.820] lstrlenW (lpString=".docx") returned 5 [0195.820] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.820] lstrlenW (lpString=".pdf") returned 4 [0195.820] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.820] lstrlenW (lpString=".xls") returned 4 [0195.820] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.820] lstrlenW (lpString=".xlsx") returned 5 [0195.820] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.820] lstrlenW (lpString=".ppt") returned 4 [0195.820] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.820] lstrlenW (lpString=".zip") returned 4 [0195.820] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.820] lstrlenW (lpString=".rar") returned 4 [0195.820] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.820] lstrlenW (lpString=".bz2") returned 4 [0195.820] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.820] lstrlenW (lpString=".7z") returned 3 [0195.820] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.820] lstrlenW (lpString=".dbf") returned 4 [0195.820] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.820] lstrlenW (lpString=".1cd") returned 4 [0195.820] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.820] lstrlenW (lpString=".jpg") returned 4 [0195.820] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.820] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.820] lstrlenW (lpString=".doc") returned 4 [0195.820] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.821] lstrlenW (lpString=".docx") returned 5 [0195.821] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.821] lstrlenW (lpString=".pdf") returned 4 [0195.821] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.821] lstrlenW (lpString=".xls") returned 4 [0195.821] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.821] lstrlenW (lpString=".xlsx") returned 5 [0195.821] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.821] lstrlenW (lpString=".ppt") returned 4 [0195.821] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.821] lstrlenW (lpString=".zip") returned 4 [0195.821] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.821] lstrlenW (lpString=".rar") returned 4 [0195.821] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.821] lstrlenW (lpString=".bz2") returned 4 [0195.821] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.821] lstrlenW (lpString=".7z") returned 3 [0195.821] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.821] lstrlenW (lpString=".dbf") returned 4 [0195.821] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.821] lstrlenW (lpString=".1cd") returned 4 [0195.821] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.821] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\si\\messages.json") returned 151 [0195.821] lstrlenW (lpString=".jpg") returned 4 [0195.821] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.821] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.821] lstrlenW (lpString="messages.json") returned 13 [0195.821] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.822] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=197) returned 1 [0195.822] CloseHandle (hObject=0x15c) returned 1 [0195.822] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json")) returned 0x2020 [0195.822] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.822] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.822] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.822] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0195.823] GetLastError () returned 0x0 [0195.823] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xc5, lpOverlapped=0x0) returned 1 [0195.981] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.982] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.982] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.983] SetEndOfFile (hFile=0x154) returned 1 [0195.983] CloseHandle (hObject=0x154) returned 1 [0195.983] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.983] SetEndOfFile (hFile=0x15c) returned 1 [0195.983] CloseHandle (hObject=0x15c) returned 1 [0195.984] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.984] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json")) returned 1 [0195.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.984] lstrlenW (lpString=".doc") returned 4 [0195.984] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.984] lstrlenW (lpString=".docx") returned 5 [0195.984] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.984] lstrlenW (lpString=".pdf") returned 4 [0195.984] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.984] lstrlenW (lpString=".xls") returned 4 [0195.984] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.984] lstrlenW (lpString=".xlsx") returned 5 [0195.984] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.984] lstrlenW (lpString=".ppt") returned 4 [0195.984] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.984] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.984] lstrlenW (lpString=".zip") returned 4 [0195.984] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.984] lstrlenW (lpString=".rar") returned 4 [0195.984] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.984] lstrlenW (lpString=".bz2") returned 4 [0195.984] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.985] lstrlenW (lpString=".7z") returned 3 [0195.985] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.985] lstrlenW (lpString=".dbf") returned 4 [0195.985] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.985] lstrlenW (lpString=".1cd") returned 4 [0195.985] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.985] lstrlenW (lpString=".jpg") returned 4 [0195.985] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.985] lstrlenW (lpString=".doc") returned 4 [0195.985] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.985] lstrlenW (lpString=".docx") returned 5 [0195.985] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.985] lstrlenW (lpString=".pdf") returned 4 [0195.985] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.985] lstrlenW (lpString=".xls") returned 4 [0195.985] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.985] lstrlenW (lpString=".xlsx") returned 5 [0195.985] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.985] lstrlenW (lpString=".ppt") returned 4 [0195.985] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.985] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.985] lstrlenW (lpString=".zip") returned 4 [0195.985] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.985] lstrlenW (lpString=".rar") returned 4 [0195.985] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.985] lstrlenW (lpString=".bz2") returned 4 [0195.985] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.985] lstrlenW (lpString=".7z") returned 3 [0195.985] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.986] lstrlenW (lpString=".dbf") returned 4 [0195.986] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.986] lstrlenW (lpString=".1cd") returned 4 [0195.986] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.986] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\sk\\messages.json") returned 151 [0195.986] lstrlenW (lpString=".jpg") returned 4 [0195.986] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.986] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.986] lstrlenW (lpString="messages.json") returned 13 [0195.986] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.986] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=194) returned 1 [0195.986] CloseHandle (hObject=0x15c) returned 1 [0195.987] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 0x2020 [0195.987] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.987] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.987] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0195.987] GetLastError () returned 0x0 [0195.987] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xc2, lpOverlapped=0x0) returned 1 [0195.988] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0195.989] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0195.989] WriteFile (in: hFile=0x154, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0195.989] SetEndOfFile (hFile=0x154) returned 1 [0195.989] CloseHandle (hObject=0x154) returned 1 [0195.990] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.990] SetEndOfFile (hFile=0x15c) returned 1 [0195.990] CloseHandle (hObject=0x15c) returned 1 [0195.990] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0195.991] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json")) returned 1 [0195.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.991] lstrlenW (lpString=".doc") returned 4 [0195.991] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.991] lstrlenW (lpString=".docx") returned 5 [0195.991] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.991] lstrlenW (lpString=".pdf") returned 4 [0195.991] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.991] lstrlenW (lpString=".xls") returned 4 [0195.991] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.991] lstrlenW (lpString=".xlsx") returned 5 [0195.991] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.991] lstrlenW (lpString=".ppt") returned 4 [0195.991] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.991] lstrlenW (lpString=".zip") returned 4 [0195.991] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.991] lstrlenW (lpString=".rar") returned 4 [0195.991] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.991] lstrlenW (lpString=".bz2") returned 4 [0195.991] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.991] lstrlenW (lpString=".7z") returned 3 [0195.991] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.991] lstrlenW (lpString=".dbf") returned 4 [0195.991] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.991] lstrlenW (lpString=".1cd") returned 4 [0195.992] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.992] lstrlenW (lpString=".jpg") returned 4 [0195.992] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.992] lstrlenW (lpString=".doc") returned 4 [0195.992] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0195.992] lstrlenW (lpString=".docx") returned 5 [0195.992] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0195.992] lstrlenW (lpString=".pdf") returned 4 [0195.992] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0195.992] lstrlenW (lpString=".xls") returned 4 [0195.992] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0195.992] lstrlenW (lpString=".xlsx") returned 5 [0195.992] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0195.992] lstrlenW (lpString=".ppt") returned 4 [0195.992] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0195.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.992] lstrlenW (lpString=".zip") returned 4 [0195.992] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0195.992] lstrlenW (lpString=".rar") returned 4 [0195.992] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0195.992] lstrlenW (lpString=".bz2") returned 4 [0195.992] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0195.992] lstrlenW (lpString=".7z") returned 3 [0195.992] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0195.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.992] lstrlenW (lpString=".dbf") returned 4 [0195.992] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0195.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.992] lstrlenW (lpString=".1cd") returned 4 [0195.992] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0195.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_locales\\zu\\messages.json") returned 151 [0195.993] lstrlenW (lpString=".jpg") returned 4 [0195.993] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0195.993] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0195.993] lstrlenW (lpString="computed_hashes.json") returned 20 [0195.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.993] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2803) returned 1 [0195.993] CloseHandle (hObject=0x15c) returned 1 [0195.993] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 0x2020 [0195.993] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0195.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0195.994] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.994] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0195.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.216] GetLastError () returned 0x0 [0196.216] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xaf3, lpOverlapped=0x0) returned 1 [0196.218] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xb00, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xb00, lpOverlapped=0x0) returned 1 [0196.219] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.219] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0196.219] SetEndOfFile (hFile=0x150) returned 1 [0196.219] CloseHandle (hObject=0x150) returned 1 [0196.219] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.219] SetEndOfFile (hFile=0x15c) returned 1 [0196.220] CloseHandle (hObject=0x15c) returned 1 [0196.220] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.220] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json")) returned 1 [0196.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.220] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.220] lstrlenW (lpString=".doc") returned 4 [0196.220] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.220] lstrlenW (lpString=".docx") returned 5 [0196.220] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.220] lstrlenW (lpString=".pdf") returned 4 [0196.220] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.220] lstrlenW (lpString=".xls") returned 4 [0196.220] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.220] lstrlenW (lpString=".xlsx") returned 5 [0196.221] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.221] lstrlenW (lpString=".ppt") returned 4 [0196.221] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.221] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.221] lstrlenW (lpString=".zip") returned 4 [0196.221] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.221] lstrlenW (lpString=".rar") returned 4 [0196.221] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.221] lstrlenW (lpString=".bz2") returned 4 [0196.221] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.221] lstrlenW (lpString=".7z") returned 3 [0196.221] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.221] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.221] lstrlenW (lpString=".dbf") returned 4 [0196.221] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.221] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.221] lstrlenW (lpString=".1cd") returned 4 [0196.221] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.221] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.221] lstrlenW (lpString=".jpg") returned 4 [0196.221] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.221] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.221] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.221] lstrlenW (lpString=".doc") returned 4 [0196.221] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.221] lstrlenW (lpString=".docx") returned 5 [0196.221] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.221] lstrlenW (lpString=".pdf") returned 4 [0196.221] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.221] lstrlenW (lpString=".xls") returned 4 [0196.221] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.221] lstrlenW (lpString=".xlsx") returned 5 [0196.221] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.221] lstrlenW (lpString=".ppt") returned 4 [0196.221] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.222] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.222] lstrlenW (lpString=".zip") returned 4 [0196.222] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.222] lstrlenW (lpString=".rar") returned 4 [0196.222] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.222] lstrlenW (lpString=".bz2") returned 4 [0196.222] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.222] lstrlenW (lpString=".7z") returned 3 [0196.222] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.222] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.222] lstrlenW (lpString=".dbf") returned 4 [0196.222] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.222] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.222] lstrlenW (lpString=".1cd") returned 4 [0196.222] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.222] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\1.4_0\\_metadata\\computed_hashes.json") returned 156 [0196.222] lstrlenW (lpString=".jpg") returned 4 [0196.222] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.222] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.222] lstrlenW (lpString="messages.json") returned 13 [0196.222] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.223] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=701) returned 1 [0196.223] CloseHandle (hObject=0x15c) returned 1 [0196.223] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 0x2020 [0196.223] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.223] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.223] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.223] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.224] GetLastError () returned 0x0 [0196.224] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2bd, lpOverlapped=0x0) returned 1 [0196.225] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0196.226] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.226] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.226] SetEndOfFile (hFile=0x150) returned 1 [0196.226] CloseHandle (hObject=0x150) returned 1 [0196.226] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.226] SetEndOfFile (hFile=0x15c) returned 1 [0196.227] CloseHandle (hObject=0x15c) returned 1 [0196.227] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.227] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json")) returned 1 [0196.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.227] lstrlenW (lpString=".doc") returned 4 [0196.227] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.227] lstrlenW (lpString=".docx") returned 5 [0196.228] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.228] lstrlenW (lpString=".pdf") returned 4 [0196.228] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.228] lstrlenW (lpString=".xls") returned 4 [0196.228] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.228] lstrlenW (lpString=".xlsx") returned 5 [0196.228] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.228] lstrlenW (lpString=".ppt") returned 4 [0196.228] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.228] lstrlenW (lpString=".zip") returned 4 [0196.228] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.228] lstrlenW (lpString=".rar") returned 4 [0196.228] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.228] lstrlenW (lpString=".bz2") returned 4 [0196.228] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.228] lstrlenW (lpString=".7z") returned 3 [0196.228] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.228] lstrlenW (lpString=".dbf") returned 4 [0196.228] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.228] lstrlenW (lpString=".1cd") returned 4 [0196.228] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.228] lstrlenW (lpString=".jpg") returned 4 [0196.228] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.228] lstrlenW (lpString=".doc") returned 4 [0196.228] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.228] lstrlenW (lpString=".docx") returned 5 [0196.228] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.231] lstrlenW (lpString=".pdf") returned 4 [0196.231] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.231] lstrlenW (lpString=".xls") returned 4 [0196.231] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.231] lstrlenW (lpString=".xlsx") returned 5 [0196.231] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.231] lstrlenW (lpString=".ppt") returned 4 [0196.231] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.231] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.232] lstrlenW (lpString=".zip") returned 4 [0196.232] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.232] lstrlenW (lpString=".rar") returned 4 [0196.232] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.232] lstrlenW (lpString=".bz2") returned 4 [0196.232] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.232] lstrlenW (lpString=".7z") returned 3 [0196.232] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.232] lstrlenW (lpString=".dbf") returned 4 [0196.232] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.232] lstrlenW (lpString=".1cd") returned 4 [0196.232] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.232] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\de\\messages.json") returned 155 [0196.232] lstrlenW (lpString=".jpg") returned 4 [0196.232] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.232] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.232] lstrlenW (lpString="messages.json") returned 13 [0196.232] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.233] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=875) returned 1 [0196.233] CloseHandle (hObject=0x15c) returned 1 [0196.233] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json")) returned 0x2020 [0196.233] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.233] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.233] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.233] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.234] GetLastError () returned 0x0 [0196.234] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x36b, lpOverlapped=0x0) returned 1 [0196.235] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x370, lpOverlapped=0x0) returned 1 [0196.236] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.236] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.236] SetEndOfFile (hFile=0x150) returned 1 [0196.237] CloseHandle (hObject=0x150) returned 1 [0196.237] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.237] SetEndOfFile (hFile=0x15c) returned 1 [0196.237] CloseHandle (hObject=0x15c) returned 1 [0196.237] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.238] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json")) returned 1 [0196.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.238] lstrlenW (lpString=".doc") returned 4 [0196.238] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.238] lstrlenW (lpString=".docx") returned 5 [0196.238] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.238] lstrlenW (lpString=".pdf") returned 4 [0196.238] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.238] lstrlenW (lpString=".xls") returned 4 [0196.238] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.238] lstrlenW (lpString=".xlsx") returned 5 [0196.238] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.238] lstrlenW (lpString=".ppt") returned 4 [0196.238] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.238] lstrlenW (lpString=".zip") returned 4 [0196.238] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.238] lstrlenW (lpString=".rar") returned 4 [0196.238] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.238] lstrlenW (lpString=".bz2") returned 4 [0196.238] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.238] lstrlenW (lpString=".7z") returned 3 [0196.238] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.238] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.238] lstrlenW (lpString=".dbf") returned 4 [0196.239] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.239] lstrlenW (lpString=".1cd") returned 4 [0196.239] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.239] lstrlenW (lpString=".jpg") returned 4 [0196.239] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.239] lstrlenW (lpString=".doc") returned 4 [0196.239] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.239] lstrlenW (lpString=".docx") returned 5 [0196.239] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.239] lstrlenW (lpString=".pdf") returned 4 [0196.239] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.239] lstrlenW (lpString=".xls") returned 4 [0196.239] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.239] lstrlenW (lpString=".xlsx") returned 5 [0196.239] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.239] lstrlenW (lpString=".ppt") returned 4 [0196.239] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.239] lstrlenW (lpString=".zip") returned 4 [0196.239] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.239] lstrlenW (lpString=".rar") returned 4 [0196.239] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.239] lstrlenW (lpString=".bz2") returned 4 [0196.239] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.239] lstrlenW (lpString=".7z") returned 3 [0196.239] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.239] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.239] lstrlenW (lpString=".dbf") returned 4 [0196.239] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.240] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.240] lstrlenW (lpString=".1cd") returned 4 [0196.240] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.240] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\el\\messages.json") returned 155 [0196.240] lstrlenW (lpString=".jpg") returned 4 [0196.240] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.240] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.240] lstrlenW (lpString="messages.json") returned 13 [0196.240] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.240] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=617) returned 1 [0196.240] CloseHandle (hObject=0x15c) returned 1 [0196.240] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json")) returned 0x2020 [0196.240] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.241] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.241] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.241] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.241] GetLastError () returned 0x0 [0196.241] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x269, lpOverlapped=0x0) returned 1 [0196.243] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x270, lpOverlapped=0x0) returned 1 [0196.244] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.244] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.244] SetEndOfFile (hFile=0x150) returned 1 [0196.244] CloseHandle (hObject=0x150) returned 1 [0196.244] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.244] SetEndOfFile (hFile=0x15c) returned 1 [0196.245] CloseHandle (hObject=0x15c) returned 1 [0196.245] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.245] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json")) returned 1 [0196.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.245] lstrlenW (lpString=".doc") returned 4 [0196.245] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.245] lstrlenW (lpString=".docx") returned 5 [0196.245] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.245] lstrlenW (lpString=".pdf") returned 4 [0196.245] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.245] lstrlenW (lpString=".xls") returned 4 [0196.245] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.245] lstrlenW (lpString=".xlsx") returned 5 [0196.246] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.246] lstrlenW (lpString=".ppt") returned 4 [0196.246] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.246] lstrlenW (lpString=".zip") returned 4 [0196.246] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.246] lstrlenW (lpString=".rar") returned 4 [0196.246] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.246] lstrlenW (lpString=".bz2") returned 4 [0196.246] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.246] lstrlenW (lpString=".7z") returned 3 [0196.246] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.246] lstrlenW (lpString=".dbf") returned 4 [0196.246] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.246] lstrlenW (lpString=".1cd") returned 4 [0196.246] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.246] lstrlenW (lpString=".jpg") returned 4 [0196.246] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.246] lstrlenW (lpString=".doc") returned 4 [0196.246] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.246] lstrlenW (lpString=".docx") returned 5 [0196.246] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.246] lstrlenW (lpString=".pdf") returned 4 [0196.246] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.246] lstrlenW (lpString=".xls") returned 4 [0196.246] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.246] lstrlenW (lpString=".xlsx") returned 5 [0196.246] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.246] lstrlenW (lpString=".ppt") returned 4 [0196.247] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.247] lstrlenW (lpString=".zip") returned 4 [0196.247] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.247] lstrlenW (lpString=".rar") returned 4 [0196.247] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.247] lstrlenW (lpString=".bz2") returned 4 [0196.247] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.247] lstrlenW (lpString=".7z") returned 3 [0196.247] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.247] lstrlenW (lpString=".dbf") returned 4 [0196.247] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.247] lstrlenW (lpString=".1cd") returned 4 [0196.247] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en\\messages.json") returned 155 [0196.247] lstrlenW (lpString=".jpg") returned 4 [0196.247] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.247] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.247] lstrlenW (lpString="messages.json") returned 13 [0196.247] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.248] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=617) returned 1 [0196.248] CloseHandle (hObject=0x15c) returned 1 [0196.248] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json")) returned 0x2020 [0196.248] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.248] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.248] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.249] GetLastError () returned 0x0 [0196.249] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x269, lpOverlapped=0x0) returned 1 [0196.250] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x270, lpOverlapped=0x0) returned 1 [0196.251] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.251] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.251] SetEndOfFile (hFile=0x150) returned 1 [0196.251] CloseHandle (hObject=0x150) returned 1 [0196.251] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.251] SetEndOfFile (hFile=0x15c) returned 1 [0196.252] CloseHandle (hObject=0x15c) returned 1 [0196.252] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.252] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_gb\\messages.json")) returned 1 [0196.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.253] lstrlenW (lpString=".doc") returned 4 [0196.253] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.253] lstrlenW (lpString=".docx") returned 5 [0196.253] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.253] lstrlenW (lpString=".pdf") returned 4 [0196.253] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.253] lstrlenW (lpString=".xls") returned 4 [0196.253] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.253] lstrlenW (lpString=".xlsx") returned 5 [0196.253] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.253] lstrlenW (lpString=".ppt") returned 4 [0196.253] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.253] lstrlenW (lpString=".zip") returned 4 [0196.253] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.253] lstrlenW (lpString=".rar") returned 4 [0196.253] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.253] lstrlenW (lpString=".bz2") returned 4 [0196.253] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.253] lstrlenW (lpString=".7z") returned 3 [0196.253] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.253] lstrlenW (lpString=".dbf") returned 4 [0196.253] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.253] lstrlenW (lpString=".1cd") returned 4 [0196.253] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.253] lstrlenW (lpString=".jpg") returned 4 [0196.253] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.254] lstrlenW (lpString=".doc") returned 4 [0196.254] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.254] lstrlenW (lpString=".docx") returned 5 [0196.254] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.254] lstrlenW (lpString=".pdf") returned 4 [0196.254] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.254] lstrlenW (lpString=".xls") returned 4 [0196.254] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.254] lstrlenW (lpString=".xlsx") returned 5 [0196.254] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.254] lstrlenW (lpString=".ppt") returned 4 [0196.254] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.254] lstrlenW (lpString=".zip") returned 4 [0196.254] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.254] lstrlenW (lpString=".rar") returned 4 [0196.254] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.254] lstrlenW (lpString=".bz2") returned 4 [0196.254] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.254] lstrlenW (lpString=".7z") returned 3 [0196.254] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.254] lstrlenW (lpString=".dbf") returned 4 [0196.254] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.254] lstrlenW (lpString=".1cd") returned 4 [0196.254] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\en_GB\\messages.json") returned 158 [0196.254] lstrlenW (lpString=".jpg") returned 4 [0196.254] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.255] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.255] lstrlenW (lpString="messages.json") returned 13 [0196.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.255] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=696) returned 1 [0196.255] CloseHandle (hObject=0x15c) returned 1 [0196.255] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json")) returned 0x2020 [0196.255] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.255] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.255] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.256] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.256] GetLastError () returned 0x0 [0196.256] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2b8, lpOverlapped=0x0) returned 1 [0196.429] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0196.458] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.458] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.458] SetEndOfFile (hFile=0x150) returned 1 [0196.458] CloseHandle (hObject=0x150) returned 1 [0196.459] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.459] SetEndOfFile (hFile=0x15c) returned 1 [0196.459] CloseHandle (hObject=0x15c) returned 1 [0196.459] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.460] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json")) returned 1 [0196.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.460] lstrlenW (lpString=".doc") returned 4 [0196.460] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.460] lstrlenW (lpString=".docx") returned 5 [0196.460] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.460] lstrlenW (lpString=".pdf") returned 4 [0196.460] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.460] lstrlenW (lpString=".xls") returned 4 [0196.460] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.460] lstrlenW (lpString=".xlsx") returned 5 [0196.460] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.460] lstrlenW (lpString=".ppt") returned 4 [0196.460] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.460] lstrlenW (lpString=".zip") returned 4 [0196.460] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.460] lstrlenW (lpString=".rar") returned 4 [0196.460] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.460] lstrlenW (lpString=".bz2") returned 4 [0196.460] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.460] lstrlenW (lpString=".7z") returned 3 [0196.460] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.460] lstrlenW (lpString=".dbf") returned 4 [0196.460] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.460] lstrlenW (lpString=".1cd") returned 4 [0196.461] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.461] lstrlenW (lpString=".jpg") returned 4 [0196.461] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.461] lstrlenW (lpString=".doc") returned 4 [0196.461] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.461] lstrlenW (lpString=".docx") returned 5 [0196.461] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.461] lstrlenW (lpString=".pdf") returned 4 [0196.461] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.461] lstrlenW (lpString=".xls") returned 4 [0196.461] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.461] lstrlenW (lpString=".xlsx") returned 5 [0196.461] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.461] lstrlenW (lpString=".ppt") returned 4 [0196.461] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.461] lstrlenW (lpString=".zip") returned 4 [0196.461] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.461] lstrlenW (lpString=".rar") returned 4 [0196.461] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.461] lstrlenW (lpString=".bz2") returned 4 [0196.461] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.461] lstrlenW (lpString=".7z") returned 3 [0196.461] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.461] lstrlenW (lpString=".dbf") returned 4 [0196.461] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.461] lstrlenW (lpString=".1cd") returned 4 [0196.461] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.461] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\es\\messages.json") returned 155 [0196.462] lstrlenW (lpString=".jpg") returned 4 [0196.462] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.462] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.462] lstrlenW (lpString="messages.json") returned 13 [0196.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.462] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=642) returned 1 [0196.462] CloseHandle (hObject=0x15c) returned 1 [0196.462] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json")) returned 0x2020 [0196.462] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.463] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.463] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.463] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.463] GetLastError () returned 0x0 [0196.463] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x282, lpOverlapped=0x0) returned 1 [0196.465] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x290, lpOverlapped=0x0) returned 1 [0196.466] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.466] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.466] SetEndOfFile (hFile=0x150) returned 1 [0196.466] CloseHandle (hObject=0x150) returned 1 [0196.466] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.466] SetEndOfFile (hFile=0x15c) returned 1 [0196.467] CloseHandle (hObject=0x15c) returned 1 [0196.467] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.467] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json")) returned 1 [0196.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.467] lstrlenW (lpString=".doc") returned 4 [0196.467] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.467] lstrlenW (lpString=".docx") returned 5 [0196.467] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.467] lstrlenW (lpString=".pdf") returned 4 [0196.467] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.467] lstrlenW (lpString=".xls") returned 4 [0196.467] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.467] lstrlenW (lpString=".xlsx") returned 5 [0196.467] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.467] lstrlenW (lpString=".ppt") returned 4 [0196.467] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.467] lstrlenW (lpString=".zip") returned 4 [0196.467] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.468] lstrlenW (lpString=".rar") returned 4 [0196.468] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.468] lstrlenW (lpString=".bz2") returned 4 [0196.468] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.468] lstrlenW (lpString=".7z") returned 3 [0196.468] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.468] lstrlenW (lpString=".dbf") returned 4 [0196.468] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.468] lstrlenW (lpString=".1cd") returned 4 [0196.468] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.468] lstrlenW (lpString=".jpg") returned 4 [0196.468] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.468] lstrlenW (lpString=".doc") returned 4 [0196.468] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.468] lstrlenW (lpString=".docx") returned 5 [0196.468] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.468] lstrlenW (lpString=".pdf") returned 4 [0196.468] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.468] lstrlenW (lpString=".xls") returned 4 [0196.468] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.468] lstrlenW (lpString=".xlsx") returned 5 [0196.468] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.468] lstrlenW (lpString=".ppt") returned 4 [0196.468] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.468] lstrlenW (lpString=".zip") returned 4 [0196.468] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.468] lstrlenW (lpString=".rar") returned 4 [0196.468] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.469] lstrlenW (lpString=".bz2") returned 4 [0196.469] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.469] lstrlenW (lpString=".7z") returned 3 [0196.469] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.469] lstrlenW (lpString=".dbf") returned 4 [0196.469] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.469] lstrlenW (lpString=".1cd") returned 4 [0196.469] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.469] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\nl\\messages.json") returned 155 [0196.469] lstrlenW (lpString=".jpg") returned 4 [0196.469] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.469] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.469] lstrlenW (lpString="messages.json") returned 13 [0196.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.469] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=666) returned 1 [0196.470] CloseHandle (hObject=0x15c) returned 1 [0196.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json")) returned 0x2020 [0196.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.470] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.470] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.470] GetLastError () returned 0x0 [0196.470] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x29a, lpOverlapped=0x0) returned 1 [0196.472] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0196.473] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.473] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.473] SetEndOfFile (hFile=0x150) returned 1 [0196.473] CloseHandle (hObject=0x150) returned 1 [0196.473] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.473] SetEndOfFile (hFile=0x15c) returned 1 [0196.476] CloseHandle (hObject=0x15c) returned 1 [0196.476] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.476] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json")) returned 1 [0196.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.476] lstrlenW (lpString=".doc") returned 4 [0196.476] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.476] lstrlenW (lpString=".docx") returned 5 [0196.476] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.476] lstrlenW (lpString=".pdf") returned 4 [0196.476] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.476] lstrlenW (lpString=".xls") returned 4 [0196.476] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.476] lstrlenW (lpString=".xlsx") returned 5 [0196.476] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.476] lstrlenW (lpString=".ppt") returned 4 [0196.476] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.476] lstrlenW (lpString=".zip") returned 4 [0196.476] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.476] lstrlenW (lpString=".rar") returned 4 [0196.476] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.476] lstrlenW (lpString=".bz2") returned 4 [0196.477] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.477] lstrlenW (lpString=".7z") returned 3 [0196.477] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.477] lstrlenW (lpString=".dbf") returned 4 [0196.477] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.477] lstrlenW (lpString=".1cd") returned 4 [0196.477] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.477] lstrlenW (lpString=".jpg") returned 4 [0196.477] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.477] lstrlenW (lpString=".doc") returned 4 [0196.477] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.477] lstrlenW (lpString=".docx") returned 5 [0196.477] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.477] lstrlenW (lpString=".pdf") returned 4 [0196.477] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.477] lstrlenW (lpString=".xls") returned 4 [0196.477] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.477] lstrlenW (lpString=".xlsx") returned 5 [0196.477] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.477] lstrlenW (lpString=".ppt") returned 4 [0196.477] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.477] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.477] lstrlenW (lpString=".zip") returned 4 [0196.477] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.477] lstrlenW (lpString=".rar") returned 4 [0196.477] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.477] lstrlenW (lpString=".bz2") returned 4 [0196.477] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.477] lstrlenW (lpString=".7z") returned 3 [0196.478] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.478] lstrlenW (lpString=".dbf") returned 4 [0196.478] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.478] lstrlenW (lpString=".1cd") returned 4 [0196.478] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.478] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pl\\messages.json") returned 155 [0196.478] lstrlenW (lpString=".jpg") returned 4 [0196.478] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.478] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.478] lstrlenW (lpString="messages.json") returned 13 [0196.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.478] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=667) returned 1 [0196.479] CloseHandle (hObject=0x15c) returned 1 [0196.479] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0196.479] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.479] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.479] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.479] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.479] GetLastError () returned 0x0 [0196.479] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x29b, lpOverlapped=0x0) returned 1 [0196.481] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0196.482] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.482] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.482] SetEndOfFile (hFile=0x150) returned 1 [0196.482] CloseHandle (hObject=0x150) returned 1 [0196.482] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.482] SetEndOfFile (hFile=0x15c) returned 1 [0196.483] CloseHandle (hObject=0x15c) returned 1 [0196.483] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.483] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_br\\messages.json")) returned 1 [0196.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.483] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.483] lstrlenW (lpString=".doc") returned 4 [0196.483] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.483] lstrlenW (lpString=".docx") returned 5 [0196.483] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.483] lstrlenW (lpString=".pdf") returned 4 [0196.484] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.484] lstrlenW (lpString=".xls") returned 4 [0196.484] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.484] lstrlenW (lpString=".xlsx") returned 5 [0196.484] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.484] lstrlenW (lpString=".ppt") returned 4 [0196.484] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.484] lstrlenW (lpString=".zip") returned 4 [0196.484] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.484] lstrlenW (lpString=".rar") returned 4 [0196.484] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.484] lstrlenW (lpString=".bz2") returned 4 [0196.484] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.484] lstrlenW (lpString=".7z") returned 3 [0196.484] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.484] lstrlenW (lpString=".dbf") returned 4 [0196.484] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.484] lstrlenW (lpString=".1cd") returned 4 [0196.484] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.484] lstrlenW (lpString=".jpg") returned 4 [0196.484] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.484] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.484] lstrlenW (lpString=".doc") returned 4 [0196.484] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.484] lstrlenW (lpString=".docx") returned 5 [0196.484] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.484] lstrlenW (lpString=".pdf") returned 4 [0196.484] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.484] lstrlenW (lpString=".xls") returned 4 [0196.484] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.485] lstrlenW (lpString=".xlsx") returned 5 [0196.485] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.485] lstrlenW (lpString=".ppt") returned 4 [0196.485] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.485] lstrlenW (lpString=".zip") returned 4 [0196.485] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.485] lstrlenW (lpString=".rar") returned 4 [0196.485] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.485] lstrlenW (lpString=".bz2") returned 4 [0196.485] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.485] lstrlenW (lpString=".7z") returned 3 [0196.485] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.485] lstrlenW (lpString=".dbf") returned 4 [0196.485] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.485] lstrlenW (lpString=".1cd") returned 4 [0196.485] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_BR\\messages.json") returned 158 [0196.485] lstrlenW (lpString=".jpg") returned 4 [0196.485] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.485] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.485] lstrlenW (lpString="messages.json") returned 13 [0196.485] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.493] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=661) returned 1 [0196.493] CloseHandle (hObject=0x15c) returned 1 [0196.493] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0196.493] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.493] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.493] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.493] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.655] GetLastError () returned 0x0 [0196.655] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x295, lpOverlapped=0x0) returned 1 [0196.688] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0196.689] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.689] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.689] SetEndOfFile (hFile=0x150) returned 1 [0196.689] CloseHandle (hObject=0x150) returned 1 [0196.689] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.689] SetEndOfFile (hFile=0x15c) returned 1 [0196.690] CloseHandle (hObject=0x15c) returned 1 [0196.690] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.690] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_pt\\messages.json")) returned 1 [0196.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.690] lstrlenW (lpString=".doc") returned 4 [0196.690] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.690] lstrlenW (lpString=".docx") returned 5 [0196.690] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.690] lstrlenW (lpString=".pdf") returned 4 [0196.690] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.690] lstrlenW (lpString=".xls") returned 4 [0196.691] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.691] lstrlenW (lpString=".xlsx") returned 5 [0196.691] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.691] lstrlenW (lpString=".ppt") returned 4 [0196.691] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.691] lstrlenW (lpString=".zip") returned 4 [0196.691] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.691] lstrlenW (lpString=".rar") returned 4 [0196.691] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.691] lstrlenW (lpString=".bz2") returned 4 [0196.691] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.691] lstrlenW (lpString=".7z") returned 3 [0196.691] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.691] lstrlenW (lpString=".dbf") returned 4 [0196.691] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.691] lstrlenW (lpString=".1cd") returned 4 [0196.691] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.691] lstrlenW (lpString=".jpg") returned 4 [0196.691] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.691] lstrlenW (lpString=".doc") returned 4 [0196.691] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.691] lstrlenW (lpString=".docx") returned 5 [0196.691] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.691] lstrlenW (lpString=".pdf") returned 4 [0196.691] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.691] lstrlenW (lpString=".xls") returned 4 [0196.691] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.692] lstrlenW (lpString=".xlsx") returned 5 [0196.692] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.692] lstrlenW (lpString=".ppt") returned 4 [0196.692] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.692] lstrlenW (lpString=".zip") returned 4 [0196.692] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.692] lstrlenW (lpString=".rar") returned 4 [0196.692] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.692] lstrlenW (lpString=".bz2") returned 4 [0196.692] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.692] lstrlenW (lpString=".7z") returned 3 [0196.692] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.692] lstrlenW (lpString=".dbf") returned 4 [0196.692] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.692] lstrlenW (lpString=".1cd") returned 4 [0196.692] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.692] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\nmmhkkegccagdldgiimedpiccmgmieda\\1.0.0.2_0\\_locales\\pt_PT\\messages.json") returned 158 [0196.692] lstrlenW (lpString=".jpg") returned 4 [0196.692] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.692] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.692] lstrlenW (lpString="messages.json") returned 13 [0196.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.696] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=312) returned 1 [0196.696] CloseHandle (hObject=0x15c) returned 1 [0196.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 0x2020 [0196.696] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.696] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.696] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.696] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.697] GetLastError () returned 0x0 [0196.697] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x138, lpOverlapped=0x0) returned 1 [0196.698] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x140, lpOverlapped=0x0) returned 1 [0196.699] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.699] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.699] SetEndOfFile (hFile=0x150) returned 1 [0196.699] CloseHandle (hObject=0x150) returned 1 [0196.699] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.699] SetEndOfFile (hFile=0x15c) returned 1 [0196.700] CloseHandle (hObject=0x15c) returned 1 [0196.700] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.700] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json")) returned 1 [0196.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.700] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.700] lstrlenW (lpString=".doc") returned 4 [0196.700] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.700] lstrlenW (lpString=".docx") returned 5 [0196.700] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.700] lstrlenW (lpString=".pdf") returned 4 [0196.701] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.701] lstrlenW (lpString=".xls") returned 4 [0196.701] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.701] lstrlenW (lpString=".xlsx") returned 5 [0196.701] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.701] lstrlenW (lpString=".ppt") returned 4 [0196.701] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.701] lstrlenW (lpString=".zip") returned 4 [0196.701] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.701] lstrlenW (lpString=".rar") returned 4 [0196.701] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.701] lstrlenW (lpString=".bz2") returned 4 [0196.701] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.701] lstrlenW (lpString=".7z") returned 3 [0196.701] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.701] lstrlenW (lpString=".dbf") returned 4 [0196.701] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.701] lstrlenW (lpString=".1cd") returned 4 [0196.701] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.701] lstrlenW (lpString=".jpg") returned 4 [0196.701] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.701] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.701] lstrlenW (lpString=".doc") returned 4 [0196.701] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.701] lstrlenW (lpString=".docx") returned 5 [0196.701] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.701] lstrlenW (lpString=".pdf") returned 4 [0196.701] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.701] lstrlenW (lpString=".xls") returned 4 [0196.702] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.702] lstrlenW (lpString=".xlsx") returned 5 [0196.702] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.702] lstrlenW (lpString=".ppt") returned 4 [0196.702] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.702] lstrlenW (lpString=".zip") returned 4 [0196.702] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.702] lstrlenW (lpString=".rar") returned 4 [0196.702] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.702] lstrlenW (lpString=".bz2") returned 4 [0196.702] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.702] lstrlenW (lpString=".7z") returned 3 [0196.702] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.702] lstrlenW (lpString=".dbf") returned 4 [0196.702] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.702] lstrlenW (lpString=".1cd") returned 4 [0196.702] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.702] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ar\\messages.json") returned 151 [0196.702] lstrlenW (lpString=".jpg") returned 4 [0196.702] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.702] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.702] lstrlenW (lpString="messages.json") returned 13 [0196.702] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.703] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=292) returned 1 [0196.703] CloseHandle (hObject=0x15c) returned 1 [0196.703] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 0x2020 [0196.703] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.703] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.703] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.703] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.704] GetLastError () returned 0x0 [0196.704] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x124, lpOverlapped=0x0) returned 1 [0196.705] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x130, lpOverlapped=0x0) returned 1 [0196.705] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.705] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.706] SetEndOfFile (hFile=0x150) returned 1 [0196.706] CloseHandle (hObject=0x150) returned 1 [0196.706] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.706] SetEndOfFile (hFile=0x15c) returned 1 [0196.707] CloseHandle (hObject=0x15c) returned 1 [0196.707] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.707] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json")) returned 1 [0196.707] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.707] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.707] lstrlenW (lpString=".doc") returned 4 [0196.707] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.707] lstrlenW (lpString=".docx") returned 5 [0196.707] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.707] lstrlenW (lpString=".pdf") returned 4 [0196.707] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.707] lstrlenW (lpString=".xls") returned 4 [0196.707] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.707] lstrlenW (lpString=".xlsx") returned 5 [0196.707] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.707] lstrlenW (lpString=".ppt") returned 4 [0196.707] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.707] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.707] lstrlenW (lpString=".zip") returned 4 [0196.707] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.707] lstrlenW (lpString=".rar") returned 4 [0196.708] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.708] lstrlenW (lpString=".bz2") returned 4 [0196.708] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.708] lstrlenW (lpString=".7z") returned 3 [0196.708] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.708] lstrlenW (lpString=".dbf") returned 4 [0196.708] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.708] lstrlenW (lpString=".1cd") returned 4 [0196.708] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.708] lstrlenW (lpString=".jpg") returned 4 [0196.708] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.708] lstrlenW (lpString=".doc") returned 4 [0196.708] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.708] lstrlenW (lpString=".docx") returned 5 [0196.708] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.708] lstrlenW (lpString=".pdf") returned 4 [0196.708] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.708] lstrlenW (lpString=".xls") returned 4 [0196.708] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.708] lstrlenW (lpString=".xlsx") returned 5 [0196.708] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.708] lstrlenW (lpString=".ppt") returned 4 [0196.708] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.708] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.708] lstrlenW (lpString=".zip") returned 4 [0196.708] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.708] lstrlenW (lpString=".rar") returned 4 [0196.708] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.708] lstrlenW (lpString=".bz2") returned 4 [0196.709] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.709] lstrlenW (lpString=".7z") returned 3 [0196.709] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.709] lstrlenW (lpString=".dbf") returned 4 [0196.709] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.709] lstrlenW (lpString=".1cd") returned 4 [0196.709] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.709] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\bg\\messages.json") returned 151 [0196.709] lstrlenW (lpString=".jpg") returned 4 [0196.709] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.709] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.709] lstrlenW (lpString="messages.json") returned 13 [0196.709] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.710] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=254) returned 1 [0196.710] CloseHandle (hObject=0x15c) returned 1 [0196.712] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 0x2020 [0196.712] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.712] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.712] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.712] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.713] GetLastError () returned 0x0 [0196.713] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xfe, lpOverlapped=0x0) returned 1 [0196.714] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0196.715] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.715] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.715] SetEndOfFile (hFile=0x150) returned 1 [0196.715] CloseHandle (hObject=0x150) returned 1 [0196.715] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.715] SetEndOfFile (hFile=0x15c) returned 1 [0196.716] CloseHandle (hObject=0x15c) returned 1 [0196.716] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.716] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json")) returned 1 [0196.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.716] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.716] lstrlenW (lpString=".doc") returned 4 [0196.716] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.716] lstrlenW (lpString=".docx") returned 5 [0196.716] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.716] lstrlenW (lpString=".pdf") returned 4 [0196.716] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.716] lstrlenW (lpString=".xls") returned 4 [0196.717] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.717] lstrlenW (lpString=".xlsx") returned 5 [0196.717] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.717] lstrlenW (lpString=".ppt") returned 4 [0196.717] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.717] lstrlenW (lpString=".zip") returned 4 [0196.717] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.717] lstrlenW (lpString=".rar") returned 4 [0196.717] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.717] lstrlenW (lpString=".bz2") returned 4 [0196.717] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.717] lstrlenW (lpString=".7z") returned 3 [0196.717] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.717] lstrlenW (lpString=".dbf") returned 4 [0196.717] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.717] lstrlenW (lpString=".1cd") returned 4 [0196.717] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.717] lstrlenW (lpString=".jpg") returned 4 [0196.717] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.717] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.717] lstrlenW (lpString=".doc") returned 4 [0196.717] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.717] lstrlenW (lpString=".docx") returned 5 [0196.717] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.717] lstrlenW (lpString=".pdf") returned 4 [0196.717] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.717] lstrlenW (lpString=".xls") returned 4 [0196.717] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.717] lstrlenW (lpString=".xlsx") returned 5 [0196.718] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.718] lstrlenW (lpString=".ppt") returned 4 [0196.718] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.718] lstrlenW (lpString=".zip") returned 4 [0196.718] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.718] lstrlenW (lpString=".rar") returned 4 [0196.718] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.718] lstrlenW (lpString=".bz2") returned 4 [0196.718] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.718] lstrlenW (lpString=".7z") returned 3 [0196.718] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.718] lstrlenW (lpString=".dbf") returned 4 [0196.718] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.718] lstrlenW (lpString=".1cd") returned 4 [0196.718] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.718] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ca\\messages.json") returned 151 [0196.718] lstrlenW (lpString=".jpg") returned 4 [0196.718] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.718] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.718] lstrlenW (lpString="messages.json") returned 13 [0196.718] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.719] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=249) returned 1 [0196.719] CloseHandle (hObject=0x15c) returned 1 [0196.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 0x2020 [0196.719] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0196.719] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.719] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.719] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0196.720] GetLastError () returned 0x0 [0196.720] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xf9, lpOverlapped=0x0) returned 1 [0196.721] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0196.721] ReadFile (in: hFile=0x15c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.721] WriteFile (in: hFile=0x150, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.722] SetEndOfFile (hFile=0x150) returned 1 [0196.722] CloseHandle (hObject=0x150) returned 1 [0196.722] SetFilePointerEx (in: hFile=0x15c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.722] SetEndOfFile (hFile=0x15c) returned 1 [0196.723] CloseHandle (hObject=0x15c) returned 1 [0196.723] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.723] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json")) returned 1 [0196.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.723] lstrlenW (lpString=".doc") returned 4 [0196.723] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.723] lstrlenW (lpString=".docx") returned 5 [0196.723] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.723] lstrlenW (lpString=".pdf") returned 4 [0196.723] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.723] lstrlenW (lpString=".xls") returned 4 [0196.723] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.723] lstrlenW (lpString=".xlsx") returned 5 [0196.723] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.723] lstrlenW (lpString=".ppt") returned 4 [0196.723] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.723] lstrlenW (lpString=".zip") returned 4 [0196.723] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.723] lstrlenW (lpString=".rar") returned 4 [0196.723] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.724] lstrlenW (lpString=".bz2") returned 4 [0196.724] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.724] lstrlenW (lpString=".7z") returned 3 [0196.724] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.724] lstrlenW (lpString=".dbf") returned 4 [0196.724] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.724] lstrlenW (lpString=".1cd") returned 4 [0196.724] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.724] lstrlenW (lpString=".jpg") returned 4 [0196.724] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.724] lstrlenW (lpString=".doc") returned 4 [0196.724] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.724] lstrlenW (lpString=".docx") returned 5 [0196.724] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.724] lstrlenW (lpString=".pdf") returned 4 [0196.724] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.724] lstrlenW (lpString=".xls") returned 4 [0196.724] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.724] lstrlenW (lpString=".xlsx") returned 5 [0196.724] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.724] lstrlenW (lpString=".ppt") returned 4 [0196.724] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.724] lstrlenW (lpString=".zip") returned 4 [0196.724] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.724] lstrlenW (lpString=".rar") returned 4 [0196.724] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.724] lstrlenW (lpString=".bz2") returned 4 [0196.724] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.725] lstrlenW (lpString=".7z") returned 3 [0196.725] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.725] lstrlenW (lpString=".dbf") returned 4 [0196.725] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.725] lstrlenW (lpString=".1cd") returned 4 [0196.725] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\cs\\messages.json") returned 151 [0196.725] lstrlenW (lpString=".jpg") returned 4 [0196.725] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.725] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.725] lstrlenW (lpString="messages.json") returned 13 [0196.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.786] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=236) returned 1 [0196.786] CloseHandle (hObject=0x154) returned 1 [0196.786] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 0x2020 [0196.786] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.786] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.786] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.786] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.787] GetLastError () returned 0x0 [0196.787] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xec, lpOverlapped=0x0) returned 1 [0196.788] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0196.788] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.789] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.789] SetEndOfFile (hFile=0x114) returned 1 [0196.789] CloseHandle (hObject=0x114) returned 1 [0196.789] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.789] SetEndOfFile (hFile=0x154) returned 1 [0196.790] CloseHandle (hObject=0x154) returned 1 [0196.790] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.790] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json")) returned 1 [0196.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.790] lstrlenW (lpString=".doc") returned 4 [0196.790] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.790] lstrlenW (lpString=".docx") returned 5 [0196.790] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.790] lstrlenW (lpString=".pdf") returned 4 [0196.790] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.790] lstrlenW (lpString=".xls") returned 4 [0196.790] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.790] lstrlenW (lpString=".xlsx") returned 5 [0196.791] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.791] lstrlenW (lpString=".ppt") returned 4 [0196.791] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.791] lstrlenW (lpString=".zip") returned 4 [0196.791] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.791] lstrlenW (lpString=".rar") returned 4 [0196.791] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.791] lstrlenW (lpString=".bz2") returned 4 [0196.791] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.791] lstrlenW (lpString=".7z") returned 3 [0196.791] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.791] lstrlenW (lpString=".dbf") returned 4 [0196.791] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.791] lstrlenW (lpString=".1cd") returned 4 [0196.791] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.791] lstrlenW (lpString=".jpg") returned 4 [0196.791] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.791] lstrlenW (lpString=".doc") returned 4 [0196.791] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.791] lstrlenW (lpString=".docx") returned 5 [0196.791] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.791] lstrlenW (lpString=".pdf") returned 4 [0196.791] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.791] lstrlenW (lpString=".xls") returned 4 [0196.791] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.791] lstrlenW (lpString=".xlsx") returned 5 [0196.791] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.792] lstrlenW (lpString=".ppt") returned 4 [0196.792] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.792] lstrlenW (lpString=".zip") returned 4 [0196.792] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.792] lstrlenW (lpString=".rar") returned 4 [0196.792] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.792] lstrlenW (lpString=".bz2") returned 4 [0196.792] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.792] lstrlenW (lpString=".7z") returned 3 [0196.792] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.792] lstrlenW (lpString=".dbf") returned 4 [0196.792] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.792] lstrlenW (lpString=".1cd") returned 4 [0196.792] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\da\\messages.json") returned 151 [0196.792] lstrlenW (lpString=".jpg") returned 4 [0196.792] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.792] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.792] lstrlenW (lpString="messages.json") returned 13 [0196.792] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.891] GetFileSizeEx (in: hFile=0x35c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=256) returned 1 [0196.891] CloseHandle (hObject=0x35c) returned 1 [0196.891] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 0x2020 [0196.891] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x35c [0196.891] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.891] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0196.892] GetLastError () returned 0x0 [0196.892] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x100, lpOverlapped=0x0) returned 1 [0196.893] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x110, lpOverlapped=0x0) returned 1 [0196.893] ReadFile (in: hFile=0x35c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.893] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.894] SetEndOfFile (hFile=0x388) returned 1 [0196.894] CloseHandle (hObject=0x388) returned 1 [0196.894] SetFilePointerEx (in: hFile=0x35c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.894] SetEndOfFile (hFile=0x35c) returned 1 [0196.894] CloseHandle (hObject=0x35c) returned 1 [0196.895] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.895] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json")) returned 1 [0196.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.895] lstrlenW (lpString=".doc") returned 4 [0196.895] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.895] lstrlenW (lpString=".docx") returned 5 [0196.895] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.895] lstrlenW (lpString=".pdf") returned 4 [0196.895] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.895] lstrlenW (lpString=".xls") returned 4 [0196.895] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.895] lstrlenW (lpString=".xlsx") returned 5 [0196.895] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.895] lstrlenW (lpString=".ppt") returned 4 [0196.895] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.895] lstrlenW (lpString=".zip") returned 4 [0196.895] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.895] lstrlenW (lpString=".rar") returned 4 [0196.895] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.895] lstrlenW (lpString=".bz2") returned 4 [0196.895] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.895] lstrlenW (lpString=".7z") returned 3 [0196.895] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.896] lstrlenW (lpString=".dbf") returned 4 [0196.896] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.896] lstrlenW (lpString=".1cd") returned 4 [0196.896] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.896] lstrlenW (lpString=".jpg") returned 4 [0196.896] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.896] lstrlenW (lpString=".doc") returned 4 [0196.896] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.896] lstrlenW (lpString=".docx") returned 5 [0196.896] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.896] lstrlenW (lpString=".pdf") returned 4 [0196.896] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.896] lstrlenW (lpString=".xls") returned 4 [0196.896] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.896] lstrlenW (lpString=".xlsx") returned 5 [0196.896] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.896] lstrlenW (lpString=".ppt") returned 4 [0196.896] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.896] lstrlenW (lpString=".zip") returned 4 [0196.896] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.896] lstrlenW (lpString=".rar") returned 4 [0196.896] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.896] lstrlenW (lpString=".bz2") returned 4 [0196.896] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.896] lstrlenW (lpString=".7z") returned 3 [0196.896] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.897] lstrlenW (lpString=".dbf") returned 4 [0196.897] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.897] lstrlenW (lpString=".1cd") returned 4 [0196.897] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\fi\\messages.json") returned 151 [0196.897] lstrlenW (lpString=".jpg") returned 4 [0196.897] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.897] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.897] lstrlenW (lpString="messages.json") returned 13 [0196.897] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.987] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=253) returned 1 [0196.987] CloseHandle (hObject=0x154) returned 1 [0196.987] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 0x2020 [0196.987] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.987] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.987] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.988] GetLastError () returned 0x0 [0196.988] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xfd, lpOverlapped=0x0) returned 1 [0196.989] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0196.990] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.990] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.990] SetEndOfFile (hFile=0x114) returned 1 [0196.990] CloseHandle (hObject=0x114) returned 1 [0196.990] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.990] SetEndOfFile (hFile=0x154) returned 1 [0196.991] CloseHandle (hObject=0x154) returned 1 [0196.991] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.991] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json")) returned 1 [0196.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.991] lstrlenW (lpString=".doc") returned 4 [0196.991] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.991] lstrlenW (lpString=".docx") returned 5 [0196.991] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.991] lstrlenW (lpString=".pdf") returned 4 [0196.991] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.991] lstrlenW (lpString=".xls") returned 4 [0196.991] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.991] lstrlenW (lpString=".xlsx") returned 5 [0196.991] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.991] lstrlenW (lpString=".ppt") returned 4 [0196.991] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.991] lstrlenW (lpString=".zip") returned 4 [0196.991] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.992] lstrlenW (lpString=".rar") returned 4 [0196.992] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.992] lstrlenW (lpString=".bz2") returned 4 [0196.992] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.992] lstrlenW (lpString=".7z") returned 3 [0196.992] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.992] lstrlenW (lpString=".dbf") returned 4 [0196.992] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.992] lstrlenW (lpString=".1cd") returned 4 [0196.992] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.992] lstrlenW (lpString=".jpg") returned 4 [0196.992] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.992] lstrlenW (lpString=".doc") returned 4 [0196.992] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.992] lstrlenW (lpString=".docx") returned 5 [0196.992] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.992] lstrlenW (lpString=".pdf") returned 4 [0196.992] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.992] lstrlenW (lpString=".xls") returned 4 [0196.992] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.992] lstrlenW (lpString=".xlsx") returned 5 [0196.992] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.992] lstrlenW (lpString=".ppt") returned 4 [0196.992] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.992] lstrlenW (lpString=".zip") returned 4 [0196.992] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.992] lstrlenW (lpString=".rar") returned 4 [0196.992] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.993] lstrlenW (lpString=".bz2") returned 4 [0196.993] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.993] lstrlenW (lpString=".7z") returned 3 [0196.993] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.993] lstrlenW (lpString=".dbf") returned 4 [0196.993] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.993] lstrlenW (lpString=".1cd") returned 4 [0196.993] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\lt\\messages.json") returned 151 [0196.993] lstrlenW (lpString=".jpg") returned 4 [0196.993] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.993] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0196.993] lstrlenW (lpString="messages.json") returned 13 [0196.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.994] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=222) returned 1 [0196.994] CloseHandle (hObject=0x154) returned 1 [0196.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 0x2020 [0196.994] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0196.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0196.994] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.994] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0196.995] GetLastError () returned 0x0 [0196.995] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xde, lpOverlapped=0x0) returned 1 [0196.996] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0196.996] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0196.996] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0196.997] SetEndOfFile (hFile=0x114) returned 1 [0196.997] CloseHandle (hObject=0x114) returned 1 [0196.997] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0196.997] SetEndOfFile (hFile=0x154) returned 1 [0196.997] CloseHandle (hObject=0x154) returned 1 [0196.998] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0196.998] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_br\\messages.json")) returned 1 [0196.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0196.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0196.998] lstrlenW (lpString=".doc") returned 4 [0196.998] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.998] lstrlenW (lpString=".docx") returned 5 [0196.998] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.998] lstrlenW (lpString=".pdf") returned 4 [0196.998] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.998] lstrlenW (lpString=".xls") returned 4 [0196.998] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.998] lstrlenW (lpString=".xlsx") returned 5 [0196.998] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.998] lstrlenW (lpString=".ppt") returned 4 [0196.998] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0196.998] lstrlenW (lpString=".zip") returned 4 [0196.998] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.998] lstrlenW (lpString=".rar") returned 4 [0196.998] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.998] lstrlenW (lpString=".bz2") returned 4 [0196.998] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.998] lstrlenW (lpString=".7z") returned 3 [0196.999] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0196.999] lstrlenW (lpString=".dbf") returned 4 [0196.999] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0196.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0196.999] lstrlenW (lpString=".1cd") returned 4 [0196.999] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0196.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0196.999] lstrlenW (lpString=".jpg") returned 4 [0196.999] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0196.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0196.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0196.999] lstrlenW (lpString=".doc") returned 4 [0196.999] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0196.999] lstrlenW (lpString=".docx") returned 5 [0196.999] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0196.999] lstrlenW (lpString=".pdf") returned 4 [0196.999] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0196.999] lstrlenW (lpString=".xls") returned 4 [0196.999] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0196.999] lstrlenW (lpString=".xlsx") returned 5 [0196.999] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0196.999] lstrlenW (lpString=".ppt") returned 4 [0196.999] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0196.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0196.999] lstrlenW (lpString=".zip") returned 4 [0196.999] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0196.999] lstrlenW (lpString=".rar") returned 4 [0196.999] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0196.999] lstrlenW (lpString=".bz2") returned 4 [0196.999] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0196.999] lstrlenW (lpString=".7z") returned 3 [0196.999] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0196.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0197.000] lstrlenW (lpString=".dbf") returned 4 [0197.000] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0197.000] lstrlenW (lpString=".1cd") returned 4 [0197.000] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_BR\\messages.json") returned 154 [0197.000] lstrlenW (lpString=".jpg") returned 4 [0197.000] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.000] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.000] lstrlenW (lpString="messages.json") returned 13 [0197.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.000] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=223) returned 1 [0197.000] CloseHandle (hObject=0x154) returned 1 [0197.000] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 0x2020 [0197.001] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.001] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.001] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.001] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0197.002] GetLastError () returned 0x0 [0197.002] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xdf, lpOverlapped=0x0) returned 1 [0197.003] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0197.004] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.004] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.004] SetEndOfFile (hFile=0x114) returned 1 [0197.004] CloseHandle (hObject=0x114) returned 1 [0197.004] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.004] SetEndOfFile (hFile=0x154) returned 1 [0197.005] CloseHandle (hObject=0x154) returned 1 [0197.005] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.005] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_pt\\messages.json")) returned 1 [0197.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.005] lstrlenW (lpString=".doc") returned 4 [0197.006] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.006] lstrlenW (lpString=".docx") returned 5 [0197.006] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.006] lstrlenW (lpString=".pdf") returned 4 [0197.006] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.006] lstrlenW (lpString=".xls") returned 4 [0197.006] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.006] lstrlenW (lpString=".xlsx") returned 5 [0197.006] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.006] lstrlenW (lpString=".ppt") returned 4 [0197.006] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.006] lstrlenW (lpString=".zip") returned 4 [0197.006] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.006] lstrlenW (lpString=".rar") returned 4 [0197.006] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.006] lstrlenW (lpString=".bz2") returned 4 [0197.006] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.006] lstrlenW (lpString=".7z") returned 3 [0197.006] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.006] lstrlenW (lpString=".dbf") returned 4 [0197.006] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.006] lstrlenW (lpString=".1cd") returned 4 [0197.006] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.006] lstrlenW (lpString=".jpg") returned 4 [0197.006] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.006] lstrlenW (lpString=".doc") returned 4 [0197.006] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.007] lstrlenW (lpString=".docx") returned 5 [0197.007] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.007] lstrlenW (lpString=".pdf") returned 4 [0197.007] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.007] lstrlenW (lpString=".xls") returned 4 [0197.007] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.007] lstrlenW (lpString=".xlsx") returned 5 [0197.007] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.007] lstrlenW (lpString=".ppt") returned 4 [0197.007] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.007] lstrlenW (lpString=".zip") returned 4 [0197.007] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.007] lstrlenW (lpString=".rar") returned 4 [0197.007] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.007] lstrlenW (lpString=".bz2") returned 4 [0197.007] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.007] lstrlenW (lpString=".7z") returned 3 [0197.007] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.007] lstrlenW (lpString=".dbf") returned 4 [0197.007] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.007] lstrlenW (lpString=".1cd") returned 4 [0197.007] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\pt_PT\\messages.json") returned 154 [0197.007] lstrlenW (lpString=".jpg") returned 4 [0197.007] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.007] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.007] lstrlenW (lpString="messages.json") returned 13 [0197.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.008] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=265) returned 1 [0197.008] CloseHandle (hObject=0x154) returned 1 [0197.008] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 0x2020 [0197.008] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.008] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.008] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.008] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.082] GetLastError () returned 0x0 [0197.082] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x109, lpOverlapped=0x0) returned 1 [0197.083] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x110, lpOverlapped=0x0) returned 1 [0197.084] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.084] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.084] SetEndOfFile (hFile=0x2d4) returned 1 [0197.084] CloseHandle (hObject=0x2d4) returned 1 [0197.084] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.084] SetEndOfFile (hFile=0x154) returned 1 [0197.085] CloseHandle (hObject=0x154) returned 1 [0197.085] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.085] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json")) returned 1 [0197.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.085] lstrlenW (lpString=".doc") returned 4 [0197.085] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.085] lstrlenW (lpString=".docx") returned 5 [0197.085] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.086] lstrlenW (lpString=".pdf") returned 4 [0197.086] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.086] lstrlenW (lpString=".xls") returned 4 [0197.086] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.086] lstrlenW (lpString=".xlsx") returned 5 [0197.086] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.086] lstrlenW (lpString=".ppt") returned 4 [0197.086] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.086] lstrlenW (lpString=".zip") returned 4 [0197.086] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.086] lstrlenW (lpString=".rar") returned 4 [0197.086] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.086] lstrlenW (lpString=".bz2") returned 4 [0197.086] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.086] lstrlenW (lpString=".7z") returned 3 [0197.086] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.086] lstrlenW (lpString=".dbf") returned 4 [0197.086] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.086] lstrlenW (lpString=".1cd") returned 4 [0197.086] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.086] lstrlenW (lpString=".jpg") returned 4 [0197.086] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.086] lstrlenW (lpString=".doc") returned 4 [0197.086] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.086] lstrlenW (lpString=".docx") returned 5 [0197.086] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.087] lstrlenW (lpString=".pdf") returned 4 [0197.087] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.087] lstrlenW (lpString=".xls") returned 4 [0197.087] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.087] lstrlenW (lpString=".xlsx") returned 5 [0197.087] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.087] lstrlenW (lpString=".ppt") returned 4 [0197.087] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.087] lstrlenW (lpString=".zip") returned 4 [0197.087] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.087] lstrlenW (lpString=".rar") returned 4 [0197.087] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.087] lstrlenW (lpString=".bz2") returned 4 [0197.087] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.087] lstrlenW (lpString=".7z") returned 3 [0197.087] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.087] lstrlenW (lpString=".dbf") returned 4 [0197.087] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.087] lstrlenW (lpString=".1cd") returned 4 [0197.087] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\ro\\messages.json") returned 151 [0197.087] lstrlenW (lpString=".jpg") returned 4 [0197.087] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.088] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.088] lstrlenW (lpString="messages.json") returned 13 [0197.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.088] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=304) returned 1 [0197.088] CloseHandle (hObject=0x154) returned 1 [0197.088] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 0x2020 [0197.088] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.089] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.089] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.089] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.089] GetLastError () returned 0x0 [0197.089] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x130, lpOverlapped=0x0) returned 1 [0197.090] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x140, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x140, lpOverlapped=0x0) returned 1 [0197.091] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.091] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.091] SetEndOfFile (hFile=0x2d4) returned 1 [0197.091] CloseHandle (hObject=0x2d4) returned 1 [0197.091] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.091] SetEndOfFile (hFile=0x154) returned 1 [0197.092] CloseHandle (hObject=0x154) returned 1 [0197.092] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.092] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json")) returned 1 [0197.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.093] lstrlenW (lpString=".doc") returned 4 [0197.093] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.093] lstrlenW (lpString=".docx") returned 5 [0197.093] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.093] lstrlenW (lpString=".pdf") returned 4 [0197.093] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.093] lstrlenW (lpString=".xls") returned 4 [0197.093] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.093] lstrlenW (lpString=".xlsx") returned 5 [0197.093] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.093] lstrlenW (lpString=".ppt") returned 4 [0197.093] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.093] lstrlenW (lpString=".zip") returned 4 [0197.093] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.093] lstrlenW (lpString=".rar") returned 4 [0197.093] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.093] lstrlenW (lpString=".bz2") returned 4 [0197.093] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.093] lstrlenW (lpString=".7z") returned 3 [0197.093] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.093] lstrlenW (lpString=".dbf") returned 4 [0197.093] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.093] lstrlenW (lpString=".1cd") returned 4 [0197.093] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.093] lstrlenW (lpString=".jpg") returned 4 [0197.093] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.093] lstrlenW (lpString=".doc") returned 4 [0197.094] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.094] lstrlenW (lpString=".docx") returned 5 [0197.094] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.094] lstrlenW (lpString=".pdf") returned 4 [0197.094] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.094] lstrlenW (lpString=".xls") returned 4 [0197.094] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.094] lstrlenW (lpString=".xlsx") returned 5 [0197.094] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.094] lstrlenW (lpString=".ppt") returned 4 [0197.094] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.094] lstrlenW (lpString=".zip") returned 4 [0197.094] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.094] lstrlenW (lpString=".rar") returned 4 [0197.094] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.094] lstrlenW (lpString=".bz2") returned 4 [0197.094] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.094] lstrlenW (lpString=".7z") returned 3 [0197.094] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.094] lstrlenW (lpString=".dbf") returned 4 [0197.094] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.094] lstrlenW (lpString=".1cd") returned 4 [0197.094] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\uk\\messages.json") returned 151 [0197.094] lstrlenW (lpString=".jpg") returned 4 [0197.094] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.094] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.095] lstrlenW (lpString="messages.json") returned 13 [0197.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.095] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=232) returned 1 [0197.095] CloseHandle (hObject=0x154) returned 1 [0197.095] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 0x2020 [0197.095] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.095] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.095] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.096] GetLastError () returned 0x0 [0197.096] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xe8, lpOverlapped=0x0) returned 1 [0197.097] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0197.098] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.098] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.098] SetEndOfFile (hFile=0x2d4) returned 1 [0197.098] CloseHandle (hObject=0x2d4) returned 1 [0197.098] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.098] SetEndOfFile (hFile=0x154) returned 1 [0197.099] CloseHandle (hObject=0x154) returned 1 [0197.099] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.099] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json")) returned 1 [0197.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.099] lstrlenW (lpString=".doc") returned 4 [0197.099] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.099] lstrlenW (lpString=".docx") returned 5 [0197.099] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.099] lstrlenW (lpString=".pdf") returned 4 [0197.099] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.099] lstrlenW (lpString=".xls") returned 4 [0197.099] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.099] lstrlenW (lpString=".xlsx") returned 5 [0197.100] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.100] lstrlenW (lpString=".ppt") returned 4 [0197.100] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.100] lstrlenW (lpString=".zip") returned 4 [0197.100] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.100] lstrlenW (lpString=".rar") returned 4 [0197.100] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.100] lstrlenW (lpString=".bz2") returned 4 [0197.100] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.100] lstrlenW (lpString=".7z") returned 3 [0197.100] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.100] lstrlenW (lpString=".dbf") returned 4 [0197.100] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.100] lstrlenW (lpString=".1cd") returned 4 [0197.100] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.100] lstrlenW (lpString=".jpg") returned 4 [0197.100] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.100] lstrlenW (lpString=".doc") returned 4 [0197.100] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.100] lstrlenW (lpString=".docx") returned 5 [0197.100] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.100] lstrlenW (lpString=".pdf") returned 4 [0197.100] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.100] lstrlenW (lpString=".xls") returned 4 [0197.100] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.100] lstrlenW (lpString=".xlsx") returned 5 [0197.100] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.100] lstrlenW (lpString=".ppt") returned 4 [0197.101] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.101] lstrlenW (lpString=".zip") returned 4 [0197.101] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.101] lstrlenW (lpString=".rar") returned 4 [0197.101] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.101] lstrlenW (lpString=".bz2") returned 4 [0197.101] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.101] lstrlenW (lpString=".7z") returned 3 [0197.101] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.101] lstrlenW (lpString=".dbf") returned 4 [0197.101] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.101] lstrlenW (lpString=".1cd") returned 4 [0197.101] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\vi\\messages.json") returned 151 [0197.101] lstrlenW (lpString=".jpg") returned 4 [0197.101] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.101] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.101] lstrlenW (lpString="messages.json") returned 13 [0197.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.102] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=258) returned 1 [0197.102] CloseHandle (hObject=0x154) returned 1 [0197.102] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 0x2020 [0197.102] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.102] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.102] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.103] GetLastError () returned 0x0 [0197.103] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x102, lpOverlapped=0x0) returned 1 [0197.103] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x110, lpOverlapped=0x0) returned 1 [0197.104] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.104] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.104] SetEndOfFile (hFile=0x2d4) returned 1 [0197.105] CloseHandle (hObject=0x2d4) returned 1 [0197.105] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.105] SetEndOfFile (hFile=0x154) returned 1 [0197.105] CloseHandle (hObject=0x154) returned 1 [0197.105] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.106] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_cn\\messages.json")) returned 1 [0197.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.106] lstrlenW (lpString=".doc") returned 4 [0197.106] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.106] lstrlenW (lpString=".docx") returned 5 [0197.106] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.106] lstrlenW (lpString=".pdf") returned 4 [0197.106] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.106] lstrlenW (lpString=".xls") returned 4 [0197.106] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.106] lstrlenW (lpString=".xlsx") returned 5 [0197.106] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.106] lstrlenW (lpString=".ppt") returned 4 [0197.106] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.106] lstrlenW (lpString=".zip") returned 4 [0197.106] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.106] lstrlenW (lpString=".rar") returned 4 [0197.106] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.106] lstrlenW (lpString=".bz2") returned 4 [0197.106] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.106] lstrlenW (lpString=".7z") returned 3 [0197.106] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.106] lstrlenW (lpString=".dbf") returned 4 [0197.106] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.107] lstrlenW (lpString=".1cd") returned 4 [0197.107] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.107] lstrlenW (lpString=".jpg") returned 4 [0197.107] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.107] lstrlenW (lpString=".doc") returned 4 [0197.107] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.107] lstrlenW (lpString=".docx") returned 5 [0197.107] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.107] lstrlenW (lpString=".pdf") returned 4 [0197.107] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.107] lstrlenW (lpString=".xls") returned 4 [0197.107] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.107] lstrlenW (lpString=".xlsx") returned 5 [0197.107] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.107] lstrlenW (lpString=".ppt") returned 4 [0197.107] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.107] lstrlenW (lpString=".zip") returned 4 [0197.107] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.107] lstrlenW (lpString=".rar") returned 4 [0197.107] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.107] lstrlenW (lpString=".bz2") returned 4 [0197.107] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.107] lstrlenW (lpString=".7z") returned 3 [0197.107] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.107] lstrlenW (lpString=".dbf") returned 4 [0197.107] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.108] lstrlenW (lpString=".1cd") returned 4 [0197.108] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_CN\\messages.json") returned 154 [0197.108] lstrlenW (lpString=".jpg") returned 4 [0197.108] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.108] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.108] lstrlenW (lpString="messages.json") returned 13 [0197.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.108] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=249) returned 1 [0197.108] CloseHandle (hObject=0x154) returned 1 [0197.108] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 0x2020 [0197.108] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.109] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.109] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.109] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.109] GetLastError () returned 0x0 [0197.109] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xf9, lpOverlapped=0x0) returned 1 [0197.110] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0197.111] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.111] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.111] SetEndOfFile (hFile=0x2d4) returned 1 [0197.111] CloseHandle (hObject=0x2d4) returned 1 [0197.111] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.111] SetEndOfFile (hFile=0x154) returned 1 [0197.112] CloseHandle (hObject=0x154) returned 1 [0197.112] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.112] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_tw\\messages.json")) returned 1 [0197.112] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.112] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.112] lstrlenW (lpString=".doc") returned 4 [0197.112] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.112] lstrlenW (lpString=".docx") returned 5 [0197.112] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.112] lstrlenW (lpString=".pdf") returned 4 [0197.113] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.113] lstrlenW (lpString=".xls") returned 4 [0197.113] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.113] lstrlenW (lpString=".xlsx") returned 5 [0197.113] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.113] lstrlenW (lpString=".ppt") returned 4 [0197.113] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.113] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.113] lstrlenW (lpString=".zip") returned 4 [0197.113] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.113] lstrlenW (lpString=".rar") returned 4 [0197.113] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.113] lstrlenW (lpString=".bz2") returned 4 [0197.113] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.113] lstrlenW (lpString=".7z") returned 3 [0197.113] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.113] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.113] lstrlenW (lpString=".dbf") returned 4 [0197.113] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.113] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.113] lstrlenW (lpString=".1cd") returned 4 [0197.113] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.113] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.113] lstrlenW (lpString=".jpg") returned 4 [0197.113] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.113] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.113] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.113] lstrlenW (lpString=".doc") returned 4 [0197.113] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.113] lstrlenW (lpString=".docx") returned 5 [0197.113] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.113] lstrlenW (lpString=".pdf") returned 4 [0197.113] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.113] lstrlenW (lpString=".xls") returned 4 [0197.114] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.114] lstrlenW (lpString=".xlsx") returned 5 [0197.114] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.114] lstrlenW (lpString=".ppt") returned 4 [0197.114] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.114] lstrlenW (lpString=".zip") returned 4 [0197.114] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.114] lstrlenW (lpString=".rar") returned 4 [0197.114] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.114] lstrlenW (lpString=".bz2") returned 4 [0197.114] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.114] lstrlenW (lpString=".7z") returned 3 [0197.114] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.114] lstrlenW (lpString=".dbf") returned 4 [0197.114] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.114] lstrlenW (lpString=".1cd") returned 4 [0197.114] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_locales\\zh_TW\\messages.json") returned 154 [0197.114] lstrlenW (lpString=".jpg") returned 4 [0197.114] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.114] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.114] lstrlenW (lpString="verified_contents.json") returned 22 [0197.114] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.115] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=9862) returned 1 [0197.115] CloseHandle (hObject=0x154) returned 1 [0197.115] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 0x2020 [0197.115] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0197.115] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.115] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.115] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0197.244] GetLastError () returned 0x0 [0197.244] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2686, lpOverlapped=0x0) returned 1 [0197.247] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2690, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2690, lpOverlapped=0x0) returned 1 [0197.249] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.249] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0197.249] SetEndOfFile (hFile=0x15c) returned 1 [0197.249] CloseHandle (hObject=0x15c) returned 1 [0197.249] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.249] SetEndOfFile (hFile=0x154) returned 1 [0197.250] CloseHandle (hObject=0x154) returned 1 [0197.250] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.250] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json")) returned 1 [0197.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.251] lstrlenW (lpString=".doc") returned 4 [0197.251] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.251] lstrlenW (lpString=".docx") returned 5 [0197.251] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.251] lstrlenW (lpString=".pdf") returned 4 [0197.251] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.251] lstrlenW (lpString=".xls") returned 4 [0197.251] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.251] lstrlenW (lpString=".xlsx") returned 5 [0197.251] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.251] lstrlenW (lpString=".ppt") returned 4 [0197.251] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.251] lstrlenW (lpString=".zip") returned 4 [0197.251] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.251] lstrlenW (lpString=".rar") returned 4 [0197.251] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.251] lstrlenW (lpString=".bz2") returned 4 [0197.251] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.251] lstrlenW (lpString=".7z") returned 3 [0197.251] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.251] lstrlenW (lpString=".dbf") returned 4 [0197.251] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.251] lstrlenW (lpString=".1cd") returned 4 [0197.251] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.251] lstrlenW (lpString=".jpg") returned 4 [0197.251] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.251] lstrlenW (lpString=".doc") returned 4 [0197.252] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.252] lstrlenW (lpString=".docx") returned 5 [0197.252] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.252] lstrlenW (lpString=".pdf") returned 4 [0197.252] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.252] lstrlenW (lpString=".xls") returned 4 [0197.252] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.252] lstrlenW (lpString=".xlsx") returned 5 [0197.252] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.252] lstrlenW (lpString=".ppt") returned 4 [0197.252] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.252] lstrlenW (lpString=".zip") returned 4 [0197.252] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.252] lstrlenW (lpString=".rar") returned 4 [0197.252] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.252] lstrlenW (lpString=".bz2") returned 4 [0197.252] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.252] lstrlenW (lpString=".7z") returned 3 [0197.252] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.252] lstrlenW (lpString=".dbf") returned 4 [0197.252] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.252] lstrlenW (lpString=".1cd") returned 4 [0197.252] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pjkljhegncpnkpknbcohdijeoejaedia\\8.1_0\\_metadata\\verified_contents.json") returned 158 [0197.252] lstrlenW (lpString=".jpg") returned 4 [0197.252] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.252] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.253] lstrlenW (lpString="cast_route_details.js") returned 21 [0197.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.260] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=238168) returned 1 [0197.260] CloseHandle (hObject=0x150) returned 1 [0197.260] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 0x2020 [0197.272] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.272] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.272] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.288] GetLastError () returned 0x0 [0197.288] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3a258, lpOverlapped=0x0) returned 1 [0197.294] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3a260, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3a260, lpOverlapped=0x0) returned 1 [0197.298] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.298] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0197.298] SetEndOfFile (hFile=0x358) returned 1 [0197.298] CloseHandle (hObject=0x358) returned 1 [0197.298] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.298] SetEndOfFile (hFile=0x150) returned 1 [0197.300] CloseHandle (hObject=0x150) returned 1 [0197.300] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.300] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js")) returned 1 [0197.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.301] lstrlenW (lpString=".doc") returned 4 [0197.301] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0197.301] lstrlenW (lpString=".docx") returned 5 [0197.301] lstrcmpiW (lpString1=".docx", lpString2="ls.js") returned -1 [0197.301] lstrlenW (lpString=".pdf") returned 4 [0197.301] lstrcmpiW (lpString1=".pdf", lpString2="s.js") returned -1 [0197.301] lstrlenW (lpString=".xls") returned 4 [0197.301] lstrcmpiW (lpString1=".xls", lpString2="s.js") returned -1 [0197.301] lstrlenW (lpString=".xlsx") returned 5 [0197.301] lstrcmpiW (lpString1=".xlsx", lpString2="ls.js") returned -1 [0197.301] lstrlenW (lpString=".ppt") returned 4 [0197.301] lstrcmpiW (lpString1=".ppt", lpString2="s.js") returned -1 [0197.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.301] lstrlenW (lpString=".zip") returned 4 [0197.301] lstrcmpiW (lpString1=".zip", lpString2="s.js") returned -1 [0197.301] lstrlenW (lpString=".rar") returned 4 [0197.301] lstrcmpiW (lpString1=".rar", lpString2="s.js") returned -1 [0197.301] lstrlenW (lpString=".bz2") returned 4 [0197.301] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0197.301] lstrlenW (lpString=".7z") returned 3 [0197.301] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.301] lstrlenW (lpString=".dbf") returned 4 [0197.301] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0197.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.301] lstrlenW (lpString=".1cd") returned 4 [0197.302] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0197.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.302] lstrlenW (lpString=".jpg") returned 4 [0197.302] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0197.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.302] lstrlenW (lpString=".doc") returned 4 [0197.302] lstrcmpiW (lpString1=".doc", lpString2="s.js") returned -1 [0197.302] lstrlenW (lpString=".docx") returned 5 [0197.302] lstrcmpiW (lpString1=".docx", lpString2="ls.js") returned -1 [0197.302] lstrlenW (lpString=".pdf") returned 4 [0197.302] lstrcmpiW (lpString1=".pdf", lpString2="s.js") returned -1 [0197.302] lstrlenW (lpString=".xls") returned 4 [0197.302] lstrcmpiW (lpString1=".xls", lpString2="s.js") returned -1 [0197.302] lstrlenW (lpString=".xlsx") returned 5 [0197.302] lstrcmpiW (lpString1=".xlsx", lpString2="ls.js") returned -1 [0197.302] lstrlenW (lpString=".ppt") returned 4 [0197.302] lstrcmpiW (lpString1=".ppt", lpString2="s.js") returned -1 [0197.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.302] lstrlenW (lpString=".zip") returned 4 [0197.302] lstrcmpiW (lpString1=".zip", lpString2="s.js") returned -1 [0197.302] lstrlenW (lpString=".rar") returned 4 [0197.302] lstrcmpiW (lpString1=".rar", lpString2="s.js") returned -1 [0197.302] lstrlenW (lpString=".bz2") returned 4 [0197.302] lstrcmpiW (lpString1=".bz2", lpString2="s.js") returned -1 [0197.302] lstrlenW (lpString=".7z") returned 3 [0197.302] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.302] lstrlenW (lpString=".dbf") returned 4 [0197.302] lstrcmpiW (lpString1=".dbf", lpString2="s.js") returned -1 [0197.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.302] lstrlenW (lpString=".1cd") returned 4 [0197.303] lstrcmpiW (lpString1=".1cd", lpString2="s.js") returned -1 [0197.303] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_route_details.js") returned 156 [0197.303] lstrlenW (lpString=".jpg") returned 4 [0197.303] lstrcmpiW (lpString1=".jpg", lpString2="s.js") returned -1 [0197.303] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.303] lstrlenW (lpString="cast_app.js") returned 11 [0197.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.303] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=139738) returned 1 [0197.303] CloseHandle (hObject=0x150) returned 1 [0197.303] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 0x2020 [0197.304] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.304] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.304] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.304] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.304] GetLastError () returned 0x0 [0197.304] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x221da, lpOverlapped=0x0) returned 1 [0197.309] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x221e0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x221e0, lpOverlapped=0x0) returned 1 [0197.312] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.312] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0197.312] SetEndOfFile (hFile=0x358) returned 1 [0197.312] CloseHandle (hObject=0x358) returned 1 [0197.312] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.312] SetEndOfFile (hFile=0x150) returned 1 [0197.314] CloseHandle (hObject=0x150) returned 1 [0197.314] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.314] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js")) returned 1 [0197.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.314] lstrlenW (lpString=".doc") returned 4 [0197.314] lstrcmpiW (lpString1=".doc", lpString2="p.js") returned -1 [0197.314] lstrlenW (lpString=".docx") returned 5 [0197.314] lstrcmpiW (lpString1=".docx", lpString2="pp.js") returned -1 [0197.314] lstrlenW (lpString=".pdf") returned 4 [0197.314] lstrcmpiW (lpString1=".pdf", lpString2="p.js") returned -1 [0197.314] lstrlenW (lpString=".xls") returned 4 [0197.314] lstrcmpiW (lpString1=".xls", lpString2="p.js") returned -1 [0197.314] lstrlenW (lpString=".xlsx") returned 5 [0197.314] lstrcmpiW (lpString1=".xlsx", lpString2="pp.js") returned -1 [0197.314] lstrlenW (lpString=".ppt") returned 4 [0197.314] lstrcmpiW (lpString1=".ppt", lpString2="p.js") returned -1 [0197.314] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.314] lstrlenW (lpString=".zip") returned 4 [0197.314] lstrcmpiW (lpString1=".zip", lpString2="p.js") returned -1 [0197.314] lstrlenW (lpString=".rar") returned 4 [0197.314] lstrcmpiW (lpString1=".rar", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString=".bz2") returned 4 [0197.315] lstrcmpiW (lpString1=".bz2", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString=".7z") returned 3 [0197.315] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.315] lstrlenW (lpString=".dbf") returned 4 [0197.315] lstrcmpiW (lpString1=".dbf", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.315] lstrlenW (lpString=".1cd") returned 4 [0197.315] lstrcmpiW (lpString1=".1cd", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.315] lstrlenW (lpString=".jpg") returned 4 [0197.315] lstrcmpiW (lpString1=".jpg", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.315] lstrlenW (lpString=".doc") returned 4 [0197.315] lstrcmpiW (lpString1=".doc", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString=".docx") returned 5 [0197.315] lstrcmpiW (lpString1=".docx", lpString2="pp.js") returned -1 [0197.315] lstrlenW (lpString=".pdf") returned 4 [0197.315] lstrcmpiW (lpString1=".pdf", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString=".xls") returned 4 [0197.315] lstrcmpiW (lpString1=".xls", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString=".xlsx") returned 5 [0197.315] lstrcmpiW (lpString1=".xlsx", lpString2="pp.js") returned -1 [0197.315] lstrlenW (lpString=".ppt") returned 4 [0197.315] lstrcmpiW (lpString1=".ppt", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.315] lstrlenW (lpString=".zip") returned 4 [0197.315] lstrcmpiW (lpString1=".zip", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString=".rar") returned 4 [0197.315] lstrcmpiW (lpString1=".rar", lpString2="p.js") returned -1 [0197.315] lstrlenW (lpString=".bz2") returned 4 [0197.316] lstrcmpiW (lpString1=".bz2", lpString2="p.js") returned -1 [0197.316] lstrlenW (lpString=".7z") returned 3 [0197.316] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.316] lstrlenW (lpString=".dbf") returned 4 [0197.316] lstrcmpiW (lpString1=".dbf", lpString2="p.js") returned -1 [0197.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.316] lstrlenW (lpString=".1cd") returned 4 [0197.316] lstrcmpiW (lpString1=".1cd", lpString2="p.js") returned -1 [0197.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app.js") returned 157 [0197.316] lstrlenW (lpString=".jpg") returned 4 [0197.316] lstrcmpiW (lpString1=".jpg", lpString2="p.js") returned -1 [0197.316] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.316] lstrlenW (lpString="cast_app_redirect.js") returned 20 [0197.316] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.402] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=242) returned 1 [0197.402] CloseHandle (hObject=0x150) returned 1 [0197.402] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 0x2020 [0197.402] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.402] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.402] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.403] GetLastError () returned 0x0 [0197.403] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xf2, lpOverlapped=0x0) returned 1 [0197.406] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0197.407] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.407] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0197.407] SetEndOfFile (hFile=0x358) returned 1 [0197.407] CloseHandle (hObject=0x358) returned 1 [0197.407] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.407] SetEndOfFile (hFile=0x150) returned 1 [0197.408] CloseHandle (hObject=0x150) returned 1 [0197.408] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.408] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js")) returned 1 [0197.408] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.408] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.408] lstrlenW (lpString=".doc") returned 4 [0197.409] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0197.409] lstrlenW (lpString=".docx") returned 5 [0197.409] lstrcmpiW (lpString1=".docx", lpString2="ct.js") returned -1 [0197.409] lstrlenW (lpString=".pdf") returned 4 [0197.409] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0197.409] lstrlenW (lpString=".xls") returned 4 [0197.409] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0197.409] lstrlenW (lpString=".xlsx") returned 5 [0197.409] lstrcmpiW (lpString1=".xlsx", lpString2="ct.js") returned -1 [0197.409] lstrlenW (lpString=".ppt") returned 4 [0197.409] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0197.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.409] lstrlenW (lpString=".zip") returned 4 [0197.409] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0197.409] lstrlenW (lpString=".rar") returned 4 [0197.409] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0197.409] lstrlenW (lpString=".bz2") returned 4 [0197.409] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0197.409] lstrlenW (lpString=".7z") returned 3 [0197.409] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.409] lstrlenW (lpString=".dbf") returned 4 [0197.409] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0197.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.409] lstrlenW (lpString=".1cd") returned 4 [0197.409] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0197.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.409] lstrlenW (lpString=".jpg") returned 4 [0197.409] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0197.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.409] lstrlenW (lpString=".doc") returned 4 [0197.410] lstrcmpiW (lpString1=".doc", lpString2="t.js") returned -1 [0197.410] lstrlenW (lpString=".docx") returned 5 [0197.410] lstrcmpiW (lpString1=".docx", lpString2="ct.js") returned -1 [0197.410] lstrlenW (lpString=".pdf") returned 4 [0197.410] lstrcmpiW (lpString1=".pdf", lpString2="t.js") returned -1 [0197.410] lstrlenW (lpString=".xls") returned 4 [0197.410] lstrcmpiW (lpString1=".xls", lpString2="t.js") returned -1 [0197.410] lstrlenW (lpString=".xlsx") returned 5 [0197.410] lstrcmpiW (lpString1=".xlsx", lpString2="ct.js") returned -1 [0197.410] lstrlenW (lpString=".ppt") returned 4 [0197.410] lstrcmpiW (lpString1=".ppt", lpString2="t.js") returned -1 [0197.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.410] lstrlenW (lpString=".zip") returned 4 [0197.410] lstrcmpiW (lpString1=".zip", lpString2="t.js") returned -1 [0197.410] lstrlenW (lpString=".rar") returned 4 [0197.410] lstrcmpiW (lpString1=".rar", lpString2="t.js") returned -1 [0197.410] lstrlenW (lpString=".bz2") returned 4 [0197.410] lstrcmpiW (lpString1=".bz2", lpString2="t.js") returned -1 [0197.410] lstrlenW (lpString=".7z") returned 3 [0197.410] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.410] lstrlenW (lpString=".dbf") returned 4 [0197.410] lstrcmpiW (lpString1=".dbf", lpString2="t.js") returned -1 [0197.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.410] lstrlenW (lpString=".1cd") returned 4 [0197.410] lstrcmpiW (lpString1=".1cd", lpString2="t.js") returned -1 [0197.410] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\cast_app_redirect.js") returned 166 [0197.410] lstrlenW (lpString=".jpg") returned 4 [0197.410] lstrcmpiW (lpString1=".jpg", lpString2="t.js") returned -1 [0197.410] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0197.411] lstrlenW (lpString="index.html") returned 10 [0197.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.411] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2088) returned 1 [0197.411] CloseHandle (hObject=0x150) returned 1 [0197.411] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 0x2020 [0197.411] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.411] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.411] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.411] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.412] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.412] GetLastError () returned 0x0 [0197.412] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x828, lpOverlapped=0x0) returned 1 [0197.414] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x830, lpOverlapped=0x0) returned 1 [0197.415] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.415] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0197.415] SetEndOfFile (hFile=0x358) returned 1 [0197.415] CloseHandle (hObject=0x358) returned 1 [0197.415] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.415] SetEndOfFile (hFile=0x150) returned 1 [0197.416] CloseHandle (hObject=0x150) returned 1 [0197.416] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.416] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html")) returned 1 [0197.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.416] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.416] lstrlenW (lpString=".doc") returned 4 [0197.416] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.416] lstrlenW (lpString=".docx") returned 5 [0197.416] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.416] lstrlenW (lpString=".pdf") returned 4 [0197.416] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.416] lstrlenW (lpString=".xls") returned 4 [0197.416] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.416] lstrlenW (lpString=".xlsx") returned 5 [0197.417] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.417] lstrlenW (lpString=".ppt") returned 4 [0197.417] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.417] lstrlenW (lpString=".zip") returned 4 [0197.417] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.417] lstrlenW (lpString=".rar") returned 4 [0197.417] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.417] lstrlenW (lpString=".bz2") returned 4 [0197.417] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.417] lstrlenW (lpString=".7z") returned 3 [0197.417] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.417] lstrlenW (lpString=".dbf") returned 4 [0197.417] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.417] lstrlenW (lpString=".1cd") returned 4 [0197.417] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.417] lstrlenW (lpString=".jpg") returned 4 [0197.417] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.417] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.417] lstrlenW (lpString=".doc") returned 4 [0197.417] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.417] lstrlenW (lpString=".docx") returned 5 [0197.417] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.417] lstrlenW (lpString=".pdf") returned 4 [0197.417] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.417] lstrlenW (lpString=".xls") returned 4 [0197.417] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.417] lstrlenW (lpString=".xlsx") returned 5 [0197.417] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.417] lstrlenW (lpString=".ppt") returned 4 [0197.418] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.418] lstrlenW (lpString=".zip") returned 4 [0197.418] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.418] lstrlenW (lpString=".rar") returned 4 [0197.418] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.418] lstrlenW (lpString=".bz2") returned 4 [0197.418] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.418] lstrlenW (lpString=".7z") returned 3 [0197.418] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.418] lstrlenW (lpString=".dbf") returned 4 [0197.418] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.418] lstrlenW (lpString=".1cd") returned 4 [0197.418] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\index.html") returned 156 [0197.418] lstrlenW (lpString=".jpg") returned 4 [0197.418] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.418] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0197.418] lstrlenW (lpString="offers.html") returned 11 [0197.418] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.419] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=59) returned 1 [0197.419] CloseHandle (hObject=0x150) returned 1 [0197.419] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 0x2020 [0197.419] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.419] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.419] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.419] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.420] GetLastError () returned 0x0 [0197.420] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3b, lpOverlapped=0x0) returned 1 [0197.420] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x40, lpOverlapped=0x0) returned 1 [0197.421] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.421] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0197.421] SetEndOfFile (hFile=0x358) returned 1 [0197.422] CloseHandle (hObject=0x358) returned 1 [0197.422] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.422] SetEndOfFile (hFile=0x150) returned 1 [0197.422] CloseHandle (hObject=0x150) returned 1 [0197.422] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.423] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html")) returned 1 [0197.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.423] lstrlenW (lpString=".doc") returned 4 [0197.423] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.423] lstrlenW (lpString=".docx") returned 5 [0197.423] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.423] lstrlenW (lpString=".pdf") returned 4 [0197.423] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.423] lstrlenW (lpString=".xls") returned 4 [0197.423] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.423] lstrlenW (lpString=".xlsx") returned 5 [0197.423] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.423] lstrlenW (lpString=".ppt") returned 4 [0197.423] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.423] lstrlenW (lpString=".zip") returned 4 [0197.423] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.423] lstrlenW (lpString=".rar") returned 4 [0197.423] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.423] lstrlenW (lpString=".bz2") returned 4 [0197.423] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.423] lstrlenW (lpString=".7z") returned 3 [0197.423] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.423] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.423] lstrlenW (lpString=".dbf") returned 4 [0197.423] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.424] lstrlenW (lpString=".1cd") returned 4 [0197.424] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.424] lstrlenW (lpString=".jpg") returned 4 [0197.424] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.424] lstrlenW (lpString=".doc") returned 4 [0197.424] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.424] lstrlenW (lpString=".docx") returned 5 [0197.424] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.424] lstrlenW (lpString=".pdf") returned 4 [0197.424] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.424] lstrlenW (lpString=".xls") returned 4 [0197.424] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.424] lstrlenW (lpString=".xlsx") returned 5 [0197.424] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.424] lstrlenW (lpString=".ppt") returned 4 [0197.424] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.424] lstrlenW (lpString=".zip") returned 4 [0197.424] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.424] lstrlenW (lpString=".rar") returned 4 [0197.424] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.424] lstrlenW (lpString=".bz2") returned 4 [0197.424] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.424] lstrlenW (lpString=".7z") returned 3 [0197.424] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.424] lstrlenW (lpString=".dbf") returned 4 [0197.424] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.424] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.424] lstrlenW (lpString=".1cd") returned 4 [0197.425] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.425] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\offers.html") returned 157 [0197.425] lstrlenW (lpString=".jpg") returned 4 [0197.425] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.425] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0197.425] lstrlenW (lpString="setup.html") returned 10 [0197.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.425] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=59) returned 1 [0197.425] CloseHandle (hObject=0x150) returned 1 [0197.425] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 0x2020 [0197.425] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.425] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.426] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.426] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.426] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.426] GetLastError () returned 0x0 [0197.426] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3b, lpOverlapped=0x0) returned 1 [0197.427] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x40, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x40, lpOverlapped=0x0) returned 1 [0197.428] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.428] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0197.428] SetEndOfFile (hFile=0x358) returned 1 [0197.428] CloseHandle (hObject=0x358) returned 1 [0197.428] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.428] SetEndOfFile (hFile=0x150) returned 1 [0197.429] CloseHandle (hObject=0x150) returned 1 [0197.429] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.429] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html")) returned 1 [0197.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.429] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.430] lstrlenW (lpString=".doc") returned 4 [0197.430] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.430] lstrlenW (lpString=".docx") returned 5 [0197.430] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.430] lstrlenW (lpString=".pdf") returned 4 [0197.430] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.430] lstrlenW (lpString=".xls") returned 4 [0197.430] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.430] lstrlenW (lpString=".xlsx") returned 5 [0197.430] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.430] lstrlenW (lpString=".ppt") returned 4 [0197.430] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.430] lstrlenW (lpString=".zip") returned 4 [0197.430] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.430] lstrlenW (lpString=".rar") returned 4 [0197.430] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.430] lstrlenW (lpString=".bz2") returned 4 [0197.430] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.430] lstrlenW (lpString=".7z") returned 3 [0197.430] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.430] lstrlenW (lpString=".dbf") returned 4 [0197.430] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.430] lstrlenW (lpString=".1cd") returned 4 [0197.430] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.430] lstrlenW (lpString=".jpg") returned 4 [0197.430] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.431] lstrlenW (lpString=".doc") returned 4 [0197.431] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.431] lstrlenW (lpString=".docx") returned 5 [0197.431] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.431] lstrlenW (lpString=".pdf") returned 4 [0197.431] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.431] lstrlenW (lpString=".xls") returned 4 [0197.431] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.431] lstrlenW (lpString=".xlsx") returned 5 [0197.431] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.431] lstrlenW (lpString=".ppt") returned 4 [0197.431] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.431] lstrlenW (lpString=".zip") returned 4 [0197.431] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.431] lstrlenW (lpString=".rar") returned 4 [0197.431] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.431] lstrlenW (lpString=".bz2") returned 4 [0197.431] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.431] lstrlenW (lpString=".7z") returned 3 [0197.431] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.431] lstrlenW (lpString=".dbf") returned 4 [0197.431] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.431] lstrlenW (lpString=".1cd") returned 4 [0197.431] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cast_setup\\setup.html") returned 156 [0197.431] lstrlenW (lpString=".jpg") returned 4 [0197.431] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.432] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0197.432] lstrlenW (lpString="view.html") returned 9 [0197.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.432] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=5964) returned 1 [0197.432] CloseHandle (hObject=0x150) returned 1 [0197.432] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 0x2020 [0197.432] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0197.432] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.432] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.433] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0197.435] GetLastError () returned 0x0 [0197.435] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x174c, lpOverlapped=0x0) returned 1 [0197.438] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x1750, lpOverlapped=0x0) returned 1 [0197.439] ReadFile (in: hFile=0x150, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.439] WriteFile (in: hFile=0x358, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0197.439] SetEndOfFile (hFile=0x358) returned 1 [0197.439] CloseHandle (hObject=0x358) returned 1 [0197.439] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.439] SetEndOfFile (hFile=0x150) returned 1 [0197.440] CloseHandle (hObject=0x150) returned 1 [0197.440] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.440] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html")) returned 1 [0197.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.440] lstrlenW (lpString=".doc") returned 4 [0197.440] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.440] lstrlenW (lpString=".docx") returned 5 [0197.440] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.440] lstrlenW (lpString=".pdf") returned 4 [0197.440] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.440] lstrlenW (lpString=".xls") returned 4 [0197.440] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.440] lstrlenW (lpString=".xlsx") returned 5 [0197.440] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.440] lstrlenW (lpString=".ppt") returned 4 [0197.441] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.441] lstrlenW (lpString=".zip") returned 4 [0197.441] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.441] lstrlenW (lpString=".rar") returned 4 [0197.441] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.441] lstrlenW (lpString=".bz2") returned 4 [0197.441] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.441] lstrlenW (lpString=".7z") returned 3 [0197.441] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.441] lstrlenW (lpString=".dbf") returned 4 [0197.441] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.441] lstrlenW (lpString=".1cd") returned 4 [0197.441] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.441] lstrlenW (lpString=".jpg") returned 4 [0197.441] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.441] lstrlenW (lpString=".doc") returned 4 [0197.441] lstrcmpiW (lpString1=".doc", lpString2="html") returned -1 [0197.441] lstrlenW (lpString=".docx") returned 5 [0197.441] lstrcmpiW (lpString1=".docx", lpString2=".html") returned -1 [0197.441] lstrlenW (lpString=".pdf") returned 4 [0197.441] lstrcmpiW (lpString1=".pdf", lpString2="html") returned -1 [0197.441] lstrlenW (lpString=".xls") returned 4 [0197.441] lstrcmpiW (lpString1=".xls", lpString2="html") returned -1 [0197.441] lstrlenW (lpString=".xlsx") returned 5 [0197.441] lstrcmpiW (lpString1=".xlsx", lpString2=".html") returned 1 [0197.441] lstrlenW (lpString=".ppt") returned 4 [0197.441] lstrcmpiW (lpString1=".ppt", lpString2="html") returned -1 [0197.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.442] lstrlenW (lpString=".zip") returned 4 [0197.442] lstrcmpiW (lpString1=".zip", lpString2="html") returned -1 [0197.442] lstrlenW (lpString=".rar") returned 4 [0197.442] lstrcmpiW (lpString1=".rar", lpString2="html") returned -1 [0197.442] lstrlenW (lpString=".bz2") returned 4 [0197.442] lstrcmpiW (lpString1=".bz2", lpString2="html") returned -1 [0197.442] lstrlenW (lpString=".7z") returned 3 [0197.442] lstrcmpiW (lpString1=".7z", lpString2="tml") returned -1 [0197.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.442] lstrlenW (lpString=".dbf") returned 4 [0197.442] lstrcmpiW (lpString1=".dbf", lpString2="html") returned -1 [0197.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.442] lstrlenW (lpString=".1cd") returned 4 [0197.442] lstrcmpiW (lpString1=".1cd", lpString2="html") returned -1 [0197.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.html") returned 164 [0197.442] lstrlenW (lpString=".jpg") returned 4 [0197.442] lstrcmpiW (lpString1=".jpg", lpString2="html") returned -1 [0197.442] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0197.442] lstrlenW (lpString="view.js") returned 7 [0197.442] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.636] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2373) returned 1 [0197.636] CloseHandle (hObject=0x388) returned 1 [0197.637] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 0x2020 [0197.637] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.637] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.637] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.637] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.637] GetLastError () returned 0x0 [0197.637] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x945, lpOverlapped=0x0) returned 1 [0197.642] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x950, lpOverlapped=0x0) returned 1 [0197.643] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.643] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0197.643] SetEndOfFile (hFile=0x2d4) returned 1 [0197.643] CloseHandle (hObject=0x2d4) returned 1 [0197.643] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.643] SetEndOfFile (hFile=0x388) returned 1 [0197.644] CloseHandle (hObject=0x388) returned 1 [0197.644] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.644] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js")) returned 1 [0197.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.644] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.644] lstrlenW (lpString=".doc") returned 4 [0197.644] lstrcmpiW (lpString1=".doc", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString=".docx") returned 5 [0197.645] lstrcmpiW (lpString1=".docx", lpString2="ew.js") returned -1 [0197.645] lstrlenW (lpString=".pdf") returned 4 [0197.645] lstrcmpiW (lpString1=".pdf", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString=".xls") returned 4 [0197.645] lstrcmpiW (lpString1=".xls", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString=".xlsx") returned 5 [0197.645] lstrcmpiW (lpString1=".xlsx", lpString2="ew.js") returned -1 [0197.645] lstrlenW (lpString=".ppt") returned 4 [0197.645] lstrcmpiW (lpString1=".ppt", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.645] lstrlenW (lpString=".zip") returned 4 [0197.645] lstrcmpiW (lpString1=".zip", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString=".rar") returned 4 [0197.645] lstrcmpiW (lpString1=".rar", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString=".bz2") returned 4 [0197.645] lstrcmpiW (lpString1=".bz2", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString=".7z") returned 3 [0197.645] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.645] lstrlenW (lpString=".dbf") returned 4 [0197.645] lstrcmpiW (lpString1=".dbf", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.645] lstrlenW (lpString=".1cd") returned 4 [0197.645] lstrcmpiW (lpString1=".1cd", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.645] lstrlenW (lpString=".jpg") returned 4 [0197.645] lstrcmpiW (lpString1=".jpg", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.645] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.645] lstrlenW (lpString=".doc") returned 4 [0197.645] lstrcmpiW (lpString1=".doc", lpString2="w.js") returned -1 [0197.645] lstrlenW (lpString=".docx") returned 5 [0197.646] lstrcmpiW (lpString1=".docx", lpString2="ew.js") returned -1 [0197.646] lstrlenW (lpString=".pdf") returned 4 [0197.646] lstrcmpiW (lpString1=".pdf", lpString2="w.js") returned -1 [0197.646] lstrlenW (lpString=".xls") returned 4 [0197.646] lstrcmpiW (lpString1=".xls", lpString2="w.js") returned -1 [0197.646] lstrlenW (lpString=".xlsx") returned 5 [0197.646] lstrcmpiW (lpString1=".xlsx", lpString2="ew.js") returned -1 [0197.646] lstrlenW (lpString=".ppt") returned 4 [0197.646] lstrcmpiW (lpString1=".ppt", lpString2="w.js") returned -1 [0197.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.646] lstrlenW (lpString=".zip") returned 4 [0197.646] lstrcmpiW (lpString1=".zip", lpString2="w.js") returned -1 [0197.646] lstrlenW (lpString=".rar") returned 4 [0197.646] lstrcmpiW (lpString1=".rar", lpString2="w.js") returned -1 [0197.646] lstrlenW (lpString=".bz2") returned 4 [0197.646] lstrcmpiW (lpString1=".bz2", lpString2="w.js") returned -1 [0197.646] lstrlenW (lpString=".7z") returned 3 [0197.646] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0197.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.646] lstrlenW (lpString=".dbf") returned 4 [0197.646] lstrcmpiW (lpString1=".dbf", lpString2="w.js") returned -1 [0197.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.646] lstrlenW (lpString=".1cd") returned 4 [0197.646] lstrcmpiW (lpString1=".1cd", lpString2="w.js") returned -1 [0197.646] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\cloud_route_details\\view.js") returned 162 [0197.646] lstrlenW (lpString=".jpg") returned 4 [0197.646] lstrcmpiW (lpString1=".jpg", lpString2="w.js") returned -1 [0197.646] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.646] lstrlenW (lpString="messages.json") returned 13 [0197.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.647] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=21195) returned 1 [0197.647] CloseHandle (hObject=0x388) returned 1 [0197.647] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json")) returned 0x2020 [0197.647] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.647] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.647] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.647] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.648] GetLastError () returned 0x0 [0197.648] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x52cb, lpOverlapped=0x0) returned 1 [0197.650] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x52d0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x52d0, lpOverlapped=0x0) returned 1 [0197.651] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.651] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.651] SetEndOfFile (hFile=0x2d4) returned 1 [0197.652] CloseHandle (hObject=0x2d4) returned 1 [0197.652] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.652] SetEndOfFile (hFile=0x388) returned 1 [0197.652] CloseHandle (hObject=0x388) returned 1 [0197.653] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.653] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json")) returned 1 [0197.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.655] lstrlenW (lpString=".doc") returned 4 [0197.655] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.655] lstrlenW (lpString=".docx") returned 5 [0197.655] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.655] lstrlenW (lpString=".pdf") returned 4 [0197.655] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.655] lstrlenW (lpString=".xls") returned 4 [0197.655] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.655] lstrlenW (lpString=".xlsx") returned 5 [0197.655] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.655] lstrlenW (lpString=".ppt") returned 4 [0197.655] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.655] lstrlenW (lpString=".zip") returned 4 [0197.655] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.655] lstrlenW (lpString=".rar") returned 4 [0197.655] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.655] lstrlenW (lpString=".bz2") returned 4 [0197.655] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.655] lstrlenW (lpString=".7z") returned 3 [0197.655] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.655] lstrlenW (lpString=".dbf") returned 4 [0197.655] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.655] lstrlenW (lpString=".1cd") returned 4 [0197.655] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.655] lstrlenW (lpString=".jpg") returned 4 [0197.656] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.656] lstrlenW (lpString=".doc") returned 4 [0197.656] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.656] lstrlenW (lpString=".docx") returned 5 [0197.656] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.656] lstrlenW (lpString=".pdf") returned 4 [0197.656] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.656] lstrlenW (lpString=".xls") returned 4 [0197.656] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.656] lstrlenW (lpString=".xlsx") returned 5 [0197.656] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.656] lstrlenW (lpString=".ppt") returned 4 [0197.656] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.656] lstrlenW (lpString=".zip") returned 4 [0197.656] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.656] lstrlenW (lpString=".rar") returned 4 [0197.656] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.656] lstrlenW (lpString=".bz2") returned 4 [0197.656] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.656] lstrlenW (lpString=".7z") returned 3 [0197.656] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.656] lstrlenW (lpString=".dbf") returned 4 [0197.656] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.656] lstrlenW (lpString=".1cd") returned 4 [0197.656] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.656] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\bn\\messages.json") returned 160 [0197.656] lstrlenW (lpString=".jpg") returned 4 [0197.656] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.657] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.657] lstrlenW (lpString="messages.json") returned 13 [0197.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.657] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=16477) returned 1 [0197.657] CloseHandle (hObject=0x388) returned 1 [0197.657] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json")) returned 0x2020 [0197.657] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.657] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.658] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.658] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.658] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.658] GetLastError () returned 0x0 [0197.658] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x405d, lpOverlapped=0x0) returned 1 [0197.660] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x4060, lpOverlapped=0x0) returned 1 [0197.661] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.661] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.661] SetEndOfFile (hFile=0x2d4) returned 1 [0197.661] CloseHandle (hObject=0x2d4) returned 1 [0197.661] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.661] SetEndOfFile (hFile=0x388) returned 1 [0197.662] CloseHandle (hObject=0x388) returned 1 [0197.662] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.662] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json")) returned 1 [0197.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.663] lstrlenW (lpString=".doc") returned 4 [0197.663] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.663] lstrlenW (lpString=".docx") returned 5 [0197.663] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.663] lstrlenW (lpString=".pdf") returned 4 [0197.663] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.663] lstrlenW (lpString=".xls") returned 4 [0197.663] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.663] lstrlenW (lpString=".xlsx") returned 5 [0197.663] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.663] lstrlenW (lpString=".ppt") returned 4 [0197.663] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.663] lstrlenW (lpString=".zip") returned 4 [0197.663] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.663] lstrlenW (lpString=".rar") returned 4 [0197.663] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.663] lstrlenW (lpString=".bz2") returned 4 [0197.663] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.663] lstrlenW (lpString=".7z") returned 3 [0197.663] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.663] lstrlenW (lpString=".dbf") returned 4 [0197.663] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.663] lstrlenW (lpString=".1cd") returned 4 [0197.663] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.664] lstrlenW (lpString=".jpg") returned 4 [0197.664] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.664] lstrlenW (lpString=".doc") returned 4 [0197.664] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.664] lstrlenW (lpString=".docx") returned 5 [0197.664] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.664] lstrlenW (lpString=".pdf") returned 4 [0197.664] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.664] lstrlenW (lpString=".xls") returned 4 [0197.664] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.664] lstrlenW (lpString=".xlsx") returned 5 [0197.664] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.664] lstrlenW (lpString=".ppt") returned 4 [0197.664] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.664] lstrlenW (lpString=".zip") returned 4 [0197.664] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.664] lstrlenW (lpString=".rar") returned 4 [0197.664] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.664] lstrlenW (lpString=".bz2") returned 4 [0197.664] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.664] lstrlenW (lpString=".7z") returned 3 [0197.664] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.664] lstrlenW (lpString=".dbf") returned 4 [0197.664] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.664] lstrlenW (lpString=".1cd") returned 4 [0197.664] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ca\\messages.json") returned 160 [0197.664] lstrlenW (lpString=".jpg") returned 4 [0197.664] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.665] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.665] lstrlenW (lpString="messages.json") returned 13 [0197.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.666] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=16425) returned 1 [0197.666] CloseHandle (hObject=0x388) returned 1 [0197.666] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json")) returned 0x2020 [0197.666] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.666] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.666] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.666] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.667] GetLastError () returned 0x0 [0197.667] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x4029, lpOverlapped=0x0) returned 1 [0197.669] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4030, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x4030, lpOverlapped=0x0) returned 1 [0197.670] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.670] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.670] SetEndOfFile (hFile=0x2d4) returned 1 [0197.670] CloseHandle (hObject=0x2d4) returned 1 [0197.670] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.670] SetEndOfFile (hFile=0x388) returned 1 [0197.671] CloseHandle (hObject=0x388) returned 1 [0197.671] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.672] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json")) returned 1 [0197.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.672] lstrlenW (lpString=".doc") returned 4 [0197.672] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.672] lstrlenW (lpString=".docx") returned 5 [0197.672] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.672] lstrlenW (lpString=".pdf") returned 4 [0197.672] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.672] lstrlenW (lpString=".xls") returned 4 [0197.672] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.672] lstrlenW (lpString=".xlsx") returned 5 [0197.672] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.672] lstrlenW (lpString=".ppt") returned 4 [0197.672] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.672] lstrlenW (lpString=".zip") returned 4 [0197.672] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.672] lstrlenW (lpString=".rar") returned 4 [0197.672] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.672] lstrlenW (lpString=".bz2") returned 4 [0197.672] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.672] lstrlenW (lpString=".7z") returned 3 [0197.672] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.672] lstrlenW (lpString=".dbf") returned 4 [0197.672] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.672] lstrlenW (lpString=".1cd") returned 4 [0197.673] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.673] lstrlenW (lpString=".jpg") returned 4 [0197.673] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.673] lstrlenW (lpString=".doc") returned 4 [0197.673] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.673] lstrlenW (lpString=".docx") returned 5 [0197.673] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.673] lstrlenW (lpString=".pdf") returned 4 [0197.673] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.673] lstrlenW (lpString=".xls") returned 4 [0197.673] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.673] lstrlenW (lpString=".xlsx") returned 5 [0197.673] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.673] lstrlenW (lpString=".ppt") returned 4 [0197.673] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.673] lstrlenW (lpString=".zip") returned 4 [0197.673] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.673] lstrlenW (lpString=".rar") returned 4 [0197.673] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.673] lstrlenW (lpString=".bz2") returned 4 [0197.673] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.673] lstrlenW (lpString=".7z") returned 3 [0197.673] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.673] lstrlenW (lpString=".dbf") returned 4 [0197.673] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.673] lstrlenW (lpString=".1cd") returned 4 [0197.673] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\cs\\messages.json") returned 160 [0197.673] lstrlenW (lpString=".jpg") returned 4 [0197.674] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.674] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.674] lstrlenW (lpString="messages.json") returned 13 [0197.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.674] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=16249) returned 1 [0197.674] CloseHandle (hObject=0x388) returned 1 [0197.674] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json")) returned 0x2020 [0197.674] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.675] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.675] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.675] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.675] GetLastError () returned 0x0 [0197.675] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3f79, lpOverlapped=0x0) returned 1 [0197.851] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3f80, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3f80, lpOverlapped=0x0) returned 1 [0197.852] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.852] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.852] SetEndOfFile (hFile=0x2d4) returned 1 [0197.852] CloseHandle (hObject=0x2d4) returned 1 [0197.853] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.853] SetEndOfFile (hFile=0x388) returned 1 [0197.853] CloseHandle (hObject=0x388) returned 1 [0197.853] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.854] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json")) returned 1 [0197.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.854] lstrlenW (lpString=".doc") returned 4 [0197.854] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.854] lstrlenW (lpString=".docx") returned 5 [0197.854] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.854] lstrlenW (lpString=".pdf") returned 4 [0197.854] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.854] lstrlenW (lpString=".xls") returned 4 [0197.854] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.854] lstrlenW (lpString=".xlsx") returned 5 [0197.854] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.854] lstrlenW (lpString=".ppt") returned 4 [0197.854] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.854] lstrlenW (lpString=".zip") returned 4 [0197.854] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.854] lstrlenW (lpString=".rar") returned 4 [0197.854] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.854] lstrlenW (lpString=".bz2") returned 4 [0197.854] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.854] lstrlenW (lpString=".7z") returned 3 [0197.854] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.854] lstrlenW (lpString=".dbf") returned 4 [0197.854] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.855] lstrlenW (lpString=".1cd") returned 4 [0197.855] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.855] lstrlenW (lpString=".jpg") returned 4 [0197.855] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.855] lstrlenW (lpString=".doc") returned 4 [0197.855] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.855] lstrlenW (lpString=".docx") returned 5 [0197.855] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.855] lstrlenW (lpString=".pdf") returned 4 [0197.855] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.855] lstrlenW (lpString=".xls") returned 4 [0197.855] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.855] lstrlenW (lpString=".xlsx") returned 5 [0197.855] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.855] lstrlenW (lpString=".ppt") returned 4 [0197.855] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.855] lstrlenW (lpString=".zip") returned 4 [0197.855] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.855] lstrlenW (lpString=".rar") returned 4 [0197.855] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.855] lstrlenW (lpString=".bz2") returned 4 [0197.855] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.855] lstrlenW (lpString=".7z") returned 3 [0197.855] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.855] lstrlenW (lpString=".dbf") returned 4 [0197.855] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.856] lstrlenW (lpString=".1cd") returned 4 [0197.856] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.856] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\da\\messages.json") returned 160 [0197.856] lstrlenW (lpString=".jpg") returned 4 [0197.856] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.856] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.856] lstrlenW (lpString="messages.json") returned 13 [0197.856] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.856] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=15965) returned 1 [0197.856] CloseHandle (hObject=0x388) returned 1 [0197.856] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json")) returned 0x2020 [0197.856] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.857] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.857] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.857] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.857] GetLastError () returned 0x0 [0197.857] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3e5d, lpOverlapped=0x0) returned 1 [0197.861] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3e60, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3e60, lpOverlapped=0x0) returned 1 [0197.863] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.863] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.863] SetEndOfFile (hFile=0x2d4) returned 1 [0197.863] CloseHandle (hObject=0x2d4) returned 1 [0197.863] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.863] SetEndOfFile (hFile=0x388) returned 1 [0197.864] CloseHandle (hObject=0x388) returned 1 [0197.864] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.864] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json")) returned 1 [0197.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.864] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.864] lstrlenW (lpString=".doc") returned 4 [0197.864] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.864] lstrlenW (lpString=".docx") returned 5 [0197.864] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.864] lstrlenW (lpString=".pdf") returned 4 [0197.864] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.864] lstrlenW (lpString=".xls") returned 4 [0197.864] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.865] lstrlenW (lpString=".xlsx") returned 5 [0197.865] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.865] lstrlenW (lpString=".ppt") returned 4 [0197.865] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.865] lstrlenW (lpString=".zip") returned 4 [0197.865] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.865] lstrlenW (lpString=".rar") returned 4 [0197.865] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.865] lstrlenW (lpString=".bz2") returned 4 [0197.865] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.865] lstrlenW (lpString=".7z") returned 3 [0197.865] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.865] lstrlenW (lpString=".dbf") returned 4 [0197.865] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.865] lstrlenW (lpString=".1cd") returned 4 [0197.865] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.865] lstrlenW (lpString=".jpg") returned 4 [0197.865] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.865] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.865] lstrlenW (lpString=".doc") returned 4 [0197.865] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.865] lstrlenW (lpString=".docx") returned 5 [0197.865] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.865] lstrlenW (lpString=".pdf") returned 4 [0197.865] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.865] lstrlenW (lpString=".xls") returned 4 [0197.865] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.865] lstrlenW (lpString=".xlsx") returned 5 [0197.865] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.866] lstrlenW (lpString=".ppt") returned 4 [0197.866] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.866] lstrlenW (lpString=".zip") returned 4 [0197.866] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.866] lstrlenW (lpString=".rar") returned 4 [0197.866] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.866] lstrlenW (lpString=".bz2") returned 4 [0197.866] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.866] lstrlenW (lpString=".7z") returned 3 [0197.866] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.866] lstrlenW (lpString=".dbf") returned 4 [0197.866] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.866] lstrlenW (lpString=".1cd") returned 4 [0197.866] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.866] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\id\\messages.json") returned 160 [0197.866] lstrlenW (lpString=".jpg") returned 4 [0197.866] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.866] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.866] lstrlenW (lpString="messages.json") returned 13 [0197.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.867] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=16140) returned 1 [0197.867] CloseHandle (hObject=0x388) returned 1 [0197.867] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json")) returned 0x2020 [0197.867] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.867] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.867] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.867] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.868] GetLastError () returned 0x0 [0197.868] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3f0c, lpOverlapped=0x0) returned 1 [0197.870] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3f10, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3f10, lpOverlapped=0x0) returned 1 [0197.871] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.871] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.871] SetEndOfFile (hFile=0x2d4) returned 1 [0197.871] CloseHandle (hObject=0x2d4) returned 1 [0197.871] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.871] SetEndOfFile (hFile=0x388) returned 1 [0197.872] CloseHandle (hObject=0x388) returned 1 [0197.872] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.872] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json")) returned 1 [0197.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.872] lstrlenW (lpString=".doc") returned 4 [0197.872] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.872] lstrlenW (lpString=".docx") returned 5 [0197.872] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.872] lstrlenW (lpString=".pdf") returned 4 [0197.872] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.872] lstrlenW (lpString=".xls") returned 4 [0197.872] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.872] lstrlenW (lpString=".xlsx") returned 5 [0197.873] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.873] lstrlenW (lpString=".ppt") returned 4 [0197.873] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.873] lstrlenW (lpString=".zip") returned 4 [0197.873] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.873] lstrlenW (lpString=".rar") returned 4 [0197.873] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.873] lstrlenW (lpString=".bz2") returned 4 [0197.873] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.873] lstrlenW (lpString=".7z") returned 3 [0197.873] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.873] lstrlenW (lpString=".dbf") returned 4 [0197.873] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.873] lstrlenW (lpString=".1cd") returned 4 [0197.873] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.873] lstrlenW (lpString=".jpg") returned 4 [0197.873] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.873] lstrlenW (lpString=".doc") returned 4 [0197.873] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.873] lstrlenW (lpString=".docx") returned 5 [0197.873] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.873] lstrlenW (lpString=".pdf") returned 4 [0197.873] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.873] lstrlenW (lpString=".xls") returned 4 [0197.873] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.873] lstrlenW (lpString=".xlsx") returned 5 [0197.873] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.873] lstrlenW (lpString=".ppt") returned 4 [0197.874] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.874] lstrlenW (lpString=".zip") returned 4 [0197.874] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.874] lstrlenW (lpString=".rar") returned 4 [0197.874] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.874] lstrlenW (lpString=".bz2") returned 4 [0197.874] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.874] lstrlenW (lpString=".7z") returned 3 [0197.874] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.874] lstrlenW (lpString=".dbf") returned 4 [0197.874] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.874] lstrlenW (lpString=".1cd") returned 4 [0197.874] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\it\\messages.json") returned 160 [0197.874] lstrlenW (lpString=".jpg") returned 4 [0197.874] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.874] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.874] lstrlenW (lpString="messages.json") returned 13 [0197.874] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.875] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=20596) returned 1 [0197.875] CloseHandle (hObject=0x388) returned 1 [0197.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json")) returned 0x2020 [0197.875] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.875] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.875] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.876] GetLastError () returned 0x0 [0197.876] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x5074, lpOverlapped=0x0) returned 1 [0197.877] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5080, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x5080, lpOverlapped=0x0) returned 1 [0197.879] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.879] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.879] SetEndOfFile (hFile=0x2d4) returned 1 [0197.879] CloseHandle (hObject=0x2d4) returned 1 [0197.879] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.879] SetEndOfFile (hFile=0x388) returned 1 [0197.880] CloseHandle (hObject=0x388) returned 1 [0197.880] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.880] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json")) returned 1 [0197.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.880] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.880] lstrlenW (lpString=".doc") returned 4 [0197.880] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.880] lstrlenW (lpString=".docx") returned 5 [0197.881] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.881] lstrlenW (lpString=".pdf") returned 4 [0197.881] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.881] lstrlenW (lpString=".xls") returned 4 [0197.881] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.881] lstrlenW (lpString=".xlsx") returned 5 [0197.881] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.881] lstrlenW (lpString=".ppt") returned 4 [0197.881] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.881] lstrlenW (lpString=".zip") returned 4 [0197.881] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.881] lstrlenW (lpString=".rar") returned 4 [0197.881] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.881] lstrlenW (lpString=".bz2") returned 4 [0197.881] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.881] lstrlenW (lpString=".7z") returned 3 [0197.881] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.881] lstrlenW (lpString=".dbf") returned 4 [0197.881] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.881] lstrlenW (lpString=".1cd") returned 4 [0197.881] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.881] lstrlenW (lpString=".jpg") returned 4 [0197.881] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.881] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.881] lstrlenW (lpString=".doc") returned 4 [0197.881] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.881] lstrlenW (lpString=".docx") returned 5 [0197.881] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.881] lstrlenW (lpString=".pdf") returned 4 [0197.881] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.882] lstrlenW (lpString=".xls") returned 4 [0197.882] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.882] lstrlenW (lpString=".xlsx") returned 5 [0197.882] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.882] lstrlenW (lpString=".ppt") returned 4 [0197.882] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.882] lstrlenW (lpString=".zip") returned 4 [0197.882] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.882] lstrlenW (lpString=".rar") returned 4 [0197.882] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.882] lstrlenW (lpString=".bz2") returned 4 [0197.882] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.882] lstrlenW (lpString=".7z") returned 3 [0197.882] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.882] lstrlenW (lpString=".dbf") returned 4 [0197.882] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.882] lstrlenW (lpString=".1cd") returned 4 [0197.882] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.882] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\iw\\messages.json") returned 160 [0197.882] lstrlenW (lpString=".jpg") returned 4 [0197.882] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.883] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.883] lstrlenW (lpString="messages.json") returned 13 [0197.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.883] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=17530) returned 1 [0197.883] CloseHandle (hObject=0x388) returned 1 [0197.883] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json")) returned 0x2020 [0197.883] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.883] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.883] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.884] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.884] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.884] GetLastError () returned 0x0 [0197.884] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x447a, lpOverlapped=0x0) returned 1 [0197.886] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4480, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x4480, lpOverlapped=0x0) returned 1 [0197.887] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0197.887] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0197.887] SetEndOfFile (hFile=0x2d4) returned 1 [0197.887] CloseHandle (hObject=0x2d4) returned 1 [0197.888] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.888] SetEndOfFile (hFile=0x388) returned 1 [0197.888] CloseHandle (hObject=0x388) returned 1 [0197.888] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0197.889] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json")) returned 1 [0197.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.889] lstrlenW (lpString=".doc") returned 4 [0197.889] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.889] lstrlenW (lpString=".docx") returned 5 [0197.889] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.889] lstrlenW (lpString=".pdf") returned 4 [0197.889] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.889] lstrlenW (lpString=".xls") returned 4 [0197.889] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.889] lstrlenW (lpString=".xlsx") returned 5 [0197.889] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.889] lstrlenW (lpString=".ppt") returned 4 [0197.889] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.889] lstrlenW (lpString=".zip") returned 4 [0197.889] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.889] lstrlenW (lpString=".rar") returned 4 [0197.889] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.889] lstrlenW (lpString=".bz2") returned 4 [0197.889] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.889] lstrlenW (lpString=".7z") returned 3 [0197.889] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.889] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.889] lstrlenW (lpString=".dbf") returned 4 [0197.889] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.890] lstrlenW (lpString=".1cd") returned 4 [0197.890] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.890] lstrlenW (lpString=".jpg") returned 4 [0197.890] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.890] lstrlenW (lpString=".doc") returned 4 [0197.890] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0197.890] lstrlenW (lpString=".docx") returned 5 [0197.890] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0197.890] lstrlenW (lpString=".pdf") returned 4 [0197.890] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0197.890] lstrlenW (lpString=".xls") returned 4 [0197.890] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0197.890] lstrlenW (lpString=".xlsx") returned 5 [0197.890] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0197.890] lstrlenW (lpString=".ppt") returned 4 [0197.890] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0197.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.890] lstrlenW (lpString=".zip") returned 4 [0197.890] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0197.890] lstrlenW (lpString=".rar") returned 4 [0197.890] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0197.890] lstrlenW (lpString=".bz2") returned 4 [0197.890] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0197.890] lstrlenW (lpString=".7z") returned 3 [0197.890] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0197.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.890] lstrlenW (lpString=".dbf") returned 4 [0197.890] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0197.890] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.890] lstrlenW (lpString=".1cd") returned 4 [0197.891] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0197.891] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\ja\\messages.json") returned 160 [0197.891] lstrlenW (lpString=".jpg") returned 4 [0197.891] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0197.891] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0197.891] lstrlenW (lpString="messages.json") returned 13 [0197.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.891] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=21923) returned 1 [0197.891] CloseHandle (hObject=0x388) returned 1 [0197.891] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json")) returned 0x2020 [0197.891] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0197.891] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0197.892] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.892] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0197.892] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0197.892] GetLastError () returned 0x0 [0197.892] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x55a3, lpOverlapped=0x0) returned 1 [0198.051] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x55b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x55b0, lpOverlapped=0x0) returned 1 [0198.052] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.052] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.053] SetEndOfFile (hFile=0x2d4) returned 1 [0198.053] CloseHandle (hObject=0x2d4) returned 1 [0198.053] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.053] SetEndOfFile (hFile=0x388) returned 1 [0198.054] CloseHandle (hObject=0x388) returned 1 [0198.054] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.054] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json")) returned 1 [0198.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.056] lstrlenW (lpString=".doc") returned 4 [0198.056] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.056] lstrlenW (lpString=".docx") returned 5 [0198.056] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.056] lstrlenW (lpString=".pdf") returned 4 [0198.056] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.056] lstrlenW (lpString=".xls") returned 4 [0198.057] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.057] lstrlenW (lpString=".xlsx") returned 5 [0198.057] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.057] lstrlenW (lpString=".ppt") returned 4 [0198.057] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.057] lstrlenW (lpString=".zip") returned 4 [0198.057] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.057] lstrlenW (lpString=".rar") returned 4 [0198.057] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.057] lstrlenW (lpString=".bz2") returned 4 [0198.057] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.057] lstrlenW (lpString=".7z") returned 3 [0198.057] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.057] lstrlenW (lpString=".dbf") returned 4 [0198.057] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.057] lstrlenW (lpString=".1cd") returned 4 [0198.057] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.057] lstrlenW (lpString=".jpg") returned 4 [0198.057] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.057] lstrlenW (lpString=".doc") returned 4 [0198.057] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.057] lstrlenW (lpString=".docx") returned 5 [0198.057] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.057] lstrlenW (lpString=".pdf") returned 4 [0198.057] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.057] lstrlenW (lpString=".xls") returned 4 [0198.058] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.058] lstrlenW (lpString=".xlsx") returned 5 [0198.058] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.058] lstrlenW (lpString=".ppt") returned 4 [0198.058] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.058] lstrlenW (lpString=".zip") returned 4 [0198.058] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.058] lstrlenW (lpString=".rar") returned 4 [0198.058] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.058] lstrlenW (lpString=".bz2") returned 4 [0198.058] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.058] lstrlenW (lpString=".7z") returned 3 [0198.058] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.058] lstrlenW (lpString=".dbf") returned 4 [0198.058] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.058] lstrlenW (lpString=".1cd") returned 4 [0198.058] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\kn\\messages.json") returned 160 [0198.058] lstrlenW (lpString=".jpg") returned 4 [0198.058] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.058] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.058] lstrlenW (lpString="messages.json") returned 13 [0198.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.059] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=16637) returned 1 [0198.059] CloseHandle (hObject=0x388) returned 1 [0198.059] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json")) returned 0x2020 [0198.059] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.059] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.059] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0198.060] GetLastError () returned 0x0 [0198.060] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x40fd, lpOverlapped=0x0) returned 1 [0198.062] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x4100, lpOverlapped=0x0) returned 1 [0198.063] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.063] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.063] SetEndOfFile (hFile=0x2d4) returned 1 [0198.063] CloseHandle (hObject=0x2d4) returned 1 [0198.063] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.063] SetEndOfFile (hFile=0x388) returned 1 [0198.064] CloseHandle (hObject=0x388) returned 1 [0198.064] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.064] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json")) returned 1 [0198.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.065] lstrlenW (lpString=".doc") returned 4 [0198.065] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.065] lstrlenW (lpString=".docx") returned 5 [0198.065] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.065] lstrlenW (lpString=".pdf") returned 4 [0198.065] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.065] lstrlenW (lpString=".xls") returned 4 [0198.065] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.065] lstrlenW (lpString=".xlsx") returned 5 [0198.065] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.065] lstrlenW (lpString=".ppt") returned 4 [0198.065] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.065] lstrlenW (lpString=".zip") returned 4 [0198.065] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.065] lstrlenW (lpString=".rar") returned 4 [0198.065] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.065] lstrlenW (lpString=".bz2") returned 4 [0198.065] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.065] lstrlenW (lpString=".7z") returned 3 [0198.065] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.065] lstrlenW (lpString=".dbf") returned 4 [0198.065] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.065] lstrlenW (lpString=".1cd") returned 4 [0198.065] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.065] lstrlenW (lpString=".jpg") returned 4 [0198.065] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.066] lstrlenW (lpString=".doc") returned 4 [0198.066] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.066] lstrlenW (lpString=".docx") returned 5 [0198.066] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.066] lstrlenW (lpString=".pdf") returned 4 [0198.066] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.066] lstrlenW (lpString=".xls") returned 4 [0198.066] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.066] lstrlenW (lpString=".xlsx") returned 5 [0198.066] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.066] lstrlenW (lpString=".ppt") returned 4 [0198.066] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.066] lstrlenW (lpString=".zip") returned 4 [0198.066] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.066] lstrlenW (lpString=".rar") returned 4 [0198.066] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.066] lstrlenW (lpString=".bz2") returned 4 [0198.066] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.066] lstrlenW (lpString=".7z") returned 3 [0198.066] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.066] lstrlenW (lpString=".dbf") returned 4 [0198.066] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.066] lstrlenW (lpString=".1cd") returned 4 [0198.066] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sk\\messages.json") returned 160 [0198.066] lstrlenW (lpString=".jpg") returned 4 [0198.066] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.067] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.067] lstrlenW (lpString="messages.json") returned 13 [0198.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.067] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=16506) returned 1 [0198.067] CloseHandle (hObject=0x388) returned 1 [0198.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json")) returned 0x2020 [0198.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.067] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.067] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.068] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0198.068] GetLastError () returned 0x0 [0198.068] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x407a, lpOverlapped=0x0) returned 1 [0198.070] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x4080, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x4080, lpOverlapped=0x0) returned 1 [0198.071] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.071] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.072] SetEndOfFile (hFile=0x2d4) returned 1 [0198.072] CloseHandle (hObject=0x2d4) returned 1 [0198.072] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.072] SetEndOfFile (hFile=0x388) returned 1 [0198.073] CloseHandle (hObject=0x388) returned 1 [0198.073] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.073] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json")) returned 1 [0198.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.073] lstrlenW (lpString=".doc") returned 4 [0198.073] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.073] lstrlenW (lpString=".docx") returned 5 [0198.073] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.073] lstrlenW (lpString=".pdf") returned 4 [0198.073] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.073] lstrlenW (lpString=".xls") returned 4 [0198.073] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.073] lstrlenW (lpString=".xlsx") returned 5 [0198.073] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.073] lstrlenW (lpString=".ppt") returned 4 [0198.073] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.073] lstrlenW (lpString=".zip") returned 4 [0198.074] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.074] lstrlenW (lpString=".rar") returned 4 [0198.074] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.074] lstrlenW (lpString=".bz2") returned 4 [0198.074] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.074] lstrlenW (lpString=".7z") returned 3 [0198.074] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.074] lstrlenW (lpString=".dbf") returned 4 [0198.074] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.074] lstrlenW (lpString=".1cd") returned 4 [0198.074] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.074] lstrlenW (lpString=".jpg") returned 4 [0198.074] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.074] lstrlenW (lpString=".doc") returned 4 [0198.074] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.074] lstrlenW (lpString=".docx") returned 5 [0198.074] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.074] lstrlenW (lpString=".pdf") returned 4 [0198.074] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.074] lstrlenW (lpString=".xls") returned 4 [0198.074] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.074] lstrlenW (lpString=".xlsx") returned 5 [0198.074] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.074] lstrlenW (lpString=".ppt") returned 4 [0198.074] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.074] lstrlenW (lpString=".zip") returned 4 [0198.075] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.075] lstrlenW (lpString=".rar") returned 4 [0198.075] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.075] lstrlenW (lpString=".bz2") returned 4 [0198.075] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.075] lstrlenW (lpString=".7z") returned 3 [0198.075] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.075] lstrlenW (lpString=".dbf") returned 4 [0198.075] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.075] lstrlenW (lpString=".1cd") returned 4 [0198.075] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sl\\messages.json") returned 160 [0198.075] lstrlenW (lpString=".jpg") returned 4 [0198.075] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.075] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.075] lstrlenW (lpString="messages.json") returned 13 [0198.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.076] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=18881) returned 1 [0198.076] CloseHandle (hObject=0x388) returned 1 [0198.076] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json")) returned 0x2020 [0198.076] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.076] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.076] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0198.077] GetLastError () returned 0x0 [0198.077] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x49c1, lpOverlapped=0x0) returned 1 [0198.079] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x49d0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x49d0, lpOverlapped=0x0) returned 1 [0198.080] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.080] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.080] SetEndOfFile (hFile=0x2d4) returned 1 [0198.080] CloseHandle (hObject=0x2d4) returned 1 [0198.080] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.080] SetEndOfFile (hFile=0x388) returned 1 [0198.081] CloseHandle (hObject=0x388) returned 1 [0198.081] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.081] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json")) returned 1 [0198.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.081] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.081] lstrlenW (lpString=".doc") returned 4 [0198.081] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.081] lstrlenW (lpString=".docx") returned 5 [0198.081] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.081] lstrlenW (lpString=".pdf") returned 4 [0198.081] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.081] lstrlenW (lpString=".xls") returned 4 [0198.081] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.082] lstrlenW (lpString=".xlsx") returned 5 [0198.082] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.082] lstrlenW (lpString=".ppt") returned 4 [0198.082] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.082] lstrlenW (lpString=".zip") returned 4 [0198.082] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.082] lstrlenW (lpString=".rar") returned 4 [0198.082] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.082] lstrlenW (lpString=".bz2") returned 4 [0198.082] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.082] lstrlenW (lpString=".7z") returned 3 [0198.082] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.082] lstrlenW (lpString=".dbf") returned 4 [0198.082] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.082] lstrlenW (lpString=".1cd") returned 4 [0198.082] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.082] lstrlenW (lpString=".jpg") returned 4 [0198.082] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.082] lstrlenW (lpString=".doc") returned 4 [0198.082] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.082] lstrlenW (lpString=".docx") returned 5 [0198.082] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.082] lstrlenW (lpString=".pdf") returned 4 [0198.082] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.082] lstrlenW (lpString=".xls") returned 4 [0198.082] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.083] lstrlenW (lpString=".xlsx") returned 5 [0198.083] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.083] lstrlenW (lpString=".ppt") returned 4 [0198.083] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.083] lstrlenW (lpString=".zip") returned 4 [0198.083] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.083] lstrlenW (lpString=".rar") returned 4 [0198.083] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.083] lstrlenW (lpString=".bz2") returned 4 [0198.083] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.083] lstrlenW (lpString=".7z") returned 3 [0198.083] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.083] lstrlenW (lpString=".dbf") returned 4 [0198.083] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.083] lstrlenW (lpString=".1cd") returned 4 [0198.083] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sr\\messages.json") returned 160 [0198.083] lstrlenW (lpString=".jpg") returned 4 [0198.083] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.083] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0198.083] lstrlenW (lpString="messages.json") returned 13 [0198.083] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.084] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=16022) returned 1 [0198.084] CloseHandle (hObject=0x388) returned 1 [0198.084] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json")) returned 0x2020 [0198.084] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.084] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.084] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0198.085] GetLastError () returned 0x0 [0198.085] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3e96, lpOverlapped=0x0) returned 1 [0198.248] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3ea0, lpOverlapped=0x0) returned 1 [0198.272] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.272] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0198.272] SetEndOfFile (hFile=0x2d4) returned 1 [0198.272] CloseHandle (hObject=0x2d4) returned 1 [0198.273] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.273] SetEndOfFile (hFile=0x388) returned 1 [0198.273] CloseHandle (hObject=0x388) returned 1 [0198.273] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.274] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json")) returned 1 [0198.274] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.274] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.274] lstrlenW (lpString=".doc") returned 4 [0198.274] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.274] lstrlenW (lpString=".docx") returned 5 [0198.274] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.274] lstrlenW (lpString=".pdf") returned 4 [0198.274] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.274] lstrlenW (lpString=".xls") returned 4 [0198.274] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.274] lstrlenW (lpString=".xlsx") returned 5 [0198.274] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.274] lstrlenW (lpString=".ppt") returned 4 [0198.274] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.274] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.274] lstrlenW (lpString=".zip") returned 4 [0198.274] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.274] lstrlenW (lpString=".rar") returned 4 [0198.274] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.274] lstrlenW (lpString=".bz2") returned 4 [0198.274] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.274] lstrlenW (lpString=".7z") returned 3 [0198.274] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.275] lstrlenW (lpString=".dbf") returned 4 [0198.275] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.275] lstrlenW (lpString=".1cd") returned 4 [0198.275] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.275] lstrlenW (lpString=".jpg") returned 4 [0198.275] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.275] lstrlenW (lpString=".doc") returned 4 [0198.275] lstrcmpiW (lpString1=".doc", lpString2="json") returned -1 [0198.275] lstrlenW (lpString=".docx") returned 5 [0198.275] lstrcmpiW (lpString1=".docx", lpString2=".json") returned -1 [0198.275] lstrlenW (lpString=".pdf") returned 4 [0198.275] lstrcmpiW (lpString1=".pdf", lpString2="json") returned -1 [0198.275] lstrlenW (lpString=".xls") returned 4 [0198.275] lstrcmpiW (lpString1=".xls", lpString2="json") returned -1 [0198.275] lstrlenW (lpString=".xlsx") returned 5 [0198.275] lstrcmpiW (lpString1=".xlsx", lpString2=".json") returned 1 [0198.275] lstrlenW (lpString=".ppt") returned 4 [0198.275] lstrcmpiW (lpString1=".ppt", lpString2="json") returned -1 [0198.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.275] lstrlenW (lpString=".zip") returned 4 [0198.275] lstrcmpiW (lpString1=".zip", lpString2="json") returned -1 [0198.275] lstrlenW (lpString=".rar") returned 4 [0198.275] lstrcmpiW (lpString1=".rar", lpString2="json") returned -1 [0198.275] lstrlenW (lpString=".bz2") returned 4 [0198.275] lstrcmpiW (lpString1=".bz2", lpString2="json") returned -1 [0198.275] lstrlenW (lpString=".7z") returned 3 [0198.275] lstrcmpiW (lpString1=".7z", lpString2="son") returned -1 [0198.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.276] lstrlenW (lpString=".dbf") returned 4 [0198.276] lstrcmpiW (lpString1=".dbf", lpString2="json") returned -1 [0198.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.276] lstrlenW (lpString=".1cd") returned 4 [0198.276] lstrcmpiW (lpString1=".1cd", lpString2="json") returned -1 [0198.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extensions\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\5817.313.0.5_0\\_locales\\sv\\messages.json") returned 160 [0198.276] lstrlenW (lpString=".jpg") returned 4 [0198.276] lstrcmpiW (lpString1=".jpg", lpString2="json") returned -1 [0198.276] lstrcmpiW (lpString1=".log", lpString2=".wiki") returned -1 [0198.276] lstrlenW (lpString="000003.log") returned 10 [0198.276] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.277] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=0) returned 1 [0198.277] CloseHandle (hObject=0x388) returned 1 [0198.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.277] lstrlenW (lpString=".doc") returned 4 [0198.277] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0198.277] lstrlenW (lpString=".docx") returned 5 [0198.277] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0198.277] lstrlenW (lpString=".pdf") returned 4 [0198.277] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0198.277] lstrlenW (lpString=".xls") returned 4 [0198.277] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0198.277] lstrlenW (lpString=".xlsx") returned 5 [0198.277] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0198.277] lstrlenW (lpString=".ppt") returned 4 [0198.277] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0198.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.277] lstrlenW (lpString=".zip") returned 4 [0198.277] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0198.277] lstrlenW (lpString=".rar") returned 4 [0198.278] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0198.278] lstrlenW (lpString=".bz2") returned 4 [0198.278] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0198.278] lstrlenW (lpString=".7z") returned 3 [0198.278] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0198.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.278] lstrlenW (lpString=".dbf") returned 4 [0198.278] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0198.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.278] lstrlenW (lpString=".1cd") returned 4 [0198.278] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0198.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.278] lstrlenW (lpString=".jpg") returned 4 [0198.278] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0198.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.278] lstrlenW (lpString=".doc") returned 4 [0198.278] lstrcmpiW (lpString1=".doc", lpString2=".log") returned -1 [0198.278] lstrlenW (lpString=".docx") returned 5 [0198.278] lstrcmpiW (lpString1=".docx", lpString2="3.log") returned -1 [0198.278] lstrlenW (lpString=".pdf") returned 4 [0198.278] lstrcmpiW (lpString1=".pdf", lpString2=".log") returned 1 [0198.278] lstrlenW (lpString=".xls") returned 4 [0198.278] lstrcmpiW (lpString1=".xls", lpString2=".log") returned 1 [0198.278] lstrlenW (lpString=".xlsx") returned 5 [0198.278] lstrcmpiW (lpString1=".xlsx", lpString2="3.log") returned -1 [0198.278] lstrlenW (lpString=".ppt") returned 4 [0198.278] lstrcmpiW (lpString1=".ppt", lpString2=".log") returned 1 [0198.278] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.278] lstrlenW (lpString=".zip") returned 4 [0198.278] lstrcmpiW (lpString1=".zip", lpString2=".log") returned 1 [0198.278] lstrlenW (lpString=".rar") returned 4 [0198.278] lstrcmpiW (lpString1=".rar", lpString2=".log") returned 1 [0198.278] lstrlenW (lpString=".bz2") returned 4 [0198.279] lstrcmpiW (lpString1=".bz2", lpString2=".log") returned -1 [0198.279] lstrlenW (lpString=".7z") returned 3 [0198.279] lstrcmpiW (lpString1=".7z", lpString2="log") returned -1 [0198.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.279] lstrlenW (lpString=".dbf") returned 4 [0198.279] lstrcmpiW (lpString1=".dbf", lpString2=".log") returned -1 [0198.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.279] lstrlenW (lpString=".1cd") returned 4 [0198.279] lstrcmpiW (lpString1=".1cd", lpString2=".log") returned -1 [0198.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\000003.log") returned 143 [0198.279] lstrlenW (lpString=".jpg") returned 4 [0198.279] lstrcmpiW (lpString1=".jpg", lpString2=".log") returned -1 [0198.279] lstrcmpiW (lpString1=".db", lpString2=".wiki") returned -1 [0198.279] lstrlenW (lpString="IconCache.db") returned 12 [0198.279] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.279] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1208859) returned 1 [0198.279] CloseHandle (hObject=0x388) returned 1 [0198.279] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db")) returned 0x2022 [0198.279] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.280] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.280] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0198.280] GetLastError () returned 0x0 [0198.280] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0198.306] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0198.482] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2722b, lpOverlapped=0x0) returned 1 [0198.499] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x27230, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x27230, lpOverlapped=0x0) returned 1 [0198.504] ReadFile (in: hFile=0x388, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.504] WriteFile (in: hFile=0x2d4, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.505] SetEndOfFile (hFile=0x2d4) returned 1 [0198.505] CloseHandle (hObject=0x2d4) returned 1 [0198.505] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.505] SetEndOfFile (hFile=0x388) returned 1 [0198.507] CloseHandle (hObject=0x388) returned 1 [0198.507] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2022) returned 1 [0198.507] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\iconcache.db")) returned 1 [0198.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.508] lstrlenW (lpString=".doc") returned 4 [0198.508] lstrcmpiW (lpString1=".doc", lpString2="e.db") returned -1 [0198.508] lstrlenW (lpString=".docx") returned 5 [0198.508] lstrcmpiW (lpString1=".docx", lpString2="he.db") returned -1 [0198.508] lstrlenW (lpString=".pdf") returned 4 [0198.508] lstrcmpiW (lpString1=".pdf", lpString2="e.db") returned -1 [0198.508] lstrlenW (lpString=".xls") returned 4 [0198.508] lstrcmpiW (lpString1=".xls", lpString2="e.db") returned -1 [0198.508] lstrlenW (lpString=".xlsx") returned 5 [0198.508] lstrcmpiW (lpString1=".xlsx", lpString2="he.db") returned -1 [0198.508] lstrlenW (lpString=".ppt") returned 4 [0198.508] lstrcmpiW (lpString1=".ppt", lpString2="e.db") returned -1 [0198.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.508] lstrlenW (lpString=".zip") returned 4 [0198.508] lstrcmpiW (lpString1=".zip", lpString2="e.db") returned -1 [0198.508] lstrlenW (lpString=".rar") returned 4 [0198.508] lstrcmpiW (lpString1=".rar", lpString2="e.db") returned -1 [0198.508] lstrlenW (lpString=".bz2") returned 4 [0198.508] lstrcmpiW (lpString1=".bz2", lpString2="e.db") returned -1 [0198.508] lstrlenW (lpString=".7z") returned 3 [0198.508] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.508] lstrlenW (lpString=".dbf") returned 4 [0198.508] lstrcmpiW (lpString1=".dbf", lpString2="e.db") returned -1 [0198.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.508] lstrlenW (lpString=".1cd") returned 4 [0198.508] lstrcmpiW (lpString1=".1cd", lpString2="e.db") returned -1 [0198.508] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.508] lstrlenW (lpString=".jpg") returned 4 [0198.508] lstrcmpiW (lpString1=".jpg", lpString2="e.db") returned -1 [0198.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.509] lstrlenW (lpString=".doc") returned 4 [0198.509] lstrcmpiW (lpString1=".doc", lpString2="e.db") returned -1 [0198.509] lstrlenW (lpString=".docx") returned 5 [0198.509] lstrcmpiW (lpString1=".docx", lpString2="he.db") returned -1 [0198.509] lstrlenW (lpString=".pdf") returned 4 [0198.509] lstrcmpiW (lpString1=".pdf", lpString2="e.db") returned -1 [0198.509] lstrlenW (lpString=".xls") returned 4 [0198.509] lstrcmpiW (lpString1=".xls", lpString2="e.db") returned -1 [0198.509] lstrlenW (lpString=".xlsx") returned 5 [0198.509] lstrcmpiW (lpString1=".xlsx", lpString2="he.db") returned -1 [0198.509] lstrlenW (lpString=".ppt") returned 4 [0198.509] lstrcmpiW (lpString1=".ppt", lpString2="e.db") returned -1 [0198.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.509] lstrlenW (lpString=".zip") returned 4 [0198.509] lstrcmpiW (lpString1=".zip", lpString2="e.db") returned -1 [0198.509] lstrlenW (lpString=".rar") returned 4 [0198.509] lstrcmpiW (lpString1=".rar", lpString2="e.db") returned -1 [0198.509] lstrlenW (lpString=".bz2") returned 4 [0198.509] lstrcmpiW (lpString1=".bz2", lpString2="e.db") returned -1 [0198.509] lstrlenW (lpString=".7z") returned 3 [0198.509] lstrcmpiW (lpString1=".7z", lpString2=".db") returned -1 [0198.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.509] lstrlenW (lpString=".dbf") returned 4 [0198.509] lstrcmpiW (lpString1=".dbf", lpString2="e.db") returned -1 [0198.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.509] lstrlenW (lpString=".1cd") returned 4 [0198.509] lstrcmpiW (lpString1=".1cd", lpString2="e.db") returned -1 [0198.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\IconCache.db") returned 56 [0198.509] lstrlenW (lpString=".jpg") returned 4 [0198.509] lstrcmpiW (lpString1=".jpg", lpString2="e.db") returned -1 [0198.510] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0198.510] lstrlenW (lpString="desktop.ini") returned 11 [0198.510] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.566] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=67) returned 1 [0198.566] CloseHandle (hObject=0x354) returned 1 [0198.566] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 0x2026 [0198.566] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.567] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.567] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.567] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.567] GetLastError () returned 0x0 [0198.567] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x43, lpOverlapped=0x0) returned 1 [0198.568] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x50, lpOverlapped=0x0) returned 1 [0198.569] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.569] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0198.569] SetEndOfFile (hFile=0x388) returned 1 [0198.569] CloseHandle (hObject=0x388) returned 1 [0198.569] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.570] SetEndOfFile (hFile=0x354) returned 1 [0198.570] CloseHandle (hObject=0x354) returned 1 [0198.570] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0198.570] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\desktop.ini")) returned 1 [0198.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.571] lstrlenW (lpString=".doc") returned 4 [0198.571] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.571] lstrlenW (lpString=".docx") returned 5 [0198.571] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.571] lstrlenW (lpString=".pdf") returned 4 [0198.571] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.571] lstrlenW (lpString=".xls") returned 4 [0198.571] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.571] lstrlenW (lpString=".xlsx") returned 5 [0198.571] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.571] lstrlenW (lpString=".ppt") returned 4 [0198.571] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.571] lstrlenW (lpString=".zip") returned 4 [0198.571] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.571] lstrlenW (lpString=".rar") returned 4 [0198.571] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.571] lstrlenW (lpString=".bz2") returned 4 [0198.571] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.571] lstrlenW (lpString=".7z") returned 3 [0198.571] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.571] lstrlenW (lpString=".dbf") returned 4 [0198.571] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.571] lstrlenW (lpString=".1cd") returned 4 [0198.571] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.571] lstrlenW (lpString=".jpg") returned 4 [0198.572] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.572] lstrlenW (lpString=".doc") returned 4 [0198.572] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.572] lstrlenW (lpString=".docx") returned 5 [0198.572] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.572] lstrlenW (lpString=".pdf") returned 4 [0198.572] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.572] lstrlenW (lpString=".xls") returned 4 [0198.572] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.572] lstrlenW (lpString=".xlsx") returned 5 [0198.572] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.572] lstrlenW (lpString=".ppt") returned 4 [0198.572] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.572] lstrlenW (lpString=".zip") returned 4 [0198.572] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.572] lstrlenW (lpString=".rar") returned 4 [0198.572] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.572] lstrlenW (lpString=".bz2") returned 4 [0198.572] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.572] lstrlenW (lpString=".7z") returned 3 [0198.572] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.572] lstrlenW (lpString=".dbf") returned 4 [0198.572] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.572] lstrlenW (lpString=".1cd") returned 4 [0198.572] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\desktop.ini") returned 77 [0198.572] lstrlenW (lpString=".jpg") returned 4 [0198.572] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.573] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0198.573] lstrlenW (lpString="desktop.ini") returned 11 [0198.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.573] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=67) returned 1 [0198.573] CloseHandle (hObject=0x354) returned 1 [0198.578] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 0x2026 [0198.579] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.579] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.579] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.581] GetLastError () returned 0x0 [0198.581] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x43, lpOverlapped=0x0) returned 1 [0198.581] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x50, lpOverlapped=0x0) returned 1 [0198.582] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.582] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0198.582] SetEndOfFile (hFile=0x388) returned 1 [0198.583] CloseHandle (hObject=0x388) returned 1 [0198.583] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.583] SetEndOfFile (hFile=0x354) returned 1 [0198.583] CloseHandle (hObject=0x354) returned 1 [0198.583] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0198.584] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\desktop.ini")) returned 1 [0198.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.584] lstrlenW (lpString=".doc") returned 4 [0198.584] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.584] lstrlenW (lpString=".docx") returned 5 [0198.584] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.584] lstrlenW (lpString=".pdf") returned 4 [0198.584] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.584] lstrlenW (lpString=".xls") returned 4 [0198.584] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.584] lstrlenW (lpString=".xlsx") returned 5 [0198.584] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.584] lstrlenW (lpString=".ppt") returned 4 [0198.584] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.584] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.584] lstrlenW (lpString=".zip") returned 4 [0198.584] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.584] lstrlenW (lpString=".rar") returned 4 [0198.584] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.585] lstrlenW (lpString=".bz2") returned 4 [0198.585] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.585] lstrlenW (lpString=".7z") returned 3 [0198.585] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.585] lstrlenW (lpString=".dbf") returned 4 [0198.585] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.585] lstrlenW (lpString=".1cd") returned 4 [0198.585] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.585] lstrlenW (lpString=".jpg") returned 4 [0198.585] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.585] lstrlenW (lpString=".doc") returned 4 [0198.585] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0198.585] lstrlenW (lpString=".docx") returned 5 [0198.585] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0198.585] lstrlenW (lpString=".pdf") returned 4 [0198.585] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0198.585] lstrlenW (lpString=".xls") returned 4 [0198.585] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0198.585] lstrlenW (lpString=".xlsx") returned 5 [0198.585] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0198.585] lstrlenW (lpString=".ppt") returned 4 [0198.585] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0198.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.585] lstrlenW (lpString=".zip") returned 4 [0198.585] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0198.585] lstrlenW (lpString=".rar") returned 4 [0198.585] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0198.585] lstrlenW (lpString=".bz2") returned 4 [0198.585] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0198.586] lstrlenW (lpString=".7z") returned 3 [0198.586] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0198.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.586] lstrlenW (lpString=".dbf") returned 4 [0198.586] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0198.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.586] lstrlenW (lpString=".1cd") returned 4 [0198.586] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0198.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\desktop.ini") returned 86 [0198.586] lstrlenW (lpString=".jpg") returned 4 [0198.586] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0198.586] lstrcmpiW (lpString1=".DAT", lpString2=".wiki") returned -1 [0198.586] lstrlenW (lpString="FRMCACHE.DAT") returned 12 [0198.586] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.587] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=245980) returned 1 [0198.587] CloseHandle (hObject=0x354) returned 1 [0198.587] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat")) returned 0x2020 [0198.587] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.587] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.587] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.588] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.588] GetLastError () returned 0x0 [0198.588] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3c0dc, lpOverlapped=0x0) returned 1 [0198.594] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3c0e0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3c0e0, lpOverlapped=0x0) returned 1 [0198.599] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.599] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xec, lpOverlapped=0x0) returned 1 [0198.599] SetEndOfFile (hFile=0x388) returned 1 [0198.599] CloseHandle (hObject=0x388) returned 1 [0198.599] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.599] SetEndOfFile (hFile=0x354) returned 1 [0198.602] CloseHandle (hObject=0x354) returned 1 [0198.602] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.602] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\forms\\frmcache.dat")) returned 1 [0198.602] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.602] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.602] lstrlenW (lpString=".doc") returned 4 [0198.602] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0198.602] lstrlenW (lpString=".docx") returned 5 [0198.602] lstrcmpiW (lpString1=".docx", lpString2="E.DAT") returned -1 [0198.602] lstrlenW (lpString=".pdf") returned 4 [0198.602] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0198.602] lstrlenW (lpString=".xls") returned 4 [0198.602] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0198.603] lstrlenW (lpString=".xlsx") returned 5 [0198.603] lstrcmpiW (lpString1=".xlsx", lpString2="E.DAT") returned -1 [0198.603] lstrlenW (lpString=".ppt") returned 4 [0198.603] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0198.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.603] lstrlenW (lpString=".zip") returned 4 [0198.603] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0198.603] lstrlenW (lpString=".rar") returned 4 [0198.603] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0198.603] lstrlenW (lpString=".bz2") returned 4 [0198.603] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0198.603] lstrlenW (lpString=".7z") returned 3 [0198.603] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0198.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.603] lstrlenW (lpString=".dbf") returned 4 [0198.603] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0198.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.603] lstrlenW (lpString=".1cd") returned 4 [0198.603] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0198.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.603] lstrlenW (lpString=".jpg") returned 4 [0198.603] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0198.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.603] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.603] lstrlenW (lpString=".doc") returned 4 [0198.603] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0198.603] lstrlenW (lpString=".docx") returned 5 [0198.603] lstrcmpiW (lpString1=".docx", lpString2="E.DAT") returned -1 [0198.603] lstrlenW (lpString=".pdf") returned 4 [0198.603] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0198.603] lstrlenW (lpString=".xls") returned 4 [0198.603] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0198.603] lstrlenW (lpString=".xlsx") returned 5 [0198.603] lstrcmpiW (lpString1=".xlsx", lpString2="E.DAT") returned -1 [0198.604] lstrlenW (lpString=".ppt") returned 4 [0198.604] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0198.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.604] lstrlenW (lpString=".zip") returned 4 [0198.604] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0198.604] lstrlenW (lpString=".rar") returned 4 [0198.604] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0198.604] lstrlenW (lpString=".bz2") returned 4 [0198.604] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0198.604] lstrlenW (lpString=".7z") returned 3 [0198.604] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0198.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.604] lstrlenW (lpString=".dbf") returned 4 [0198.604] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0198.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.604] lstrlenW (lpString=".1cd") returned 4 [0198.604] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0198.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\FORMS\\FRMCACHE.DAT") returned 72 [0198.604] lstrlenW (lpString=".jpg") returned 4 [0198.604] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0198.604] lstrcmpiW (lpString1=".bak", lpString2=".wiki") returned -1 [0198.604] lstrlenW (lpString="brndlog.bak") returned 11 [0198.604] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.605] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=12201) returned 1 [0198.605] CloseHandle (hObject=0x354) returned 1 [0198.605] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 0x2020 [0198.605] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.605] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.605] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.605] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.606] GetLastError () returned 0x0 [0198.606] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2fa9, lpOverlapped=0x0) returned 1 [0198.761] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2fb0, lpOverlapped=0x0) returned 1 [0198.762] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0198.762] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0198.762] SetEndOfFile (hFile=0x388) returned 1 [0198.763] CloseHandle (hObject=0x388) returned 1 [0198.763] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.763] SetEndOfFile (hFile=0x354) returned 1 [0198.763] CloseHandle (hObject=0x354) returned 1 [0198.764] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0198.764] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\internet explorer\\brndlog.bak")) returned 1 [0198.764] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.764] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.764] lstrlenW (lpString=".doc") returned 4 [0198.764] lstrcmpiW (lpString1=".doc", lpString2=".bak") returned 1 [0198.764] lstrlenW (lpString=".docx") returned 5 [0198.764] lstrcmpiW (lpString1=".docx", lpString2="g.bak") returned -1 [0198.764] lstrlenW (lpString=".pdf") returned 4 [0198.764] lstrcmpiW (lpString1=".pdf", lpString2=".bak") returned 1 [0198.764] lstrlenW (lpString=".xls") returned 4 [0198.764] lstrcmpiW (lpString1=".xls", lpString2=".bak") returned 1 [0198.764] lstrlenW (lpString=".xlsx") returned 5 [0198.764] lstrcmpiW (lpString1=".xlsx", lpString2="g.bak") returned -1 [0198.764] lstrlenW (lpString=".ppt") returned 4 [0198.764] lstrcmpiW (lpString1=".ppt", lpString2=".bak") returned 1 [0198.764] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.764] lstrlenW (lpString=".zip") returned 4 [0198.764] lstrcmpiW (lpString1=".zip", lpString2=".bak") returned 1 [0198.764] lstrlenW (lpString=".rar") returned 4 [0198.764] lstrcmpiW (lpString1=".rar", lpString2=".bak") returned 1 [0198.764] lstrlenW (lpString=".bz2") returned 4 [0198.764] lstrcmpiW (lpString1=".bz2", lpString2=".bak") returned 1 [0198.765] lstrlenW (lpString=".7z") returned 3 [0198.765] lstrcmpiW (lpString1=".7z", lpString2="bak") returned -1 [0198.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.765] lstrlenW (lpString=".dbf") returned 4 [0198.765] lstrcmpiW (lpString1=".dbf", lpString2=".bak") returned 1 [0198.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.765] lstrlenW (lpString=".1cd") returned 4 [0198.765] lstrcmpiW (lpString1=".1cd", lpString2=".bak") returned -1 [0198.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.765] lstrlenW (lpString=".jpg") returned 4 [0198.765] lstrcmpiW (lpString1=".jpg", lpString2=".bak") returned 1 [0198.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.765] lstrlenW (lpString=".doc") returned 4 [0198.765] lstrcmpiW (lpString1=".doc", lpString2=".bak") returned 1 [0198.765] lstrlenW (lpString=".docx") returned 5 [0198.765] lstrcmpiW (lpString1=".docx", lpString2="g.bak") returned -1 [0198.765] lstrlenW (lpString=".pdf") returned 4 [0198.765] lstrcmpiW (lpString1=".pdf", lpString2=".bak") returned 1 [0198.765] lstrlenW (lpString=".xls") returned 4 [0198.765] lstrcmpiW (lpString1=".xls", lpString2=".bak") returned 1 [0198.765] lstrlenW (lpString=".xlsx") returned 5 [0198.765] lstrcmpiW (lpString1=".xlsx", lpString2="g.bak") returned -1 [0198.765] lstrlenW (lpString=".ppt") returned 4 [0198.765] lstrcmpiW (lpString1=".ppt", lpString2=".bak") returned 1 [0198.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.765] lstrlenW (lpString=".zip") returned 4 [0198.765] lstrcmpiW (lpString1=".zip", lpString2=".bak") returned 1 [0198.765] lstrlenW (lpString=".rar") returned 4 [0198.765] lstrcmpiW (lpString1=".rar", lpString2=".bak") returned 1 [0198.765] lstrlenW (lpString=".bz2") returned 4 [0198.765] lstrcmpiW (lpString1=".bz2", lpString2=".bak") returned 1 [0198.765] lstrlenW (lpString=".7z") returned 3 [0198.765] lstrcmpiW (lpString1=".7z", lpString2="bak") returned -1 [0198.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.766] lstrlenW (lpString=".dbf") returned 4 [0198.766] lstrcmpiW (lpString1=".dbf", lpString2=".bak") returned 1 [0198.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.766] lstrlenW (lpString=".1cd") returned 4 [0198.766] lstrcmpiW (lpString1=".1cd", lpString2=".bak") returned -1 [0198.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Internet Explorer\\brndlog.bak") returned 83 [0198.766] lstrlenW (lpString=".jpg") returned 4 [0198.766] lstrcmpiW (lpString1=".jpg", lpString2=".bak") returned 1 [0198.766] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0198.766] lstrlenW (lpString="thumbs.dat") returned 10 [0198.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.766] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=128000) returned 1 [0198.766] CloseHandle (hObject=0x354) returned 1 [0198.767] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat")) returned 0x2020 [0198.767] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.767] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.767] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0199.043] GetLastError () returned 0x0 [0199.043] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x1f400, lpOverlapped=0x0) returned 1 [0199.048] WriteFile (in: hFile=0x350, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1f410, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x1f410, lpOverlapped=0x0) returned 1 [0199.051] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.051] WriteFile (in: hFile=0x350, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0199.051] SetEndOfFile (hFile=0x350) returned 1 [0199.051] CloseHandle (hObject=0x350) returned 1 [0199.051] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.052] SetEndOfFile (hFile=0x354) returned 1 [0199.053] CloseHandle (hObject=0x354) returned 1 [0199.053] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.053] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\visio\\thumbs.dat")) returned 1 [0199.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.054] lstrlenW (lpString=".doc") returned 4 [0199.054] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.054] lstrlenW (lpString=".docx") returned 5 [0199.054] lstrcmpiW (lpString1=".docx", lpString2="s.dat") returned -1 [0199.054] lstrlenW (lpString=".pdf") returned 4 [0199.054] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.054] lstrlenW (lpString=".xls") returned 4 [0199.054] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.054] lstrlenW (lpString=".xlsx") returned 5 [0199.054] lstrcmpiW (lpString1=".xlsx", lpString2="s.dat") returned -1 [0199.054] lstrlenW (lpString=".ppt") returned 4 [0199.054] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.054] lstrlenW (lpString=".zip") returned 4 [0199.054] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.054] lstrlenW (lpString=".rar") returned 4 [0199.054] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.054] lstrlenW (lpString=".bz2") returned 4 [0199.054] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.054] lstrlenW (lpString=".7z") returned 3 [0199.054] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.054] lstrlenW (lpString=".dbf") returned 4 [0199.054] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.054] lstrlenW (lpString=".1cd") returned 4 [0199.054] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.054] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.054] lstrlenW (lpString=".jpg") returned 4 [0199.055] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.055] lstrlenW (lpString=".doc") returned 4 [0199.055] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.055] lstrlenW (lpString=".docx") returned 5 [0199.055] lstrcmpiW (lpString1=".docx", lpString2="s.dat") returned -1 [0199.055] lstrlenW (lpString=".pdf") returned 4 [0199.055] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.055] lstrlenW (lpString=".xls") returned 4 [0199.055] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.055] lstrlenW (lpString=".xlsx") returned 5 [0199.055] lstrcmpiW (lpString1=".xlsx", lpString2="s.dat") returned -1 [0199.055] lstrlenW (lpString=".ppt") returned 4 [0199.055] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.055] lstrlenW (lpString=".zip") returned 4 [0199.055] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.055] lstrlenW (lpString=".rar") returned 4 [0199.055] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.055] lstrlenW (lpString=".bz2") returned 4 [0199.055] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.055] lstrlenW (lpString=".7z") returned 3 [0199.055] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.055] lstrlenW (lpString=".dbf") returned 4 [0199.055] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.055] lstrlenW (lpString=".1cd") returned 4 [0199.055] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Visio\\thumbs.dat") returned 70 [0199.055] lstrlenW (lpString=".jpg") returned 4 [0199.055] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.056] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0199.056] lstrlenW (lpString="desktop.ini") returned 11 [0199.056] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.058] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=145) returned 1 [0199.058] CloseHandle (hObject=0x354) returned 1 [0199.058] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 0x2026 [0199.058] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.058] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.058] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.248] GetLastError () returned 0x0 [0199.248] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x91, lpOverlapped=0x0) returned 1 [0199.249] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0199.250] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.250] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.250] SetEndOfFile (hFile=0x114) returned 1 [0199.250] CloseHandle (hObject=0x114) returned 1 [0199.250] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.250] SetEndOfFile (hFile=0x354) returned 1 [0199.251] CloseHandle (hObject=0x354) returned 1 [0199.251] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.251] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\history\\history.ie5\\desktop.ini")) returned 1 [0199.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.252] lstrlenW (lpString=".doc") returned 4 [0199.252] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.252] lstrlenW (lpString=".docx") returned 5 [0199.252] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.252] lstrlenW (lpString=".pdf") returned 4 [0199.252] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.252] lstrlenW (lpString=".xls") returned 4 [0199.252] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.252] lstrlenW (lpString=".xlsx") returned 5 [0199.252] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.252] lstrlenW (lpString=".ppt") returned 4 [0199.252] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.252] lstrlenW (lpString=".zip") returned 4 [0199.252] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.252] lstrlenW (lpString=".rar") returned 4 [0199.252] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.252] lstrlenW (lpString=".bz2") returned 4 [0199.252] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.252] lstrlenW (lpString=".7z") returned 3 [0199.252] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.252] lstrlenW (lpString=".dbf") returned 4 [0199.252] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.252] lstrlenW (lpString=".1cd") returned 4 [0199.252] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.252] lstrlenW (lpString=".jpg") returned 4 [0199.252] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.252] lstrlenW (lpString=".doc") returned 4 [0199.253] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.253] lstrlenW (lpString=".docx") returned 5 [0199.253] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.253] lstrlenW (lpString=".pdf") returned 4 [0199.253] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.253] lstrlenW (lpString=".xls") returned 4 [0199.253] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.253] lstrlenW (lpString=".xlsx") returned 5 [0199.253] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.253] lstrlenW (lpString=".ppt") returned 4 [0199.253] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.253] lstrlenW (lpString=".zip") returned 4 [0199.253] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.253] lstrlenW (lpString=".rar") returned 4 [0199.253] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.253] lstrlenW (lpString=".bz2") returned 4 [0199.253] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.253] lstrlenW (lpString=".7z") returned 3 [0199.253] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.253] lstrlenW (lpString=".dbf") returned 4 [0199.253] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.253] lstrlenW (lpString=".1cd") returned 4 [0199.253] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\History\\History.IE5\\desktop.ini") returned 93 [0199.253] lstrlenW (lpString=".jpg") returned 4 [0199.253] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.253] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0199.254] lstrlenW (lpString="desktop.ini") returned 11 [0199.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.254] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=67) returned 1 [0199.254] CloseHandle (hObject=0x354) returned 1 [0199.254] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 0x2026 [0199.254] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.254] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.254] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.254] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.255] GetLastError () returned 0x0 [0199.255] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x43, lpOverlapped=0x0) returned 1 [0199.256] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x50, lpOverlapped=0x0) returned 1 [0199.257] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.257] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.257] SetEndOfFile (hFile=0x114) returned 1 [0199.257] CloseHandle (hObject=0x114) returned 1 [0199.257] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.257] SetEndOfFile (hFile=0x354) returned 1 [0199.258] CloseHandle (hObject=0x354) returned 1 [0199.258] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.258] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\desktop.ini")) returned 1 [0199.258] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.258] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.258] lstrlenW (lpString=".doc") returned 4 [0199.259] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.259] lstrlenW (lpString=".docx") returned 5 [0199.259] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.259] lstrlenW (lpString=".pdf") returned 4 [0199.259] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.259] lstrlenW (lpString=".xls") returned 4 [0199.259] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.259] lstrlenW (lpString=".xlsx") returned 5 [0199.259] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.259] lstrlenW (lpString=".ppt") returned 4 [0199.259] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.259] lstrlenW (lpString=".zip") returned 4 [0199.259] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.259] lstrlenW (lpString=".rar") returned 4 [0199.259] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.259] lstrlenW (lpString=".bz2") returned 4 [0199.259] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.259] lstrlenW (lpString=".7z") returned 3 [0199.259] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.259] lstrlenW (lpString=".dbf") returned 4 [0199.259] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.259] lstrlenW (lpString=".1cd") returned 4 [0199.259] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.259] lstrlenW (lpString=".jpg") returned 4 [0199.259] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.259] lstrlenW (lpString=".doc") returned 4 [0199.259] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.260] lstrlenW (lpString=".docx") returned 5 [0199.260] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.260] lstrlenW (lpString=".pdf") returned 4 [0199.260] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.260] lstrlenW (lpString=".xls") returned 4 [0199.260] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.260] lstrlenW (lpString=".xlsx") returned 5 [0199.260] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.260] lstrlenW (lpString=".ppt") returned 4 [0199.260] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.260] lstrlenW (lpString=".zip") returned 4 [0199.260] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.260] lstrlenW (lpString=".rar") returned 4 [0199.260] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.260] lstrlenW (lpString=".bz2") returned 4 [0199.260] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.260] lstrlenW (lpString=".7z") returned 3 [0199.260] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.260] lstrlenW (lpString=".dbf") returned 4 [0199.260] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.260] lstrlenW (lpString=".1cd") returned 4 [0199.260] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\desktop.ini") returned 110 [0199.260] lstrlenW (lpString=".jpg") returned 4 [0199.260] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.260] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0199.260] lstrlenW (lpString="index.dat") returned 9 [0199.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.261] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=65536) returned 1 [0199.261] CloseHandle (hObject=0x354) returned 1 [0199.261] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 0x2026 [0199.261] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.261] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.261] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.262] GetLastError () returned 0x0 [0199.262] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x10000, lpOverlapped=0x0) returned 1 [0199.264] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0199.266] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.266] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.266] SetEndOfFile (hFile=0x114) returned 1 [0199.266] CloseHandle (hObject=0x114) returned 1 [0199.266] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.266] SetEndOfFile (hFile=0x354) returned 1 [0199.267] CloseHandle (hObject=0x354) returned 1 [0199.268] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.268] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\index.dat")) returned 1 [0199.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.268] lstrlenW (lpString=".doc") returned 4 [0199.268] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.268] lstrlenW (lpString=".docx") returned 5 [0199.268] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0199.268] lstrlenW (lpString=".pdf") returned 4 [0199.268] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.268] lstrlenW (lpString=".xls") returned 4 [0199.268] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.268] lstrlenW (lpString=".xlsx") returned 5 [0199.268] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0199.268] lstrlenW (lpString=".ppt") returned 4 [0199.268] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.268] lstrlenW (lpString=".zip") returned 4 [0199.268] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.268] lstrlenW (lpString=".rar") returned 4 [0199.268] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.268] lstrlenW (lpString=".bz2") returned 4 [0199.268] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.269] lstrlenW (lpString=".7z") returned 3 [0199.269] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.269] lstrlenW (lpString=".dbf") returned 4 [0199.269] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.269] lstrlenW (lpString=".1cd") returned 4 [0199.269] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.269] lstrlenW (lpString=".jpg") returned 4 [0199.269] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.269] lstrlenW (lpString=".doc") returned 4 [0199.269] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.269] lstrlenW (lpString=".docx") returned 5 [0199.269] lstrcmpiW (lpString1=".docx", lpString2="x.dat") returned -1 [0199.269] lstrlenW (lpString=".pdf") returned 4 [0199.269] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.269] lstrlenW (lpString=".xls") returned 4 [0199.269] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.269] lstrlenW (lpString=".xlsx") returned 5 [0199.269] lstrcmpiW (lpString1=".xlsx", lpString2="x.dat") returned -1 [0199.269] lstrlenW (lpString=".ppt") returned 4 [0199.269] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.269] lstrlenW (lpString=".zip") returned 4 [0199.269] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.269] lstrlenW (lpString=".rar") returned 4 [0199.269] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.269] lstrlenW (lpString=".bz2") returned 4 [0199.269] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.269] lstrlenW (lpString=".7z") returned 3 [0199.269] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.270] lstrlenW (lpString=".dbf") returned 4 [0199.270] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.270] lstrlenW (lpString=".1cd") returned 4 [0199.270] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\index.dat") returned 108 [0199.270] lstrlenW (lpString=".jpg") returned 4 [0199.270] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.270] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0199.270] lstrlenW (lpString="desktop.ini") returned 11 [0199.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.271] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=67) returned 1 [0199.271] CloseHandle (hObject=0x354) returned 1 [0199.271] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 0x2026 [0199.271] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.272] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.272] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.272] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.272] GetLastError () returned 0x0 [0199.272] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x43, lpOverlapped=0x0) returned 1 [0199.273] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x50, lpOverlapped=0x0) returned 1 [0199.274] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.274] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.274] SetEndOfFile (hFile=0x114) returned 1 [0199.274] CloseHandle (hObject=0x114) returned 1 [0199.274] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.274] SetEndOfFile (hFile=0x354) returned 1 [0199.275] CloseHandle (hObject=0x354) returned 1 [0199.275] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.275] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\mm5o9xqs\\desktop.ini")) returned 1 [0199.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.276] lstrlenW (lpString=".doc") returned 4 [0199.276] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.276] lstrlenW (lpString=".docx") returned 5 [0199.276] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.276] lstrlenW (lpString=".pdf") returned 4 [0199.276] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.276] lstrlenW (lpString=".xls") returned 4 [0199.276] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.276] lstrlenW (lpString=".xlsx") returned 5 [0199.276] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.276] lstrlenW (lpString=".ppt") returned 4 [0199.276] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.276] lstrlenW (lpString=".zip") returned 4 [0199.276] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.276] lstrlenW (lpString=".rar") returned 4 [0199.276] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.276] lstrlenW (lpString=".bz2") returned 4 [0199.276] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.276] lstrlenW (lpString=".7z") returned 3 [0199.276] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.276] lstrlenW (lpString=".dbf") returned 4 [0199.276] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.276] lstrlenW (lpString=".1cd") returned 4 [0199.276] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.276] lstrlenW (lpString=".jpg") returned 4 [0199.276] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.276] lstrlenW (lpString=".doc") returned 4 [0199.277] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.277] lstrlenW (lpString=".docx") returned 5 [0199.277] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.277] lstrlenW (lpString=".pdf") returned 4 [0199.277] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.277] lstrlenW (lpString=".xls") returned 4 [0199.277] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.277] lstrlenW (lpString=".xlsx") returned 5 [0199.277] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.277] lstrlenW (lpString=".ppt") returned 4 [0199.277] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.277] lstrlenW (lpString=".zip") returned 4 [0199.277] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.277] lstrlenW (lpString=".rar") returned 4 [0199.277] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.277] lstrlenW (lpString=".bz2") returned 4 [0199.277] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.277] lstrlenW (lpString=".7z") returned 3 [0199.277] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.277] lstrlenW (lpString=".dbf") returned 4 [0199.277] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.277] lstrlenW (lpString=".1cd") returned 4 [0199.277] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.277] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\MM5O9XQS\\desktop.ini") returned 119 [0199.277] lstrlenW (lpString=".jpg") returned 4 [0199.277] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.277] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0199.278] lstrlenW (lpString="desktop.ini") returned 11 [0199.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.280] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=67) returned 1 [0199.280] CloseHandle (hObject=0x354) returned 1 [0199.280] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 0x2026 [0199.280] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.280] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.280] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.280] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.280] GetLastError () returned 0x0 [0199.280] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x43, lpOverlapped=0x0) returned 1 [0199.282] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x50, lpOverlapped=0x0) returned 1 [0199.283] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.283] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.283] SetEndOfFile (hFile=0x114) returned 1 [0199.283] CloseHandle (hObject=0x114) returned 1 [0199.283] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.283] SetEndOfFile (hFile=0x354) returned 1 [0199.284] CloseHandle (hObject=0x354) returned 1 [0199.284] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.284] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\pmmr5k9k\\desktop.ini")) returned 1 [0199.284] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.284] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.284] lstrlenW (lpString=".doc") returned 4 [0199.284] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.284] lstrlenW (lpString=".docx") returned 5 [0199.284] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.284] lstrlenW (lpString=".pdf") returned 4 [0199.284] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.284] lstrlenW (lpString=".xls") returned 4 [0199.284] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.285] lstrlenW (lpString=".xlsx") returned 5 [0199.285] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.285] lstrlenW (lpString=".ppt") returned 4 [0199.285] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.285] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.285] lstrlenW (lpString=".zip") returned 4 [0199.285] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.285] lstrlenW (lpString=".rar") returned 4 [0199.285] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.285] lstrlenW (lpString=".bz2") returned 4 [0199.285] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.285] lstrlenW (lpString=".7z") returned 3 [0199.285] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.285] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.285] lstrlenW (lpString=".dbf") returned 4 [0199.285] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.285] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.285] lstrlenW (lpString=".1cd") returned 4 [0199.285] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.285] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.285] lstrlenW (lpString=".jpg") returned 4 [0199.285] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.285] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.285] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.285] lstrlenW (lpString=".doc") returned 4 [0199.285] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.285] lstrlenW (lpString=".docx") returned 5 [0199.285] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.285] lstrlenW (lpString=".pdf") returned 4 [0199.285] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.285] lstrlenW (lpString=".xls") returned 4 [0199.285] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.285] lstrlenW (lpString=".xlsx") returned 5 [0199.285] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.286] lstrlenW (lpString=".ppt") returned 4 [0199.286] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.286] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.286] lstrlenW (lpString=".zip") returned 4 [0199.286] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.286] lstrlenW (lpString=".rar") returned 4 [0199.286] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.286] lstrlenW (lpString=".bz2") returned 4 [0199.286] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.286] lstrlenW (lpString=".7z") returned 3 [0199.286] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.286] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.286] lstrlenW (lpString=".dbf") returned 4 [0199.286] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.286] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.286] lstrlenW (lpString=".1cd") returned 4 [0199.286] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.286] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PMMR5K9K\\desktop.ini") returned 119 [0199.286] lstrlenW (lpString=".jpg") returned 4 [0199.286] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.286] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0199.286] lstrlenW (lpString="desktop.ini") returned 11 [0199.286] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.287] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=67) returned 1 [0199.287] CloseHandle (hObject=0x354) returned 1 [0199.287] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 0x2026 [0199.288] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.288] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.288] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.288] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.289] GetLastError () returned 0x0 [0199.289] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x43, lpOverlapped=0x0) returned 1 [0199.289] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x50, lpOverlapped=0x0) returned 1 [0199.290] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.291] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.291] SetEndOfFile (hFile=0x114) returned 1 [0199.291] CloseHandle (hObject=0x114) returned 1 [0199.291] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.291] SetEndOfFile (hFile=0x354) returned 1 [0199.292] CloseHandle (hObject=0x354) returned 1 [0199.292] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.292] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\rijuql1c\\desktop.ini")) returned 1 [0199.292] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.292] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.292] lstrlenW (lpString=".doc") returned 4 [0199.292] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.292] lstrlenW (lpString=".docx") returned 5 [0199.292] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.292] lstrlenW (lpString=".pdf") returned 4 [0199.292] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.292] lstrlenW (lpString=".xls") returned 4 [0199.292] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.292] lstrlenW (lpString=".xlsx") returned 5 [0199.292] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.292] lstrlenW (lpString=".ppt") returned 4 [0199.292] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.292] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.292] lstrlenW (lpString=".zip") returned 4 [0199.292] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.292] lstrlenW (lpString=".rar") returned 4 [0199.293] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.293] lstrlenW (lpString=".bz2") returned 4 [0199.293] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.293] lstrlenW (lpString=".7z") returned 3 [0199.293] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.293] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.293] lstrlenW (lpString=".dbf") returned 4 [0199.293] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.293] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.293] lstrlenW (lpString=".1cd") returned 4 [0199.293] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.293] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.293] lstrlenW (lpString=".jpg") returned 4 [0199.293] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.293] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.293] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.293] lstrlenW (lpString=".doc") returned 4 [0199.293] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.293] lstrlenW (lpString=".docx") returned 5 [0199.293] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.293] lstrlenW (lpString=".pdf") returned 4 [0199.293] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.293] lstrlenW (lpString=".xls") returned 4 [0199.293] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.293] lstrlenW (lpString=".xlsx") returned 5 [0199.293] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.293] lstrlenW (lpString=".ppt") returned 4 [0199.294] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.294] lstrlenW (lpString=".zip") returned 4 [0199.294] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.294] lstrlenW (lpString=".rar") returned 4 [0199.294] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.294] lstrlenW (lpString=".bz2") returned 4 [0199.294] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.294] lstrlenW (lpString=".7z") returned 3 [0199.294] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.294] lstrlenW (lpString=".dbf") returned 4 [0199.294] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.294] lstrlenW (lpString=".1cd") returned 4 [0199.294] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.294] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\RIJUQL1C\\desktop.ini") returned 119 [0199.294] lstrlenW (lpString=".jpg") returned 4 [0199.294] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.294] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0199.294] lstrlenW (lpString="desktop.ini") returned 11 [0199.294] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.296] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=67) returned 1 [0199.296] CloseHandle (hObject=0x354) returned 1 [0199.296] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 0x2026 [0199.296] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.296] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.296] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.296] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.297] GetLastError () returned 0x0 [0199.297] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x43, lpOverlapped=0x0) returned 1 [0199.298] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x50, lpOverlapped=0x0) returned 1 [0199.298] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.298] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.299] SetEndOfFile (hFile=0x114) returned 1 [0199.299] CloseHandle (hObject=0x114) returned 1 [0199.299] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.299] SetEndOfFile (hFile=0x354) returned 1 [0199.300] CloseHandle (hObject=0x354) returned 1 [0199.300] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.300] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\content.ie5\\x9ohk109\\desktop.ini")) returned 1 [0199.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.300] lstrlenW (lpString=".doc") returned 4 [0199.300] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.300] lstrlenW (lpString=".docx") returned 5 [0199.300] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.300] lstrlenW (lpString=".pdf") returned 4 [0199.300] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.300] lstrlenW (lpString=".xls") returned 4 [0199.300] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.300] lstrlenW (lpString=".xlsx") returned 5 [0199.300] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.300] lstrlenW (lpString=".ppt") returned 4 [0199.300] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.300] lstrlenW (lpString=".zip") returned 4 [0199.300] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.300] lstrlenW (lpString=".rar") returned 4 [0199.300] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.301] lstrlenW (lpString=".bz2") returned 4 [0199.301] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.301] lstrlenW (lpString=".7z") returned 3 [0199.301] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.301] lstrlenW (lpString=".dbf") returned 4 [0199.301] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.301] lstrlenW (lpString=".1cd") returned 4 [0199.301] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.301] lstrlenW (lpString=".jpg") returned 4 [0199.301] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.301] lstrlenW (lpString=".doc") returned 4 [0199.301] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.301] lstrlenW (lpString=".docx") returned 5 [0199.301] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.301] lstrlenW (lpString=".pdf") returned 4 [0199.301] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.301] lstrlenW (lpString=".xls") returned 4 [0199.301] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.301] lstrlenW (lpString=".xlsx") returned 5 [0199.301] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.301] lstrlenW (lpString=".ppt") returned 4 [0199.301] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.301] lstrlenW (lpString=".zip") returned 4 [0199.301] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.301] lstrlenW (lpString=".rar") returned 4 [0199.301] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.301] lstrlenW (lpString=".bz2") returned 4 [0199.302] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.302] lstrlenW (lpString=".7z") returned 3 [0199.302] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.302] lstrlenW (lpString=".dbf") returned 4 [0199.302] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.302] lstrlenW (lpString=".1cd") returned 4 [0199.302] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\X9OHK109\\desktop.ini") returned 119 [0199.302] lstrlenW (lpString=".jpg") returned 4 [0199.302] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.302] lstrcmpiW (lpString1=".ini", lpString2=".wiki") returned -1 [0199.302] lstrlenW (lpString="desktop.ini") returned 11 [0199.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.303] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=67) returned 1 [0199.303] CloseHandle (hObject=0x354) returned 1 [0199.303] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 0x2026 [0199.303] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.303] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.303] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.303] GetLastError () returned 0x0 [0199.304] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x43, lpOverlapped=0x0) returned 1 [0199.305] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x50, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x50, lpOverlapped=0x0) returned 1 [0199.305] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.305] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.306] SetEndOfFile (hFile=0x114) returned 1 [0199.306] CloseHandle (hObject=0x114) returned 1 [0199.306] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.306] SetEndOfFile (hFile=0x354) returned 1 [0199.306] CloseHandle (hObject=0x354) returned 1 [0199.306] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2026) returned 1 [0199.307] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\desktop.ini")) returned 1 [0199.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.307] lstrlenW (lpString=".doc") returned 4 [0199.307] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.307] lstrlenW (lpString=".docx") returned 5 [0199.307] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.307] lstrlenW (lpString=".pdf") returned 4 [0199.307] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.307] lstrlenW (lpString=".xls") returned 4 [0199.307] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.307] lstrlenW (lpString=".xlsx") returned 5 [0199.307] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.307] lstrlenW (lpString=".ppt") returned 4 [0199.307] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.307] lstrlenW (lpString=".zip") returned 4 [0199.307] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.307] lstrlenW (lpString=".rar") returned 4 [0199.307] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.307] lstrlenW (lpString=".bz2") returned 4 [0199.307] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.307] lstrlenW (lpString=".7z") returned 3 [0199.307] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.308] lstrlenW (lpString=".dbf") returned 4 [0199.308] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.308] lstrlenW (lpString=".1cd") returned 4 [0199.308] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.308] lstrlenW (lpString=".jpg") returned 4 [0199.308] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.308] lstrlenW (lpString=".doc") returned 4 [0199.308] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0199.308] lstrlenW (lpString=".docx") returned 5 [0199.308] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0199.308] lstrlenW (lpString=".pdf") returned 4 [0199.308] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0199.308] lstrlenW (lpString=".xls") returned 4 [0199.308] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0199.308] lstrlenW (lpString=".xlsx") returned 5 [0199.308] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0199.308] lstrlenW (lpString=".ppt") returned 4 [0199.308] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0199.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.308] lstrlenW (lpString=".zip") returned 4 [0199.308] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0199.308] lstrlenW (lpString=".rar") returned 4 [0199.308] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0199.308] lstrlenW (lpString=".bz2") returned 4 [0199.308] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0199.308] lstrlenW (lpString=".7z") returned 3 [0199.308] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0199.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.309] lstrlenW (lpString=".dbf") returned 4 [0199.309] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0199.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.309] lstrlenW (lpString=".1cd") returned 4 [0199.309] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0199.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\desktop.ini") returned 98 [0199.309] lstrlenW (lpString=".jpg") returned 4 [0199.309] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0199.309] lstrcmpiW (lpString1=".dat", lpString2=".wiki") returned -1 [0199.309] lstrlenW (lpString="2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 40 [0199.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.309] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=294804) returned 1 [0199.310] CloseHandle (hObject=0x354) returned 1 [0199.310] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat")) returned 0x2020 [0199.310] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.310] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.310] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.312] GetLastError () returned 0x0 [0199.312] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x47f94, lpOverlapped=0x0) returned 1 [0199.320] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x47fa0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x47fa0, lpOverlapped=0x0) returned 1 [0199.326] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.326] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x124, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x124, lpOverlapped=0x0) returned 1 [0199.327] SetEndOfFile (hFile=0x114) returned 1 [0199.327] CloseHandle (hObject=0x114) returned 1 [0199.327] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.327] SetEndOfFile (hFile=0x354) returned 1 [0199.330] CloseHandle (hObject=0x354) returned 1 [0199.330] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.330] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\antiphishing\\2cedbfbc-dba8-43aa-b1fd-cc8e6316e3e2.dat")) returned 1 [0199.330] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.330] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.330] lstrlenW (lpString=".doc") returned 4 [0199.330] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.330] lstrlenW (lpString=".docx") returned 5 [0199.330] lstrcmpiW (lpString1=".docx", lpString2="2.dat") returned -1 [0199.330] lstrlenW (lpString=".pdf") returned 4 [0199.330] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.330] lstrlenW (lpString=".xls") returned 4 [0199.330] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.331] lstrlenW (lpString=".xlsx") returned 5 [0199.331] lstrcmpiW (lpString1=".xlsx", lpString2="2.dat") returned -1 [0199.331] lstrlenW (lpString=".ppt") returned 4 [0199.331] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.331] lstrlenW (lpString=".zip") returned 4 [0199.331] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.331] lstrlenW (lpString=".rar") returned 4 [0199.331] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.331] lstrlenW (lpString=".bz2") returned 4 [0199.331] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.331] lstrlenW (lpString=".7z") returned 3 [0199.331] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.331] lstrlenW (lpString=".dbf") returned 4 [0199.331] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.331] lstrlenW (lpString=".1cd") returned 4 [0199.331] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.331] lstrlenW (lpString=".jpg") returned 4 [0199.331] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.331] lstrlenW (lpString=".doc") returned 4 [0199.331] lstrcmpiW (lpString1=".doc", lpString2=".dat") returned 1 [0199.331] lstrlenW (lpString=".docx") returned 5 [0199.331] lstrcmpiW (lpString1=".docx", lpString2="2.dat") returned -1 [0199.331] lstrlenW (lpString=".pdf") returned 4 [0199.331] lstrcmpiW (lpString1=".pdf", lpString2=".dat") returned 1 [0199.331] lstrlenW (lpString=".xls") returned 4 [0199.331] lstrcmpiW (lpString1=".xls", lpString2=".dat") returned 1 [0199.331] lstrlenW (lpString=".xlsx") returned 5 [0199.332] lstrcmpiW (lpString1=".xlsx", lpString2="2.dat") returned -1 [0199.332] lstrlenW (lpString=".ppt") returned 4 [0199.332] lstrcmpiW (lpString1=".ppt", lpString2=".dat") returned 1 [0199.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.332] lstrlenW (lpString=".zip") returned 4 [0199.332] lstrcmpiW (lpString1=".zip", lpString2=".dat") returned 1 [0199.332] lstrlenW (lpString=".rar") returned 4 [0199.332] lstrcmpiW (lpString1=".rar", lpString2=".dat") returned 1 [0199.332] lstrlenW (lpString=".bz2") returned 4 [0199.332] lstrcmpiW (lpString1=".bz2", lpString2=".dat") returned -1 [0199.332] lstrlenW (lpString=".7z") returned 3 [0199.332] lstrcmpiW (lpString1=".7z", lpString2="dat") returned -1 [0199.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.332] lstrlenW (lpString=".dbf") returned 4 [0199.332] lstrcmpiW (lpString1=".dbf", lpString2=".dat") returned 1 [0199.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.332] lstrlenW (lpString=".1cd") returned 4 [0199.332] lstrcmpiW (lpString1=".1cd", lpString2=".dat") returned -1 [0199.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\AntiPhishing\\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat") returned 144 [0199.332] lstrlenW (lpString=".jpg") returned 4 [0199.332] lstrcmpiW (lpString1=".jpg", lpString2=".dat") returned 1 [0199.332] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0199.332] lstrlenW (lpString="528d82a2[1].js") returned 14 [0199.332] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.334] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=11979) returned 1 [0199.334] CloseHandle (hObject=0x354) returned 1 [0199.334] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js")) returned 0x2020 [0199.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0199.335] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.335] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x114 [0199.337] GetLastError () returned 0x0 [0199.337] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2ecb, lpOverlapped=0x0) returned 1 [0199.536] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2ed0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2ed0, lpOverlapped=0x0) returned 1 [0199.537] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.537] WriteFile (in: hFile=0x114, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.537] SetEndOfFile (hFile=0x114) returned 1 [0199.538] CloseHandle (hObject=0x114) returned 1 [0199.538] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.538] SetEndOfFile (hFile=0x354) returned 1 [0199.539] CloseHandle (hObject=0x354) returned 1 [0199.539] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.539] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\528d82a2[1].js")) returned 1 [0199.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.539] lstrlenW (lpString=".doc") returned 4 [0199.539] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0199.539] lstrlenW (lpString=".docx") returned 5 [0199.539] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0199.539] lstrlenW (lpString=".pdf") returned 4 [0199.539] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0199.539] lstrlenW (lpString=".xls") returned 4 [0199.539] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0199.539] lstrlenW (lpString=".xlsx") returned 5 [0199.539] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0199.539] lstrlenW (lpString=".ppt") returned 4 [0199.539] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0199.539] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.539] lstrlenW (lpString=".zip") returned 4 [0199.539] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0199.539] lstrlenW (lpString=".rar") returned 4 [0199.539] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString=".bz2") returned 4 [0199.540] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString=".7z") returned 3 [0199.540] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0199.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.540] lstrlenW (lpString=".dbf") returned 4 [0199.540] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.540] lstrlenW (lpString=".1cd") returned 4 [0199.540] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.540] lstrlenW (lpString=".jpg") returned 4 [0199.540] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.540] lstrlenW (lpString=".doc") returned 4 [0199.540] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString=".docx") returned 5 [0199.540] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0199.540] lstrlenW (lpString=".pdf") returned 4 [0199.540] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString=".xls") returned 4 [0199.540] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString=".xlsx") returned 5 [0199.540] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0199.540] lstrlenW (lpString=".ppt") returned 4 [0199.540] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.540] lstrlenW (lpString=".zip") returned 4 [0199.540] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString=".rar") returned 4 [0199.540] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0199.540] lstrlenW (lpString=".bz2") returned 4 [0199.541] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0199.541] lstrlenW (lpString=".7z") returned 3 [0199.541] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0199.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.541] lstrlenW (lpString=".dbf") returned 4 [0199.541] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0199.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.541] lstrlenW (lpString=".1cd") returned 4 [0199.541] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0199.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\528d82a2[1].js") returned 126 [0199.541] lstrlenW (lpString=".jpg") returned 4 [0199.541] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0199.541] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.541] lstrlenW (lpString="AA61yi9[1].png") returned 14 [0199.541] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.984] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=413) returned 1 [0199.984] CloseHandle (hObject=0x34c) returned 1 [0199.984] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png")) returned 0x2020 [0199.985] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.985] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.985] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.985] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.985] GetLastError () returned 0x0 [0199.985] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x19d, lpOverlapped=0x0) returned 1 [0199.987] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x1a0, lpOverlapped=0x0) returned 1 [0199.988] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.988] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.988] SetEndOfFile (hFile=0x15c) returned 1 [0199.988] CloseHandle (hObject=0x15c) returned 1 [0199.988] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.988] SetEndOfFile (hFile=0x34c) returned 1 [0199.989] CloseHandle (hObject=0x34c) returned 1 [0199.989] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.989] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\aa61yi9[1].png")) returned 1 [0199.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.990] lstrlenW (lpString=".doc") returned 4 [0199.990] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.990] lstrlenW (lpString=".docx") returned 5 [0199.990] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.990] lstrlenW (lpString=".pdf") returned 4 [0199.990] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.990] lstrlenW (lpString=".xls") returned 4 [0199.990] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.990] lstrlenW (lpString=".xlsx") returned 5 [0199.990] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.990] lstrlenW (lpString=".ppt") returned 4 [0199.990] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.990] lstrlenW (lpString=".zip") returned 4 [0199.990] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.990] lstrlenW (lpString=".rar") returned 4 [0199.990] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.990] lstrlenW (lpString=".bz2") returned 4 [0199.990] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.990] lstrlenW (lpString=".7z") returned 3 [0199.990] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.990] lstrlenW (lpString=".dbf") returned 4 [0199.990] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.990] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.990] lstrlenW (lpString=".1cd") returned 4 [0199.991] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.991] lstrlenW (lpString=".jpg") returned 4 [0199.991] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.991] lstrlenW (lpString=".doc") returned 4 [0199.991] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.991] lstrlenW (lpString=".docx") returned 5 [0199.991] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.991] lstrlenW (lpString=".pdf") returned 4 [0199.991] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.991] lstrlenW (lpString=".xls") returned 4 [0199.991] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.991] lstrlenW (lpString=".xlsx") returned 5 [0199.991] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.991] lstrlenW (lpString=".ppt") returned 4 [0199.991] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.991] lstrlenW (lpString=".zip") returned 4 [0199.991] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.991] lstrlenW (lpString=".rar") returned 4 [0199.991] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.991] lstrlenW (lpString=".bz2") returned 4 [0199.991] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.991] lstrlenW (lpString=".7z") returned 3 [0199.991] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.991] lstrlenW (lpString=".dbf") returned 4 [0199.991] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.991] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.991] lstrlenW (lpString=".1cd") returned 4 [0199.992] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\AA61yi9[1].png") returned 126 [0199.992] lstrlenW (lpString=".jpg") returned 4 [0199.992] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.992] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.992] lstrlenW (lpString="BB6Ma4a[1].png") returned 14 [0199.992] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.992] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=396) returned 1 [0199.992] CloseHandle (hObject=0x34c) returned 1 [0199.992] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png")) returned 0x2020 [0199.992] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.993] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.993] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.993] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.993] GetLastError () returned 0x0 [0199.993] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x18c, lpOverlapped=0x0) returned 1 [0199.995] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x190, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x190, lpOverlapped=0x0) returned 1 [0199.996] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.996] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.996] SetEndOfFile (hFile=0x15c) returned 1 [0199.996] CloseHandle (hObject=0x15c) returned 1 [0199.996] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.996] SetEndOfFile (hFile=0x34c) returned 1 [0199.997] CloseHandle (hObject=0x34c) returned 1 [0199.997] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.997] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb6ma4a[1].png")) returned 1 [0199.997] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.997] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.997] lstrlenW (lpString=".doc") returned 4 [0199.997] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.997] lstrlenW (lpString=".docx") returned 5 [0199.997] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.998] lstrlenW (lpString=".pdf") returned 4 [0199.998] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.998] lstrlenW (lpString=".xls") returned 4 [0199.998] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.998] lstrlenW (lpString=".xlsx") returned 5 [0199.998] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.998] lstrlenW (lpString=".ppt") returned 4 [0199.998] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.998] lstrlenW (lpString=".zip") returned 4 [0199.998] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.998] lstrlenW (lpString=".rar") returned 4 [0199.998] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.998] lstrlenW (lpString=".bz2") returned 4 [0199.998] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.998] lstrlenW (lpString=".7z") returned 3 [0199.998] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.998] lstrlenW (lpString=".dbf") returned 4 [0199.998] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.998] lstrlenW (lpString=".1cd") returned 4 [0199.998] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.998] lstrlenW (lpString=".jpg") returned 4 [0199.998] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.998] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.998] lstrlenW (lpString=".doc") returned 4 [0199.998] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0199.998] lstrlenW (lpString=".docx") returned 5 [0199.998] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0199.998] lstrlenW (lpString=".pdf") returned 4 [0199.999] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0199.999] lstrlenW (lpString=".xls") returned 4 [0199.999] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0199.999] lstrlenW (lpString=".xlsx") returned 5 [0199.999] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0199.999] lstrlenW (lpString=".ppt") returned 4 [0199.999] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0199.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.999] lstrlenW (lpString=".zip") returned 4 [0199.999] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0199.999] lstrlenW (lpString=".rar") returned 4 [0199.999] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0199.999] lstrlenW (lpString=".bz2") returned 4 [0199.999] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0199.999] lstrlenW (lpString=".7z") returned 3 [0199.999] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0199.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.999] lstrlenW (lpString=".dbf") returned 4 [0199.999] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0199.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.999] lstrlenW (lpString=".1cd") returned 4 [0199.999] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0199.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB6Ma4a[1].png") returned 126 [0199.999] lstrlenW (lpString=".jpg") returned 4 [0199.999] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0199.999] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0199.999] lstrlenW (lpString="BB74fLs[1].png") returned 14 [0199.999] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.000] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=360) returned 1 [0200.000] CloseHandle (hObject=0x34c) returned 1 [0200.000] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png")) returned 0x2020 [0200.000] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.000] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.000] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.000] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.001] GetLastError () returned 0x0 [0200.001] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x168, lpOverlapped=0x0) returned 1 [0200.002] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x170, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x170, lpOverlapped=0x0) returned 1 [0200.003] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.003] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.003] SetEndOfFile (hFile=0x15c) returned 1 [0200.004] CloseHandle (hObject=0x15c) returned 1 [0200.004] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.004] SetEndOfFile (hFile=0x34c) returned 1 [0200.005] CloseHandle (hObject=0x34c) returned 1 [0200.005] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.005] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bb74fls[1].png")) returned 1 [0200.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.005] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.005] lstrlenW (lpString=".doc") returned 4 [0200.005] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0200.005] lstrlenW (lpString=".docx") returned 5 [0200.005] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0200.005] lstrlenW (lpString=".pdf") returned 4 [0200.005] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0200.005] lstrlenW (lpString=".xls") returned 4 [0200.005] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0200.005] lstrlenW (lpString=".xlsx") returned 5 [0200.006] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0200.006] lstrlenW (lpString=".ppt") returned 4 [0200.006] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0200.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.006] lstrlenW (lpString=".zip") returned 4 [0200.006] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0200.006] lstrlenW (lpString=".rar") returned 4 [0200.006] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0200.006] lstrlenW (lpString=".bz2") returned 4 [0200.006] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0200.006] lstrlenW (lpString=".7z") returned 3 [0200.006] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0200.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.006] lstrlenW (lpString=".dbf") returned 4 [0200.006] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0200.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.006] lstrlenW (lpString=".1cd") returned 4 [0200.006] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0200.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.006] lstrlenW (lpString=".jpg") returned 4 [0200.006] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0200.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.006] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.006] lstrlenW (lpString=".doc") returned 4 [0200.006] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0200.006] lstrlenW (lpString=".docx") returned 5 [0200.006] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0200.006] lstrlenW (lpString=".pdf") returned 4 [0200.006] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0200.006] lstrlenW (lpString=".xls") returned 4 [0200.006] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0200.006] lstrlenW (lpString=".xlsx") returned 5 [0200.007] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0200.007] lstrlenW (lpString=".ppt") returned 4 [0200.007] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0200.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.007] lstrlenW (lpString=".zip") returned 4 [0200.007] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0200.007] lstrlenW (lpString=".rar") returned 4 [0200.007] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0200.007] lstrlenW (lpString=".bz2") returned 4 [0200.007] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0200.007] lstrlenW (lpString=".7z") returned 3 [0200.007] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0200.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.007] lstrlenW (lpString=".dbf") returned 4 [0200.007] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0200.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.007] lstrlenW (lpString=".1cd") returned 4 [0200.007] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0200.007] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BB74fLs[1].png") returned 126 [0200.007] lstrlenW (lpString=".jpg") returned 4 [0200.007] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0200.007] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.007] lstrlenW (lpString="BBBIqq8[1].jpg") returned 14 [0200.007] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.011] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=13119) returned 1 [0200.011] CloseHandle (hObject=0x34c) returned 1 [0200.011] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg")) returned 0x2020 [0200.011] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.011] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.011] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.012] GetLastError () returned 0x0 [0200.012] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x333f, lpOverlapped=0x0) returned 1 [0200.014] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3340, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3340, lpOverlapped=0x0) returned 1 [0200.015] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.015] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.015] SetEndOfFile (hFile=0x15c) returned 1 [0200.015] CloseHandle (hObject=0x15c) returned 1 [0200.015] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.015] SetEndOfFile (hFile=0x34c) returned 1 [0200.016] CloseHandle (hObject=0x34c) returned 1 [0200.016] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.016] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbiqq8[1].jpg")) returned 1 [0200.017] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.017] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.017] lstrlenW (lpString=".doc") returned 4 [0200.017] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.017] lstrlenW (lpString=".docx") returned 5 [0200.017] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.017] lstrlenW (lpString=".pdf") returned 4 [0200.017] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.017] lstrlenW (lpString=".xls") returned 4 [0200.017] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.017] lstrlenW (lpString=".xlsx") returned 5 [0200.017] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.017] lstrlenW (lpString=".ppt") returned 4 [0200.017] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.017] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.017] lstrlenW (lpString=".zip") returned 4 [0200.017] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.017] lstrlenW (lpString=".rar") returned 4 [0200.017] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.017] lstrlenW (lpString=".bz2") returned 4 [0200.017] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.017] lstrlenW (lpString=".7z") returned 3 [0200.017] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.017] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.017] lstrlenW (lpString=".dbf") returned 4 [0200.017] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.017] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.017] lstrlenW (lpString=".1cd") returned 4 [0200.017] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.017] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.017] lstrlenW (lpString=".jpg") returned 4 [0200.017] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.018] lstrlenW (lpString=".doc") returned 4 [0200.018] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.018] lstrlenW (lpString=".docx") returned 5 [0200.018] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.018] lstrlenW (lpString=".pdf") returned 4 [0200.018] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.018] lstrlenW (lpString=".xls") returned 4 [0200.018] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.018] lstrlenW (lpString=".xlsx") returned 5 [0200.018] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.018] lstrlenW (lpString=".ppt") returned 4 [0200.018] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.018] lstrlenW (lpString=".zip") returned 4 [0200.018] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.018] lstrlenW (lpString=".rar") returned 4 [0200.018] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.018] lstrlenW (lpString=".bz2") returned 4 [0200.018] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.018] lstrlenW (lpString=".7z") returned 3 [0200.018] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.018] lstrlenW (lpString=".dbf") returned 4 [0200.018] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.018] lstrlenW (lpString=".1cd") returned 4 [0200.018] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBIqq8[1].jpg") returned 126 [0200.018] lstrlenW (lpString=".jpg") returned 4 [0200.018] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.019] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.019] lstrlenW (lpString="BBBL0ij[1].jpg") returned 14 [0200.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.020] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2315) returned 1 [0200.020] CloseHandle (hObject=0x34c) returned 1 [0200.020] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg")) returned 0x2020 [0200.020] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.020] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.020] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.021] GetLastError () returned 0x0 [0200.021] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x90b, lpOverlapped=0x0) returned 1 [0200.022] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x910, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x910, lpOverlapped=0x0) returned 1 [0200.023] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.023] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.024] SetEndOfFile (hFile=0x15c) returned 1 [0200.024] CloseHandle (hObject=0x15c) returned 1 [0200.024] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.024] SetEndOfFile (hFile=0x34c) returned 1 [0200.025] CloseHandle (hObject=0x34c) returned 1 [0200.025] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.025] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbl0ij[1].jpg")) returned 1 [0200.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.025] lstrlenW (lpString=".doc") returned 4 [0200.025] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.025] lstrlenW (lpString=".docx") returned 5 [0200.025] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.025] lstrlenW (lpString=".pdf") returned 4 [0200.025] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.025] lstrlenW (lpString=".xls") returned 4 [0200.025] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.025] lstrlenW (lpString=".xlsx") returned 5 [0200.025] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.025] lstrlenW (lpString=".ppt") returned 4 [0200.025] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.025] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.025] lstrlenW (lpString=".zip") returned 4 [0200.025] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.025] lstrlenW (lpString=".rar") returned 4 [0200.025] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.025] lstrlenW (lpString=".bz2") returned 4 [0200.026] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.026] lstrlenW (lpString=".7z") returned 3 [0200.026] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.026] lstrlenW (lpString=".dbf") returned 4 [0200.026] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.026] lstrlenW (lpString=".1cd") returned 4 [0200.026] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.026] lstrlenW (lpString=".jpg") returned 4 [0200.026] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.026] lstrlenW (lpString=".doc") returned 4 [0200.026] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.026] lstrlenW (lpString=".docx") returned 5 [0200.026] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.026] lstrlenW (lpString=".pdf") returned 4 [0200.026] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.026] lstrlenW (lpString=".xls") returned 4 [0200.026] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.026] lstrlenW (lpString=".xlsx") returned 5 [0200.026] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.026] lstrlenW (lpString=".ppt") returned 4 [0200.026] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.026] lstrlenW (lpString=".zip") returned 4 [0200.026] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.026] lstrlenW (lpString=".rar") returned 4 [0200.026] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.026] lstrlenW (lpString=".bz2") returned 4 [0200.027] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.027] lstrlenW (lpString=".7z") returned 3 [0200.027] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.027] lstrlenW (lpString=".dbf") returned 4 [0200.027] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.027] lstrlenW (lpString=".1cd") returned 4 [0200.027] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBL0ij[1].jpg") returned 126 [0200.027] lstrlenW (lpString=".jpg") returned 4 [0200.027] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.027] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.027] lstrlenW (lpString="BBBLhZX[1].jpg") returned 14 [0200.027] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.028] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2452) returned 1 [0200.028] CloseHandle (hObject=0x34c) returned 1 [0200.028] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg")) returned 0x2020 [0200.028] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.028] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.028] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.029] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.029] GetLastError () returned 0x0 [0200.029] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x994, lpOverlapped=0x0) returned 1 [0200.030] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x9a0, lpOverlapped=0x0) returned 1 [0200.031] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.031] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.031] SetEndOfFile (hFile=0x15c) returned 1 [0200.032] CloseHandle (hObject=0x15c) returned 1 [0200.032] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.032] SetEndOfFile (hFile=0x34c) returned 1 [0200.032] CloseHandle (hObject=0x34c) returned 1 [0200.032] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.033] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbblhzx[1].jpg")) returned 1 [0200.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.033] lstrlenW (lpString=".doc") returned 4 [0200.033] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.033] lstrlenW (lpString=".docx") returned 5 [0200.033] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.033] lstrlenW (lpString=".pdf") returned 4 [0200.033] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.033] lstrlenW (lpString=".xls") returned 4 [0200.033] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.033] lstrlenW (lpString=".xlsx") returned 5 [0200.033] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.033] lstrlenW (lpString=".ppt") returned 4 [0200.033] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.033] lstrlenW (lpString=".zip") returned 4 [0200.033] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.033] lstrlenW (lpString=".rar") returned 4 [0200.033] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.033] lstrlenW (lpString=".bz2") returned 4 [0200.033] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.033] lstrlenW (lpString=".7z") returned 3 [0200.033] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.033] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.034] lstrlenW (lpString=".dbf") returned 4 [0200.034] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.034] lstrlenW (lpString=".1cd") returned 4 [0200.034] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.034] lstrlenW (lpString=".jpg") returned 4 [0200.034] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.034] lstrlenW (lpString=".doc") returned 4 [0200.034] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.034] lstrlenW (lpString=".docx") returned 5 [0200.034] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.034] lstrlenW (lpString=".pdf") returned 4 [0200.034] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.034] lstrlenW (lpString=".xls") returned 4 [0200.034] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.034] lstrlenW (lpString=".xlsx") returned 5 [0200.034] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.034] lstrlenW (lpString=".ppt") returned 4 [0200.034] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.034] lstrlenW (lpString=".zip") returned 4 [0200.034] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.034] lstrlenW (lpString=".rar") returned 4 [0200.034] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.034] lstrlenW (lpString=".bz2") returned 4 [0200.034] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.034] lstrlenW (lpString=".7z") returned 3 [0200.034] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.034] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.034] lstrlenW (lpString=".dbf") returned 4 [0200.035] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.035] lstrlenW (lpString=".1cd") returned 4 [0200.035] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBLhZX[1].jpg") returned 126 [0200.035] lstrlenW (lpString=".jpg") returned 4 [0200.035] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.100] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.100] lstrlenW (lpString="BBBNiEo[1].jpg") returned 14 [0200.100] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.153] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=10425) returned 1 [0200.156] CloseHandle (hObject=0x34c) returned 1 [0200.156] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg")) returned 0x2020 [0200.156] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.165] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.165] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.165] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.165] GetLastError () returned 0x0 [0200.165] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x28b9, lpOverlapped=0x0) returned 1 [0200.167] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x28c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x28c0, lpOverlapped=0x0) returned 1 [0200.168] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.168] WriteFile (in: hFile=0x15c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0200.168] SetEndOfFile (hFile=0x15c) returned 1 [0200.169] CloseHandle (hObject=0x15c) returned 1 [0200.169] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.169] SetEndOfFile (hFile=0x34c) returned 1 [0200.169] CloseHandle (hObject=0x34c) returned 1 [0200.169] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.170] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbnieo[1].jpg")) returned 1 [0200.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.170] lstrlenW (lpString=".doc") returned 4 [0200.170] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.170] lstrlenW (lpString=".docx") returned 5 [0200.170] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.170] lstrlenW (lpString=".pdf") returned 4 [0200.170] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.170] lstrlenW (lpString=".xls") returned 4 [0200.170] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.170] lstrlenW (lpString=".xlsx") returned 5 [0200.170] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.170] lstrlenW (lpString=".ppt") returned 4 [0200.170] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.170] lstrlenW (lpString=".zip") returned 4 [0200.170] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.170] lstrlenW (lpString=".rar") returned 4 [0200.170] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.170] lstrlenW (lpString=".bz2") returned 4 [0200.170] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.170] lstrlenW (lpString=".7z") returned 3 [0200.171] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.171] lstrlenW (lpString=".dbf") returned 4 [0200.171] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.171] lstrlenW (lpString=".1cd") returned 4 [0200.171] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.171] lstrlenW (lpString=".jpg") returned 4 [0200.171] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.171] lstrlenW (lpString=".doc") returned 4 [0200.171] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0200.171] lstrlenW (lpString=".docx") returned 5 [0200.171] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0200.171] lstrlenW (lpString=".pdf") returned 4 [0200.171] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0200.171] lstrlenW (lpString=".xls") returned 4 [0200.171] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0200.171] lstrlenW (lpString=".xlsx") returned 5 [0200.171] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0200.171] lstrlenW (lpString=".ppt") returned 4 [0200.171] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0200.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.171] lstrlenW (lpString=".zip") returned 4 [0200.171] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0200.171] lstrlenW (lpString=".rar") returned 4 [0200.171] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0200.171] lstrlenW (lpString=".bz2") returned 4 [0200.171] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0200.171] lstrlenW (lpString=".7z") returned 3 [0200.171] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0200.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.172] lstrlenW (lpString=".dbf") returned 4 [0200.172] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0200.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.172] lstrlenW (lpString=".1cd") returned 4 [0200.172] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0200.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBNiEo[1].jpg") returned 126 [0200.172] lstrlenW (lpString=".jpg") returned 4 [0200.172] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0200.172] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0200.172] lstrlenW (lpString="BBBseMP[1].jpg") returned 14 [0200.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.173] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=6499) returned 1 [0200.173] CloseHandle (hObject=0x34c) returned 1 [0200.173] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg")) returned 0x2020 [0200.173] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0200.173] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.173] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.143] GetLastError () returned 0x0 [0201.143] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x1963, lpOverlapped=0x0) returned 1 [0201.146] WriteFile (in: hFile=0x354, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1970, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x1970, lpOverlapped=0x0) returned 1 [0201.147] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.147] WriteFile (in: hFile=0x354, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.147] SetEndOfFile (hFile=0x354) returned 1 [0201.147] CloseHandle (hObject=0x354) returned 1 [0201.147] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.147] SetEndOfFile (hFile=0x34c) returned 1 [0201.148] CloseHandle (hObject=0x34c) returned 1 [0201.148] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.148] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbsemp[1].jpg")) returned 1 [0201.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.149] lstrlenW (lpString=".doc") returned 4 [0201.149] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.149] lstrlenW (lpString=".docx") returned 5 [0201.149] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.149] lstrlenW (lpString=".pdf") returned 4 [0201.149] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.149] lstrlenW (lpString=".xls") returned 4 [0201.149] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.149] lstrlenW (lpString=".xlsx") returned 5 [0201.149] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.149] lstrlenW (lpString=".ppt") returned 4 [0201.149] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.149] lstrlenW (lpString=".zip") returned 4 [0201.149] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.149] lstrlenW (lpString=".rar") returned 4 [0201.149] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.149] lstrlenW (lpString=".bz2") returned 4 [0201.149] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.149] lstrlenW (lpString=".7z") returned 3 [0201.149] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.149] lstrlenW (lpString=".dbf") returned 4 [0201.149] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.149] lstrlenW (lpString=".1cd") returned 4 [0201.149] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.149] lstrlenW (lpString=".jpg") returned 4 [0201.149] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.149] lstrlenW (lpString=".doc") returned 4 [0201.149] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.150] lstrlenW (lpString=".docx") returned 5 [0201.150] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.150] lstrlenW (lpString=".pdf") returned 4 [0201.150] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.150] lstrlenW (lpString=".xls") returned 4 [0201.150] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.150] lstrlenW (lpString=".xlsx") returned 5 [0201.150] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.150] lstrlenW (lpString=".ppt") returned 4 [0201.150] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.150] lstrlenW (lpString=".zip") returned 4 [0201.150] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.150] lstrlenW (lpString=".rar") returned 4 [0201.150] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.150] lstrlenW (lpString=".bz2") returned 4 [0201.150] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.150] lstrlenW (lpString=".7z") returned 3 [0201.150] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.150] lstrlenW (lpString=".dbf") returned 4 [0201.150] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.150] lstrlenW (lpString=".1cd") returned 4 [0201.150] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBseMP[1].jpg") returned 126 [0201.150] lstrlenW (lpString=".jpg") returned 4 [0201.150] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.150] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.151] lstrlenW (lpString="BBBVJ4r[1].jpg") returned 14 [0201.151] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.151] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2426) returned 1 [0201.152] CloseHandle (hObject=0x34c) returned 1 [0201.152] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg")) returned 0x2020 [0201.152] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.152] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.152] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.152] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.152] GetLastError () returned 0x0 [0201.152] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x97a, lpOverlapped=0x0) returned 1 [0201.154] WriteFile (in: hFile=0x354, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x980, lpOverlapped=0x0) returned 1 [0201.155] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.155] WriteFile (in: hFile=0x354, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.155] SetEndOfFile (hFile=0x354) returned 1 [0201.155] CloseHandle (hObject=0x354) returned 1 [0201.155] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.155] SetEndOfFile (hFile=0x34c) returned 1 [0201.156] CloseHandle (hObject=0x34c) returned 1 [0201.156] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.156] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvj4r[1].jpg")) returned 1 [0201.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.157] lstrlenW (lpString=".doc") returned 4 [0201.157] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.157] lstrlenW (lpString=".docx") returned 5 [0201.157] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.157] lstrlenW (lpString=".pdf") returned 4 [0201.157] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.157] lstrlenW (lpString=".xls") returned 4 [0201.157] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.157] lstrlenW (lpString=".xlsx") returned 5 [0201.157] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.157] lstrlenW (lpString=".ppt") returned 4 [0201.157] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.157] lstrlenW (lpString=".zip") returned 4 [0201.157] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.157] lstrlenW (lpString=".rar") returned 4 [0201.157] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.157] lstrlenW (lpString=".bz2") returned 4 [0201.157] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.157] lstrlenW (lpString=".7z") returned 3 [0201.157] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.157] lstrlenW (lpString=".dbf") returned 4 [0201.157] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.157] lstrlenW (lpString=".1cd") returned 4 [0201.157] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.157] lstrlenW (lpString=".jpg") returned 4 [0201.157] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.158] lstrlenW (lpString=".doc") returned 4 [0201.158] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.158] lstrlenW (lpString=".docx") returned 5 [0201.158] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.158] lstrlenW (lpString=".pdf") returned 4 [0201.158] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.158] lstrlenW (lpString=".xls") returned 4 [0201.158] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.158] lstrlenW (lpString=".xlsx") returned 5 [0201.158] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.158] lstrlenW (lpString=".ppt") returned 4 [0201.158] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.158] lstrlenW (lpString=".zip") returned 4 [0201.158] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.158] lstrlenW (lpString=".rar") returned 4 [0201.158] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.158] lstrlenW (lpString=".bz2") returned 4 [0201.158] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.158] lstrlenW (lpString=".7z") returned 3 [0201.158] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.158] lstrlenW (lpString=".dbf") returned 4 [0201.158] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.158] lstrlenW (lpString=".1cd") returned 4 [0201.158] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.158] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVJ4r[1].jpg") returned 126 [0201.158] lstrlenW (lpString=".jpg") returned 4 [0201.158] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.159] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.159] lstrlenW (lpString="BBBVxM8[1].jpg") returned 14 [0201.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.159] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2008) returned 1 [0201.159] CloseHandle (hObject=0x34c) returned 1 [0201.159] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg")) returned 0x2020 [0201.159] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.159] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.159] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.160] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.160] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.160] GetLastError () returned 0x0 [0201.160] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x7d8, lpOverlapped=0x0) returned 1 [0201.162] WriteFile (in: hFile=0x354, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x7e0, lpOverlapped=0x0) returned 1 [0201.162] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.162] WriteFile (in: hFile=0x354, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.163] SetEndOfFile (hFile=0x354) returned 1 [0201.163] CloseHandle (hObject=0x354) returned 1 [0201.163] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.163] SetEndOfFile (hFile=0x34c) returned 1 [0201.164] CloseHandle (hObject=0x34c) returned 1 [0201.164] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.164] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbvxm8[1].jpg")) returned 1 [0201.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.164] lstrlenW (lpString=".doc") returned 4 [0201.164] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.164] lstrlenW (lpString=".docx") returned 5 [0201.164] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.164] lstrlenW (lpString=".pdf") returned 4 [0201.164] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.164] lstrlenW (lpString=".xls") returned 4 [0201.164] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.164] lstrlenW (lpString=".xlsx") returned 5 [0201.164] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.164] lstrlenW (lpString=".ppt") returned 4 [0201.164] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.164] lstrlenW (lpString=".zip") returned 4 [0201.164] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.164] lstrlenW (lpString=".rar") returned 4 [0201.164] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.165] lstrlenW (lpString=".bz2") returned 4 [0201.165] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.165] lstrlenW (lpString=".7z") returned 3 [0201.165] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.165] lstrlenW (lpString=".dbf") returned 4 [0201.165] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.165] lstrlenW (lpString=".1cd") returned 4 [0201.165] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.165] lstrlenW (lpString=".jpg") returned 4 [0201.165] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.165] lstrlenW (lpString=".doc") returned 4 [0201.165] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.165] lstrlenW (lpString=".docx") returned 5 [0201.165] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.165] lstrlenW (lpString=".pdf") returned 4 [0201.165] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.165] lstrlenW (lpString=".xls") returned 4 [0201.165] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.165] lstrlenW (lpString=".xlsx") returned 5 [0201.165] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.165] lstrlenW (lpString=".ppt") returned 4 [0201.165] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.165] lstrlenW (lpString=".zip") returned 4 [0201.165] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.165] lstrlenW (lpString=".rar") returned 4 [0201.165] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.165] lstrlenW (lpString=".bz2") returned 4 [0201.165] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.166] lstrlenW (lpString=".7z") returned 3 [0201.166] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.166] lstrlenW (lpString=".dbf") returned 4 [0201.166] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.166] lstrlenW (lpString=".1cd") returned 4 [0201.166] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBVxM8[1].jpg") returned 126 [0201.166] lstrlenW (lpString=".jpg") returned 4 [0201.166] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.166] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.166] lstrlenW (lpString="BBBz9wz[1].jpg") returned 14 [0201.166] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.166] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2263) returned 1 [0201.166] CloseHandle (hObject=0x34c) returned 1 [0201.167] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg")) returned 0x2020 [0201.167] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.167] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.167] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.167] GetLastError () returned 0x0 [0201.167] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x8d7, lpOverlapped=0x0) returned 1 [0201.169] WriteFile (in: hFile=0x354, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0201.170] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.170] WriteFile (in: hFile=0x354, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.170] SetEndOfFile (hFile=0x354) returned 1 [0201.170] CloseHandle (hObject=0x354) returned 1 [0201.170] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.170] SetEndOfFile (hFile=0x34c) returned 1 [0201.171] CloseHandle (hObject=0x34c) returned 1 [0201.171] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.171] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbz9wz[1].jpg")) returned 1 [0201.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.171] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.171] lstrlenW (lpString=".doc") returned 4 [0201.171] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.171] lstrlenW (lpString=".docx") returned 5 [0201.172] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.172] lstrlenW (lpString=".pdf") returned 4 [0201.172] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.172] lstrlenW (lpString=".xls") returned 4 [0201.172] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.172] lstrlenW (lpString=".xlsx") returned 5 [0201.172] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.172] lstrlenW (lpString=".ppt") returned 4 [0201.172] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.172] lstrlenW (lpString=".zip") returned 4 [0201.172] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.172] lstrlenW (lpString=".rar") returned 4 [0201.172] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.172] lstrlenW (lpString=".bz2") returned 4 [0201.172] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.172] lstrlenW (lpString=".7z") returned 3 [0201.172] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.172] lstrlenW (lpString=".dbf") returned 4 [0201.172] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.172] lstrlenW (lpString=".1cd") returned 4 [0201.172] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.172] lstrlenW (lpString=".jpg") returned 4 [0201.172] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.172] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.172] lstrlenW (lpString=".doc") returned 4 [0201.172] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.172] lstrlenW (lpString=".docx") returned 5 [0201.172] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.172] lstrlenW (lpString=".pdf") returned 4 [0201.173] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.173] lstrlenW (lpString=".xls") returned 4 [0201.173] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.173] lstrlenW (lpString=".xlsx") returned 5 [0201.173] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.173] lstrlenW (lpString=".ppt") returned 4 [0201.173] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.173] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.173] lstrlenW (lpString=".zip") returned 4 [0201.173] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.173] lstrlenW (lpString=".rar") returned 4 [0201.173] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.173] lstrlenW (lpString=".bz2") returned 4 [0201.173] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.173] lstrlenW (lpString=".7z") returned 3 [0201.173] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.173] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.173] lstrlenW (lpString=".dbf") returned 4 [0201.173] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.173] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.173] lstrlenW (lpString=".1cd") returned 4 [0201.173] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.173] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBz9wz[1].jpg") returned 126 [0201.173] lstrlenW (lpString=".jpg") returned 4 [0201.173] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.173] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.173] lstrlenW (lpString="BBBzxW1[1].jpg") returned 14 [0201.173] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.174] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=9406) returned 1 [0201.174] CloseHandle (hObject=0x34c) returned 1 [0201.174] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg")) returned 0x2020 [0201.174] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.174] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.175] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.175] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.175] GetLastError () returned 0x0 [0201.175] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x24be, lpOverlapped=0x0) returned 1 [0201.177] WriteFile (in: hFile=0x354, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x24c0, lpOverlapped=0x0) returned 1 [0201.178] ReadFile (in: hFile=0x34c, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.178] WriteFile (in: hFile=0x354, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.178] SetEndOfFile (hFile=0x354) returned 1 [0201.178] CloseHandle (hObject=0x354) returned 1 [0201.178] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.178] SetEndOfFile (hFile=0x34c) returned 1 [0201.180] CloseHandle (hObject=0x34c) returned 1 [0201.180] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.180] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbbzxw1[1].jpg")) returned 1 [0201.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.181] lstrlenW (lpString=".doc") returned 4 [0201.181] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.181] lstrlenW (lpString=".docx") returned 5 [0201.181] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.181] lstrlenW (lpString=".pdf") returned 4 [0201.181] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.181] lstrlenW (lpString=".xls") returned 4 [0201.181] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.181] lstrlenW (lpString=".xlsx") returned 5 [0201.181] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.181] lstrlenW (lpString=".ppt") returned 4 [0201.181] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.181] lstrlenW (lpString=".zip") returned 4 [0201.181] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.181] lstrlenW (lpString=".rar") returned 4 [0201.181] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.181] lstrlenW (lpString=".bz2") returned 4 [0201.181] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.181] lstrlenW (lpString=".7z") returned 3 [0201.181] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.181] lstrlenW (lpString=".dbf") returned 4 [0201.181] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.181] lstrlenW (lpString=".1cd") returned 4 [0201.181] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.181] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.181] lstrlenW (lpString=".jpg") returned 4 [0201.182] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.182] lstrlenW (lpString=".doc") returned 4 [0201.182] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.182] lstrlenW (lpString=".docx") returned 5 [0201.182] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.182] lstrlenW (lpString=".pdf") returned 4 [0201.182] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.182] lstrlenW (lpString=".xls") returned 4 [0201.182] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.182] lstrlenW (lpString=".xlsx") returned 5 [0201.182] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.182] lstrlenW (lpString=".ppt") returned 4 [0201.182] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.182] lstrlenW (lpString=".zip") returned 4 [0201.182] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.182] lstrlenW (lpString=".rar") returned 4 [0201.182] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.182] lstrlenW (lpString=".bz2") returned 4 [0201.182] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.182] lstrlenW (lpString=".7z") returned 3 [0201.182] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.182] lstrlenW (lpString=".dbf") returned 4 [0201.182] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.182] lstrlenW (lpString=".1cd") returned 4 [0201.182] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.182] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBBzxW1[1].jpg") returned 126 [0201.183] lstrlenW (lpString=".jpg") returned 4 [0201.183] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.183] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.183] lstrlenW (lpString="BBC06Ub[1].jpg") returned 14 [0201.183] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.405] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=13224) returned 1 [0201.405] CloseHandle (hObject=0x358) returned 1 [0201.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg")) returned 0x2020 [0201.406] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.406] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.406] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.406] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.407] GetLastError () returned 0x0 [0201.407] ReadFile (in: hFile=0x358, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x33a8, lpOverlapped=0x0) returned 1 [0201.452] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x33b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x33b0, lpOverlapped=0x0) returned 1 [0201.454] ReadFile (in: hFile=0x358, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.454] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.454] SetEndOfFile (hFile=0x34c) returned 1 [0201.454] CloseHandle (hObject=0x34c) returned 1 [0201.454] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.454] SetEndOfFile (hFile=0x358) returned 1 [0201.455] CloseHandle (hObject=0x358) returned 1 [0201.455] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.455] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc06ub[1].jpg")) returned 1 [0201.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.456] lstrlenW (lpString=".doc") returned 4 [0201.456] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.456] lstrlenW (lpString=".docx") returned 5 [0201.456] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.456] lstrlenW (lpString=".pdf") returned 4 [0201.456] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.456] lstrlenW (lpString=".xls") returned 4 [0201.456] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.456] lstrlenW (lpString=".xlsx") returned 5 [0201.456] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.456] lstrlenW (lpString=".ppt") returned 4 [0201.456] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.456] lstrlenW (lpString=".zip") returned 4 [0201.456] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.456] lstrlenW (lpString=".rar") returned 4 [0201.456] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.456] lstrlenW (lpString=".bz2") returned 4 [0201.456] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.456] lstrlenW (lpString=".7z") returned 3 [0201.456] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.456] lstrlenW (lpString=".dbf") returned 4 [0201.456] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.456] lstrlenW (lpString=".1cd") returned 4 [0201.456] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.456] lstrlenW (lpString=".jpg") returned 4 [0201.456] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.457] lstrlenW (lpString=".doc") returned 4 [0201.457] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.457] lstrlenW (lpString=".docx") returned 5 [0201.457] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.457] lstrlenW (lpString=".pdf") returned 4 [0201.457] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.457] lstrlenW (lpString=".xls") returned 4 [0201.457] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.457] lstrlenW (lpString=".xlsx") returned 5 [0201.457] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.457] lstrlenW (lpString=".ppt") returned 4 [0201.457] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.457] lstrlenW (lpString=".zip") returned 4 [0201.457] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.457] lstrlenW (lpString=".rar") returned 4 [0201.457] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.457] lstrlenW (lpString=".bz2") returned 4 [0201.457] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.457] lstrlenW (lpString=".7z") returned 3 [0201.457] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.457] lstrlenW (lpString=".dbf") returned 4 [0201.457] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.457] lstrlenW (lpString=".1cd") returned 4 [0201.457] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.457] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC06Ub[1].jpg") returned 126 [0201.457] lstrlenW (lpString=".jpg") returned 4 [0201.457] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.458] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.458] lstrlenW (lpString="BBC0ALC[1].jpg") returned 14 [0201.458] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.487] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=6053) returned 1 [0201.487] CloseHandle (hObject=0x358) returned 1 [0201.487] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg")) returned 0x2020 [0201.487] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.488] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.488] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.488] GetLastError () returned 0x0 [0201.488] ReadFile (in: hFile=0x358, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x17a5, lpOverlapped=0x0) returned 1 [0201.490] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0201.491] ReadFile (in: hFile=0x358, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.491] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.491] SetEndOfFile (hFile=0x34c) returned 1 [0201.491] CloseHandle (hObject=0x34c) returned 1 [0201.491] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.491] SetEndOfFile (hFile=0x358) returned 1 [0201.492] CloseHandle (hObject=0x358) returned 1 [0201.492] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.492] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0alc[1].jpg")) returned 1 [0201.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.493] lstrlenW (lpString=".doc") returned 4 [0201.493] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.493] lstrlenW (lpString=".docx") returned 5 [0201.493] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.493] lstrlenW (lpString=".pdf") returned 4 [0201.493] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.493] lstrlenW (lpString=".xls") returned 4 [0201.493] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.493] lstrlenW (lpString=".xlsx") returned 5 [0201.493] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.493] lstrlenW (lpString=".ppt") returned 4 [0201.493] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.493] lstrlenW (lpString=".zip") returned 4 [0201.493] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.493] lstrlenW (lpString=".rar") returned 4 [0201.493] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.493] lstrlenW (lpString=".bz2") returned 4 [0201.493] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.493] lstrlenW (lpString=".7z") returned 3 [0201.493] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.493] lstrlenW (lpString=".dbf") returned 4 [0201.493] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.493] lstrlenW (lpString=".1cd") returned 4 [0201.493] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.493] lstrlenW (lpString=".jpg") returned 4 [0201.493] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.494] lstrlenW (lpString=".doc") returned 4 [0201.494] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.494] lstrlenW (lpString=".docx") returned 5 [0201.494] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.494] lstrlenW (lpString=".pdf") returned 4 [0201.494] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.494] lstrlenW (lpString=".xls") returned 4 [0201.494] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.494] lstrlenW (lpString=".xlsx") returned 5 [0201.494] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.494] lstrlenW (lpString=".ppt") returned 4 [0201.494] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.494] lstrlenW (lpString=".zip") returned 4 [0201.494] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.494] lstrlenW (lpString=".rar") returned 4 [0201.494] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.494] lstrlenW (lpString=".bz2") returned 4 [0201.494] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.494] lstrlenW (lpString=".7z") returned 3 [0201.494] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.494] lstrlenW (lpString=".dbf") returned 4 [0201.494] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.494] lstrlenW (lpString=".1cd") returned 4 [0201.494] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0ALC[1].jpg") returned 126 [0201.494] lstrlenW (lpString=".jpg") returned 4 [0201.494] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.495] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.495] lstrlenW (lpString="BBC0lYn[1].jpg") returned 14 [0201.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.503] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=10016) returned 1 [0201.503] CloseHandle (hObject=0x358) returned 1 [0201.503] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg")) returned 0x2020 [0201.503] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.504] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.504] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.504] GetLastError () returned 0x0 [0201.504] ReadFile (in: hFile=0x358, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2720, lpOverlapped=0x0) returned 1 [0201.506] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2730, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2730, lpOverlapped=0x0) returned 1 [0201.507] ReadFile (in: hFile=0x358, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.507] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.507] SetEndOfFile (hFile=0x34c) returned 1 [0201.507] CloseHandle (hObject=0x34c) returned 1 [0201.508] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.508] SetEndOfFile (hFile=0x358) returned 1 [0201.508] CloseHandle (hObject=0x358) returned 1 [0201.508] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.509] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0lyn[1].jpg")) returned 1 [0201.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.509] lstrlenW (lpString=".doc") returned 4 [0201.509] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.509] lstrlenW (lpString=".docx") returned 5 [0201.509] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.509] lstrlenW (lpString=".pdf") returned 4 [0201.509] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.509] lstrlenW (lpString=".xls") returned 4 [0201.509] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.509] lstrlenW (lpString=".xlsx") returned 5 [0201.509] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.509] lstrlenW (lpString=".ppt") returned 4 [0201.509] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.509] lstrlenW (lpString=".zip") returned 4 [0201.509] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.509] lstrlenW (lpString=".rar") returned 4 [0201.509] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.509] lstrlenW (lpString=".bz2") returned 4 [0201.509] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.509] lstrlenW (lpString=".7z") returned 3 [0201.509] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.509] lstrlenW (lpString=".dbf") returned 4 [0201.509] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.509] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.510] lstrlenW (lpString=".1cd") returned 4 [0201.510] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.510] lstrlenW (lpString=".jpg") returned 4 [0201.510] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.510] lstrlenW (lpString=".doc") returned 4 [0201.510] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.510] lstrlenW (lpString=".docx") returned 5 [0201.510] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.510] lstrlenW (lpString=".pdf") returned 4 [0201.510] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.510] lstrlenW (lpString=".xls") returned 4 [0201.510] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.510] lstrlenW (lpString=".xlsx") returned 5 [0201.510] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.510] lstrlenW (lpString=".ppt") returned 4 [0201.510] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.510] lstrlenW (lpString=".zip") returned 4 [0201.510] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.510] lstrlenW (lpString=".rar") returned 4 [0201.510] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.510] lstrlenW (lpString=".bz2") returned 4 [0201.510] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.510] lstrlenW (lpString=".7z") returned 3 [0201.510] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.510] lstrlenW (lpString=".dbf") returned 4 [0201.510] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.510] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.510] lstrlenW (lpString=".1cd") returned 4 [0201.511] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.511] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0lYn[1].jpg") returned 126 [0201.511] lstrlenW (lpString=".jpg") returned 4 [0201.511] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.511] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.511] lstrlenW (lpString="BBC0mlu[1].jpg") returned 14 [0201.511] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.511] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1314) returned 1 [0201.511] CloseHandle (hObject=0x358) returned 1 [0201.511] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg")) returned 0x2020 [0201.512] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.512] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.512] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.512] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.512] GetLastError () returned 0x0 [0201.512] ReadFile (in: hFile=0x358, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x522, lpOverlapped=0x0) returned 1 [0201.757] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x530, lpOverlapped=0x0) returned 1 [0201.757] ReadFile (in: hFile=0x358, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.758] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0201.758] SetEndOfFile (hFile=0x34c) returned 1 [0201.839] CloseHandle (hObject=0x34c) returned 1 [0201.839] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.839] SetEndOfFile (hFile=0x358) returned 1 [0201.856] CloseHandle (hObject=0x358) returned 1 [0201.856] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.870] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbc0mlu[1].jpg")) returned 1 [0201.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.873] lstrlenW (lpString=".doc") returned 4 [0201.873] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.873] lstrlenW (lpString=".docx") returned 5 [0201.873] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.873] lstrlenW (lpString=".pdf") returned 4 [0201.873] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.873] lstrlenW (lpString=".xls") returned 4 [0201.873] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.873] lstrlenW (lpString=".xlsx") returned 5 [0201.873] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.873] lstrlenW (lpString=".ppt") returned 4 [0201.873] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.873] lstrlenW (lpString=".zip") returned 4 [0201.873] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.873] lstrlenW (lpString=".rar") returned 4 [0201.873] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.873] lstrlenW (lpString=".bz2") returned 4 [0201.873] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.873] lstrlenW (lpString=".7z") returned 3 [0201.873] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.873] lstrlenW (lpString=".dbf") returned 4 [0201.873] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.873] lstrlenW (lpString=".1cd") returned 4 [0201.874] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.874] lstrlenW (lpString=".jpg") returned 4 [0201.874] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.874] lstrlenW (lpString=".doc") returned 4 [0201.874] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0201.874] lstrlenW (lpString=".docx") returned 5 [0201.874] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0201.874] lstrlenW (lpString=".pdf") returned 4 [0201.874] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0201.874] lstrlenW (lpString=".xls") returned 4 [0201.874] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0201.874] lstrlenW (lpString=".xlsx") returned 5 [0201.874] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0201.874] lstrlenW (lpString=".ppt") returned 4 [0201.874] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0201.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.874] lstrlenW (lpString=".zip") returned 4 [0201.874] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0201.874] lstrlenW (lpString=".rar") returned 4 [0201.874] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0201.874] lstrlenW (lpString=".bz2") returned 4 [0201.874] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0201.874] lstrlenW (lpString=".7z") returned 3 [0201.874] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0201.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.874] lstrlenW (lpString=".dbf") returned 4 [0201.874] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0201.874] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.874] lstrlenW (lpString=".1cd") returned 4 [0201.874] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0201.875] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBC0mlu[1].jpg") returned 126 [0201.875] lstrlenW (lpString=".jpg") returned 4 [0201.875] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0201.875] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0201.875] lstrlenW (lpString="BBEcHle[1].jpg") returned 14 [0201.875] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.123] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2233) returned 1 [0202.123] CloseHandle (hObject=0x2d4) returned 1 [0202.123] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg")) returned 0x2020 [0202.123] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.123] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.123] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.123] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.124] GetLastError () returned 0x0 [0202.124] ReadFile (in: hFile=0x2d4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x8b9, lpOverlapped=0x0) returned 1 [0202.126] WriteFile (in: hFile=0x350, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0202.127] ReadFile (in: hFile=0x2d4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.127] WriteFile (in: hFile=0x350, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.127] SetEndOfFile (hFile=0x350) returned 1 [0202.127] CloseHandle (hObject=0x350) returned 1 [0202.128] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.129] SetEndOfFile (hFile=0x2d4) returned 1 [0202.129] CloseHandle (hObject=0x2d4) returned 1 [0202.129] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.129] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbechle[1].jpg")) returned 1 [0202.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.130] lstrlenW (lpString=".doc") returned 4 [0202.130] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.130] lstrlenW (lpString=".docx") returned 5 [0202.130] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.130] lstrlenW (lpString=".pdf") returned 4 [0202.130] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.130] lstrlenW (lpString=".xls") returned 4 [0202.130] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.130] lstrlenW (lpString=".xlsx") returned 5 [0202.130] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.130] lstrlenW (lpString=".ppt") returned 4 [0202.130] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.130] lstrlenW (lpString=".zip") returned 4 [0202.130] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.130] lstrlenW (lpString=".rar") returned 4 [0202.130] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.130] lstrlenW (lpString=".bz2") returned 4 [0202.130] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.130] lstrlenW (lpString=".7z") returned 3 [0202.130] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.130] lstrlenW (lpString=".dbf") returned 4 [0202.130] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.130] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.130] lstrlenW (lpString=".1cd") returned 4 [0202.131] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.131] lstrlenW (lpString=".jpg") returned 4 [0202.131] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.131] lstrlenW (lpString=".doc") returned 4 [0202.131] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.131] lstrlenW (lpString=".docx") returned 5 [0202.131] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.131] lstrlenW (lpString=".pdf") returned 4 [0202.131] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.131] lstrlenW (lpString=".xls") returned 4 [0202.131] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.131] lstrlenW (lpString=".xlsx") returned 5 [0202.131] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.131] lstrlenW (lpString=".ppt") returned 4 [0202.131] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.131] lstrlenW (lpString=".zip") returned 4 [0202.131] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.131] lstrlenW (lpString=".rar") returned 4 [0202.131] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.131] lstrlenW (lpString=".bz2") returned 4 [0202.131] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.131] lstrlenW (lpString=".7z") returned 3 [0202.131] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.131] lstrlenW (lpString=".dbf") returned 4 [0202.131] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.131] lstrlenW (lpString=".1cd") returned 4 [0202.131] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.131] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEcHle[1].jpg") returned 126 [0202.132] lstrlenW (lpString=".jpg") returned 4 [0202.132] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.132] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.132] lstrlenW (lpString="BBEdE0f[1].jpg") returned 14 [0202.132] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.133] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=8326) returned 1 [0202.133] CloseHandle (hObject=0x2d4) returned 1 [0202.134] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg")) returned 0x2020 [0202.134] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.134] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.134] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.134] GetLastError () returned 0x0 [0202.134] ReadFile (in: hFile=0x2d4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x2086, lpOverlapped=0x0) returned 1 [0202.136] WriteFile (in: hFile=0x350, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x2090, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x2090, lpOverlapped=0x0) returned 1 [0202.137] ReadFile (in: hFile=0x2d4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.137] WriteFile (in: hFile=0x350, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.137] SetEndOfFile (hFile=0x350) returned 1 [0202.137] CloseHandle (hObject=0x350) returned 1 [0202.138] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.138] SetEndOfFile (hFile=0x2d4) returned 1 [0202.138] CloseHandle (hObject=0x2d4) returned 1 [0202.139] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.139] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbede0f[1].jpg")) returned 1 [0202.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.139] lstrlenW (lpString=".doc") returned 4 [0202.139] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.139] lstrlenW (lpString=".docx") returned 5 [0202.139] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.139] lstrlenW (lpString=".pdf") returned 4 [0202.139] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.139] lstrlenW (lpString=".xls") returned 4 [0202.139] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.139] lstrlenW (lpString=".xlsx") returned 5 [0202.139] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.139] lstrlenW (lpString=".ppt") returned 4 [0202.139] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.139] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.139] lstrlenW (lpString=".zip") returned 4 [0202.139] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.139] lstrlenW (lpString=".rar") returned 4 [0202.139] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.139] lstrlenW (lpString=".bz2") returned 4 [0202.139] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.140] lstrlenW (lpString=".7z") returned 3 [0202.140] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.140] lstrlenW (lpString=".dbf") returned 4 [0202.140] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.140] lstrlenW (lpString=".1cd") returned 4 [0202.140] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.140] lstrlenW (lpString=".jpg") returned 4 [0202.140] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.140] lstrlenW (lpString=".doc") returned 4 [0202.140] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.140] lstrlenW (lpString=".docx") returned 5 [0202.140] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.140] lstrlenW (lpString=".pdf") returned 4 [0202.140] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.140] lstrlenW (lpString=".xls") returned 4 [0202.140] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.140] lstrlenW (lpString=".xlsx") returned 5 [0202.140] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.140] lstrlenW (lpString=".ppt") returned 4 [0202.140] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.140] lstrlenW (lpString=".zip") returned 4 [0202.140] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.140] lstrlenW (lpString=".rar") returned 4 [0202.140] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.140] lstrlenW (lpString=".bz2") returned 4 [0202.140] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.140] lstrlenW (lpString=".7z") returned 3 [0202.141] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.141] lstrlenW (lpString=".dbf") returned 4 [0202.141] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.141] lstrlenW (lpString=".1cd") returned 4 [0202.141] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdE0f[1].jpg") returned 126 [0202.141] lstrlenW (lpString=".jpg") returned 4 [0202.141] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.142] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.142] lstrlenW (lpString="BBEdoQv[1].jpg") returned 14 [0202.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.143] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=2427) returned 1 [0202.143] CloseHandle (hObject=0x2d4) returned 1 [0202.143] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg")) returned 0x2020 [0202.143] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.143] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.143] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.143] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.144] GetLastError () returned 0x0 [0202.144] ReadFile (in: hFile=0x2d4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x97b, lpOverlapped=0x0) returned 1 [0202.146] WriteFile (in: hFile=0x350, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x980, lpOverlapped=0x0) returned 1 [0202.146] ReadFile (in: hFile=0x2d4, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.146] WriteFile (in: hFile=0x350, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0202.147] SetEndOfFile (hFile=0x350) returned 1 [0202.147] CloseHandle (hObject=0x350) returned 1 [0202.147] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.147] SetEndOfFile (hFile=0x2d4) returned 1 [0202.147] CloseHandle (hObject=0x2d4) returned 1 [0202.148] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.148] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedoqv[1].jpg")) returned 1 [0202.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.148] lstrlenW (lpString=".doc") returned 4 [0202.148] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.148] lstrlenW (lpString=".docx") returned 5 [0202.148] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.148] lstrlenW (lpString=".pdf") returned 4 [0202.148] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.148] lstrlenW (lpString=".xls") returned 4 [0202.148] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.148] lstrlenW (lpString=".xlsx") returned 5 [0202.148] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.148] lstrlenW (lpString=".ppt") returned 4 [0202.148] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.148] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.148] lstrlenW (lpString=".zip") returned 4 [0202.148] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.148] lstrlenW (lpString=".rar") returned 4 [0202.148] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.148] lstrlenW (lpString=".bz2") returned 4 [0202.148] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.149] lstrlenW (lpString=".7z") returned 3 [0202.149] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.149] lstrlenW (lpString=".dbf") returned 4 [0202.149] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.149] lstrlenW (lpString=".1cd") returned 4 [0202.149] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.149] lstrlenW (lpString=".jpg") returned 4 [0202.149] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.149] lstrlenW (lpString=".doc") returned 4 [0202.149] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0202.149] lstrlenW (lpString=".docx") returned 5 [0202.149] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0202.149] lstrlenW (lpString=".pdf") returned 4 [0202.149] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0202.149] lstrlenW (lpString=".xls") returned 4 [0202.149] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0202.149] lstrlenW (lpString=".xlsx") returned 5 [0202.149] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0202.149] lstrlenW (lpString=".ppt") returned 4 [0202.149] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0202.149] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.149] lstrlenW (lpString=".zip") returned 4 [0202.149] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0202.149] lstrlenW (lpString=".rar") returned 4 [0202.149] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0202.149] lstrlenW (lpString=".bz2") returned 4 [0202.149] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0202.149] lstrlenW (lpString=".7z") returned 3 [0202.150] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0202.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.150] lstrlenW (lpString=".dbf") returned 4 [0202.150] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0202.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.150] lstrlenW (lpString=".1cd") returned 4 [0202.150] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0202.150] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdoQv[1].jpg") returned 126 [0202.150] lstrlenW (lpString=".jpg") returned 4 [0202.150] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0202.150] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0202.150] lstrlenW (lpString="BBEdqEy[1].jpg") returned 14 [0202.150] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.098] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1690) returned 1 [0203.098] CloseHandle (hObject=0x378) returned 1 [0203.098] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg")) returned 0x2020 [0203.098] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.104] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.104] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.104] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.156] GetLastError () returned 0x0 [0203.156] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x69a, lpOverlapped=0x0) returned 1 [0203.158] WriteFile (in: hFile=0x378, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0203.159] ReadFile (in: hFile=0x354, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.159] WriteFile (in: hFile=0x378, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.159] SetEndOfFile (hFile=0x378) returned 1 [0203.159] CloseHandle (hObject=0x378) returned 1 [0203.159] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.159] SetEndOfFile (hFile=0x354) returned 1 [0203.160] CloseHandle (hObject=0x354) returned 1 [0203.160] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.160] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbedqey[1].jpg")) returned 1 [0203.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.160] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.160] lstrlenW (lpString=".doc") returned 4 [0203.160] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.160] lstrlenW (lpString=".docx") returned 5 [0203.160] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.160] lstrlenW (lpString=".pdf") returned 4 [0203.160] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.160] lstrlenW (lpString=".xls") returned 4 [0203.160] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.160] lstrlenW (lpString=".xlsx") returned 5 [0203.160] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.160] lstrlenW (lpString=".ppt") returned 4 [0203.160] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.161] lstrlenW (lpString=".zip") returned 4 [0203.161] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.161] lstrlenW (lpString=".rar") returned 4 [0203.161] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.161] lstrlenW (lpString=".bz2") returned 4 [0203.161] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.161] lstrlenW (lpString=".7z") returned 3 [0203.161] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.161] lstrlenW (lpString=".dbf") returned 4 [0203.161] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.161] lstrlenW (lpString=".1cd") returned 4 [0203.161] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.161] lstrlenW (lpString=".jpg") returned 4 [0203.161] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.161] lstrlenW (lpString=".doc") returned 4 [0203.161] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.161] lstrlenW (lpString=".docx") returned 5 [0203.161] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.161] lstrlenW (lpString=".pdf") returned 4 [0203.161] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.161] lstrlenW (lpString=".xls") returned 4 [0203.161] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.161] lstrlenW (lpString=".xlsx") returned 5 [0203.161] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.161] lstrlenW (lpString=".ppt") returned 4 [0203.161] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.161] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.161] lstrlenW (lpString=".zip") returned 4 [0203.162] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.162] lstrlenW (lpString=".rar") returned 4 [0203.162] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.162] lstrlenW (lpString=".bz2") returned 4 [0203.162] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.162] lstrlenW (lpString=".7z") returned 3 [0203.162] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.162] lstrlenW (lpString=".dbf") returned 4 [0203.162] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.162] lstrlenW (lpString=".1cd") returned 4 [0203.162] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.162] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEdqEy[1].jpg") returned 126 [0203.162] lstrlenW (lpString=".jpg") returned 4 [0203.162] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.162] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0203.162] lstrlenW (lpString="BBEgx5f[1].jpg") returned 14 [0203.162] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.163] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1509) returned 1 [0203.163] CloseHandle (hObject=0x378) returned 1 [0203.163] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg")) returned 0x2020 [0203.164] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.164] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.164] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.164] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.164] GetLastError () returned 0x0 [0203.164] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x5e5, lpOverlapped=0x0) returned 1 [0203.166] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0203.167] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.167] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.167] SetEndOfFile (hFile=0x34c) returned 1 [0203.167] CloseHandle (hObject=0x34c) returned 1 [0203.167] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.167] SetEndOfFile (hFile=0x378) returned 1 [0203.168] CloseHandle (hObject=0x378) returned 1 [0203.168] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.168] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[1].jpg")) returned 1 [0203.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.168] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.168] lstrlenW (lpString=".doc") returned 4 [0203.168] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.168] lstrlenW (lpString=".docx") returned 5 [0203.168] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.168] lstrlenW (lpString=".pdf") returned 4 [0203.169] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.169] lstrlenW (lpString=".xls") returned 4 [0203.169] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.169] lstrlenW (lpString=".xlsx") returned 5 [0203.169] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.169] lstrlenW (lpString=".ppt") returned 4 [0203.169] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.169] lstrlenW (lpString=".zip") returned 4 [0203.169] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.169] lstrlenW (lpString=".rar") returned 4 [0203.169] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.169] lstrlenW (lpString=".bz2") returned 4 [0203.169] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.169] lstrlenW (lpString=".7z") returned 3 [0203.169] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.169] lstrlenW (lpString=".dbf") returned 4 [0203.169] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.169] lstrlenW (lpString=".1cd") returned 4 [0203.169] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.169] lstrlenW (lpString=".jpg") returned 4 [0203.169] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.169] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.169] lstrlenW (lpString=".doc") returned 4 [0203.169] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.169] lstrlenW (lpString=".docx") returned 5 [0203.169] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.169] lstrlenW (lpString=".pdf") returned 4 [0203.169] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.170] lstrlenW (lpString=".xls") returned 4 [0203.170] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.170] lstrlenW (lpString=".xlsx") returned 5 [0203.170] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.170] lstrlenW (lpString=".ppt") returned 4 [0203.170] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.170] lstrlenW (lpString=".zip") returned 4 [0203.170] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.170] lstrlenW (lpString=".rar") returned 4 [0203.170] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.170] lstrlenW (lpString=".bz2") returned 4 [0203.170] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.170] lstrlenW (lpString=".7z") returned 3 [0203.170] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.170] lstrlenW (lpString=".dbf") returned 4 [0203.170] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.170] lstrlenW (lpString=".1cd") returned 4 [0203.170] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.170] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[1].jpg") returned 126 [0203.170] lstrlenW (lpString=".jpg") returned 4 [0203.170] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.170] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0203.170] lstrlenW (lpString="BBEgx5f[2].jpg") returned 14 [0203.170] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.172] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=1509) returned 1 [0203.172] CloseHandle (hObject=0x378) returned 1 [0203.172] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg")) returned 0x2020 [0203.172] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.172] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.172] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.172] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.173] GetLastError () returned 0x0 [0203.173] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x5e5, lpOverlapped=0x0) returned 1 [0203.174] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0203.175] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.175] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.175] SetEndOfFile (hFile=0x34c) returned 1 [0203.175] CloseHandle (hObject=0x34c) returned 1 [0203.175] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.175] SetEndOfFile (hFile=0x378) returned 1 [0203.176] CloseHandle (hObject=0x378) returned 1 [0203.176] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.176] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegx5f[2].jpg")) returned 1 [0203.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.176] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.177] lstrlenW (lpString=".doc") returned 4 [0203.177] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.177] lstrlenW (lpString=".docx") returned 5 [0203.177] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.177] lstrlenW (lpString=".pdf") returned 4 [0203.177] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.177] lstrlenW (lpString=".xls") returned 4 [0203.177] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.177] lstrlenW (lpString=".xlsx") returned 5 [0203.177] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.177] lstrlenW (lpString=".ppt") returned 4 [0203.177] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.177] lstrlenW (lpString=".zip") returned 4 [0203.177] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.177] lstrlenW (lpString=".rar") returned 4 [0203.177] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.177] lstrlenW (lpString=".bz2") returned 4 [0203.177] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.177] lstrlenW (lpString=".7z") returned 3 [0203.177] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.177] lstrlenW (lpString=".dbf") returned 4 [0203.177] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.177] lstrlenW (lpString=".1cd") returned 4 [0203.177] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.177] lstrlenW (lpString=".jpg") returned 4 [0203.177] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.177] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.177] lstrlenW (lpString=".doc") returned 4 [0203.177] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.177] lstrlenW (lpString=".docx") returned 5 [0203.178] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.178] lstrlenW (lpString=".pdf") returned 4 [0203.178] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.178] lstrlenW (lpString=".xls") returned 4 [0203.178] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.178] lstrlenW (lpString=".xlsx") returned 5 [0203.178] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.178] lstrlenW (lpString=".ppt") returned 4 [0203.178] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.178] lstrlenW (lpString=".zip") returned 4 [0203.178] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.178] lstrlenW (lpString=".rar") returned 4 [0203.178] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.178] lstrlenW (lpString=".bz2") returned 4 [0203.178] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.178] lstrlenW (lpString=".7z") returned 3 [0203.178] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.178] lstrlenW (lpString=".dbf") returned 4 [0203.178] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.178] lstrlenW (lpString=".1cd") returned 4 [0203.178] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.178] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgx5f[2].jpg") returned 126 [0203.178] lstrlenW (lpString=".jpg") returned 4 [0203.178] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.178] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0203.178] lstrlenW (lpString="BBEgyIm[1].jpg") returned 14 [0203.178] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.179] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=13669) returned 1 [0203.180] CloseHandle (hObject=0x378) returned 1 [0203.180] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg")) returned 0x2020 [0203.180] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.180] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.180] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.180] GetLastError () returned 0x0 [0203.180] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3565, lpOverlapped=0x0) returned 1 [0203.183] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3570, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3570, lpOverlapped=0x0) returned 1 [0203.184] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.184] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.184] SetEndOfFile (hFile=0x34c) returned 1 [0203.184] CloseHandle (hObject=0x34c) returned 1 [0203.184] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.184] SetEndOfFile (hFile=0x378) returned 1 [0203.185] CloseHandle (hObject=0x378) returned 1 [0203.185] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.185] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbegyim[1].jpg")) returned 1 [0203.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.185] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.185] lstrlenW (lpString=".doc") returned 4 [0203.185] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.185] lstrlenW (lpString=".docx") returned 5 [0203.185] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.185] lstrlenW (lpString=".pdf") returned 4 [0203.185] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.186] lstrlenW (lpString=".xls") returned 4 [0203.186] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.186] lstrlenW (lpString=".xlsx") returned 5 [0203.186] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.186] lstrlenW (lpString=".ppt") returned 4 [0203.186] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.186] lstrlenW (lpString=".zip") returned 4 [0203.186] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.186] lstrlenW (lpString=".rar") returned 4 [0203.186] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.186] lstrlenW (lpString=".bz2") returned 4 [0203.186] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.186] lstrlenW (lpString=".7z") returned 3 [0203.186] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.186] lstrlenW (lpString=".dbf") returned 4 [0203.186] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.186] lstrlenW (lpString=".1cd") returned 4 [0203.186] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.186] lstrlenW (lpString=".jpg") returned 4 [0203.186] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.186] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.186] lstrlenW (lpString=".doc") returned 4 [0203.186] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.186] lstrlenW (lpString=".docx") returned 5 [0203.186] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.186] lstrlenW (lpString=".pdf") returned 4 [0203.186] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.187] lstrlenW (lpString=".xls") returned 4 [0203.187] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.187] lstrlenW (lpString=".xlsx") returned 5 [0203.187] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.187] lstrlenW (lpString=".ppt") returned 4 [0203.187] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.187] lstrlenW (lpString=".zip") returned 4 [0203.187] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.187] lstrlenW (lpString=".rar") returned 4 [0203.187] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.187] lstrlenW (lpString=".bz2") returned 4 [0203.187] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.187] lstrlenW (lpString=".7z") returned 3 [0203.187] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.187] lstrlenW (lpString=".dbf") returned 4 [0203.187] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.187] lstrlenW (lpString=".1cd") returned 4 [0203.187] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.187] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBEgyIm[1].jpg") returned 126 [0203.187] lstrlenW (lpString=".jpg") returned 4 [0203.187] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.187] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0203.187] lstrlenW (lpString="BBg3ODX[2].png") returned 14 [0203.187] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.188] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=243) returned 1 [0203.189] CloseHandle (hObject=0x378) returned 1 [0203.189] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png")) returned 0x2020 [0203.189] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.189] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.189] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.189] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.189] GetLastError () returned 0x0 [0203.189] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0xf3, lpOverlapped=0x0) returned 1 [0203.191] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x100, lpOverlapped=0x0) returned 1 [0203.192] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.192] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.192] SetEndOfFile (hFile=0x34c) returned 1 [0203.192] CloseHandle (hObject=0x34c) returned 1 [0203.192] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.192] SetEndOfFile (hFile=0x378) returned 1 [0203.193] CloseHandle (hObject=0x378) returned 1 [0203.193] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.193] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbg3odx[2].png")) returned 1 [0203.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.193] lstrlenW (lpString=".doc") returned 4 [0203.193] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.193] lstrlenW (lpString=".docx") returned 5 [0203.193] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.194] lstrlenW (lpString=".pdf") returned 4 [0203.194] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.194] lstrlenW (lpString=".xls") returned 4 [0203.194] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.194] lstrlenW (lpString=".xlsx") returned 5 [0203.194] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.194] lstrlenW (lpString=".ppt") returned 4 [0203.194] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.194] lstrlenW (lpString=".zip") returned 4 [0203.194] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.194] lstrlenW (lpString=".rar") returned 4 [0203.194] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.194] lstrlenW (lpString=".bz2") returned 4 [0203.194] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.194] lstrlenW (lpString=".7z") returned 3 [0203.194] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.194] lstrlenW (lpString=".dbf") returned 4 [0203.194] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.194] lstrlenW (lpString=".1cd") returned 4 [0203.194] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.194] lstrlenW (lpString=".jpg") returned 4 [0203.194] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.194] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.194] lstrlenW (lpString=".doc") returned 4 [0203.194] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.194] lstrlenW (lpString=".docx") returned 5 [0203.194] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.194] lstrlenW (lpString=".pdf") returned 4 [0203.195] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.195] lstrlenW (lpString=".xls") returned 4 [0203.195] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.195] lstrlenW (lpString=".xlsx") returned 5 [0203.195] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.195] lstrlenW (lpString=".ppt") returned 4 [0203.195] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.195] lstrlenW (lpString=".zip") returned 4 [0203.195] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.195] lstrlenW (lpString=".rar") returned 4 [0203.195] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.195] lstrlenW (lpString=".bz2") returned 4 [0203.195] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.195] lstrlenW (lpString=".7z") returned 3 [0203.195] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.195] lstrlenW (lpString=".dbf") returned 4 [0203.195] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.195] lstrlenW (lpString=".1cd") returned 4 [0203.195] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.195] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBg3ODX[2].png") returned 126 [0203.195] lstrlenW (lpString=".jpg") returned 4 [0203.195] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.195] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0203.195] lstrlenW (lpString="BBiyCq[1].png") returned 13 [0203.195] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.196] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=953) returned 1 [0203.196] CloseHandle (hObject=0x378) returned 1 [0203.196] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png")) returned 0x2020 [0203.196] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.196] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.196] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.196] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.197] GetLastError () returned 0x0 [0203.197] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3b9, lpOverlapped=0x0) returned 1 [0203.198] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0203.199] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.199] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0203.199] SetEndOfFile (hFile=0x34c) returned 1 [0203.199] CloseHandle (hObject=0x34c) returned 1 [0203.200] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.200] SetEndOfFile (hFile=0x378) returned 1 [0203.200] CloseHandle (hObject=0x378) returned 1 [0203.200] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.201] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbiycq[1].png")) returned 1 [0203.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.201] lstrlenW (lpString=".doc") returned 4 [0203.201] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.201] lstrlenW (lpString=".docx") returned 5 [0203.201] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.201] lstrlenW (lpString=".pdf") returned 4 [0203.201] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.201] lstrlenW (lpString=".xls") returned 4 [0203.201] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.201] lstrlenW (lpString=".xlsx") returned 5 [0203.201] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.201] lstrlenW (lpString=".ppt") returned 4 [0203.201] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.201] lstrlenW (lpString=".zip") returned 4 [0203.201] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.201] lstrlenW (lpString=".rar") returned 4 [0203.201] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.201] lstrlenW (lpString=".bz2") returned 4 [0203.201] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.201] lstrlenW (lpString=".7z") returned 3 [0203.201] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.201] lstrlenW (lpString=".dbf") returned 4 [0203.202] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.202] lstrlenW (lpString=".1cd") returned 4 [0203.202] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.202] lstrlenW (lpString=".jpg") returned 4 [0203.202] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.202] lstrlenW (lpString=".doc") returned 4 [0203.202] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.202] lstrlenW (lpString=".docx") returned 5 [0203.202] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.202] lstrlenW (lpString=".pdf") returned 4 [0203.202] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.202] lstrlenW (lpString=".xls") returned 4 [0203.202] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.202] lstrlenW (lpString=".xlsx") returned 5 [0203.202] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.202] lstrlenW (lpString=".ppt") returned 4 [0203.202] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.202] lstrlenW (lpString=".zip") returned 4 [0203.202] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.202] lstrlenW (lpString=".rar") returned 4 [0203.202] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.202] lstrlenW (lpString=".bz2") returned 4 [0203.202] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.202] lstrlenW (lpString=".7z") returned 3 [0203.202] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.202] lstrlenW (lpString=".dbf") returned 4 [0203.202] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.203] lstrlenW (lpString=".1cd") returned 4 [0203.203] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBiyCq[1].png") returned 125 [0203.203] lstrlenW (lpString=".jpg") returned 4 [0203.203] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.203] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0203.203] lstrlenW (lpString="BBn4lUU[1].png") returned 14 [0203.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.205] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=333) returned 1 [0203.205] CloseHandle (hObject=0x378) returned 1 [0203.205] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png")) returned 0x2020 [0203.205] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.205] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.205] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.205] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.206] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.206] GetLastError () returned 0x0 [0203.206] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x14d, lpOverlapped=0x0) returned 1 [0203.208] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x150, lpOverlapped=0x0) returned 1 [0203.208] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.209] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.209] SetEndOfFile (hFile=0x34c) returned 1 [0203.209] CloseHandle (hObject=0x34c) returned 1 [0203.209] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.209] SetEndOfFile (hFile=0x378) returned 1 [0203.210] CloseHandle (hObject=0x378) returned 1 [0203.210] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.210] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbn4luu[1].png")) returned 1 [0203.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.210] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.210] lstrlenW (lpString=".doc") returned 4 [0203.210] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.210] lstrlenW (lpString=".docx") returned 5 [0203.210] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.210] lstrlenW (lpString=".pdf") returned 4 [0203.210] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.210] lstrlenW (lpString=".xls") returned 4 [0203.210] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.210] lstrlenW (lpString=".xlsx") returned 5 [0203.210] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.211] lstrlenW (lpString=".ppt") returned 4 [0203.211] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.211] lstrlenW (lpString=".zip") returned 4 [0203.211] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.211] lstrlenW (lpString=".rar") returned 4 [0203.211] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.211] lstrlenW (lpString=".bz2") returned 4 [0203.211] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.211] lstrlenW (lpString=".7z") returned 3 [0203.211] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.211] lstrlenW (lpString=".dbf") returned 4 [0203.211] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.211] lstrlenW (lpString=".1cd") returned 4 [0203.211] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.211] lstrlenW (lpString=".jpg") returned 4 [0203.211] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.211] lstrlenW (lpString=".doc") returned 4 [0203.211] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.211] lstrlenW (lpString=".docx") returned 5 [0203.211] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.211] lstrlenW (lpString=".pdf") returned 4 [0203.211] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.211] lstrlenW (lpString=".xls") returned 4 [0203.211] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.211] lstrlenW (lpString=".xlsx") returned 5 [0203.211] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.211] lstrlenW (lpString=".ppt") returned 4 [0203.211] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.212] lstrlenW (lpString=".zip") returned 4 [0203.212] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.212] lstrlenW (lpString=".rar") returned 4 [0203.212] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.212] lstrlenW (lpString=".bz2") returned 4 [0203.212] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.212] lstrlenW (lpString=".7z") returned 3 [0203.212] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.212] lstrlenW (lpString=".dbf") returned 4 [0203.212] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.212] lstrlenW (lpString=".1cd") returned 4 [0203.212] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBn4lUU[1].png") returned 126 [0203.212] lstrlenW (lpString=".jpg") returned 4 [0203.212] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.212] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0203.212] lstrlenW (lpString="BBnMKeN[1].png") returned 14 [0203.212] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.213] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=587) returned 1 [0203.213] CloseHandle (hObject=0x378) returned 1 [0203.213] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png")) returned 0x2020 [0203.213] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.213] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.213] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.214] GetLastError () returned 0x0 [0203.214] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x24b, lpOverlapped=0x0) returned 1 [0203.215] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x250, lpOverlapped=0x0) returned 1 [0203.216] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.216] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.216] SetEndOfFile (hFile=0x34c) returned 1 [0203.216] CloseHandle (hObject=0x34c) returned 1 [0203.216] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.216] SetEndOfFile (hFile=0x378) returned 1 [0203.217] CloseHandle (hObject=0x378) returned 1 [0203.217] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.217] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbnmken[1].png")) returned 1 [0203.218] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.218] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.218] lstrlenW (lpString=".doc") returned 4 [0203.218] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.218] lstrlenW (lpString=".docx") returned 5 [0203.218] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.218] lstrlenW (lpString=".pdf") returned 4 [0203.218] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.218] lstrlenW (lpString=".xls") returned 4 [0203.218] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.218] lstrlenW (lpString=".xlsx") returned 5 [0203.218] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.218] lstrlenW (lpString=".ppt") returned 4 [0203.218] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.218] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.218] lstrlenW (lpString=".zip") returned 4 [0203.218] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.218] lstrlenW (lpString=".rar") returned 4 [0203.218] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.218] lstrlenW (lpString=".bz2") returned 4 [0203.218] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.218] lstrlenW (lpString=".7z") returned 3 [0203.218] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.218] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.218] lstrlenW (lpString=".dbf") returned 4 [0203.218] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.218] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.218] lstrlenW (lpString=".1cd") returned 4 [0203.218] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.218] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.218] lstrlenW (lpString=".jpg") returned 4 [0203.218] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.219] lstrlenW (lpString=".doc") returned 4 [0203.219] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.219] lstrlenW (lpString=".docx") returned 5 [0203.219] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.219] lstrlenW (lpString=".pdf") returned 4 [0203.219] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.219] lstrlenW (lpString=".xls") returned 4 [0203.219] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.219] lstrlenW (lpString=".xlsx") returned 5 [0203.219] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.219] lstrlenW (lpString=".ppt") returned 4 [0203.219] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.219] lstrlenW (lpString=".zip") returned 4 [0203.219] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.219] lstrlenW (lpString=".rar") returned 4 [0203.219] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.219] lstrlenW (lpString=".bz2") returned 4 [0203.219] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.219] lstrlenW (lpString=".7z") returned 3 [0203.219] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.219] lstrlenW (lpString=".dbf") returned 4 [0203.219] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.219] lstrlenW (lpString=".1cd") returned 4 [0203.219] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.219] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBnMKeN[1].png") returned 126 [0203.219] lstrlenW (lpString=".jpg") returned 4 [0203.219] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.220] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0203.220] lstrlenW (lpString="BBwGan9[1].jpg") returned 14 [0203.220] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.221] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=14519) returned 1 [0203.221] CloseHandle (hObject=0x378) returned 1 [0203.221] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg")) returned 0x2020 [0203.221] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.221] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.221] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.221] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.222] GetLastError () returned 0x0 [0203.222] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x38b7, lpOverlapped=0x0) returned 1 [0203.223] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x38c0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x38c0, lpOverlapped=0x0) returned 1 [0203.224] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.224] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.224] SetEndOfFile (hFile=0x34c) returned 1 [0203.224] CloseHandle (hObject=0x34c) returned 1 [0203.224] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.225] SetEndOfFile (hFile=0x378) returned 1 [0203.225] CloseHandle (hObject=0x378) returned 1 [0203.225] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.226] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbwgan9[1].jpg")) returned 1 [0203.226] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.226] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.226] lstrlenW (lpString=".doc") returned 4 [0203.226] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.226] lstrlenW (lpString=".docx") returned 5 [0203.226] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.226] lstrlenW (lpString=".pdf") returned 4 [0203.226] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.226] lstrlenW (lpString=".xls") returned 4 [0203.226] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.226] lstrlenW (lpString=".xlsx") returned 5 [0203.226] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.226] lstrlenW (lpString=".ppt") returned 4 [0203.226] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.226] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.226] lstrlenW (lpString=".zip") returned 4 [0203.226] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.226] lstrlenW (lpString=".rar") returned 4 [0203.226] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.226] lstrlenW (lpString=".bz2") returned 4 [0203.226] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.226] lstrlenW (lpString=".7z") returned 3 [0203.226] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.227] lstrlenW (lpString=".dbf") returned 4 [0203.227] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.227] lstrlenW (lpString=".1cd") returned 4 [0203.227] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.227] lstrlenW (lpString=".jpg") returned 4 [0203.227] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.227] lstrlenW (lpString=".doc") returned 4 [0203.227] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0203.227] lstrlenW (lpString=".docx") returned 5 [0203.227] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0203.227] lstrlenW (lpString=".pdf") returned 4 [0203.227] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0203.227] lstrlenW (lpString=".xls") returned 4 [0203.227] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0203.227] lstrlenW (lpString=".xlsx") returned 5 [0203.227] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0203.227] lstrlenW (lpString=".ppt") returned 4 [0203.227] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0203.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.227] lstrlenW (lpString=".zip") returned 4 [0203.227] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0203.227] lstrlenW (lpString=".rar") returned 4 [0203.227] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0203.227] lstrlenW (lpString=".bz2") returned 4 [0203.227] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0203.227] lstrlenW (lpString=".7z") returned 3 [0203.227] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0203.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.227] lstrlenW (lpString=".dbf") returned 4 [0203.228] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0203.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.228] lstrlenW (lpString=".1cd") returned 4 [0203.228] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0203.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBwGan9[1].jpg") returned 126 [0203.228] lstrlenW (lpString=".jpg") returned 4 [0203.228] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0203.228] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0203.228] lstrlenW (lpString="BBz3ebk[1].png") returned 14 [0203.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.228] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=876) returned 1 [0203.228] CloseHandle (hObject=0x378) returned 1 [0203.228] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png")) returned 0x2020 [0203.229] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.229] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.229] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.229] GetLastError () returned 0x0 [0203.229] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x36c, lpOverlapped=0x0) returned 1 [0203.285] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x370, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x370, lpOverlapped=0x0) returned 1 [0203.286] ReadFile (in: hFile=0x378, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.286] WriteFile (in: hFile=0x34c, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0203.287] SetEndOfFile (hFile=0x34c) returned 1 [0203.381] CloseHandle (hObject=0x34c) returned 1 [0203.381] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.381] SetEndOfFile (hFile=0x378) returned 1 [0203.399] CloseHandle (hObject=0x378) returned 1 [0203.399] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.421] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\bbz3ebk[1].png")) returned 1 [0203.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.421] lstrlenW (lpString=".doc") returned 4 [0203.421] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.421] lstrlenW (lpString=".docx") returned 5 [0203.421] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.421] lstrlenW (lpString=".pdf") returned 4 [0203.430] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.430] lstrlenW (lpString=".xls") returned 4 [0203.430] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.430] lstrlenW (lpString=".xlsx") returned 5 [0203.430] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.430] lstrlenW (lpString=".ppt") returned 4 [0203.430] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.430] lstrlenW (lpString=".zip") returned 4 [0203.430] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.430] lstrlenW (lpString=".rar") returned 4 [0203.435] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.435] lstrlenW (lpString=".bz2") returned 4 [0203.438] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.438] lstrlenW (lpString=".7z") returned 3 [0203.438] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.441] lstrlenW (lpString=".dbf") returned 4 [0203.441] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.441] lstrlenW (lpString=".1cd") returned 4 [0203.441] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.441] lstrlenW (lpString=".jpg") returned 4 [0203.441] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.441] lstrlenW (lpString=".doc") returned 4 [0203.449] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0203.449] lstrlenW (lpString=".docx") returned 5 [0203.449] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0203.449] lstrlenW (lpString=".pdf") returned 4 [0203.449] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0203.449] lstrlenW (lpString=".xls") returned 4 [0203.449] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0203.449] lstrlenW (lpString=".xlsx") returned 5 [0203.449] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0203.449] lstrlenW (lpString=".ppt") returned 4 [0203.450] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0203.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.450] lstrlenW (lpString=".zip") returned 4 [0203.450] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0203.450] lstrlenW (lpString=".rar") returned 4 [0203.450] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0203.450] lstrlenW (lpString=".bz2") returned 4 [0203.450] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0203.450] lstrlenW (lpString=".7z") returned 3 [0203.450] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0203.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.450] lstrlenW (lpString=".dbf") returned 4 [0203.450] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0203.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.450] lstrlenW (lpString=".1cd") returned 4 [0203.450] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0203.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\BBz3ebk[1].png") returned 126 [0203.450] lstrlenW (lpString=".jpg") returned 4 [0203.450] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0203.451] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0203.451] lstrlenW (lpString="postmessageRelay[1].htm") returned 23 [0203.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.608] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=506) returned 1 [0203.608] CloseHandle (hObject=0x154) returned 1 [0203.608] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm")) returned 0x2020 [0203.608] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.609] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.609] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.609] GetLastError () returned 0x0 [0203.609] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x1fa, lpOverlapped=0x0) returned 1 [0203.610] WriteFile (in: hFile=0x2d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x200, lpOverlapped=0x0) returned 1 [0203.611] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.611] WriteFile (in: hFile=0x2d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x102, lpOverlapped=0x0) returned 1 [0203.611] SetEndOfFile (hFile=0x2d8) returned 1 [0203.611] CloseHandle (hObject=0x2d8) returned 1 [0203.611] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.611] SetEndOfFile (hFile=0x154) returned 1 [0203.612] CloseHandle (hObject=0x154) returned 1 [0203.612] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.612] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\postmessagerelay[1].htm")) returned 1 [0203.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.613] lstrlenW (lpString=".doc") returned 4 [0203.613] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0203.613] lstrlenW (lpString=".docx") returned 5 [0203.613] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0203.613] lstrlenW (lpString=".pdf") returned 4 [0203.613] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0203.613] lstrlenW (lpString=".xls") returned 4 [0203.613] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0203.613] lstrlenW (lpString=".xlsx") returned 5 [0203.613] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0203.613] lstrlenW (lpString=".ppt") returned 4 [0203.613] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0203.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.613] lstrlenW (lpString=".zip") returned 4 [0203.613] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0203.613] lstrlenW (lpString=".rar") returned 4 [0203.613] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0203.613] lstrlenW (lpString=".bz2") returned 4 [0203.613] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0203.613] lstrlenW (lpString=".7z") returned 3 [0203.613] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0203.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.613] lstrlenW (lpString=".dbf") returned 4 [0203.613] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0203.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.613] lstrlenW (lpString=".1cd") returned 4 [0203.613] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0203.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.613] lstrlenW (lpString=".jpg") returned 4 [0203.613] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0203.613] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.614] lstrlenW (lpString=".doc") returned 4 [0203.614] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0203.614] lstrlenW (lpString=".docx") returned 5 [0203.614] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0203.614] lstrlenW (lpString=".pdf") returned 4 [0203.614] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0203.614] lstrlenW (lpString=".xls") returned 4 [0203.614] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0203.614] lstrlenW (lpString=".xlsx") returned 5 [0203.614] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0203.614] lstrlenW (lpString=".ppt") returned 4 [0203.614] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0203.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.614] lstrlenW (lpString=".zip") returned 4 [0203.614] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0203.614] lstrlenW (lpString=".rar") returned 4 [0203.614] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0203.614] lstrlenW (lpString=".bz2") returned 4 [0203.614] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0203.614] lstrlenW (lpString=".7z") returned 3 [0203.614] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0203.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.614] lstrlenW (lpString=".dbf") returned 4 [0203.614] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0203.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.614] lstrlenW (lpString=".1cd") returned 4 [0203.614] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0203.614] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\postmessageRelay[1].htm") returned 135 [0203.614] lstrlenW (lpString=".jpg") returned 4 [0203.614] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0203.615] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0203.615] lstrlenW (lpString="search[1].htm") returned 13 [0203.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.615] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=105071) returned 1 [0203.615] CloseHandle (hObject=0x154) returned 1 [0203.615] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm")) returned 0x2020 [0203.615] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.615] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.615] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.615] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.617] GetLastError () returned 0x0 [0203.617] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x19a6f, lpOverlapped=0x0) returned 1 [0203.621] WriteFile (in: hFile=0x2d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x19a70, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x19a70, lpOverlapped=0x0) returned 1 [0203.624] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.624] WriteFile (in: hFile=0x2d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0203.624] SetEndOfFile (hFile=0x2d8) returned 1 [0203.624] CloseHandle (hObject=0x2d8) returned 1 [0203.624] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.624] SetEndOfFile (hFile=0x154) returned 1 [0203.625] CloseHandle (hObject=0x154) returned 1 [0203.625] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.626] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\search[1].htm")) returned 1 [0203.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.626] lstrlenW (lpString=".doc") returned 4 [0203.626] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0203.626] lstrlenW (lpString=".docx") returned 5 [0203.626] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0203.626] lstrlenW (lpString=".pdf") returned 4 [0203.626] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0203.626] lstrlenW (lpString=".xls") returned 4 [0203.626] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0203.626] lstrlenW (lpString=".xlsx") returned 5 [0203.626] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0203.626] lstrlenW (lpString=".ppt") returned 4 [0203.626] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0203.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.626] lstrlenW (lpString=".zip") returned 4 [0203.626] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0203.626] lstrlenW (lpString=".rar") returned 4 [0203.626] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0203.626] lstrlenW (lpString=".bz2") returned 4 [0203.626] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0203.626] lstrlenW (lpString=".7z") returned 3 [0203.626] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0203.626] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.627] lstrlenW (lpString=".dbf") returned 4 [0203.627] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0203.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.627] lstrlenW (lpString=".1cd") returned 4 [0203.627] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0203.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.627] lstrlenW (lpString=".jpg") returned 4 [0203.627] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0203.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.627] lstrlenW (lpString=".doc") returned 4 [0203.627] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0203.627] lstrlenW (lpString=".docx") returned 5 [0203.627] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0203.627] lstrlenW (lpString=".pdf") returned 4 [0203.627] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0203.627] lstrlenW (lpString=".xls") returned 4 [0203.627] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0203.627] lstrlenW (lpString=".xlsx") returned 5 [0203.627] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0203.627] lstrlenW (lpString=".ppt") returned 4 [0203.627] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0203.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.627] lstrlenW (lpString=".zip") returned 4 [0203.627] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0203.627] lstrlenW (lpString=".rar") returned 4 [0203.627] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0203.627] lstrlenW (lpString=".bz2") returned 4 [0203.627] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0203.627] lstrlenW (lpString=".7z") returned 3 [0203.627] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0203.627] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.627] lstrlenW (lpString=".dbf") returned 4 [0203.628] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0203.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.628] lstrlenW (lpString=".1cd") returned 4 [0203.628] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0203.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\search[1].htm") returned 125 [0203.628] lstrlenW (lpString=".jpg") returned 4 [0203.628] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0203.628] lstrcmpiW (lpString1=".css", lpString2=".wiki") returned -1 [0203.628] lstrlenW (lpString="uhf-west-european-default.min[1].css") returned 36 [0203.628] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.629] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=116827) returned 1 [0203.629] CloseHandle (hObject=0x154) returned 1 [0203.629] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css")) returned 0x2020 [0203.629] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.629] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.629] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.629] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.630] GetLastError () returned 0x0 [0203.630] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x1c85b, lpOverlapped=0x0) returned 1 [0203.633] WriteFile (in: hFile=0x2d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1c860, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x1c860, lpOverlapped=0x0) returned 1 [0203.636] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.636] WriteFile (in: hFile=0x2d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x11c, lpOverlapped=0x0) returned 1 [0203.637] SetEndOfFile (hFile=0x2d8) returned 1 [0203.637] CloseHandle (hObject=0x2d8) returned 1 [0203.637] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.637] SetEndOfFile (hFile=0x154) returned 1 [0203.640] CloseHandle (hObject=0x154) returned 1 [0203.640] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.640] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\uhf-west-european-default.min[1].css")) returned 1 [0203.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.640] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.640] lstrlenW (lpString=".doc") returned 4 [0203.640] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0203.640] lstrlenW (lpString=".docx") returned 5 [0203.640] lstrcmpiW (lpString1=".docx", lpString2="].css") returned -1 [0203.640] lstrlenW (lpString=".pdf") returned 4 [0203.640] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0203.640] lstrlenW (lpString=".xls") returned 4 [0203.640] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0203.640] lstrlenW (lpString=".xlsx") returned 5 [0203.640] lstrcmpiW (lpString1=".xlsx", lpString2="].css") returned -1 [0203.640] lstrlenW (lpString=".ppt") returned 4 [0203.640] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0203.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.641] lstrlenW (lpString=".zip") returned 4 [0203.641] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0203.641] lstrlenW (lpString=".rar") returned 4 [0203.641] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0203.641] lstrlenW (lpString=".bz2") returned 4 [0203.641] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0203.641] lstrlenW (lpString=".7z") returned 3 [0203.641] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0203.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.641] lstrlenW (lpString=".dbf") returned 4 [0203.641] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0203.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.641] lstrlenW (lpString=".1cd") returned 4 [0203.641] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0203.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.641] lstrlenW (lpString=".jpg") returned 4 [0203.641] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0203.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.641] lstrlenW (lpString=".doc") returned 4 [0203.641] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0203.641] lstrlenW (lpString=".docx") returned 5 [0203.641] lstrcmpiW (lpString1=".docx", lpString2="].css") returned -1 [0203.641] lstrlenW (lpString=".pdf") returned 4 [0203.641] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0203.641] lstrlenW (lpString=".xls") returned 4 [0203.641] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0203.641] lstrlenW (lpString=".xlsx") returned 5 [0203.641] lstrcmpiW (lpString1=".xlsx", lpString2="].css") returned -1 [0203.641] lstrlenW (lpString=".ppt") returned 4 [0203.641] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0203.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.642] lstrlenW (lpString=".zip") returned 4 [0203.642] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0203.642] lstrlenW (lpString=".rar") returned 4 [0203.642] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0203.642] lstrlenW (lpString=".bz2") returned 4 [0203.642] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0203.642] lstrlenW (lpString=".7z") returned 3 [0203.642] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0203.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.642] lstrlenW (lpString=".dbf") returned 4 [0203.642] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0203.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.642] lstrlenW (lpString=".1cd") returned 4 [0203.642] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0203.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\uhf-west-european-default.min[1].css") returned 148 [0203.642] lstrlenW (lpString=".jpg") returned 4 [0203.642] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0203.642] lstrcmpiW (lpString1=".css", lpString2=".wiki") returned -1 [0203.642] lstrlenW (lpString="WebCore.4.19.0.ltr.light.min[1].css") returned 35 [0203.642] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.643] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=5767) returned 1 [0203.643] CloseHandle (hObject=0x154) returned 1 [0203.643] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css")) returned 0x2020 [0203.643] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.643] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.643] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.644] GetLastError () returned 0x0 [0203.644] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x1687, lpOverlapped=0x0) returned 1 [0203.784] WriteFile (in: hFile=0x2d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1690, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x1690, lpOverlapped=0x0) returned 1 [0203.799] ReadFile (in: hFile=0x154, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.800] WriteFile (in: hFile=0x2d8, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x11a, lpOverlapped=0x0) returned 1 [0203.800] SetEndOfFile (hFile=0x2d8) returned 1 [0203.800] CloseHandle (hObject=0x2d8) returned 1 [0203.800] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.800] SetEndOfFile (hFile=0x154) returned 1 [0203.826] CloseHandle (hObject=0x154) returned 1 [0203.826] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.826] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\webcore.4.19.0.ltr.light.min[1].css")) returned 1 [0203.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.827] lstrlenW (lpString=".doc") returned 4 [0203.827] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0203.827] lstrlenW (lpString=".docx") returned 5 [0203.827] lstrcmpiW (lpString1=".docx", lpString2="].css") returned -1 [0203.827] lstrlenW (lpString=".pdf") returned 4 [0203.827] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0203.827] lstrlenW (lpString=".xls") returned 4 [0203.827] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0203.827] lstrlenW (lpString=".xlsx") returned 5 [0203.827] lstrcmpiW (lpString1=".xlsx", lpString2="].css") returned -1 [0203.827] lstrlenW (lpString=".ppt") returned 4 [0203.827] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0203.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.827] lstrlenW (lpString=".zip") returned 4 [0203.827] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0203.827] lstrlenW (lpString=".rar") returned 4 [0203.827] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0203.827] lstrlenW (lpString=".bz2") returned 4 [0203.827] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0203.827] lstrlenW (lpString=".7z") returned 3 [0203.827] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0203.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.827] lstrlenW (lpString=".dbf") returned 4 [0203.827] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0203.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.827] lstrlenW (lpString=".1cd") returned 4 [0203.827] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0203.827] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.827] lstrlenW (lpString=".jpg") returned 4 [0203.827] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0203.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.828] lstrlenW (lpString=".doc") returned 4 [0203.828] lstrcmpiW (lpString1=".doc", lpString2=".css") returned 1 [0203.828] lstrlenW (lpString=".docx") returned 5 [0203.828] lstrcmpiW (lpString1=".docx", lpString2="].css") returned -1 [0203.828] lstrlenW (lpString=".pdf") returned 4 [0203.828] lstrcmpiW (lpString1=".pdf", lpString2=".css") returned 1 [0203.828] lstrlenW (lpString=".xls") returned 4 [0203.828] lstrcmpiW (lpString1=".xls", lpString2=".css") returned 1 [0203.828] lstrlenW (lpString=".xlsx") returned 5 [0203.828] lstrcmpiW (lpString1=".xlsx", lpString2="].css") returned -1 [0203.828] lstrlenW (lpString=".ppt") returned 4 [0203.828] lstrcmpiW (lpString1=".ppt", lpString2=".css") returned 1 [0203.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.828] lstrlenW (lpString=".zip") returned 4 [0203.828] lstrcmpiW (lpString1=".zip", lpString2=".css") returned 1 [0203.828] lstrlenW (lpString=".rar") returned 4 [0203.828] lstrcmpiW (lpString1=".rar", lpString2=".css") returned 1 [0203.828] lstrlenW (lpString=".bz2") returned 4 [0203.828] lstrcmpiW (lpString1=".bz2", lpString2=".css") returned -1 [0203.828] lstrlenW (lpString=".7z") returned 3 [0203.828] lstrcmpiW (lpString1=".7z", lpString2="css") returned -1 [0203.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.828] lstrlenW (lpString=".dbf") returned 4 [0203.828] lstrcmpiW (lpString1=".dbf", lpString2=".css") returned 1 [0203.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.828] lstrlenW (lpString=".1cd") returned 4 [0203.828] lstrcmpiW (lpString1=".1cd", lpString2=".css") returned -1 [0203.828] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\WebCore.4.19.0.ltr.light.min[1].css") returned 147 [0203.828] lstrlenW (lpString=".jpg") returned 4 [0203.828] lstrcmpiW (lpString1=".jpg", lpString2=".css") returned 1 [0203.829] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0203.829] lstrlenW (lpString="AA429NP[1].png") returned 14 [0203.829] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.967] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=613) returned 1 [0203.967] CloseHandle (hObject=0x350) returned 1 [0203.967] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png")) returned 0x2020 [0203.968] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.968] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.968] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0204.273] GetLastError () returned 0x0 [0204.273] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x265, lpOverlapped=0x0) returned 1 [0204.275] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x270, lpOverlapped=0x0) returned 1 [0204.276] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.276] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.276] SetEndOfFile (hFile=0x388) returned 1 [0204.276] CloseHandle (hObject=0x388) returned 1 [0204.276] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.276] SetEndOfFile (hFile=0x350) returned 1 [0204.279] CloseHandle (hObject=0x350) returned 1 [0204.279] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.279] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aa429np[1].png")) returned 1 [0204.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.279] lstrlenW (lpString=".doc") returned 4 [0204.279] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.279] lstrlenW (lpString=".docx") returned 5 [0204.279] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.279] lstrlenW (lpString=".pdf") returned 4 [0204.279] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.279] lstrlenW (lpString=".xls") returned 4 [0204.279] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.279] lstrlenW (lpString=".xlsx") returned 5 [0204.279] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.279] lstrlenW (lpString=".ppt") returned 4 [0204.280] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.280] lstrlenW (lpString=".zip") returned 4 [0204.280] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.280] lstrlenW (lpString=".rar") returned 4 [0204.280] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.280] lstrlenW (lpString=".bz2") returned 4 [0204.280] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.280] lstrlenW (lpString=".7z") returned 3 [0204.280] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.280] lstrlenW (lpString=".dbf") returned 4 [0204.280] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.280] lstrlenW (lpString=".1cd") returned 4 [0204.280] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.280] lstrlenW (lpString=".jpg") returned 4 [0204.280] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.280] lstrlenW (lpString=".doc") returned 4 [0204.280] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.280] lstrlenW (lpString=".docx") returned 5 [0204.280] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.280] lstrlenW (lpString=".pdf") returned 4 [0204.280] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.280] lstrlenW (lpString=".xls") returned 4 [0204.280] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.280] lstrlenW (lpString=".xlsx") returned 5 [0204.280] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.280] lstrlenW (lpString=".ppt") returned 4 [0204.280] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.281] lstrlenW (lpString=".zip") returned 4 [0204.281] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.281] lstrlenW (lpString=".rar") returned 4 [0204.281] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.281] lstrlenW (lpString=".bz2") returned 4 [0204.281] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.281] lstrlenW (lpString=".7z") returned 3 [0204.281] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.281] lstrlenW (lpString=".dbf") returned 4 [0204.281] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.281] lstrlenW (lpString=".1cd") returned 4 [0204.281] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AA429NP[1].png") returned 126 [0204.281] lstrlenW (lpString=".jpg") returned 4 [0204.281] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.281] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.281] lstrlenW (lpString="AAni8qk[1].png") returned 14 [0204.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.282] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=913) returned 1 [0204.282] CloseHandle (hObject=0x350) returned 1 [0204.282] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png")) returned 0x2020 [0204.282] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.282] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.282] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.282] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0204.283] GetLastError () returned 0x0 [0204.283] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x391, lpOverlapped=0x0) returned 1 [0204.284] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0204.286] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.286] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.286] SetEndOfFile (hFile=0x388) returned 1 [0204.286] CloseHandle (hObject=0x388) returned 1 [0204.286] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.286] SetEndOfFile (hFile=0x350) returned 1 [0204.287] CloseHandle (hObject=0x350) returned 1 [0204.287] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.287] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\aani8qk[1].png")) returned 1 [0204.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.287] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.287] lstrlenW (lpString=".doc") returned 4 [0204.287] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.287] lstrlenW (lpString=".docx") returned 5 [0204.287] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.287] lstrlenW (lpString=".pdf") returned 4 [0204.287] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.287] lstrlenW (lpString=".xls") returned 4 [0204.287] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.287] lstrlenW (lpString=".xlsx") returned 5 [0204.287] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.287] lstrlenW (lpString=".ppt") returned 4 [0204.288] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.288] lstrlenW (lpString=".zip") returned 4 [0204.288] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.288] lstrlenW (lpString=".rar") returned 4 [0204.288] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.288] lstrlenW (lpString=".bz2") returned 4 [0204.288] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.288] lstrlenW (lpString=".7z") returned 3 [0204.288] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.288] lstrlenW (lpString=".dbf") returned 4 [0204.288] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.288] lstrlenW (lpString=".1cd") returned 4 [0204.288] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.288] lstrlenW (lpString=".jpg") returned 4 [0204.288] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.288] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.288] lstrlenW (lpString=".doc") returned 4 [0204.288] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.288] lstrlenW (lpString=".docx") returned 5 [0204.288] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.288] lstrlenW (lpString=".pdf") returned 4 [0204.288] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.288] lstrlenW (lpString=".xls") returned 4 [0204.288] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.288] lstrlenW (lpString=".xlsx") returned 5 [0204.288] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.288] lstrlenW (lpString=".ppt") returned 4 [0204.288] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.289] lstrlenW (lpString=".zip") returned 4 [0204.289] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.289] lstrlenW (lpString=".rar") returned 4 [0204.289] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.289] lstrlenW (lpString=".bz2") returned 4 [0204.289] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.289] lstrlenW (lpString=".7z") returned 3 [0204.289] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.289] lstrlenW (lpString=".dbf") returned 4 [0204.289] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.289] lstrlenW (lpString=".1cd") returned 4 [0204.289] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.289] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\AAni8qk[1].png") returned 126 [0204.289] lstrlenW (lpString=".jpg") returned 4 [0204.289] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.289] lstrcmpiW (lpString1=".js", lpString2=".wiki") returned -1 [0204.289] lstrlenW (lpString="adition[1].js") returned 13 [0204.289] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.290] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=31314) returned 1 [0204.290] CloseHandle (hObject=0x350) returned 1 [0204.290] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js")) returned 0x2020 [0204.290] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.290] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.290] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.290] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0204.291] GetLastError () returned 0x0 [0204.291] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x7a52, lpOverlapped=0x0) returned 1 [0204.293] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x7a60, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x7a60, lpOverlapped=0x0) returned 1 [0204.294] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.294] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xee, lpOverlapped=0x0) returned 1 [0204.295] SetEndOfFile (hFile=0x388) returned 1 [0204.295] CloseHandle (hObject=0x388) returned 1 [0204.295] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.295] SetEndOfFile (hFile=0x350) returned 1 [0204.297] CloseHandle (hObject=0x350) returned 1 [0204.297] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.297] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\adition[1].js")) returned 1 [0204.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.297] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.297] lstrlenW (lpString=".doc") returned 4 [0204.297] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0204.297] lstrlenW (lpString=".docx") returned 5 [0204.297] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0204.297] lstrlenW (lpString=".pdf") returned 4 [0204.297] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0204.297] lstrlenW (lpString=".xls") returned 4 [0204.297] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0204.297] lstrlenW (lpString=".xlsx") returned 5 [0204.298] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0204.298] lstrlenW (lpString=".ppt") returned 4 [0204.298] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0204.298] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.298] lstrlenW (lpString=".zip") returned 4 [0204.298] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0204.298] lstrlenW (lpString=".rar") returned 4 [0204.298] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0204.298] lstrlenW (lpString=".bz2") returned 4 [0204.298] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0204.298] lstrlenW (lpString=".7z") returned 3 [0204.298] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0204.298] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.298] lstrlenW (lpString=".dbf") returned 4 [0204.298] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0204.298] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.298] lstrlenW (lpString=".1cd") returned 4 [0204.298] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0204.298] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.298] lstrlenW (lpString=".jpg") returned 4 [0204.298] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0204.298] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.298] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.298] lstrlenW (lpString=".doc") returned 4 [0204.298] lstrcmpiW (lpString1=".doc", lpString2="].js") returned -1 [0204.298] lstrlenW (lpString=".docx") returned 5 [0204.298] lstrcmpiW (lpString1=".docx", lpString2="1].js") returned -1 [0204.298] lstrlenW (lpString=".pdf") returned 4 [0204.298] lstrcmpiW (lpString1=".pdf", lpString2="].js") returned -1 [0204.298] lstrlenW (lpString=".xls") returned 4 [0204.298] lstrcmpiW (lpString1=".xls", lpString2="].js") returned -1 [0204.298] lstrlenW (lpString=".xlsx") returned 5 [0204.299] lstrcmpiW (lpString1=".xlsx", lpString2="1].js") returned -1 [0204.299] lstrlenW (lpString=".ppt") returned 4 [0204.299] lstrcmpiW (lpString1=".ppt", lpString2="].js") returned -1 [0204.299] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.299] lstrlenW (lpString=".zip") returned 4 [0204.299] lstrcmpiW (lpString1=".zip", lpString2="].js") returned -1 [0204.299] lstrlenW (lpString=".rar") returned 4 [0204.299] lstrcmpiW (lpString1=".rar", lpString2="].js") returned -1 [0204.299] lstrlenW (lpString=".bz2") returned 4 [0204.299] lstrcmpiW (lpString1=".bz2", lpString2="].js") returned -1 [0204.299] lstrlenW (lpString=".7z") returned 3 [0204.299] lstrcmpiW (lpString1=".7z", lpString2=".js") returned -1 [0204.299] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.299] lstrlenW (lpString=".dbf") returned 4 [0204.299] lstrcmpiW (lpString1=".dbf", lpString2="].js") returned -1 [0204.299] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.299] lstrlenW (lpString=".1cd") returned 4 [0204.299] lstrcmpiW (lpString1=".1cd", lpString2="].js") returned -1 [0204.299] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\adition[1].js") returned 125 [0204.299] lstrlenW (lpString=".jpg") returned 4 [0204.299] lstrcmpiW (lpString1=".jpg", lpString2="].js") returned -1 [0204.299] lstrcmpiW (lpString1=".htm", lpString2=".wiki") returned -1 [0204.299] lstrlenW (lpString="async_usersync[1].htm") returned 21 [0204.299] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.301] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=995) returned 1 [0204.301] CloseHandle (hObject=0x350) returned 1 [0204.301] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm")) returned 0x2020 [0204.301] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.301] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.301] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.301] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0204.302] GetLastError () returned 0x0 [0204.302] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x3e3, lpOverlapped=0x0) returned 1 [0204.304] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x3f0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x3f0, lpOverlapped=0x0) returned 1 [0204.305] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.305] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0204.305] SetEndOfFile (hFile=0x388) returned 1 [0204.305] CloseHandle (hObject=0x388) returned 1 [0204.305] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.305] SetEndOfFile (hFile=0x350) returned 1 [0204.306] CloseHandle (hObject=0x350) returned 1 [0204.306] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.306] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\async_usersync[1].htm")) returned 1 [0204.306] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.306] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.306] lstrlenW (lpString=".doc") returned 4 [0204.306] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0204.306] lstrlenW (lpString=".docx") returned 5 [0204.306] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0204.306] lstrlenW (lpString=".pdf") returned 4 [0204.306] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0204.306] lstrlenW (lpString=".xls") returned 4 [0204.306] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0204.306] lstrlenW (lpString=".xlsx") returned 5 [0204.306] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0204.307] lstrlenW (lpString=".ppt") returned 4 [0204.307] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0204.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.307] lstrlenW (lpString=".zip") returned 4 [0204.307] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0204.307] lstrlenW (lpString=".rar") returned 4 [0204.307] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0204.307] lstrlenW (lpString=".bz2") returned 4 [0204.307] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0204.307] lstrlenW (lpString=".7z") returned 3 [0204.307] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0204.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.307] lstrlenW (lpString=".dbf") returned 4 [0204.307] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0204.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.307] lstrlenW (lpString=".1cd") returned 4 [0204.307] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0204.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.307] lstrlenW (lpString=".jpg") returned 4 [0204.307] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0204.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.307] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.307] lstrlenW (lpString=".doc") returned 4 [0204.307] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0204.307] lstrlenW (lpString=".docx") returned 5 [0204.307] lstrcmpiW (lpString1=".docx", lpString2="].htm") returned -1 [0204.307] lstrlenW (lpString=".pdf") returned 4 [0204.307] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0204.307] lstrlenW (lpString=".xls") returned 4 [0204.307] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0204.307] lstrlenW (lpString=".xlsx") returned 5 [0204.307] lstrcmpiW (lpString1=".xlsx", lpString2="].htm") returned -1 [0204.307] lstrlenW (lpString=".ppt") returned 4 [0204.308] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0204.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.308] lstrlenW (lpString=".zip") returned 4 [0204.308] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0204.308] lstrlenW (lpString=".rar") returned 4 [0204.308] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0204.308] lstrlenW (lpString=".bz2") returned 4 [0204.308] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0204.308] lstrlenW (lpString=".7z") returned 3 [0204.308] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0204.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.308] lstrlenW (lpString=".dbf") returned 4 [0204.308] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0204.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.308] lstrlenW (lpString=".1cd") returned 4 [0204.308] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0204.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\async_usersync[1].htm") returned 133 [0204.308] lstrlenW (lpString=".jpg") returned 4 [0204.308] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0204.308] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.308] lstrlenW (lpString="b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 43 [0204.308] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.309] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=24555) returned 1 [0204.309] CloseHandle (hObject=0x350) returned 1 [0204.309] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg")) returned 0x2020 [0204.309] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.309] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.309] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.309] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0204.310] GetLastError () returned 0x0 [0204.310] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x5feb, lpOverlapped=0x0) returned 1 [0204.312] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x5ff0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x5ff0, lpOverlapped=0x0) returned 1 [0204.314] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.314] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x12a, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x12a, lpOverlapped=0x0) returned 1 [0204.314] SetEndOfFile (hFile=0x388) returned 1 [0204.314] CloseHandle (hObject=0x388) returned 1 [0204.314] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.314] SetEndOfFile (hFile=0x350) returned 1 [0204.315] CloseHandle (hObject=0x350) returned 1 [0204.315] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.315] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg")) returned 1 [0204.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.315] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.315] lstrlenW (lpString=".doc") returned 4 [0204.315] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.315] lstrlenW (lpString=".docx") returned 5 [0204.315] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.315] lstrlenW (lpString=".pdf") returned 4 [0204.316] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.316] lstrlenW (lpString=".xls") returned 4 [0204.316] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.316] lstrlenW (lpString=".xlsx") returned 5 [0204.316] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.316] lstrlenW (lpString=".ppt") returned 4 [0204.316] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.316] lstrlenW (lpString=".zip") returned 4 [0204.316] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.316] lstrlenW (lpString=".rar") returned 4 [0204.316] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.316] lstrlenW (lpString=".bz2") returned 4 [0204.316] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.316] lstrlenW (lpString=".7z") returned 3 [0204.316] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.316] lstrlenW (lpString=".dbf") returned 4 [0204.316] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.316] lstrlenW (lpString=".1cd") returned 4 [0204.316] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.316] lstrlenW (lpString=".jpg") returned 4 [0204.316] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.316] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.316] lstrlenW (lpString=".doc") returned 4 [0204.316] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.316] lstrlenW (lpString=".docx") returned 5 [0204.316] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.316] lstrlenW (lpString=".pdf") returned 4 [0204.316] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.317] lstrlenW (lpString=".xls") returned 4 [0204.317] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.317] lstrlenW (lpString=".xlsx") returned 5 [0204.317] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.317] lstrlenW (lpString=".ppt") returned 4 [0204.317] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.317] lstrlenW (lpString=".zip") returned 4 [0204.317] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.317] lstrlenW (lpString=".rar") returned 4 [0204.317] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.317] lstrlenW (lpString=".bz2") returned 4 [0204.317] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.317] lstrlenW (lpString=".7z") returned 3 [0204.317] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.317] lstrlenW (lpString=".dbf") returned 4 [0204.317] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.317] lstrlenW (lpString=".1cd") returned 4 [0204.317] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\b367c075-d98a-457d-b37d-3d9e8ab53e8b[1].jpg") returned 155 [0204.317] lstrlenW (lpString=".jpg") returned 4 [0204.317] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.317] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.317] lstrlenW (lpString="BB8jcOr[2].png") returned 14 [0204.317] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.318] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=426) returned 1 [0204.318] CloseHandle (hObject=0x350) returned 1 [0204.318] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png")) returned 0x2020 [0204.318] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.318] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.318] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.318] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0204.320] GetLastError () returned 0x0 [0204.320] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x1aa, lpOverlapped=0x0) returned 1 [0204.322] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1b0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x1b0, lpOverlapped=0x0) returned 1 [0204.323] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.323] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.323] SetEndOfFile (hFile=0x388) returned 1 [0204.323] CloseHandle (hObject=0x388) returned 1 [0204.323] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.323] SetEndOfFile (hFile=0x350) returned 1 [0204.324] CloseHandle (hObject=0x350) returned 1 [0204.324] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.324] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bb8jcor[2].png")) returned 1 [0204.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.325] lstrlenW (lpString=".doc") returned 4 [0204.325] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.325] lstrlenW (lpString=".docx") returned 5 [0204.325] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.325] lstrlenW (lpString=".pdf") returned 4 [0204.325] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.325] lstrlenW (lpString=".xls") returned 4 [0204.325] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.325] lstrlenW (lpString=".xlsx") returned 5 [0204.325] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.325] lstrlenW (lpString=".ppt") returned 4 [0204.325] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.325] lstrlenW (lpString=".zip") returned 4 [0204.325] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.325] lstrlenW (lpString=".rar") returned 4 [0204.325] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.325] lstrlenW (lpString=".bz2") returned 4 [0204.325] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.325] lstrlenW (lpString=".7z") returned 3 [0204.325] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.325] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.325] lstrlenW (lpString=".dbf") returned 4 [0204.326] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.326] lstrlenW (lpString=".1cd") returned 4 [0204.326] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.326] lstrlenW (lpString=".jpg") returned 4 [0204.326] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.326] lstrlenW (lpString=".doc") returned 4 [0204.326] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.326] lstrlenW (lpString=".docx") returned 5 [0204.326] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.326] lstrlenW (lpString=".pdf") returned 4 [0204.326] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.326] lstrlenW (lpString=".xls") returned 4 [0204.326] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.326] lstrlenW (lpString=".xlsx") returned 5 [0204.326] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.326] lstrlenW (lpString=".ppt") returned 4 [0204.326] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.326] lstrlenW (lpString=".zip") returned 4 [0204.326] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.326] lstrlenW (lpString=".rar") returned 4 [0204.326] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.326] lstrlenW (lpString=".bz2") returned 4 [0204.326] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.326] lstrlenW (lpString=".7z") returned 3 [0204.326] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.326] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.326] lstrlenW (lpString=".dbf") returned 4 [0204.326] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.327] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.327] lstrlenW (lpString=".1cd") returned 4 [0204.327] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.327] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BB8jcOr[2].png") returned 126 [0204.327] lstrlenW (lpString=".jpg") returned 4 [0204.327] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.327] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.327] lstrlenW (lpString="BBB8ZbM[1].jpg") returned 14 [0204.327] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.327] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=7202) returned 1 [0204.327] CloseHandle (hObject=0x350) returned 1 [0204.327] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg")) returned 0x2020 [0204.328] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.328] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.328] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.328] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0204.328] GetLastError () returned 0x0 [0204.328] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x1c22, lpOverlapped=0x0) returned 1 [0204.330] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x1c30, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x1c30, lpOverlapped=0x0) returned 1 [0204.331] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.331] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.331] SetEndOfFile (hFile=0x388) returned 1 [0204.331] CloseHandle (hObject=0x388) returned 1 [0204.331] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.331] SetEndOfFile (hFile=0x350) returned 1 [0204.332] CloseHandle (hObject=0x350) returned 1 [0204.332] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.332] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb8zbm[1].jpg")) returned 1 [0204.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.333] lstrlenW (lpString=".doc") returned 4 [0204.333] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.333] lstrlenW (lpString=".docx") returned 5 [0204.333] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.333] lstrlenW (lpString=".pdf") returned 4 [0204.333] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.333] lstrlenW (lpString=".xls") returned 4 [0204.333] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.333] lstrlenW (lpString=".xlsx") returned 5 [0204.333] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.333] lstrlenW (lpString=".ppt") returned 4 [0204.333] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.333] lstrlenW (lpString=".zip") returned 4 [0204.333] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.333] lstrlenW (lpString=".rar") returned 4 [0204.333] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.333] lstrlenW (lpString=".bz2") returned 4 [0204.333] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.333] lstrlenW (lpString=".7z") returned 3 [0204.333] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.333] lstrlenW (lpString=".dbf") returned 4 [0204.333] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.333] lstrlenW (lpString=".1cd") returned 4 [0204.333] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.333] lstrlenW (lpString=".jpg") returned 4 [0204.333] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.333] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.334] lstrlenW (lpString=".doc") returned 4 [0204.334] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0204.334] lstrlenW (lpString=".docx") returned 5 [0204.334] lstrcmpiW (lpString1=".docx", lpString2="].jpg") returned -1 [0204.334] lstrlenW (lpString=".pdf") returned 4 [0204.334] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0204.334] lstrlenW (lpString=".xls") returned 4 [0204.334] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0204.334] lstrlenW (lpString=".xlsx") returned 5 [0204.334] lstrcmpiW (lpString1=".xlsx", lpString2="].jpg") returned -1 [0204.334] lstrlenW (lpString=".ppt") returned 4 [0204.334] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0204.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.334] lstrlenW (lpString=".zip") returned 4 [0204.334] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0204.334] lstrlenW (lpString=".rar") returned 4 [0204.334] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0204.334] lstrlenW (lpString=".bz2") returned 4 [0204.334] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0204.334] lstrlenW (lpString=".7z") returned 3 [0204.334] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0204.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.334] lstrlenW (lpString=".dbf") returned 4 [0204.334] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0204.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.334] lstrlenW (lpString=".1cd") returned 4 [0204.334] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0204.334] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB8ZbM[1].jpg") returned 126 [0204.334] lstrlenW (lpString=".jpg") returned 4 [0204.334] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0204.335] lstrcmpiW (lpString1=".png", lpString2=".wiki") returned -1 [0204.335] lstrlenW (lpString="BBB9wH0[1].png") returned 14 [0204.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.335] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x313ff1c | out: lpFileSize=0x313ff1c*=564) returned 1 [0204.335] CloseHandle (hObject=0x350) returned 1 [0204.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png")) returned 0x2020 [0204.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0204.335] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.335] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.336] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0204.336] GetLastError () returned 0x0 [0204.336] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x234, lpOverlapped=0x0) returned 1 [0204.547] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0x240, lpOverlapped=0x0) returned 1 [0204.884] ReadFile (in: hFile=0x350, lpBuffer=0x3cf0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x313fed4, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesRead=0x313fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.884] WriteFile (in: hFile=0x388, lpBuffer=0x3cf0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x313fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3cf0020*, lpNumberOfBytesWritten=0x313fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0204.892] SetEndOfFile (hFile=0x388) returned 1 [0204.892] CloseHandle (hObject=0x388) returned 1 [0204.892] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x313fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.892] SetEndOfFile (hFile=0x350) returned 1 [0204.893] CloseHandle (hObject=0x350) returned 1 [0204.893] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.893] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbb9wh0[1].png")) returned 1 [0204.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.893] lstrlenW (lpString=".doc") returned 4 [0204.893] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.893] lstrlenW (lpString=".docx") returned 5 [0204.893] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.893] lstrlenW (lpString=".pdf") returned 4 [0204.893] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.893] lstrlenW (lpString=".xls") returned 4 [0204.894] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.894] lstrlenW (lpString=".xlsx") returned 5 [0204.894] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.894] lstrlenW (lpString=".ppt") returned 4 [0204.894] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.894] lstrlenW (lpString=".zip") returned 4 [0204.894] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.894] lstrlenW (lpString=".rar") returned 4 [0204.894] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.894] lstrlenW (lpString=".bz2") returned 4 [0204.894] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.894] lstrlenW (lpString=".7z") returned 3 [0204.894] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.894] lstrlenW (lpString=".dbf") returned 4 [0204.894] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.894] lstrlenW (lpString=".1cd") returned 4 [0204.894] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.894] lstrlenW (lpString=".jpg") returned 4 [0204.894] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.894] lstrlenW (lpString=".doc") returned 4 [0204.894] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0204.894] lstrlenW (lpString=".docx") returned 5 [0204.894] lstrcmpiW (lpString1=".docx", lpString2="].png") returned -1 [0204.894] lstrlenW (lpString=".pdf") returned 4 [0204.894] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0204.894] lstrlenW (lpString=".xls") returned 4 [0204.894] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0204.895] lstrlenW (lpString=".xlsx") returned 5 [0204.895] lstrcmpiW (lpString1=".xlsx", lpString2="].png") returned -1 [0204.895] lstrlenW (lpString=".ppt") returned 4 [0204.895] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0204.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.895] lstrlenW (lpString=".zip") returned 4 [0204.895] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0204.895] lstrlenW (lpString=".rar") returned 4 [0204.895] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0204.895] lstrlenW (lpString=".bz2") returned 4 [0204.895] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0204.895] lstrlenW (lpString=".7z") returned 3 [0204.895] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0204.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.895] lstrlenW (lpString=".dbf") returned 4 [0204.895] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0204.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.895] lstrlenW (lpString=".1cd") returned 4 [0204.895] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0204.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBB9wH0[1].png") returned 126 [0204.895] lstrlenW (lpString=".jpg") returned 4 [0204.895] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0204.895] lstrcmpiW (lpString1=".jpg", lpString2=".wiki") returned -1 [0204.895] lstrlenW (lpString="BBBVACL[1].jpg") returned 14 [0204.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\BBBVACL[1].jpg" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\bbbvacl[1].jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 71 os_tid = 0x7d4 [0183.497] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x3890060 [0183.498] lstrlenW (lpString="C:") returned 2 [0183.498] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x327fd00 | out: lpFindFileData=0x327fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x2e0978 [0183.498] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0183.498] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0183.498] lstrlenW (lpString="$Recycle.Bin") returned 12 [0183.498] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0183.498] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x38a0068 [0183.499] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0183.499] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e09b8 [0183.499] FindNextFileW (in: hFindFile=0x2e09b8, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.499] FindNextFileW (in: hFindFile=0x2e09b8, lpFindFileData=0x327fa84 | out: lpFindFileData=0x327fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcf1a3640, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xcf1a3640, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0183.499] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0183.499] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0183.499] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0183.499] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0183.499] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x38b0070 [0183.499] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0183.499] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcf1a3640, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xcf1a3640, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x2e09f8 [0183.500] FindNextFileW (in: hFindFile=0x2e09f8, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcf1a3640, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xcf1a3640, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.500] FindNextFileW (in: hFindFile=0x2e09f8, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcf1a3640, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xcf1a3640, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xcf1c97a0, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0183.500] lstrlenW (lpString="desktop.ini") returned 11 [0183.500] lstrlenW (lpString=".1cd") returned 4 [0183.500] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0183.500] lstrlenW (lpString=".3ds") returned 4 [0183.500] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0183.500] lstrlenW (lpString=".3fr") returned 4 [0183.500] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0183.500] lstrlenW (lpString=".3g2") returned 4 [0183.500] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0183.500] lstrlenW (lpString=".3gp") returned 4 [0183.500] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0183.500] lstrlenW (lpString=".7z") returned 3 [0183.500] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0183.500] lstrlenW (lpString=".accda") returned 6 [0183.500] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0183.500] lstrlenW (lpString=".accdb") returned 6 [0183.500] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0183.500] lstrlenW (lpString=".accdc") returned 6 [0183.500] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0183.500] lstrlenW (lpString=".accde") returned 6 [0183.500] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0183.500] lstrlenW (lpString=".accdt") returned 6 [0183.500] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0183.500] lstrlenW (lpString=".accdw") returned 6 [0183.500] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0183.500] lstrlenW (lpString=".adb") returned 4 [0183.501] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".adp") returned 4 [0183.501] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".ai") returned 3 [0183.501] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0183.501] lstrlenW (lpString=".ai3") returned 4 [0183.501] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".ai4") returned 4 [0183.501] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".ai5") returned 4 [0183.501] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".ai6") returned 4 [0183.501] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".ai7") returned 4 [0183.501] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".ai8") returned 4 [0183.501] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".anim") returned 5 [0183.501] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0183.501] lstrlenW (lpString=".arw") returned 4 [0183.501] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".as") returned 3 [0183.501] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0183.501] lstrlenW (lpString=".asa") returned 4 [0183.501] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".asc") returned 4 [0183.501] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".ascx") returned 5 [0183.501] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0183.501] lstrlenW (lpString=".asm") returned 4 [0183.501] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".asmx") returned 5 [0183.501] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0183.501] lstrlenW (lpString=".asp") returned 4 [0183.501] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0183.501] lstrlenW (lpString=".aspx") returned 5 [0183.502] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0183.502] lstrlenW (lpString=".asr") returned 4 [0183.502] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".asx") returned 4 [0183.502] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".avi") returned 4 [0183.502] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".avs") returned 4 [0183.502] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".backup") returned 7 [0183.502] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0183.502] lstrlenW (lpString=".bak") returned 4 [0183.502] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".bay") returned 4 [0183.502] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".bd") returned 3 [0183.502] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0183.502] lstrlenW (lpString=".bin") returned 4 [0183.502] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".bmp") returned 4 [0183.502] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".bz2") returned 4 [0183.502] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".c") returned 2 [0183.502] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0183.502] lstrlenW (lpString=".cdr") returned 4 [0183.502] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".cer") returned 4 [0183.502] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".cf") returned 3 [0183.502] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0183.502] lstrlenW (lpString=".cfc") returned 4 [0183.502] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0183.502] lstrlenW (lpString=".cfm") returned 4 [0183.503] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".cfml") returned 5 [0183.503] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0183.503] lstrlenW (lpString=".cfu") returned 4 [0183.503] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".chm") returned 4 [0183.503] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".cin") returned 4 [0183.503] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".class") returned 6 [0183.503] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0183.503] lstrlenW (lpString=".clx") returned 4 [0183.503] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".config") returned 7 [0183.503] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0183.503] lstrlenW (lpString=".cpp") returned 4 [0183.503] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".cr2") returned 4 [0183.503] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".crt") returned 4 [0183.503] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".crw") returned 4 [0183.503] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".cs") returned 3 [0183.503] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0183.503] lstrlenW (lpString=".css") returned 4 [0183.503] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".csv") returned 4 [0183.503] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".cub") returned 4 [0183.503] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".dae") returned 4 [0183.503] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".dat") returned 4 [0183.503] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0183.503] lstrlenW (lpString=".db") returned 3 [0183.504] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0183.504] lstrlenW (lpString=".dbf") returned 4 [0183.504] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".dbx") returned 4 [0183.504] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".dc3") returned 4 [0183.504] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".dcm") returned 4 [0183.504] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".dcr") returned 4 [0183.504] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".der") returned 4 [0183.504] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".dib") returned 4 [0183.504] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".dic") returned 4 [0183.504] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".dif") returned 4 [0183.504] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".divx") returned 5 [0183.504] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0183.504] lstrlenW (lpString=".djvu") returned 5 [0183.504] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0183.504] lstrlenW (lpString=".dng") returned 4 [0183.504] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".doc") returned 4 [0183.504] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".docm") returned 5 [0183.504] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0183.504] lstrlenW (lpString=".docx") returned 5 [0183.504] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0183.504] lstrlenW (lpString=".dot") returned 4 [0183.504] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0183.504] lstrlenW (lpString=".dotm") returned 5 [0183.504] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0183.504] lstrlenW (lpString=".dotx") returned 5 [0183.505] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0183.505] lstrlenW (lpString=".dpx") returned 4 [0183.505] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".dqy") returned 4 [0183.505] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".dsn") returned 4 [0183.505] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".dt") returned 3 [0183.505] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0183.505] lstrlenW (lpString=".dtd") returned 4 [0183.505] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".dwg") returned 4 [0183.505] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".dwt") returned 4 [0183.505] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".dx") returned 3 [0183.505] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0183.505] lstrlenW (lpString=".dxf") returned 4 [0183.505] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".edml") returned 5 [0183.505] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0183.505] lstrlenW (lpString=".efd") returned 4 [0183.505] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".elf") returned 4 [0183.505] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".emf") returned 4 [0183.505] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".emz") returned 4 [0183.505] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".epf") returned 4 [0183.505] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".eps") returned 4 [0183.505] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0183.505] lstrlenW (lpString=".epsf") returned 5 [0183.505] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0183.505] lstrlenW (lpString=".epsp") returned 5 [0183.506] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0183.506] lstrlenW (lpString=".erf") returned 4 [0183.506] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".exr") returned 4 [0183.506] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".f4v") returned 4 [0183.506] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".fido") returned 5 [0183.506] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0183.506] lstrlenW (lpString=".flm") returned 4 [0183.506] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".flv") returned 4 [0183.506] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".frm") returned 4 [0183.506] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".fxg") returned 4 [0183.506] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".geo") returned 4 [0183.506] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".gif") returned 4 [0183.506] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".grs") returned 4 [0183.506] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".gz") returned 3 [0183.506] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0183.506] lstrlenW (lpString=".h") returned 2 [0183.506] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0183.506] lstrlenW (lpString=".hdr") returned 4 [0183.506] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".hpp") returned 4 [0183.506] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".hta") returned 4 [0183.506] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0183.506] lstrlenW (lpString=".htc") returned 4 [0183.506] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0183.507] lstrlenW (lpString=".htm") returned 4 [0183.507] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0183.507] lstrlenW (lpString=".html") returned 5 [0183.507] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0183.507] lstrlenW (lpString=".icb") returned 4 [0183.507] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0183.507] lstrlenW (lpString=".ics") returned 4 [0183.507] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0183.507] lstrlenW (lpString=".iff") returned 4 [0183.507] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0183.507] lstrlenW (lpString=".inc") returned 4 [0183.507] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0183.507] lstrlenW (lpString=".indd") returned 5 [0183.507] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0183.507] lstrlenW (lpString=".ini") returned 4 [0183.507] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0183.507] lstrlenW (lpString="desktop.ini") returned 11 [0183.507] lstrlenW (lpString=".wiki") returned 5 [0183.507] lstrcmpiW (lpString1=".wiki", lpString2="p.ini") returned -1 [0183.507] lstrlenW (lpString="desktop.ini") returned 11 [0183.507] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0183.507] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0183.507] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0183.507] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0183.507] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0183.508] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0183.508] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0183.508] lstrcmpiW (lpString1="1Black.exe", lpString2="desktop.ini") returned -1 [0183.508] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0183.508] FindNextFileW (in: hFindFile=0x2e09f8, lpFindFileData=0x327f808 | out: lpFindFileData=0x327f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x99b98230, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0x99b98230, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0x99bbe390, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="DESKTO~1.WIK")) returned 1 [0183.508] lstrlenW (lpString="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki") returned 53 [0183.508] lstrlenW (lpString=".1cd") returned 4 [0183.508] lstrcmpiW (lpString1=".1cd", lpString2="wiki") returned -1 [0183.508] lstrlenW (lpString=".3ds") returned 4 [0183.508] lstrcmpiW (lpString1=".3ds", lpString2="wiki") returned -1 [0183.508] lstrlenW (lpString=".3fr") returned 4 [0183.508] lstrcmpiW (lpString1=".3fr", lpString2="wiki") returned -1 [0183.508] lstrlenW (lpString=".3g2") returned 4 [0183.508] lstrcmpiW (lpString1=".3g2", lpString2="wiki") returned -1 [0183.508] lstrlenW (lpString=".3gp") returned 4 [0183.508] lstrcmpiW (lpString1=".3gp", lpString2="wiki") returned -1 [0183.508] lstrlenW (lpString=".7z") returned 3 [0183.508] lstrcmpiW (lpString1=".7z", lpString2="iki") returned -1 [0183.508] lstrlenW (lpString=".accda") returned 6 [0183.508] lstrcmpiW (lpString1=".accda", lpString2="].wiki") returned -1 [0183.508] lstrlenW (lpString=".accdb") returned 6 [0183.508] lstrcmpiW (lpString1=".accdb", lpString2="].wiki") returned -1 [0183.508] lstrlenW (lpString=".accdc") returned 6 [0183.508] lstrcmpiW (lpString1=".accdc", lpString2="].wiki") returned -1 [0183.508] lstrlenW (lpString=".accde") returned 6 [0183.508] lstrcmpiW (lpString1=".accde", lpString2="].wiki") returned -1 [0183.508] lstrlenW (lpString=".accdt") returned 6 [0183.508] lstrcmpiW (lpString1=".accdt", lpString2="].wiki") returned -1 [0183.508] lstrlenW (lpString=".accdw") returned 6 [0183.508] lstrcmpiW (lpString1=".accdw", lpString2="].wiki") returned -1 [0183.508] lstrlenW (lpString=".adb") returned 4 [0183.509] lstrcmpiW (lpString1=".adb", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".adp") returned 4 [0183.509] lstrcmpiW (lpString1=".adp", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".ai") returned 3 [0183.509] lstrcmpiW (lpString1=".ai", lpString2="iki") returned -1 [0183.509] lstrlenW (lpString=".ai3") returned 4 [0183.509] lstrcmpiW (lpString1=".ai3", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".ai4") returned 4 [0183.509] lstrcmpiW (lpString1=".ai4", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".ai5") returned 4 [0183.509] lstrcmpiW (lpString1=".ai5", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".ai6") returned 4 [0183.509] lstrcmpiW (lpString1=".ai6", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".ai7") returned 4 [0183.509] lstrcmpiW (lpString1=".ai7", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".ai8") returned 4 [0183.509] lstrcmpiW (lpString1=".ai8", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".anim") returned 5 [0183.509] lstrcmpiW (lpString1=".anim", lpString2=".wiki") returned -1 [0183.509] lstrlenW (lpString=".arw") returned 4 [0183.509] lstrcmpiW (lpString1=".arw", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".as") returned 3 [0183.509] lstrcmpiW (lpString1=".as", lpString2="iki") returned -1 [0183.509] lstrlenW (lpString=".asa") returned 4 [0183.509] lstrcmpiW (lpString1=".asa", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".asc") returned 4 [0183.509] lstrcmpiW (lpString1=".asc", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".ascx") returned 5 [0183.509] lstrcmpiW (lpString1=".ascx", lpString2=".wiki") returned -1 [0183.509] lstrlenW (lpString=".asm") returned 4 [0183.509] lstrcmpiW (lpString1=".asm", lpString2="wiki") returned -1 [0183.509] lstrlenW (lpString=".asmx") returned 5 [0183.509] lstrcmpiW (lpString1=".asmx", lpString2=".wiki") returned -1 [0183.509] lstrlenW (lpString=".asp") returned 4 [0183.509] lstrcmpiW (lpString1=".asp", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".aspx") returned 5 [0183.510] lstrcmpiW (lpString1=".aspx", lpString2=".wiki") returned -1 [0183.510] lstrlenW (lpString=".asr") returned 4 [0183.510] lstrcmpiW (lpString1=".asr", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".asx") returned 4 [0183.510] lstrcmpiW (lpString1=".asx", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".avi") returned 4 [0183.510] lstrcmpiW (lpString1=".avi", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".avs") returned 4 [0183.510] lstrcmpiW (lpString1=".avs", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".backup") returned 7 [0183.510] lstrcmpiW (lpString1=".backup", lpString2=" ].wiki") returned 1 [0183.510] lstrlenW (lpString=".bak") returned 4 [0183.510] lstrcmpiW (lpString1=".bak", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".bay") returned 4 [0183.510] lstrcmpiW (lpString1=".bay", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".bd") returned 3 [0183.510] lstrcmpiW (lpString1=".bd", lpString2="iki") returned -1 [0183.510] lstrlenW (lpString=".bin") returned 4 [0183.510] lstrcmpiW (lpString1=".bin", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".bmp") returned 4 [0183.510] lstrcmpiW (lpString1=".bmp", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".bz2") returned 4 [0183.510] lstrcmpiW (lpString1=".bz2", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".c") returned 2 [0183.510] lstrcmpiW (lpString1=".c", lpString2="ki") returned -1 [0183.510] lstrlenW (lpString=".cdr") returned 4 [0183.510] lstrcmpiW (lpString1=".cdr", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".cer") returned 4 [0183.510] lstrcmpiW (lpString1=".cer", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".cf") returned 3 [0183.510] lstrcmpiW (lpString1=".cf", lpString2="iki") returned -1 [0183.510] lstrlenW (lpString=".cfc") returned 4 [0183.510] lstrcmpiW (lpString1=".cfc", lpString2="wiki") returned -1 [0183.510] lstrlenW (lpString=".cfm") returned 4 [0183.511] lstrcmpiW (lpString1=".cfm", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".cfml") returned 5 [0183.511] lstrcmpiW (lpString1=".cfml", lpString2=".wiki") returned -1 [0183.511] lstrlenW (lpString=".cfu") returned 4 [0183.511] lstrcmpiW (lpString1=".cfu", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".chm") returned 4 [0183.511] lstrcmpiW (lpString1=".chm", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".cin") returned 4 [0183.511] lstrcmpiW (lpString1=".cin", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".class") returned 6 [0183.511] lstrcmpiW (lpString1=".class", lpString2="].wiki") returned -1 [0183.511] lstrlenW (lpString=".clx") returned 4 [0183.511] lstrcmpiW (lpString1=".clx", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".config") returned 7 [0183.511] lstrcmpiW (lpString1=".config", lpString2=" ].wiki") returned 1 [0183.511] lstrlenW (lpString=".cpp") returned 4 [0183.511] lstrcmpiW (lpString1=".cpp", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".cr2") returned 4 [0183.511] lstrcmpiW (lpString1=".cr2", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".crt") returned 4 [0183.511] lstrcmpiW (lpString1=".crt", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".crw") returned 4 [0183.511] lstrcmpiW (lpString1=".crw", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".cs") returned 3 [0183.511] lstrcmpiW (lpString1=".cs", lpString2="iki") returned -1 [0183.511] lstrlenW (lpString=".css") returned 4 [0183.511] lstrcmpiW (lpString1=".css", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".csv") returned 4 [0183.511] lstrcmpiW (lpString1=".csv", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".cub") returned 4 [0183.511] lstrcmpiW (lpString1=".cub", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".dae") returned 4 [0183.511] lstrcmpiW (lpString1=".dae", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".dat") returned 4 [0183.511] lstrcmpiW (lpString1=".dat", lpString2="wiki") returned -1 [0183.511] lstrlenW (lpString=".db") returned 3 [0183.512] lstrcmpiW (lpString1=".db", lpString2="iki") returned -1 [0183.512] lstrlenW (lpString=".dbf") returned 4 [0183.512] lstrcmpiW (lpString1=".dbf", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".dbx") returned 4 [0183.512] lstrcmpiW (lpString1=".dbx", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".dc3") returned 4 [0183.512] lstrcmpiW (lpString1=".dc3", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".dcm") returned 4 [0183.512] lstrcmpiW (lpString1=".dcm", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".dcr") returned 4 [0183.512] lstrcmpiW (lpString1=".dcr", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".der") returned 4 [0183.512] lstrcmpiW (lpString1=".der", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".dib") returned 4 [0183.512] lstrcmpiW (lpString1=".dib", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".dic") returned 4 [0183.512] lstrcmpiW (lpString1=".dic", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".dif") returned 4 [0183.512] lstrcmpiW (lpString1=".dif", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".divx") returned 5 [0183.512] lstrcmpiW (lpString1=".divx", lpString2=".wiki") returned -1 [0183.512] lstrlenW (lpString=".djvu") returned 5 [0183.512] lstrcmpiW (lpString1=".djvu", lpString2=".wiki") returned -1 [0183.512] lstrlenW (lpString=".dng") returned 4 [0183.512] lstrcmpiW (lpString1=".dng", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".doc") returned 4 [0183.512] lstrcmpiW (lpString1=".doc", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".docm") returned 5 [0183.512] lstrcmpiW (lpString1=".docm", lpString2=".wiki") returned -1 [0183.512] lstrlenW (lpString=".docx") returned 5 [0183.512] lstrcmpiW (lpString1=".docx", lpString2=".wiki") returned -1 [0183.512] lstrlenW (lpString=".dot") returned 4 [0183.512] lstrcmpiW (lpString1=".dot", lpString2="wiki") returned -1 [0183.512] lstrlenW (lpString=".dotm") returned 5 [0183.512] lstrcmpiW (lpString1=".dotm", lpString2=".wiki") returned -1 [0183.513] lstrlenW (lpString=".dotx") returned 5 [0183.513] lstrcmpiW (lpString1=".dotx", lpString2=".wiki") returned -1 [0183.513] lstrlenW (lpString=".dpx") returned 4 [0183.513] lstrcmpiW (lpString1=".dpx", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".dqy") returned 4 [0183.513] lstrcmpiW (lpString1=".dqy", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".dsn") returned 4 [0183.513] lstrcmpiW (lpString1=".dsn", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".dt") returned 3 [0183.513] lstrcmpiW (lpString1=".dt", lpString2="iki") returned -1 [0183.513] lstrlenW (lpString=".dtd") returned 4 [0183.513] lstrcmpiW (lpString1=".dtd", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".dwg") returned 4 [0183.513] lstrcmpiW (lpString1=".dwg", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".dwt") returned 4 [0183.513] lstrcmpiW (lpString1=".dwt", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".dx") returned 3 [0183.513] lstrcmpiW (lpString1=".dx", lpString2="iki") returned -1 [0183.513] lstrlenW (lpString=".dxf") returned 4 [0183.513] lstrcmpiW (lpString1=".dxf", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".edml") returned 5 [0183.513] lstrcmpiW (lpString1=".edml", lpString2=".wiki") returned -1 [0183.513] lstrlenW (lpString=".efd") returned 4 [0183.513] lstrcmpiW (lpString1=".efd", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".elf") returned 4 [0183.513] lstrcmpiW (lpString1=".elf", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".emf") returned 4 [0183.513] lstrcmpiW (lpString1=".emf", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".emz") returned 4 [0183.513] lstrcmpiW (lpString1=".emz", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".epf") returned 4 [0183.513] lstrcmpiW (lpString1=".epf", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".eps") returned 4 [0183.513] lstrcmpiW (lpString1=".eps", lpString2="wiki") returned -1 [0183.513] lstrlenW (lpString=".epsf") returned 5 [0183.513] lstrcmpiW (lpString1=".epsf", lpString2=".wiki") returned -1 [0183.514] lstrlenW (lpString=".epsp") returned 5 [0183.514] lstrcmpiW (lpString1=".epsp", lpString2=".wiki") returned -1 [0183.514] lstrlenW (lpString=".erf") returned 4 [0183.514] lstrcmpiW (lpString1=".erf", lpString2="wiki") returned -1 [0183.514] lstrlenW (lpString=".exr") returned 4 [0183.514] lstrcmpiW (lpString1=".exr", lpString2="wiki") returned -1 [0183.514] lstrlenW (lpString=".f4v") returned 4 [0183.514] lstrcmpiW (lpString1=".f4v", lpString2="wiki") returned -1 [0183.514] lstrlenW (lpString=".fido") returned 5 [0183.514] lstrcmpiW (lpString1=".fido", lpString2=".wiki") returned -1 [0183.514] lstrlenW (lpString=".flm") returned 4 [0183.514] lstrcmpiW (lpString1=".flm", lpString2="wiki") returned -1 [0183.514] lstrlenW (lpString=".flv") returned 4 [0183.514] lstrcmpiW (lpString1=".flv", lpString2="wiki") returned -1 [0183.514] lstrlenW (lpString=".frm") returned 4 [0183.514] lstrcmpiW (lpString1=".frm", lpString2="wiki") returned -1 [0185.361] lstrcmpiW (lpString1=".1cd", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".3ds", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".3fr", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".3g2", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".3gp", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".7z", lpString2="iki") returned -1 [0185.362] lstrcmpiW (lpString1=".accda", lpString2="].wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".accdb", lpString2="].wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".accdc", lpString2="].wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".accde", lpString2="].wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".accdt", lpString2="].wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".accdw", lpString2="].wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".adb", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".adp", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".ai", lpString2="iki") returned -1 [0185.362] lstrcmpiW (lpString1=".ai3", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".ai4", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".ai5", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".ai6", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".ai7", lpString2="wiki") returned -1 [0185.362] lstrcmpiW (lpString1=".ai8", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".anim", lpString2=".wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".arw", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".as", lpString2="iki") returned -1 [0185.363] lstrcmpiW (lpString1=".asa", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".asc", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".ascx", lpString2=".wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".asm", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".asmx", lpString2=".wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".asp", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".aspx", lpString2=".wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".asr", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".asx", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".avi", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".avs", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".backup", lpString2=" ].wiki") returned 1 [0185.363] lstrcmpiW (lpString1=".bak", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".bay", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".bd", lpString2="iki") returned -1 [0185.363] lstrcmpiW (lpString1=".bin", lpString2="wiki") returned -1 [0185.363] lstrcmpiW (lpString1=".bmp", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".bz2", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".c", lpString2="ki") returned -1 [0185.364] lstrcmpiW (lpString1=".cdr", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".cer", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".cf", lpString2="iki") returned -1 [0185.364] lstrcmpiW (lpString1=".cfc", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".cfm", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".cfml", lpString2=".wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".cfu", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".chm", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".cin", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".class", lpString2="].wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".clx", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".config", lpString2=" ].wiki") returned 1 [0185.364] lstrcmpiW (lpString1=".cpp", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".cr2", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".crt", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".crw", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".cs", lpString2="iki") returned -1 [0185.364] lstrcmpiW (lpString1=".css", lpString2="wiki") returned -1 [0185.364] lstrcmpiW (lpString1=".csv", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".cub", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dae", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dat", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".db", lpString2="iki") returned -1 [0185.365] lstrcmpiW (lpString1=".dbf", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dbx", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dc3", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dcm", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dcr", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".der", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dib", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dic", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dif", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".divx", lpString2=".wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".djvu", lpString2=".wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dng", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".doc", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".docm", lpString2=".wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".docx", lpString2=".wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dot", lpString2="wiki") returned -1 [0185.365] lstrcmpiW (lpString1=".dotm", lpString2=".wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".dotx", lpString2=".wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".dpx", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".dqy", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".dsn", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".dt", lpString2="iki") returned -1 [0185.366] lstrcmpiW (lpString1=".dtd", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".dwg", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".dwt", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".dx", lpString2="iki") returned -1 [0185.366] lstrcmpiW (lpString1=".dxf", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".edml", lpString2=".wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".efd", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".elf", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".emf", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".emz", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".epf", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".eps", lpString2="wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".epsf", lpString2=".wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".epsp", lpString2=".wiki") returned -1 [0185.366] lstrcmpiW (lpString1=".erf", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".exr", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".f4v", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".fido", lpString2=".wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".flm", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".flv", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".frm", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".fxg", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".geo", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".gif", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".grs", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".gz", lpString2="iki") returned -1 [0185.367] lstrcmpiW (lpString1=".h", lpString2="ki") returned -1 [0185.367] lstrcmpiW (lpString1=".hdr", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".hpp", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".hta", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".htc", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".htm", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".html", lpString2=".wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".icb", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".ics", lpString2="wiki") returned -1 [0185.367] lstrcmpiW (lpString1=".iff", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".inc", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".indd", lpString2=".wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".ini", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".iqy", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".j2c", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".j2k", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".java", lpString2=".wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".jp2", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".jpc", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".jpe", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".jpeg", lpString2=".wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".jpf", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".jpg", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".jpx", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".js", lpString2="iki") returned -1 [0185.368] lstrcmpiW (lpString1=".jsf", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".json", lpString2=".wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".jsp", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".kdc", lpString2="wiki") returned -1 [0185.368] lstrcmpiW (lpString1=".kmz", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".kwm", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".lasso", lpString2="].wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".lbi", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".lgf", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".lgp", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".log", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".m1v", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".m4a", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".m4v", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".max", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".md", lpString2="iki") returned -1 [0185.369] lstrcmpiW (lpString1=".mda", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".mdb", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".mde", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".mdf", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".mdw", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".mef", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".mft", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".mfw", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".mht", lpString2="wiki") returned -1 [0185.369] lstrcmpiW (lpString1=".mhtml", lpString2="].wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mka", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mkidx", lpString2="].wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mkv", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mos", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mov", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mp3", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mp4", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mpeg", lpString2=".wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mpg", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mpv", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mrw", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".msg", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".mxl", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".myd", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".myi", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".nef", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".nrw", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".obj", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".odb", lpString2="wiki") returned -1 [0185.370] lstrcmpiW (lpString1=".odc", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".odm", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".odp", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".ods", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".oft", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".one", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".onepkg", lpString2=" ].wiki") returned 1 [0185.371] lstrcmpiW (lpString1=".onetoc2", lpString2="m ].wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".opt", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".oqy", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".orf", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".p12", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".p7b", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".p7c", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".pam", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".pbm", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".pct", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".pcx", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".pdd", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".pdf", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".pdp", lpString2="wiki") returned -1 [0185.371] lstrcmpiW (lpString1=".pef", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".pem", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".pff", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".pfm", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".pfx", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".pgm", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".php", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".php3", lpString2=".wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".php4", lpString2=".wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".php5", lpString2=".wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".phtml", lpString2="].wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".pict", lpString2=".wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".pl", lpString2="iki") returned -1 [0185.372] lstrcmpiW (lpString1=".pls", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".pm", lpString2="iki") returned -1 [0185.372] lstrcmpiW (lpString1=".png", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".pnm", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".pot", lpString2="wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".potm", lpString2=".wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".potx", lpString2=".wiki") returned -1 [0185.372] lstrcmpiW (lpString1=".ppa", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".ppam", lpString2=".wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".ppm", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".pps", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".ppsm", lpString2=".wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".ppt", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".pptm", lpString2=".wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".pptx", lpString2=".wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".prn", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".ps", lpString2="iki") returned -1 [0185.373] lstrcmpiW (lpString1=".psb", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".psd", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".pst", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".ptx", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".pub", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".pwm", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".pxr", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".py", lpString2="iki") returned -1 [0185.373] lstrcmpiW (lpString1=".qt", lpString2="iki") returned -1 [0185.373] lstrcmpiW (lpString1=".r3d", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".raf", lpString2="wiki") returned -1 [0185.373] lstrcmpiW (lpString1=".rar", lpString2="wiki") returned -1 [0185.374] lstrcmpiW (lpString1=".raw", lpString2="wiki") returned -1 [0185.374] lstrcmpiW (lpString1=".rdf", lpString2="wiki") returned -1 [0185.374] FindNextFileW (in: hFindFile=0x38d3a80, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0b0f50, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xaa0b0f50, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xaa0b0f50, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x266c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00525_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="BL0052~2.WIK")) returned 1 [0185.374] FindNextFileW (in: hFindFile=0x38d3a80, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0d70b0, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xaa0d70b0, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xaa0d70b0, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x6c9c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00526_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="BL0052~3.WIK")) returned 1 [0185.374] FindNextFileW (in: hFindFile=0x38d3a80, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0d70b0, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xaa0d70b0, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xaa0d70b0, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x2ddc, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00648_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="BL0064~1.WIK")) returned 1 [0185.374] FindNextFileW (in: hFindFile=0x38d3a80, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0fd210, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xaa0fd210, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xaa0fd210, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x122c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00921_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="BL0092~1.WIK")) returned 1 [0185.374] FindNextFileW (in: hFindFile=0x38d3a80, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa0fd210, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xaa0fd210, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xaa123370, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x196c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00923_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="BL0092~2.WIK")) returned 1 [0185.374] FindNextFileW (in: hFindFile=0x38d3a80, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa123370, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xaa123370, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xaa123370, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x4d0c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00932_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="BL0093~1.WIK")) returned 1 [0185.375] FindNextFileW (in: hFindFile=0x38d3a80, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa123370, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xaa123370, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xaa1494d0, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0xfac, dwReserved0=0x0, dwReserved1=0x0, cFileName="BL00985_.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="BL0098~1.WIK")) returned 1 [0185.375] FindNextFileW (in: hFindFile=0x38d3a80, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1494d0, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xaa1494d0, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xaa1494d0, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0xe04, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOAT.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="BOATWM~1.WIK")) returned 1 [0185.375] FindNextFileW (in: hFindFile=0x38d3a80, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xaa1494d0, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xaa1494d0, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xaa16f630, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x723c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BOATINST.WMF.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="BOATIN~1.WIK")) returned 1 [0185.375] FindNextFileW (in: hFindFile=0x38d3a80, lpFindFileData=0x327f310 | out: lpFindFileData=0x327f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x77641800, ftCreationTime.dwHighDateTime=0x1bd4b2a, ftLastAccessTime.dwLowDateTime=0x51aadd90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x77641800, ftLastWriteTime.dwHighDateTime=0x1bd4b2a, nFileSizeHigh=0x0, nFileSizeLow=0x532, dwReserved0=0x0, dwReserved1=0x0, cFileName="BS00076_.WMF", cAlternateFileName="")) returned 1 Thread: id = 73 os_tid = 0x350 [0183.691] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x3906410 [0183.692] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x3916418 [0183.692] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e36a0 [0183.692] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6) returned 0x3221e8 [0183.692] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e36b8 [0183.692] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x3ee0020 [0183.692] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e36d0 [0183.692] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2e36d0, Size=0x20) returned 0x3655c8 [0183.693] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e36d0 [0183.693] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2e36d0, Size=0x20) returned 0x365690 [0183.693] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.693] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.693] Wow64DisableWow64FsRedirection (in: OldValue=0x33bff58 | out: OldValue=0x33bff58*=0x0) returned 1 [0183.693] lstrlenW (lpString="kernel32.dll") returned 12 [0183.693] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x3655c8 | out: hHeap=0x270000) returned 1 [0183.693] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.693] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x365690 | out: hHeap=0x270000) returned 1 [0183.693] Sleep (dwMilliseconds=0x64) [0183.978] lstrlenW (lpString="BCD") returned 3 [0183.978] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.978] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.978] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.978] lstrlenW (lpString=".doc") returned 4 [0183.978] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0183.978] lstrlenW (lpString=".docx") returned 5 [0183.978] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0183.978] lstrlenW (lpString=".pdf") returned 4 [0183.978] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0183.978] lstrlenW (lpString=".xls") returned 4 [0183.978] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0183.978] lstrlenW (lpString=".xlsx") returned 5 [0183.978] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0183.978] lstrlenW (lpString=".ppt") returned 4 [0183.978] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0183.978] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.978] lstrlenW (lpString=".zip") returned 4 [0183.978] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0183.978] lstrlenW (lpString=".rar") returned 4 [0183.978] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0183.978] lstrlenW (lpString=".bz2") returned 4 [0183.978] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0183.978] lstrlenW (lpString=".7z") returned 3 [0183.978] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0183.979] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.979] lstrlenW (lpString=".dbf") returned 4 [0183.979] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0183.979] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.979] lstrlenW (lpString=".1cd") returned 4 [0183.979] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0183.979] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.979] lstrlenW (lpString=".jpg") returned 4 [0183.979] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0183.979] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.979] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.979] lstrlenW (lpString=".doc") returned 4 [0183.979] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0183.979] lstrlenW (lpString=".docx") returned 5 [0183.979] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0183.979] lstrlenW (lpString=".pdf") returned 4 [0183.979] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0183.979] lstrlenW (lpString=".xls") returned 4 [0183.979] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0183.979] lstrlenW (lpString=".xlsx") returned 5 [0183.979] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0183.979] lstrlenW (lpString=".ppt") returned 4 [0183.979] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0183.979] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.979] lstrlenW (lpString=".zip") returned 4 [0183.979] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0183.979] lstrlenW (lpString=".rar") returned 4 [0183.979] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0183.979] lstrlenW (lpString=".bz2") returned 4 [0183.979] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0183.979] lstrlenW (lpString=".7z") returned 3 [0183.979] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0183.979] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.980] lstrlenW (lpString=".dbf") returned 4 [0183.980] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0183.980] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.980] lstrlenW (lpString=".1cd") returned 4 [0183.980] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0183.980] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0183.980] lstrlenW (lpString=".jpg") returned 4 [0183.980] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0183.980] lstrcmpiW (lpString1=".LOG1", lpString2=".wiki") returned -1 [0183.980] lstrlenW (lpString="BCD.LOG1") returned 8 [0183.980] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0183.980] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0183.980] CloseHandle (hObject=0x248) returned 1 [0183.980] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.980] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.981] lstrlenW (lpString=".doc") returned 4 [0183.981] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0183.981] lstrlenW (lpString=".docx") returned 5 [0183.981] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0183.981] lstrlenW (lpString=".pdf") returned 4 [0183.981] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0183.981] lstrlenW (lpString=".xls") returned 4 [0183.981] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0183.981] lstrlenW (lpString=".xlsx") returned 5 [0183.981] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0183.981] lstrlenW (lpString=".ppt") returned 4 [0183.981] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0183.981] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.981] lstrlenW (lpString=".zip") returned 4 [0183.981] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0183.981] lstrlenW (lpString=".rar") returned 4 [0183.981] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0183.981] lstrlenW (lpString=".bz2") returned 4 [0183.981] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0183.981] lstrlenW (lpString=".7z") returned 3 [0183.981] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0183.981] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.981] lstrlenW (lpString=".dbf") returned 4 [0183.981] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0183.981] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.981] lstrlenW (lpString=".1cd") returned 4 [0183.981] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0183.981] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.981] lstrlenW (lpString=".jpg") returned 4 [0183.981] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0183.981] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.981] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.981] lstrlenW (lpString=".doc") returned 4 [0183.982] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0183.982] lstrlenW (lpString=".docx") returned 5 [0183.982] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0183.982] lstrlenW (lpString=".pdf") returned 4 [0183.982] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0183.982] lstrlenW (lpString=".xls") returned 4 [0183.982] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0183.982] lstrlenW (lpString=".xlsx") returned 5 [0183.982] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0183.982] lstrlenW (lpString=".ppt") returned 4 [0183.982] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0183.982] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.982] lstrlenW (lpString=".zip") returned 4 [0183.982] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0183.982] lstrlenW (lpString=".rar") returned 4 [0183.982] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0183.982] lstrlenW (lpString=".bz2") returned 4 [0183.982] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0183.982] lstrlenW (lpString=".7z") returned 3 [0183.982] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0183.982] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.982] lstrlenW (lpString=".dbf") returned 4 [0183.982] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0183.982] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.982] lstrlenW (lpString=".1cd") returned 4 [0183.982] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0183.982] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0183.982] lstrlenW (lpString=".jpg") returned 4 [0183.982] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0183.983] lstrcmpiW (lpString1=".LOG2", lpString2=".wiki") returned -1 [0183.983] lstrlenW (lpString="BCD.LOG2") returned 8 [0183.983] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0183.983] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0183.983] CloseHandle (hObject=0x248) returned 1 [0183.983] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.983] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.983] lstrlenW (lpString=".doc") returned 4 [0183.983] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0183.983] lstrlenW (lpString=".docx") returned 5 [0183.983] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0183.983] lstrlenW (lpString=".pdf") returned 4 [0183.983] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0183.983] lstrlenW (lpString=".xls") returned 4 [0183.983] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0183.983] lstrlenW (lpString=".xlsx") returned 5 [0183.983] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0183.983] lstrlenW (lpString=".ppt") returned 4 [0183.983] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0183.983] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.983] lstrlenW (lpString=".zip") returned 4 [0183.983] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0183.983] lstrlenW (lpString=".rar") returned 4 [0183.984] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString=".bz2") returned 4 [0183.984] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString=".7z") returned 3 [0183.984] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0183.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.984] lstrlenW (lpString=".dbf") returned 4 [0183.984] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.984] lstrlenW (lpString=".1cd") returned 4 [0183.984] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.984] lstrlenW (lpString=".jpg") returned 4 [0183.984] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.984] lstrlenW (lpString=".doc") returned 4 [0183.984] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString=".docx") returned 5 [0183.984] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0183.984] lstrlenW (lpString=".pdf") returned 4 [0183.984] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString=".xls") returned 4 [0183.984] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString=".xlsx") returned 5 [0183.984] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0183.984] lstrlenW (lpString=".ppt") returned 4 [0183.984] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.984] lstrlenW (lpString=".zip") returned 4 [0183.984] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString=".rar") returned 4 [0183.984] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0183.984] lstrlenW (lpString=".bz2") returned 4 [0183.985] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0183.985] lstrlenW (lpString=".7z") returned 3 [0183.985] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0183.985] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.985] lstrlenW (lpString=".dbf") returned 4 [0183.985] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0183.985] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.985] lstrlenW (lpString=".1cd") returned 4 [0183.985] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0183.985] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0183.985] lstrlenW (lpString=".jpg") returned 4 [0183.985] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0183.985] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0183.985] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0183.985] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0183.985] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=89168) returned 1 [0183.985] CloseHandle (hObject=0x248) returned 1 [0183.985] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0183.986] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.986] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.986] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.986] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.986] lstrlenW (lpString=".doc") returned 4 [0183.986] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0183.986] lstrlenW (lpString=".docx") returned 5 [0183.986] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0183.986] lstrlenW (lpString=".pdf") returned 4 [0183.986] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0183.986] lstrlenW (lpString=".xls") returned 4 [0183.986] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0183.986] lstrlenW (lpString=".xlsx") returned 5 [0183.986] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0183.986] lstrlenW (lpString=".ppt") returned 4 [0183.986] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0183.986] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.986] lstrlenW (lpString=".zip") returned 4 [0183.986] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0183.986] lstrlenW (lpString=".rar") returned 4 [0183.986] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0183.986] lstrlenW (lpString=".bz2") returned 4 [0183.986] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0183.986] lstrlenW (lpString=".7z") returned 3 [0183.986] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0183.986] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.986] lstrlenW (lpString=".dbf") returned 4 [0183.986] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0183.986] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.986] lstrlenW (lpString=".1cd") returned 4 [0183.986] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0183.987] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.987] lstrlenW (lpString=".jpg") returned 4 [0183.987] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0183.987] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.987] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.987] lstrlenW (lpString=".doc") returned 4 [0183.987] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0183.987] lstrlenW (lpString=".docx") returned 5 [0183.987] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0183.987] lstrlenW (lpString=".pdf") returned 4 [0183.987] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0183.987] lstrlenW (lpString=".xls") returned 4 [0183.987] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0183.987] lstrlenW (lpString=".xlsx") returned 5 [0183.987] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0183.987] lstrlenW (lpString=".ppt") returned 4 [0183.987] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0183.987] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.987] lstrlenW (lpString=".zip") returned 4 [0183.987] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0183.987] lstrlenW (lpString=".rar") returned 4 [0183.987] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0183.987] lstrlenW (lpString=".bz2") returned 4 [0183.987] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0183.987] lstrlenW (lpString=".7z") returned 3 [0183.987] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0183.987] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.987] lstrlenW (lpString=".dbf") returned 4 [0183.987] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0183.987] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.987] lstrlenW (lpString=".1cd") returned 4 [0183.987] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0183.988] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0183.988] lstrlenW (lpString=".jpg") returned 4 [0183.988] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0183.988] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0183.988] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0183.988] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0183.988] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=87616) returned 1 [0183.988] CloseHandle (hObject=0x248) returned 1 [0183.988] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0183.988] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.988] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.988] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.988] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.988] lstrlenW (lpString=".doc") returned 4 [0183.988] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0183.988] lstrlenW (lpString=".docx") returned 5 [0183.989] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0183.989] lstrlenW (lpString=".pdf") returned 4 [0183.989] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0183.989] lstrlenW (lpString=".xls") returned 4 [0183.989] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0183.989] lstrlenW (lpString=".xlsx") returned 5 [0183.989] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0183.989] lstrlenW (lpString=".ppt") returned 4 [0183.989] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0183.989] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.989] lstrlenW (lpString=".zip") returned 4 [0183.989] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0183.989] lstrlenW (lpString=".rar") returned 4 [0183.989] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0183.989] lstrlenW (lpString=".bz2") returned 4 [0183.989] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0183.989] lstrlenW (lpString=".7z") returned 3 [0183.989] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0183.989] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.989] lstrlenW (lpString=".dbf") returned 4 [0183.989] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0183.989] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.989] lstrlenW (lpString=".1cd") returned 4 [0183.989] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0183.989] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.989] lstrlenW (lpString=".jpg") returned 4 [0183.989] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0183.989] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.989] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.989] lstrlenW (lpString=".doc") returned 4 [0183.989] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0183.989] lstrlenW (lpString=".docx") returned 5 [0183.990] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0183.990] lstrlenW (lpString=".pdf") returned 4 [0183.990] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0183.990] lstrlenW (lpString=".xls") returned 4 [0183.990] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0183.990] lstrlenW (lpString=".xlsx") returned 5 [0183.990] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0183.990] lstrlenW (lpString=".ppt") returned 4 [0183.990] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0183.990] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.990] lstrlenW (lpString=".zip") returned 4 [0183.990] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0183.990] lstrlenW (lpString=".rar") returned 4 [0183.990] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0183.990] lstrlenW (lpString=".bz2") returned 4 [0183.990] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0183.990] lstrlenW (lpString=".7z") returned 3 [0183.990] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0183.990] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.990] lstrlenW (lpString=".dbf") returned 4 [0183.990] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0183.990] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.990] lstrlenW (lpString=".1cd") returned 4 [0183.990] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0183.990] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0183.990] lstrlenW (lpString=".jpg") returned 4 [0183.990] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0183.990] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0183.990] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0183.991] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0183.991] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=91712) returned 1 [0183.991] CloseHandle (hObject=0x248) returned 1 [0183.991] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0183.991] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.991] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.991] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.991] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.991] lstrlenW (lpString=".doc") returned 4 [0183.991] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0183.991] lstrlenW (lpString=".docx") returned 5 [0183.991] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0183.991] lstrlenW (lpString=".pdf") returned 4 [0183.991] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0183.991] lstrlenW (lpString=".xls") returned 4 [0183.991] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0183.991] lstrlenW (lpString=".xlsx") returned 5 [0183.991] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0183.991] lstrlenW (lpString=".ppt") returned 4 [0183.991] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0183.991] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.992] lstrlenW (lpString=".zip") returned 4 [0183.992] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0183.992] lstrlenW (lpString=".rar") returned 4 [0183.992] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0183.992] lstrlenW (lpString=".bz2") returned 4 [0183.992] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0183.992] lstrlenW (lpString=".7z") returned 3 [0183.992] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0183.992] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.992] lstrlenW (lpString=".dbf") returned 4 [0183.992] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0183.992] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.992] lstrlenW (lpString=".1cd") returned 4 [0183.992] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0183.992] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.992] lstrlenW (lpString=".jpg") returned 4 [0183.992] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0183.992] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.992] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.992] lstrlenW (lpString=".doc") returned 4 [0183.992] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0183.992] lstrlenW (lpString=".docx") returned 5 [0183.992] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0183.992] lstrlenW (lpString=".pdf") returned 4 [0183.992] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0183.992] lstrlenW (lpString=".xls") returned 4 [0183.992] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0183.992] lstrlenW (lpString=".xlsx") returned 5 [0183.992] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0183.992] lstrlenW (lpString=".ppt") returned 4 [0183.992] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0183.992] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.992] lstrlenW (lpString=".zip") returned 4 [0183.992] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0183.992] lstrlenW (lpString=".rar") returned 4 [0183.993] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0183.993] lstrlenW (lpString=".bz2") returned 4 [0183.993] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0183.993] lstrlenW (lpString=".7z") returned 3 [0183.993] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0183.993] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.993] lstrlenW (lpString=".dbf") returned 4 [0183.993] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0183.993] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.993] lstrlenW (lpString=".1cd") returned 4 [0183.993] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0183.993] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0183.993] lstrlenW (lpString=".jpg") returned 4 [0183.993] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0183.993] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0183.993] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0183.993] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0183.993] GetFileSizeEx (in: hFile=0x248, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=94800) returned 1 [0183.993] CloseHandle (hObject=0x248) returned 1 [0183.993] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0183.994] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0183.994] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0183.994] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0183.994] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0183.994] lstrlenW (lpString=".doc") returned 4 [0183.994] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0183.994] lstrlenW (lpString=".docx") returned 5 [0183.994] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0183.994] lstrlenW (lpString=".pdf") returned 4 [0183.994] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0183.994] lstrlenW (lpString=".xls") returned 4 [0183.994] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0183.994] lstrlenW (lpString=".xlsx") returned 5 [0183.994] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0183.994] lstrlenW (lpString=".ppt") returned 4 [0183.994] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0183.994] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0183.994] lstrlenW (lpString=".zip") returned 4 [0183.994] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0183.994] lstrlenW (lpString=".rar") returned 4 [0183.994] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0183.994] lstrlenW (lpString=".bz2") returned 4 [0183.994] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0183.994] lstrlenW (lpString=".7z") returned 3 [0183.994] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0183.996] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.243] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.517] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.117] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.118] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.121] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.136] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.137] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.139] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.145] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.155] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.156] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVE.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\groove.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\grooveex.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.736] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\INFOPATH.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\infopath.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Installed_resources14.xss.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\installed_resources14.xss.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPDESIGN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\ipdesign.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\IPEDITOR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\ipeditor.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.822] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSACCESS.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\msaccess.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1036\\MSGR3FR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1036\\msgr3fr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.168] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\3082\\MSGR3ES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\3082\\msgr3es.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3EN.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3en.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.169] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSGR3ES.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msgr3es.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.172] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7EN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7en.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.173] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7ES.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7es.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.174] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSSP7FR.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\mssp7fr.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7EN.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7en.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.176] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7ES.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7es.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.177] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\MSTH7FR.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\msth7fr.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.191] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BIZFORM.DPV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\bizform.dpv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.192] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\BRCHUR98.POC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\brchur98.poc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.196] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\CALNDR98.POC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\calndr98.poc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\TIMESOLN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\timesoln.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.188] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\ImagingEngine.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows photo viewer\\imagingengine.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.832] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGM.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agm.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AGM.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\agm.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.852] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\authplay.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\authplay.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\authplay.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\authplay.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.881] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ccme_base.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\ccme_base.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\ccme_base.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\ccme_base.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.886] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CoolType.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cooltype.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\CoolType.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cooltype.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.886] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\cryptocme2.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\cryptocme2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.889] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\icudt40_full.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\icudt40_full.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\icudt40_full.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\icudt40_full.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.200] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.dll"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.201] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_child.dll"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\chrome_child.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\chrome_child.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.203] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\d3dcompiler_47.dll" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\d3dcompiler_47.dll"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\d3dcompiler_47.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\d3dcompiler_47.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.205] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrmstp.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrmstp.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\chrmstp.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\chrmstp.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.206] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\setup.exe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\Installer\\setup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\installer\\setup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.206] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\libglesv2.dll" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\libglesv2.dll"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\libglesv2.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\libglesv2.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.351] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.351] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.352] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.354] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.358] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\GROOVEEX.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\grooveex.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0198.363] MoveFileW (lpExistingFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp"), lpNewFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0198.364] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10110_mui.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0198.368] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc6c | out: lpNewFilePointer=0x0) returned 1 [0198.368] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc2c | out: lpNewFilePointer=0x0) returned 1 [0198.369] ReadFile (in: hFile=0x350, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x33bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.403] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x5a1000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc2c | out: lpNewFilePointer=0x0) returned 1 [0198.403] ReadFile (in: hFile=0x350, lpBuffer=0x3f20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f20058*, lpNumberOfBytesRead=0x33bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.408] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0198.408] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x10a3000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc2c | out: lpNewFilePointer=0x0) returned 1 [0198.408] ReadFile (in: hFile=0x350, lpBuffer=0x3f60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f60058*, lpNumberOfBytesRead=0x33bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.426] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0198.426] WriteFile (in: hFile=0x350, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x33bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfcb0*=0xc011a, lpOverlapped=0x0) returned 1 [0198.728] SetEndOfFile (hFile=0x350) returned 1 [0198.728] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40000) returned 0x4130060 [0198.728] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc7c | out: lpNewFilePointer=0x0) returned 1 [0198.728] WriteFile (in: hFile=0x350, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x33bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0198.729] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x5a1000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc7c | out: lpNewFilePointer=0x0) returned 1 [0198.729] WriteFile (in: hFile=0x350, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x33bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0198.730] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x10a3000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc7c | out: lpNewFilePointer=0x0) returned 1 [0198.730] WriteFile (in: hFile=0x350, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33bfc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x33bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0198.732] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x4130060 | out: hHeap=0x270000) returned 1 [0198.732] CloseHandle (hObject=0x350) returned 1 [0198.732] SetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.732] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.732] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.732] lstrlenW (lpString=".doc") returned 4 [0198.733] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0198.733] lstrlenW (lpString=".docx") returned 5 [0198.733] lstrcmpiW (lpString1=".docx", lpString2="I.msp") returned -1 [0198.733] lstrlenW (lpString=".pdf") returned 4 [0198.733] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0198.733] lstrlenW (lpString=".xls") returned 4 [0198.733] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0198.733] lstrlenW (lpString=".xlsx") returned 5 [0198.733] lstrcmpiW (lpString1=".xlsx", lpString2="I.msp") returned -1 [0198.733] lstrlenW (lpString=".ppt") returned 4 [0198.733] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0198.733] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.733] lstrlenW (lpString=".zip") returned 4 [0198.733] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0198.733] lstrlenW (lpString=".rar") returned 4 [0198.733] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0198.733] lstrlenW (lpString=".bz2") returned 4 [0198.733] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0198.733] lstrlenW (lpString=".7z") returned 3 [0198.733] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0198.733] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.733] lstrlenW (lpString=".dbf") returned 4 [0198.733] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0198.733] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.733] lstrlenW (lpString=".1cd") returned 4 [0198.733] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0198.733] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.733] lstrlenW (lpString=".jpg") returned 4 [0198.733] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0198.733] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.733] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.733] lstrlenW (lpString=".doc") returned 4 [0198.733] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0198.733] lstrlenW (lpString=".docx") returned 5 [0198.734] lstrcmpiW (lpString1=".docx", lpString2="I.msp") returned -1 [0198.734] lstrlenW (lpString=".pdf") returned 4 [0198.734] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0198.734] lstrlenW (lpString=".xls") returned 4 [0198.734] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0198.734] lstrlenW (lpString=".xlsx") returned 5 [0198.734] lstrcmpiW (lpString1=".xlsx", lpString2="I.msp") returned -1 [0198.734] lstrlenW (lpString=".ppt") returned 4 [0198.734] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0198.734] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.734] lstrlenW (lpString=".zip") returned 4 [0198.734] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0198.734] lstrlenW (lpString=".rar") returned 4 [0198.734] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0198.734] lstrlenW (lpString=".bz2") returned 4 [0198.734] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0198.734] lstrlenW (lpString=".7z") returned 3 [0198.734] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0198.734] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.734] lstrlenW (lpString=".dbf") returned 4 [0198.734] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0198.734] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.734] lstrlenW (lpString=".1cd") returned 4 [0198.734] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0198.734] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10110_MUI.msp") returned 62 [0198.734] lstrlenW (lpString=".jpg") returned 4 [0198.734] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0198.734] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0198.734] lstrlenW (lpString="OUTLLIBR.REST.trx_dll") returned 21 [0198.734] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.007] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=681312) returned 1 [0199.007] CloseHandle (hObject=0x150) returned 1 [0199.007] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll")) returned 0x2020 [0199.007] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.007] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outllibr.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.007] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.007] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.007] lstrlenW (lpString=".doc") returned 4 [0199.007] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.007] lstrlenW (lpString=".docx") returned 5 [0199.007] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.007] lstrlenW (lpString=".pdf") returned 4 [0199.007] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.007] lstrlenW (lpString=".xls") returned 4 [0199.007] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.007] lstrlenW (lpString=".xlsx") returned 5 [0199.007] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.007] lstrlenW (lpString=".ppt") returned 4 [0199.007] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.007] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.007] lstrlenW (lpString=".zip") returned 4 [0199.008] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.008] lstrlenW (lpString=".rar") returned 4 [0199.008] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.008] lstrlenW (lpString=".bz2") returned 4 [0199.008] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.008] lstrlenW (lpString=".7z") returned 3 [0199.008] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.008] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.008] lstrlenW (lpString=".dbf") returned 4 [0199.008] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.008] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.008] lstrlenW (lpString=".1cd") returned 4 [0199.008] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.008] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.008] lstrlenW (lpString=".jpg") returned 4 [0199.008] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.008] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.008] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.008] lstrlenW (lpString=".doc") returned 4 [0199.008] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.008] lstrlenW (lpString=".docx") returned 5 [0199.008] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.008] lstrlenW (lpString=".pdf") returned 4 [0199.008] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.008] lstrlenW (lpString=".xls") returned 4 [0199.008] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.008] lstrlenW (lpString=".xlsx") returned 5 [0199.008] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.008] lstrlenW (lpString=".ppt") returned 4 [0199.008] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.008] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.008] lstrlenW (lpString=".zip") returned 4 [0199.008] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.009] lstrlenW (lpString=".rar") returned 4 [0199.009] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.009] lstrlenW (lpString=".bz2") returned 4 [0199.009] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.009] lstrlenW (lpString=".7z") returned 3 [0199.009] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.009] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.009] lstrlenW (lpString=".dbf") returned 4 [0199.009] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.009] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.009] lstrlenW (lpString=".1cd") returned 4 [0199.009] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.009] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLLIBR.REST.trx_dll") returned 69 [0199.009] lstrlenW (lpString=".jpg") returned 4 [0199.009] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.009] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0199.009] lstrlenW (lpString="VISINTL.DLL.trx_dll") returned 19 [0199.009] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.009] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=488800) returned 1 [0199.009] CloseHandle (hObject=0x150) returned 1 [0199.010] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll")) returned 0x2020 [0199.010] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.010] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\visintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.010] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.010] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.010] lstrlenW (lpString=".doc") returned 4 [0199.010] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.010] lstrlenW (lpString=".docx") returned 5 [0199.010] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.010] lstrlenW (lpString=".pdf") returned 4 [0199.010] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.010] lstrlenW (lpString=".xls") returned 4 [0199.010] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.010] lstrlenW (lpString=".xlsx") returned 5 [0199.010] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.010] lstrlenW (lpString=".ppt") returned 4 [0199.010] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.010] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.010] lstrlenW (lpString=".zip") returned 4 [0199.010] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.010] lstrlenW (lpString=".rar") returned 4 [0199.010] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.010] lstrlenW (lpString=".bz2") returned 4 [0199.010] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.010] lstrlenW (lpString=".7z") returned 3 [0199.010] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.010] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.010] lstrlenW (lpString=".dbf") returned 4 [0199.011] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.011] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.011] lstrlenW (lpString=".1cd") returned 4 [0199.011] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.011] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.011] lstrlenW (lpString=".jpg") returned 4 [0199.011] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.011] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.011] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.011] lstrlenW (lpString=".doc") returned 4 [0199.011] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.011] lstrlenW (lpString=".docx") returned 5 [0199.011] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.011] lstrlenW (lpString=".pdf") returned 4 [0199.011] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.011] lstrlenW (lpString=".xls") returned 4 [0199.011] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.011] lstrlenW (lpString=".xlsx") returned 5 [0199.011] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.011] lstrlenW (lpString=".ppt") returned 4 [0199.011] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.011] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.011] lstrlenW (lpString=".zip") returned 4 [0199.011] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.011] lstrlenW (lpString=".rar") returned 4 [0199.011] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.011] lstrlenW (lpString=".bz2") returned 4 [0199.011] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.011] lstrlenW (lpString=".7z") returned 3 [0199.011] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.011] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.011] lstrlenW (lpString=".dbf") returned 4 [0199.011] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.012] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.012] lstrlenW (lpString=".1cd") returned 4 [0199.012] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.012] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\VISINTL.DLL.trx_dll") returned 67 [0199.012] lstrlenW (lpString=".jpg") returned 4 [0199.012] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.012] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0199.012] lstrlenW (lpString="WWINTL.DLL.trx_dll") returned 18 [0199.012] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.013] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=154464) returned 1 [0199.013] CloseHandle (hObject=0x150) returned 1 [0199.013] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll")) returned 0x2020 [0199.013] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.013] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.013] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.013] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.013] lstrlenW (lpString=".doc") returned 4 [0199.013] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.013] lstrlenW (lpString=".docx") returned 5 [0199.013] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.013] lstrlenW (lpString=".pdf") returned 4 [0199.013] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.013] lstrlenW (lpString=".xls") returned 4 [0199.013] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.013] lstrlenW (lpString=".xlsx") returned 5 [0199.013] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.013] lstrlenW (lpString=".ppt") returned 4 [0199.013] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.013] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.013] lstrlenW (lpString=".zip") returned 4 [0199.014] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString=".rar") returned 4 [0199.014] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString=".bz2") returned 4 [0199.014] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString=".7z") returned 3 [0199.014] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.014] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.014] lstrlenW (lpString=".dbf") returned 4 [0199.014] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.014] lstrlenW (lpString=".1cd") returned 4 [0199.014] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.014] lstrlenW (lpString=".jpg") returned 4 [0199.014] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.014] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.014] lstrlenW (lpString=".doc") returned 4 [0199.014] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString=".docx") returned 5 [0199.014] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.014] lstrlenW (lpString=".pdf") returned 4 [0199.014] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString=".xls") returned 4 [0199.014] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString=".xlsx") returned 5 [0199.014] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.014] lstrlenW (lpString=".ppt") returned 4 [0199.014] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.014] lstrlenW (lpString=".zip") returned 4 [0199.014] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.014] lstrlenW (lpString=".rar") returned 4 [0199.015] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.015] lstrlenW (lpString=".bz2") returned 4 [0199.015] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.015] lstrlenW (lpString=".7z") returned 3 [0199.015] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.015] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.015] lstrlenW (lpString=".dbf") returned 4 [0199.015] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.015] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.015] lstrlenW (lpString=".1cd") returned 4 [0199.015] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.015] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.DLL.trx_dll") returned 66 [0199.015] lstrlenW (lpString=".jpg") returned 4 [0199.015] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.015] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0199.015] lstrlenW (lpString="WWINTL.REST.trx_dll") returned 19 [0199.015] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.015] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1137504) returned 1 [0199.015] CloseHandle (hObject=0x150) returned 1 [0199.015] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll")) returned 0x2020 [0199.016] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.016] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\wwintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.016] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.016] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.016] lstrlenW (lpString=".doc") returned 4 [0199.016] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.016] lstrlenW (lpString=".docx") returned 5 [0199.016] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.016] lstrlenW (lpString=".pdf") returned 4 [0199.016] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.016] lstrlenW (lpString=".xls") returned 4 [0199.016] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.016] lstrlenW (lpString=".xlsx") returned 5 [0199.016] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.016] lstrlenW (lpString=".ppt") returned 4 [0199.016] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.016] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.016] lstrlenW (lpString=".zip") returned 4 [0199.016] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.016] lstrlenW (lpString=".rar") returned 4 [0199.016] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.016] lstrlenW (lpString=".bz2") returned 4 [0199.016] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.016] lstrlenW (lpString=".7z") returned 3 [0199.016] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.016] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.016] lstrlenW (lpString=".dbf") returned 4 [0199.016] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.017] lstrlenW (lpString=".1cd") returned 4 [0199.017] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.017] lstrlenW (lpString=".jpg") returned 4 [0199.017] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.017] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.017] lstrlenW (lpString=".doc") returned 4 [0199.017] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString=".docx") returned 5 [0199.017] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.017] lstrlenW (lpString=".pdf") returned 4 [0199.017] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString=".xls") returned 4 [0199.017] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString=".xlsx") returned 5 [0199.017] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.017] lstrlenW (lpString=".ppt") returned 4 [0199.017] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.017] lstrlenW (lpString=".zip") returned 4 [0199.017] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString=".rar") returned 4 [0199.017] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString=".bz2") returned 4 [0199.017] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString=".7z") returned 3 [0199.017] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.017] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.017] lstrlenW (lpString=".dbf") returned 4 [0199.017] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.017] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.018] lstrlenW (lpString=".1cd") returned 4 [0199.018] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.018] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\WWINTL.REST.trx_dll") returned 67 [0199.018] lstrlenW (lpString=".jpg") returned 4 [0199.018] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.018] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0199.018] lstrlenW (lpString="XLINTL32.DLL.trx_dll") returned 20 [0199.018] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.019] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=152416) returned 1 [0199.019] CloseHandle (hObject=0x150) returned 1 [0199.019] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll")) returned 0x2020 [0199.019] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.019] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.019] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.019] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.019] lstrlenW (lpString=".doc") returned 4 [0199.019] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.019] lstrlenW (lpString=".docx") returned 5 [0199.019] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.019] lstrlenW (lpString=".pdf") returned 4 [0199.019] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.019] lstrlenW (lpString=".xls") returned 4 [0199.019] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.019] lstrlenW (lpString=".xlsx") returned 5 [0199.019] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.019] lstrlenW (lpString=".ppt") returned 4 [0199.019] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.019] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.020] lstrlenW (lpString=".zip") returned 4 [0199.020] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.020] lstrlenW (lpString=".rar") returned 4 [0199.020] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.020] lstrlenW (lpString=".bz2") returned 4 [0199.020] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.020] lstrlenW (lpString=".7z") returned 3 [0199.020] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.020] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.020] lstrlenW (lpString=".dbf") returned 4 [0199.020] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.020] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.020] lstrlenW (lpString=".1cd") returned 4 [0199.020] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.020] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.020] lstrlenW (lpString=".jpg") returned 4 [0199.020] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.020] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.020] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.020] lstrlenW (lpString=".doc") returned 4 [0199.020] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.020] lstrlenW (lpString=".docx") returned 5 [0199.020] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.020] lstrlenW (lpString=".pdf") returned 4 [0199.020] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.020] lstrlenW (lpString=".xls") returned 4 [0199.020] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.020] lstrlenW (lpString=".xlsx") returned 5 [0199.020] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.020] lstrlenW (lpString=".ppt") returned 4 [0199.020] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.020] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.020] lstrlenW (lpString=".zip") returned 4 [0199.021] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.021] lstrlenW (lpString=".rar") returned 4 [0199.021] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.021] lstrlenW (lpString=".bz2") returned 4 [0199.021] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.021] lstrlenW (lpString=".7z") returned 3 [0199.021] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.021] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.021] lstrlenW (lpString=".dbf") returned 4 [0199.021] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.021] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.021] lstrlenW (lpString=".1cd") returned 4 [0199.021] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.021] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.DLL.trx_dll") returned 68 [0199.021] lstrlenW (lpString=".jpg") returned 4 [0199.021] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.021] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0199.021] lstrlenW (lpString="XLINTL32.REST.trx_dll") returned 21 [0199.021] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.022] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1276256) returned 1 [0199.022] CloseHandle (hObject=0x150) returned 1 [0199.022] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll")) returned 0x2020 [0199.022] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.022] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\xlintl32.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.022] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned 69 [0199.022] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned 69 [0199.022] lstrlenW (lpString=".doc") returned 4 [0199.022] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.022] lstrlenW (lpString=".docx") returned 5 [0199.022] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.022] lstrlenW (lpString=".pdf") returned 4 [0199.022] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.022] lstrlenW (lpString=".xls") returned 4 [0199.022] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.022] lstrlenW (lpString=".xlsx") returned 5 [0199.022] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.022] lstrlenW (lpString=".ppt") returned 4 [0199.022] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.022] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned 69 [0199.022] lstrlenW (lpString=".zip") returned 4 [0199.022] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.022] lstrlenW (lpString=".rar") returned 4 [0199.022] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.023] lstrlenW (lpString=".bz2") returned 4 [0199.023] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.023] lstrlenW (lpString=".7z") returned 3 [0199.023] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.023] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\XLINTL32.REST.trx_dll") returned 69 [0199.023] lstrlenW (lpString=".dbf") returned 4 [0199.023] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.029] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\3082\\MSOINTL.REST.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\3082\\msointl.rest.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0199.035] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.035] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.035] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0199.039] GetLastError () returned 0x0 [0199.039] ReadFile (in: hFile=0x150, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x25000, lpOverlapped=0x0) returned 1 [0199.212] WriteFile (in: hFile=0x388, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x25010, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x25010, lpOverlapped=0x0) returned 1 [0199.215] ReadFile (in: hFile=0x150, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.215] WriteFile (in: hFile=0x388, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0199.215] SetEndOfFile (hFile=0x388) returned 1 [0199.215] CloseHandle (hObject=0x388) returned 1 [0199.215] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.215] SetEndOfFile (hFile=0x150) returned 1 [0199.217] CloseHandle (hObject=0x150) returned 1 [0199.217] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.217] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf" (normalized: "c:\\programdata\\microsoft\\rac\\publisheddata\\racwmidatabase.sdf")) returned 1 [0199.218] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.218] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.218] lstrlenW (lpString=".doc") returned 4 [0199.218] lstrcmpiW (lpString1=".doc", lpString2=".sdf") returned -1 [0199.218] lstrlenW (lpString=".docx") returned 5 [0199.218] lstrcmpiW (lpString1=".docx", lpString2="e.sdf") returned -1 [0199.218] lstrlenW (lpString=".pdf") returned 4 [0199.218] lstrcmpiW (lpString1=".pdf", lpString2=".sdf") returned -1 [0199.218] lstrlenW (lpString=".xls") returned 4 [0199.218] lstrcmpiW (lpString1=".xls", lpString2=".sdf") returned 1 [0199.218] lstrlenW (lpString=".xlsx") returned 5 [0199.218] lstrcmpiW (lpString1=".xlsx", lpString2="e.sdf") returned -1 [0199.218] lstrlenW (lpString=".ppt") returned 4 [0199.218] lstrcmpiW (lpString1=".ppt", lpString2=".sdf") returned -1 [0199.218] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.218] lstrlenW (lpString=".zip") returned 4 [0199.218] lstrcmpiW (lpString1=".zip", lpString2=".sdf") returned 1 [0199.218] lstrlenW (lpString=".rar") returned 4 [0199.218] lstrcmpiW (lpString1=".rar", lpString2=".sdf") returned -1 [0199.218] lstrlenW (lpString=".bz2") returned 4 [0199.218] lstrcmpiW (lpString1=".bz2", lpString2=".sdf") returned -1 [0199.218] lstrlenW (lpString=".7z") returned 3 [0199.218] lstrcmpiW (lpString1=".7z", lpString2="sdf") returned -1 [0199.218] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.218] lstrlenW (lpString=".dbf") returned 4 [0199.218] lstrcmpiW (lpString1=".dbf", lpString2=".sdf") returned -1 [0199.219] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.219] lstrlenW (lpString=".1cd") returned 4 [0199.219] lstrcmpiW (lpString1=".1cd", lpString2=".sdf") returned -1 [0199.219] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.219] lstrlenW (lpString=".jpg") returned 4 [0199.219] lstrcmpiW (lpString1=".jpg", lpString2=".sdf") returned -1 [0199.219] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.219] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.219] lstrlenW (lpString=".doc") returned 4 [0199.219] lstrcmpiW (lpString1=".doc", lpString2=".sdf") returned -1 [0199.219] lstrlenW (lpString=".docx") returned 5 [0199.219] lstrcmpiW (lpString1=".docx", lpString2="e.sdf") returned -1 [0199.219] lstrlenW (lpString=".pdf") returned 4 [0199.219] lstrcmpiW (lpString1=".pdf", lpString2=".sdf") returned -1 [0199.219] lstrlenW (lpString=".xls") returned 4 [0199.219] lstrcmpiW (lpString1=".xls", lpString2=".sdf") returned 1 [0199.219] lstrlenW (lpString=".xlsx") returned 5 [0199.219] lstrcmpiW (lpString1=".xlsx", lpString2="e.sdf") returned -1 [0199.219] lstrlenW (lpString=".ppt") returned 4 [0199.219] lstrcmpiW (lpString1=".ppt", lpString2=".sdf") returned -1 [0199.219] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.219] lstrlenW (lpString=".zip") returned 4 [0199.219] lstrcmpiW (lpString1=".zip", lpString2=".sdf") returned 1 [0199.219] lstrlenW (lpString=".rar") returned 4 [0199.219] lstrcmpiW (lpString1=".rar", lpString2=".sdf") returned -1 [0199.219] lstrlenW (lpString=".bz2") returned 4 [0199.219] lstrcmpiW (lpString1=".bz2", lpString2=".sdf") returned -1 [0199.219] lstrlenW (lpString=".7z") returned 3 [0199.219] lstrcmpiW (lpString1=".7z", lpString2="sdf") returned -1 [0199.219] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.219] lstrlenW (lpString=".dbf") returned 4 [0199.219] lstrcmpiW (lpString1=".dbf", lpString2=".sdf") returned -1 [0199.220] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.220] lstrlenW (lpString=".1cd") returned 4 [0199.220] lstrcmpiW (lpString1=".1cd", lpString2=".sdf") returned -1 [0199.220] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\PublishedData\\RacWmiDatabase.sdf") returned 61 [0199.220] lstrlenW (lpString=".jpg") returned 4 [0199.220] lstrcmpiW (lpString1=".jpg", lpString2=".sdf") returned -1 [0199.220] lstrcmpiW (lpString1=".cab", lpString2=".wiki") returned -1 [0199.220] lstrlenW (lpString="cab1.cab") returned 8 [0199.220] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0199.488] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=5881317) returned 1 [0199.488] CloseHandle (hObject=0x378) returned 1 [0199.488] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab")) returned 0x20 [0199.488] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.488] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0199.488] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.488] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.488] lstrlenW (lpString=".doc") returned 4 [0199.488] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0199.488] lstrlenW (lpString=".docx") returned 5 [0199.488] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0199.488] lstrlenW (lpString=".pdf") returned 4 [0199.488] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0199.488] lstrlenW (lpString=".xls") returned 4 [0199.488] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0199.489] lstrlenW (lpString=".xlsx") returned 5 [0199.489] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0199.489] lstrlenW (lpString=".ppt") returned 4 [0199.489] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0199.489] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.489] lstrlenW (lpString=".zip") returned 4 [0199.489] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0199.489] lstrlenW (lpString=".rar") returned 4 [0199.489] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0199.489] lstrlenW (lpString=".bz2") returned 4 [0199.489] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0199.489] lstrlenW (lpString=".7z") returned 3 [0199.489] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0199.489] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.489] lstrlenW (lpString=".dbf") returned 4 [0199.489] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0199.489] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.489] lstrlenW (lpString=".1cd") returned 4 [0199.489] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0199.489] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.489] lstrlenW (lpString=".jpg") returned 4 [0199.489] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0199.489] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.489] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.489] lstrlenW (lpString=".doc") returned 4 [0199.489] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0199.489] lstrlenW (lpString=".docx") returned 5 [0199.490] lstrcmpiW (lpString1=".docx", lpString2="1.cab") returned -1 [0199.490] lstrlenW (lpString=".pdf") returned 4 [0199.490] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0199.490] lstrlenW (lpString=".xls") returned 4 [0199.490] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0199.490] lstrlenW (lpString=".xlsx") returned 5 [0199.490] lstrcmpiW (lpString1=".xlsx", lpString2="1.cab") returned -1 [0199.490] lstrlenW (lpString=".ppt") returned 4 [0199.490] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0199.490] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.490] lstrlenW (lpString=".zip") returned 4 [0199.490] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0199.490] lstrlenW (lpString=".rar") returned 4 [0199.490] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0199.490] lstrlenW (lpString=".bz2") returned 4 [0199.490] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0199.490] lstrlenW (lpString=".7z") returned 3 [0199.490] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0199.490] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.490] lstrlenW (lpString=".dbf") returned 4 [0199.490] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0199.490] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.490] lstrlenW (lpString=".1cd") returned 4 [0199.490] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0199.490] lstrlenW (lpString="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\cab1.cab") returned 123 [0199.490] lstrlenW (lpString=".jpg") returned 4 [0199.490] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0199.491] lstrcmpiW (lpString1=".icc", lpString2=".wiki") returned -1 [0199.499] lstrlenW (lpString="wsRGB.icc") returned 9 [0199.499] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0199.500] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=2676) returned 1 [0199.500] CloseHandle (hObject=0x378) returned 1 [0199.500] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 0x2020 [0199.500] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0199.500] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.500] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.500] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.731] GetLastError () returned 0x0 [0199.731] ReadFile (in: hFile=0x378, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0xa74, lpOverlapped=0x0) returned 1 [0199.732] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xa80, lpOverlapped=0x0) returned 1 [0199.733] ReadFile (in: hFile=0x378, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.733] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe6, lpOverlapped=0x0) returned 1 [0199.733] SetEndOfFile (hFile=0x15c) returned 1 [0199.733] CloseHandle (hObject=0x15c) returned 1 [0199.733] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.733] SetEndOfFile (hFile=0x378) returned 1 [0199.734] CloseHandle (hObject=0x378) returned 1 [0199.734] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.734] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wsrgb.icc")) returned 1 [0199.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.735] lstrlenW (lpString=".doc") returned 4 [0199.735] lstrcmpiW (lpString1=".doc", lpString2=".icc") returned -1 [0199.735] lstrlenW (lpString=".docx") returned 5 [0199.735] lstrcmpiW (lpString1=".docx", lpString2="B.icc") returned -1 [0199.735] lstrlenW (lpString=".pdf") returned 4 [0199.735] lstrcmpiW (lpString1=".pdf", lpString2=".icc") returned 1 [0199.735] lstrlenW (lpString=".xls") returned 4 [0199.735] lstrcmpiW (lpString1=".xls", lpString2=".icc") returned 1 [0199.735] lstrlenW (lpString=".xlsx") returned 5 [0199.735] lstrcmpiW (lpString1=".xlsx", lpString2="B.icc") returned -1 [0199.735] lstrlenW (lpString=".ppt") returned 4 [0199.735] lstrcmpiW (lpString1=".ppt", lpString2=".icc") returned 1 [0199.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.735] lstrlenW (lpString=".zip") returned 4 [0199.735] lstrcmpiW (lpString1=".zip", lpString2=".icc") returned 1 [0199.735] lstrlenW (lpString=".rar") returned 4 [0199.735] lstrcmpiW (lpString1=".rar", lpString2=".icc") returned 1 [0199.735] lstrlenW (lpString=".bz2") returned 4 [0199.735] lstrcmpiW (lpString1=".bz2", lpString2=".icc") returned -1 [0199.735] lstrlenW (lpString=".7z") returned 3 [0199.735] lstrcmpiW (lpString1=".7z", lpString2="icc") returned -1 [0199.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.735] lstrlenW (lpString=".dbf") returned 4 [0199.735] lstrcmpiW (lpString1=".dbf", lpString2=".icc") returned -1 [0199.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.735] lstrlenW (lpString=".1cd") returned 4 [0199.735] lstrcmpiW (lpString1=".1cd", lpString2=".icc") returned -1 [0199.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.735] lstrlenW (lpString=".jpg") returned 4 [0199.736] lstrcmpiW (lpString1=".jpg", lpString2=".icc") returned 1 [0199.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.736] lstrlenW (lpString=".doc") returned 4 [0199.736] lstrcmpiW (lpString1=".doc", lpString2=".icc") returned -1 [0199.736] lstrlenW (lpString=".docx") returned 5 [0199.736] lstrcmpiW (lpString1=".docx", lpString2="B.icc") returned -1 [0199.736] lstrlenW (lpString=".pdf") returned 4 [0199.736] lstrcmpiW (lpString1=".pdf", lpString2=".icc") returned 1 [0199.736] lstrlenW (lpString=".xls") returned 4 [0199.736] lstrcmpiW (lpString1=".xls", lpString2=".icc") returned 1 [0199.736] lstrlenW (lpString=".xlsx") returned 5 [0199.736] lstrcmpiW (lpString1=".xlsx", lpString2="B.icc") returned -1 [0199.736] lstrlenW (lpString=".ppt") returned 4 [0199.736] lstrcmpiW (lpString1=".ppt", lpString2=".icc") returned 1 [0199.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.736] lstrlenW (lpString=".zip") returned 4 [0199.736] lstrcmpiW (lpString1=".zip", lpString2=".icc") returned 1 [0199.736] lstrlenW (lpString=".rar") returned 4 [0199.736] lstrcmpiW (lpString1=".rar", lpString2=".icc") returned 1 [0199.736] lstrlenW (lpString=".bz2") returned 4 [0199.736] lstrcmpiW (lpString1=".bz2", lpString2=".icc") returned -1 [0199.736] lstrlenW (lpString=".7z") returned 3 [0199.736] lstrcmpiW (lpString1=".7z", lpString2="icc") returned -1 [0199.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.736] lstrlenW (lpString=".dbf") returned 4 [0199.736] lstrcmpiW (lpString1=".dbf", lpString2=".icc") returned -1 [0199.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.736] lstrlenW (lpString=".1cd") returned 4 [0199.736] lstrcmpiW (lpString1=".1cd", lpString2=".icc") returned -1 [0199.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wsRGB.icc") returned 74 [0199.736] lstrlenW (lpString=".jpg") returned 4 [0199.736] lstrcmpiW (lpString1=".jpg", lpString2=".icc") returned 1 [0199.737] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0199.737] lstrlenW (lpString="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 68 [0199.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0199.794] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=11824) returned 1 [0199.794] CloseHandle (hObject=0x370) returned 1 [0199.794] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest")) returned 0x2020 [0199.794] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0199.794] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.795] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.795] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.795] GetLastError () returned 0x0 [0199.795] ReadFile (in: hFile=0x370, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x2e30, lpOverlapped=0x0) returned 1 [0199.797] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x2e40, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x2e40, lpOverlapped=0x0) returned 1 [0199.798] ReadFile (in: hFile=0x370, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.798] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x15c, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x15c, lpOverlapped=0x0) returned 1 [0199.798] SetEndOfFile (hFile=0x2d4) returned 1 [0199.798] CloseHandle (hObject=0x2d4) returned 1 [0199.798] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.798] SetEndOfFile (hFile=0x370) returned 1 [0199.799] CloseHandle (hObject=0x370) returned 1 [0199.799] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.799] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest")) returned 1 [0199.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.799] lstrlenW (lpString=".doc") returned 4 [0199.799] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0199.799] lstrlenW (lpString=".docx") returned 5 [0199.800] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0199.800] lstrlenW (lpString=".pdf") returned 4 [0199.800] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0199.800] lstrlenW (lpString=".xls") returned 4 [0199.800] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0199.800] lstrlenW (lpString=".xlsx") returned 5 [0199.800] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0199.800] lstrlenW (lpString=".ppt") returned 4 [0199.800] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0199.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.800] lstrlenW (lpString=".zip") returned 4 [0199.800] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0199.800] lstrlenW (lpString=".rar") returned 4 [0199.800] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0199.800] lstrlenW (lpString=".bz2") returned 4 [0199.800] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0199.800] lstrlenW (lpString=".7z") returned 3 [0199.800] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0199.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.800] lstrlenW (lpString=".dbf") returned 4 [0199.800] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0199.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.800] lstrlenW (lpString=".1cd") returned 4 [0199.800] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0199.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.800] lstrlenW (lpString=".jpg") returned 4 [0199.800] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0199.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.800] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.800] lstrlenW (lpString=".doc") returned 4 [0199.800] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0199.801] lstrlenW (lpString=".docx") returned 5 [0199.801] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0199.801] lstrlenW (lpString=".pdf") returned 4 [0199.801] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0199.801] lstrlenW (lpString=".xls") returned 4 [0199.801] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0199.801] lstrlenW (lpString=".xlsx") returned 5 [0199.801] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0199.801] lstrlenW (lpString=".ppt") returned 4 [0199.801] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0199.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.801] lstrlenW (lpString=".zip") returned 4 [0199.801] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0199.801] lstrlenW (lpString=".rar") returned 4 [0199.801] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0199.801] lstrlenW (lpString=".bz2") returned 4 [0199.801] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0199.801] lstrlenW (lpString=".7z") returned 3 [0199.801] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0199.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.801] lstrlenW (lpString=".dbf") returned 4 [0199.801] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0199.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.801] lstrlenW (lpString=".1cd") returned 4 [0199.801] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0199.801] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.manifest") returned 157 [0199.801] lstrlenW (lpString=".jpg") returned 4 [0199.801] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0199.802] lstrlenW (lpString="data_2") returned 6 [0199.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.887] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=8192) returned 1 [0199.887] CloseHandle (hObject=0x2d4) returned 1 [0199.887] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 0x2020 [0199.887] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.887] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.887] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.887] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.888] GetLastError () returned 0x0 [0199.888] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x2000, lpOverlapped=0x0) returned 1 [0199.890] WriteFile (in: hFile=0x34c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x2010, lpOverlapped=0x0) returned 1 [0199.891] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.891] WriteFile (in: hFile=0x34c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe0, lpOverlapped=0x0) returned 1 [0199.891] SetEndOfFile (hFile=0x34c) returned 1 [0199.891] CloseHandle (hObject=0x34c) returned 1 [0199.891] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.891] SetEndOfFile (hFile=0x2d4) returned 1 [0199.892] CloseHandle (hObject=0x2d4) returned 1 [0199.892] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.892] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_2")) returned 1 [0199.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.892] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.892] lstrlenW (lpString=".doc") returned 4 [0199.892] lstrcmpiW (lpString1=".doc", lpString2="ta_2") returned -1 [0199.892] lstrlenW (lpString=".docx") returned 5 [0199.892] lstrcmpiW (lpString1=".docx", lpString2="ata_2") returned -1 [0199.892] lstrlenW (lpString=".pdf") returned 4 [0199.892] lstrcmpiW (lpString1=".pdf", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString=".xls") returned 4 [0199.893] lstrcmpiW (lpString1=".xls", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString=".xlsx") returned 5 [0199.893] lstrcmpiW (lpString1=".xlsx", lpString2="ata_2") returned -1 [0199.893] lstrlenW (lpString=".ppt") returned 4 [0199.893] lstrcmpiW (lpString1=".ppt", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.893] lstrlenW (lpString=".zip") returned 4 [0199.893] lstrcmpiW (lpString1=".zip", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString=".rar") returned 4 [0199.893] lstrcmpiW (lpString1=".rar", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString=".bz2") returned 4 [0199.893] lstrcmpiW (lpString1=".bz2", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString=".7z") returned 3 [0199.893] lstrcmpiW (lpString1=".7z", lpString2="a_2") returned -1 [0199.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.893] lstrlenW (lpString=".dbf") returned 4 [0199.893] lstrcmpiW (lpString1=".dbf", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.893] lstrlenW (lpString=".1cd") returned 4 [0199.893] lstrcmpiW (lpString1=".1cd", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.893] lstrlenW (lpString=".jpg") returned 4 [0199.893] lstrcmpiW (lpString1=".jpg", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.893] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.893] lstrlenW (lpString=".doc") returned 4 [0199.893] lstrcmpiW (lpString1=".doc", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString=".docx") returned 5 [0199.893] lstrcmpiW (lpString1=".docx", lpString2="ata_2") returned -1 [0199.893] lstrlenW (lpString=".pdf") returned 4 [0199.893] lstrcmpiW (lpString1=".pdf", lpString2="ta_2") returned -1 [0199.893] lstrlenW (lpString=".xls") returned 4 [0199.894] lstrcmpiW (lpString1=".xls", lpString2="ta_2") returned -1 [0199.894] lstrlenW (lpString=".xlsx") returned 5 [0199.894] lstrcmpiW (lpString1=".xlsx", lpString2="ata_2") returned -1 [0199.894] lstrlenW (lpString=".ppt") returned 4 [0199.894] lstrcmpiW (lpString1=".ppt", lpString2="ta_2") returned -1 [0199.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.894] lstrlenW (lpString=".zip") returned 4 [0199.894] lstrcmpiW (lpString1=".zip", lpString2="ta_2") returned -1 [0199.894] lstrlenW (lpString=".rar") returned 4 [0199.894] lstrcmpiW (lpString1=".rar", lpString2="ta_2") returned -1 [0199.894] lstrlenW (lpString=".bz2") returned 4 [0199.894] lstrcmpiW (lpString1=".bz2", lpString2="ta_2") returned -1 [0199.894] lstrlenW (lpString=".7z") returned 3 [0199.894] lstrcmpiW (lpString1=".7z", lpString2="a_2") returned -1 [0199.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.894] lstrlenW (lpString=".dbf") returned 4 [0199.894] lstrcmpiW (lpString1=".dbf", lpString2="ta_2") returned -1 [0199.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.894] lstrlenW (lpString=".1cd") returned 4 [0199.894] lstrcmpiW (lpString1=".1cd", lpString2="ta_2") returned -1 [0199.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_2") returned 88 [0199.894] lstrlenW (lpString=".jpg") returned 4 [0199.894] lstrcmpiW (lpString1=".jpg", lpString2="ta_2") returned -1 [0199.894] lstrlenW (lpString="index") returned 5 [0199.894] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.895] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=524656) returned 1 [0199.895] CloseHandle (hObject=0x2d4) returned 1 [0199.895] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 0x2020 [0199.895] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.895] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.895] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.896] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.896] GetLastError () returned 0x0 [0199.896] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x80170, lpOverlapped=0x0) returned 1 [0199.911] WriteFile (in: hFile=0x34c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x80180, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x80180, lpOverlapped=0x0) returned 1 [0199.924] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0199.924] WriteFile (in: hFile=0x34c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xde, lpOverlapped=0x0) returned 1 [0199.924] SetEndOfFile (hFile=0x34c) returned 1 [0199.924] CloseHandle (hObject=0x34c) returned 1 [0199.924] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0199.924] SetEndOfFile (hFile=0x2d4) returned 1 [0200.092] CloseHandle (hObject=0x2d4) returned 1 [0200.252] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.252] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\index")) returned 1 [0200.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.252] lstrlenW (lpString=".doc") returned 4 [0200.253] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0200.253] lstrlenW (lpString=".docx") returned 5 [0200.253] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0200.253] lstrlenW (lpString=".pdf") returned 4 [0200.253] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0200.253] lstrlenW (lpString=".xls") returned 4 [0200.253] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0200.253] lstrlenW (lpString=".xlsx") returned 5 [0200.253] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0200.253] lstrlenW (lpString=".ppt") returned 4 [0200.253] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0200.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.253] lstrlenW (lpString=".zip") returned 4 [0200.253] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0200.253] lstrlenW (lpString=".rar") returned 4 [0200.253] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0200.253] lstrlenW (lpString=".bz2") returned 4 [0200.253] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0200.253] lstrlenW (lpString=".7z") returned 3 [0200.253] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0200.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.253] lstrlenW (lpString=".dbf") returned 4 [0200.253] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0200.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.253] lstrlenW (lpString=".1cd") returned 4 [0200.253] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0200.253] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.253] lstrlenW (lpString=".jpg") returned 4 [0200.254] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0200.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.254] lstrlenW (lpString=".doc") returned 4 [0200.254] lstrcmpiW (lpString1=".doc", lpString2="ndex") returned -1 [0200.254] lstrlenW (lpString=".docx") returned 5 [0200.254] lstrcmpiW (lpString1=".docx", lpString2="index") returned -1 [0200.254] lstrlenW (lpString=".pdf") returned 4 [0200.254] lstrcmpiW (lpString1=".pdf", lpString2="ndex") returned -1 [0200.254] lstrlenW (lpString=".xls") returned 4 [0200.254] lstrcmpiW (lpString1=".xls", lpString2="ndex") returned -1 [0200.254] lstrlenW (lpString=".xlsx") returned 5 [0200.254] lstrcmpiW (lpString1=".xlsx", lpString2="index") returned -1 [0200.254] lstrlenW (lpString=".ppt") returned 4 [0200.254] lstrcmpiW (lpString1=".ppt", lpString2="ndex") returned -1 [0200.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.254] lstrlenW (lpString=".zip") returned 4 [0200.254] lstrcmpiW (lpString1=".zip", lpString2="ndex") returned -1 [0200.254] lstrlenW (lpString=".rar") returned 4 [0200.254] lstrcmpiW (lpString1=".rar", lpString2="ndex") returned -1 [0200.254] lstrlenW (lpString=".bz2") returned 4 [0200.254] lstrcmpiW (lpString1=".bz2", lpString2="ndex") returned -1 [0200.254] lstrlenW (lpString=".7z") returned 3 [0200.254] lstrcmpiW (lpString1=".7z", lpString2="dex") returned -1 [0200.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.254] lstrlenW (lpString=".dbf") returned 4 [0200.254] lstrcmpiW (lpString1=".dbf", lpString2="ndex") returned -1 [0200.254] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.254] lstrlenW (lpString=".1cd") returned 4 [0200.254] lstrcmpiW (lpString1=".1cd", lpString2="ndex") returned -1 [0200.255] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\index") returned 87 [0200.255] lstrlenW (lpString=".jpg") returned 4 [0200.255] lstrcmpiW (lpString1=".jpg", lpString2="ndex") returned -1 [0200.255] lstrlenW (lpString="MANIFEST-000001") returned 15 [0200.255] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.570] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=41) returned 1 [0200.581] CloseHandle (hObject=0x154) returned 1 [0200.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001")) returned 0x2020 [0200.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.582] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.582] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.582] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0200.582] GetLastError () returned 0x0 [0200.582] ReadFile (in: hFile=0x154, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x29, lpOverlapped=0x0) returned 1 [0200.583] WriteFile (in: hFile=0x354, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x30, lpOverlapped=0x0) returned 1 [0200.584] ReadFile (in: hFile=0x154, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.584] WriteFile (in: hFile=0x354, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0200.584] SetEndOfFile (hFile=0x354) returned 1 [0200.584] CloseHandle (hObject=0x354) returned 1 [0200.584] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.584] SetEndOfFile (hFile=0x154) returned 1 [0200.585] CloseHandle (hObject=0x154) returned 1 [0200.585] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.585] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\manifest-000001")) returned 1 [0200.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.585] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.585] lstrlenW (lpString=".doc") returned 4 [0200.586] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0200.586] lstrlenW (lpString=".docx") returned 5 [0200.586] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0200.586] lstrlenW (lpString=".pdf") returned 4 [0200.586] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0200.586] lstrlenW (lpString=".xls") returned 4 [0200.586] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0200.586] lstrlenW (lpString=".xlsx") returned 5 [0200.586] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0200.586] lstrlenW (lpString=".ppt") returned 4 [0200.586] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0200.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.586] lstrlenW (lpString=".zip") returned 4 [0200.586] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0200.586] lstrlenW (lpString=".rar") returned 4 [0200.586] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0200.586] lstrlenW (lpString=".bz2") returned 4 [0200.586] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0200.586] lstrlenW (lpString=".7z") returned 3 [0200.586] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0200.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.586] lstrlenW (lpString=".dbf") returned 4 [0200.586] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0200.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.586] lstrlenW (lpString=".1cd") returned 4 [0200.586] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0200.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.586] lstrlenW (lpString=".jpg") returned 4 [0200.586] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0200.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.587] lstrlenW (lpString=".doc") returned 4 [0200.587] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0200.587] lstrlenW (lpString=".docx") returned 5 [0200.587] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0200.587] lstrlenW (lpString=".pdf") returned 4 [0200.587] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0200.587] lstrlenW (lpString=".xls") returned 4 [0200.587] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0200.587] lstrlenW (lpString=".xlsx") returned 5 [0200.587] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0200.587] lstrlenW (lpString=".ppt") returned 4 [0200.587] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0200.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.587] lstrlenW (lpString=".zip") returned 4 [0200.587] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0200.587] lstrlenW (lpString=".rar") returned 4 [0200.587] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0200.587] lstrlenW (lpString=".bz2") returned 4 [0200.587] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0200.587] lstrlenW (lpString=".7z") returned 3 [0200.587] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0200.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.587] lstrlenW (lpString=".dbf") returned 4 [0200.587] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0200.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.587] lstrlenW (lpString=".1cd") returned 4 [0200.587] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0200.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\MANIFEST-000001") returned 120 [0200.587] lstrlenW (lpString=".jpg") returned 4 [0200.587] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0200.588] lstrlenW (lpString="History") returned 7 [0200.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.588] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=102400) returned 1 [0200.588] CloseHandle (hObject=0x154) returned 1 [0200.588] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history")) returned 0x2020 [0200.588] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.588] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.588] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0200.589] GetLastError () returned 0x0 [0200.589] ReadFile (in: hFile=0x154, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x19000, lpOverlapped=0x0) returned 1 [0200.592] WriteFile (in: hFile=0x354, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x19010, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x19010, lpOverlapped=0x0) returned 1 [0200.594] ReadFile (in: hFile=0x154, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.594] WriteFile (in: hFile=0x354, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0200.594] SetEndOfFile (hFile=0x354) returned 1 [0200.594] CloseHandle (hObject=0x354) returned 1 [0200.595] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.595] SetEndOfFile (hFile=0x154) returned 1 [0200.596] CloseHandle (hObject=0x154) returned 1 [0200.596] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.596] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history")) returned 1 [0200.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.596] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.596] lstrlenW (lpString=".doc") returned 4 [0200.596] lstrcmpiW (lpString1=".doc", lpString2="tory") returned -1 [0200.596] lstrlenW (lpString=".docx") returned 5 [0200.596] lstrcmpiW (lpString1=".docx", lpString2="story") returned -1 [0200.596] lstrlenW (lpString=".pdf") returned 4 [0200.596] lstrcmpiW (lpString1=".pdf", lpString2="tory") returned -1 [0200.597] lstrlenW (lpString=".xls") returned 4 [0200.597] lstrcmpiW (lpString1=".xls", lpString2="tory") returned -1 [0200.597] lstrlenW (lpString=".xlsx") returned 5 [0200.597] lstrcmpiW (lpString1=".xlsx", lpString2="story") returned -1 [0200.597] lstrlenW (lpString=".ppt") returned 4 [0200.597] lstrcmpiW (lpString1=".ppt", lpString2="tory") returned -1 [0200.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.597] lstrlenW (lpString=".zip") returned 4 [0200.597] lstrcmpiW (lpString1=".zip", lpString2="tory") returned -1 [0200.597] lstrlenW (lpString=".rar") returned 4 [0200.597] lstrcmpiW (lpString1=".rar", lpString2="tory") returned -1 [0200.597] lstrlenW (lpString=".bz2") returned 4 [0200.597] lstrcmpiW (lpString1=".bz2", lpString2="tory") returned -1 [0200.597] lstrlenW (lpString=".7z") returned 3 [0200.597] lstrcmpiW (lpString1=".7z", lpString2="ory") returned -1 [0200.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.597] lstrlenW (lpString=".dbf") returned 4 [0200.597] lstrcmpiW (lpString1=".dbf", lpString2="tory") returned -1 [0200.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.597] lstrlenW (lpString=".1cd") returned 4 [0200.597] lstrcmpiW (lpString1=".1cd", lpString2="tory") returned -1 [0200.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.597] lstrlenW (lpString=".jpg") returned 4 [0200.597] lstrcmpiW (lpString1=".jpg", lpString2="tory") returned -1 [0200.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.597] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.597] lstrlenW (lpString=".doc") returned 4 [0200.597] lstrcmpiW (lpString1=".doc", lpString2="tory") returned -1 [0200.597] lstrlenW (lpString=".docx") returned 5 [0200.597] lstrcmpiW (lpString1=".docx", lpString2="story") returned -1 [0200.597] lstrlenW (lpString=".pdf") returned 4 [0200.597] lstrcmpiW (lpString1=".pdf", lpString2="tory") returned -1 [0200.598] lstrlenW (lpString=".xls") returned 4 [0200.598] lstrcmpiW (lpString1=".xls", lpString2="tory") returned -1 [0200.598] lstrlenW (lpString=".xlsx") returned 5 [0200.598] lstrcmpiW (lpString1=".xlsx", lpString2="story") returned -1 [0200.598] lstrlenW (lpString=".ppt") returned 4 [0200.598] lstrcmpiW (lpString1=".ppt", lpString2="tory") returned -1 [0200.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.598] lstrlenW (lpString=".zip") returned 4 [0200.598] lstrcmpiW (lpString1=".zip", lpString2="tory") returned -1 [0200.598] lstrlenW (lpString=".rar") returned 4 [0200.598] lstrcmpiW (lpString1=".rar", lpString2="tory") returned -1 [0200.598] lstrlenW (lpString=".bz2") returned 4 [0200.598] lstrcmpiW (lpString1=".bz2", lpString2="tory") returned -1 [0200.598] lstrlenW (lpString=".7z") returned 3 [0200.598] lstrcmpiW (lpString1=".7z", lpString2="ory") returned -1 [0200.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.598] lstrlenW (lpString=".dbf") returned 4 [0200.598] lstrcmpiW (lpString1=".dbf", lpString2="tory") returned -1 [0200.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.598] lstrlenW (lpString=".1cd") returned 4 [0200.598] lstrcmpiW (lpString1=".1cd", lpString2="tory") returned -1 [0200.598] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History") returned 83 [0200.598] lstrlenW (lpString=".jpg") returned 4 [0200.598] lstrcmpiW (lpString1=".jpg", lpString2="tory") returned -1 [0200.598] lstrlenW (lpString="History Provider Cache") returned 22 [0200.598] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.599] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=5167) returned 1 [0200.599] CloseHandle (hObject=0x154) returned 1 [0200.599] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache")) returned 0x2020 [0200.599] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.599] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.599] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.599] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0200.600] GetLastError () returned 0x0 [0200.600] ReadFile (in: hFile=0x154, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x142f, lpOverlapped=0x0) returned 1 [0200.601] WriteFile (in: hFile=0x354, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1430, lpOverlapped=0x0) returned 1 [0200.602] ReadFile (in: hFile=0x154, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.602] WriteFile (in: hFile=0x354, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x100, lpOverlapped=0x0) returned 1 [0200.603] SetEndOfFile (hFile=0x354) returned 1 [0200.603] CloseHandle (hObject=0x354) returned 1 [0200.603] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.603] SetEndOfFile (hFile=0x154) returned 1 [0200.604] CloseHandle (hObject=0x154) returned 1 [0200.604] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.604] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history provider cache")) returned 1 [0200.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.604] lstrlenW (lpString=".doc") returned 4 [0200.604] lstrcmpiW (lpString1=".doc", lpString2="ache") returned -1 [0200.604] lstrlenW (lpString=".docx") returned 5 [0200.604] lstrcmpiW (lpString1=".docx", lpString2="Cache") returned -1 [0200.604] lstrlenW (lpString=".pdf") returned 4 [0200.604] lstrcmpiW (lpString1=".pdf", lpString2="ache") returned -1 [0200.604] lstrlenW (lpString=".xls") returned 4 [0200.604] lstrcmpiW (lpString1=".xls", lpString2="ache") returned -1 [0200.604] lstrlenW (lpString=".xlsx") returned 5 [0200.604] lstrcmpiW (lpString1=".xlsx", lpString2="Cache") returned -1 [0200.604] lstrlenW (lpString=".ppt") returned 4 [0200.604] lstrcmpiW (lpString1=".ppt", lpString2="ache") returned -1 [0200.604] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.604] lstrlenW (lpString=".zip") returned 4 [0200.604] lstrcmpiW (lpString1=".zip", lpString2="ache") returned -1 [0200.604] lstrlenW (lpString=".rar") returned 4 [0200.604] lstrcmpiW (lpString1=".rar", lpString2="ache") returned -1 [0200.604] lstrlenW (lpString=".bz2") returned 4 [0200.604] lstrcmpiW (lpString1=".bz2", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString=".7z") returned 3 [0200.605] lstrcmpiW (lpString1=".7z", lpString2="che") returned -1 [0200.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.605] lstrlenW (lpString=".dbf") returned 4 [0200.605] lstrcmpiW (lpString1=".dbf", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.605] lstrlenW (lpString=".1cd") returned 4 [0200.605] lstrcmpiW (lpString1=".1cd", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.605] lstrlenW (lpString=".jpg") returned 4 [0200.605] lstrcmpiW (lpString1=".jpg", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.605] lstrlenW (lpString=".doc") returned 4 [0200.605] lstrcmpiW (lpString1=".doc", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString=".docx") returned 5 [0200.605] lstrcmpiW (lpString1=".docx", lpString2="Cache") returned -1 [0200.605] lstrlenW (lpString=".pdf") returned 4 [0200.605] lstrcmpiW (lpString1=".pdf", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString=".xls") returned 4 [0200.605] lstrcmpiW (lpString1=".xls", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString=".xlsx") returned 5 [0200.605] lstrcmpiW (lpString1=".xlsx", lpString2="Cache") returned -1 [0200.605] lstrlenW (lpString=".ppt") returned 4 [0200.605] lstrcmpiW (lpString1=".ppt", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.605] lstrlenW (lpString=".zip") returned 4 [0200.605] lstrcmpiW (lpString1=".zip", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString=".rar") returned 4 [0200.605] lstrcmpiW (lpString1=".rar", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString=".bz2") returned 4 [0200.605] lstrcmpiW (lpString1=".bz2", lpString2="ache") returned -1 [0200.605] lstrlenW (lpString=".7z") returned 3 [0200.605] lstrcmpiW (lpString1=".7z", lpString2="che") returned -1 [0200.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.606] lstrlenW (lpString=".dbf") returned 4 [0200.606] lstrcmpiW (lpString1=".dbf", lpString2="ache") returned -1 [0200.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.606] lstrlenW (lpString=".1cd") returned 4 [0200.606] lstrcmpiW (lpString1=".1cd", lpString2="ache") returned -1 [0200.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History Provider Cache") returned 98 [0200.606] lstrlenW (lpString=".jpg") returned 4 [0200.606] lstrcmpiW (lpString1=".jpg", lpString2="ache") returned -1 [0200.606] lstrlenW (lpString="History-journal") returned 15 [0200.606] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\history-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.606] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0200.606] CloseHandle (hObject=0x154) returned 1 [0200.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.606] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.606] lstrlenW (lpString=".doc") returned 4 [0200.607] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.607] lstrlenW (lpString=".docx") returned 5 [0200.607] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.607] lstrlenW (lpString=".pdf") returned 4 [0200.607] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.607] lstrlenW (lpString=".xls") returned 4 [0200.607] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.607] lstrlenW (lpString=".xlsx") returned 5 [0200.607] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.607] lstrlenW (lpString=".ppt") returned 4 [0200.607] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.607] lstrlenW (lpString=".zip") returned 4 [0200.607] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.607] lstrlenW (lpString=".rar") returned 4 [0200.607] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.607] lstrlenW (lpString=".bz2") returned 4 [0200.607] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.607] lstrlenW (lpString=".7z") returned 3 [0200.607] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.607] lstrlenW (lpString=".dbf") returned 4 [0200.607] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.607] lstrlenW (lpString=".1cd") returned 4 [0200.607] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.607] lstrlenW (lpString=".jpg") returned 4 [0200.607] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.607] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.607] lstrlenW (lpString=".doc") returned 4 [0200.607] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.608] lstrlenW (lpString=".docx") returned 5 [0200.608] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.608] lstrlenW (lpString=".pdf") returned 4 [0200.608] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.608] lstrlenW (lpString=".xls") returned 4 [0200.608] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.608] lstrlenW (lpString=".xlsx") returned 5 [0200.608] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.608] lstrlenW (lpString=".ppt") returned 4 [0200.608] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.608] lstrlenW (lpString=".zip") returned 4 [0200.608] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.608] lstrlenW (lpString=".rar") returned 4 [0200.608] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.608] lstrlenW (lpString=".bz2") returned 4 [0200.608] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.608] lstrlenW (lpString=".7z") returned 3 [0200.608] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.608] lstrlenW (lpString=".dbf") returned 4 [0200.608] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.608] lstrlenW (lpString=".1cd") returned 4 [0200.608] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\History-journal") returned 91 [0200.608] lstrlenW (lpString=".jpg") returned 4 [0200.608] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.608] lstrcmpiW (lpString1=".tmp", lpString2=".wiki") returned -1 [0200.608] lstrlenW (lpString="A058.tmp") returned 8 [0200.609] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a058.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.609] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0200.609] CloseHandle (hObject=0x154) returned 1 [0200.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.609] lstrlenW (lpString=".doc") returned 4 [0200.609] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0200.609] lstrlenW (lpString=".docx") returned 5 [0200.609] lstrcmpiW (lpString1=".docx", lpString2="8.tmp") returned -1 [0200.609] lstrlenW (lpString=".pdf") returned 4 [0200.609] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0200.609] lstrlenW (lpString=".xls") returned 4 [0200.609] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0200.609] lstrlenW (lpString=".xlsx") returned 5 [0200.609] lstrcmpiW (lpString1=".xlsx", lpString2="8.tmp") returned -1 [0200.609] lstrlenW (lpString=".ppt") returned 4 [0200.609] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0200.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.609] lstrlenW (lpString=".zip") returned 4 [0200.610] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0200.610] lstrlenW (lpString=".rar") returned 4 [0200.610] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0200.610] lstrlenW (lpString=".bz2") returned 4 [0200.610] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0200.610] lstrlenW (lpString=".7z") returned 3 [0200.610] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0200.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.610] lstrlenW (lpString=".dbf") returned 4 [0200.610] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0200.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.610] lstrlenW (lpString=".1cd") returned 4 [0200.610] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0200.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.610] lstrlenW (lpString=".jpg") returned 4 [0200.610] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0200.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.610] lstrlenW (lpString=".doc") returned 4 [0200.610] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0200.610] lstrlenW (lpString=".docx") returned 5 [0200.610] lstrcmpiW (lpString1=".docx", lpString2="8.tmp") returned -1 [0200.610] lstrlenW (lpString=".pdf") returned 4 [0200.610] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0200.610] lstrlenW (lpString=".xls") returned 4 [0200.610] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0200.610] lstrlenW (lpString=".xlsx") returned 5 [0200.610] lstrcmpiW (lpString1=".xlsx", lpString2="8.tmp") returned -1 [0200.610] lstrlenW (lpString=".ppt") returned 4 [0200.610] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0200.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.610] lstrlenW (lpString=".zip") returned 4 [0200.610] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0200.610] lstrlenW (lpString=".rar") returned 4 [0200.611] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0200.611] lstrlenW (lpString=".bz2") returned 4 [0200.611] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0200.611] lstrlenW (lpString=".7z") returned 3 [0200.611] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0200.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.611] lstrlenW (lpString=".dbf") returned 4 [0200.611] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0200.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.611] lstrlenW (lpString=".1cd") returned 4 [0200.611] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0200.611] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A058.tmp") returned 98 [0200.611] lstrlenW (lpString=".jpg") returned 4 [0200.611] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0200.611] lstrcmpiW (lpString1=".tmp", lpString2=".wiki") returned -1 [0200.611] lstrlenW (lpString="A059.tmp") returned 8 [0200.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticons\\a059.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0200.612] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0200.612] CloseHandle (hObject=0x154) returned 1 [0200.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.612] lstrlenW (lpString=".doc") returned 4 [0200.612] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0200.612] lstrlenW (lpString=".docx") returned 5 [0200.612] lstrcmpiW (lpString1=".docx", lpString2="9.tmp") returned -1 [0200.612] lstrlenW (lpString=".pdf") returned 4 [0200.612] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0200.612] lstrlenW (lpString=".xls") returned 4 [0200.612] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0200.612] lstrlenW (lpString=".xlsx") returned 5 [0200.612] lstrcmpiW (lpString1=".xlsx", lpString2="9.tmp") returned -1 [0200.612] lstrlenW (lpString=".ppt") returned 4 [0200.612] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0200.612] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.612] lstrlenW (lpString=".zip") returned 4 [0200.612] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0200.772] lstrlenW (lpString=".rar") returned 4 [0200.772] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0200.772] lstrlenW (lpString=".bz2") returned 4 [0200.772] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0200.772] lstrlenW (lpString=".7z") returned 3 [0200.772] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0200.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.773] lstrlenW (lpString=".dbf") returned 4 [0200.773] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0200.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.773] lstrlenW (lpString=".1cd") returned 4 [0200.773] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0200.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.773] lstrlenW (lpString=".jpg") returned 4 [0200.773] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0200.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.773] lstrlenW (lpString=".doc") returned 4 [0200.773] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0200.773] lstrlenW (lpString=".docx") returned 5 [0200.773] lstrcmpiW (lpString1=".docx", lpString2="9.tmp") returned -1 [0200.773] lstrlenW (lpString=".pdf") returned 4 [0200.773] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0200.773] lstrlenW (lpString=".xls") returned 4 [0200.773] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0200.773] lstrlenW (lpString=".xlsx") returned 5 [0200.773] lstrcmpiW (lpString1=".xlsx", lpString2="9.tmp") returned -1 [0200.773] lstrlenW (lpString=".ppt") returned 4 [0200.773] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0200.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.773] lstrlenW (lpString=".zip") returned 4 [0200.773] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0200.773] lstrlenW (lpString=".rar") returned 4 [0200.773] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0200.773] lstrlenW (lpString=".bz2") returned 4 [0200.773] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0200.773] lstrlenW (lpString=".7z") returned 3 [0200.773] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0200.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.773] lstrlenW (lpString=".dbf") returned 4 [0200.774] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0200.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.774] lstrlenW (lpString=".1cd") returned 4 [0200.774] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0200.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIcons\\A059.tmp") returned 98 [0200.774] lstrlenW (lpString=".jpg") returned 4 [0200.774] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0200.774] lstrlenW (lpString="CURRENT") returned 7 [0200.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.775] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=16) returned 1 [0200.775] CloseHandle (hObject=0x2d4) returned 1 [0200.775] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current")) returned 0x2020 [0200.775] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.776] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.776] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.776] GetLastError () returned 0x0 [0200.776] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x10, lpOverlapped=0x0) returned 1 [0200.777] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x20, lpOverlapped=0x0) returned 1 [0200.778] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.778] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe2, lpOverlapped=0x0) returned 1 [0200.778] SetEndOfFile (hFile=0x15c) returned 1 [0200.778] CloseHandle (hObject=0x15c) returned 1 [0200.778] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.778] SetEndOfFile (hFile=0x2d4) returned 1 [0200.779] CloseHandle (hObject=0x2d4) returned 1 [0200.779] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.779] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\current")) returned 1 [0200.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.780] lstrlenW (lpString=".doc") returned 4 [0200.780] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0200.780] lstrlenW (lpString=".docx") returned 5 [0200.780] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0200.780] lstrlenW (lpString=".pdf") returned 4 [0200.780] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0200.780] lstrlenW (lpString=".xls") returned 4 [0200.780] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0200.780] lstrlenW (lpString=".xlsx") returned 5 [0200.780] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0200.780] lstrlenW (lpString=".ppt") returned 4 [0200.780] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0200.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.780] lstrlenW (lpString=".zip") returned 4 [0200.780] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0200.780] lstrlenW (lpString=".rar") returned 4 [0200.780] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0200.780] lstrlenW (lpString=".bz2") returned 4 [0200.780] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0200.780] lstrlenW (lpString=".7z") returned 3 [0200.780] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0200.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.780] lstrlenW (lpString=".dbf") returned 4 [0200.780] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0200.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.780] lstrlenW (lpString=".1cd") returned 4 [0200.780] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0200.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.780] lstrlenW (lpString=".jpg") returned 4 [0200.781] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0200.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.781] lstrlenW (lpString=".doc") returned 4 [0200.781] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0200.781] lstrlenW (lpString=".docx") returned 5 [0200.781] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0200.781] lstrlenW (lpString=".pdf") returned 4 [0200.781] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0200.781] lstrlenW (lpString=".xls") returned 4 [0200.781] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0200.781] lstrlenW (lpString=".xlsx") returned 5 [0200.781] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0200.781] lstrlenW (lpString=".ppt") returned 4 [0200.781] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0200.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.781] lstrlenW (lpString=".zip") returned 4 [0200.781] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0200.781] lstrlenW (lpString=".rar") returned 4 [0200.781] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0200.781] lstrlenW (lpString=".bz2") returned 4 [0200.781] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0200.781] lstrlenW (lpString=".7z") returned 3 [0200.781] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0200.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.781] lstrlenW (lpString=".dbf") returned 4 [0200.781] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0200.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.781] lstrlenW (lpString=".1cd") returned 4 [0200.781] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0200.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\CURRENT") returned 141 [0200.781] lstrlenW (lpString=".jpg") returned 4 [0200.781] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0200.782] lstrlenW (lpString="LOCK") returned 4 [0200.782] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.782] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0200.782] CloseHandle (hObject=0x2d4) returned 1 [0200.782] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.782] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.782] lstrlenW (lpString=".doc") returned 4 [0200.782] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0200.782] lstrlenW (lpString=".docx") returned 5 [0200.782] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0200.782] lstrlenW (lpString=".pdf") returned 4 [0200.782] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0200.782] lstrlenW (lpString=".xls") returned 4 [0200.783] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString=".xlsx") returned 5 [0200.783] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0200.783] lstrlenW (lpString=".ppt") returned 4 [0200.783] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.783] lstrlenW (lpString=".zip") returned 4 [0200.783] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString=".rar") returned 4 [0200.783] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString=".bz2") returned 4 [0200.783] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString=".7z") returned 3 [0200.783] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0200.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.783] lstrlenW (lpString=".dbf") returned 4 [0200.783] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.783] lstrlenW (lpString=".1cd") returned 4 [0200.783] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.783] lstrlenW (lpString=".jpg") returned 4 [0200.783] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.783] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.783] lstrlenW (lpString=".doc") returned 4 [0200.783] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString=".docx") returned 5 [0200.783] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0200.783] lstrlenW (lpString=".pdf") returned 4 [0200.783] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString=".xls") returned 4 [0200.783] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0200.783] lstrlenW (lpString=".xlsx") returned 5 [0200.784] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0200.784] lstrlenW (lpString=".ppt") returned 4 [0200.784] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0200.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.784] lstrlenW (lpString=".zip") returned 4 [0200.784] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0200.784] lstrlenW (lpString=".rar") returned 4 [0200.784] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0200.784] lstrlenW (lpString=".bz2") returned 4 [0200.784] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0200.784] lstrlenW (lpString=".7z") returned 3 [0200.784] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0200.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.784] lstrlenW (lpString=".dbf") returned 4 [0200.784] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0200.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.784] lstrlenW (lpString=".1cd") returned 4 [0200.784] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0200.784] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOCK") returned 138 [0200.784] lstrlenW (lpString=".jpg") returned 4 [0200.784] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0200.784] lstrlenW (lpString="LOG") returned 3 [0200.784] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.785] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=196) returned 1 [0200.785] CloseHandle (hObject=0x2d4) returned 1 [0200.785] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log")) returned 0x2020 [0200.785] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.785] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.785] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.785] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.786] GetLastError () returned 0x0 [0200.786] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0xc4, lpOverlapped=0x0) returned 1 [0200.787] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xd0, lpOverlapped=0x0) returned 1 [0200.787] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.787] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xda, lpOverlapped=0x0) returned 1 [0200.788] SetEndOfFile (hFile=0x15c) returned 1 [0200.788] CloseHandle (hObject=0x15c) returned 1 [0200.788] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.788] SetEndOfFile (hFile=0x2d4) returned 1 [0200.789] CloseHandle (hObject=0x2d4) returned 1 [0200.789] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.789] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\log")) returned 1 [0200.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.789] lstrlenW (lpString=".doc") returned 4 [0200.789] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0200.789] lstrlenW (lpString=".docx") returned 5 [0200.789] lstrcmpiW (lpString1=".docx", lpString2="i\\LOG") returned -1 [0200.789] lstrlenW (lpString=".pdf") returned 4 [0200.789] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0200.789] lstrlenW (lpString=".xls") returned 4 [0200.789] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0200.789] lstrlenW (lpString=".xlsx") returned 5 [0200.789] lstrcmpiW (lpString1=".xlsx", lpString2="i\\LOG") returned -1 [0200.789] lstrlenW (lpString=".ppt") returned 4 [0200.789] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0200.789] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.789] lstrlenW (lpString=".zip") returned 4 [0200.789] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0200.789] lstrlenW (lpString=".rar") returned 4 [0200.789] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0200.790] lstrlenW (lpString=".bz2") returned 4 [0200.790] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0200.790] lstrlenW (lpString=".7z") returned 3 [0200.790] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0200.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.790] lstrlenW (lpString=".dbf") returned 4 [0200.790] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0200.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.790] lstrlenW (lpString=".1cd") returned 4 [0200.790] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0200.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.790] lstrlenW (lpString=".jpg") returned 4 [0200.790] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0200.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.790] lstrlenW (lpString=".doc") returned 4 [0200.790] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0200.790] lstrlenW (lpString=".docx") returned 5 [0200.790] lstrcmpiW (lpString1=".docx", lpString2="i\\LOG") returned -1 [0200.790] lstrlenW (lpString=".pdf") returned 4 [0200.790] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0200.790] lstrlenW (lpString=".xls") returned 4 [0200.790] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0200.790] lstrlenW (lpString=".xlsx") returned 5 [0200.790] lstrcmpiW (lpString1=".xlsx", lpString2="i\\LOG") returned -1 [0200.790] lstrlenW (lpString=".ppt") returned 4 [0200.790] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0200.790] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.790] lstrlenW (lpString=".zip") returned 4 [0200.790] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0200.790] lstrlenW (lpString=".rar") returned 4 [0200.790] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0200.791] lstrlenW (lpString=".bz2") returned 4 [0200.791] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0200.791] lstrlenW (lpString=".7z") returned 3 [0200.791] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0200.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.791] lstrlenW (lpString=".dbf") returned 4 [0200.791] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0200.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.791] lstrlenW (lpString=".1cd") returned 4 [0200.791] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0200.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\LOG") returned 137 [0200.791] lstrlenW (lpString=".jpg") returned 4 [0200.791] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0200.791] lstrlenW (lpString="MANIFEST-000001") returned 15 [0200.791] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.793] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=41) returned 1 [0200.793] CloseHandle (hObject=0x2d4) returned 1 [0200.793] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001")) returned 0x2020 [0200.793] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.793] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.793] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.794] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.794] GetLastError () returned 0x0 [0200.794] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x29, lpOverlapped=0x0) returned 1 [0200.795] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x30, lpOverlapped=0x0) returned 1 [0200.796] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.796] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0200.796] SetEndOfFile (hFile=0x15c) returned 1 [0200.796] CloseHandle (hObject=0x15c) returned 1 [0200.796] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.796] SetEndOfFile (hFile=0x2d4) returned 1 [0200.797] CloseHandle (hObject=0x2d4) returned 1 [0200.797] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.797] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local extension settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\manifest-000001")) returned 1 [0200.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.797] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.797] lstrlenW (lpString=".doc") returned 4 [0200.797] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0200.797] lstrlenW (lpString=".docx") returned 5 [0200.797] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0200.797] lstrlenW (lpString=".pdf") returned 4 [0200.797] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0200.797] lstrlenW (lpString=".xls") returned 4 [0200.798] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString=".xlsx") returned 5 [0200.798] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0200.798] lstrlenW (lpString=".ppt") returned 4 [0200.798] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.798] lstrlenW (lpString=".zip") returned 4 [0200.798] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString=".rar") returned 4 [0200.798] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString=".bz2") returned 4 [0200.798] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString=".7z") returned 3 [0200.798] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0200.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.798] lstrlenW (lpString=".dbf") returned 4 [0200.798] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.798] lstrlenW (lpString=".1cd") returned 4 [0200.798] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.798] lstrlenW (lpString=".jpg") returned 4 [0200.798] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.798] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.798] lstrlenW (lpString=".doc") returned 4 [0200.798] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString=".docx") returned 5 [0200.798] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0200.798] lstrlenW (lpString=".pdf") returned 4 [0200.798] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString=".xls") returned 4 [0200.798] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0200.798] lstrlenW (lpString=".xlsx") returned 5 [0200.799] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0200.799] lstrlenW (lpString=".ppt") returned 4 [0200.799] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0200.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.799] lstrlenW (lpString=".zip") returned 4 [0200.799] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0200.799] lstrlenW (lpString=".rar") returned 4 [0200.799] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0200.799] lstrlenW (lpString=".bz2") returned 4 [0200.799] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0200.799] lstrlenW (lpString=".7z") returned 3 [0200.799] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0200.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.799] lstrlenW (lpString=".dbf") returned 4 [0200.799] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0200.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.799] lstrlenW (lpString=".1cd") returned 4 [0200.799] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0200.799] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Extension Settings\\ghbmnnjooekpmoecnnnilnnbdlolhkhi\\MANIFEST-000001") returned 149 [0200.799] lstrlenW (lpString=".jpg") returned 4 [0200.799] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0200.799] lstrcmpiW (lpString1=".localstorage", lpString2=".wiki") returned -1 [0200.800] lstrlenW (lpString="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 64 [0200.800] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.801] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=12288) returned 1 [0200.801] CloseHandle (hObject=0x2d4) returned 1 [0200.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage")) returned 0x2020 [0200.801] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.801] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.801] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.801] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.802] GetLastError () returned 0x0 [0200.802] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x3000, lpOverlapped=0x0) returned 1 [0200.804] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x3010, lpOverlapped=0x0) returned 1 [0200.805] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.805] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x154, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x154, lpOverlapped=0x0) returned 1 [0200.805] SetEndOfFile (hFile=0x15c) returned 1 [0200.805] CloseHandle (hObject=0x15c) returned 1 [0200.805] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.805] SetEndOfFile (hFile=0x2d4) returned 1 [0200.806] CloseHandle (hObject=0x2d4) returned 1 [0200.806] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.806] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage")) returned 1 [0200.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.806] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.806] lstrlenW (lpString=".doc") returned 4 [0200.806] lstrcmpiW (lpString1=".doc", lpString2="rage") returned -1 [0200.806] lstrlenW (lpString=".docx") returned 5 [0200.806] lstrcmpiW (lpString1=".docx", lpString2="orage") returned -1 [0200.806] lstrlenW (lpString=".pdf") returned 4 [0200.806] lstrcmpiW (lpString1=".pdf", lpString2="rage") returned -1 [0200.806] lstrlenW (lpString=".xls") returned 4 [0200.806] lstrcmpiW (lpString1=".xls", lpString2="rage") returned -1 [0200.806] lstrlenW (lpString=".xlsx") returned 5 [0200.806] lstrcmpiW (lpString1=".xlsx", lpString2="orage") returned -1 [0200.806] lstrlenW (lpString=".ppt") returned 4 [0200.807] lstrcmpiW (lpString1=".ppt", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.807] lstrlenW (lpString=".zip") returned 4 [0200.807] lstrcmpiW (lpString1=".zip", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString=".rar") returned 4 [0200.807] lstrcmpiW (lpString1=".rar", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString=".bz2") returned 4 [0200.807] lstrcmpiW (lpString1=".bz2", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString=".7z") returned 3 [0200.807] lstrcmpiW (lpString1=".7z", lpString2="age") returned -1 [0200.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.807] lstrlenW (lpString=".dbf") returned 4 [0200.807] lstrcmpiW (lpString1=".dbf", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.807] lstrlenW (lpString=".1cd") returned 4 [0200.807] lstrcmpiW (lpString1=".1cd", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.807] lstrlenW (lpString=".jpg") returned 4 [0200.807] lstrcmpiW (lpString1=".jpg", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.807] lstrlenW (lpString=".doc") returned 4 [0200.807] lstrcmpiW (lpString1=".doc", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString=".docx") returned 5 [0200.807] lstrcmpiW (lpString1=".docx", lpString2="orage") returned -1 [0200.807] lstrlenW (lpString=".pdf") returned 4 [0200.807] lstrcmpiW (lpString1=".pdf", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString=".xls") returned 4 [0200.807] lstrcmpiW (lpString1=".xls", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString=".xlsx") returned 5 [0200.807] lstrcmpiW (lpString1=".xlsx", lpString2="orage") returned -1 [0200.807] lstrlenW (lpString=".ppt") returned 4 [0200.807] lstrcmpiW (lpString1=".ppt", lpString2="rage") returned -1 [0200.807] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.808] lstrlenW (lpString=".zip") returned 4 [0200.808] lstrcmpiW (lpString1=".zip", lpString2="rage") returned -1 [0200.808] lstrlenW (lpString=".rar") returned 4 [0200.808] lstrcmpiW (lpString1=".rar", lpString2="rage") returned -1 [0200.808] lstrlenW (lpString=".bz2") returned 4 [0200.808] lstrcmpiW (lpString1=".bz2", lpString2="rage") returned -1 [0200.808] lstrlenW (lpString=".7z") returned 3 [0200.808] lstrcmpiW (lpString1=".7z", lpString2="age") returned -1 [0200.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.808] lstrlenW (lpString=".dbf") returned 4 [0200.808] lstrcmpiW (lpString1=".dbf", lpString2="rage") returned -1 [0200.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.808] lstrlenW (lpString=".1cd") returned 4 [0200.808] lstrcmpiW (lpString1=".1cd", lpString2="rage") returned -1 [0200.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage") returned 154 [0200.808] lstrlenW (lpString=".jpg") returned 4 [0200.808] lstrcmpiW (lpString1=".jpg", lpString2="rage") returned -1 [0200.808] lstrcmpiW (lpString1=".localstorage-journal", lpString2=".wiki") returned -1 [0200.808] lstrlenW (lpString="chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 72 [0200.808] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\local storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.809] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0200.809] CloseHandle (hObject=0x2d4) returned 1 [0200.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.809] lstrlenW (lpString=".doc") returned 4 [0200.809] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.809] lstrlenW (lpString=".docx") returned 5 [0200.809] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.809] lstrlenW (lpString=".pdf") returned 4 [0200.809] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.809] lstrlenW (lpString=".xls") returned 4 [0200.809] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.809] lstrlenW (lpString=".xlsx") returned 5 [0200.809] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.809] lstrlenW (lpString=".ppt") returned 4 [0200.809] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.809] lstrlenW (lpString=".zip") returned 4 [0200.809] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.809] lstrlenW (lpString=".rar") returned 4 [0200.809] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.809] lstrlenW (lpString=".bz2") returned 4 [0200.809] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.809] lstrlenW (lpString=".7z") returned 3 [0200.809] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.809] lstrlenW (lpString=".dbf") returned 4 [0200.809] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.809] lstrlenW (lpString=".1cd") returned 4 [0200.809] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.810] lstrlenW (lpString=".jpg") returned 4 [0200.810] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.810] lstrlenW (lpString=".doc") returned 4 [0200.810] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.810] lstrlenW (lpString=".docx") returned 5 [0200.810] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.810] lstrlenW (lpString=".pdf") returned 4 [0200.810] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.810] lstrlenW (lpString=".xls") returned 4 [0200.810] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.810] lstrlenW (lpString=".xlsx") returned 5 [0200.810] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.810] lstrlenW (lpString=".ppt") returned 4 [0200.810] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.810] lstrlenW (lpString=".zip") returned 4 [0200.810] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.810] lstrlenW (lpString=".rar") returned 4 [0200.810] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.810] lstrlenW (lpString=".bz2") returned 4 [0200.810] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.810] lstrlenW (lpString=".7z") returned 3 [0200.810] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.810] lstrlenW (lpString=".dbf") returned 4 [0200.810] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.810] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.810] lstrlenW (lpString=".1cd") returned 4 [0200.810] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.811] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Local Storage\\chrome-extension_pkedcjkdefgpdelpbcmbmeomcjbeemfm_0.localstorage-journal") returned 162 [0200.811] lstrlenW (lpString=".jpg") returned 4 [0200.811] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.811] lstrlenW (lpString="Login Data") returned 10 [0200.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.811] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=18432) returned 1 [0200.811] CloseHandle (hObject=0x2d4) returned 1 [0200.811] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data")) returned 0x2020 [0200.811] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.811] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.812] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.812] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.812] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.812] GetLastError () returned 0x0 [0200.812] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x4800, lpOverlapped=0x0) returned 1 [0200.894] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x4810, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x4810, lpOverlapped=0x0) returned 1 [0200.896] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.896] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe8, lpOverlapped=0x0) returned 1 [0200.896] SetEndOfFile (hFile=0x15c) returned 1 [0200.896] CloseHandle (hObject=0x15c) returned 1 [0200.896] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.896] SetEndOfFile (hFile=0x2d4) returned 1 [0200.897] CloseHandle (hObject=0x2d4) returned 1 [0200.897] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.897] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data")) returned 1 [0200.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.897] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.897] lstrlenW (lpString=".doc") returned 4 [0200.897] lstrcmpiW (lpString1=".doc", lpString2="Data") returned -1 [0200.897] lstrlenW (lpString=".docx") returned 5 [0200.897] lstrcmpiW (lpString1=".docx", lpString2=" Data") returned 1 [0200.897] lstrlenW (lpString=".pdf") returned 4 [0200.897] lstrcmpiW (lpString1=".pdf", lpString2="Data") returned -1 [0200.897] lstrlenW (lpString=".xls") returned 4 [0200.897] lstrcmpiW (lpString1=".xls", lpString2="Data") returned -1 [0200.897] lstrlenW (lpString=".xlsx") returned 5 [0200.897] lstrcmpiW (lpString1=".xlsx", lpString2=" Data") returned 1 [0200.897] lstrlenW (lpString=".ppt") returned 4 [0200.898] lstrcmpiW (lpString1=".ppt", lpString2="Data") returned -1 [0200.898] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.898] lstrlenW (lpString=".zip") returned 4 [0200.898] lstrcmpiW (lpString1=".zip", lpString2="Data") returned -1 [0200.898] lstrlenW (lpString=".rar") returned 4 [0200.898] lstrcmpiW (lpString1=".rar", lpString2="Data") returned -1 [0200.898] lstrlenW (lpString=".bz2") returned 4 [0200.898] lstrcmpiW (lpString1=".bz2", lpString2="Data") returned -1 [0200.898] lstrlenW (lpString=".7z") returned 3 [0200.898] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0200.898] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.898] lstrlenW (lpString=".dbf") returned 4 [0200.898] lstrcmpiW (lpString1=".dbf", lpString2="Data") returned -1 [0200.898] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.898] lstrlenW (lpString=".1cd") returned 4 [0200.898] lstrcmpiW (lpString1=".1cd", lpString2="Data") returned -1 [0200.898] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.898] lstrlenW (lpString=".jpg") returned 4 [0200.898] lstrcmpiW (lpString1=".jpg", lpString2="Data") returned -1 [0200.898] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.898] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.898] lstrlenW (lpString=".doc") returned 4 [0200.898] lstrcmpiW (lpString1=".doc", lpString2="Data") returned -1 [0200.898] lstrlenW (lpString=".docx") returned 5 [0200.898] lstrcmpiW (lpString1=".docx", lpString2=" Data") returned 1 [0200.898] lstrlenW (lpString=".pdf") returned 4 [0200.898] lstrcmpiW (lpString1=".pdf", lpString2="Data") returned -1 [0200.898] lstrlenW (lpString=".xls") returned 4 [0200.898] lstrcmpiW (lpString1=".xls", lpString2="Data") returned -1 [0200.898] lstrlenW (lpString=".xlsx") returned 5 [0200.898] lstrcmpiW (lpString1=".xlsx", lpString2=" Data") returned 1 [0200.898] lstrlenW (lpString=".ppt") returned 4 [0200.898] lstrcmpiW (lpString1=".ppt", lpString2="Data") returned -1 [0200.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.899] lstrlenW (lpString=".zip") returned 4 [0200.899] lstrcmpiW (lpString1=".zip", lpString2="Data") returned -1 [0200.899] lstrlenW (lpString=".rar") returned 4 [0200.899] lstrcmpiW (lpString1=".rar", lpString2="Data") returned -1 [0200.899] lstrlenW (lpString=".bz2") returned 4 [0200.899] lstrcmpiW (lpString1=".bz2", lpString2="Data") returned -1 [0200.899] lstrlenW (lpString=".7z") returned 3 [0200.899] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0200.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.899] lstrlenW (lpString=".dbf") returned 4 [0200.899] lstrcmpiW (lpString1=".dbf", lpString2="Data") returned -1 [0200.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.899] lstrlenW (lpString=".1cd") returned 4 [0200.899] lstrcmpiW (lpString1=".1cd", lpString2="Data") returned -1 [0200.899] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data") returned 86 [0200.899] lstrlenW (lpString=".jpg") returned 4 [0200.899] lstrcmpiW (lpString1=".jpg", lpString2="Data") returned -1 [0200.899] lstrlenW (lpString="Login Data-journal") returned 18 [0200.899] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\login data-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.900] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0200.900] CloseHandle (hObject=0x2d4) returned 1 [0200.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.900] lstrlenW (lpString=".doc") returned 4 [0200.900] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.900] lstrlenW (lpString=".docx") returned 5 [0200.900] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.900] lstrlenW (lpString=".pdf") returned 4 [0200.900] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.900] lstrlenW (lpString=".xls") returned 4 [0200.900] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.900] lstrlenW (lpString=".xlsx") returned 5 [0200.900] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.900] lstrlenW (lpString=".ppt") returned 4 [0200.900] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.900] lstrlenW (lpString=".zip") returned 4 [0200.900] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.900] lstrlenW (lpString=".rar") returned 4 [0200.900] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.900] lstrlenW (lpString=".bz2") returned 4 [0200.900] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.900] lstrlenW (lpString=".7z") returned 3 [0200.900] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.900] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.901] lstrlenW (lpString=".dbf") returned 4 [0200.901] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.901] lstrlenW (lpString=".1cd") returned 4 [0200.901] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.901] lstrlenW (lpString=".jpg") returned 4 [0200.901] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.901] lstrlenW (lpString=".doc") returned 4 [0200.901] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.901] lstrlenW (lpString=".docx") returned 5 [0200.901] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.901] lstrlenW (lpString=".pdf") returned 4 [0200.901] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.901] lstrlenW (lpString=".xls") returned 4 [0200.901] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.901] lstrlenW (lpString=".xlsx") returned 5 [0200.901] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.901] lstrlenW (lpString=".ppt") returned 4 [0200.901] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.901] lstrlenW (lpString=".zip") returned 4 [0200.901] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.901] lstrlenW (lpString=".rar") returned 4 [0200.901] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.901] lstrlenW (lpString=".bz2") returned 4 [0200.901] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.901] lstrlenW (lpString=".7z") returned 3 [0200.901] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.901] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.901] lstrlenW (lpString=".dbf") returned 4 [0200.901] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.902] lstrlenW (lpString=".1cd") returned 4 [0200.902] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.902] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data-journal") returned 94 [0200.902] lstrlenW (lpString=".jpg") returned 4 [0200.902] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.902] lstrlenW (lpString="Network Action Predictor") returned 24 [0200.902] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.902] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=15360) returned 1 [0200.902] CloseHandle (hObject=0x2d4) returned 1 [0200.902] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor")) returned 0x2020 [0200.903] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.903] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.903] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.903] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.903] GetLastError () returned 0x0 [0200.903] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x3c00, lpOverlapped=0x0) returned 1 [0200.905] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x3c10, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x3c10, lpOverlapped=0x0) returned 1 [0200.906] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.906] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x104, lpOverlapped=0x0) returned 1 [0200.906] SetEndOfFile (hFile=0x15c) returned 1 [0200.907] CloseHandle (hObject=0x15c) returned 1 [0200.907] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.907] SetEndOfFile (hFile=0x2d4) returned 1 [0200.907] CloseHandle (hObject=0x2d4) returned 1 [0200.908] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.908] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor")) returned 1 [0200.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.908] lstrlenW (lpString=".doc") returned 4 [0200.908] lstrcmpiW (lpString1=".doc", lpString2="ctor") returned -1 [0200.908] lstrlenW (lpString=".docx") returned 5 [0200.908] lstrcmpiW (lpString1=".docx", lpString2="ictor") returned -1 [0200.908] lstrlenW (lpString=".pdf") returned 4 [0200.908] lstrcmpiW (lpString1=".pdf", lpString2="ctor") returned -1 [0200.908] lstrlenW (lpString=".xls") returned 4 [0200.908] lstrcmpiW (lpString1=".xls", lpString2="ctor") returned -1 [0200.908] lstrlenW (lpString=".xlsx") returned 5 [0200.908] lstrcmpiW (lpString1=".xlsx", lpString2="ictor") returned -1 [0200.908] lstrlenW (lpString=".ppt") returned 4 [0200.908] lstrcmpiW (lpString1=".ppt", lpString2="ctor") returned -1 [0200.908] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.908] lstrlenW (lpString=".zip") returned 4 [0200.908] lstrcmpiW (lpString1=".zip", lpString2="ctor") returned -1 [0200.908] lstrlenW (lpString=".rar") returned 4 [0200.908] lstrcmpiW (lpString1=".rar", lpString2="ctor") returned -1 [0200.908] lstrlenW (lpString=".bz2") returned 4 [0200.908] lstrcmpiW (lpString1=".bz2", lpString2="ctor") returned -1 [0200.909] lstrlenW (lpString=".7z") returned 3 [0200.909] lstrcmpiW (lpString1=".7z", lpString2="tor") returned -1 [0200.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.909] lstrlenW (lpString=".dbf") returned 4 [0200.909] lstrcmpiW (lpString1=".dbf", lpString2="ctor") returned -1 [0200.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.909] lstrlenW (lpString=".1cd") returned 4 [0200.909] lstrcmpiW (lpString1=".1cd", lpString2="ctor") returned -1 [0200.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.909] lstrlenW (lpString=".jpg") returned 4 [0200.909] lstrcmpiW (lpString1=".jpg", lpString2="ctor") returned -1 [0200.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.909] lstrlenW (lpString=".doc") returned 4 [0200.909] lstrcmpiW (lpString1=".doc", lpString2="ctor") returned -1 [0200.909] lstrlenW (lpString=".docx") returned 5 [0200.909] lstrcmpiW (lpString1=".docx", lpString2="ictor") returned -1 [0200.909] lstrlenW (lpString=".pdf") returned 4 [0200.909] lstrcmpiW (lpString1=".pdf", lpString2="ctor") returned -1 [0200.909] lstrlenW (lpString=".xls") returned 4 [0200.909] lstrcmpiW (lpString1=".xls", lpString2="ctor") returned -1 [0200.909] lstrlenW (lpString=".xlsx") returned 5 [0200.909] lstrcmpiW (lpString1=".xlsx", lpString2="ictor") returned -1 [0200.909] lstrlenW (lpString=".ppt") returned 4 [0200.909] lstrcmpiW (lpString1=".ppt", lpString2="ctor") returned -1 [0200.909] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.909] lstrlenW (lpString=".zip") returned 4 [0200.909] lstrcmpiW (lpString1=".zip", lpString2="ctor") returned -1 [0200.909] lstrlenW (lpString=".rar") returned 4 [0200.909] lstrcmpiW (lpString1=".rar", lpString2="ctor") returned -1 [0200.909] lstrlenW (lpString=".bz2") returned 4 [0200.909] lstrcmpiW (lpString1=".bz2", lpString2="ctor") returned -1 [0200.910] lstrlenW (lpString=".7z") returned 3 [0200.910] lstrcmpiW (lpString1=".7z", lpString2="tor") returned -1 [0200.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.910] lstrlenW (lpString=".dbf") returned 4 [0200.910] lstrcmpiW (lpString1=".dbf", lpString2="ctor") returned -1 [0200.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.910] lstrlenW (lpString=".1cd") returned 4 [0200.910] lstrcmpiW (lpString1=".1cd", lpString2="ctor") returned -1 [0200.910] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor") returned 100 [0200.910] lstrlenW (lpString=".jpg") returned 4 [0200.910] lstrcmpiW (lpString1=".jpg", lpString2="ctor") returned -1 [0200.910] lstrlenW (lpString="Network Action Predictor-journal") returned 32 [0200.910] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network action predictor-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.910] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0200.910] CloseHandle (hObject=0x2d4) returned 1 [0200.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.911] lstrlenW (lpString=".doc") returned 4 [0200.911] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.911] lstrlenW (lpString=".docx") returned 5 [0200.911] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.911] lstrlenW (lpString=".pdf") returned 4 [0200.911] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.911] lstrlenW (lpString=".xls") returned 4 [0200.911] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.911] lstrlenW (lpString=".xlsx") returned 5 [0200.911] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.911] lstrlenW (lpString=".ppt") returned 4 [0200.911] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.911] lstrlenW (lpString=".zip") returned 4 [0200.911] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.911] lstrlenW (lpString=".rar") returned 4 [0200.911] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.911] lstrlenW (lpString=".bz2") returned 4 [0200.911] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.911] lstrlenW (lpString=".7z") returned 3 [0200.911] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.911] lstrlenW (lpString=".dbf") returned 4 [0200.911] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.911] lstrlenW (lpString=".1cd") returned 4 [0200.911] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.911] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.911] lstrlenW (lpString=".jpg") returned 4 [0200.911] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.912] lstrlenW (lpString=".doc") returned 4 [0200.912] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.912] lstrlenW (lpString=".docx") returned 5 [0200.912] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.912] lstrlenW (lpString=".pdf") returned 4 [0200.912] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.912] lstrlenW (lpString=".xls") returned 4 [0200.912] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.912] lstrlenW (lpString=".xlsx") returned 5 [0200.912] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.912] lstrlenW (lpString=".ppt") returned 4 [0200.912] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.912] lstrlenW (lpString=".zip") returned 4 [0200.912] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.912] lstrlenW (lpString=".rar") returned 4 [0200.912] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.912] lstrlenW (lpString=".bz2") returned 4 [0200.912] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.912] lstrlenW (lpString=".7z") returned 3 [0200.912] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.912] lstrlenW (lpString=".dbf") returned 4 [0200.912] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.912] lstrlenW (lpString=".1cd") returned 4 [0200.912] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.912] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Action Predictor-journal") returned 108 [0200.912] lstrlenW (lpString=".jpg") returned 4 [0200.912] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.913] lstrlenW (lpString="Network Persistent State") returned 24 [0200.913] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.913] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=40) returned 1 [0200.913] CloseHandle (hObject=0x2d4) returned 1 [0200.916] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state")) returned 0x2020 [0200.916] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.916] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.916] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.916] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.917] GetLastError () returned 0x0 [0200.917] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x28, lpOverlapped=0x0) returned 1 [0200.917] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x30, lpOverlapped=0x0) returned 1 [0200.918] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.918] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x104, lpOverlapped=0x0) returned 1 [0200.918] SetEndOfFile (hFile=0x15c) returned 1 [0200.919] CloseHandle (hObject=0x15c) returned 1 [0200.919] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.919] SetEndOfFile (hFile=0x2d4) returned 1 [0200.919] CloseHandle (hObject=0x2d4) returned 1 [0200.919] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.920] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\network persistent state")) returned 1 [0200.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.920] lstrlenW (lpString=".doc") returned 4 [0200.920] lstrcmpiW (lpString1=".doc", lpString2="tate") returned -1 [0200.920] lstrlenW (lpString=".docx") returned 5 [0200.920] lstrcmpiW (lpString1=".docx", lpString2="State") returned -1 [0200.920] lstrlenW (lpString=".pdf") returned 4 [0200.920] lstrcmpiW (lpString1=".pdf", lpString2="tate") returned -1 [0200.920] lstrlenW (lpString=".xls") returned 4 [0200.920] lstrcmpiW (lpString1=".xls", lpString2="tate") returned -1 [0200.920] lstrlenW (lpString=".xlsx") returned 5 [0200.920] lstrcmpiW (lpString1=".xlsx", lpString2="State") returned -1 [0200.920] lstrlenW (lpString=".ppt") returned 4 [0200.920] lstrcmpiW (lpString1=".ppt", lpString2="tate") returned -1 [0200.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.920] lstrlenW (lpString=".zip") returned 4 [0200.920] lstrcmpiW (lpString1=".zip", lpString2="tate") returned -1 [0200.920] lstrlenW (lpString=".rar") returned 4 [0200.920] lstrcmpiW (lpString1=".rar", lpString2="tate") returned -1 [0200.920] lstrlenW (lpString=".bz2") returned 4 [0200.920] lstrcmpiW (lpString1=".bz2", lpString2="tate") returned -1 [0200.920] lstrlenW (lpString=".7z") returned 3 [0200.920] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0200.920] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.920] lstrlenW (lpString=".dbf") returned 4 [0200.920] lstrcmpiW (lpString1=".dbf", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.921] lstrlenW (lpString=".1cd") returned 4 [0200.921] lstrcmpiW (lpString1=".1cd", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.921] lstrlenW (lpString=".jpg") returned 4 [0200.921] lstrcmpiW (lpString1=".jpg", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.921] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.921] lstrlenW (lpString=".doc") returned 4 [0200.921] lstrcmpiW (lpString1=".doc", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString=".docx") returned 5 [0200.921] lstrcmpiW (lpString1=".docx", lpString2="State") returned -1 [0200.921] lstrlenW (lpString=".pdf") returned 4 [0200.921] lstrcmpiW (lpString1=".pdf", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString=".xls") returned 4 [0200.921] lstrcmpiW (lpString1=".xls", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString=".xlsx") returned 5 [0200.921] lstrcmpiW (lpString1=".xlsx", lpString2="State") returned -1 [0200.921] lstrlenW (lpString=".ppt") returned 4 [0200.921] lstrcmpiW (lpString1=".ppt", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.921] lstrlenW (lpString=".zip") returned 4 [0200.921] lstrcmpiW (lpString1=".zip", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString=".rar") returned 4 [0200.921] lstrcmpiW (lpString1=".rar", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString=".bz2") returned 4 [0200.921] lstrcmpiW (lpString1=".bz2", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString=".7z") returned 3 [0200.921] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0200.921] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.921] lstrlenW (lpString=".dbf") returned 4 [0200.921] lstrcmpiW (lpString1=".dbf", lpString2="tate") returned -1 [0200.921] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.921] lstrlenW (lpString=".1cd") returned 4 [0200.921] lstrcmpiW (lpString1=".1cd", lpString2="tate") returned -1 [0200.922] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Network Persistent State") returned 100 [0200.922] lstrlenW (lpString=".jpg") returned 4 [0200.922] lstrcmpiW (lpString1=".jpg", lpString2="tate") returned -1 [0200.922] lstrlenW (lpString="Origin Bound Certs") returned 18 [0200.922] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.923] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=5120) returned 1 [0200.923] CloseHandle (hObject=0x2d4) returned 1 [0200.923] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs")) returned 0x2020 [0200.923] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.923] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.924] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.924] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.924] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.924] GetLastError () returned 0x0 [0200.924] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x1400, lpOverlapped=0x0) returned 1 [0200.926] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1410, lpOverlapped=0x0) returned 1 [0200.927] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0200.927] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf8, lpOverlapped=0x0) returned 1 [0200.927] SetEndOfFile (hFile=0x15c) returned 1 [0200.927] CloseHandle (hObject=0x15c) returned 1 [0200.927] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.927] SetEndOfFile (hFile=0x2d4) returned 1 [0200.928] CloseHandle (hObject=0x2d4) returned 1 [0200.928] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.928] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs")) returned 1 [0200.928] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.928] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.928] lstrlenW (lpString=".doc") returned 4 [0200.928] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0200.928] lstrlenW (lpString=".docx") returned 5 [0200.928] lstrcmpiW (lpString1=".docx", lpString2="Certs") returned -1 [0200.928] lstrlenW (lpString=".pdf") returned 4 [0200.928] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0200.928] lstrlenW (lpString=".xls") returned 4 [0200.928] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0200.928] lstrlenW (lpString=".xlsx") returned 5 [0200.929] lstrcmpiW (lpString1=".xlsx", lpString2="Certs") returned -1 [0200.929] lstrlenW (lpString=".ppt") returned 4 [0200.929] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0200.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.929] lstrlenW (lpString=".zip") returned 4 [0200.929] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0200.929] lstrlenW (lpString=".rar") returned 4 [0200.929] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0200.929] lstrlenW (lpString=".bz2") returned 4 [0200.929] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0200.929] lstrlenW (lpString=".7z") returned 3 [0200.929] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0200.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.929] lstrlenW (lpString=".dbf") returned 4 [0200.929] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0200.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.929] lstrlenW (lpString=".1cd") returned 4 [0200.929] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0200.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.929] lstrlenW (lpString=".jpg") returned 4 [0200.929] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0200.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.929] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.929] lstrlenW (lpString=".doc") returned 4 [0200.929] lstrcmpiW (lpString1=".doc", lpString2="erts") returned -1 [0200.929] lstrlenW (lpString=".docx") returned 5 [0200.929] lstrcmpiW (lpString1=".docx", lpString2="Certs") returned -1 [0200.929] lstrlenW (lpString=".pdf") returned 4 [0200.929] lstrcmpiW (lpString1=".pdf", lpString2="erts") returned -1 [0200.929] lstrlenW (lpString=".xls") returned 4 [0200.929] lstrcmpiW (lpString1=".xls", lpString2="erts") returned -1 [0200.929] lstrlenW (lpString=".xlsx") returned 5 [0200.929] lstrcmpiW (lpString1=".xlsx", lpString2="Certs") returned -1 [0200.929] lstrlenW (lpString=".ppt") returned 4 [0200.930] lstrcmpiW (lpString1=".ppt", lpString2="erts") returned -1 [0200.930] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.930] lstrlenW (lpString=".zip") returned 4 [0200.930] lstrcmpiW (lpString1=".zip", lpString2="erts") returned -1 [0200.930] lstrlenW (lpString=".rar") returned 4 [0200.930] lstrcmpiW (lpString1=".rar", lpString2="erts") returned -1 [0200.930] lstrlenW (lpString=".bz2") returned 4 [0200.930] lstrcmpiW (lpString1=".bz2", lpString2="erts") returned -1 [0200.930] lstrlenW (lpString=".7z") returned 3 [0200.930] lstrcmpiW (lpString1=".7z", lpString2="rts") returned -1 [0200.930] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.930] lstrlenW (lpString=".dbf") returned 4 [0200.930] lstrcmpiW (lpString1=".dbf", lpString2="erts") returned -1 [0200.930] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.930] lstrlenW (lpString=".1cd") returned 4 [0200.930] lstrcmpiW (lpString1=".1cd", lpString2="erts") returned -1 [0200.930] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs") returned 94 [0200.930] lstrlenW (lpString=".jpg") returned 4 [0200.930] lstrcmpiW (lpString1=".jpg", lpString2="erts") returned -1 [0200.930] lstrlenW (lpString="Origin Bound Certs-journal") returned 26 [0200.930] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\origin bound certs-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.931] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0200.931] CloseHandle (hObject=0x2d4) returned 1 [0200.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.931] lstrlenW (lpString=".doc") returned 4 [0200.931] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.931] lstrlenW (lpString=".docx") returned 5 [0200.931] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.931] lstrlenW (lpString=".pdf") returned 4 [0200.931] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.931] lstrlenW (lpString=".xls") returned 4 [0200.931] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.931] lstrlenW (lpString=".xlsx") returned 5 [0200.931] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.931] lstrlenW (lpString=".ppt") returned 4 [0200.931] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.931] lstrlenW (lpString=".zip") returned 4 [0200.931] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.931] lstrlenW (lpString=".rar") returned 4 [0200.931] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.931] lstrlenW (lpString=".bz2") returned 4 [0200.931] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.931] lstrlenW (lpString=".7z") returned 3 [0200.931] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.931] lstrlenW (lpString=".dbf") returned 4 [0200.931] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.931] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.931] lstrlenW (lpString=".1cd") returned 4 [0200.932] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.932] lstrlenW (lpString=".jpg") returned 4 [0200.932] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.932] lstrlenW (lpString=".doc") returned 4 [0200.932] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString=".docx") returned 5 [0200.932] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.932] lstrlenW (lpString=".pdf") returned 4 [0200.932] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString=".xls") returned 4 [0200.932] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString=".xlsx") returned 5 [0200.932] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.932] lstrlenW (lpString=".ppt") returned 4 [0200.932] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.932] lstrlenW (lpString=".zip") returned 4 [0200.932] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString=".rar") returned 4 [0200.932] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString=".bz2") returned 4 [0200.932] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString=".7z") returned 3 [0200.932] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.932] lstrlenW (lpString=".dbf") returned 4 [0200.932] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.932] lstrlenW (lpString=".1cd") returned 4 [0200.932] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.932] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Origin Bound Certs-journal") returned 102 [0200.933] lstrlenW (lpString=".jpg") returned 4 [0200.933] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.933] lstrlenW (lpString="Preferences") returned 11 [0200.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.933] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=6813) returned 1 [0200.933] CloseHandle (hObject=0x2d4) returned 1 [0200.933] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences")) returned 0x2020 [0200.933] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.933] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.933] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.934] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0200.934] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.934] GetLastError () returned 0x0 [0200.934] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x1a9d, lpOverlapped=0x0) returned 1 [0201.188] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0201.189] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.189] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0201.189] SetEndOfFile (hFile=0x15c) returned 1 [0201.190] CloseHandle (hObject=0x15c) returned 1 [0201.190] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.190] SetEndOfFile (hFile=0x2d4) returned 1 [0201.191] CloseHandle (hObject=0x2d4) returned 1 [0201.191] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.191] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\preferences")) returned 1 [0201.191] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.191] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.191] lstrlenW (lpString=".doc") returned 4 [0201.191] lstrcmpiW (lpString1=".doc", lpString2="nces") returned -1 [0201.191] lstrlenW (lpString=".docx") returned 5 [0201.191] lstrcmpiW (lpString1=".docx", lpString2="ences") returned -1 [0201.191] lstrlenW (lpString=".pdf") returned 4 [0201.191] lstrcmpiW (lpString1=".pdf", lpString2="nces") returned -1 [0201.191] lstrlenW (lpString=".xls") returned 4 [0201.191] lstrcmpiW (lpString1=".xls", lpString2="nces") returned -1 [0201.191] lstrlenW (lpString=".xlsx") returned 5 [0201.191] lstrcmpiW (lpString1=".xlsx", lpString2="ences") returned -1 [0201.191] lstrlenW (lpString=".ppt") returned 4 [0201.191] lstrcmpiW (lpString1=".ppt", lpString2="nces") returned -1 [0201.191] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.191] lstrlenW (lpString=".zip") returned 4 [0201.191] lstrcmpiW (lpString1=".zip", lpString2="nces") returned -1 [0201.191] lstrlenW (lpString=".rar") returned 4 [0201.192] lstrcmpiW (lpString1=".rar", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString=".bz2") returned 4 [0201.192] lstrcmpiW (lpString1=".bz2", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString=".7z") returned 3 [0201.192] lstrcmpiW (lpString1=".7z", lpString2="ces") returned -1 [0201.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.192] lstrlenW (lpString=".dbf") returned 4 [0201.192] lstrcmpiW (lpString1=".dbf", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.192] lstrlenW (lpString=".1cd") returned 4 [0201.192] lstrcmpiW (lpString1=".1cd", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.192] lstrlenW (lpString=".jpg") returned 4 [0201.192] lstrcmpiW (lpString1=".jpg", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.192] lstrlenW (lpString=".doc") returned 4 [0201.192] lstrcmpiW (lpString1=".doc", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString=".docx") returned 5 [0201.192] lstrcmpiW (lpString1=".docx", lpString2="ences") returned -1 [0201.192] lstrlenW (lpString=".pdf") returned 4 [0201.192] lstrcmpiW (lpString1=".pdf", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString=".xls") returned 4 [0201.192] lstrcmpiW (lpString1=".xls", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString=".xlsx") returned 5 [0201.192] lstrcmpiW (lpString1=".xlsx", lpString2="ences") returned -1 [0201.192] lstrlenW (lpString=".ppt") returned 4 [0201.192] lstrcmpiW (lpString1=".ppt", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.192] lstrlenW (lpString=".zip") returned 4 [0201.192] lstrcmpiW (lpString1=".zip", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString=".rar") returned 4 [0201.192] lstrcmpiW (lpString1=".rar", lpString2="nces") returned -1 [0201.192] lstrlenW (lpString=".bz2") returned 4 [0201.193] lstrcmpiW (lpString1=".bz2", lpString2="nces") returned -1 [0201.193] lstrlenW (lpString=".7z") returned 3 [0201.193] lstrcmpiW (lpString1=".7z", lpString2="ces") returned -1 [0201.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.193] lstrlenW (lpString=".dbf") returned 4 [0201.193] lstrcmpiW (lpString1=".dbf", lpString2="nces") returned -1 [0201.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.193] lstrlenW (lpString=".1cd") returned 4 [0201.193] lstrcmpiW (lpString1=".1cd", lpString2="nces") returned -1 [0201.193] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Preferences") returned 87 [0201.193] lstrlenW (lpString=".jpg") returned 4 [0201.193] lstrcmpiW (lpString1=".jpg", lpString2="nces") returned -1 [0201.193] lstrlenW (lpString="TransportSecurity") returned 17 [0201.193] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.193] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=632) returned 1 [0201.193] CloseHandle (hObject=0x2d4) returned 1 [0201.194] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity")) returned 0x2020 [0201.194] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.194] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.194] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.194] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.194] GetLastError () returned 0x0 [0201.194] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x278, lpOverlapped=0x0) returned 1 [0201.196] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x280, lpOverlapped=0x0) returned 1 [0201.197] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.197] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0201.197] SetEndOfFile (hFile=0x15c) returned 1 [0201.197] CloseHandle (hObject=0x15c) returned 1 [0201.197] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.197] SetEndOfFile (hFile=0x2d4) returned 1 [0201.198] CloseHandle (hObject=0x2d4) returned 1 [0201.198] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.198] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\transportsecurity")) returned 1 [0201.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.198] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.199] lstrlenW (lpString=".doc") returned 4 [0201.199] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0201.199] lstrlenW (lpString=".docx") returned 5 [0201.199] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0201.199] lstrlenW (lpString=".pdf") returned 4 [0201.199] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0201.199] lstrlenW (lpString=".xls") returned 4 [0201.199] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0201.199] lstrlenW (lpString=".xlsx") returned 5 [0201.199] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0201.199] lstrlenW (lpString=".ppt") returned 4 [0201.199] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0201.199] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.199] lstrlenW (lpString=".zip") returned 4 [0201.199] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0201.199] lstrlenW (lpString=".rar") returned 4 [0201.199] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0201.199] lstrlenW (lpString=".bz2") returned 4 [0201.199] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0201.199] lstrlenW (lpString=".7z") returned 3 [0201.199] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0201.199] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.199] lstrlenW (lpString=".dbf") returned 4 [0201.199] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0201.199] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.199] lstrlenW (lpString=".1cd") returned 4 [0201.199] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0201.199] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.199] lstrlenW (lpString=".jpg") returned 4 [0201.199] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0201.199] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.199] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.199] lstrlenW (lpString=".doc") returned 4 [0201.199] lstrcmpiW (lpString1=".doc", lpString2="rity") returned -1 [0201.200] lstrlenW (lpString=".docx") returned 5 [0201.200] lstrcmpiW (lpString1=".docx", lpString2="urity") returned -1 [0201.200] lstrlenW (lpString=".pdf") returned 4 [0201.200] lstrcmpiW (lpString1=".pdf", lpString2="rity") returned -1 [0201.200] lstrlenW (lpString=".xls") returned 4 [0201.200] lstrcmpiW (lpString1=".xls", lpString2="rity") returned -1 [0201.200] lstrlenW (lpString=".xlsx") returned 5 [0201.200] lstrcmpiW (lpString1=".xlsx", lpString2="urity") returned -1 [0201.200] lstrlenW (lpString=".ppt") returned 4 [0201.200] lstrcmpiW (lpString1=".ppt", lpString2="rity") returned -1 [0201.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.200] lstrlenW (lpString=".zip") returned 4 [0201.200] lstrcmpiW (lpString1=".zip", lpString2="rity") returned -1 [0201.200] lstrlenW (lpString=".rar") returned 4 [0201.200] lstrcmpiW (lpString1=".rar", lpString2="rity") returned -1 [0201.200] lstrlenW (lpString=".bz2") returned 4 [0201.200] lstrcmpiW (lpString1=".bz2", lpString2="rity") returned -1 [0201.200] lstrlenW (lpString=".7z") returned 3 [0201.200] lstrcmpiW (lpString1=".7z", lpString2="ity") returned -1 [0201.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.200] lstrlenW (lpString=".dbf") returned 4 [0201.200] lstrcmpiW (lpString1=".dbf", lpString2="rity") returned -1 [0201.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.200] lstrlenW (lpString=".1cd") returned 4 [0201.200] lstrcmpiW (lpString1=".1cd", lpString2="rity") returned -1 [0201.200] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\TransportSecurity") returned 93 [0201.200] lstrlenW (lpString=".jpg") returned 4 [0201.200] lstrcmpiW (lpString1=".jpg", lpString2="rity") returned -1 [0201.200] lstrlenW (lpString="Visited Links") returned 13 [0201.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.201] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=131072) returned 1 [0201.201] CloseHandle (hObject=0x2d4) returned 1 [0201.201] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links")) returned 0x2020 [0201.201] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.201] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.201] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.201] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.202] GetLastError () returned 0x0 [0201.202] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x20000, lpOverlapped=0x0) returned 1 [0201.206] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x20010, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x20010, lpOverlapped=0x0) returned 1 [0201.209] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.209] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xee, lpOverlapped=0x0) returned 1 [0201.209] SetEndOfFile (hFile=0x15c) returned 1 [0201.209] CloseHandle (hObject=0x15c) returned 1 [0201.209] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.209] SetEndOfFile (hFile=0x2d4) returned 1 [0201.211] CloseHandle (hObject=0x2d4) returned 1 [0201.211] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.211] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\visited links")) returned 1 [0201.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.211] lstrlenW (lpString=".doc") returned 4 [0201.211] lstrcmpiW (lpString1=".doc", lpString2="inks") returned -1 [0201.211] lstrlenW (lpString=".docx") returned 5 [0201.211] lstrcmpiW (lpString1=".docx", lpString2="Links") returned -1 [0201.211] lstrlenW (lpString=".pdf") returned 4 [0201.211] lstrcmpiW (lpString1=".pdf", lpString2="inks") returned -1 [0201.211] lstrlenW (lpString=".xls") returned 4 [0201.211] lstrcmpiW (lpString1=".xls", lpString2="inks") returned -1 [0201.211] lstrlenW (lpString=".xlsx") returned 5 [0201.211] lstrcmpiW (lpString1=".xlsx", lpString2="Links") returned -1 [0201.211] lstrlenW (lpString=".ppt") returned 4 [0201.211] lstrcmpiW (lpString1=".ppt", lpString2="inks") returned -1 [0201.211] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.211] lstrlenW (lpString=".zip") returned 4 [0201.211] lstrcmpiW (lpString1=".zip", lpString2="inks") returned -1 [0201.211] lstrlenW (lpString=".rar") returned 4 [0201.211] lstrcmpiW (lpString1=".rar", lpString2="inks") returned -1 [0201.211] lstrlenW (lpString=".bz2") returned 4 [0201.211] lstrcmpiW (lpString1=".bz2", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString=".7z") returned 3 [0201.212] lstrcmpiW (lpString1=".7z", lpString2="nks") returned -1 [0201.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.212] lstrlenW (lpString=".dbf") returned 4 [0201.212] lstrcmpiW (lpString1=".dbf", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.212] lstrlenW (lpString=".1cd") returned 4 [0201.212] lstrcmpiW (lpString1=".1cd", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.212] lstrlenW (lpString=".jpg") returned 4 [0201.212] lstrcmpiW (lpString1=".jpg", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.212] lstrlenW (lpString=".doc") returned 4 [0201.212] lstrcmpiW (lpString1=".doc", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString=".docx") returned 5 [0201.212] lstrcmpiW (lpString1=".docx", lpString2="Links") returned -1 [0201.212] lstrlenW (lpString=".pdf") returned 4 [0201.212] lstrcmpiW (lpString1=".pdf", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString=".xls") returned 4 [0201.212] lstrcmpiW (lpString1=".xls", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString=".xlsx") returned 5 [0201.212] lstrcmpiW (lpString1=".xlsx", lpString2="Links") returned -1 [0201.212] lstrlenW (lpString=".ppt") returned 4 [0201.212] lstrcmpiW (lpString1=".ppt", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.212] lstrlenW (lpString=".zip") returned 4 [0201.212] lstrcmpiW (lpString1=".zip", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString=".rar") returned 4 [0201.212] lstrcmpiW (lpString1=".rar", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString=".bz2") returned 4 [0201.212] lstrcmpiW (lpString1=".bz2", lpString2="inks") returned -1 [0201.212] lstrlenW (lpString=".7z") returned 3 [0201.213] lstrcmpiW (lpString1=".7z", lpString2="nks") returned -1 [0201.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.213] lstrlenW (lpString=".dbf") returned 4 [0201.213] lstrcmpiW (lpString1=".dbf", lpString2="inks") returned -1 [0201.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.213] lstrlenW (lpString=".1cd") returned 4 [0201.213] lstrcmpiW (lpString1=".1cd", lpString2="inks") returned -1 [0201.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Visited Links") returned 89 [0201.213] lstrlenW (lpString=".jpg") returned 4 [0201.213] lstrcmpiW (lpString1=".jpg", lpString2="inks") returned -1 [0201.213] lstrcmpiW (lpString1=".ico", lpString2=".wiki") returned -1 [0201.213] lstrlenW (lpString="Google Docs.ico") returned 15 [0201.213] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.214] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=167414) returned 1 [0201.214] CloseHandle (hObject=0x2d4) returned 1 [0201.214] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico")) returned 0x2020 [0201.214] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.214] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.214] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.214] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.216] GetLastError () returned 0x0 [0201.216] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x28df6, lpOverlapped=0x0) returned 1 [0201.221] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x28e00, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x28e00, lpOverlapped=0x0) returned 1 [0201.224] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.224] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0201.224] SetEndOfFile (hFile=0x15c) returned 1 [0201.224] CloseHandle (hObject=0x15c) returned 1 [0201.224] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.224] SetEndOfFile (hFile=0x2d4) returned 1 [0201.226] CloseHandle (hObject=0x2d4) returned 1 [0201.226] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.226] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico")) returned 1 [0201.226] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.226] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.226] lstrlenW (lpString=".doc") returned 4 [0201.226] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0201.226] lstrlenW (lpString=".docx") returned 5 [0201.226] lstrcmpiW (lpString1=".docx", lpString2="s.ico") returned -1 [0201.226] lstrlenW (lpString=".pdf") returned 4 [0201.226] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0201.226] lstrlenW (lpString=".xls") returned 4 [0201.227] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0201.227] lstrlenW (lpString=".xlsx") returned 5 [0201.227] lstrcmpiW (lpString1=".xlsx", lpString2="s.ico") returned -1 [0201.227] lstrlenW (lpString=".ppt") returned 4 [0201.227] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0201.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.227] lstrlenW (lpString=".zip") returned 4 [0201.227] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0201.227] lstrlenW (lpString=".rar") returned 4 [0201.227] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0201.227] lstrlenW (lpString=".bz2") returned 4 [0201.227] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0201.227] lstrlenW (lpString=".7z") returned 3 [0201.227] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0201.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.227] lstrlenW (lpString=".dbf") returned 4 [0201.227] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0201.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.227] lstrlenW (lpString=".1cd") returned 4 [0201.227] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0201.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.227] lstrlenW (lpString=".jpg") returned 4 [0201.227] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0201.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.227] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.227] lstrlenW (lpString=".doc") returned 4 [0201.227] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0201.227] lstrlenW (lpString=".docx") returned 5 [0201.227] lstrcmpiW (lpString1=".docx", lpString2="s.ico") returned -1 [0201.227] lstrlenW (lpString=".pdf") returned 4 [0201.227] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0201.227] lstrlenW (lpString=".xls") returned 4 [0201.227] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0201.228] lstrlenW (lpString=".xlsx") returned 5 [0201.228] lstrcmpiW (lpString1=".xlsx", lpString2="s.ico") returned -1 [0201.228] lstrlenW (lpString=".ppt") returned 4 [0201.228] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0201.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.228] lstrlenW (lpString=".zip") returned 4 [0201.228] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0201.228] lstrlenW (lpString=".rar") returned 4 [0201.228] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0201.228] lstrlenW (lpString=".bz2") returned 4 [0201.228] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0201.228] lstrlenW (lpString=".7z") returned 3 [0201.228] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0201.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.228] lstrlenW (lpString=".dbf") returned 4 [0201.228] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0201.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.228] lstrlenW (lpString=".1cd") returned 4 [0201.228] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0201.228] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico") returned 146 [0201.228] lstrlenW (lpString=".jpg") returned 4 [0201.228] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0201.228] lstrcmpiW (lpString1=".md5", lpString2=".wiki") returned -1 [0201.228] lstrlenW (lpString="Google Docs.ico.md5") returned 19 [0201.228] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.229] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=16) returned 1 [0201.229] CloseHandle (hObject=0x2d4) returned 1 [0201.229] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5")) returned 0x2020 [0201.229] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.229] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.229] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.229] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.230] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.230] GetLastError () returned 0x0 [0201.230] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x10, lpOverlapped=0x0) returned 1 [0201.231] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x20, lpOverlapped=0x0) returned 1 [0201.232] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.232] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xfa, lpOverlapped=0x0) returned 1 [0201.232] SetEndOfFile (hFile=0x15c) returned 1 [0201.232] CloseHandle (hObject=0x15c) returned 1 [0201.232] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.232] SetEndOfFile (hFile=0x2d4) returned 1 [0201.233] CloseHandle (hObject=0x2d4) returned 1 [0201.233] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.233] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web applications\\_crx_aohghmighlieiainnegkcijnfilokake\\google docs.ico.md5")) returned 1 [0201.233] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.233] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.233] lstrlenW (lpString=".doc") returned 4 [0201.234] lstrcmpiW (lpString1=".doc", lpString2=".md5") returned -1 [0201.234] lstrlenW (lpString=".docx") returned 5 [0201.234] lstrcmpiW (lpString1=".docx", lpString2="o.md5") returned -1 [0201.234] lstrlenW (lpString=".pdf") returned 4 [0201.234] lstrcmpiW (lpString1=".pdf", lpString2=".md5") returned 1 [0201.234] lstrlenW (lpString=".xls") returned 4 [0201.234] lstrcmpiW (lpString1=".xls", lpString2=".md5") returned 1 [0201.234] lstrlenW (lpString=".xlsx") returned 5 [0201.234] lstrcmpiW (lpString1=".xlsx", lpString2="o.md5") returned -1 [0201.234] lstrlenW (lpString=".ppt") returned 4 [0201.234] lstrcmpiW (lpString1=".ppt", lpString2=".md5") returned 1 [0201.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.234] lstrlenW (lpString=".zip") returned 4 [0201.234] lstrcmpiW (lpString1=".zip", lpString2=".md5") returned 1 [0201.234] lstrlenW (lpString=".rar") returned 4 [0201.234] lstrcmpiW (lpString1=".rar", lpString2=".md5") returned 1 [0201.234] lstrlenW (lpString=".bz2") returned 4 [0201.234] lstrcmpiW (lpString1=".bz2", lpString2=".md5") returned -1 [0201.234] lstrlenW (lpString=".7z") returned 3 [0201.234] lstrcmpiW (lpString1=".7z", lpString2="md5") returned -1 [0201.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.234] lstrlenW (lpString=".dbf") returned 4 [0201.234] lstrcmpiW (lpString1=".dbf", lpString2=".md5") returned -1 [0201.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.234] lstrlenW (lpString=".1cd") returned 4 [0201.234] lstrcmpiW (lpString1=".1cd", lpString2=".md5") returned -1 [0201.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.234] lstrlenW (lpString=".jpg") returned 4 [0201.234] lstrcmpiW (lpString1=".jpg", lpString2=".md5") returned -1 [0201.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.234] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.234] lstrlenW (lpString=".doc") returned 4 [0201.234] lstrcmpiW (lpString1=".doc", lpString2=".md5") returned -1 [0201.234] lstrlenW (lpString=".docx") returned 5 [0201.235] lstrcmpiW (lpString1=".docx", lpString2="o.md5") returned -1 [0201.235] lstrlenW (lpString=".pdf") returned 4 [0201.235] lstrcmpiW (lpString1=".pdf", lpString2=".md5") returned 1 [0201.235] lstrlenW (lpString=".xls") returned 4 [0201.235] lstrcmpiW (lpString1=".xls", lpString2=".md5") returned 1 [0201.235] lstrlenW (lpString=".xlsx") returned 5 [0201.235] lstrcmpiW (lpString1=".xlsx", lpString2="o.md5") returned -1 [0201.235] lstrlenW (lpString=".ppt") returned 4 [0201.235] lstrcmpiW (lpString1=".ppt", lpString2=".md5") returned 1 [0201.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.235] lstrlenW (lpString=".zip") returned 4 [0201.235] lstrcmpiW (lpString1=".zip", lpString2=".md5") returned 1 [0201.235] lstrlenW (lpString=".rar") returned 4 [0201.235] lstrcmpiW (lpString1=".rar", lpString2=".md5") returned 1 [0201.235] lstrlenW (lpString=".bz2") returned 4 [0201.235] lstrcmpiW (lpString1=".bz2", lpString2=".md5") returned -1 [0201.235] lstrlenW (lpString=".7z") returned 3 [0201.235] lstrcmpiW (lpString1=".7z", lpString2="md5") returned -1 [0201.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.235] lstrlenW (lpString=".dbf") returned 4 [0201.235] lstrcmpiW (lpString1=".dbf", lpString2=".md5") returned -1 [0201.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.235] lstrlenW (lpString=".1cd") returned 4 [0201.235] lstrcmpiW (lpString1=".1cd", lpString2=".md5") returned -1 [0201.235] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Applications\\_crx_aohghmighlieiainnegkcijnfilokake\\Google Docs.ico.md5") returned 150 [0201.235] lstrlenW (lpString=".jpg") returned 4 [0201.235] lstrcmpiW (lpString1=".jpg", lpString2=".md5") returned -1 [0201.235] lstrlenW (lpString="Web Data") returned 8 [0201.235] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.236] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=69632) returned 1 [0201.236] CloseHandle (hObject=0x2d4) returned 1 [0201.236] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data")) returned 0x2020 [0201.236] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.236] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.236] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.237] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.237] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.237] GetLastError () returned 0x0 [0201.237] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x11000, lpOverlapped=0x0) returned 1 [0201.240] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x11010, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x11010, lpOverlapped=0x0) returned 1 [0201.241] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.241] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0201.242] SetEndOfFile (hFile=0x15c) returned 1 [0201.242] CloseHandle (hObject=0x15c) returned 1 [0201.242] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.242] SetEndOfFile (hFile=0x2d4) returned 1 [0201.243] CloseHandle (hObject=0x2d4) returned 1 [0201.243] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.243] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data")) returned 1 [0201.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.243] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.243] lstrlenW (lpString=".doc") returned 4 [0201.243] lstrcmpiW (lpString1=".doc", lpString2="Data") returned -1 [0201.243] lstrlenW (lpString=".docx") returned 5 [0201.243] lstrcmpiW (lpString1=".docx", lpString2=" Data") returned 1 [0201.243] lstrlenW (lpString=".pdf") returned 4 [0201.244] lstrcmpiW (lpString1=".pdf", lpString2="Data") returned -1 [0201.244] lstrlenW (lpString=".xls") returned 4 [0201.244] lstrcmpiW (lpString1=".xls", lpString2="Data") returned -1 [0201.244] lstrlenW (lpString=".xlsx") returned 5 [0201.244] lstrcmpiW (lpString1=".xlsx", lpString2=" Data") returned 1 [0201.244] lstrlenW (lpString=".ppt") returned 4 [0201.244] lstrcmpiW (lpString1=".ppt", lpString2="Data") returned -1 [0201.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.244] lstrlenW (lpString=".zip") returned 4 [0201.244] lstrcmpiW (lpString1=".zip", lpString2="Data") returned -1 [0201.244] lstrlenW (lpString=".rar") returned 4 [0201.244] lstrcmpiW (lpString1=".rar", lpString2="Data") returned -1 [0201.244] lstrlenW (lpString=".bz2") returned 4 [0201.244] lstrcmpiW (lpString1=".bz2", lpString2="Data") returned -1 [0201.244] lstrlenW (lpString=".7z") returned 3 [0201.244] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0201.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.244] lstrlenW (lpString=".dbf") returned 4 [0201.244] lstrcmpiW (lpString1=".dbf", lpString2="Data") returned -1 [0201.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.244] lstrlenW (lpString=".1cd") returned 4 [0201.244] lstrcmpiW (lpString1=".1cd", lpString2="Data") returned -1 [0201.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.244] lstrlenW (lpString=".jpg") returned 4 [0201.244] lstrcmpiW (lpString1=".jpg", lpString2="Data") returned -1 [0201.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.244] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.244] lstrlenW (lpString=".doc") returned 4 [0201.244] lstrcmpiW (lpString1=".doc", lpString2="Data") returned -1 [0201.244] lstrlenW (lpString=".docx") returned 5 [0201.244] lstrcmpiW (lpString1=".docx", lpString2=" Data") returned 1 [0201.244] lstrlenW (lpString=".pdf") returned 4 [0201.244] lstrcmpiW (lpString1=".pdf", lpString2="Data") returned -1 [0201.245] lstrlenW (lpString=".xls") returned 4 [0201.245] lstrcmpiW (lpString1=".xls", lpString2="Data") returned -1 [0201.245] lstrlenW (lpString=".xlsx") returned 5 [0201.245] lstrcmpiW (lpString1=".xlsx", lpString2=" Data") returned 1 [0201.245] lstrlenW (lpString=".ppt") returned 4 [0201.245] lstrcmpiW (lpString1=".ppt", lpString2="Data") returned -1 [0201.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.245] lstrlenW (lpString=".zip") returned 4 [0201.245] lstrcmpiW (lpString1=".zip", lpString2="Data") returned -1 [0201.245] lstrlenW (lpString=".rar") returned 4 [0201.245] lstrcmpiW (lpString1=".rar", lpString2="Data") returned -1 [0201.245] lstrlenW (lpString=".bz2") returned 4 [0201.245] lstrcmpiW (lpString1=".bz2", lpString2="Data") returned -1 [0201.245] lstrlenW (lpString=".7z") returned 3 [0201.245] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0201.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.245] lstrlenW (lpString=".dbf") returned 4 [0201.245] lstrcmpiW (lpString1=".dbf", lpString2="Data") returned -1 [0201.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.245] lstrlenW (lpString=".1cd") returned 4 [0201.245] lstrcmpiW (lpString1=".1cd", lpString2="Data") returned -1 [0201.245] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data") returned 84 [0201.245] lstrlenW (lpString=".jpg") returned 4 [0201.245] lstrcmpiW (lpString1=".jpg", lpString2="Data") returned -1 [0201.245] lstrlenW (lpString="Web Data-journal") returned 16 [0201.245] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\web data-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.246] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0201.246] CloseHandle (hObject=0x2d4) returned 1 [0201.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.246] lstrlenW (lpString=".doc") returned 4 [0201.246] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.246] lstrlenW (lpString=".docx") returned 5 [0201.246] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.246] lstrlenW (lpString=".pdf") returned 4 [0201.246] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.246] lstrlenW (lpString=".xls") returned 4 [0201.246] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.246] lstrlenW (lpString=".xlsx") returned 5 [0201.246] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.246] lstrlenW (lpString=".ppt") returned 4 [0201.246] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.246] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.246] lstrlenW (lpString=".zip") returned 4 [0201.246] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.246] lstrlenW (lpString=".rar") returned 4 [0201.246] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.246] lstrlenW (lpString=".bz2") returned 4 [0201.246] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString=".7z") returned 3 [0201.247] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.247] lstrlenW (lpString=".dbf") returned 4 [0201.247] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.247] lstrlenW (lpString=".1cd") returned 4 [0201.247] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.247] lstrlenW (lpString=".jpg") returned 4 [0201.247] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.247] lstrlenW (lpString=".doc") returned 4 [0201.247] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString=".docx") returned 5 [0201.247] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.247] lstrlenW (lpString=".pdf") returned 4 [0201.247] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString=".xls") returned 4 [0201.247] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString=".xlsx") returned 5 [0201.247] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.247] lstrlenW (lpString=".ppt") returned 4 [0201.247] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.247] lstrlenW (lpString=".zip") returned 4 [0201.247] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString=".rar") returned 4 [0201.247] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString=".bz2") returned 4 [0201.247] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.247] lstrlenW (lpString=".7z") returned 3 [0201.248] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.248] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.248] lstrlenW (lpString=".dbf") returned 4 [0201.248] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.248] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.248] lstrlenW (lpString=".1cd") returned 4 [0201.248] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.248] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Web Data-journal") returned 92 [0201.248] lstrlenW (lpString=".jpg") returned 4 [0201.248] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.248] lstrlenW (lpString="First Run") returned 9 [0201.248] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\first run"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.250] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=0) returned 1 [0201.250] CloseHandle (hObject=0x2d4) returned 1 [0201.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.250] lstrlenW (lpString=".doc") returned 4 [0201.250] lstrcmpiW (lpString1=".doc", lpString2=" Run") returned 1 [0201.250] lstrlenW (lpString=".docx") returned 5 [0201.250] lstrcmpiW (lpString1=".docx", lpString2="t Run") returned -1 [0201.250] lstrlenW (lpString=".pdf") returned 4 [0201.250] lstrcmpiW (lpString1=".pdf", lpString2=" Run") returned 1 [0201.250] lstrlenW (lpString=".xls") returned 4 [0201.250] lstrcmpiW (lpString1=".xls", lpString2=" Run") returned 1 [0201.250] lstrlenW (lpString=".xlsx") returned 5 [0201.250] lstrcmpiW (lpString1=".xlsx", lpString2="t Run") returned -1 [0201.250] lstrlenW (lpString=".ppt") returned 4 [0201.250] lstrcmpiW (lpString1=".ppt", lpString2=" Run") returned 1 [0201.250] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.250] lstrlenW (lpString=".zip") returned 4 [0201.250] lstrcmpiW (lpString1=".zip", lpString2=" Run") returned 1 [0201.250] lstrlenW (lpString=".rar") returned 4 [0201.250] lstrcmpiW (lpString1=".rar", lpString2=" Run") returned 1 [0201.250] lstrlenW (lpString=".bz2") returned 4 [0201.250] lstrcmpiW (lpString1=".bz2", lpString2=" Run") returned 1 [0201.250] lstrlenW (lpString=".7z") returned 3 [0201.250] lstrcmpiW (lpString1=".7z", lpString2="Run") returned -1 [0201.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.251] lstrlenW (lpString=".dbf") returned 4 [0201.251] lstrcmpiW (lpString1=".dbf", lpString2=" Run") returned 1 [0201.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.251] lstrlenW (lpString=".1cd") returned 4 [0201.251] lstrcmpiW (lpString1=".1cd", lpString2=" Run") returned 1 [0201.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.251] lstrlenW (lpString=".jpg") returned 4 [0201.251] lstrcmpiW (lpString1=".jpg", lpString2=" Run") returned 1 [0201.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.251] lstrlenW (lpString=".doc") returned 4 [0201.251] lstrcmpiW (lpString1=".doc", lpString2=" Run") returned 1 [0201.251] lstrlenW (lpString=".docx") returned 5 [0201.251] lstrcmpiW (lpString1=".docx", lpString2="t Run") returned -1 [0201.251] lstrlenW (lpString=".pdf") returned 4 [0201.251] lstrcmpiW (lpString1=".pdf", lpString2=" Run") returned 1 [0201.251] lstrlenW (lpString=".xls") returned 4 [0201.251] lstrcmpiW (lpString1=".xls", lpString2=" Run") returned 1 [0201.251] lstrlenW (lpString=".xlsx") returned 5 [0201.251] lstrcmpiW (lpString1=".xlsx", lpString2="t Run") returned -1 [0201.251] lstrlenW (lpString=".ppt") returned 4 [0201.251] lstrcmpiW (lpString1=".ppt", lpString2=" Run") returned 1 [0201.251] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.251] lstrlenW (lpString=".zip") returned 4 [0201.251] lstrcmpiW (lpString1=".zip", lpString2=" Run") returned 1 [0201.251] lstrlenW (lpString=".rar") returned 4 [0201.251] lstrcmpiW (lpString1=".rar", lpString2=" Run") returned 1 [0201.251] lstrlenW (lpString=".bz2") returned 4 [0201.251] lstrcmpiW (lpString1=".bz2", lpString2=" Run") returned 1 [0201.251] lstrlenW (lpString=".7z") returned 3 [0201.251] lstrcmpiW (lpString1=".7z", lpString2="Run") returned -1 [0201.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.252] lstrlenW (lpString=".dbf") returned 4 [0201.252] lstrcmpiW (lpString1=".dbf", lpString2=" Run") returned 1 [0201.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.252] lstrlenW (lpString=".1cd") returned 4 [0201.252] lstrcmpiW (lpString1=".1cd", lpString2=" Run") returned 1 [0201.252] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\First Run") returned 77 [0201.252] lstrlenW (lpString=".jpg") returned 4 [0201.252] lstrcmpiW (lpString1=".jpg", lpString2=" Run") returned 1 [0201.252] lstrlenW (lpString="Local State") returned 11 [0201.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.252] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=67626) returned 1 [0201.252] CloseHandle (hObject=0x2d4) returned 1 [0201.252] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state")) returned 0x2020 [0201.253] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.253] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.253] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.253] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.253] GetLastError () returned 0x0 [0201.253] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x1082a, lpOverlapped=0x0) returned 1 [0201.256] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x10830, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x10830, lpOverlapped=0x0) returned 1 [0201.258] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.258] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xea, lpOverlapped=0x0) returned 1 [0201.258] SetEndOfFile (hFile=0x15c) returned 1 [0201.258] CloseHandle (hObject=0x15c) returned 1 [0201.258] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.258] SetEndOfFile (hFile=0x2d4) returned 1 [0201.259] CloseHandle (hObject=0x2d4) returned 1 [0201.259] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.260] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\local state")) returned 1 [0201.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.260] lstrlenW (lpString=".doc") returned 4 [0201.260] lstrcmpiW (lpString1=".doc", lpString2="tate") returned -1 [0201.260] lstrlenW (lpString=".docx") returned 5 [0201.260] lstrcmpiW (lpString1=".docx", lpString2="State") returned -1 [0201.260] lstrlenW (lpString=".pdf") returned 4 [0201.260] lstrcmpiW (lpString1=".pdf", lpString2="tate") returned -1 [0201.260] lstrlenW (lpString=".xls") returned 4 [0201.260] lstrcmpiW (lpString1=".xls", lpString2="tate") returned -1 [0201.260] lstrlenW (lpString=".xlsx") returned 5 [0201.260] lstrcmpiW (lpString1=".xlsx", lpString2="State") returned -1 [0201.260] lstrlenW (lpString=".ppt") returned 4 [0201.260] lstrcmpiW (lpString1=".ppt", lpString2="tate") returned -1 [0201.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.260] lstrlenW (lpString=".zip") returned 4 [0201.260] lstrcmpiW (lpString1=".zip", lpString2="tate") returned -1 [0201.260] lstrlenW (lpString=".rar") returned 4 [0201.260] lstrcmpiW (lpString1=".rar", lpString2="tate") returned -1 [0201.260] lstrlenW (lpString=".bz2") returned 4 [0201.260] lstrcmpiW (lpString1=".bz2", lpString2="tate") returned -1 [0201.260] lstrlenW (lpString=".7z") returned 3 [0201.260] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0201.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.260] lstrlenW (lpString=".dbf") returned 4 [0201.260] lstrcmpiW (lpString1=".dbf", lpString2="tate") returned -1 [0201.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.260] lstrlenW (lpString=".1cd") returned 4 [0201.261] lstrcmpiW (lpString1=".1cd", lpString2="tate") returned -1 [0201.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.261] lstrlenW (lpString=".jpg") returned 4 [0201.261] lstrcmpiW (lpString1=".jpg", lpString2="tate") returned -1 [0201.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.261] lstrlenW (lpString=".doc") returned 4 [0201.261] lstrcmpiW (lpString1=".doc", lpString2="tate") returned -1 [0201.261] lstrlenW (lpString=".docx") returned 5 [0201.261] lstrcmpiW (lpString1=".docx", lpString2="State") returned -1 [0201.261] lstrlenW (lpString=".pdf") returned 4 [0201.261] lstrcmpiW (lpString1=".pdf", lpString2="tate") returned -1 [0201.261] lstrlenW (lpString=".xls") returned 4 [0201.261] lstrcmpiW (lpString1=".xls", lpString2="tate") returned -1 [0201.261] lstrlenW (lpString=".xlsx") returned 5 [0201.261] lstrcmpiW (lpString1=".xlsx", lpString2="State") returned -1 [0201.261] lstrlenW (lpString=".ppt") returned 4 [0201.261] lstrcmpiW (lpString1=".ppt", lpString2="tate") returned -1 [0201.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.261] lstrlenW (lpString=".zip") returned 4 [0201.261] lstrcmpiW (lpString1=".zip", lpString2="tate") returned -1 [0201.261] lstrlenW (lpString=".rar") returned 4 [0201.261] lstrcmpiW (lpString1=".rar", lpString2="tate") returned -1 [0201.261] lstrlenW (lpString=".bz2") returned 4 [0201.261] lstrcmpiW (lpString1=".bz2", lpString2="tate") returned -1 [0201.261] lstrlenW (lpString=".7z") returned 3 [0201.261] lstrcmpiW (lpString1=".7z", lpString2="ate") returned -1 [0201.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.261] lstrlenW (lpString=".dbf") returned 4 [0201.261] lstrcmpiW (lpString1=".dbf", lpString2="tate") returned -1 [0201.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.261] lstrlenW (lpString=".1cd") returned 4 [0201.261] lstrcmpiW (lpString1=".1cd", lpString2="tate") returned -1 [0201.262] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Local State") returned 79 [0201.262] lstrlenW (lpString=".jpg") returned 4 [0201.262] lstrcmpiW (lpString1=".jpg", lpString2="tate") returned -1 [0201.262] lstrlenW (lpString="Safe Browsing Channel IDs") returned 25 [0201.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.262] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=5120) returned 1 [0201.262] CloseHandle (hObject=0x2d4) returned 1 [0201.262] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids")) returned 0x2020 [0201.262] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.262] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.263] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.263] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.263] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.263] GetLastError () returned 0x0 [0201.263] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x1400, lpOverlapped=0x0) returned 1 [0201.545] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x1410, lpOverlapped=0x0) returned 1 [0201.547] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.547] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x106, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x106, lpOverlapped=0x0) returned 1 [0201.547] SetEndOfFile (hFile=0x15c) returned 1 [0201.547] CloseHandle (hObject=0x15c) returned 1 [0201.547] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.547] SetEndOfFile (hFile=0x2d4) returned 1 [0201.548] CloseHandle (hObject=0x2d4) returned 1 [0201.550] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.550] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids")) returned 1 [0201.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.550] lstrlenW (lpString=".doc") returned 4 [0201.550] lstrcmpiW (lpString1=".doc", lpString2=" IDs") returned 1 [0201.550] lstrlenW (lpString=".docx") returned 5 [0201.550] lstrcmpiW (lpString1=".docx", lpString2="l IDs") returned -1 [0201.550] lstrlenW (lpString=".pdf") returned 4 [0201.550] lstrcmpiW (lpString1=".pdf", lpString2=" IDs") returned 1 [0201.550] lstrlenW (lpString=".xls") returned 4 [0201.550] lstrcmpiW (lpString1=".xls", lpString2=" IDs") returned 1 [0201.550] lstrlenW (lpString=".xlsx") returned 5 [0201.550] lstrcmpiW (lpString1=".xlsx", lpString2="l IDs") returned -1 [0201.550] lstrlenW (lpString=".ppt") returned 4 [0201.550] lstrcmpiW (lpString1=".ppt", lpString2=" IDs") returned 1 [0201.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.551] lstrlenW (lpString=".zip") returned 4 [0201.551] lstrcmpiW (lpString1=".zip", lpString2=" IDs") returned 1 [0201.551] lstrlenW (lpString=".rar") returned 4 [0201.551] lstrcmpiW (lpString1=".rar", lpString2=" IDs") returned 1 [0201.551] lstrlenW (lpString=".bz2") returned 4 [0201.551] lstrcmpiW (lpString1=".bz2", lpString2=" IDs") returned 1 [0201.551] lstrlenW (lpString=".7z") returned 3 [0201.551] lstrcmpiW (lpString1=".7z", lpString2="IDs") returned -1 [0201.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.551] lstrlenW (lpString=".dbf") returned 4 [0201.551] lstrcmpiW (lpString1=".dbf", lpString2=" IDs") returned 1 [0201.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.551] lstrlenW (lpString=".1cd") returned 4 [0201.551] lstrcmpiW (lpString1=".1cd", lpString2=" IDs") returned 1 [0201.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.551] lstrlenW (lpString=".jpg") returned 4 [0201.551] lstrcmpiW (lpString1=".jpg", lpString2=" IDs") returned 1 [0201.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.551] lstrlenW (lpString=".doc") returned 4 [0201.551] lstrcmpiW (lpString1=".doc", lpString2=" IDs") returned 1 [0201.551] lstrlenW (lpString=".docx") returned 5 [0201.551] lstrcmpiW (lpString1=".docx", lpString2="l IDs") returned -1 [0201.551] lstrlenW (lpString=".pdf") returned 4 [0201.551] lstrcmpiW (lpString1=".pdf", lpString2=" IDs") returned 1 [0201.551] lstrlenW (lpString=".xls") returned 4 [0201.551] lstrcmpiW (lpString1=".xls", lpString2=" IDs") returned 1 [0201.551] lstrlenW (lpString=".xlsx") returned 5 [0201.551] lstrcmpiW (lpString1=".xlsx", lpString2="l IDs") returned -1 [0201.551] lstrlenW (lpString=".ppt") returned 4 [0201.551] lstrcmpiW (lpString1=".ppt", lpString2=" IDs") returned 1 [0201.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.551] lstrlenW (lpString=".zip") returned 4 [0201.551] lstrcmpiW (lpString1=".zip", lpString2=" IDs") returned 1 [0201.552] lstrlenW (lpString=".rar") returned 4 [0201.552] lstrcmpiW (lpString1=".rar", lpString2=" IDs") returned 1 [0201.552] lstrlenW (lpString=".bz2") returned 4 [0201.552] lstrcmpiW (lpString1=".bz2", lpString2=" IDs") returned 1 [0201.552] lstrlenW (lpString=".7z") returned 3 [0201.552] lstrcmpiW (lpString1=".7z", lpString2="IDs") returned -1 [0201.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.552] lstrlenW (lpString=".dbf") returned 4 [0201.552] lstrcmpiW (lpString1=".dbf", lpString2=" IDs") returned 1 [0201.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.552] lstrlenW (lpString=".1cd") returned 4 [0201.552] lstrcmpiW (lpString1=".1cd", lpString2=" IDs") returned 1 [0201.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs") returned 93 [0201.552] lstrlenW (lpString=".jpg") returned 4 [0201.552] lstrcmpiW (lpString1=".jpg", lpString2=" IDs") returned 1 [0201.552] lstrcmpiW (lpString1=".wmdb", lpString2=".wiki") returned 1 [0201.552] lstrlenW (lpString="LocalMLS_3.wmdb") returned 15 [0201.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.553] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=69740) returned 1 [0201.553] CloseHandle (hObject=0x2d4) returned 1 [0201.553] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb")) returned 0x2020 [0201.553] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.553] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.553] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.553] GetLastError () returned 0x0 [0201.553] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x1106c, lpOverlapped=0x0) returned 1 [0201.557] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x11070, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x11070, lpOverlapped=0x0) returned 1 [0201.558] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.558] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf2, lpOverlapped=0x0) returned 1 [0201.559] SetEndOfFile (hFile=0x15c) returned 1 [0201.559] CloseHandle (hObject=0x15c) returned 1 [0201.559] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.559] SetEndOfFile (hFile=0x2d4) returned 1 [0201.560] CloseHandle (hObject=0x2d4) returned 1 [0201.560] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.560] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\localmls_3.wmdb")) returned 1 [0201.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.560] lstrlenW (lpString=".doc") returned 4 [0201.560] lstrcmpiW (lpString1=".doc", lpString2="wmdb") returned -1 [0201.560] lstrlenW (lpString=".docx") returned 5 [0201.560] lstrcmpiW (lpString1=".docx", lpString2=".wmdb") returned -1 [0201.560] lstrlenW (lpString=".pdf") returned 4 [0201.561] lstrcmpiW (lpString1=".pdf", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString=".xls") returned 4 [0201.561] lstrcmpiW (lpString1=".xls", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString=".xlsx") returned 5 [0201.561] lstrcmpiW (lpString1=".xlsx", lpString2=".wmdb") returned 1 [0201.561] lstrlenW (lpString=".ppt") returned 4 [0201.561] lstrcmpiW (lpString1=".ppt", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.561] lstrlenW (lpString=".zip") returned 4 [0201.561] lstrcmpiW (lpString1=".zip", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString=".rar") returned 4 [0201.561] lstrcmpiW (lpString1=".rar", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString=".bz2") returned 4 [0201.561] lstrcmpiW (lpString1=".bz2", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString=".7z") returned 3 [0201.561] lstrcmpiW (lpString1=".7z", lpString2="mdb") returned -1 [0201.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.561] lstrlenW (lpString=".dbf") returned 4 [0201.561] lstrcmpiW (lpString1=".dbf", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.561] lstrlenW (lpString=".1cd") returned 4 [0201.561] lstrcmpiW (lpString1=".1cd", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.561] lstrlenW (lpString=".jpg") returned 4 [0201.561] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.561] lstrlenW (lpString=".doc") returned 4 [0201.561] lstrcmpiW (lpString1=".doc", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString=".docx") returned 5 [0201.561] lstrcmpiW (lpString1=".docx", lpString2=".wmdb") returned -1 [0201.561] lstrlenW (lpString=".pdf") returned 4 [0201.561] lstrcmpiW (lpString1=".pdf", lpString2="wmdb") returned -1 [0201.561] lstrlenW (lpString=".xls") returned 4 [0201.562] lstrcmpiW (lpString1=".xls", lpString2="wmdb") returned -1 [0201.562] lstrlenW (lpString=".xlsx") returned 5 [0201.562] lstrcmpiW (lpString1=".xlsx", lpString2=".wmdb") returned 1 [0201.562] lstrlenW (lpString=".ppt") returned 4 [0201.562] lstrcmpiW (lpString1=".ppt", lpString2="wmdb") returned -1 [0201.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.562] lstrlenW (lpString=".zip") returned 4 [0201.562] lstrcmpiW (lpString1=".zip", lpString2="wmdb") returned -1 [0201.562] lstrlenW (lpString=".rar") returned 4 [0201.562] lstrcmpiW (lpString1=".rar", lpString2="wmdb") returned -1 [0201.562] lstrlenW (lpString=".bz2") returned 4 [0201.562] lstrcmpiW (lpString1=".bz2", lpString2="wmdb") returned -1 [0201.562] lstrlenW (lpString=".7z") returned 3 [0201.562] lstrcmpiW (lpString1=".7z", lpString2="mdb") returned -1 [0201.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.562] lstrlenW (lpString=".dbf") returned 4 [0201.562] lstrcmpiW (lpString1=".dbf", lpString2="wmdb") returned -1 [0201.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.562] lstrlenW (lpString=".1cd") returned 4 [0201.562] lstrcmpiW (lpString1=".1cd", lpString2="wmdb") returned -1 [0201.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\LocalMLS_3.wmdb") returned 82 [0201.562] lstrlenW (lpString=".jpg") returned 4 [0201.562] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0201.562] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.562] lstrlenW (lpString="01_Music_auto_rated_at_5_stars.wpl") returned 34 [0201.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.563] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1044) returned 1 [0201.563] CloseHandle (hObject=0x2d4) returned 1 [0201.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl")) returned 0x2020 [0201.564] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.564] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.564] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.564] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.564] GetLastError () returned 0x0 [0201.564] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x414, lpOverlapped=0x0) returned 1 [0201.566] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x420, lpOverlapped=0x0) returned 1 [0201.567] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.567] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x118, lpOverlapped=0x0) returned 1 [0201.567] SetEndOfFile (hFile=0x15c) returned 1 [0201.567] CloseHandle (hObject=0x15c) returned 1 [0201.567] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.568] SetEndOfFile (hFile=0x2d4) returned 1 [0201.568] CloseHandle (hObject=0x2d4) returned 1 [0201.568] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.569] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\01_music_auto_rated_at_5_stars.wpl")) returned 1 [0201.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.569] lstrlenW (lpString=".doc") returned 4 [0201.569] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.569] lstrlenW (lpString=".docx") returned 5 [0201.569] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0201.569] lstrlenW (lpString=".pdf") returned 4 [0201.569] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.569] lstrlenW (lpString=".xls") returned 4 [0201.569] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.569] lstrlenW (lpString=".xlsx") returned 5 [0201.569] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0201.569] lstrlenW (lpString=".ppt") returned 4 [0201.569] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.569] lstrlenW (lpString=".zip") returned 4 [0201.569] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.569] lstrlenW (lpString=".rar") returned 4 [0201.569] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.569] lstrlenW (lpString=".bz2") returned 4 [0201.569] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.569] lstrlenW (lpString=".7z") returned 3 [0201.569] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.569] lstrlenW (lpString=".dbf") returned 4 [0201.569] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.569] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.570] lstrlenW (lpString=".1cd") returned 4 [0201.570] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.570] lstrlenW (lpString=".jpg") returned 4 [0201.570] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.570] lstrlenW (lpString=".doc") returned 4 [0201.570] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.570] lstrlenW (lpString=".docx") returned 5 [0201.570] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0201.570] lstrlenW (lpString=".pdf") returned 4 [0201.570] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.570] lstrlenW (lpString=".xls") returned 4 [0201.570] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.570] lstrlenW (lpString=".xlsx") returned 5 [0201.570] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0201.570] lstrlenW (lpString=".ppt") returned 4 [0201.570] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.570] lstrlenW (lpString=".zip") returned 4 [0201.570] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.570] lstrlenW (lpString=".rar") returned 4 [0201.570] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.570] lstrlenW (lpString=".bz2") returned 4 [0201.570] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.570] lstrlenW (lpString=".7z") returned 3 [0201.570] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.570] lstrlenW (lpString=".dbf") returned 4 [0201.570] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.570] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.570] lstrlenW (lpString=".1cd") returned 4 [0201.571] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0201.571] lstrlenW (lpString=".jpg") returned 4 [0201.571] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.571] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.571] lstrlenW (lpString="02_Music_added_in_the_last_month.wpl") returned 36 [0201.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.571] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1279) returned 1 [0201.571] CloseHandle (hObject=0x2d4) returned 1 [0201.571] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl")) returned 0x2020 [0201.571] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.571] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.572] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.572] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.572] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.572] GetLastError () returned 0x0 [0201.572] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x4ff, lpOverlapped=0x0) returned 1 [0201.576] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x500, lpOverlapped=0x0) returned 1 [0201.577] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.577] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x11c, lpOverlapped=0x0) returned 1 [0201.577] SetEndOfFile (hFile=0x15c) returned 1 [0201.577] CloseHandle (hObject=0x15c) returned 1 [0201.577] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.577] SetEndOfFile (hFile=0x2d4) returned 1 [0201.578] CloseHandle (hObject=0x2d4) returned 1 [0201.578] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.578] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\02_music_added_in_the_last_month.wpl")) returned 1 [0201.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.578] lstrlenW (lpString=".doc") returned 4 [0201.578] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.578] lstrlenW (lpString=".docx") returned 5 [0201.578] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0201.578] lstrlenW (lpString=".pdf") returned 4 [0201.578] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.578] lstrlenW (lpString=".xls") returned 4 [0201.578] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.578] lstrlenW (lpString=".xlsx") returned 5 [0201.578] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0201.578] lstrlenW (lpString=".ppt") returned 4 [0201.578] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.579] lstrlenW (lpString=".zip") returned 4 [0201.579] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.579] lstrlenW (lpString=".rar") returned 4 [0201.579] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.579] lstrlenW (lpString=".bz2") returned 4 [0201.579] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.579] lstrlenW (lpString=".7z") returned 3 [0201.579] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.579] lstrlenW (lpString=".dbf") returned 4 [0201.579] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.579] lstrlenW (lpString=".1cd") returned 4 [0201.579] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.579] lstrlenW (lpString=".jpg") returned 4 [0201.579] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.579] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.579] lstrlenW (lpString=".doc") returned 4 [0201.579] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.579] lstrlenW (lpString=".docx") returned 5 [0201.579] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0201.579] lstrlenW (lpString=".pdf") returned 4 [0201.579] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.579] lstrlenW (lpString=".xls") returned 4 [0201.579] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.579] lstrlenW (lpString=".xlsx") returned 5 [0201.580] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0201.580] lstrlenW (lpString=".ppt") returned 4 [0201.580] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.580] lstrlenW (lpString=".zip") returned 4 [0201.580] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.580] lstrlenW (lpString=".rar") returned 4 [0201.580] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.580] lstrlenW (lpString=".bz2") returned 4 [0201.580] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.580] lstrlenW (lpString=".7z") returned 3 [0201.580] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.580] lstrlenW (lpString=".dbf") returned 4 [0201.580] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.580] lstrlenW (lpString=".1cd") returned 4 [0201.580] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.580] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\02_Music_added_in_the_last_month.wpl") returned 133 [0201.580] lstrlenW (lpString=".jpg") returned 4 [0201.580] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.580] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.580] lstrlenW (lpString="03_Music_rated_at_4_or_5_stars.wpl") returned 34 [0201.580] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.581] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1267) returned 1 [0201.581] CloseHandle (hObject=0x2d4) returned 1 [0201.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl")) returned 0x2020 [0201.581] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.581] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.581] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.581] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.582] GetLastError () returned 0x0 [0201.582] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x4f3, lpOverlapped=0x0) returned 1 [0201.583] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x500, lpOverlapped=0x0) returned 1 [0201.584] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.584] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x118, lpOverlapped=0x0) returned 1 [0201.584] SetEndOfFile (hFile=0x15c) returned 1 [0201.584] CloseHandle (hObject=0x15c) returned 1 [0201.584] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.584] SetEndOfFile (hFile=0x2d4) returned 1 [0201.585] CloseHandle (hObject=0x2d4) returned 1 [0201.585] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.585] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\03_music_rated_at_4_or_5_stars.wpl")) returned 1 [0201.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.586] lstrlenW (lpString=".doc") returned 4 [0201.586] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.586] lstrlenW (lpString=".docx") returned 5 [0201.586] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0201.586] lstrlenW (lpString=".pdf") returned 4 [0201.586] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.586] lstrlenW (lpString=".xls") returned 4 [0201.586] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.586] lstrlenW (lpString=".xlsx") returned 5 [0201.586] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0201.586] lstrlenW (lpString=".ppt") returned 4 [0201.586] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.586] lstrlenW (lpString=".zip") returned 4 [0201.586] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.586] lstrlenW (lpString=".rar") returned 4 [0201.586] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.586] lstrlenW (lpString=".bz2") returned 4 [0201.586] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.586] lstrlenW (lpString=".7z") returned 3 [0201.586] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.586] lstrlenW (lpString=".dbf") returned 4 [0201.586] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.586] lstrlenW (lpString=".1cd") returned 4 [0201.586] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.586] lstrlenW (lpString=".jpg") returned 4 [0201.587] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.587] lstrlenW (lpString=".doc") returned 4 [0201.587] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.587] lstrlenW (lpString=".docx") returned 5 [0201.587] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0201.587] lstrlenW (lpString=".pdf") returned 4 [0201.587] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.587] lstrlenW (lpString=".xls") returned 4 [0201.587] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.587] lstrlenW (lpString=".xlsx") returned 5 [0201.587] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0201.587] lstrlenW (lpString=".ppt") returned 4 [0201.587] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.587] lstrlenW (lpString=".zip") returned 4 [0201.587] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.587] lstrlenW (lpString=".rar") returned 4 [0201.587] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.587] lstrlenW (lpString=".bz2") returned 4 [0201.587] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.587] lstrlenW (lpString=".7z") returned 3 [0201.587] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.587] lstrlenW (lpString=".dbf") returned 4 [0201.587] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.587] lstrlenW (lpString=".1cd") returned 4 [0201.587] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0201.587] lstrlenW (lpString=".jpg") returned 4 [0201.587] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.588] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.588] lstrlenW (lpString="04_Music_played_in_the_last_month.wpl") returned 37 [0201.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.588] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1284) returned 1 [0201.588] CloseHandle (hObject=0x2d4) returned 1 [0201.588] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl")) returned 0x2020 [0201.588] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.589] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.589] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.589] GetLastError () returned 0x0 [0201.589] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x504, lpOverlapped=0x0) returned 1 [0201.591] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x510, lpOverlapped=0x0) returned 1 [0201.591] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.591] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x11e, lpOverlapped=0x0) returned 1 [0201.592] SetEndOfFile (hFile=0x15c) returned 1 [0201.592] CloseHandle (hObject=0x15c) returned 1 [0201.592] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.592] SetEndOfFile (hFile=0x2d4) returned 1 [0201.592] CloseHandle (hObject=0x2d4) returned 1 [0201.593] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.593] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\04_music_played_in_the_last_month.wpl")) returned 1 [0201.593] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.593] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.593] lstrlenW (lpString=".doc") returned 4 [0201.593] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.593] lstrlenW (lpString=".docx") returned 5 [0201.593] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0201.593] lstrlenW (lpString=".pdf") returned 4 [0201.593] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.593] lstrlenW (lpString=".xls") returned 4 [0201.593] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.593] lstrlenW (lpString=".xlsx") returned 5 [0201.593] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0201.593] lstrlenW (lpString=".ppt") returned 4 [0201.593] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.593] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.593] lstrlenW (lpString=".zip") returned 4 [0201.593] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.593] lstrlenW (lpString=".rar") returned 4 [0201.593] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.593] lstrlenW (lpString=".bz2") returned 4 [0201.593] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.593] lstrlenW (lpString=".7z") returned 3 [0201.594] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.594] lstrlenW (lpString=".dbf") returned 4 [0201.594] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.594] lstrlenW (lpString=".1cd") returned 4 [0201.594] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.594] lstrlenW (lpString=".jpg") returned 4 [0201.594] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.594] lstrlenW (lpString=".doc") returned 4 [0201.594] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.594] lstrlenW (lpString=".docx") returned 5 [0201.594] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0201.594] lstrlenW (lpString=".pdf") returned 4 [0201.594] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.594] lstrlenW (lpString=".xls") returned 4 [0201.594] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.594] lstrlenW (lpString=".xlsx") returned 5 [0201.594] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0201.594] lstrlenW (lpString=".ppt") returned 4 [0201.594] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.594] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.594] lstrlenW (lpString=".zip") returned 4 [0201.594] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.594] lstrlenW (lpString=".rar") returned 4 [0201.594] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.594] lstrlenW (lpString=".bz2") returned 4 [0201.594] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.594] lstrlenW (lpString=".7z") returned 3 [0201.594] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.595] lstrlenW (lpString=".dbf") returned 4 [0201.595] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.595] lstrlenW (lpString=".1cd") returned 4 [0201.595] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.595] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\04_Music_played_in_the_last_month.wpl") returned 134 [0201.595] lstrlenW (lpString=".jpg") returned 4 [0201.595] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.595] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.595] lstrlenW (lpString="05_Pictures_taken_in_the_last_month.wpl") returned 39 [0201.595] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.595] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=797) returned 1 [0201.595] CloseHandle (hObject=0x2d4) returned 1 [0201.596] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl")) returned 0x2020 [0201.596] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.596] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.596] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.596] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.596] GetLastError () returned 0x0 [0201.596] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x31d, lpOverlapped=0x0) returned 1 [0201.598] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x320, lpOverlapped=0x0) returned 1 [0201.599] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.599] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x122, lpOverlapped=0x0) returned 1 [0201.599] SetEndOfFile (hFile=0x15c) returned 1 [0201.599] CloseHandle (hObject=0x15c) returned 1 [0201.599] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.599] SetEndOfFile (hFile=0x2d4) returned 1 [0201.600] CloseHandle (hObject=0x2d4) returned 1 [0201.600] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.600] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\05_pictures_taken_in_the_last_month.wpl")) returned 1 [0201.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.600] lstrlenW (lpString=".doc") returned 4 [0201.600] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.600] lstrlenW (lpString=".docx") returned 5 [0201.600] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0201.600] lstrlenW (lpString=".pdf") returned 4 [0201.600] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.600] lstrlenW (lpString=".xls") returned 4 [0201.600] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.601] lstrlenW (lpString=".xlsx") returned 5 [0201.601] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0201.601] lstrlenW (lpString=".ppt") returned 4 [0201.601] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.601] lstrlenW (lpString=".zip") returned 4 [0201.601] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.601] lstrlenW (lpString=".rar") returned 4 [0201.601] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.601] lstrlenW (lpString=".bz2") returned 4 [0201.601] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.601] lstrlenW (lpString=".7z") returned 3 [0201.601] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.601] lstrlenW (lpString=".dbf") returned 4 [0201.601] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.601] lstrlenW (lpString=".1cd") returned 4 [0201.601] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.601] lstrlenW (lpString=".jpg") returned 4 [0201.601] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.601] lstrlenW (lpString=".doc") returned 4 [0201.601] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.601] lstrlenW (lpString=".docx") returned 5 [0201.601] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0201.601] lstrlenW (lpString=".pdf") returned 4 [0201.601] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.601] lstrlenW (lpString=".xls") returned 4 [0201.601] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.601] lstrlenW (lpString=".xlsx") returned 5 [0201.601] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0201.602] lstrlenW (lpString=".ppt") returned 4 [0201.602] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.602] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.602] lstrlenW (lpString=".zip") returned 4 [0201.602] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.602] lstrlenW (lpString=".rar") returned 4 [0201.602] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.602] lstrlenW (lpString=".bz2") returned 4 [0201.602] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.602] lstrlenW (lpString=".7z") returned 3 [0201.602] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.602] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.602] lstrlenW (lpString=".dbf") returned 4 [0201.602] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.602] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.602] lstrlenW (lpString=".1cd") returned 4 [0201.602] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.602] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0201.602] lstrlenW (lpString=".jpg") returned 4 [0201.602] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.602] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.602] lstrlenW (lpString="06_Pictures_rated_4_or_5_stars.wpl") returned 34 [0201.602] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.603] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=785) returned 1 [0201.603] CloseHandle (hObject=0x2d4) returned 1 [0201.603] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl")) returned 0x2020 [0201.603] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.603] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.603] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.603] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.604] GetLastError () returned 0x0 [0201.604] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x311, lpOverlapped=0x0) returned 1 [0201.606] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x320, lpOverlapped=0x0) returned 1 [0201.606] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.606] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x118, lpOverlapped=0x0) returned 1 [0201.607] SetEndOfFile (hFile=0x15c) returned 1 [0201.607] CloseHandle (hObject=0x15c) returned 1 [0201.607] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.607] SetEndOfFile (hFile=0x2d4) returned 1 [0201.608] CloseHandle (hObject=0x2d4) returned 1 [0201.608] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.608] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\06_pictures_rated_4_or_5_stars.wpl")) returned 1 [0201.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.608] lstrlenW (lpString=".doc") returned 4 [0201.608] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.608] lstrlenW (lpString=".docx") returned 5 [0201.608] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0201.608] lstrlenW (lpString=".pdf") returned 4 [0201.608] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.608] lstrlenW (lpString=".xls") returned 4 [0201.608] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.608] lstrlenW (lpString=".xlsx") returned 5 [0201.608] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0201.608] lstrlenW (lpString=".ppt") returned 4 [0201.608] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.608] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.608] lstrlenW (lpString=".zip") returned 4 [0201.608] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.608] lstrlenW (lpString=".rar") returned 4 [0201.608] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.608] lstrlenW (lpString=".bz2") returned 4 [0201.608] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.609] lstrlenW (lpString=".7z") returned 3 [0201.609] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.609] lstrlenW (lpString=".dbf") returned 4 [0201.609] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.609] lstrlenW (lpString=".1cd") returned 4 [0201.609] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.609] lstrlenW (lpString=".jpg") returned 4 [0201.609] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.609] lstrlenW (lpString=".doc") returned 4 [0201.609] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.609] lstrlenW (lpString=".docx") returned 5 [0201.609] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0201.609] lstrlenW (lpString=".pdf") returned 4 [0201.609] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.609] lstrlenW (lpString=".xls") returned 4 [0201.609] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.609] lstrlenW (lpString=".xlsx") returned 5 [0201.609] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0201.609] lstrlenW (lpString=".ppt") returned 4 [0201.609] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.609] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.609] lstrlenW (lpString=".zip") returned 4 [0201.609] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.609] lstrlenW (lpString=".rar") returned 4 [0201.609] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.609] lstrlenW (lpString=".bz2") returned 4 [0201.609] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.609] lstrlenW (lpString=".7z") returned 3 [0201.609] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.610] lstrlenW (lpString=".dbf") returned 4 [0201.610] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.610] lstrlenW (lpString=".1cd") returned 4 [0201.610] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.610] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0201.610] lstrlenW (lpString=".jpg") returned 4 [0201.610] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.610] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.610] lstrlenW (lpString="07_TV_recorded_in_the_last_week.wpl") returned 35 [0201.610] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.610] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1040) returned 1 [0201.610] CloseHandle (hObject=0x2d4) returned 1 [0201.611] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl")) returned 0x2020 [0201.611] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.611] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.611] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.611] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0201.611] GetLastError () returned 0x0 [0201.612] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x410, lpOverlapped=0x0) returned 1 [0201.613] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x420, lpOverlapped=0x0) returned 1 [0201.614] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0201.614] WriteFile (in: hFile=0x15c, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x11a, lpOverlapped=0x0) returned 1 [0201.614] SetEndOfFile (hFile=0x15c) returned 1 [0201.614] CloseHandle (hObject=0x15c) returned 1 [0201.614] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.614] SetEndOfFile (hFile=0x2d4) returned 1 [0201.615] CloseHandle (hObject=0x2d4) returned 1 [0201.615] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.615] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\07_tv_recorded_in_the_last_week.wpl")) returned 1 [0201.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.615] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.615] lstrlenW (lpString=".doc") returned 4 [0201.615] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.615] lstrlenW (lpString=".docx") returned 5 [0201.615] lstrcmpiW (lpString1=".docx", lpString2="k.wpl") returned -1 [0201.615] lstrlenW (lpString=".pdf") returned 4 [0201.615] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.616] lstrlenW (lpString=".xls") returned 4 [0201.616] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.616] lstrlenW (lpString=".xlsx") returned 5 [0201.616] lstrcmpiW (lpString1=".xlsx", lpString2="k.wpl") returned -1 [0201.616] lstrlenW (lpString=".ppt") returned 4 [0201.616] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.616] lstrlenW (lpString=".zip") returned 4 [0201.616] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.616] lstrlenW (lpString=".rar") returned 4 [0201.616] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.616] lstrlenW (lpString=".bz2") returned 4 [0201.616] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.616] lstrlenW (lpString=".7z") returned 3 [0201.616] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.616] lstrlenW (lpString=".dbf") returned 4 [0201.616] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.616] lstrlenW (lpString=".1cd") returned 4 [0201.616] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.616] lstrlenW (lpString=".jpg") returned 4 [0201.616] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.616] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.616] lstrlenW (lpString=".doc") returned 4 [0201.616] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.616] lstrlenW (lpString=".docx") returned 5 [0201.616] lstrcmpiW (lpString1=".docx", lpString2="k.wpl") returned -1 [0201.616] lstrlenW (lpString=".pdf") returned 4 [0201.616] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.616] lstrlenW (lpString=".xls") returned 4 [0201.616] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.617] lstrlenW (lpString=".xlsx") returned 5 [0201.617] lstrcmpiW (lpString1=".xlsx", lpString2="k.wpl") returned -1 [0201.617] lstrlenW (lpString=".ppt") returned 4 [0201.617] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.617] lstrlenW (lpString=".zip") returned 4 [0201.617] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.617] lstrlenW (lpString=".rar") returned 4 [0201.617] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.617] lstrlenW (lpString=".bz2") returned 4 [0201.617] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.617] lstrlenW (lpString=".7z") returned 3 [0201.617] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.617] lstrlenW (lpString=".dbf") returned 4 [0201.617] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.617] lstrlenW (lpString=".1cd") returned 4 [0201.617] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.617] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0201.617] lstrlenW (lpString=".jpg") returned 4 [0201.617] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.617] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.617] lstrlenW (lpString="08_Video_rated_at_4_or_5_stars.wpl") returned 34 [0201.617] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.618] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1020) returned 1 [0201.618] CloseHandle (hObject=0x2d4) returned 1 [0201.618] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl")) returned 0x2020 [0201.618] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0201.618] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.618] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0201.618] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.031] GetLastError () returned 0x0 [0202.031] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x3fc, lpOverlapped=0x0) returned 1 [0202.032] WriteFile (in: hFile=0x350, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x400, lpOverlapped=0x0) returned 1 [0202.033] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0202.033] WriteFile (in: hFile=0x350, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x118, lpOverlapped=0x0) returned 1 [0202.033] SetEndOfFile (hFile=0x350) returned 1 [0202.033] CloseHandle (hObject=0x350) returned 1 [0202.034] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.034] SetEndOfFile (hFile=0x2d4) returned 1 [0202.034] CloseHandle (hObject=0x2d4) returned 1 [0202.034] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.035] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\08_video_rated_at_4_or_5_stars.wpl")) returned 1 [0202.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.035] lstrlenW (lpString=".doc") returned 4 [0202.035] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.035] lstrlenW (lpString=".docx") returned 5 [0202.035] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.035] lstrlenW (lpString=".pdf") returned 4 [0202.035] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.035] lstrlenW (lpString=".xls") returned 4 [0202.035] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.035] lstrlenW (lpString=".xlsx") returned 5 [0202.035] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.035] lstrlenW (lpString=".ppt") returned 4 [0202.035] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.035] lstrlenW (lpString=".zip") returned 4 [0202.035] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.035] lstrlenW (lpString=".rar") returned 4 [0202.035] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.035] lstrlenW (lpString=".bz2") returned 4 [0202.035] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.035] lstrlenW (lpString=".7z") returned 3 [0202.035] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.035] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.035] lstrlenW (lpString=".dbf") returned 4 [0202.035] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.036] lstrlenW (lpString=".1cd") returned 4 [0202.036] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.036] lstrlenW (lpString=".jpg") returned 4 [0202.036] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.036] lstrlenW (lpString=".doc") returned 4 [0202.036] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.036] lstrlenW (lpString=".docx") returned 5 [0202.036] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.036] lstrlenW (lpString=".pdf") returned 4 [0202.036] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.036] lstrlenW (lpString=".xls") returned 4 [0202.036] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.036] lstrlenW (lpString=".xlsx") returned 5 [0202.036] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.036] lstrlenW (lpString=".ppt") returned 4 [0202.036] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.036] lstrlenW (lpString=".zip") returned 4 [0202.036] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.036] lstrlenW (lpString=".rar") returned 4 [0202.036] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.036] lstrlenW (lpString=".bz2") returned 4 [0202.036] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.036] lstrlenW (lpString=".7z") returned 3 [0202.036] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.036] lstrlenW (lpString=".dbf") returned 4 [0202.036] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.036] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.036] lstrlenW (lpString=".1cd") returned 4 [0202.037] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.037] lstrlenW (lpString=".jpg") returned 4 [0202.037] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.037] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.037] lstrlenW (lpString="05_Pictures_taken_in_the_last_month.wpl") returned 39 [0202.037] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.865] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=797) returned 1 [0202.865] CloseHandle (hObject=0x2d4) returned 1 [0202.865] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl")) returned 0x2020 [0202.865] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.865] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.866] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.866] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.866] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.867] GetLastError () returned 0x0 [0202.867] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x31d, lpOverlapped=0x0) returned 1 [0202.868] WriteFile (in: hFile=0x344, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x320, lpOverlapped=0x0) returned 1 [0202.869] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0202.869] WriteFile (in: hFile=0x344, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x122, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x122, lpOverlapped=0x0) returned 1 [0202.869] SetEndOfFile (hFile=0x344) returned 1 [0202.869] CloseHandle (hObject=0x344) returned 1 [0202.869] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0202.870] SetEndOfFile (hFile=0x2d4) returned 1 [0202.870] CloseHandle (hObject=0x2d4) returned 1 [0202.870] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.871] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\05_pictures_taken_in_the_last_month.wpl")) returned 1 [0202.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.871] lstrlenW (lpString=".doc") returned 4 [0202.871] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.871] lstrlenW (lpString=".docx") returned 5 [0202.871] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0202.871] lstrlenW (lpString=".pdf") returned 4 [0202.871] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.871] lstrlenW (lpString=".xls") returned 4 [0202.871] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.871] lstrlenW (lpString=".xlsx") returned 5 [0202.871] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0202.871] lstrlenW (lpString=".ppt") returned 4 [0202.871] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.871] lstrlenW (lpString=".zip") returned 4 [0202.871] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.871] lstrlenW (lpString=".rar") returned 4 [0202.871] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.871] lstrlenW (lpString=".bz2") returned 4 [0202.871] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.871] lstrlenW (lpString=".7z") returned 3 [0202.871] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.871] lstrlenW (lpString=".dbf") returned 4 [0202.871] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.871] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.872] lstrlenW (lpString=".1cd") returned 4 [0202.872] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.872] lstrlenW (lpString=".jpg") returned 4 [0202.872] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.872] lstrlenW (lpString=".doc") returned 4 [0202.872] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.872] lstrlenW (lpString=".docx") returned 5 [0202.872] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0202.872] lstrlenW (lpString=".pdf") returned 4 [0202.872] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.872] lstrlenW (lpString=".xls") returned 4 [0202.872] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.872] lstrlenW (lpString=".xlsx") returned 5 [0202.872] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0202.872] lstrlenW (lpString=".ppt") returned 4 [0202.872] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.872] lstrlenW (lpString=".zip") returned 4 [0202.872] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.872] lstrlenW (lpString=".rar") returned 4 [0202.872] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.872] lstrlenW (lpString=".bz2") returned 4 [0202.872] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.872] lstrlenW (lpString=".7z") returned 3 [0202.872] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.872] lstrlenW (lpString=".dbf") returned 4 [0202.872] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.872] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.872] lstrlenW (lpString=".1cd") returned 4 [0202.872] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.873] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\05_Pictures_taken_in_the_last_month.wpl") returned 136 [0202.873] lstrlenW (lpString=".jpg") returned 4 [0202.873] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.873] lstrcmpiW (lpString1=".IE5\\9QH4S0GZ\\async_usersync[2]", lpString2=".wiki") returned -1 [0202.873] lstrlenW (lpString="async_usersync[2]") returned 17 [0202.873] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.109] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1332) returned 1 [0203.109] CloseHandle (hObject=0x358) returned 1 [0203.110] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2]")) returned 0x2020 [0203.110] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.111] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.111] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.111] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.648] GetLastError () returned 0x0 [0203.648] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x534, lpOverlapped=0x0) returned 1 [0203.651] WriteFile (in: hFile=0x378, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x540, lpOverlapped=0x0) returned 1 [0203.652] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.652] WriteFile (in: hFile=0x378, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xf6, lpOverlapped=0x0) returned 1 [0203.652] SetEndOfFile (hFile=0x378) returned 1 [0203.652] CloseHandle (hObject=0x378) returned 1 [0203.652] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.652] SetEndOfFile (hFile=0x2d4) returned 1 [0203.653] CloseHandle (hObject=0x2d4) returned 1 [0203.653] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.653] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[2]")) returned 1 [0203.653] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.653] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.653] lstrlenW (lpString=".doc") returned 4 [0203.653] lstrcmpiW (lpString1=".doc", lpString2="c[2]") returned -1 [0203.653] lstrlenW (lpString=".docx") returned 5 [0203.653] lstrcmpiW (lpString1=".docx", lpString2="nc[2]") returned -1 [0203.653] lstrlenW (lpString=".pdf") returned 4 [0203.653] lstrcmpiW (lpString1=".pdf", lpString2="c[2]") returned -1 [0203.653] lstrlenW (lpString=".xls") returned 4 [0203.653] lstrcmpiW (lpString1=".xls", lpString2="c[2]") returned -1 [0203.653] lstrlenW (lpString=".xlsx") returned 5 [0203.653] lstrcmpiW (lpString1=".xlsx", lpString2="nc[2]") returned -1 [0203.654] lstrlenW (lpString=".ppt") returned 4 [0203.654] lstrcmpiW (lpString1=".ppt", lpString2="c[2]") returned -1 [0203.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.654] lstrlenW (lpString=".zip") returned 4 [0203.654] lstrcmpiW (lpString1=".zip", lpString2="c[2]") returned -1 [0203.654] lstrlenW (lpString=".rar") returned 4 [0203.654] lstrcmpiW (lpString1=".rar", lpString2="c[2]") returned -1 [0203.654] lstrlenW (lpString=".bz2") returned 4 [0203.654] lstrcmpiW (lpString1=".bz2", lpString2="c[2]") returned -1 [0203.654] lstrlenW (lpString=".7z") returned 3 [0203.654] lstrcmpiW (lpString1=".7z", lpString2="[2]") returned -1 [0203.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.654] lstrlenW (lpString=".dbf") returned 4 [0203.654] lstrcmpiW (lpString1=".dbf", lpString2="c[2]") returned -1 [0203.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.654] lstrlenW (lpString=".1cd") returned 4 [0203.654] lstrcmpiW (lpString1=".1cd", lpString2="c[2]") returned -1 [0203.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.654] lstrlenW (lpString=".jpg") returned 4 [0203.654] lstrcmpiW (lpString1=".jpg", lpString2="c[2]") returned -1 [0203.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.654] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.654] lstrlenW (lpString=".doc") returned 4 [0203.654] lstrcmpiW (lpString1=".doc", lpString2="c[2]") returned -1 [0203.654] lstrlenW (lpString=".docx") returned 5 [0203.654] lstrcmpiW (lpString1=".docx", lpString2="nc[2]") returned -1 [0203.654] lstrlenW (lpString=".pdf") returned 4 [0203.655] lstrcmpiW (lpString1=".pdf", lpString2="c[2]") returned -1 [0203.655] lstrlenW (lpString=".xls") returned 4 [0203.655] lstrcmpiW (lpString1=".xls", lpString2="c[2]") returned -1 [0203.655] lstrlenW (lpString=".xlsx") returned 5 [0203.655] lstrcmpiW (lpString1=".xlsx", lpString2="nc[2]") returned -1 [0203.655] lstrlenW (lpString=".ppt") returned 4 [0203.655] lstrcmpiW (lpString1=".ppt", lpString2="c[2]") returned -1 [0203.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.655] lstrlenW (lpString=".zip") returned 4 [0203.655] lstrcmpiW (lpString1=".zip", lpString2="c[2]") returned -1 [0203.655] lstrlenW (lpString=".rar") returned 4 [0203.655] lstrcmpiW (lpString1=".rar", lpString2="c[2]") returned -1 [0203.655] lstrlenW (lpString=".bz2") returned 4 [0203.655] lstrcmpiW (lpString1=".bz2", lpString2="c[2]") returned -1 [0203.655] lstrlenW (lpString=".7z") returned 3 [0203.655] lstrcmpiW (lpString1=".7z", lpString2="[2]") returned -1 [0203.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.655] lstrlenW (lpString=".dbf") returned 4 [0203.655] lstrcmpiW (lpString1=".dbf", lpString2="c[2]") returned -1 [0203.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.655] lstrlenW (lpString=".1cd") returned 4 [0203.655] lstrcmpiW (lpString1=".1cd", lpString2="c[2]") returned -1 [0203.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[2]") returned 129 [0203.655] lstrlenW (lpString=".jpg") returned 4 [0203.655] lstrcmpiW (lpString1=".jpg", lpString2="c[2]") returned -1 [0203.655] lstrcmpiW (lpString1=".theme", lpString2=".wiki") returned -1 [0203.655] lstrlenW (lpString="Custom.theme") returned 12 [0203.655] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.656] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1802) returned 1 [0203.656] CloseHandle (hObject=0x2d4) returned 1 [0203.656] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme")) returned 0x2020 [0203.656] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.656] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.656] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.656] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.657] GetLastError () returned 0x0 [0203.657] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x70a, lpOverlapped=0x0) returned 1 [0203.659] WriteFile (in: hFile=0x378, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x710, lpOverlapped=0x0) returned 1 [0203.660] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.660] WriteFile (in: hFile=0x378, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xec, lpOverlapped=0x0) returned 1 [0203.660] SetEndOfFile (hFile=0x378) returned 1 [0203.660] CloseHandle (hObject=0x378) returned 1 [0203.660] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.660] SetEndOfFile (hFile=0x2d4) returned 1 [0203.661] CloseHandle (hObject=0x2d4) returned 1 [0203.661] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.661] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\themes\\custom.theme")) returned 1 [0203.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.661] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.661] lstrlenW (lpString=".doc") returned 4 [0203.661] lstrcmpiW (lpString1=".doc", lpString2="heme") returned -1 [0203.661] lstrlenW (lpString=".docx") returned 5 [0203.661] lstrcmpiW (lpString1=".docx", lpString2="theme") returned -1 [0203.661] lstrlenW (lpString=".pdf") returned 4 [0203.661] lstrcmpiW (lpString1=".pdf", lpString2="heme") returned -1 [0203.661] lstrlenW (lpString=".xls") returned 4 [0203.661] lstrcmpiW (lpString1=".xls", lpString2="heme") returned -1 [0203.661] lstrlenW (lpString=".xlsx") returned 5 [0203.661] lstrcmpiW (lpString1=".xlsx", lpString2="theme") returned -1 [0203.661] lstrlenW (lpString=".ppt") returned 4 [0203.661] lstrcmpiW (lpString1=".ppt", lpString2="heme") returned -1 [0203.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.662] lstrlenW (lpString=".zip") returned 4 [0203.662] lstrcmpiW (lpString1=".zip", lpString2="heme") returned -1 [0203.662] lstrlenW (lpString=".rar") returned 4 [0203.662] lstrcmpiW (lpString1=".rar", lpString2="heme") returned -1 [0203.662] lstrlenW (lpString=".bz2") returned 4 [0203.662] lstrcmpiW (lpString1=".bz2", lpString2="heme") returned -1 [0203.662] lstrlenW (lpString=".7z") returned 3 [0203.662] lstrcmpiW (lpString1=".7z", lpString2="eme") returned -1 [0203.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.662] lstrlenW (lpString=".dbf") returned 4 [0203.662] lstrcmpiW (lpString1=".dbf", lpString2="heme") returned -1 [0203.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.662] lstrlenW (lpString=".1cd") returned 4 [0203.662] lstrcmpiW (lpString1=".1cd", lpString2="heme") returned -1 [0203.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.662] lstrlenW (lpString=".jpg") returned 4 [0203.662] lstrcmpiW (lpString1=".jpg", lpString2="heme") returned -1 [0203.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.662] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.662] lstrlenW (lpString=".doc") returned 4 [0203.662] lstrcmpiW (lpString1=".doc", lpString2="heme") returned -1 [0203.662] lstrlenW (lpString=".docx") returned 5 [0203.662] lstrcmpiW (lpString1=".docx", lpString2="theme") returned -1 [0203.662] lstrlenW (lpString=".pdf") returned 4 [0203.662] lstrcmpiW (lpString1=".pdf", lpString2="heme") returned -1 [0203.662] lstrlenW (lpString=".xls") returned 4 [0203.662] lstrcmpiW (lpString1=".xls", lpString2="heme") returned -1 [0203.662] lstrlenW (lpString=".xlsx") returned 5 [0203.662] lstrcmpiW (lpString1=".xlsx", lpString2="theme") returned -1 [0203.662] lstrlenW (lpString=".ppt") returned 4 [0203.662] lstrcmpiW (lpString1=".ppt", lpString2="heme") returned -1 [0203.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.663] lstrlenW (lpString=".zip") returned 4 [0203.663] lstrcmpiW (lpString1=".zip", lpString2="heme") returned -1 [0203.663] lstrlenW (lpString=".rar") returned 4 [0203.663] lstrcmpiW (lpString1=".rar", lpString2="heme") returned -1 [0203.663] lstrlenW (lpString=".bz2") returned 4 [0203.663] lstrcmpiW (lpString1=".bz2", lpString2="heme") returned -1 [0203.663] lstrlenW (lpString=".7z") returned 3 [0203.663] lstrcmpiW (lpString1=".7z", lpString2="eme") returned -1 [0203.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.663] lstrlenW (lpString=".dbf") returned 4 [0203.663] lstrcmpiW (lpString1=".dbf", lpString2="heme") returned -1 [0203.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.663] lstrlenW (lpString=".1cd") returned 4 [0203.663] lstrcmpiW (lpString1=".1cd", lpString2="heme") returned -1 [0203.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Themes\\Custom.theme") returned 81 [0203.663] lstrlenW (lpString=".jpg") returned 4 [0203.663] lstrcmpiW (lpString1=".jpg", lpString2="heme") returned -1 [0203.663] lstrcmpiW (lpString1=".LOG1", lpString2=".wiki") returned -1 [0203.663] lstrlenW (lpString="UsrClass.dat.LOG1") returned 17 [0203.663] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.663] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.663] lstrlenW (lpString=".doc") returned 4 [0203.663] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0203.663] lstrlenW (lpString=".docx") returned 5 [0203.663] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0203.664] lstrlenW (lpString=".pdf") returned 4 [0203.664] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0203.664] lstrlenW (lpString=".xls") returned 4 [0203.664] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0203.664] lstrlenW (lpString=".xlsx") returned 5 [0203.664] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0203.664] lstrlenW (lpString=".ppt") returned 4 [0203.664] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0203.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.664] lstrlenW (lpString=".zip") returned 4 [0203.664] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0203.664] lstrlenW (lpString=".rar") returned 4 [0203.664] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0203.664] lstrlenW (lpString=".bz2") returned 4 [0203.664] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0203.664] lstrlenW (lpString=".7z") returned 3 [0203.664] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0203.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.664] lstrlenW (lpString=".dbf") returned 4 [0203.664] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0203.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.664] lstrlenW (lpString=".1cd") returned 4 [0203.664] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0203.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.664] lstrlenW (lpString=".jpg") returned 4 [0203.664] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0203.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.664] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.664] lstrlenW (lpString=".doc") returned 4 [0203.664] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0203.664] lstrlenW (lpString=".docx") returned 5 [0203.664] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0203.664] lstrlenW (lpString=".pdf") returned 4 [0203.665] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0203.665] lstrlenW (lpString=".xls") returned 4 [0203.665] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0203.665] lstrlenW (lpString=".xlsx") returned 5 [0203.665] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0203.665] lstrlenW (lpString=".ppt") returned 4 [0203.665] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0203.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.665] lstrlenW (lpString=".zip") returned 4 [0203.665] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0203.665] lstrlenW (lpString=".rar") returned 4 [0203.665] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0203.665] lstrlenW (lpString=".bz2") returned 4 [0203.665] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0203.665] lstrlenW (lpString=".7z") returned 3 [0203.665] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0203.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.665] lstrlenW (lpString=".dbf") returned 4 [0203.665] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0203.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.665] lstrlenW (lpString=".1cd") returned 4 [0203.665] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0203.665] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG1") returned 79 [0203.665] lstrlenW (lpString=".jpg") returned 4 [0203.665] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0203.665] lstrcmpiW (lpString1=".LOG2", lpString2=".wiki") returned -1 [0203.665] lstrlenW (lpString="UsrClass.dat.LOG2") returned 17 [0203.665] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.666] lstrlenW (lpString=".doc") returned 4 [0203.666] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0203.666] lstrlenW (lpString=".docx") returned 5 [0203.666] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0203.666] lstrlenW (lpString=".pdf") returned 4 [0203.666] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0203.666] lstrlenW (lpString=".xls") returned 4 [0203.666] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0203.666] lstrlenW (lpString=".xlsx") returned 5 [0203.666] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0203.666] lstrlenW (lpString=".ppt") returned 4 [0203.666] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0203.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.666] lstrlenW (lpString=".zip") returned 4 [0203.666] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0203.666] lstrlenW (lpString=".rar") returned 4 [0203.666] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0203.666] lstrlenW (lpString=".bz2") returned 4 [0203.666] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0203.666] lstrlenW (lpString=".7z") returned 3 [0203.666] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0203.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.666] lstrlenW (lpString=".dbf") returned 4 [0203.666] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0203.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.666] lstrlenW (lpString=".1cd") returned 4 [0203.666] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0203.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.666] lstrlenW (lpString=".jpg") returned 4 [0203.666] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0203.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.667] lstrlenW (lpString=".doc") returned 4 [0203.667] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0203.667] lstrlenW (lpString=".docx") returned 5 [0203.667] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0203.667] lstrlenW (lpString=".pdf") returned 4 [0203.667] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0203.667] lstrlenW (lpString=".xls") returned 4 [0203.667] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0203.667] lstrlenW (lpString=".xlsx") returned 5 [0203.667] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0203.667] lstrlenW (lpString=".ppt") returned 4 [0203.667] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0203.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.667] lstrlenW (lpString=".zip") returned 4 [0203.667] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0203.667] lstrlenW (lpString=".rar") returned 4 [0203.667] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0203.667] lstrlenW (lpString=".bz2") returned 4 [0203.667] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0203.667] lstrlenW (lpString=".7z") returned 3 [0203.667] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0203.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.667] lstrlenW (lpString=".dbf") returned 4 [0203.667] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0203.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.667] lstrlenW (lpString=".1cd") returned 4 [0203.667] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0203.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat.LOG2") returned 79 [0203.667] lstrlenW (lpString=".jpg") returned 4 [0203.667] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0203.668] lstrcmpiW (lpString1=".blf", lpString2=".wiki") returned -1 [0203.668] lstrlenW (lpString="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 57 [0203.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.668] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=65536) returned 1 [0203.668] CloseHandle (hObject=0x2d4) returned 1 [0203.668] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf")) returned 0x2026 [0203.668] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tm.blf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.668] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.669] lstrlenW (lpString=".doc") returned 4 [0203.669] lstrcmpiW (lpString1=".doc", lpString2=".blf") returned 1 [0203.669] lstrlenW (lpString=".docx") returned 5 [0203.669] lstrcmpiW (lpString1=".docx", lpString2="M.blf") returned -1 [0203.669] lstrlenW (lpString=".pdf") returned 4 [0203.669] lstrcmpiW (lpString1=".pdf", lpString2=".blf") returned 1 [0203.669] lstrlenW (lpString=".xls") returned 4 [0203.669] lstrcmpiW (lpString1=".xls", lpString2=".blf") returned 1 [0203.669] lstrlenW (lpString=".xlsx") returned 5 [0203.669] lstrcmpiW (lpString1=".xlsx", lpString2="M.blf") returned -1 [0203.669] lstrlenW (lpString=".ppt") returned 4 [0203.669] lstrcmpiW (lpString1=".ppt", lpString2=".blf") returned 1 [0203.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.669] lstrlenW (lpString=".zip") returned 4 [0203.669] lstrcmpiW (lpString1=".zip", lpString2=".blf") returned 1 [0203.669] lstrlenW (lpString=".rar") returned 4 [0203.669] lstrcmpiW (lpString1=".rar", lpString2=".blf") returned 1 [0203.669] lstrlenW (lpString=".bz2") returned 4 [0203.669] lstrcmpiW (lpString1=".bz2", lpString2=".blf") returned 1 [0203.669] lstrlenW (lpString=".7z") returned 3 [0203.669] lstrcmpiW (lpString1=".7z", lpString2="blf") returned -1 [0203.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.669] lstrlenW (lpString=".dbf") returned 4 [0203.669] lstrcmpiW (lpString1=".dbf", lpString2=".blf") returned 1 [0203.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.669] lstrlenW (lpString=".1cd") returned 4 [0203.669] lstrcmpiW (lpString1=".1cd", lpString2=".blf") returned -1 [0203.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.669] lstrlenW (lpString=".jpg") returned 4 [0203.669] lstrcmpiW (lpString1=".jpg", lpString2=".blf") returned 1 [0203.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.669] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.669] lstrlenW (lpString=".doc") returned 4 [0203.670] lstrcmpiW (lpString1=".doc", lpString2=".blf") returned 1 [0203.670] lstrlenW (lpString=".docx") returned 5 [0203.670] lstrcmpiW (lpString1=".docx", lpString2="M.blf") returned -1 [0203.670] lstrlenW (lpString=".pdf") returned 4 [0203.670] lstrcmpiW (lpString1=".pdf", lpString2=".blf") returned 1 [0203.670] lstrlenW (lpString=".xls") returned 4 [0203.670] lstrcmpiW (lpString1=".xls", lpString2=".blf") returned 1 [0203.670] lstrlenW (lpString=".xlsx") returned 5 [0203.670] lstrcmpiW (lpString1=".xlsx", lpString2="M.blf") returned -1 [0203.670] lstrlenW (lpString=".ppt") returned 4 [0203.670] lstrcmpiW (lpString1=".ppt", lpString2=".blf") returned 1 [0203.670] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.670] lstrlenW (lpString=".zip") returned 4 [0203.670] lstrcmpiW (lpString1=".zip", lpString2=".blf") returned 1 [0203.670] lstrlenW (lpString=".rar") returned 4 [0203.670] lstrcmpiW (lpString1=".rar", lpString2=".blf") returned 1 [0203.670] lstrlenW (lpString=".bz2") returned 4 [0203.670] lstrcmpiW (lpString1=".bz2", lpString2=".blf") returned 1 [0203.670] lstrlenW (lpString=".7z") returned 3 [0203.670] lstrcmpiW (lpString1=".7z", lpString2="blf") returned -1 [0203.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.671] lstrlenW (lpString=".dbf") returned 4 [0203.671] lstrcmpiW (lpString1=".dbf", lpString2=".blf") returned 1 [0203.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.671] lstrlenW (lpString=".1cd") returned 4 [0203.671] lstrcmpiW (lpString1=".1cd", lpString2=".blf") returned -1 [0203.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TM.blf") returned 119 [0203.671] lstrlenW (lpString=".jpg") returned 4 [0203.671] lstrcmpiW (lpString1=".jpg", lpString2=".blf") returned 1 [0203.671] lstrcmpiW (lpString1=".regtrans-ms", lpString2=".wiki") returned -1 [0203.671] lstrlenW (lpString="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 94 [0203.671] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.671] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=524288) returned 1 [0203.671] CloseHandle (hObject=0x2d4) returned 1 [0203.671] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms")) returned 0x2026 [0203.672] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.672] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000001.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.672] lstrlenW (lpString=".doc") returned 4 [0203.672] lstrcmpiW (lpString1=".doc", lpString2="s-ms") returned -1 [0203.672] lstrlenW (lpString=".docx") returned 5 [0203.672] lstrcmpiW (lpString1=".docx", lpString2="ns-ms") returned -1 [0203.672] lstrlenW (lpString=".pdf") returned 4 [0203.672] lstrcmpiW (lpString1=".pdf", lpString2="s-ms") returned -1 [0203.672] lstrlenW (lpString=".xls") returned 4 [0203.672] lstrcmpiW (lpString1=".xls", lpString2="s-ms") returned -1 [0203.672] lstrlenW (lpString=".xlsx") returned 5 [0203.672] lstrcmpiW (lpString1=".xlsx", lpString2="ns-ms") returned -1 [0203.672] lstrlenW (lpString=".ppt") returned 4 [0203.672] lstrcmpiW (lpString1=".ppt", lpString2="s-ms") returned -1 [0203.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.672] lstrlenW (lpString=".zip") returned 4 [0203.672] lstrcmpiW (lpString1=".zip", lpString2="s-ms") returned -1 [0203.672] lstrlenW (lpString=".rar") returned 4 [0203.672] lstrcmpiW (lpString1=".rar", lpString2="s-ms") returned -1 [0203.672] lstrlenW (lpString=".bz2") returned 4 [0203.672] lstrcmpiW (lpString1=".bz2", lpString2="s-ms") returned -1 [0203.672] lstrlenW (lpString=".7z") returned 3 [0203.672] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.672] lstrlenW (lpString=".dbf") returned 4 [0203.672] lstrcmpiW (lpString1=".dbf", lpString2="s-ms") returned -1 [0203.672] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.673] lstrlenW (lpString=".1cd") returned 4 [0203.673] lstrcmpiW (lpString1=".1cd", lpString2="s-ms") returned -1 [0203.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.673] lstrlenW (lpString=".jpg") returned 4 [0203.673] lstrcmpiW (lpString1=".jpg", lpString2="s-ms") returned -1 [0203.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.673] lstrlenW (lpString=".doc") returned 4 [0203.673] lstrcmpiW (lpString1=".doc", lpString2="s-ms") returned -1 [0203.673] lstrlenW (lpString=".docx") returned 5 [0203.673] lstrcmpiW (lpString1=".docx", lpString2="ns-ms") returned -1 [0203.673] lstrlenW (lpString=".pdf") returned 4 [0203.673] lstrcmpiW (lpString1=".pdf", lpString2="s-ms") returned -1 [0203.673] lstrlenW (lpString=".xls") returned 4 [0203.673] lstrcmpiW (lpString1=".xls", lpString2="s-ms") returned -1 [0203.673] lstrlenW (lpString=".xlsx") returned 5 [0203.673] lstrcmpiW (lpString1=".xlsx", lpString2="ns-ms") returned -1 [0203.673] lstrlenW (lpString=".ppt") returned 4 [0203.673] lstrcmpiW (lpString1=".ppt", lpString2="s-ms") returned -1 [0203.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.673] lstrlenW (lpString=".zip") returned 4 [0203.673] lstrcmpiW (lpString1=".zip", lpString2="s-ms") returned -1 [0203.673] lstrlenW (lpString=".rar") returned 4 [0203.673] lstrcmpiW (lpString1=".rar", lpString2="s-ms") returned -1 [0203.673] lstrlenW (lpString=".bz2") returned 4 [0203.673] lstrcmpiW (lpString1=".bz2", lpString2="s-ms") returned -1 [0203.673] lstrlenW (lpString=".7z") returned 3 [0203.673] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.673] lstrlenW (lpString=".dbf") returned 4 [0203.673] lstrcmpiW (lpString1=".dbf", lpString2="s-ms") returned -1 [0203.673] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.673] lstrlenW (lpString=".1cd") returned 4 [0203.674] lstrcmpiW (lpString1=".1cd", lpString2="s-ms") returned -1 [0203.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000001.regtrans-ms") returned 156 [0203.674] lstrlenW (lpString=".jpg") returned 4 [0203.674] lstrcmpiW (lpString1=".jpg", lpString2="s-ms") returned -1 [0203.674] lstrcmpiW (lpString1=".regtrans-ms", lpString2=".wiki") returned -1 [0203.674] lstrlenW (lpString="UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 94 [0203.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.674] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=524288) returned 1 [0203.674] CloseHandle (hObject=0x2d4) returned 1 [0203.674] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms")) returned 0x2026 [0203.674] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.674] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\usrclass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.tmcontainer00000000000000000002.regtrans-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.675] lstrlenW (lpString=".doc") returned 4 [0203.675] lstrcmpiW (lpString1=".doc", lpString2="s-ms") returned -1 [0203.675] lstrlenW (lpString=".docx") returned 5 [0203.675] lstrcmpiW (lpString1=".docx", lpString2="ns-ms") returned -1 [0203.675] lstrlenW (lpString=".pdf") returned 4 [0203.675] lstrcmpiW (lpString1=".pdf", lpString2="s-ms") returned -1 [0203.675] lstrlenW (lpString=".xls") returned 4 [0203.675] lstrcmpiW (lpString1=".xls", lpString2="s-ms") returned -1 [0203.675] lstrlenW (lpString=".xlsx") returned 5 [0203.675] lstrcmpiW (lpString1=".xlsx", lpString2="ns-ms") returned -1 [0203.675] lstrlenW (lpString=".ppt") returned 4 [0203.675] lstrcmpiW (lpString1=".ppt", lpString2="s-ms") returned -1 [0203.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.675] lstrlenW (lpString=".zip") returned 4 [0203.675] lstrcmpiW (lpString1=".zip", lpString2="s-ms") returned -1 [0203.675] lstrlenW (lpString=".rar") returned 4 [0203.675] lstrcmpiW (lpString1=".rar", lpString2="s-ms") returned -1 [0203.675] lstrlenW (lpString=".bz2") returned 4 [0203.675] lstrcmpiW (lpString1=".bz2", lpString2="s-ms") returned -1 [0203.675] lstrlenW (lpString=".7z") returned 3 [0203.675] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.675] lstrlenW (lpString=".dbf") returned 4 [0203.675] lstrcmpiW (lpString1=".dbf", lpString2="s-ms") returned -1 [0203.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.675] lstrlenW (lpString=".1cd") returned 4 [0203.675] lstrcmpiW (lpString1=".1cd", lpString2="s-ms") returned -1 [0203.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.675] lstrlenW (lpString=".jpg") returned 4 [0203.675] lstrcmpiW (lpString1=".jpg", lpString2="s-ms") returned -1 [0203.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.676] lstrlenW (lpString=".doc") returned 4 [0203.676] lstrcmpiW (lpString1=".doc", lpString2="s-ms") returned -1 [0203.676] lstrlenW (lpString=".docx") returned 5 [0203.676] lstrcmpiW (lpString1=".docx", lpString2="ns-ms") returned -1 [0203.676] lstrlenW (lpString=".pdf") returned 4 [0203.676] lstrcmpiW (lpString1=".pdf", lpString2="s-ms") returned -1 [0203.676] lstrlenW (lpString=".xls") returned 4 [0203.676] lstrcmpiW (lpString1=".xls", lpString2="s-ms") returned -1 [0203.676] lstrlenW (lpString=".xlsx") returned 5 [0203.676] lstrcmpiW (lpString1=".xlsx", lpString2="ns-ms") returned -1 [0203.676] lstrlenW (lpString=".ppt") returned 4 [0203.676] lstrcmpiW (lpString1=".ppt", lpString2="s-ms") returned -1 [0203.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.676] lstrlenW (lpString=".zip") returned 4 [0203.676] lstrcmpiW (lpString1=".zip", lpString2="s-ms") returned -1 [0203.676] lstrlenW (lpString=".rar") returned 4 [0203.676] lstrcmpiW (lpString1=".rar", lpString2="s-ms") returned -1 [0203.676] lstrlenW (lpString=".bz2") returned 4 [0203.676] lstrcmpiW (lpString1=".bz2", lpString2="s-ms") returned -1 [0203.676] lstrlenW (lpString=".7z") returned 3 [0203.676] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0203.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.676] lstrlenW (lpString=".dbf") returned 4 [0203.676] lstrcmpiW (lpString1=".dbf", lpString2="s-ms") returned -1 [0203.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.676] lstrlenW (lpString=".1cd") returned 4 [0203.676] lstrcmpiW (lpString1=".1cd", lpString2="s-ms") returned -1 [0203.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\UsrClass.dat{0f6d7aa7-f51a-11df-ae0e-001d09f21116}.TMContainer00000000000000000002.regtrans-ms") returned 156 [0203.676] lstrlenW (lpString=".jpg") returned 4 [0203.676] lstrcmpiW (lpString1=".jpg", lpString2="s-ms") returned -1 [0203.677] lstrcmpiW (lpString1=".oeaccount", lpString2=".wiki") returned -1 [0203.677] lstrlenW (lpString="account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 55 [0203.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.677] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=1508) returned 1 [0203.677] CloseHandle (hObject=0x2d4) returned 1 [0203.677] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount")) returned 0x2020 [0203.677] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.677] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.678] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.678] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.678] GetLastError () returned 0x0 [0203.678] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x5e4, lpOverlapped=0x0) returned 1 [0203.679] WriteFile (in: hFile=0x378, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0203.680] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.680] WriteFile (in: hFile=0x378, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x142, lpOverlapped=0x0) returned 1 [0203.680] SetEndOfFile (hFile=0x378) returned 1 [0203.681] CloseHandle (hObject=0x378) returned 1 [0203.681] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.681] SetEndOfFile (hFile=0x2d4) returned 1 [0203.681] CloseHandle (hObject=0x2d4) returned 1 [0203.681] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.682] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{047ef9ce-9c1f-4250-9ca7-d206db8b643c}.oeaccount")) returned 1 [0203.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.682] lstrlenW (lpString=".doc") returned 4 [0203.682] lstrcmpiW (lpString1=".doc", lpString2="ount") returned -1 [0203.682] lstrlenW (lpString=".docx") returned 5 [0203.682] lstrcmpiW (lpString1=".docx", lpString2="count") returned -1 [0203.682] lstrlenW (lpString=".pdf") returned 4 [0203.682] lstrcmpiW (lpString1=".pdf", lpString2="ount") returned -1 [0203.682] lstrlenW (lpString=".xls") returned 4 [0203.682] lstrcmpiW (lpString1=".xls", lpString2="ount") returned -1 [0203.682] lstrlenW (lpString=".xlsx") returned 5 [0203.682] lstrcmpiW (lpString1=".xlsx", lpString2="count") returned -1 [0203.682] lstrlenW (lpString=".ppt") returned 4 [0203.682] lstrcmpiW (lpString1=".ppt", lpString2="ount") returned -1 [0203.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.682] lstrlenW (lpString=".zip") returned 4 [0203.682] lstrcmpiW (lpString1=".zip", lpString2="ount") returned -1 [0203.682] lstrlenW (lpString=".rar") returned 4 [0203.682] lstrcmpiW (lpString1=".rar", lpString2="ount") returned -1 [0203.682] lstrlenW (lpString=".bz2") returned 4 [0203.682] lstrcmpiW (lpString1=".bz2", lpString2="ount") returned -1 [0203.682] lstrlenW (lpString=".7z") returned 3 [0203.682] lstrcmpiW (lpString1=".7z", lpString2="unt") returned -1 [0203.682] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.683] lstrlenW (lpString=".dbf") returned 4 [0203.683] lstrcmpiW (lpString1=".dbf", lpString2="ount") returned -1 [0203.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.683] lstrlenW (lpString=".1cd") returned 4 [0203.683] lstrcmpiW (lpString1=".1cd", lpString2="ount") returned -1 [0203.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.683] lstrlenW (lpString=".jpg") returned 4 [0203.683] lstrcmpiW (lpString1=".jpg", lpString2="ount") returned -1 [0203.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.683] lstrlenW (lpString=".doc") returned 4 [0203.683] lstrcmpiW (lpString1=".doc", lpString2="ount") returned -1 [0203.683] lstrlenW (lpString=".docx") returned 5 [0203.683] lstrcmpiW (lpString1=".docx", lpString2="count") returned -1 [0203.683] lstrlenW (lpString=".pdf") returned 4 [0203.683] lstrcmpiW (lpString1=".pdf", lpString2="ount") returned -1 [0203.683] lstrlenW (lpString=".xls") returned 4 [0203.683] lstrcmpiW (lpString1=".xls", lpString2="ount") returned -1 [0203.683] lstrlenW (lpString=".xlsx") returned 5 [0203.683] lstrcmpiW (lpString1=".xlsx", lpString2="count") returned -1 [0203.683] lstrlenW (lpString=".ppt") returned 4 [0203.683] lstrcmpiW (lpString1=".ppt", lpString2="ount") returned -1 [0203.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.683] lstrlenW (lpString=".zip") returned 4 [0203.683] lstrcmpiW (lpString1=".zip", lpString2="ount") returned -1 [0203.683] lstrlenW (lpString=".rar") returned 4 [0203.683] lstrcmpiW (lpString1=".rar", lpString2="ount") returned -1 [0203.683] lstrlenW (lpString=".bz2") returned 4 [0203.683] lstrcmpiW (lpString1=".bz2", lpString2="ount") returned -1 [0203.683] lstrlenW (lpString=".7z") returned 3 [0203.683] lstrcmpiW (lpString1=".7z", lpString2="unt") returned -1 [0203.683] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.683] lstrlenW (lpString=".dbf") returned 4 [0203.684] lstrcmpiW (lpString1=".dbf", lpString2="ount") returned -1 [0203.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.684] lstrlenW (lpString=".1cd") returned 4 [0203.684] lstrcmpiW (lpString1=".1cd", lpString2="ount") returned -1 [0203.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{047EF9CE-9C1F-4250-9CA7-D206DB8B643C}.oeaccount") returned 122 [0203.684] lstrlenW (lpString=".jpg") returned 4 [0203.684] lstrcmpiW (lpString1=".jpg", lpString2="ount") returned -1 [0203.684] lstrcmpiW (lpString1=".oeaccount", lpString2=".wiki") returned -1 [0203.684] lstrlenW (lpString="account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 55 [0203.684] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.684] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=672) returned 1 [0203.684] CloseHandle (hObject=0x2d4) returned 1 [0203.684] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount")) returned 0x2020 [0203.685] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.685] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.685] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.685] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.829] GetLastError () returned 0x0 [0203.829] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x2a0, lpOverlapped=0x0) returned 1 [0203.831] WriteFile (in: hFile=0x378, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0203.832] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0203.832] WriteFile (in: hFile=0x378, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x142, lpOverlapped=0x0) returned 1 [0203.832] SetEndOfFile (hFile=0x378) returned 1 [0203.832] CloseHandle (hObject=0x378) returned 1 [0203.832] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.832] SetEndOfFile (hFile=0x2d4) returned 1 [0203.833] CloseHandle (hObject=0x2d4) returned 1 [0203.833] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.833] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{1cd43f3b-668b-4ca8-b816-34f74122ec0f}.oeaccount")) returned 1 [0203.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.833] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.833] lstrlenW (lpString=".doc") returned 4 [0203.833] lstrcmpiW (lpString1=".doc", lpString2="ount") returned -1 [0203.833] lstrlenW (lpString=".docx") returned 5 [0203.833] lstrcmpiW (lpString1=".docx", lpString2="count") returned -1 [0203.833] lstrlenW (lpString=".pdf") returned 4 [0203.833] lstrcmpiW (lpString1=".pdf", lpString2="ount") returned -1 [0203.833] lstrlenW (lpString=".xls") returned 4 [0203.833] lstrcmpiW (lpString1=".xls", lpString2="ount") returned -1 [0203.833] lstrlenW (lpString=".xlsx") returned 5 [0203.833] lstrcmpiW (lpString1=".xlsx", lpString2="count") returned -1 [0203.833] lstrlenW (lpString=".ppt") returned 4 [0203.834] lstrcmpiW (lpString1=".ppt", lpString2="ount") returned -1 [0203.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.834] lstrlenW (lpString=".zip") returned 4 [0203.834] lstrcmpiW (lpString1=".zip", lpString2="ount") returned -1 [0203.834] lstrlenW (lpString=".rar") returned 4 [0203.834] lstrcmpiW (lpString1=".rar", lpString2="ount") returned -1 [0203.834] lstrlenW (lpString=".bz2") returned 4 [0203.834] lstrcmpiW (lpString1=".bz2", lpString2="ount") returned -1 [0203.834] lstrlenW (lpString=".7z") returned 3 [0203.834] lstrcmpiW (lpString1=".7z", lpString2="unt") returned -1 [0203.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.834] lstrlenW (lpString=".dbf") returned 4 [0203.834] lstrcmpiW (lpString1=".dbf", lpString2="ount") returned -1 [0203.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.834] lstrlenW (lpString=".1cd") returned 4 [0203.834] lstrcmpiW (lpString1=".1cd", lpString2="ount") returned -1 [0203.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.834] lstrlenW (lpString=".jpg") returned 4 [0203.834] lstrcmpiW (lpString1=".jpg", lpString2="ount") returned -1 [0203.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.834] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.834] lstrlenW (lpString=".doc") returned 4 [0203.834] lstrcmpiW (lpString1=".doc", lpString2="ount") returned -1 [0203.834] lstrlenW (lpString=".docx") returned 5 [0203.834] lstrcmpiW (lpString1=".docx", lpString2="count") returned -1 [0203.834] lstrlenW (lpString=".pdf") returned 4 [0203.834] lstrcmpiW (lpString1=".pdf", lpString2="ount") returned -1 [0203.834] lstrlenW (lpString=".xls") returned 4 [0203.834] lstrcmpiW (lpString1=".xls", lpString2="ount") returned -1 [0203.834] lstrlenW (lpString=".xlsx") returned 5 [0203.834] lstrcmpiW (lpString1=".xlsx", lpString2="count") returned -1 [0203.835] lstrlenW (lpString=".ppt") returned 4 [0203.835] lstrcmpiW (lpString1=".ppt", lpString2="ount") returned -1 [0203.835] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.835] lstrlenW (lpString=".zip") returned 4 [0203.835] lstrcmpiW (lpString1=".zip", lpString2="ount") returned -1 [0203.835] lstrlenW (lpString=".rar") returned 4 [0203.835] lstrcmpiW (lpString1=".rar", lpString2="ount") returned -1 [0203.835] lstrlenW (lpString=".bz2") returned 4 [0203.835] lstrcmpiW (lpString1=".bz2", lpString2="ount") returned -1 [0203.835] lstrlenW (lpString=".7z") returned 3 [0203.835] lstrcmpiW (lpString1=".7z", lpString2="unt") returned -1 [0203.835] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.835] lstrlenW (lpString=".dbf") returned 4 [0203.835] lstrcmpiW (lpString1=".dbf", lpString2="ount") returned -1 [0203.835] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.835] lstrlenW (lpString=".1cd") returned 4 [0203.835] lstrcmpiW (lpString1=".1cd", lpString2="ount") returned -1 [0203.835] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{1CD43F3B-668B-4CA8-B816-34F74122EC0F}.oeaccount") returned 122 [0203.835] lstrlenW (lpString=".jpg") returned 4 [0203.835] lstrcmpiW (lpString1=".jpg", lpString2="ount") returned -1 [0203.835] lstrcmpiW (lpString1=".MSMessageStore", lpString2=".wiki") returned -1 [0203.835] lstrlenW (lpString="WindowsMail.MSMessageStore") returned 26 [0203.835] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.837] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=2113536) returned 1 [0203.837] CloseHandle (hObject=0x2d4) returned 1 [0203.837] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore")) returned 0x2020 [0203.837] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.837] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0203.838] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.msmessagestore.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.838] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc6c | out: lpNewFilePointer=0x0) returned 1 [0203.838] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc2c | out: lpNewFilePointer=0x0) returned 1 [0203.838] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x33bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.842] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xac000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc2c | out: lpNewFilePointer=0x0) returned 1 [0203.842] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f20058*, lpNumberOfBytesRead=0x33bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.847] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0203.847] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x1c4000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc2c | out: lpNewFilePointer=0x0) returned 1 [0203.847] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f60058*, lpNumberOfBytesRead=0x33bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.871] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0203.871] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xc0120, lpNumberOfBytesWritten=0x33bfcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfcb0*=0xc0120, lpOverlapped=0x0) returned 1 [0204.009] SetEndOfFile (hFile=0x2d4) returned 1 [0204.009] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40000) returned 0x42a0008 [0204.009] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc7c | out: lpNewFilePointer=0x0) returned 1 [0204.009] WriteFile (in: hFile=0x2d4, lpBuffer=0x42a0008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33bfc88, lpOverlapped=0x0 | out: lpBuffer=0x42a0008*, lpNumberOfBytesWritten=0x33bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.010] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xac000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc7c | out: lpNewFilePointer=0x0) returned 1 [0204.010] WriteFile (in: hFile=0x2d4, lpBuffer=0x42a0008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33bfc88, lpOverlapped=0x0 | out: lpBuffer=0x42a0008*, lpNumberOfBytesWritten=0x33bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.012] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x1c4000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc7c | out: lpNewFilePointer=0x0) returned 1 [0204.012] WriteFile (in: hFile=0x2d4, lpBuffer=0x42a0008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x33bfc88, lpOverlapped=0x0 | out: lpBuffer=0x42a0008*, lpNumberOfBytesWritten=0x33bfc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.014] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x42a0008 | out: hHeap=0x270000) returned 1 [0204.014] CloseHandle (hObject=0x2d4) returned 1 [0204.014] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.014] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.014] lstrlenW (lpString=".doc") returned 4 [0204.014] lstrcmpiW (lpString1=".doc", lpString2="tore") returned -1 [0204.014] lstrlenW (lpString=".docx") returned 5 [0204.014] lstrcmpiW (lpString1=".docx", lpString2="Store") returned -1 [0204.014] lstrlenW (lpString=".pdf") returned 4 [0204.014] lstrcmpiW (lpString1=".pdf", lpString2="tore") returned -1 [0204.014] lstrlenW (lpString=".xls") returned 4 [0204.014] lstrcmpiW (lpString1=".xls", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString=".xlsx") returned 5 [0204.015] lstrcmpiW (lpString1=".xlsx", lpString2="Store") returned -1 [0204.015] lstrlenW (lpString=".ppt") returned 4 [0204.015] lstrcmpiW (lpString1=".ppt", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.015] lstrlenW (lpString=".zip") returned 4 [0204.015] lstrcmpiW (lpString1=".zip", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString=".rar") returned 4 [0204.015] lstrcmpiW (lpString1=".rar", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString=".bz2") returned 4 [0204.015] lstrcmpiW (lpString1=".bz2", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString=".7z") returned 3 [0204.015] lstrcmpiW (lpString1=".7z", lpString2="ore") returned -1 [0204.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.015] lstrlenW (lpString=".dbf") returned 4 [0204.015] lstrcmpiW (lpString1=".dbf", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.015] lstrlenW (lpString=".1cd") returned 4 [0204.015] lstrcmpiW (lpString1=".1cd", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.015] lstrlenW (lpString=".jpg") returned 4 [0204.015] lstrcmpiW (lpString1=".jpg", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.015] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.015] lstrlenW (lpString=".doc") returned 4 [0204.015] lstrcmpiW (lpString1=".doc", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString=".docx") returned 5 [0204.015] lstrcmpiW (lpString1=".docx", lpString2="Store") returned -1 [0204.015] lstrlenW (lpString=".pdf") returned 4 [0204.015] lstrcmpiW (lpString1=".pdf", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString=".xls") returned 4 [0204.015] lstrcmpiW (lpString1=".xls", lpString2="tore") returned -1 [0204.015] lstrlenW (lpString=".xlsx") returned 5 [0204.016] lstrcmpiW (lpString1=".xlsx", lpString2="Store") returned -1 [0204.016] lstrlenW (lpString=".ppt") returned 4 [0204.016] lstrcmpiW (lpString1=".ppt", lpString2="tore") returned -1 [0204.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.016] lstrlenW (lpString=".zip") returned 4 [0204.016] lstrcmpiW (lpString1=".zip", lpString2="tore") returned -1 [0204.016] lstrlenW (lpString=".rar") returned 4 [0204.016] lstrcmpiW (lpString1=".rar", lpString2="tore") returned -1 [0204.016] lstrlenW (lpString=".bz2") returned 4 [0204.016] lstrcmpiW (lpString1=".bz2", lpString2="tore") returned -1 [0204.016] lstrlenW (lpString=".7z") returned 3 [0204.016] lstrcmpiW (lpString1=".7z", lpString2="ore") returned -1 [0204.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.016] lstrlenW (lpString=".dbf") returned 4 [0204.016] lstrcmpiW (lpString1=".dbf", lpString2="tore") returned -1 [0204.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.016] lstrlenW (lpString=".1cd") returned 4 [0204.016] lstrcmpiW (lpString1=".1cd", lpString2="tore") returned -1 [0204.016] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.MSMessageStore") returned 93 [0204.016] lstrlenW (lpString=".jpg") returned 4 [0204.016] lstrcmpiW (lpString1=".jpg", lpString2="tore") returned -1 [0204.016] lstrcmpiW (lpString1=".default\\Cache\\0\\A8\\C3B7Bd01", lpString2=".wiki") returned -1 [0204.016] lstrlenW (lpString="C3B7Bd01") returned 8 [0204.016] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0204.017] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=18584) returned 1 [0204.017] CloseHandle (hObject=0x2d4) returned 1 [0204.017] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01")) returned 0x2020 [0204.017] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.017] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0204.017] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.018] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.018] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0204.018] GetLastError () returned 0x0 [0204.018] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x4898, lpOverlapped=0x0) returned 1 [0204.033] WriteFile (in: hFile=0x154, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0x48a0, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0x48a0, lpOverlapped=0x0) returned 1 [0204.034] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.034] WriteFile (in: hFile=0x154, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.034] SetEndOfFile (hFile=0x154) returned 1 [0204.034] CloseHandle (hObject=0x154) returned 1 [0204.034] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.034] SetEndOfFile (hFile=0x2d4) returned 1 [0204.035] CloseHandle (hObject=0x2d4) returned 1 [0204.036] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.036] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\a8\\c3b7bd01")) returned 1 [0204.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.037] lstrlenW (lpString=".doc") returned 4 [0204.037] lstrcmpiW (lpString1=".doc", lpString2="Bd01") returned -1 [0204.037] lstrlenW (lpString=".docx") returned 5 [0204.037] lstrcmpiW (lpString1=".docx", lpString2="7Bd01") returned -1 [0204.037] lstrlenW (lpString=".pdf") returned 4 [0204.037] lstrcmpiW (lpString1=".pdf", lpString2="Bd01") returned -1 [0204.037] lstrlenW (lpString=".xls") returned 4 [0204.037] lstrcmpiW (lpString1=".xls", lpString2="Bd01") returned -1 [0204.037] lstrlenW (lpString=".xlsx") returned 5 [0204.037] lstrcmpiW (lpString1=".xlsx", lpString2="7Bd01") returned -1 [0204.037] lstrlenW (lpString=".ppt") returned 4 [0204.037] lstrcmpiW (lpString1=".ppt", lpString2="Bd01") returned -1 [0204.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.037] lstrlenW (lpString=".zip") returned 4 [0204.037] lstrcmpiW (lpString1=".zip", lpString2="Bd01") returned -1 [0204.037] lstrlenW (lpString=".rar") returned 4 [0204.037] lstrcmpiW (lpString1=".rar", lpString2="Bd01") returned -1 [0204.037] lstrlenW (lpString=".bz2") returned 4 [0204.037] lstrcmpiW (lpString1=".bz2", lpString2="Bd01") returned -1 [0204.037] lstrlenW (lpString=".7z") returned 3 [0204.037] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.037] lstrlenW (lpString=".dbf") returned 4 [0204.037] lstrcmpiW (lpString1=".dbf", lpString2="Bd01") returned -1 [0204.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.037] lstrlenW (lpString=".1cd") returned 4 [0204.037] lstrcmpiW (lpString1=".1cd", lpString2="Bd01") returned -1 [0204.037] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.037] lstrlenW (lpString=".jpg") returned 4 [0204.038] lstrcmpiW (lpString1=".jpg", lpString2="Bd01") returned -1 [0204.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.038] lstrlenW (lpString=".doc") returned 4 [0204.038] lstrcmpiW (lpString1=".doc", lpString2="Bd01") returned -1 [0204.038] lstrlenW (lpString=".docx") returned 5 [0204.038] lstrcmpiW (lpString1=".docx", lpString2="7Bd01") returned -1 [0204.038] lstrlenW (lpString=".pdf") returned 4 [0204.038] lstrcmpiW (lpString1=".pdf", lpString2="Bd01") returned -1 [0204.038] lstrlenW (lpString=".xls") returned 4 [0204.038] lstrcmpiW (lpString1=".xls", lpString2="Bd01") returned -1 [0204.038] lstrlenW (lpString=".xlsx") returned 5 [0204.038] lstrcmpiW (lpString1=".xlsx", lpString2="7Bd01") returned -1 [0204.038] lstrlenW (lpString=".ppt") returned 4 [0204.038] lstrcmpiW (lpString1=".ppt", lpString2="Bd01") returned -1 [0204.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.038] lstrlenW (lpString=".zip") returned 4 [0204.038] lstrcmpiW (lpString1=".zip", lpString2="Bd01") returned -1 [0204.038] lstrlenW (lpString=".rar") returned 4 [0204.038] lstrcmpiW (lpString1=".rar", lpString2="Bd01") returned -1 [0204.038] lstrlenW (lpString=".bz2") returned 4 [0204.038] lstrcmpiW (lpString1=".bz2", lpString2="Bd01") returned -1 [0204.038] lstrlenW (lpString=".7z") returned 3 [0204.038] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.038] lstrlenW (lpString=".dbf") returned 4 [0204.038] lstrcmpiW (lpString1=".dbf", lpString2="Bd01") returned -1 [0204.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.038] lstrlenW (lpString=".1cd") returned 4 [0204.038] lstrcmpiW (lpString1=".1cd", lpString2="Bd01") returned -1 [0204.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\A8\\C3B7Bd01") returned 105 [0204.038] lstrlenW (lpString=".jpg") returned 4 [0204.038] lstrcmpiW (lpString1=".jpg", lpString2="Bd01") returned -1 [0204.039] lstrcmpiW (lpString1=".default\\Cache\\1\\F6\\CBD4Dd01", lpString2=".wiki") returned -1 [0204.039] lstrlenW (lpString="CBD4Dd01") returned 8 [0204.039] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0204.039] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=42507) returned 1 [0204.039] CloseHandle (hObject=0x2d4) returned 1 [0204.039] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01")) returned 0x2020 [0204.039] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0204.040] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.040] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0204.040] GetLastError () returned 0x0 [0204.040] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0xa60b, lpOverlapped=0x0) returned 1 [0204.393] WriteFile (in: hFile=0x154, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xa610, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xa610, lpOverlapped=0x0) returned 1 [0204.395] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33bfed4, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesRead=0x33bfed4*=0x0, lpOverlapped=0x0) returned 1 [0204.395] WriteFile (in: hFile=0x154, lpBuffer=0x3ee0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x33bfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ee0020*, lpNumberOfBytesWritten=0x33bfc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.395] SetEndOfFile (hFile=0x154) returned 1 [0204.395] CloseHandle (hObject=0x154) returned 1 [0204.395] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.395] SetEndOfFile (hFile=0x2d4) returned 1 [0204.396] CloseHandle (hObject=0x2d4) returned 1 [0204.396] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.396] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\f6\\cbd4dd01")) returned 1 [0204.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.396] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.397] lstrlenW (lpString=".doc") returned 4 [0204.397] lstrcmpiW (lpString1=".doc", lpString2="Dd01") returned -1 [0204.397] lstrlenW (lpString=".docx") returned 5 [0204.397] lstrcmpiW (lpString1=".docx", lpString2="4Dd01") returned -1 [0204.397] lstrlenW (lpString=".pdf") returned 4 [0204.397] lstrcmpiW (lpString1=".pdf", lpString2="Dd01") returned -1 [0204.397] lstrlenW (lpString=".xls") returned 4 [0204.397] lstrcmpiW (lpString1=".xls", lpString2="Dd01") returned -1 [0204.397] lstrlenW (lpString=".xlsx") returned 5 [0204.397] lstrcmpiW (lpString1=".xlsx", lpString2="4Dd01") returned -1 [0204.397] lstrlenW (lpString=".ppt") returned 4 [0204.397] lstrcmpiW (lpString1=".ppt", lpString2="Dd01") returned -1 [0204.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.397] lstrlenW (lpString=".zip") returned 4 [0204.397] lstrcmpiW (lpString1=".zip", lpString2="Dd01") returned -1 [0204.397] lstrlenW (lpString=".rar") returned 4 [0204.397] lstrcmpiW (lpString1=".rar", lpString2="Dd01") returned -1 [0204.397] lstrlenW (lpString=".bz2") returned 4 [0204.397] lstrcmpiW (lpString1=".bz2", lpString2="Dd01") returned -1 [0204.397] lstrlenW (lpString=".7z") returned 3 [0204.397] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.397] lstrlenW (lpString=".dbf") returned 4 [0204.397] lstrcmpiW (lpString1=".dbf", lpString2="Dd01") returned -1 [0204.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.397] lstrlenW (lpString=".1cd") returned 4 [0204.397] lstrcmpiW (lpString1=".1cd", lpString2="Dd01") returned -1 [0204.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.397] lstrlenW (lpString=".jpg") returned 4 [0204.397] lstrcmpiW (lpString1=".jpg", lpString2="Dd01") returned -1 [0204.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.397] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.397] lstrlenW (lpString=".doc") returned 4 [0204.398] lstrcmpiW (lpString1=".doc", lpString2="Dd01") returned -1 [0204.398] lstrlenW (lpString=".docx") returned 5 [0204.398] lstrcmpiW (lpString1=".docx", lpString2="4Dd01") returned -1 [0204.398] lstrlenW (lpString=".pdf") returned 4 [0204.398] lstrcmpiW (lpString1=".pdf", lpString2="Dd01") returned -1 [0204.398] lstrlenW (lpString=".xls") returned 4 [0204.398] lstrcmpiW (lpString1=".xls", lpString2="Dd01") returned -1 [0204.398] lstrlenW (lpString=".xlsx") returned 5 [0204.398] lstrcmpiW (lpString1=".xlsx", lpString2="4Dd01") returned -1 [0204.398] lstrlenW (lpString=".ppt") returned 4 [0204.398] lstrcmpiW (lpString1=".ppt", lpString2="Dd01") returned -1 [0204.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.398] lstrlenW (lpString=".zip") returned 4 [0204.398] lstrcmpiW (lpString1=".zip", lpString2="Dd01") returned -1 [0204.398] lstrlenW (lpString=".rar") returned 4 [0204.398] lstrcmpiW (lpString1=".rar", lpString2="Dd01") returned -1 [0204.398] lstrlenW (lpString=".bz2") returned 4 [0204.398] lstrcmpiW (lpString1=".bz2", lpString2="Dd01") returned -1 [0204.398] lstrlenW (lpString=".7z") returned 3 [0204.398] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.398] lstrlenW (lpString=".dbf") returned 4 [0204.398] lstrcmpiW (lpString1=".dbf", lpString2="Dd01") returned -1 [0204.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.398] lstrlenW (lpString=".1cd") returned 4 [0204.398] lstrcmpiW (lpString1=".1cd", lpString2="Dd01") returned -1 [0204.398] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\F6\\CBD4Dd01") returned 105 [0204.398] lstrlenW (lpString=".jpg") returned 4 [0204.398] lstrcmpiW (lpString1=".jpg", lpString2="Dd01") returned -1 [0204.398] lstrcmpiW (lpString1=".default\\Cache\\_CACHE_001_", lpString2=".wiki") returned -1 [0204.399] lstrlenW (lpString="_CACHE_001_") returned 11 [0204.399] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0204.399] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x33bff1c | out: lpFileSize=0x33bff1c*=4194304) returned 1 [0204.399] CloseHandle (hObject=0x2d4) returned 1 [0204.401] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_")) returned 0x2020 [0204.401] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.401] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0204.402] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_001_.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_001_.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0204.402] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc6c | out: lpNewFilePointer=0x0) returned 1 [0204.402] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.402] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ee0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3ee0058*, lpNumberOfBytesRead=0x33bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.553] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x155555, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.553] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f20058*, lpNumberOfBytesRead=0x33bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.556] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x33bfc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0204.556] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x3c0000, lpNewFilePointer=0x0, dwMoveMethod=0x33bfc2c | out: lpNewFilePointer=0x0) returned 1 [0204.556] ReadFile (in: hFile=0x2d4, lpBuffer=0x3f60058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x33bfc38, lpOverlapped=0x0 | out: lpBuffer=0x3f60058*, lpNumberOfBytesRead=0x33bfc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.571] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33bfec8 | out: lpNewFilePointer=0x0) returned 1 [0204.571] WriteFile (hFile=0x2d4, lpBuffer=0x3ee0020, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x33bfcb0, lpOverlapped=0x0) Thread: id = 74 os_tid = 0x158 [0183.693] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x3926420 [0183.694] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x3936428 [0183.694] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e36d0 [0183.694] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6) returned 0x3221d8 [0183.694] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e36e8 [0183.694] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x3ff0020 [0183.694] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e3700 [0183.694] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2e3700, Size=0x20) returned 0x365690 [0183.694] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e3700 [0183.694] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2e3700, Size=0x20) returned 0x3655c8 [0183.695] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.695] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.695] Wow64DisableWow64FsRedirection (in: OldValue=0x360ff58 | out: OldValue=0x360ff58*=0x0) returned 1 [0183.695] lstrlenW (lpString="kernel32.dll") returned 12 [0183.695] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x365690 | out: hHeap=0x270000) returned 1 [0183.695] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.695] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x3655c8 | out: hHeap=0x270000) returned 1 [0183.695] Sleep (dwMilliseconds=0x64) [0183.998] lstrcmpiW (lpString1=".ttf", lpString2=".wiki") returned -1 [0183.998] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0183.998] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0184.138] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=47452) returned 1 [0184.138] CloseHandle (hObject=0x300) returned 1 [0184.138] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0184.138] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.138] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.138] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.138] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.138] lstrlenW (lpString=".doc") returned 4 [0184.138] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0184.138] lstrlenW (lpString=".docx") returned 5 [0184.138] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0184.138] lstrlenW (lpString=".pdf") returned 4 [0184.138] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0184.138] lstrlenW (lpString=".xls") returned 4 [0184.139] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0184.139] lstrlenW (lpString=".xlsx") returned 5 [0184.139] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0184.139] lstrlenW (lpString=".ppt") returned 4 [0184.139] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0184.139] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.139] lstrlenW (lpString=".zip") returned 4 [0184.139] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0184.139] lstrlenW (lpString=".rar") returned 4 [0184.139] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0184.139] lstrlenW (lpString=".bz2") returned 4 [0184.139] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0184.139] lstrlenW (lpString=".7z") returned 3 [0184.139] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0184.139] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.139] lstrlenW (lpString=".dbf") returned 4 [0184.139] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0184.139] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.139] lstrlenW (lpString=".1cd") returned 4 [0184.139] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0184.139] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.139] lstrlenW (lpString=".jpg") returned 4 [0184.139] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0184.139] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.139] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.139] lstrlenW (lpString=".doc") returned 4 [0184.139] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0184.139] lstrlenW (lpString=".docx") returned 5 [0184.139] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0184.139] lstrlenW (lpString=".pdf") returned 4 [0184.139] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0184.139] lstrlenW (lpString=".xls") returned 4 [0184.139] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0184.140] lstrlenW (lpString=".xlsx") returned 5 [0184.140] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0184.140] lstrlenW (lpString=".ppt") returned 4 [0184.140] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0184.140] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.140] lstrlenW (lpString=".zip") returned 4 [0184.140] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0184.140] lstrlenW (lpString=".rar") returned 4 [0184.140] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0184.140] lstrlenW (lpString=".bz2") returned 4 [0184.140] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0184.140] lstrlenW (lpString=".7z") returned 3 [0184.140] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0184.140] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.140] lstrlenW (lpString=".dbf") returned 4 [0184.140] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0184.140] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.140] lstrlenW (lpString=".1cd") returned 4 [0184.140] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0184.140] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0184.140] lstrlenW (lpString=".jpg") returned 4 [0184.140] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0184.140] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0184.140] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0184.140] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0184.269] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=4096) returned 1 [0184.269] CloseHandle (hObject=0x310) returned 1 [0184.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0184.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.269] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.270] lstrlenW (lpString=".doc") returned 4 [0184.270] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.270] lstrlenW (lpString=".docx") returned 5 [0184.270] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0184.270] lstrlenW (lpString=".pdf") returned 4 [0184.270] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.270] lstrlenW (lpString=".xls") returned 4 [0184.270] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.270] lstrlenW (lpString=".xlsx") returned 5 [0184.270] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0184.270] lstrlenW (lpString=".ppt") returned 4 [0184.270] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.270] lstrlenW (lpString=".zip") returned 4 [0184.270] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.270] lstrlenW (lpString=".rar") returned 4 [0184.270] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.270] lstrlenW (lpString=".bz2") returned 4 [0184.270] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.270] lstrlenW (lpString=".7z") returned 3 [0184.270] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.270] lstrlenW (lpString=".dbf") returned 4 [0184.270] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.270] lstrlenW (lpString=".1cd") returned 4 [0184.270] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.270] lstrlenW (lpString=".jpg") returned 4 [0184.270] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.271] lstrlenW (lpString=".doc") returned 4 [0184.271] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.271] lstrlenW (lpString=".docx") returned 5 [0184.271] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0184.271] lstrlenW (lpString=".pdf") returned 4 [0184.271] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.271] lstrlenW (lpString=".xls") returned 4 [0184.271] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.271] lstrlenW (lpString=".xlsx") returned 5 [0184.271] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0184.271] lstrlenW (lpString=".ppt") returned 4 [0184.271] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.271] lstrlenW (lpString=".zip") returned 4 [0184.271] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.271] lstrlenW (lpString=".rar") returned 4 [0184.271] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.271] lstrlenW (lpString=".bz2") returned 4 [0184.271] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.271] lstrlenW (lpString=".7z") returned 3 [0184.271] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.271] lstrlenW (lpString=".dbf") returned 4 [0184.271] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.271] lstrlenW (lpString=".1cd") returned 4 [0184.272] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0184.272] lstrlenW (lpString=".jpg") returned 4 [0184.272] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.272] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0184.272] lstrlenW (lpString="mraut.dll") returned 9 [0184.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0184.384] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=6331392) returned 1 [0184.385] CloseHandle (hObject=0x318) returned 1 [0184.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0184.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.385] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.385] lstrlenW (lpString=".doc") returned 4 [0184.385] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.385] lstrlenW (lpString=".docx") returned 5 [0184.385] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0184.385] lstrlenW (lpString=".pdf") returned 4 [0184.385] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.385] lstrlenW (lpString=".xls") returned 4 [0184.385] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.385] lstrlenW (lpString=".xlsx") returned 5 [0184.385] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0184.385] lstrlenW (lpString=".ppt") returned 4 [0184.385] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.385] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.385] lstrlenW (lpString=".zip") returned 4 [0184.385] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.385] lstrlenW (lpString=".rar") returned 4 [0184.385] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.385] lstrlenW (lpString=".bz2") returned 4 [0184.385] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.385] lstrlenW (lpString=".7z") returned 3 [0184.386] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.386] lstrlenW (lpString=".dbf") returned 4 [0184.386] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.386] lstrlenW (lpString=".1cd") returned 4 [0184.386] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.386] lstrlenW (lpString=".jpg") returned 4 [0184.386] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.386] lstrlenW (lpString=".doc") returned 4 [0184.386] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.386] lstrlenW (lpString=".docx") returned 5 [0184.386] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0184.386] lstrlenW (lpString=".pdf") returned 4 [0184.386] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.386] lstrlenW (lpString=".xls") returned 4 [0184.386] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.386] lstrlenW (lpString=".xlsx") returned 5 [0184.386] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0184.386] lstrlenW (lpString=".ppt") returned 4 [0184.386] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.386] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.386] lstrlenW (lpString=".zip") returned 4 [0184.386] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.386] lstrlenW (lpString=".rar") returned 4 [0184.386] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.386] lstrlenW (lpString=".bz2") returned 4 [0184.386] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.386] lstrlenW (lpString=".7z") returned 3 [0184.386] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.387] lstrlenW (lpString=".dbf") returned 4 [0184.387] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.387] lstrlenW (lpString=".1cd") returned 4 [0184.387] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.387] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0184.387] lstrlenW (lpString=".jpg") returned 4 [0184.387] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.387] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0184.387] lstrlenW (lpString="mshwgst.dll") returned 11 [0184.387] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0184.387] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=49664) returned 1 [0184.387] CloseHandle (hObject=0x318) returned 1 [0184.387] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0184.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.388] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.388] lstrlenW (lpString=".doc") returned 4 [0184.388] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.388] lstrlenW (lpString=".docx") returned 5 [0184.388] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0184.388] lstrlenW (lpString=".pdf") returned 4 [0184.388] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.388] lstrlenW (lpString=".xls") returned 4 [0184.388] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.388] lstrlenW (lpString=".xlsx") returned 5 [0184.388] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0184.388] lstrlenW (lpString=".ppt") returned 4 [0184.388] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.388] lstrlenW (lpString=".zip") returned 4 [0184.388] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.388] lstrlenW (lpString=".rar") returned 4 [0184.388] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.388] lstrlenW (lpString=".bz2") returned 4 [0184.388] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.388] lstrlenW (lpString=".7z") returned 3 [0184.388] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.388] lstrlenW (lpString=".dbf") returned 4 [0184.388] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.388] lstrlenW (lpString=".1cd") returned 4 [0184.389] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.389] lstrlenW (lpString=".jpg") returned 4 [0184.389] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.389] lstrlenW (lpString=".doc") returned 4 [0184.389] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.389] lstrlenW (lpString=".docx") returned 5 [0184.389] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0184.389] lstrlenW (lpString=".pdf") returned 4 [0184.389] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.389] lstrlenW (lpString=".xls") returned 4 [0184.389] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.389] lstrlenW (lpString=".xlsx") returned 5 [0184.389] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0184.389] lstrlenW (lpString=".ppt") returned 4 [0184.389] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.389] lstrlenW (lpString=".zip") returned 4 [0184.389] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.389] lstrlenW (lpString=".rar") returned 4 [0184.389] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.389] lstrlenW (lpString=".bz2") returned 4 [0184.389] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.389] lstrlenW (lpString=".7z") returned 3 [0184.389] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.389] lstrlenW (lpString=".dbf") returned 4 [0184.389] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.389] lstrlenW (lpString=".1cd") returned 4 [0184.389] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0184.390] lstrlenW (lpString=".jpg") returned 4 [0184.390] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.390] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0184.390] lstrlenW (lpString="mshwLatin.dll") returned 13 [0184.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0184.390] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1071616) returned 1 [0184.390] CloseHandle (hObject=0x318) returned 1 [0184.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0184.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.391] lstrlenW (lpString=".doc") returned 4 [0184.391] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.391] lstrlenW (lpString=".docx") returned 5 [0184.391] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0184.391] lstrlenW (lpString=".pdf") returned 4 [0184.391] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.391] lstrlenW (lpString=".xls") returned 4 [0184.391] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.391] lstrlenW (lpString=".xlsx") returned 5 [0184.391] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0184.391] lstrlenW (lpString=".ppt") returned 4 [0184.391] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.391] lstrlenW (lpString=".zip") returned 4 [0184.391] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.391] lstrlenW (lpString=".rar") returned 4 [0184.391] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.391] lstrlenW (lpString=".bz2") returned 4 [0184.391] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.391] lstrlenW (lpString=".7z") returned 3 [0184.391] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.391] lstrlenW (lpString=".dbf") returned 4 [0184.391] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.391] lstrlenW (lpString=".1cd") returned 4 [0184.391] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.391] lstrlenW (lpString=".jpg") returned 4 [0184.391] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.391] lstrlenW (lpString=".doc") returned 4 [0184.391] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.392] lstrlenW (lpString=".docx") returned 5 [0184.392] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0184.392] lstrlenW (lpString=".pdf") returned 4 [0184.392] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.392] lstrlenW (lpString=".xls") returned 4 [0184.392] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.392] lstrlenW (lpString=".xlsx") returned 5 [0184.392] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0184.392] lstrlenW (lpString=".ppt") returned 4 [0184.392] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.392] lstrlenW (lpString=".zip") returned 4 [0184.392] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.392] lstrlenW (lpString=".rar") returned 4 [0184.392] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.392] lstrlenW (lpString=".bz2") returned 4 [0184.392] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.392] lstrlenW (lpString=".7z") returned 3 [0184.392] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.392] lstrlenW (lpString=".dbf") returned 4 [0184.392] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.392] lstrlenW (lpString=".1cd") returned 4 [0184.392] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.392] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0184.392] lstrlenW (lpString=".jpg") returned 4 [0184.392] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.392] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0184.392] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0184.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0184.393] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=3584) returned 1 [0184.393] CloseHandle (hObject=0x318) returned 1 [0184.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0184.393] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.393] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.393] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.393] lstrlenW (lpString=".doc") returned 4 [0184.393] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.393] lstrlenW (lpString=".docx") returned 5 [0184.393] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0184.393] lstrlenW (lpString=".pdf") returned 4 [0184.393] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.393] lstrlenW (lpString=".xls") returned 4 [0184.393] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.393] lstrlenW (lpString=".xlsx") returned 5 [0184.393] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0184.393] lstrlenW (lpString=".ppt") returned 4 [0184.394] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.394] lstrlenW (lpString=".zip") returned 4 [0184.394] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.394] lstrlenW (lpString=".rar") returned 4 [0184.394] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.394] lstrlenW (lpString=".bz2") returned 4 [0184.394] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.394] lstrlenW (lpString=".7z") returned 3 [0184.394] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.394] lstrlenW (lpString=".dbf") returned 4 [0184.394] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.394] lstrlenW (lpString=".1cd") returned 4 [0184.394] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.394] lstrlenW (lpString=".jpg") returned 4 [0184.394] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.394] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.394] lstrlenW (lpString=".doc") returned 4 [0184.394] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.394] lstrlenW (lpString=".docx") returned 5 [0184.394] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0184.394] lstrlenW (lpString=".pdf") returned 4 [0184.394] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.394] lstrlenW (lpString=".xls") returned 4 [0184.394] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.394] lstrlenW (lpString=".xlsx") returned 5 [0184.394] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0184.394] lstrlenW (lpString=".ppt") returned 4 [0184.394] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.395] lstrlenW (lpString=".zip") returned 4 [0184.395] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.395] lstrlenW (lpString=".rar") returned 4 [0184.395] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.395] lstrlenW (lpString=".bz2") returned 4 [0184.395] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.395] lstrlenW (lpString=".7z") returned 3 [0184.395] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.395] lstrlenW (lpString=".dbf") returned 4 [0184.395] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.395] lstrlenW (lpString=".1cd") returned 4 [0184.395] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.395] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0184.395] lstrlenW (lpString=".jpg") returned 4 [0184.395] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.395] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0184.395] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0184.395] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0184.397] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=3584) returned 1 [0184.398] CloseHandle (hObject=0x318) returned 1 [0184.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui")) returned 0x20 [0184.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nl-nl\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0184.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0184.398] lstrlenW (lpString=".doc") returned 4 [0184.398] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.398] lstrlenW (lpString=".docx") returned 5 [0184.398] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0184.398] lstrlenW (lpString=".pdf") returned 4 [0184.398] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.398] lstrlenW (lpString=".xls") returned 4 [0184.398] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.398] lstrlenW (lpString=".xlsx") returned 5 [0184.398] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0184.398] lstrlenW (lpString=".ppt") returned 4 [0184.398] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nl-NL\\tipresx.dll.mui") returned 72 [0184.398] lstrlenW (lpString=".zip") returned 4 [0184.398] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.398] lstrlenW (lpString=".rar") returned 4 [0184.398] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.398] lstrlenW (lpString=".bz2") returned 4 [0184.398] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.398] lstrlenW (lpString=".7z") returned 3 [0184.398] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.412] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.421] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.422] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.733] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.740] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.741] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.742] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.224] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.225] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.780] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.110] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.112] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.113] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.116] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.571] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.573] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.574] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.576] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.587] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=781) returned 1 [0187.587] CloseHandle (hObject=0x380) returned 1 [0187.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg")) returned 0x20 [0187.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0187.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0187.618] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GFX.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\gfx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKExcel.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\gkexcel.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.619] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKPowerPoint.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\gkpowerpoint.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.620] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GKWord.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\gkword.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.722] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\GRAPH.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\graph.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.832] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7db.kic.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mset7db.kic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7en.kic.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mset7en.kic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.833] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7fr.kic.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mset7fr.kic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7ge.kic.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mset7ge.kic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.834] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\mset7jp.kic.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mset7jp.kic.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPST32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mspst32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.844] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\MSPUB.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\mspub.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Data0011.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7data0011.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.849] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Lexicons0011.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7lexicons0011.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.852] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS0009.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0009.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.853] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000A.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000a.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.858] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7MODELS000C.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models000c.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.859] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\NL7Models0011.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\nl7models0011.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OART.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\oart.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.861] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OARTCONV.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\oartconv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OFFOWC.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\offowc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.865] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OIMG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\oimg.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.867] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OLMAPI32.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\olmapi32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONENOTE.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\onenote.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONFILTER.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\onfilter.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.148] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\OUTLOOK.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\outlook.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.152] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\POWERPNT.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\powerpnt.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.153] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPCORE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\ppcore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.154] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PPTICO.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pptico.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0190.028] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroRd32.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrord32.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.762] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pe.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pe.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\pe.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\pe.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.764] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\AcroForm.api.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\acroform.api.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.765] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\Annots.api.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\annots.api.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.767] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\EScript.api.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\escript.api.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.768] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\MakeAccessible.api.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\makeaccessible.api.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.802] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins\\PPKLite.api.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins\\ppklite.api.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.424] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1208836) returned 1 [0193.424] CloseHandle (hObject=0x378) returned 1 [0193.424] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze108.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze108.hsp")) returned 0x20 [0193.424] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze108.hsp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze108.hsp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0193.425] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\cze108.hsp" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\cze108.hsp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.966] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.967] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Csi.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.968] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.968] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSO.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.968] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.225] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\nacl_irt_x86_64.nexe"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\nacl_irt_x86_64.nexe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\nacl_irt_x86_64.nexe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.225] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\resources.pak"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\resources.pak.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\resources.pak.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.226] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdm.dll" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdm.dll"), lpNewFileName="C:\\Program Files (x86)\\Google\\Chrome\\Application\\58.0.3029.110\\WidevineCdm\\_platform_specific\\win_x64\\widevinecdm.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\google\\chrome\\application\\58.0.3029.110\\widevinecdm\\_platform_specific\\win_x64\\widevinecdm.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.660] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\charsets.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\charsets.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.669] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\deploy.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\deploy.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.484] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWDWG.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewdwg.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWDWG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewdwg.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.484] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWER.DLL" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewer.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft Office\\Office14\\VVIEWER.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft office\\office14\\vviewer.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.499] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.mshtml.dll" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\microsoft.mshtml.dll"), lpNewFileName="C:\\Program Files (x86)\\Microsoft.NET\\Primary Interop Assemblies\\Microsoft.mshtml.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\microsoft.net\\primary interop assemblies\\microsoft.mshtml.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.502] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\omni.ja"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\browser\\omni.ja.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\browser\\omni.ja.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.504] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\D3DCompiler_43.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\d3dcompiler_43.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\D3DCompiler_43.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\d3dcompiler_43.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.754] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nss3.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\nss3.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\nss3.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\nss3.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.756] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja" (normalized: "c:\\program files (x86)\\mozilla firefox\\omni.ja"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\omni.ja.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\omni.ja.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.761] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\xul.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\xul.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\xul.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\xul.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.769] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.770] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.774] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.776] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\system.workflow.componentmodel.dll"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.Workflow.ComponentModel.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.0\\system.workflow.componentmodel.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.783] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll"), lpNewFileName="C:\\Program Files (x86)\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.801] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\msoe.dll" (normalized: "c:\\program files (x86)\\windows mail\\msoe.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\msoe.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows mail\\msoe.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.801] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows Mail\\MSOERES.dll" (normalized: "c:\\program files (x86)\\windows mail\\msoeres.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Mail\\MSOERES.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows mail\\msoeres.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0199.191] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{37B8F9C7-03FB-3253-8781-2517C99D7C00}v11.0.61030\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{37b8f9c7-03fb-3253-8781-2517c99d7c00}v11.0.61030\\packages\\vcruntimeadditional_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0199.196] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{68306422-7C57-373F-8860-D26CE4BA2A15}v14.10.25017\\packages\\vcRuntimeAdditional_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{68306422-7c57-373f-8860-d26ce4ba2a15}v14.10.25017\\packages\\vcruntimeadditional_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0199.502] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=143360) returned 1 [0199.502] CloseHandle (hObject=0x370) returned 1 [0199.503] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi")) returned 0x20 [0199.503] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.503] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{E512788E-C50B-3858-A4B9-73AD5F3F9E93}v14.10.25017\\packages\\vcRuntimeAdditional_amd64\\vc_runtimeAdditional_x64.msi" (normalized: "c:\\programdata\\package cache\\{e512788e-c50b-3858-a4b9-73ad5f3f9e93}v14.10.25017\\packages\\vcruntimeadditional_amd64\\vc_runtimeadditional_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.503] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1130328) returned 1 [0199.503] CloseHandle (hObject=0x370) returned 1 [0199.503] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe")) returned 0x20 [0199.503] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.503] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0199.504] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.504] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.504] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.690] GetLastError () returned 0x0 [0199.690] ReadFile (in: hFile=0x370, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0199.710] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0199.787] ReadFile (in: hFile=0x370, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.787] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0199.790] SetEndOfFile (hFile=0x2d4) returned 1 [0199.791] CloseHandle (hObject=0x2d4) returned 1 [0199.791] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.791] SetEndOfFile (hFile=0x370) returned 1 [0199.791] CloseHandle (hObject=0x370) returned 1 [0199.791] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.791] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\googleupdatesetup.exe")) returned 1 [0199.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.791] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.791] lstrlenW (lpString=".doc") returned 4 [0199.791] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0199.791] lstrlenW (lpString=".docx") returned 5 [0199.791] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0199.791] lstrlenW (lpString=".pdf") returned 4 [0199.791] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0199.791] lstrlenW (lpString=".xls") returned 4 [0199.791] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0199.792] lstrlenW (lpString=".xlsx") returned 5 [0199.792] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0199.792] lstrlenW (lpString=".ppt") returned 4 [0199.792] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0199.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.792] lstrlenW (lpString=".zip") returned 4 [0199.792] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0199.792] lstrlenW (lpString=".rar") returned 4 [0199.792] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0199.792] lstrlenW (lpString=".bz2") returned 4 [0199.792] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0199.792] lstrlenW (lpString=".7z") returned 3 [0199.792] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0199.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.792] lstrlenW (lpString=".dbf") returned 4 [0199.792] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0199.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.792] lstrlenW (lpString=".1cd") returned 4 [0199.792] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0199.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.792] lstrlenW (lpString=".jpg") returned 4 [0199.792] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0199.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.792] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.792] lstrlenW (lpString=".doc") returned 4 [0199.792] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0199.792] lstrlenW (lpString=".docx") returned 5 [0199.792] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0199.792] lstrlenW (lpString=".pdf") returned 4 [0199.792] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0199.792] lstrlenW (lpString=".xls") returned 4 [0199.792] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0199.792] lstrlenW (lpString=".xlsx") returned 5 [0199.793] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0199.793] lstrlenW (lpString=".ppt") returned 4 [0199.793] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0199.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.793] lstrlenW (lpString=".zip") returned 4 [0199.793] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0199.793] lstrlenW (lpString=".rar") returned 4 [0199.793] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0199.793] lstrlenW (lpString=".bz2") returned 4 [0199.793] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0199.793] lstrlenW (lpString=".7z") returned 3 [0199.793] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0199.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.793] lstrlenW (lpString=".dbf") returned 4 [0199.793] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0199.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.793] lstrlenW (lpString=".1cd") returned 4 [0199.793] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0199.793] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715\\GoogleUpdateSetup.exe") returned 160 [0199.793] lstrlenW (lpString=".jpg") returned 4 [0199.793] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0199.793] lstrlenW (lpString="data_1") returned 6 [0199.793] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.828] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=270336) returned 1 [0199.828] CloseHandle (hObject=0x2d4) returned 1 [0199.828] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 0x2020 [0199.828] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.828] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.828] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.828] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.829] GetLastError () returned 0x0 [0199.829] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x42000, lpOverlapped=0x0) returned 1 [0199.837] WriteFile (in: hFile=0x34c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x42010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x42010, lpOverlapped=0x0) returned 1 [0199.843] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.843] WriteFile (in: hFile=0x34c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0199.843] SetEndOfFile (hFile=0x34c) returned 1 [0199.843] CloseHandle (hObject=0x34c) returned 1 [0199.843] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.843] SetEndOfFile (hFile=0x2d4) returned 1 [0199.846] CloseHandle (hObject=0x2d4) returned 1 [0199.846] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.846] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_1")) returned 1 [0199.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.846] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.846] lstrlenW (lpString=".doc") returned 4 [0199.846] lstrcmpiW (lpString1=".doc", lpString2="ta_1") returned -1 [0199.846] lstrlenW (lpString=".docx") returned 5 [0199.846] lstrcmpiW (lpString1=".docx", lpString2="ata_1") returned -1 [0199.846] lstrlenW (lpString=".pdf") returned 4 [0199.846] lstrcmpiW (lpString1=".pdf", lpString2="ta_1") returned -1 [0199.846] lstrlenW (lpString=".xls") returned 4 [0199.846] lstrcmpiW (lpString1=".xls", lpString2="ta_1") returned -1 [0199.846] lstrlenW (lpString=".xlsx") returned 5 [0199.847] lstrcmpiW (lpString1=".xlsx", lpString2="ata_1") returned -1 [0199.847] lstrlenW (lpString=".ppt") returned 4 [0199.847] lstrcmpiW (lpString1=".ppt", lpString2="ta_1") returned -1 [0199.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.847] lstrlenW (lpString=".zip") returned 4 [0199.847] lstrcmpiW (lpString1=".zip", lpString2="ta_1") returned -1 [0199.847] lstrlenW (lpString=".rar") returned 4 [0199.847] lstrcmpiW (lpString1=".rar", lpString2="ta_1") returned -1 [0199.847] lstrlenW (lpString=".bz2") returned 4 [0199.847] lstrcmpiW (lpString1=".bz2", lpString2="ta_1") returned -1 [0199.847] lstrlenW (lpString=".7z") returned 3 [0199.847] lstrcmpiW (lpString1=".7z", lpString2="a_1") returned -1 [0199.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.847] lstrlenW (lpString=".dbf") returned 4 [0199.847] lstrcmpiW (lpString1=".dbf", lpString2="ta_1") returned -1 [0199.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.847] lstrlenW (lpString=".1cd") returned 4 [0199.847] lstrcmpiW (lpString1=".1cd", lpString2="ta_1") returned -1 [0199.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.847] lstrlenW (lpString=".jpg") returned 4 [0199.847] lstrcmpiW (lpString1=".jpg", lpString2="ta_1") returned -1 [0199.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.847] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.847] lstrlenW (lpString=".doc") returned 4 [0199.847] lstrcmpiW (lpString1=".doc", lpString2="ta_1") returned -1 [0199.847] lstrlenW (lpString=".docx") returned 5 [0199.847] lstrcmpiW (lpString1=".docx", lpString2="ata_1") returned -1 [0199.847] lstrlenW (lpString=".pdf") returned 4 [0199.847] lstrcmpiW (lpString1=".pdf", lpString2="ta_1") returned -1 [0199.847] lstrlenW (lpString=".xls") returned 4 [0199.847] lstrcmpiW (lpString1=".xls", lpString2="ta_1") returned -1 [0199.847] lstrlenW (lpString=".xlsx") returned 5 [0199.848] lstrcmpiW (lpString1=".xlsx", lpString2="ata_1") returned -1 [0199.848] lstrlenW (lpString=".ppt") returned 4 [0199.848] lstrcmpiW (lpString1=".ppt", lpString2="ta_1") returned -1 [0199.848] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.848] lstrlenW (lpString=".zip") returned 4 [0199.926] lstrcmpiW (lpString1=".zip", lpString2="ta_1") returned -1 [0199.926] lstrlenW (lpString=".rar") returned 4 [0199.926] lstrcmpiW (lpString1=".rar", lpString2="ta_1") returned -1 [0199.927] lstrlenW (lpString=".bz2") returned 4 [0199.927] lstrcmpiW (lpString1=".bz2", lpString2="ta_1") returned -1 [0199.927] lstrlenW (lpString=".7z") returned 3 [0199.927] lstrcmpiW (lpString1=".7z", lpString2="a_1") returned -1 [0199.927] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.927] lstrlenW (lpString=".dbf") returned 4 [0199.927] lstrcmpiW (lpString1=".dbf", lpString2="ta_1") returned -1 [0199.927] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.927] lstrlenW (lpString=".1cd") returned 4 [0199.927] lstrcmpiW (lpString1=".1cd", lpString2="ta_1") returned -1 [0199.927] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_1") returned 88 [0199.927] lstrlenW (lpString=".jpg") returned 4 [0199.927] lstrcmpiW (lpString1=".jpg", lpString2="ta_1") returned -1 [0199.927] lstrlenW (lpString="Cookies") returned 7 [0199.927] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.928] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=7168) returned 1 [0199.928] CloseHandle (hObject=0x34c) returned 1 [0199.928] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 0x2020 [0199.928] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.928] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.928] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.928] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.929] GetLastError () returned 0x0 [0199.929] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x1c00, lpOverlapped=0x0) returned 1 [0199.931] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0199.931] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.932] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0199.932] SetEndOfFile (hFile=0x15c) returned 1 [0199.932] CloseHandle (hObject=0x15c) returned 1 [0199.932] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.932] SetEndOfFile (hFile=0x34c) returned 1 [0199.933] CloseHandle (hObject=0x34c) returned 1 [0199.933] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.933] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies")) returned 1 [0199.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.933] lstrlenW (lpString=".doc") returned 4 [0199.933] lstrcmpiW (lpString1=".doc", lpString2="kies") returned -1 [0199.933] lstrlenW (lpString=".docx") returned 5 [0199.933] lstrcmpiW (lpString1=".docx", lpString2="okies") returned -1 [0199.933] lstrlenW (lpString=".pdf") returned 4 [0199.933] lstrcmpiW (lpString1=".pdf", lpString2="kies") returned -1 [0199.933] lstrlenW (lpString=".xls") returned 4 [0199.933] lstrcmpiW (lpString1=".xls", lpString2="kies") returned -1 [0199.933] lstrlenW (lpString=".xlsx") returned 5 [0199.933] lstrcmpiW (lpString1=".xlsx", lpString2="okies") returned -1 [0199.933] lstrlenW (lpString=".ppt") returned 4 [0199.933] lstrcmpiW (lpString1=".ppt", lpString2="kies") returned -1 [0199.933] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.933] lstrlenW (lpString=".zip") returned 4 [0199.934] lstrcmpiW (lpString1=".zip", lpString2="kies") returned -1 [0199.934] lstrlenW (lpString=".rar") returned 4 [0199.934] lstrcmpiW (lpString1=".rar", lpString2="kies") returned -1 [0199.934] lstrlenW (lpString=".bz2") returned 4 [0199.934] lstrcmpiW (lpString1=".bz2", lpString2="kies") returned -1 [0199.934] lstrlenW (lpString=".7z") returned 3 [0199.934] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0199.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.934] lstrlenW (lpString=".dbf") returned 4 [0199.934] lstrcmpiW (lpString1=".dbf", lpString2="kies") returned -1 [0199.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.934] lstrlenW (lpString=".1cd") returned 4 [0199.934] lstrcmpiW (lpString1=".1cd", lpString2="kies") returned -1 [0199.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.934] lstrlenW (lpString=".jpg") returned 4 [0199.934] lstrcmpiW (lpString1=".jpg", lpString2="kies") returned -1 [0199.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.934] lstrlenW (lpString=".doc") returned 4 [0199.934] lstrcmpiW (lpString1=".doc", lpString2="kies") returned -1 [0199.934] lstrlenW (lpString=".docx") returned 5 [0199.934] lstrcmpiW (lpString1=".docx", lpString2="okies") returned -1 [0199.934] lstrlenW (lpString=".pdf") returned 4 [0199.934] lstrcmpiW (lpString1=".pdf", lpString2="kies") returned -1 [0199.934] lstrlenW (lpString=".xls") returned 4 [0199.934] lstrcmpiW (lpString1=".xls", lpString2="kies") returned -1 [0199.934] lstrlenW (lpString=".xlsx") returned 5 [0199.934] lstrcmpiW (lpString1=".xlsx", lpString2="okies") returned -1 [0199.934] lstrlenW (lpString=".ppt") returned 4 [0199.934] lstrcmpiW (lpString1=".ppt", lpString2="kies") returned -1 [0199.934] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.934] lstrlenW (lpString=".zip") returned 4 [0199.934] lstrcmpiW (lpString1=".zip", lpString2="kies") returned -1 [0199.935] lstrlenW (lpString=".rar") returned 4 [0199.935] lstrcmpiW (lpString1=".rar", lpString2="kies") returned -1 [0199.935] lstrlenW (lpString=".bz2") returned 4 [0199.935] lstrcmpiW (lpString1=".bz2", lpString2="kies") returned -1 [0199.935] lstrlenW (lpString=".7z") returned 3 [0199.935] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0199.935] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.935] lstrlenW (lpString=".dbf") returned 4 [0199.935] lstrcmpiW (lpString1=".dbf", lpString2="kies") returned -1 [0199.935] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.935] lstrlenW (lpString=".1cd") returned 4 [0199.935] lstrcmpiW (lpString1=".1cd", lpString2="kies") returned -1 [0199.935] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies") returned 83 [0199.935] lstrlenW (lpString=".jpg") returned 4 [0199.935] lstrcmpiW (lpString1=".jpg", lpString2="kies") returned -1 [0199.935] lstrlenW (lpString="Cookies-journal") returned 15 [0199.935] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.936] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0199.936] CloseHandle (hObject=0x34c) returned 1 [0199.936] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.936] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.936] lstrlenW (lpString=".doc") returned 4 [0199.936] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0199.936] lstrlenW (lpString=".docx") returned 5 [0199.936] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0199.936] lstrlenW (lpString=".pdf") returned 4 [0199.936] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0199.936] lstrlenW (lpString=".xls") returned 4 [0199.936] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0199.936] lstrlenW (lpString=".xlsx") returned 5 [0199.936] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0199.936] lstrlenW (lpString=".ppt") returned 4 [0199.936] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0199.936] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.936] lstrlenW (lpString=".zip") returned 4 [0199.936] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0199.936] lstrlenW (lpString=".rar") returned 4 [0199.936] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0199.936] lstrlenW (lpString=".bz2") returned 4 [0199.936] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0199.936] lstrlenW (lpString=".7z") returned 3 [0199.936] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0199.936] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.936] lstrlenW (lpString=".dbf") returned 4 [0199.936] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0199.936] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.936] lstrlenW (lpString=".1cd") returned 4 [0199.936] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.937] lstrlenW (lpString=".jpg") returned 4 [0199.937] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.937] lstrlenW (lpString=".doc") returned 4 [0199.937] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString=".docx") returned 5 [0199.937] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0199.937] lstrlenW (lpString=".pdf") returned 4 [0199.937] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString=".xls") returned 4 [0199.937] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString=".xlsx") returned 5 [0199.937] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0199.937] lstrlenW (lpString=".ppt") returned 4 [0199.937] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.937] lstrlenW (lpString=".zip") returned 4 [0199.937] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString=".rar") returned 4 [0199.937] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString=".bz2") returned 4 [0199.937] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString=".7z") returned 3 [0199.937] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0199.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.937] lstrlenW (lpString=".dbf") returned 4 [0199.937] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.937] lstrlenW (lpString=".1cd") returned 4 [0199.937] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0199.937] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies-journal") returned 91 [0199.938] lstrlenW (lpString=".jpg") returned 4 [0199.938] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0199.938] lstrlenW (lpString="Current Session") returned 15 [0199.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.938] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=470) returned 1 [0199.938] CloseHandle (hObject=0x34c) returned 1 [0199.938] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 0x2020 [0199.938] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.938] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.939] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.939] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.939] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.939] GetLastError () returned 0x0 [0199.939] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x1d6, lpOverlapped=0x0) returned 1 [0199.940] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x1e0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x1e0, lpOverlapped=0x0) returned 1 [0199.948] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.948] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0199.948] SetEndOfFile (hFile=0x15c) returned 1 [0199.949] CloseHandle (hObject=0x15c) returned 1 [0199.949] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.949] SetEndOfFile (hFile=0x34c) returned 1 [0199.949] CloseHandle (hObject=0x34c) returned 1 [0199.950] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.950] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current session")) returned 1 [0199.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.950] lstrlenW (lpString=".doc") returned 4 [0199.950] lstrcmpiW (lpString1=".doc", lpString2="sion") returned -1 [0199.950] lstrlenW (lpString=".docx") returned 5 [0199.950] lstrcmpiW (lpString1=".docx", lpString2="ssion") returned -1 [0199.950] lstrlenW (lpString=".pdf") returned 4 [0199.950] lstrcmpiW (lpString1=".pdf", lpString2="sion") returned -1 [0199.950] lstrlenW (lpString=".xls") returned 4 [0199.950] lstrcmpiW (lpString1=".xls", lpString2="sion") returned -1 [0199.950] lstrlenW (lpString=".xlsx") returned 5 [0199.950] lstrcmpiW (lpString1=".xlsx", lpString2="ssion") returned -1 [0199.950] lstrlenW (lpString=".ppt") returned 4 [0199.950] lstrcmpiW (lpString1=".ppt", lpString2="sion") returned -1 [0199.950] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.950] lstrlenW (lpString=".zip") returned 4 [0199.950] lstrcmpiW (lpString1=".zip", lpString2="sion") returned -1 [0199.950] lstrlenW (lpString=".rar") returned 4 [0199.951] lstrcmpiW (lpString1=".rar", lpString2="sion") returned -1 [0199.951] lstrlenW (lpString=".bz2") returned 4 [0199.951] lstrcmpiW (lpString1=".bz2", lpString2="sion") returned -1 [0199.951] lstrlenW (lpString=".7z") returned 3 [0199.951] lstrcmpiW (lpString1=".7z", lpString2="ion") returned -1 [0199.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.951] lstrlenW (lpString=".dbf") returned 4 [0199.951] lstrcmpiW (lpString1=".dbf", lpString2="sion") returned -1 [0199.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.951] lstrlenW (lpString=".1cd") returned 4 [0199.951] lstrcmpiW (lpString1=".1cd", lpString2="sion") returned -1 [0199.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.951] lstrlenW (lpString=".jpg") returned 4 [0199.951] lstrcmpiW (lpString1=".jpg", lpString2="sion") returned -1 [0199.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.951] lstrlenW (lpString=".doc") returned 4 [0199.951] lstrcmpiW (lpString1=".doc", lpString2="sion") returned -1 [0199.951] lstrlenW (lpString=".docx") returned 5 [0199.951] lstrcmpiW (lpString1=".docx", lpString2="ssion") returned -1 [0199.951] lstrlenW (lpString=".pdf") returned 4 [0199.951] lstrcmpiW (lpString1=".pdf", lpString2="sion") returned -1 [0199.951] lstrlenW (lpString=".xls") returned 4 [0199.951] lstrcmpiW (lpString1=".xls", lpString2="sion") returned -1 [0199.951] lstrlenW (lpString=".xlsx") returned 5 [0199.951] lstrcmpiW (lpString1=".xlsx", lpString2="ssion") returned -1 [0199.951] lstrlenW (lpString=".ppt") returned 4 [0199.951] lstrcmpiW (lpString1=".ppt", lpString2="sion") returned -1 [0199.951] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.951] lstrlenW (lpString=".zip") returned 4 [0199.951] lstrcmpiW (lpString1=".zip", lpString2="sion") returned -1 [0199.951] lstrlenW (lpString=".rar") returned 4 [0199.951] lstrcmpiW (lpString1=".rar", lpString2="sion") returned -1 [0199.952] lstrlenW (lpString=".bz2") returned 4 [0199.952] lstrcmpiW (lpString1=".bz2", lpString2="sion") returned -1 [0199.952] lstrlenW (lpString=".7z") returned 3 [0199.952] lstrcmpiW (lpString1=".7z", lpString2="ion") returned -1 [0199.952] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.952] lstrlenW (lpString=".dbf") returned 4 [0199.952] lstrcmpiW (lpString1=".dbf", lpString2="sion") returned -1 [0199.952] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.952] lstrlenW (lpString=".1cd") returned 4 [0199.952] lstrcmpiW (lpString1=".1cd", lpString2="sion") returned -1 [0199.952] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Session") returned 91 [0199.952] lstrlenW (lpString=".jpg") returned 4 [0199.952] lstrcmpiW (lpString1=".jpg", lpString2="sion") returned -1 [0199.952] lstrlenW (lpString="Current Tabs") returned 12 [0199.952] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.953] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=294) returned 1 [0199.953] CloseHandle (hObject=0x34c) returned 1 [0199.953] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 0x2020 [0199.953] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.953] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.953] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.953] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.954] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.954] GetLastError () returned 0x0 [0199.954] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x126, lpOverlapped=0x0) returned 1 [0199.955] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x130, lpOverlapped=0x0) returned 1 [0199.956] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.956] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1 [0199.956] SetEndOfFile (hFile=0x15c) returned 1 [0199.956] CloseHandle (hObject=0x15c) returned 1 [0199.956] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.956] SetEndOfFile (hFile=0x34c) returned 1 [0199.957] CloseHandle (hObject=0x34c) returned 1 [0199.957] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.958] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\current tabs")) returned 1 [0199.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.958] lstrlenW (lpString=".doc") returned 4 [0199.958] lstrcmpiW (lpString1=".doc", lpString2="Tabs") returned -1 [0199.958] lstrlenW (lpString=".docx") returned 5 [0199.958] lstrcmpiW (lpString1=".docx", lpString2=" Tabs") returned 1 [0199.958] lstrlenW (lpString=".pdf") returned 4 [0199.958] lstrcmpiW (lpString1=".pdf", lpString2="Tabs") returned -1 [0199.958] lstrlenW (lpString=".xls") returned 4 [0199.958] lstrcmpiW (lpString1=".xls", lpString2="Tabs") returned -1 [0199.958] lstrlenW (lpString=".xlsx") returned 5 [0199.958] lstrcmpiW (lpString1=".xlsx", lpString2=" Tabs") returned 1 [0199.958] lstrlenW (lpString=".ppt") returned 4 [0199.958] lstrcmpiW (lpString1=".ppt", lpString2="Tabs") returned -1 [0199.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.958] lstrlenW (lpString=".zip") returned 4 [0199.958] lstrcmpiW (lpString1=".zip", lpString2="Tabs") returned -1 [0199.958] lstrlenW (lpString=".rar") returned 4 [0199.958] lstrcmpiW (lpString1=".rar", lpString2="Tabs") returned -1 [0199.958] lstrlenW (lpString=".bz2") returned 4 [0199.958] lstrcmpiW (lpString1=".bz2", lpString2="Tabs") returned -1 [0199.958] lstrlenW (lpString=".7z") returned 3 [0199.958] lstrcmpiW (lpString1=".7z", lpString2="abs") returned -1 [0199.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.958] lstrlenW (lpString=".dbf") returned 4 [0199.958] lstrcmpiW (lpString1=".dbf", lpString2="Tabs") returned -1 [0199.958] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.959] lstrlenW (lpString=".1cd") returned 4 [0199.959] lstrcmpiW (lpString1=".1cd", lpString2="Tabs") returned -1 [0199.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.959] lstrlenW (lpString=".jpg") returned 4 [0199.959] lstrcmpiW (lpString1=".jpg", lpString2="Tabs") returned -1 [0199.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.959] lstrlenW (lpString=".doc") returned 4 [0199.959] lstrcmpiW (lpString1=".doc", lpString2="Tabs") returned -1 [0199.959] lstrlenW (lpString=".docx") returned 5 [0199.959] lstrcmpiW (lpString1=".docx", lpString2=" Tabs") returned 1 [0199.959] lstrlenW (lpString=".pdf") returned 4 [0199.959] lstrcmpiW (lpString1=".pdf", lpString2="Tabs") returned -1 [0199.959] lstrlenW (lpString=".xls") returned 4 [0199.959] lstrcmpiW (lpString1=".xls", lpString2="Tabs") returned -1 [0199.959] lstrlenW (lpString=".xlsx") returned 5 [0199.959] lstrcmpiW (lpString1=".xlsx", lpString2=" Tabs") returned 1 [0199.959] lstrlenW (lpString=".ppt") returned 4 [0199.959] lstrcmpiW (lpString1=".ppt", lpString2="Tabs") returned -1 [0199.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.959] lstrlenW (lpString=".zip") returned 4 [0199.959] lstrcmpiW (lpString1=".zip", lpString2="Tabs") returned -1 [0199.959] lstrlenW (lpString=".rar") returned 4 [0199.959] lstrcmpiW (lpString1=".rar", lpString2="Tabs") returned -1 [0199.959] lstrlenW (lpString=".bz2") returned 4 [0199.959] lstrcmpiW (lpString1=".bz2", lpString2="Tabs") returned -1 [0199.959] lstrlenW (lpString=".7z") returned 3 [0199.959] lstrcmpiW (lpString1=".7z", lpString2="abs") returned -1 [0199.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.959] lstrlenW (lpString=".dbf") returned 4 [0199.959] lstrcmpiW (lpString1=".dbf", lpString2="Tabs") returned -1 [0199.959] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.960] lstrlenW (lpString=".1cd") returned 4 [0199.960] lstrcmpiW (lpString1=".1cd", lpString2="Tabs") returned -1 [0199.960] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Current Tabs") returned 88 [0199.960] lstrlenW (lpString=".jpg") returned 4 [0199.960] lstrcmpiW (lpString1=".jpg", lpString2="Tabs") returned -1 [0199.960] lstrlenW (lpString="CURRENT") returned 7 [0199.960] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.962] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=16) returned 1 [0199.962] CloseHandle (hObject=0x34c) returned 1 [0199.965] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 0x2020 [0199.965] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.965] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.965] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.965] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.965] GetLastError () returned 0x0 [0199.966] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x10, lpOverlapped=0x0) returned 1 [0199.966] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x20, lpOverlapped=0x0) returned 1 [0199.967] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.967] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0199.967] SetEndOfFile (hFile=0x15c) returned 1 [0199.968] CloseHandle (hObject=0x15c) returned 1 [0199.968] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.968] SetEndOfFile (hFile=0x34c) returned 1 [0199.968] CloseHandle (hObject=0x34c) returned 1 [0199.968] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.969] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\current")) returned 1 [0199.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.969] lstrlenW (lpString=".doc") returned 4 [0199.969] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0199.969] lstrlenW (lpString=".docx") returned 5 [0199.969] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0199.969] lstrlenW (lpString=".pdf") returned 4 [0199.969] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0199.969] lstrlenW (lpString=".xls") returned 4 [0199.969] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0199.969] lstrlenW (lpString=".xlsx") returned 5 [0199.969] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0199.969] lstrlenW (lpString=".ppt") returned 4 [0199.969] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0199.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.969] lstrlenW (lpString=".zip") returned 4 [0199.969] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0199.969] lstrlenW (lpString=".rar") returned 4 [0199.969] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0199.969] lstrlenW (lpString=".bz2") returned 4 [0199.969] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0199.969] lstrlenW (lpString=".7z") returned 3 [0199.969] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0199.969] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.969] lstrlenW (lpString=".dbf") returned 4 [0199.969] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0199.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.970] lstrlenW (lpString=".1cd") returned 4 [0199.970] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0199.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.970] lstrlenW (lpString=".jpg") returned 4 [0199.970] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0199.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.970] lstrlenW (lpString=".doc") returned 4 [0199.970] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0199.970] lstrlenW (lpString=".docx") returned 5 [0199.970] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0199.970] lstrlenW (lpString=".pdf") returned 4 [0199.970] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0199.970] lstrlenW (lpString=".xls") returned 4 [0199.970] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0199.970] lstrlenW (lpString=".xlsx") returned 5 [0199.970] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0199.970] lstrlenW (lpString=".ppt") returned 4 [0199.970] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0199.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.970] lstrlenW (lpString=".zip") returned 4 [0199.970] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0199.970] lstrlenW (lpString=".rar") returned 4 [0199.970] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0199.970] lstrlenW (lpString=".bz2") returned 4 [0199.970] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0199.970] lstrlenW (lpString=".7z") returned 3 [0199.970] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0199.970] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.970] lstrlenW (lpString=".dbf") returned 4 [0199.970] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0199.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.971] lstrlenW (lpString=".1cd") returned 4 [0199.971] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0199.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\CURRENT") returned 112 [0199.971] lstrlenW (lpString=".jpg") returned 4 [0199.971] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0199.971] lstrlenW (lpString="LOCK") returned 4 [0199.971] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.971] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0199.971] CloseHandle (hObject=0x34c) returned 1 [0199.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0199.971] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0199.971] lstrlenW (lpString=".doc") returned 4 [0199.971] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString=".docx") returned 5 [0199.972] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0199.972] lstrlenW (lpString=".pdf") returned 4 [0199.972] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString=".xls") returned 4 [0199.972] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString=".xlsx") returned 5 [0199.972] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0199.972] lstrlenW (lpString=".ppt") returned 4 [0199.972] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0199.972] lstrlenW (lpString=".zip") returned 4 [0199.972] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString=".rar") returned 4 [0199.972] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString=".bz2") returned 4 [0199.972] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString=".7z") returned 3 [0199.972] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0199.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0199.972] lstrlenW (lpString=".dbf") returned 4 [0199.972] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0199.972] lstrlenW (lpString=".1cd") returned 4 [0199.972] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0199.972] lstrlenW (lpString=".jpg") returned 4 [0199.972] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0199.972] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0199.972] lstrlenW (lpString=".doc") returned 4 [0199.972] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0199.972] lstrlenW (lpString=".docx") returned 5 [0200.094] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0200.094] lstrlenW (lpString=".pdf") returned 4 [0200.094] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0200.094] lstrlenW (lpString=".xls") returned 4 [0200.094] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0200.094] lstrlenW (lpString=".xlsx") returned 5 [0200.094] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0200.094] lstrlenW (lpString=".ppt") returned 4 [0200.094] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0200.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0200.094] lstrlenW (lpString=".zip") returned 4 [0200.094] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0200.094] lstrlenW (lpString=".rar") returned 4 [0200.094] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0200.094] lstrlenW (lpString=".bz2") returned 4 [0200.094] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0200.094] lstrlenW (lpString=".7z") returned 3 [0200.094] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0200.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0200.094] lstrlenW (lpString=".dbf") returned 4 [0200.094] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0200.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0200.094] lstrlenW (lpString=".1cd") returned 4 [0200.094] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0200.094] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOCK") returned 109 [0200.094] lstrlenW (lpString=".jpg") returned 4 [0200.094] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0200.095] lstrlenW (lpString="LOG") returned 3 [0200.095] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.095] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=167) returned 1 [0200.095] CloseHandle (hObject=0x2d4) returned 1 [0200.095] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 0x2020 [0200.095] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.096] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.096] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.096] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.546] GetLastError () returned 0x0 [0200.546] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0xa7, lpOverlapped=0x0) returned 1 [0200.547] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0200.548] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.548] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xda, lpOverlapped=0x0) returned 1 [0200.548] SetEndOfFile (hFile=0x15c) returned 1 [0200.548] CloseHandle (hObject=0x15c) returned 1 [0200.548] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.548] SetEndOfFile (hFile=0x2d4) returned 1 [0200.549] CloseHandle (hObject=0x2d4) returned 1 [0200.549] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.549] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\data_reduction_proxy_leveldb\\log")) returned 1 [0200.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.550] lstrlenW (lpString=".doc") returned 4 [0200.550] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0200.550] lstrlenW (lpString=".docx") returned 5 [0200.550] lstrcmpiW (lpString1=".docx", lpString2="b\\LOG") returned -1 [0200.550] lstrlenW (lpString=".pdf") returned 4 [0200.550] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0200.550] lstrlenW (lpString=".xls") returned 4 [0200.550] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0200.550] lstrlenW (lpString=".xlsx") returned 5 [0200.550] lstrcmpiW (lpString1=".xlsx", lpString2="b\\LOG") returned -1 [0200.550] lstrlenW (lpString=".ppt") returned 4 [0200.550] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0200.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.550] lstrlenW (lpString=".zip") returned 4 [0200.550] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0200.550] lstrlenW (lpString=".rar") returned 4 [0200.550] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0200.550] lstrlenW (lpString=".bz2") returned 4 [0200.550] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0200.550] lstrlenW (lpString=".7z") returned 3 [0200.550] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0200.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.550] lstrlenW (lpString=".dbf") returned 4 [0200.550] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0200.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.550] lstrlenW (lpString=".1cd") returned 4 [0200.550] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0200.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.551] lstrlenW (lpString=".jpg") returned 4 [0200.551] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0200.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.551] lstrlenW (lpString=".doc") returned 4 [0200.551] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0200.551] lstrlenW (lpString=".docx") returned 5 [0200.551] lstrcmpiW (lpString1=".docx", lpString2="b\\LOG") returned -1 [0200.551] lstrlenW (lpString=".pdf") returned 4 [0200.551] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0200.551] lstrlenW (lpString=".xls") returned 4 [0200.551] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0200.551] lstrlenW (lpString=".xlsx") returned 5 [0200.551] lstrcmpiW (lpString1=".xlsx", lpString2="b\\LOG") returned -1 [0200.551] lstrlenW (lpString=".ppt") returned 4 [0200.551] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0200.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.551] lstrlenW (lpString=".zip") returned 4 [0200.551] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0200.551] lstrlenW (lpString=".rar") returned 4 [0200.551] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0200.551] lstrlenW (lpString=".bz2") returned 4 [0200.551] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0200.551] lstrlenW (lpString=".7z") returned 3 [0200.551] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0200.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.551] lstrlenW (lpString=".dbf") returned 4 [0200.551] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0200.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.551] lstrlenW (lpString=".1cd") returned 4 [0200.551] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0200.551] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\data_reduction_proxy_leveldb\\LOG") returned 108 [0200.551] lstrlenW (lpString=".jpg") returned 4 [0200.552] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0200.552] lstrlenW (lpString="LOCK") returned 4 [0200.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.552] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0200.552] CloseHandle (hObject=0x2d4) returned 1 [0200.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.552] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.552] lstrlenW (lpString=".doc") returned 4 [0200.552] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0200.552] lstrlenW (lpString=".docx") returned 5 [0200.552] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0200.552] lstrlenW (lpString=".pdf") returned 4 [0200.552] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0200.552] lstrlenW (lpString=".xls") returned 4 [0200.552] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString=".xlsx") returned 5 [0200.553] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0200.553] lstrlenW (lpString=".ppt") returned 4 [0200.553] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.553] lstrlenW (lpString=".zip") returned 4 [0200.553] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString=".rar") returned 4 [0200.553] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString=".bz2") returned 4 [0200.553] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString=".7z") returned 3 [0200.553] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0200.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.553] lstrlenW (lpString=".dbf") returned 4 [0200.553] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.553] lstrlenW (lpString=".1cd") returned 4 [0200.553] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.553] lstrlenW (lpString=".jpg") returned 4 [0200.553] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.553] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.553] lstrlenW (lpString=".doc") returned 4 [0200.553] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString=".docx") returned 5 [0200.553] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0200.553] lstrlenW (lpString=".pdf") returned 4 [0200.553] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString=".xls") returned 4 [0200.553] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0200.553] lstrlenW (lpString=".xlsx") returned 5 [0200.554] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0200.554] lstrlenW (lpString=".ppt") returned 4 [0200.554] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0200.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.554] lstrlenW (lpString=".zip") returned 4 [0200.554] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0200.554] lstrlenW (lpString=".rar") returned 4 [0200.554] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0200.554] lstrlenW (lpString=".bz2") returned 4 [0200.554] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0200.554] lstrlenW (lpString=".7z") returned 3 [0200.554] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0200.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.554] lstrlenW (lpString=".dbf") returned 4 [0200.554] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0200.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.554] lstrlenW (lpString=".1cd") returned 4 [0200.554] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0200.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOCK") returned 96 [0200.554] lstrlenW (lpString=".jpg") returned 4 [0200.554] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0200.554] lstrlenW (lpString="LOG") returned 3 [0200.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.555] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=154) returned 1 [0200.555] CloseHandle (hObject=0x2d4) returned 1 [0200.555] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 0x2020 [0200.555] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.555] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.555] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.556] GetLastError () returned 0x0 [0200.556] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x9a, lpOverlapped=0x0) returned 1 [0200.556] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0200.557] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.557] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xda, lpOverlapped=0x0) returned 1 [0200.557] SetEndOfFile (hFile=0x15c) returned 1 [0200.558] CloseHandle (hObject=0x15c) returned 1 [0200.558] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.558] SetEndOfFile (hFile=0x2d4) returned 1 [0200.558] CloseHandle (hObject=0x2d4) returned 1 [0200.558] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.559] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\log")) returned 1 [0200.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.559] lstrlenW (lpString=".doc") returned 4 [0200.559] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0200.559] lstrlenW (lpString=".docx") returned 5 [0200.559] lstrcmpiW (lpString1=".docx", lpString2="e\\LOG") returned -1 [0200.559] lstrlenW (lpString=".pdf") returned 4 [0200.559] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0200.559] lstrlenW (lpString=".xls") returned 4 [0200.559] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0200.559] lstrlenW (lpString=".xlsx") returned 5 [0200.559] lstrcmpiW (lpString1=".xlsx", lpString2="e\\LOG") returned -1 [0200.559] lstrlenW (lpString=".ppt") returned 4 [0200.559] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0200.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.559] lstrlenW (lpString=".zip") returned 4 [0200.559] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0200.559] lstrlenW (lpString=".rar") returned 4 [0200.559] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0200.559] lstrlenW (lpString=".bz2") returned 4 [0200.559] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0200.559] lstrlenW (lpString=".7z") returned 3 [0200.559] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0200.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.560] lstrlenW (lpString=".dbf") returned 4 [0200.560] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0200.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.560] lstrlenW (lpString=".1cd") returned 4 [0200.560] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0200.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.560] lstrlenW (lpString=".jpg") returned 4 [0200.560] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0200.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.560] lstrlenW (lpString=".doc") returned 4 [0200.560] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0200.560] lstrlenW (lpString=".docx") returned 5 [0200.560] lstrcmpiW (lpString1=".docx", lpString2="e\\LOG") returned -1 [0200.560] lstrlenW (lpString=".pdf") returned 4 [0200.560] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0200.560] lstrlenW (lpString=".xls") returned 4 [0200.560] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0200.560] lstrlenW (lpString=".xlsx") returned 5 [0200.560] lstrcmpiW (lpString1=".xlsx", lpString2="e\\LOG") returned -1 [0200.560] lstrlenW (lpString=".ppt") returned 4 [0200.560] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0200.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.560] lstrlenW (lpString=".zip") returned 4 [0200.560] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0200.560] lstrlenW (lpString=".rar") returned 4 [0200.560] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0200.560] lstrlenW (lpString=".bz2") returned 4 [0200.560] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0200.560] lstrlenW (lpString=".7z") returned 3 [0200.560] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0200.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.560] lstrlenW (lpString=".dbf") returned 4 [0200.561] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0200.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.561] lstrlenW (lpString=".1cd") returned 4 [0200.561] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0200.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\LOG") returned 95 [0200.561] lstrlenW (lpString=".jpg") returned 4 [0200.561] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0200.561] lstrlenW (lpString="MANIFEST-000001") returned 15 [0200.561] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.561] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=41) returned 1 [0200.561] CloseHandle (hObject=0x2d4) returned 1 [0200.561] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 0x2020 [0200.561] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.562] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.562] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.562] GetLastError () returned 0x0 [0200.562] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x29, lpOverlapped=0x0) returned 1 [0200.563] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x30, lpOverlapped=0x0) returned 1 [0200.564] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.564] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0200.564] SetEndOfFile (hFile=0x15c) returned 1 [0200.564] CloseHandle (hObject=0x15c) returned 1 [0200.564] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.564] SetEndOfFile (hFile=0x2d4) returned 1 [0200.565] CloseHandle (hObject=0x2d4) returned 1 [0200.565] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.565] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\manifest-000001")) returned 1 [0200.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.566] lstrlenW (lpString=".doc") returned 4 [0200.566] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0200.566] lstrlenW (lpString=".docx") returned 5 [0200.566] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0200.566] lstrlenW (lpString=".pdf") returned 4 [0200.566] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0200.566] lstrlenW (lpString=".xls") returned 4 [0200.566] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0200.566] lstrlenW (lpString=".xlsx") returned 5 [0200.566] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0200.566] lstrlenW (lpString=".ppt") returned 4 [0200.566] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0200.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.566] lstrlenW (lpString=".zip") returned 4 [0200.566] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0200.566] lstrlenW (lpString=".rar") returned 4 [0200.566] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0200.566] lstrlenW (lpString=".bz2") returned 4 [0200.566] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0200.566] lstrlenW (lpString=".7z") returned 3 [0200.566] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0200.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.566] lstrlenW (lpString=".dbf") returned 4 [0200.566] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0200.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.566] lstrlenW (lpString=".1cd") returned 4 [0200.566] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0200.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.566] lstrlenW (lpString=".jpg") returned 4 [0200.566] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0200.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.567] lstrlenW (lpString=".doc") returned 4 [0200.567] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0200.567] lstrlenW (lpString=".docx") returned 5 [0200.567] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0200.567] lstrlenW (lpString=".pdf") returned 4 [0200.567] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0200.567] lstrlenW (lpString=".xls") returned 4 [0200.567] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0200.567] lstrlenW (lpString=".xlsx") returned 5 [0200.567] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0200.567] lstrlenW (lpString=".ppt") returned 4 [0200.567] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0200.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.567] lstrlenW (lpString=".zip") returned 4 [0200.567] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0200.567] lstrlenW (lpString=".rar") returned 4 [0200.567] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0200.567] lstrlenW (lpString=".bz2") returned 4 [0200.567] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0200.567] lstrlenW (lpString=".7z") returned 3 [0200.567] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0200.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.567] lstrlenW (lpString=".dbf") returned 4 [0200.567] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0200.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.567] lstrlenW (lpString=".1cd") returned 4 [0200.567] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0200.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\MANIFEST-000001") returned 107 [0200.567] lstrlenW (lpString=".jpg") returned 4 [0200.567] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0200.568] lstrlenW (lpString="Favicons") returned 8 [0200.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.568] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=20480) returned 1 [0200.568] CloseHandle (hObject=0x2d4) returned 1 [0200.568] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons")) returned 0x2020 [0200.568] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.568] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.569] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.569] GetLastError () returned 0x0 [0200.569] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x5000, lpOverlapped=0x0) returned 1 [0200.571] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x5010, lpOverlapped=0x0) returned 1 [0200.572] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.572] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0200.572] SetEndOfFile (hFile=0x15c) returned 1 [0200.572] CloseHandle (hObject=0x15c) returned 1 [0200.572] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.572] SetEndOfFile (hFile=0x2d4) returned 1 [0200.573] CloseHandle (hObject=0x2d4) returned 1 [0200.573] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.573] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons")) returned 1 [0200.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.574] lstrlenW (lpString=".doc") returned 4 [0200.574] lstrcmpiW (lpString1=".doc", lpString2="cons") returned -1 [0200.574] lstrlenW (lpString=".docx") returned 5 [0200.574] lstrcmpiW (lpString1=".docx", lpString2="icons") returned -1 [0200.574] lstrlenW (lpString=".pdf") returned 4 [0200.574] lstrcmpiW (lpString1=".pdf", lpString2="cons") returned -1 [0200.574] lstrlenW (lpString=".xls") returned 4 [0200.574] lstrcmpiW (lpString1=".xls", lpString2="cons") returned -1 [0200.574] lstrlenW (lpString=".xlsx") returned 5 [0200.574] lstrcmpiW (lpString1=".xlsx", lpString2="icons") returned -1 [0200.574] lstrlenW (lpString=".ppt") returned 4 [0200.574] lstrcmpiW (lpString1=".ppt", lpString2="cons") returned -1 [0200.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.574] lstrlenW (lpString=".zip") returned 4 [0200.574] lstrcmpiW (lpString1=".zip", lpString2="cons") returned -1 [0200.574] lstrlenW (lpString=".rar") returned 4 [0200.574] lstrcmpiW (lpString1=".rar", lpString2="cons") returned -1 [0200.574] lstrlenW (lpString=".bz2") returned 4 [0200.574] lstrcmpiW (lpString1=".bz2", lpString2="cons") returned -1 [0200.574] lstrlenW (lpString=".7z") returned 3 [0200.574] lstrcmpiW (lpString1=".7z", lpString2="ons") returned -1 [0200.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.574] lstrlenW (lpString=".dbf") returned 4 [0200.574] lstrcmpiW (lpString1=".dbf", lpString2="cons") returned -1 [0200.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.574] lstrlenW (lpString=".1cd") returned 4 [0200.574] lstrcmpiW (lpString1=".1cd", lpString2="cons") returned -1 [0200.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.575] lstrlenW (lpString=".jpg") returned 4 [0200.575] lstrcmpiW (lpString1=".jpg", lpString2="cons") returned -1 [0200.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.575] lstrlenW (lpString=".doc") returned 4 [0200.575] lstrcmpiW (lpString1=".doc", lpString2="cons") returned -1 [0200.575] lstrlenW (lpString=".docx") returned 5 [0200.575] lstrcmpiW (lpString1=".docx", lpString2="icons") returned -1 [0200.575] lstrlenW (lpString=".pdf") returned 4 [0200.575] lstrcmpiW (lpString1=".pdf", lpString2="cons") returned -1 [0200.575] lstrlenW (lpString=".xls") returned 4 [0200.575] lstrcmpiW (lpString1=".xls", lpString2="cons") returned -1 [0200.575] lstrlenW (lpString=".xlsx") returned 5 [0200.575] lstrcmpiW (lpString1=".xlsx", lpString2="icons") returned -1 [0200.575] lstrlenW (lpString=".ppt") returned 4 [0200.575] lstrcmpiW (lpString1=".ppt", lpString2="cons") returned -1 [0200.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.575] lstrlenW (lpString=".zip") returned 4 [0200.575] lstrcmpiW (lpString1=".zip", lpString2="cons") returned -1 [0200.575] lstrlenW (lpString=".rar") returned 4 [0200.575] lstrcmpiW (lpString1=".rar", lpString2="cons") returned -1 [0200.575] lstrlenW (lpString=".bz2") returned 4 [0200.575] lstrcmpiW (lpString1=".bz2", lpString2="cons") returned -1 [0200.575] lstrlenW (lpString=".7z") returned 3 [0200.575] lstrcmpiW (lpString1=".7z", lpString2="ons") returned -1 [0200.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.575] lstrlenW (lpString=".dbf") returned 4 [0200.575] lstrcmpiW (lpString1=".dbf", lpString2="cons") returned -1 [0200.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.575] lstrlenW (lpString=".1cd") returned 4 [0200.575] lstrcmpiW (lpString1=".1cd", lpString2="cons") returned -1 [0200.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons") returned 84 [0200.575] lstrlenW (lpString=".jpg") returned 4 [0200.575] lstrcmpiW (lpString1=".jpg", lpString2="cons") returned -1 [0200.576] lstrlenW (lpString="Favicons-journal") returned 16 [0200.576] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\favicons-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.576] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0200.576] CloseHandle (hObject=0x2d4) returned 1 [0200.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.576] lstrlenW (lpString=".doc") returned 4 [0200.576] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.576] lstrlenW (lpString=".docx") returned 5 [0200.576] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.576] lstrlenW (lpString=".pdf") returned 4 [0200.576] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.576] lstrlenW (lpString=".xls") returned 4 [0200.576] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.576] lstrlenW (lpString=".xlsx") returned 5 [0200.576] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.577] lstrlenW (lpString=".ppt") returned 4 [0200.577] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.577] lstrlenW (lpString=".zip") returned 4 [0200.577] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.577] lstrlenW (lpString=".rar") returned 4 [0200.577] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.577] lstrlenW (lpString=".bz2") returned 4 [0200.577] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.577] lstrlenW (lpString=".7z") returned 3 [0200.577] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.577] lstrlenW (lpString=".dbf") returned 4 [0200.577] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.577] lstrlenW (lpString=".1cd") returned 4 [0200.577] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.577] lstrlenW (lpString=".jpg") returned 4 [0200.577] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.577] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.577] lstrlenW (lpString=".doc") returned 4 [0200.577] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0200.577] lstrlenW (lpString=".docx") returned 5 [0200.577] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0200.577] lstrlenW (lpString=".pdf") returned 4 [0200.577] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0200.577] lstrlenW (lpString=".xls") returned 4 [0200.577] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0200.577] lstrlenW (lpString=".xlsx") returned 5 [0200.577] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0200.577] lstrlenW (lpString=".ppt") returned 4 [0200.577] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0200.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.578] lstrlenW (lpString=".zip") returned 4 [0200.578] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0200.578] lstrlenW (lpString=".rar") returned 4 [0200.578] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0200.578] lstrlenW (lpString=".bz2") returned 4 [0200.578] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0200.578] lstrlenW (lpString=".7z") returned 3 [0200.578] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0200.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.578] lstrlenW (lpString=".dbf") returned 4 [0200.578] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0200.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.578] lstrlenW (lpString=".1cd") returned 4 [0200.578] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0200.578] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Favicons-journal") returned 92 [0200.578] lstrlenW (lpString=".jpg") returned 4 [0200.578] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0200.578] lstrcmpiW (lpString1=".ico", lpString2=".wiki") returned -1 [0200.578] lstrlenW (lpString="Google Profile.ico") returned 18 [0200.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.579] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=176873) returned 1 [0200.579] CloseHandle (hObject=0x2d4) returned 1 [0200.579] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico")) returned 0x2020 [0200.579] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0200.579] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.579] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.579] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0200.580] GetLastError () returned 0x0 [0200.580] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x2b2e9, lpOverlapped=0x0) returned 1 [0200.742] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x2b2f0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x2b2f0, lpOverlapped=0x0) returned 1 [0200.745] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.745] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0200.745] SetEndOfFile (hFile=0x15c) returned 1 [0200.745] CloseHandle (hObject=0x15c) returned 1 [0200.746] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.746] SetEndOfFile (hFile=0x2d4) returned 1 [0200.747] CloseHandle (hObject=0x2d4) returned 1 [0200.747] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.747] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\google profile.ico")) returned 1 [0200.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.748] lstrlenW (lpString=".doc") returned 4 [0200.748] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0200.748] lstrlenW (lpString=".docx") returned 5 [0200.748] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0200.748] lstrlenW (lpString=".pdf") returned 4 [0200.748] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0200.748] lstrlenW (lpString=".xls") returned 4 [0200.748] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0200.748] lstrlenW (lpString=".xlsx") returned 5 [0200.748] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0200.748] lstrlenW (lpString=".ppt") returned 4 [0200.748] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0200.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.748] lstrlenW (lpString=".zip") returned 4 [0200.748] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0200.748] lstrlenW (lpString=".rar") returned 4 [0200.748] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0200.748] lstrlenW (lpString=".bz2") returned 4 [0200.748] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0200.748] lstrlenW (lpString=".7z") returned 3 [0200.748] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0200.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.748] lstrlenW (lpString=".dbf") returned 4 [0200.748] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0200.748] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.748] lstrlenW (lpString=".1cd") returned 4 [0200.748] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0200.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.749] lstrlenW (lpString=".jpg") returned 4 [0200.749] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0200.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.749] lstrlenW (lpString=".doc") returned 4 [0200.749] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0200.749] lstrlenW (lpString=".docx") returned 5 [0200.749] lstrcmpiW (lpString1=".docx", lpString2="e.ico") returned -1 [0200.749] lstrlenW (lpString=".pdf") returned 4 [0200.749] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0200.749] lstrlenW (lpString=".xls") returned 4 [0200.749] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0200.749] lstrlenW (lpString=".xlsx") returned 5 [0200.749] lstrcmpiW (lpString1=".xlsx", lpString2="e.ico") returned -1 [0200.749] lstrlenW (lpString=".ppt") returned 4 [0200.749] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0200.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.749] lstrlenW (lpString=".zip") returned 4 [0200.749] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0200.749] lstrlenW (lpString=".rar") returned 4 [0200.749] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0200.749] lstrlenW (lpString=".bz2") returned 4 [0200.749] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0200.749] lstrlenW (lpString=".7z") returned 3 [0200.749] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0200.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.749] lstrlenW (lpString=".dbf") returned 4 [0200.749] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0200.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.749] lstrlenW (lpString=".1cd") returned 4 [0200.749] lstrcmpiW (lpString1=".1cd", lpString2=".ico") returned -1 [0200.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Google Profile.ico") returned 94 [0200.750] lstrlenW (lpString=".jpg") returned 4 [0200.750] lstrcmpiW (lpString1=".jpg", lpString2=".ico") returned 1 [0200.750] lstrcmpiW (lpString1=".tmp", lpString2=".wiki") returned -1 [0200.750] lstrlenW (lpString="2B04.tmp") returned 8 [0200.750] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b04.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.078] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0201.078] CloseHandle (hObject=0x358) returned 1 [0201.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.078] lstrlenW (lpString=".doc") returned 4 [0201.078] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0201.078] lstrlenW (lpString=".docx") returned 5 [0201.078] lstrcmpiW (lpString1=".docx", lpString2="4.tmp") returned -1 [0201.078] lstrlenW (lpString=".pdf") returned 4 [0201.078] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0201.078] lstrlenW (lpString=".xls") returned 4 [0201.079] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0201.079] lstrlenW (lpString=".xlsx") returned 5 [0201.079] lstrcmpiW (lpString1=".xlsx", lpString2="4.tmp") returned -1 [0201.079] lstrlenW (lpString=".ppt") returned 4 [0201.096] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0201.096] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.096] lstrlenW (lpString=".zip") returned 4 [0201.096] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0201.096] lstrlenW (lpString=".rar") returned 4 [0201.096] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0201.096] lstrlenW (lpString=".bz2") returned 4 [0201.096] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0201.096] lstrlenW (lpString=".7z") returned 3 [0201.104] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0201.104] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.104] lstrlenW (lpString=".dbf") returned 4 [0201.105] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0201.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.105] lstrlenW (lpString=".1cd") returned 4 [0201.105] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0201.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.105] lstrlenW (lpString=".jpg") returned 4 [0201.105] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0201.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.105] lstrlenW (lpString=".doc") returned 4 [0201.105] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0201.105] lstrlenW (lpString=".docx") returned 5 [0201.105] lstrcmpiW (lpString1=".docx", lpString2="4.tmp") returned -1 [0201.105] lstrlenW (lpString=".pdf") returned 4 [0201.105] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0201.105] lstrlenW (lpString=".xls") returned 4 [0201.105] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0201.105] lstrlenW (lpString=".xlsx") returned 5 [0201.105] lstrcmpiW (lpString1=".xlsx", lpString2="4.tmp") returned -1 [0201.105] lstrlenW (lpString=".ppt") returned 4 [0201.105] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0201.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.105] lstrlenW (lpString=".zip") returned 4 [0201.105] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0201.105] lstrlenW (lpString=".rar") returned 4 [0201.105] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0201.105] lstrlenW (lpString=".bz2") returned 4 [0201.105] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0201.105] lstrlenW (lpString=".7z") returned 3 [0201.105] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0201.105] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.105] lstrlenW (lpString=".dbf") returned 4 [0201.106] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0201.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.106] lstrlenW (lpString=".1cd") returned 4 [0201.106] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0201.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B04.tmp") returned 101 [0201.106] lstrlenW (lpString=".jpg") returned 4 [0201.106] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0201.106] lstrlenW (lpString="Shortcuts-journal") returned 17 [0201.106] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.106] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0201.106] CloseHandle (hObject=0x358) returned 1 [0201.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.106] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.106] lstrlenW (lpString=".doc") returned 4 [0201.106] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.106] lstrlenW (lpString=".docx") returned 5 [0201.107] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.107] lstrlenW (lpString=".pdf") returned 4 [0201.107] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.107] lstrlenW (lpString=".xls") returned 4 [0201.107] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.107] lstrlenW (lpString=".xlsx") returned 5 [0201.107] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.107] lstrlenW (lpString=".ppt") returned 4 [0201.107] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.107] lstrlenW (lpString=".zip") returned 4 [0201.107] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.107] lstrlenW (lpString=".rar") returned 4 [0201.107] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.107] lstrlenW (lpString=".bz2") returned 4 [0201.107] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.107] lstrlenW (lpString=".7z") returned 3 [0201.107] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.107] lstrlenW (lpString=".dbf") returned 4 [0201.107] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.107] lstrlenW (lpString=".1cd") returned 4 [0201.107] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.107] lstrlenW (lpString=".jpg") returned 4 [0201.107] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.107] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.107] lstrlenW (lpString=".doc") returned 4 [0201.107] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.107] lstrlenW (lpString=".docx") returned 5 [0201.107] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.108] lstrlenW (lpString=".pdf") returned 4 [0201.108] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.108] lstrlenW (lpString=".xls") returned 4 [0201.108] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.108] lstrlenW (lpString=".xlsx") returned 5 [0201.108] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.108] lstrlenW (lpString=".ppt") returned 4 [0201.108] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.108] lstrlenW (lpString=".zip") returned 4 [0201.108] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.108] lstrlenW (lpString=".rar") returned 4 [0201.108] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.108] lstrlenW (lpString=".bz2") returned 4 [0201.108] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.108] lstrlenW (lpString=".7z") returned 3 [0201.108] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.108] lstrlenW (lpString=".dbf") returned 4 [0201.108] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.108] lstrlenW (lpString=".1cd") returned 4 [0201.108] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.108] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts-journal") returned 93 [0201.108] lstrlenW (lpString=".jpg") returned 4 [0201.108] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.108] lstrlenW (lpString="CURRENT") returned 7 [0201.108] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.109] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=16) returned 1 [0201.109] CloseHandle (hObject=0x358) returned 1 [0201.110] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current")) returned 0x2020 [0201.110] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.110] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.110] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.110] GetLastError () returned 0x0 [0201.110] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x10, lpOverlapped=0x0) returned 1 [0201.112] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x20, lpOverlapped=0x0) returned 1 [0201.112] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.113] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0201.113] SetEndOfFile (hFile=0x354) returned 1 [0201.113] CloseHandle (hObject=0x354) returned 1 [0201.113] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.113] SetEndOfFile (hFile=0x358) returned 1 [0201.114] CloseHandle (hObject=0x358) returned 1 [0201.114] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.114] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\current")) returned 1 [0201.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.114] lstrlenW (lpString=".doc") returned 4 [0201.114] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0201.114] lstrlenW (lpString=".docx") returned 5 [0201.114] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0201.114] lstrlenW (lpString=".pdf") returned 4 [0201.114] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0201.114] lstrlenW (lpString=".xls") returned 4 [0201.114] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0201.114] lstrlenW (lpString=".xlsx") returned 5 [0201.114] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0201.114] lstrlenW (lpString=".ppt") returned 4 [0201.114] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0201.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.114] lstrlenW (lpString=".zip") returned 4 [0201.114] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0201.114] lstrlenW (lpString=".rar") returned 4 [0201.114] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString=".bz2") returned 4 [0201.115] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString=".7z") returned 3 [0201.115] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0201.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.115] lstrlenW (lpString=".dbf") returned 4 [0201.115] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.115] lstrlenW (lpString=".1cd") returned 4 [0201.115] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.115] lstrlenW (lpString=".jpg") returned 4 [0201.115] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.115] lstrlenW (lpString=".doc") returned 4 [0201.115] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString=".docx") returned 5 [0201.115] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0201.115] lstrlenW (lpString=".pdf") returned 4 [0201.115] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString=".xls") returned 4 [0201.115] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString=".xlsx") returned 5 [0201.115] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0201.115] lstrlenW (lpString=".ppt") returned 4 [0201.115] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.115] lstrlenW (lpString=".zip") returned 4 [0201.115] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString=".rar") returned 4 [0201.115] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString=".bz2") returned 4 [0201.115] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0201.115] lstrlenW (lpString=".7z") returned 3 [0201.116] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0201.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.116] lstrlenW (lpString=".dbf") returned 4 [0201.116] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0201.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.116] lstrlenW (lpString=".1cd") returned 4 [0201.116] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0201.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\CURRENT") returned 140 [0201.116] lstrlenW (lpString=".jpg") returned 4 [0201.116] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0201.116] lstrlenW (lpString="LOCK") returned 4 [0201.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.119] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0201.119] CloseHandle (hObject=0x358) returned 1 [0201.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.119] lstrlenW (lpString=".doc") returned 4 [0201.119] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0201.119] lstrlenW (lpString=".docx") returned 5 [0201.119] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0201.119] lstrlenW (lpString=".pdf") returned 4 [0201.119] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0201.119] lstrlenW (lpString=".xls") returned 4 [0201.119] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0201.119] lstrlenW (lpString=".xlsx") returned 5 [0201.119] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0201.119] lstrlenW (lpString=".ppt") returned 4 [0201.119] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0201.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.119] lstrlenW (lpString=".zip") returned 4 [0201.119] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0201.119] lstrlenW (lpString=".rar") returned 4 [0201.119] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0201.119] lstrlenW (lpString=".bz2") returned 4 [0201.119] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0201.119] lstrlenW (lpString=".7z") returned 3 [0201.119] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0201.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.119] lstrlenW (lpString=".dbf") returned 4 [0201.119] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0201.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.120] lstrlenW (lpString=".1cd") returned 4 [0201.120] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0201.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.120] lstrlenW (lpString=".jpg") returned 4 [0201.120] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0201.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.120] lstrlenW (lpString=".doc") returned 4 [0201.120] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0201.120] lstrlenW (lpString=".docx") returned 5 [0201.120] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0201.120] lstrlenW (lpString=".pdf") returned 4 [0201.120] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0201.120] lstrlenW (lpString=".xls") returned 4 [0201.120] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0201.120] lstrlenW (lpString=".xlsx") returned 5 [0201.120] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0201.120] lstrlenW (lpString=".ppt") returned 4 [0201.120] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0201.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.120] lstrlenW (lpString=".zip") returned 4 [0201.120] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0201.120] lstrlenW (lpString=".rar") returned 4 [0201.120] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0201.120] lstrlenW (lpString=".bz2") returned 4 [0201.120] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0201.120] lstrlenW (lpString=".7z") returned 3 [0201.120] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0201.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.120] lstrlenW (lpString=".dbf") returned 4 [0201.120] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0201.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.120] lstrlenW (lpString=".1cd") returned 4 [0201.120] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0201.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOCK") returned 137 [0201.121] lstrlenW (lpString=".jpg") returned 4 [0201.121] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0201.121] lstrlenW (lpString="LOG") returned 3 [0201.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.121] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=195) returned 1 [0201.121] CloseHandle (hObject=0x358) returned 1 [0201.121] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log")) returned 0x2020 [0201.121] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.122] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.122] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.122] GetLastError () returned 0x0 [0201.122] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0xc3, lpOverlapped=0x0) returned 1 [0201.123] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0201.124] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.124] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xda, lpOverlapped=0x0) returned 1 [0201.124] SetEndOfFile (hFile=0x354) returned 1 [0201.124] CloseHandle (hObject=0x354) returned 1 [0201.124] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.124] SetEndOfFile (hFile=0x358) returned 1 [0201.125] CloseHandle (hObject=0x358) returned 1 [0201.125] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.125] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\log")) returned 1 [0201.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.125] lstrlenW (lpString=".doc") returned 4 [0201.125] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0201.125] lstrlenW (lpString=".docx") returned 5 [0201.125] lstrcmpiW (lpString1=".docx", lpString2="m\\LOG") returned -1 [0201.126] lstrlenW (lpString=".pdf") returned 4 [0201.126] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0201.126] lstrlenW (lpString=".xls") returned 4 [0201.126] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0201.126] lstrlenW (lpString=".xlsx") returned 5 [0201.126] lstrcmpiW (lpString1=".xlsx", lpString2="m\\LOG") returned -1 [0201.126] lstrlenW (lpString=".ppt") returned 4 [0201.126] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0201.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.126] lstrlenW (lpString=".zip") returned 4 [0201.126] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0201.126] lstrlenW (lpString=".rar") returned 4 [0201.126] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0201.126] lstrlenW (lpString=".bz2") returned 4 [0201.126] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0201.126] lstrlenW (lpString=".7z") returned 3 [0201.126] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0201.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.126] lstrlenW (lpString=".dbf") returned 4 [0201.126] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0201.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.126] lstrlenW (lpString=".1cd") returned 4 [0201.126] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0201.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.126] lstrlenW (lpString=".jpg") returned 4 [0201.126] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0201.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.126] lstrlenW (lpString=".doc") returned 4 [0201.126] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0201.126] lstrlenW (lpString=".docx") returned 5 [0201.126] lstrcmpiW (lpString1=".docx", lpString2="m\\LOG") returned -1 [0201.127] lstrlenW (lpString=".pdf") returned 4 [0201.127] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0201.127] lstrlenW (lpString=".xls") returned 4 [0201.127] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0201.127] lstrlenW (lpString=".xlsx") returned 5 [0201.127] lstrcmpiW (lpString1=".xlsx", lpString2="m\\LOG") returned -1 [0201.127] lstrlenW (lpString=".ppt") returned 4 [0201.127] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0201.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.127] lstrlenW (lpString=".zip") returned 4 [0201.127] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0201.127] lstrlenW (lpString=".rar") returned 4 [0201.127] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0201.127] lstrlenW (lpString=".bz2") returned 4 [0201.127] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0201.127] lstrlenW (lpString=".7z") returned 3 [0201.127] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0201.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.127] lstrlenW (lpString=".dbf") returned 4 [0201.127] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0201.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.127] lstrlenW (lpString=".1cd") returned 4 [0201.128] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0201.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\LOG") returned 136 [0201.128] lstrlenW (lpString=".jpg") returned 4 [0201.128] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0201.128] lstrlenW (lpString="MANIFEST-000001") returned 15 [0201.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.128] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=41) returned 1 [0201.128] CloseHandle (hObject=0x358) returned 1 [0201.128] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001")) returned 0x2020 [0201.128] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.128] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.129] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.129] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.129] GetLastError () returned 0x0 [0201.129] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x29, lpOverlapped=0x0) returned 1 [0201.130] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x30, lpOverlapped=0x0) returned 1 [0201.131] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.131] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0201.131] SetEndOfFile (hFile=0x354) returned 1 [0201.131] CloseHandle (hObject=0x354) returned 1 [0201.131] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.131] SetEndOfFile (hFile=0x358) returned 1 [0201.132] CloseHandle (hObject=0x358) returned 1 [0201.132] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.132] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\sync extension settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\manifest-000001")) returned 1 [0201.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.132] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.132] lstrlenW (lpString=".doc") returned 4 [0201.132] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0201.132] lstrlenW (lpString=".docx") returned 5 [0201.132] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0201.132] lstrlenW (lpString=".pdf") returned 4 [0201.132] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0201.132] lstrlenW (lpString=".xls") returned 4 [0201.133] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString=".xlsx") returned 5 [0201.133] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0201.133] lstrlenW (lpString=".ppt") returned 4 [0201.133] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.133] lstrlenW (lpString=".zip") returned 4 [0201.133] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString=".rar") returned 4 [0201.133] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString=".bz2") returned 4 [0201.133] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString=".7z") returned 3 [0201.133] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0201.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.133] lstrlenW (lpString=".dbf") returned 4 [0201.133] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.133] lstrlenW (lpString=".1cd") returned 4 [0201.133] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.133] lstrlenW (lpString=".jpg") returned 4 [0201.133] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.133] lstrlenW (lpString=".doc") returned 4 [0201.133] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString=".docx") returned 5 [0201.133] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0201.133] lstrlenW (lpString=".pdf") returned 4 [0201.133] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString=".xls") returned 4 [0201.133] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0201.133] lstrlenW (lpString=".xlsx") returned 5 [0201.134] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0201.134] lstrlenW (lpString=".ppt") returned 4 [0201.134] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0201.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.134] lstrlenW (lpString=".zip") returned 4 [0201.134] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0201.134] lstrlenW (lpString=".rar") returned 4 [0201.134] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0201.134] lstrlenW (lpString=".bz2") returned 4 [0201.134] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0201.134] lstrlenW (lpString=".7z") returned 3 [0201.134] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0201.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.134] lstrlenW (lpString=".dbf") returned 4 [0201.134] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0201.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.134] lstrlenW (lpString=".1cd") returned 4 [0201.134] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0201.134] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Sync Extension Settings\\pkedcjkdefgpdelpbcmbmeomcjbeemfm\\MANIFEST-000001") returned 148 [0201.134] lstrlenW (lpString=".jpg") returned 4 [0201.134] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0201.134] lstrlenW (lpString="Top Sites") returned 9 [0201.134] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.135] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=20480) returned 1 [0201.135] CloseHandle (hObject=0x358) returned 1 [0201.135] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites")) returned 0x2020 [0201.135] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.135] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.135] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.135] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.135] GetLastError () returned 0x0 [0201.136] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x5000, lpOverlapped=0x0) returned 1 [0201.137] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x5010, lpOverlapped=0x0) returned 1 [0201.138] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.139] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0201.139] SetEndOfFile (hFile=0x354) returned 1 [0201.139] CloseHandle (hObject=0x354) returned 1 [0201.139] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.139] SetEndOfFile (hFile=0x358) returned 1 [0201.140] CloseHandle (hObject=0x358) returned 1 [0201.140] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.140] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites")) returned 1 [0201.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.140] lstrlenW (lpString=".doc") returned 4 [0201.140] lstrcmpiW (lpString1=".doc", lpString2="ites") returned -1 [0201.140] lstrlenW (lpString=".docx") returned 5 [0201.140] lstrcmpiW (lpString1=".docx", lpString2="Sites") returned -1 [0201.140] lstrlenW (lpString=".pdf") returned 4 [0201.140] lstrcmpiW (lpString1=".pdf", lpString2="ites") returned -1 [0201.140] lstrlenW (lpString=".xls") returned 4 [0201.140] lstrcmpiW (lpString1=".xls", lpString2="ites") returned -1 [0201.140] lstrlenW (lpString=".xlsx") returned 5 [0201.140] lstrcmpiW (lpString1=".xlsx", lpString2="Sites") returned -1 [0201.140] lstrlenW (lpString=".ppt") returned 4 [0201.140] lstrcmpiW (lpString1=".ppt", lpString2="ites") returned -1 [0201.140] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.140] lstrlenW (lpString=".zip") returned 4 [0201.141] lstrcmpiW (lpString1=".zip", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString=".rar") returned 4 [0201.141] lstrcmpiW (lpString1=".rar", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString=".bz2") returned 4 [0201.141] lstrcmpiW (lpString1=".bz2", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString=".7z") returned 3 [0201.141] lstrcmpiW (lpString1=".7z", lpString2="tes") returned -1 [0201.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.141] lstrlenW (lpString=".dbf") returned 4 [0201.141] lstrcmpiW (lpString1=".dbf", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.141] lstrlenW (lpString=".1cd") returned 4 [0201.141] lstrcmpiW (lpString1=".1cd", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.141] lstrlenW (lpString=".jpg") returned 4 [0201.141] lstrcmpiW (lpString1=".jpg", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.141] lstrlenW (lpString=".doc") returned 4 [0201.141] lstrcmpiW (lpString1=".doc", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString=".docx") returned 5 [0201.141] lstrcmpiW (lpString1=".docx", lpString2="Sites") returned -1 [0201.141] lstrlenW (lpString=".pdf") returned 4 [0201.141] lstrcmpiW (lpString1=".pdf", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString=".xls") returned 4 [0201.141] lstrcmpiW (lpString1=".xls", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString=".xlsx") returned 5 [0201.141] lstrcmpiW (lpString1=".xlsx", lpString2="Sites") returned -1 [0201.141] lstrlenW (lpString=".ppt") returned 4 [0201.141] lstrcmpiW (lpString1=".ppt", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.141] lstrlenW (lpString=".zip") returned 4 [0201.141] lstrcmpiW (lpString1=".zip", lpString2="ites") returned -1 [0201.141] lstrlenW (lpString=".rar") returned 4 [0201.141] lstrcmpiW (lpString1=".rar", lpString2="ites") returned -1 [0201.142] lstrlenW (lpString=".bz2") returned 4 [0201.142] lstrcmpiW (lpString1=".bz2", lpString2="ites") returned -1 [0201.142] lstrlenW (lpString=".7z") returned 3 [0201.142] lstrcmpiW (lpString1=".7z", lpString2="tes") returned -1 [0201.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.142] lstrlenW (lpString=".dbf") returned 4 [0201.142] lstrcmpiW (lpString1=".dbf", lpString2="ites") returned -1 [0201.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.142] lstrlenW (lpString=".1cd") returned 4 [0201.142] lstrcmpiW (lpString1=".1cd", lpString2="ites") returned -1 [0201.142] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites") returned 85 [0201.142] lstrlenW (lpString=".jpg") returned 4 [0201.142] lstrcmpiW (lpString1=".jpg", lpString2="ites") returned -1 [0201.142] lstrlenW (lpString="Top Sites-journal") returned 17 [0201.142] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\top sites-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.142] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0201.358] CloseHandle (hObject=0x358) returned 1 [0201.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.366] lstrlenW (lpString=".doc") returned 4 [0201.369] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.369] lstrlenW (lpString=".docx") returned 5 [0201.369] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.377] lstrlenW (lpString=".pdf") returned 4 [0201.377] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.377] lstrlenW (lpString=".xls") returned 4 [0201.377] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.377] lstrlenW (lpString=".xlsx") returned 5 [0201.377] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.377] lstrlenW (lpString=".ppt") returned 4 [0201.377] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.391] lstrlenW (lpString=".zip") returned 4 [0201.391] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.391] lstrlenW (lpString=".rar") returned 4 [0201.391] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.391] lstrlenW (lpString=".bz2") returned 4 [0201.391] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.391] lstrlenW (lpString=".7z") returned 3 [0201.391] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.391] lstrlenW (lpString=".dbf") returned 4 [0201.391] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.391] lstrlenW (lpString=".1cd") returned 4 [0201.391] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.391] lstrlenW (lpString=".jpg") returned 4 [0201.391] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.391] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.391] lstrlenW (lpString=".doc") returned 4 [0201.391] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.392] lstrlenW (lpString=".docx") returned 5 [0201.392] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.392] lstrlenW (lpString=".pdf") returned 4 [0201.392] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.392] lstrlenW (lpString=".xls") returned 4 [0201.392] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.392] lstrlenW (lpString=".xlsx") returned 5 [0201.392] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.392] lstrlenW (lpString=".ppt") returned 4 [0201.392] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.392] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.392] lstrlenW (lpString=".zip") returned 4 [0201.392] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.392] lstrlenW (lpString=".rar") returned 4 [0201.392] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.392] lstrlenW (lpString=".bz2") returned 4 [0201.392] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.392] lstrlenW (lpString=".7z") returned 3 [0201.392] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.393] lstrlenW (lpString=".dbf") returned 4 [0201.393] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.393] lstrlenW (lpString=".1cd") returned 4 [0201.393] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.393] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Top Sites-journal") returned 93 [0201.393] lstrlenW (lpString=".jpg") returned 4 [0201.393] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.393] lstrcmpiW (lpString1=".feed-ms", lpString2=".wiki") returned -1 [0201.393] lstrlenW (lpString="MSNBC News~.feed-ms") returned 19 [0201.393] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.394] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=28672) returned 1 [0201.394] CloseHandle (hObject=0x358) returned 1 [0201.394] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms")) returned 0x2020 [0201.394] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0201.394] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.394] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.394] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.395] GetLastError () returned 0x0 [0201.395] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x7000, lpOverlapped=0x0) returned 1 [0201.398] WriteFile (in: hFile=0x34c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x7010, lpOverlapped=0x0) returned 1 [0201.399] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.399] WriteFile (in: hFile=0x34c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0201.400] SetEndOfFile (hFile=0x34c) returned 1 [0201.400] CloseHandle (hObject=0x34c) returned 1 [0201.400] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.400] SetEndOfFile (hFile=0x358) returned 1 [0201.401] CloseHandle (hObject=0x358) returned 1 [0201.401] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.401] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\msnbc news~.feed-ms")) returned 1 [0201.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.402] lstrlenW (lpString=".doc") returned 4 [0201.402] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0201.402] lstrlenW (lpString=".docx") returned 5 [0201.402] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0201.402] lstrlenW (lpString=".pdf") returned 4 [0201.402] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0201.402] lstrlenW (lpString=".xls") returned 4 [0201.402] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0201.402] lstrlenW (lpString=".xlsx") returned 5 [0201.402] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0201.402] lstrlenW (lpString=".ppt") returned 4 [0201.402] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0201.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.402] lstrlenW (lpString=".zip") returned 4 [0201.402] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0201.402] lstrlenW (lpString=".rar") returned 4 [0201.402] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0201.402] lstrlenW (lpString=".bz2") returned 4 [0201.402] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0201.402] lstrlenW (lpString=".7z") returned 3 [0201.402] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.402] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.402] lstrlenW (lpString=".dbf") returned 4 [0201.402] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0201.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.403] lstrlenW (lpString=".1cd") returned 4 [0201.403] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0201.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.403] lstrlenW (lpString=".jpg") returned 4 [0201.403] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0201.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.403] lstrlenW (lpString=".doc") returned 4 [0201.403] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0201.403] lstrlenW (lpString=".docx") returned 5 [0201.403] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0201.403] lstrlenW (lpString=".pdf") returned 4 [0201.403] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0201.403] lstrlenW (lpString=".xls") returned 4 [0201.403] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0201.403] lstrlenW (lpString=".xlsx") returned 5 [0201.403] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0201.403] lstrlenW (lpString=".ppt") returned 4 [0201.403] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0201.403] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.403] lstrlenW (lpString=".zip") returned 4 [0201.403] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0201.403] lstrlenW (lpString=".rar") returned 4 [0201.403] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0201.403] lstrlenW (lpString=".bz2") returned 4 [0201.403] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0201.404] lstrlenW (lpString=".7z") returned 3 [0201.404] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.404] lstrlenW (lpString=".dbf") returned 4 [0201.404] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0201.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.404] lstrlenW (lpString=".1cd") returned 4 [0201.404] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0201.404] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\MSNBC News~.feed-ms") returned 96 [0201.404] lstrlenW (lpString=".jpg") returned 4 [0201.404] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0201.404] lstrcmpiW (lpString1=".feed-ms", lpString2=".wiki") returned -1 [0201.404] lstrlenW (lpString="Suggested Sites~.feed-ms") returned 24 [0201.404] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.409] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=32768) returned 1 [0201.409] CloseHandle (hObject=0x354) returned 1 [0201.409] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms")) returned 0x2020 [0201.409] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.409] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.409] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.409] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.409] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0201.412] GetLastError () returned 0x0 [0201.412] ReadFile (in: hFile=0x354, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x8000, lpOverlapped=0x0) returned 1 [0201.414] WriteFile (in: hFile=0x154, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x8010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x8010, lpOverlapped=0x0) returned 1 [0201.416] ReadFile (in: hFile=0x354, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.416] WriteFile (in: hFile=0x154, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x104, lpOverlapped=0x0) returned 1 [0201.416] SetEndOfFile (hFile=0x154) returned 1 [0201.416] CloseHandle (hObject=0x154) returned 1 [0201.417] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.417] SetEndOfFile (hFile=0x354) returned 1 [0201.418] CloseHandle (hObject=0x354) returned 1 [0201.418] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.418] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\suggested sites~.feed-ms")) returned 1 [0201.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.418] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.418] lstrlenW (lpString=".doc") returned 4 [0201.418] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0201.418] lstrlenW (lpString=".docx") returned 5 [0201.419] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0201.419] lstrlenW (lpString=".pdf") returned 4 [0201.419] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0201.419] lstrlenW (lpString=".xls") returned 4 [0201.419] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0201.419] lstrlenW (lpString=".xlsx") returned 5 [0201.419] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0201.419] lstrlenW (lpString=".ppt") returned 4 [0201.419] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0201.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.419] lstrlenW (lpString=".zip") returned 4 [0201.419] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0201.419] lstrlenW (lpString=".rar") returned 4 [0201.419] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0201.419] lstrlenW (lpString=".bz2") returned 4 [0201.419] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0201.419] lstrlenW (lpString=".7z") returned 3 [0201.419] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.419] lstrlenW (lpString=".dbf") returned 4 [0201.419] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0201.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.419] lstrlenW (lpString=".1cd") returned 4 [0201.419] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0201.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.419] lstrlenW (lpString=".jpg") returned 4 [0201.419] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0201.419] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.420] lstrlenW (lpString=".doc") returned 4 [0201.420] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0201.420] lstrlenW (lpString=".docx") returned 5 [0201.420] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0201.420] lstrlenW (lpString=".pdf") returned 4 [0201.420] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0201.420] lstrlenW (lpString=".xls") returned 4 [0201.420] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0201.420] lstrlenW (lpString=".xlsx") returned 5 [0201.420] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0201.420] lstrlenW (lpString=".ppt") returned 4 [0201.420] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0201.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.420] lstrlenW (lpString=".zip") returned 4 [0201.420] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0201.420] lstrlenW (lpString=".rar") returned 4 [0201.420] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0201.420] lstrlenW (lpString=".bz2") returned 4 [0201.420] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0201.420] lstrlenW (lpString=".7z") returned 3 [0201.420] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.420] lstrlenW (lpString=".dbf") returned 4 [0201.420] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0201.420] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.420] lstrlenW (lpString=".1cd") returned 4 [0201.420] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0201.421] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Suggested Sites~.feed-ms") returned 135 [0201.421] lstrlenW (lpString=".jpg") returned 4 [0201.421] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0201.421] lstrcmpiW (lpString1=".feed-ms", lpString2=".wiki") returned -1 [0201.421] lstrlenW (lpString="Web Slice Gallery~.feed-ms") returned 26 [0201.421] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.421] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=28672) returned 1 [0201.422] CloseHandle (hObject=0x354) returned 1 [0201.422] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms")) returned 0x2020 [0201.422] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.422] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.422] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.422] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0201.423] GetLastError () returned 0x0 [0201.423] ReadFile (in: hFile=0x354, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x7000, lpOverlapped=0x0) returned 1 [0201.426] WriteFile (in: hFile=0x154, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x7010, lpOverlapped=0x0) returned 1 [0201.427] ReadFile (in: hFile=0x354, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.427] WriteFile (in: hFile=0x154, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x108, lpOverlapped=0x0) returned 1 [0201.428] SetEndOfFile (hFile=0x154) returned 1 [0201.428] CloseHandle (hObject=0x154) returned 1 [0201.428] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.428] SetEndOfFile (hFile=0x354) returned 1 [0201.429] CloseHandle (hObject=0x354) returned 1 [0201.429] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.429] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\{5588acfd-6436-411b-a5ce-666ae6a92d3d}~\\webslices~\\web slice gallery~.feed-ms")) returned 1 [0201.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.430] lstrlenW (lpString=".doc") returned 4 [0201.430] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0201.430] lstrlenW (lpString=".docx") returned 5 [0201.430] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0201.430] lstrlenW (lpString=".pdf") returned 4 [0201.430] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0201.430] lstrlenW (lpString=".xls") returned 4 [0201.430] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0201.430] lstrlenW (lpString=".xlsx") returned 5 [0201.430] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0201.430] lstrlenW (lpString=".ppt") returned 4 [0201.430] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0201.430] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.430] lstrlenW (lpString=".zip") returned 4 [0201.430] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0201.430] lstrlenW (lpString=".rar") returned 4 [0201.430] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0201.430] lstrlenW (lpString=".bz2") returned 4 [0201.430] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0201.431] lstrlenW (lpString=".7z") returned 3 [0201.431] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.431] lstrlenW (lpString=".dbf") returned 4 [0201.431] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0201.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.431] lstrlenW (lpString=".1cd") returned 4 [0201.431] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0201.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.431] lstrlenW (lpString=".jpg") returned 4 [0201.431] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0201.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.431] lstrlenW (lpString=".doc") returned 4 [0201.431] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0201.431] lstrlenW (lpString=".docx") returned 5 [0201.431] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0201.431] lstrlenW (lpString=".pdf") returned 4 [0201.431] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0201.431] lstrlenW (lpString=".xls") returned 4 [0201.431] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0201.431] lstrlenW (lpString=".xlsx") returned 5 [0201.431] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0201.431] lstrlenW (lpString=".ppt") returned 4 [0201.431] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0201.431] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.431] lstrlenW (lpString=".zip") returned 4 [0201.431] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0201.431] lstrlenW (lpString=".rar") returned 4 [0201.431] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0201.431] lstrlenW (lpString=".bz2") returned 4 [0201.432] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0201.432] lstrlenW (lpString=".7z") returned 3 [0201.432] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.432] lstrlenW (lpString=".dbf") returned 4 [0201.432] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0201.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.432] lstrlenW (lpString=".1cd") returned 4 [0201.432] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0201.432] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\{5588ACFD-6436-411B-A5CE-666AE6A92D3D}~\\WebSlices~\\Web Slice Gallery~.feed-ms") returned 137 [0201.432] lstrlenW (lpString=".jpg") returned 4 [0201.432] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0201.432] lstrlenW (lpString="fwlink[1]") returned 9 [0201.432] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\1nbur4hr\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.433] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0201.433] CloseHandle (hObject=0x354) returned 1 [0201.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.433] lstrlenW (lpString=".doc") returned 4 [0201.433] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0201.433] lstrlenW (lpString=".docx") returned 5 [0201.433] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0201.433] lstrlenW (lpString=".pdf") returned 4 [0201.433] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0201.433] lstrlenW (lpString=".xls") returned 4 [0201.433] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0201.433] lstrlenW (lpString=".xlsx") returned 5 [0201.433] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0201.433] lstrlenW (lpString=".ppt") returned 4 [0201.433] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0201.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.433] lstrlenW (lpString=".zip") returned 4 [0201.433] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0201.433] lstrlenW (lpString=".rar") returned 4 [0201.433] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0201.433] lstrlenW (lpString=".bz2") returned 4 [0201.433] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0201.433] lstrlenW (lpString=".7z") returned 3 [0201.433] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0201.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.433] lstrlenW (lpString=".dbf") returned 4 [0201.433] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0201.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.433] lstrlenW (lpString=".1cd") returned 4 [0201.433] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0201.433] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.433] lstrlenW (lpString=".jpg") returned 4 [0201.434] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0201.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.434] lstrlenW (lpString=".doc") returned 4 [0201.434] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0201.434] lstrlenW (lpString=".docx") returned 5 [0201.434] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0201.434] lstrlenW (lpString=".pdf") returned 4 [0201.434] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0201.434] lstrlenW (lpString=".xls") returned 4 [0201.434] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0201.434] lstrlenW (lpString=".xlsx") returned 5 [0201.434] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0201.434] lstrlenW (lpString=".ppt") returned 4 [0201.434] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0201.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.434] lstrlenW (lpString=".zip") returned 4 [0201.434] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0201.434] lstrlenW (lpString=".rar") returned 4 [0201.434] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0201.434] lstrlenW (lpString=".bz2") returned 4 [0201.434] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0201.434] lstrlenW (lpString=".7z") returned 3 [0201.434] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0201.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.434] lstrlenW (lpString=".dbf") returned 4 [0201.434] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0201.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.434] lstrlenW (lpString=".1cd") returned 4 [0201.434] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0201.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\1NBUR4HR\\fwlink[1]") returned 84 [0201.434] lstrlenW (lpString=".jpg") returned 4 [0201.434] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0201.435] lstrlenW (lpString="fwlink[1]") returned 9 [0201.435] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\6asvn7j7\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.435] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0201.435] CloseHandle (hObject=0x354) returned 1 [0201.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.435] lstrlenW (lpString=".doc") returned 4 [0201.435] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0201.435] lstrlenW (lpString=".docx") returned 5 [0201.435] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0201.435] lstrlenW (lpString=".pdf") returned 4 [0201.435] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0201.435] lstrlenW (lpString=".xls") returned 4 [0201.435] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0201.435] lstrlenW (lpString=".xlsx") returned 5 [0201.436] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0201.436] lstrlenW (lpString=".ppt") returned 4 [0201.436] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0201.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.436] lstrlenW (lpString=".zip") returned 4 [0201.436] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0201.436] lstrlenW (lpString=".rar") returned 4 [0201.436] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0201.436] lstrlenW (lpString=".bz2") returned 4 [0201.436] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0201.436] lstrlenW (lpString=".7z") returned 3 [0201.436] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0201.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.436] lstrlenW (lpString=".dbf") returned 4 [0201.436] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0201.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.436] lstrlenW (lpString=".1cd") returned 4 [0201.436] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0201.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.436] lstrlenW (lpString=".jpg") returned 4 [0201.436] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0201.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.436] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.436] lstrlenW (lpString=".doc") returned 4 [0201.436] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0201.436] lstrlenW (lpString=".docx") returned 5 [0201.436] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0201.436] lstrlenW (lpString=".pdf") returned 4 [0201.436] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0201.436] lstrlenW (lpString=".xls") returned 4 [0201.436] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0201.436] lstrlenW (lpString=".xlsx") returned 5 [0201.436] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0201.436] lstrlenW (lpString=".ppt") returned 4 [0201.437] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0201.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.437] lstrlenW (lpString=".zip") returned 4 [0201.437] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0201.437] lstrlenW (lpString=".rar") returned 4 [0201.437] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0201.437] lstrlenW (lpString=".bz2") returned 4 [0201.437] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0201.437] lstrlenW (lpString=".7z") returned 3 [0201.437] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0201.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.437] lstrlenW (lpString=".dbf") returned 4 [0201.437] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0201.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.437] lstrlenW (lpString=".1cd") returned 4 [0201.437] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0201.437] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\6ASVN7J7\\fwlink[1]") returned 84 [0201.437] lstrlenW (lpString=".jpg") returned 4 [0201.437] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0201.437] lstrlenW (lpString="fwlink[1]") returned 9 [0201.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\d68g7bij\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.438] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0201.438] CloseHandle (hObject=0x354) returned 1 [0201.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.439] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.439] lstrlenW (lpString=".doc") returned 4 [0201.439] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString=".docx") returned 5 [0201.440] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0201.440] lstrlenW (lpString=".pdf") returned 4 [0201.440] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString=".xls") returned 4 [0201.440] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString=".xlsx") returned 5 [0201.440] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0201.440] lstrlenW (lpString=".ppt") returned 4 [0201.440] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.440] lstrlenW (lpString=".zip") returned 4 [0201.440] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString=".rar") returned 4 [0201.440] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString=".bz2") returned 4 [0201.440] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString=".7z") returned 3 [0201.440] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0201.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.440] lstrlenW (lpString=".dbf") returned 4 [0201.440] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.440] lstrlenW (lpString=".1cd") returned 4 [0201.440] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.440] lstrlenW (lpString=".jpg") returned 4 [0201.440] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.440] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.440] lstrlenW (lpString=".doc") returned 4 [0201.440] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0201.440] lstrlenW (lpString=".docx") returned 5 [0201.441] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0201.441] lstrlenW (lpString=".pdf") returned 4 [0201.441] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0201.441] lstrlenW (lpString=".xls") returned 4 [0201.441] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0201.441] lstrlenW (lpString=".xlsx") returned 5 [0201.441] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0201.441] lstrlenW (lpString=".ppt") returned 4 [0201.441] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0201.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.441] lstrlenW (lpString=".zip") returned 4 [0201.441] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0201.441] lstrlenW (lpString=".rar") returned 4 [0201.441] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0201.441] lstrlenW (lpString=".bz2") returned 4 [0201.441] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0201.441] lstrlenW (lpString=".7z") returned 3 [0201.441] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0201.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.441] lstrlenW (lpString=".dbf") returned 4 [0201.441] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0201.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.441] lstrlenW (lpString=".1cd") returned 4 [0201.441] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0201.441] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\D68G7BIJ\\fwlink[1]") returned 84 [0201.441] lstrlenW (lpString=".jpg") returned 4 [0201.441] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0201.441] lstrlenW (lpString="fwlink[1]") returned 9 [0201.441] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\fwlink[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.442] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0201.442] CloseHandle (hObject=0x354) returned 1 [0201.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.442] lstrlenW (lpString=".doc") returned 4 [0201.442] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0201.442] lstrlenW (lpString=".docx") returned 5 [0201.442] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0201.442] lstrlenW (lpString=".pdf") returned 4 [0201.442] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0201.442] lstrlenW (lpString=".xls") returned 4 [0201.442] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0201.442] lstrlenW (lpString=".xlsx") returned 5 [0201.442] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0201.442] lstrlenW (lpString=".ppt") returned 4 [0201.442] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0201.442] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.442] lstrlenW (lpString=".zip") returned 4 [0201.442] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0201.442] lstrlenW (lpString=".rar") returned 4 [0201.443] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString=".bz2") returned 4 [0201.443] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString=".7z") returned 3 [0201.443] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0201.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.443] lstrlenW (lpString=".dbf") returned 4 [0201.443] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.443] lstrlenW (lpString=".1cd") returned 4 [0201.443] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.443] lstrlenW (lpString=".jpg") returned 4 [0201.443] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.443] lstrlenW (lpString=".doc") returned 4 [0201.443] lstrcmpiW (lpString1=".doc", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString=".docx") returned 5 [0201.443] lstrcmpiW (lpString1=".docx", lpString2="nk[1]") returned -1 [0201.443] lstrlenW (lpString=".pdf") returned 4 [0201.443] lstrcmpiW (lpString1=".pdf", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString=".xls") returned 4 [0201.443] lstrcmpiW (lpString1=".xls", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString=".xlsx") returned 5 [0201.443] lstrcmpiW (lpString1=".xlsx", lpString2="nk[1]") returned -1 [0201.443] lstrlenW (lpString=".ppt") returned 4 [0201.443] lstrcmpiW (lpString1=".ppt", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.443] lstrlenW (lpString=".zip") returned 4 [0201.443] lstrcmpiW (lpString1=".zip", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString=".rar") returned 4 [0201.443] lstrcmpiW (lpString1=".rar", lpString2="k[1]") returned -1 [0201.443] lstrlenW (lpString=".bz2") returned 4 [0201.444] lstrcmpiW (lpString1=".bz2", lpString2="k[1]") returned -1 [0201.444] lstrlenW (lpString=".7z") returned 3 [0201.444] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0201.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.444] lstrlenW (lpString=".dbf") returned 4 [0201.444] lstrcmpiW (lpString1=".dbf", lpString2="k[1]") returned -1 [0201.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.444] lstrlenW (lpString=".1cd") returned 4 [0201.444] lstrcmpiW (lpString1=".1cd", lpString2="k[1]") returned -1 [0201.444] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\fwlink[1]") returned 84 [0201.444] lstrlenW (lpString=".jpg") returned 4 [0201.444] lstrcmpiW (lpString1=".jpg", lpString2="k[1]") returned -1 [0201.444] lstrcmpiW (lpString1=".microsoft[1]", lpString2=".wiki") returned -1 [0201.444] lstrlenW (lpString="ieonline.microsoft[1]") returned 21 [0201.444] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds cache\\kqmhsvkd\\ieonline.microsoft[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.446] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0201.446] CloseHandle (hObject=0x354) returned 1 [0201.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.446] lstrlenW (lpString=".doc") returned 4 [0201.446] lstrcmpiW (lpString1=".doc", lpString2="t[1]") returned -1 [0201.446] lstrlenW (lpString=".docx") returned 5 [0201.446] lstrcmpiW (lpString1=".docx", lpString2="ft[1]") returned -1 [0201.446] lstrlenW (lpString=".pdf") returned 4 [0201.446] lstrcmpiW (lpString1=".pdf", lpString2="t[1]") returned -1 [0201.446] lstrlenW (lpString=".xls") returned 4 [0201.446] lstrcmpiW (lpString1=".xls", lpString2="t[1]") returned -1 [0201.446] lstrlenW (lpString=".xlsx") returned 5 [0201.446] lstrcmpiW (lpString1=".xlsx", lpString2="ft[1]") returned -1 [0201.446] lstrlenW (lpString=".ppt") returned 4 [0201.446] lstrcmpiW (lpString1=".ppt", lpString2="t[1]") returned -1 [0201.446] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.446] lstrlenW (lpString=".zip") returned 4 [0201.446] lstrcmpiW (lpString1=".zip", lpString2="t[1]") returned -1 [0201.446] lstrlenW (lpString=".rar") returned 4 [0201.447] lstrcmpiW (lpString1=".rar", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString=".bz2") returned 4 [0201.447] lstrcmpiW (lpString1=".bz2", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString=".7z") returned 3 [0201.447] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0201.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.447] lstrlenW (lpString=".dbf") returned 4 [0201.447] lstrcmpiW (lpString1=".dbf", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.447] lstrlenW (lpString=".1cd") returned 4 [0201.447] lstrcmpiW (lpString1=".1cd", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.447] lstrlenW (lpString=".jpg") returned 4 [0201.447] lstrcmpiW (lpString1=".jpg", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.447] lstrlenW (lpString=".doc") returned 4 [0201.447] lstrcmpiW (lpString1=".doc", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString=".docx") returned 5 [0201.447] lstrcmpiW (lpString1=".docx", lpString2="ft[1]") returned -1 [0201.447] lstrlenW (lpString=".pdf") returned 4 [0201.447] lstrcmpiW (lpString1=".pdf", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString=".xls") returned 4 [0201.447] lstrcmpiW (lpString1=".xls", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString=".xlsx") returned 5 [0201.447] lstrcmpiW (lpString1=".xlsx", lpString2="ft[1]") returned -1 [0201.447] lstrlenW (lpString=".ppt") returned 4 [0201.447] lstrcmpiW (lpString1=".ppt", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.447] lstrlenW (lpString=".zip") returned 4 [0201.447] lstrcmpiW (lpString1=".zip", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString=".rar") returned 4 [0201.447] lstrcmpiW (lpString1=".rar", lpString2="t[1]") returned -1 [0201.447] lstrlenW (lpString=".bz2") returned 4 [0201.448] lstrcmpiW (lpString1=".bz2", lpString2="t[1]") returned -1 [0201.448] lstrlenW (lpString=".7z") returned 3 [0201.448] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0201.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.448] lstrlenW (lpString=".dbf") returned 4 [0201.448] lstrcmpiW (lpString1=".dbf", lpString2="t[1]") returned -1 [0201.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.448] lstrlenW (lpString=".1cd") returned 4 [0201.448] lstrcmpiW (lpString1=".1cd", lpString2="t[1]") returned -1 [0201.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds Cache\\KQMHSVKD\\ieonline.microsoft[1]") returned 96 [0201.448] lstrlenW (lpString=".jpg") returned 4 [0201.448] lstrcmpiW (lpString1=".jpg", lpString2="t[1]") returned -1 [0201.448] lstrcmpiW (lpString1=".wmdb", lpString2=".wiki") returned 1 [0201.448] lstrlenW (lpString="CurrentDatabase_372.wmdb") returned 24 [0201.448] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.448] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1069056) returned 1 [0201.449] CloseHandle (hObject=0x354) returned 1 [0201.449] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb")) returned 0x2020 [0201.449] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0201.449] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.449] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.449] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0201.449] GetLastError () returned 0x0 [0201.449] ReadFile (in: hFile=0x354, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0201.478] WriteFile (in: hFile=0x154, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0201.741] ReadFile (in: hFile=0x354, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x5010, lpOverlapped=0x0) returned 1 [0201.749] WriteFile (in: hFile=0x154, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x5020, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x5020, lpOverlapped=0x0) returned 1 [0201.752] ReadFile (in: hFile=0x354, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.753] WriteFile (in: hFile=0x154, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x104, lpOverlapped=0x0) returned 1 [0201.753] SetEndOfFile (hFile=0x154) returned 1 [0201.753] CloseHandle (hObject=0x154) returned 1 [0201.753] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.753] SetEndOfFile (hFile=0x354) returned 1 [0201.754] CloseHandle (hObject=0x354) returned 1 [0201.754] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.754] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\currentdatabase_372.wmdb")) returned 1 [0201.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.754] lstrlenW (lpString=".doc") returned 4 [0201.754] lstrcmpiW (lpString1=".doc", lpString2="wmdb") returned -1 [0201.754] lstrlenW (lpString=".docx") returned 5 [0201.754] lstrcmpiW (lpString1=".docx", lpString2=".wmdb") returned -1 [0201.754] lstrlenW (lpString=".pdf") returned 4 [0201.754] lstrcmpiW (lpString1=".pdf", lpString2="wmdb") returned -1 [0201.754] lstrlenW (lpString=".xls") returned 4 [0201.755] lstrcmpiW (lpString1=".xls", lpString2="wmdb") returned -1 [0201.755] lstrlenW (lpString=".xlsx") returned 5 [0201.755] lstrcmpiW (lpString1=".xlsx", lpString2=".wmdb") returned 1 [0201.755] lstrlenW (lpString=".ppt") returned 4 [0201.755] lstrcmpiW (lpString1=".ppt", lpString2="wmdb") returned -1 [0201.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.755] lstrlenW (lpString=".zip") returned 4 [0201.755] lstrcmpiW (lpString1=".zip", lpString2="wmdb") returned -1 [0201.755] lstrlenW (lpString=".rar") returned 4 [0201.755] lstrcmpiW (lpString1=".rar", lpString2="wmdb") returned -1 [0201.755] lstrlenW (lpString=".bz2") returned 4 [0201.755] lstrcmpiW (lpString1=".bz2", lpString2="wmdb") returned -1 [0201.755] lstrlenW (lpString=".7z") returned 3 [0201.755] lstrcmpiW (lpString1=".7z", lpString2="mdb") returned -1 [0201.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.755] lstrlenW (lpString=".dbf") returned 4 [0201.755] lstrcmpiW (lpString1=".dbf", lpString2="wmdb") returned -1 [0201.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.755] lstrlenW (lpString=".1cd") returned 4 [0201.755] lstrcmpiW (lpString1=".1cd", lpString2="wmdb") returned -1 [0201.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.755] lstrlenW (lpString=".jpg") returned 4 [0201.755] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0201.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.755] lstrlenW (lpString=".doc") returned 4 [0201.755] lstrcmpiW (lpString1=".doc", lpString2="wmdb") returned -1 [0201.755] lstrlenW (lpString=".docx") returned 5 [0201.755] lstrcmpiW (lpString1=".docx", lpString2=".wmdb") returned -1 [0201.755] lstrlenW (lpString=".pdf") returned 4 [0201.755] lstrcmpiW (lpString1=".pdf", lpString2="wmdb") returned -1 [0201.755] lstrlenW (lpString=".xls") returned 4 [0201.755] lstrcmpiW (lpString1=".xls", lpString2="wmdb") returned -1 [0201.756] lstrlenW (lpString=".xlsx") returned 5 [0201.756] lstrcmpiW (lpString1=".xlsx", lpString2=".wmdb") returned 1 [0201.756] lstrlenW (lpString=".ppt") returned 4 [0201.756] lstrcmpiW (lpString1=".ppt", lpString2="wmdb") returned -1 [0201.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.756] lstrlenW (lpString=".zip") returned 4 [0201.756] lstrcmpiW (lpString1=".zip", lpString2="wmdb") returned -1 [0201.756] lstrlenW (lpString=".rar") returned 4 [0201.756] lstrcmpiW (lpString1=".rar", lpString2="wmdb") returned -1 [0201.756] lstrlenW (lpString=".bz2") returned 4 [0201.756] lstrcmpiW (lpString1=".bz2", lpString2="wmdb") returned -1 [0201.756] lstrlenW (lpString=".7z") returned 3 [0201.756] lstrcmpiW (lpString1=".7z", lpString2="mdb") returned -1 [0201.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.756] lstrlenW (lpString=".dbf") returned 4 [0201.756] lstrcmpiW (lpString1=".dbf", lpString2="wmdb") returned -1 [0201.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.756] lstrlenW (lpString=".1cd") returned 4 [0201.756] lstrcmpiW (lpString1=".1cd", lpString2="wmdb") returned -1 [0201.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\CurrentDatabase_372.wmdb") returned 91 [0201.756] lstrlenW (lpString=".jpg") returned 4 [0201.756] lstrcmpiW (lpString1=".jpg", lpString2="wmdb") returned -1 [0201.756] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.756] lstrlenW (lpString="10_All_Music.wpl") returned 16 [0201.756] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.163] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1063) returned 1 [0202.163] CloseHandle (hObject=0x2d4) returned 1 [0202.166] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl")) returned 0x2020 [0202.166] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.174] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.174] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.174] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.180] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.189] GetLastError () returned 0x0 [0202.191] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x427, lpOverlapped=0x0) returned 1 [0202.198] WriteFile (in: hFile=0x350, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x430, lpOverlapped=0x0) returned 1 [0202.199] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.199] WriteFile (in: hFile=0x350, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0202.199] SetEndOfFile (hFile=0x350) returned 1 [0202.200] CloseHandle (hObject=0x350) returned 1 [0202.200] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.200] SetEndOfFile (hFile=0x2d4) returned 1 [0202.200] CloseHandle (hObject=0x2d4) returned 1 [0202.200] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.201] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\10_all_music.wpl")) returned 1 [0202.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.201] lstrlenW (lpString=".doc") returned 4 [0202.201] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.201] lstrlenW (lpString=".docx") returned 5 [0202.201] lstrcmpiW (lpString1=".docx", lpString2="c.wpl") returned -1 [0202.201] lstrlenW (lpString=".pdf") returned 4 [0202.201] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.201] lstrlenW (lpString=".xls") returned 4 [0202.201] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.201] lstrlenW (lpString=".xlsx") returned 5 [0202.201] lstrcmpiW (lpString1=".xlsx", lpString2="c.wpl") returned -1 [0202.201] lstrlenW (lpString=".ppt") returned 4 [0202.201] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.201] lstrlenW (lpString=".zip") returned 4 [0202.201] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.201] lstrlenW (lpString=".rar") returned 4 [0202.201] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.201] lstrlenW (lpString=".bz2") returned 4 [0202.201] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.201] lstrlenW (lpString=".7z") returned 3 [0202.201] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.201] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.201] lstrlenW (lpString=".dbf") returned 4 [0202.201] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.202] lstrlenW (lpString=".1cd") returned 4 [0202.202] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.202] lstrlenW (lpString=".jpg") returned 4 [0202.202] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.202] lstrlenW (lpString=".doc") returned 4 [0202.202] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.202] lstrlenW (lpString=".docx") returned 5 [0202.202] lstrcmpiW (lpString1=".docx", lpString2="c.wpl") returned -1 [0202.202] lstrlenW (lpString=".pdf") returned 4 [0202.202] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.202] lstrlenW (lpString=".xls") returned 4 [0202.202] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.202] lstrlenW (lpString=".xlsx") returned 5 [0202.202] lstrcmpiW (lpString1=".xlsx", lpString2="c.wpl") returned -1 [0202.202] lstrlenW (lpString=".ppt") returned 4 [0202.202] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.202] lstrlenW (lpString=".zip") returned 4 [0202.202] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.202] lstrlenW (lpString=".rar") returned 4 [0202.202] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.202] lstrlenW (lpString=".bz2") returned 4 [0202.202] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.202] lstrlenW (lpString=".7z") returned 3 [0202.202] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.202] lstrlenW (lpString=".dbf") returned 4 [0202.202] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.202] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.203] lstrlenW (lpString=".1cd") returned 4 [0202.203] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.203] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\10_All_Music.wpl") returned 113 [0202.203] lstrlenW (lpString=".jpg") returned 4 [0202.203] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.203] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.203] lstrlenW (lpString="06_Pictures_rated_4_or_5_stars.wpl") returned 34 [0202.203] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.555] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=785) returned 1 [0202.555] CloseHandle (hObject=0x2d4) returned 1 [0202.555] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl")) returned 0x2020 [0202.555] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.555] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.555] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.555] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.556] GetLastError () returned 0x0 [0202.556] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x311, lpOverlapped=0x0) returned 1 [0202.557] WriteFile (in: hFile=0x350, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x320, lpOverlapped=0x0) returned 1 [0202.558] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.558] WriteFile (in: hFile=0x350, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x118, lpOverlapped=0x0) returned 1 [0202.558] SetEndOfFile (hFile=0x350) returned 1 [0202.558] CloseHandle (hObject=0x350) returned 1 [0202.558] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.558] SetEndOfFile (hFile=0x2d4) returned 1 [0202.559] CloseHandle (hObject=0x2d4) returned 1 [0202.559] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.559] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\06_pictures_rated_4_or_5_stars.wpl")) returned 1 [0202.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.560] lstrlenW (lpString=".doc") returned 4 [0202.560] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.560] lstrlenW (lpString=".docx") returned 5 [0202.560] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.560] lstrlenW (lpString=".pdf") returned 4 [0202.560] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.560] lstrlenW (lpString=".xls") returned 4 [0202.560] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.560] lstrlenW (lpString=".xlsx") returned 5 [0202.560] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.560] lstrlenW (lpString=".ppt") returned 4 [0202.560] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.560] lstrlenW (lpString=".zip") returned 4 [0202.560] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.560] lstrlenW (lpString=".rar") returned 4 [0202.560] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.560] lstrlenW (lpString=".bz2") returned 4 [0202.560] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.560] lstrlenW (lpString=".7z") returned 3 [0202.560] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.560] lstrlenW (lpString=".dbf") returned 4 [0202.560] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.560] lstrlenW (lpString=".1cd") returned 4 [0202.560] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.560] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.560] lstrlenW (lpString=".jpg") returned 4 [0202.560] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.561] lstrlenW (lpString=".doc") returned 4 [0202.561] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.561] lstrlenW (lpString=".docx") returned 5 [0202.561] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.561] lstrlenW (lpString=".pdf") returned 4 [0202.561] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.561] lstrlenW (lpString=".xls") returned 4 [0202.561] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.561] lstrlenW (lpString=".xlsx") returned 5 [0202.561] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.561] lstrlenW (lpString=".ppt") returned 4 [0202.561] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.561] lstrlenW (lpString=".zip") returned 4 [0202.561] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.561] lstrlenW (lpString=".rar") returned 4 [0202.561] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.561] lstrlenW (lpString=".bz2") returned 4 [0202.561] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.561] lstrlenW (lpString=".7z") returned 3 [0202.561] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.561] lstrlenW (lpString=".dbf") returned 4 [0202.561] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.561] lstrlenW (lpString=".1cd") returned 4 [0202.561] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.561] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\06_Pictures_rated_4_or_5_stars.wpl") returned 131 [0202.561] lstrlenW (lpString=".jpg") returned 4 [0202.561] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.562] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.562] lstrlenW (lpString="07_TV_recorded_in_the_last_week.wpl") returned 35 [0202.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.562] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1040) returned 1 [0202.562] CloseHandle (hObject=0x2d4) returned 1 [0202.562] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl")) returned 0x2020 [0202.562] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.562] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.563] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.563] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.563] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0202.704] GetLastError () returned 0x0 [0202.704] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x410, lpOverlapped=0x0) returned 1 [0202.731] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x420, lpOverlapped=0x0) returned 1 [0202.732] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.732] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x11a, lpOverlapped=0x0) returned 1 [0202.732] SetEndOfFile (hFile=0x354) returned 1 [0202.732] CloseHandle (hObject=0x354) returned 1 [0202.732] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.732] SetEndOfFile (hFile=0x2d4) returned 1 [0202.733] CloseHandle (hObject=0x2d4) returned 1 [0202.733] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.733] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\07_tv_recorded_in_the_last_week.wpl")) returned 1 [0202.733] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.733] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.733] lstrlenW (lpString=".doc") returned 4 [0202.733] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.733] lstrlenW (lpString=".docx") returned 5 [0202.733] lstrcmpiW (lpString1=".docx", lpString2="k.wpl") returned -1 [0202.733] lstrlenW (lpString=".pdf") returned 4 [0202.734] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.734] lstrlenW (lpString=".xls") returned 4 [0202.734] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.734] lstrlenW (lpString=".xlsx") returned 5 [0202.734] lstrcmpiW (lpString1=".xlsx", lpString2="k.wpl") returned -1 [0202.734] lstrlenW (lpString=".ppt") returned 4 [0202.734] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.734] lstrlenW (lpString=".zip") returned 4 [0202.734] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.734] lstrlenW (lpString=".rar") returned 4 [0202.734] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.734] lstrlenW (lpString=".bz2") returned 4 [0202.734] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.734] lstrlenW (lpString=".7z") returned 3 [0202.734] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.734] lstrlenW (lpString=".dbf") returned 4 [0202.734] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.734] lstrlenW (lpString=".1cd") returned 4 [0202.734] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.734] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.734] lstrlenW (lpString=".jpg") returned 4 [0202.735] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.735] lstrlenW (lpString=".doc") returned 4 [0202.735] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.735] lstrlenW (lpString=".docx") returned 5 [0202.735] lstrcmpiW (lpString1=".docx", lpString2="k.wpl") returned -1 [0202.735] lstrlenW (lpString=".pdf") returned 4 [0202.735] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.735] lstrlenW (lpString=".xls") returned 4 [0202.735] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.735] lstrlenW (lpString=".xlsx") returned 5 [0202.735] lstrcmpiW (lpString1=".xlsx", lpString2="k.wpl") returned -1 [0202.735] lstrlenW (lpString=".ppt") returned 4 [0202.735] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.735] lstrlenW (lpString=".zip") returned 4 [0202.735] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.735] lstrlenW (lpString=".rar") returned 4 [0202.735] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.735] lstrlenW (lpString=".bz2") returned 4 [0202.735] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.735] lstrlenW (lpString=".7z") returned 3 [0202.735] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.735] lstrlenW (lpString=".dbf") returned 4 [0202.735] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.735] lstrlenW (lpString=".1cd") returned 4 [0202.735] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.735] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\07_TV_recorded_in_the_last_week.wpl") returned 132 [0202.735] lstrlenW (lpString=".jpg") returned 4 [0202.735] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.736] lstrcmpiW (lpString1=".sig", lpString2=".wiki") returned -1 [0202.736] lstrlenW (lpString="350db95df4cbd94b2a1c300510e12e11.sig") returned 36 [0202.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.736] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=128) returned 1 [0202.736] CloseHandle (hObject=0x2d4) returned 1 [0202.736] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig")) returned 0x2020 [0202.736] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.736] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.737] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.737] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.737] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0202.737] GetLastError () returned 0x0 [0202.737] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x80, lpOverlapped=0x0) returned 1 [0202.738] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x90, lpOverlapped=0x0) returned 1 [0202.739] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.739] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x11c, lpOverlapped=0x0) returned 1 [0202.739] SetEndOfFile (hFile=0x354) returned 1 [0202.739] CloseHandle (hObject=0x354) returned 1 [0202.739] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.739] SetEndOfFile (hFile=0x2d4) returned 1 [0202.740] CloseHandle (hObject=0x2d4) returned 1 [0202.740] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.740] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\onetconfig\\350db95df4cbd94b2a1c300510e12e11.sig")) returned 1 [0202.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.740] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.740] lstrlenW (lpString=".doc") returned 4 [0202.740] lstrcmpiW (lpString1=".doc", lpString2=".sig") returned -1 [0202.740] lstrlenW (lpString=".docx") returned 5 [0202.741] lstrcmpiW (lpString1=".docx", lpString2="1.sig") returned -1 [0202.741] lstrlenW (lpString=".pdf") returned 4 [0202.741] lstrcmpiW (lpString1=".pdf", lpString2=".sig") returned -1 [0202.741] lstrlenW (lpString=".xls") returned 4 [0202.741] lstrcmpiW (lpString1=".xls", lpString2=".sig") returned 1 [0202.741] lstrlenW (lpString=".xlsx") returned 5 [0202.741] lstrcmpiW (lpString1=".xlsx", lpString2="1.sig") returned -1 [0202.741] lstrlenW (lpString=".ppt") returned 4 [0202.741] lstrcmpiW (lpString1=".ppt", lpString2=".sig") returned -1 [0202.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.741] lstrlenW (lpString=".zip") returned 4 [0202.741] lstrcmpiW (lpString1=".zip", lpString2=".sig") returned 1 [0202.741] lstrlenW (lpString=".rar") returned 4 [0202.741] lstrcmpiW (lpString1=".rar", lpString2=".sig") returned -1 [0202.741] lstrlenW (lpString=".bz2") returned 4 [0202.741] lstrcmpiW (lpString1=".bz2", lpString2=".sig") returned -1 [0202.741] lstrlenW (lpString=".7z") returned 3 [0202.741] lstrcmpiW (lpString1=".7z", lpString2="sig") returned -1 [0202.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.741] lstrlenW (lpString=".dbf") returned 4 [0202.741] lstrcmpiW (lpString1=".dbf", lpString2=".sig") returned -1 [0202.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.741] lstrlenW (lpString=".1cd") returned 4 [0202.741] lstrcmpiW (lpString1=".1cd", lpString2=".sig") returned -1 [0202.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.741] lstrlenW (lpString=".jpg") returned 4 [0202.741] lstrcmpiW (lpString1=".jpg", lpString2=".sig") returned -1 [0202.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.741] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.741] lstrlenW (lpString=".doc") returned 4 [0202.741] lstrcmpiW (lpString1=".doc", lpString2=".sig") returned -1 [0202.741] lstrlenW (lpString=".docx") returned 5 [0202.741] lstrcmpiW (lpString1=".docx", lpString2="1.sig") returned -1 [0202.741] lstrlenW (lpString=".pdf") returned 4 [0202.742] lstrcmpiW (lpString1=".pdf", lpString2=".sig") returned -1 [0202.742] lstrlenW (lpString=".xls") returned 4 [0202.742] lstrcmpiW (lpString1=".xls", lpString2=".sig") returned 1 [0202.742] lstrlenW (lpString=".xlsx") returned 5 [0202.742] lstrcmpiW (lpString1=".xlsx", lpString2="1.sig") returned -1 [0202.742] lstrlenW (lpString=".ppt") returned 4 [0202.742] lstrcmpiW (lpString1=".ppt", lpString2=".sig") returned -1 [0202.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.742] lstrlenW (lpString=".zip") returned 4 [0202.742] lstrcmpiW (lpString1=".zip", lpString2=".sig") returned 1 [0202.742] lstrlenW (lpString=".rar") returned 4 [0202.742] lstrcmpiW (lpString1=".rar", lpString2=".sig") returned -1 [0202.742] lstrlenW (lpString=".bz2") returned 4 [0202.742] lstrcmpiW (lpString1=".bz2", lpString2=".sig") returned -1 [0202.742] lstrlenW (lpString=".7z") returned 3 [0202.742] lstrcmpiW (lpString1=".7z", lpString2="sig") returned -1 [0202.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.742] lstrlenW (lpString=".dbf") returned 4 [0202.742] lstrcmpiW (lpString1=".dbf", lpString2=".sig") returned -1 [0202.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.742] lstrlenW (lpString=".1cd") returned 4 [0202.742] lstrcmpiW (lpString1=".1cd", lpString2=".sig") returned -1 [0202.742] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\ONetConfig\\350db95df4cbd94b2a1c300510e12e11.sig") returned 108 [0202.742] lstrlenW (lpString=".jpg") returned 4 [0202.742] lstrcmpiW (lpString1=".jpg", lpString2=".sig") returned -1 [0202.742] lstrcmpiW (lpString1=".inf", lpString2=".wiki") returned -1 [0202.742] lstrlenW (lpString="mapisvc.inf") returned 11 [0202.742] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.743] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1122) returned 1 [0202.743] CloseHandle (hObject=0x2d4) returned 1 [0202.743] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf")) returned 0x2020 [0202.743] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.743] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.743] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.743] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.752] GetLastError () returned 0x0 [0202.752] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x462, lpOverlapped=0x0) returned 1 [0202.754] WriteFile (in: hFile=0x344, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x470, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x470, lpOverlapped=0x0) returned 1 [0202.754] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.754] WriteFile (in: hFile=0x344, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1 [0202.755] SetEndOfFile (hFile=0x344) returned 1 [0202.755] CloseHandle (hObject=0x344) returned 1 [0202.755] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.755] SetEndOfFile (hFile=0x2d4) returned 1 [0202.756] CloseHandle (hObject=0x2d4) returned 1 [0202.756] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.756] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\mapisvc.inf")) returned 1 [0202.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.756] lstrlenW (lpString=".doc") returned 4 [0202.756] lstrcmpiW (lpString1=".doc", lpString2=".inf") returned -1 [0202.756] lstrlenW (lpString=".docx") returned 5 [0202.756] lstrcmpiW (lpString1=".docx", lpString2="c.inf") returned -1 [0202.756] lstrlenW (lpString=".pdf") returned 4 [0202.756] lstrcmpiW (lpString1=".pdf", lpString2=".inf") returned 1 [0202.756] lstrlenW (lpString=".xls") returned 4 [0202.756] lstrcmpiW (lpString1=".xls", lpString2=".inf") returned 1 [0202.756] lstrlenW (lpString=".xlsx") returned 5 [0202.756] lstrcmpiW (lpString1=".xlsx", lpString2="c.inf") returned -1 [0202.756] lstrlenW (lpString=".ppt") returned 4 [0202.756] lstrcmpiW (lpString1=".ppt", lpString2=".inf") returned 1 [0202.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.756] lstrlenW (lpString=".zip") returned 4 [0202.756] lstrcmpiW (lpString1=".zip", lpString2=".inf") returned 1 [0202.756] lstrlenW (lpString=".rar") returned 4 [0202.756] lstrcmpiW (lpString1=".rar", lpString2=".inf") returned 1 [0202.756] lstrlenW (lpString=".bz2") returned 4 [0202.756] lstrcmpiW (lpString1=".bz2", lpString2=".inf") returned -1 [0202.756] lstrlenW (lpString=".7z") returned 3 [0202.757] lstrcmpiW (lpString1=".7z", lpString2="inf") returned -1 [0202.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.757] lstrlenW (lpString=".dbf") returned 4 [0202.757] lstrcmpiW (lpString1=".dbf", lpString2=".inf") returned -1 [0202.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.757] lstrlenW (lpString=".1cd") returned 4 [0202.757] lstrcmpiW (lpString1=".1cd", lpString2=".inf") returned -1 [0202.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.757] lstrlenW (lpString=".jpg") returned 4 [0202.757] lstrcmpiW (lpString1=".jpg", lpString2=".inf") returned 1 [0202.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.757] lstrlenW (lpString=".doc") returned 4 [0202.757] lstrcmpiW (lpString1=".doc", lpString2=".inf") returned -1 [0202.757] lstrlenW (lpString=".docx") returned 5 [0202.757] lstrcmpiW (lpString1=".docx", lpString2="c.inf") returned -1 [0202.757] lstrlenW (lpString=".pdf") returned 4 [0202.757] lstrcmpiW (lpString1=".pdf", lpString2=".inf") returned 1 [0202.757] lstrlenW (lpString=".xls") returned 4 [0202.757] lstrcmpiW (lpString1=".xls", lpString2=".inf") returned 1 [0202.757] lstrlenW (lpString=".xlsx") returned 5 [0202.757] lstrcmpiW (lpString1=".xlsx", lpString2="c.inf") returned -1 [0202.757] lstrlenW (lpString=".ppt") returned 4 [0202.757] lstrcmpiW (lpString1=".ppt", lpString2=".inf") returned 1 [0202.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.757] lstrlenW (lpString=".zip") returned 4 [0202.757] lstrcmpiW (lpString1=".zip", lpString2=".inf") returned 1 [0202.757] lstrlenW (lpString=".rar") returned 4 [0202.757] lstrcmpiW (lpString1=".rar", lpString2=".inf") returned 1 [0202.757] lstrlenW (lpString=".bz2") returned 4 [0202.757] lstrcmpiW (lpString1=".bz2", lpString2=".inf") returned -1 [0202.757] lstrlenW (lpString=".7z") returned 3 [0202.757] lstrcmpiW (lpString1=".7z", lpString2="inf") returned -1 [0202.757] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.757] lstrlenW (lpString=".dbf") returned 4 [0202.758] lstrcmpiW (lpString1=".dbf", lpString2=".inf") returned -1 [0202.758] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.758] lstrlenW (lpString=".1cd") returned 4 [0202.758] lstrcmpiW (lpString1=".1cd", lpString2=".inf") returned -1 [0202.758] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\mapisvc.inf") returned 73 [0202.758] lstrlenW (lpString=".jpg") returned 4 [0202.758] lstrcmpiW (lpString1=".jpg", lpString2=".inf") returned 1 [0202.758] lstrcmpiW (lpString1=".etl", lpString2=".wiki") returned -1 [0202.758] lstrlenW (lpString="ExplorerStartupLog.etl") returned 22 [0202.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.758] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=24576) returned 1 [0202.758] CloseHandle (hObject=0x2d4) returned 1 [0202.758] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl")) returned 0x2020 [0202.758] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.759] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.759] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.760] GetLastError () returned 0x0 [0202.760] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x6000, lpOverlapped=0x0) returned 1 [0202.761] WriteFile (in: hFile=0x344, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x6010, lpOverlapped=0x0) returned 1 [0202.763] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.763] WriteFile (in: hFile=0x344, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x100, lpOverlapped=0x0) returned 1 [0202.763] SetEndOfFile (hFile=0x344) returned 1 [0202.763] CloseHandle (hObject=0x344) returned 1 [0202.763] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.763] SetEndOfFile (hFile=0x2d4) returned 1 [0202.764] CloseHandle (hObject=0x2d4) returned 1 [0202.764] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.764] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog.etl")) returned 1 [0202.764] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.764] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.764] lstrlenW (lpString=".doc") returned 4 [0202.764] lstrcmpiW (lpString1=".doc", lpString2=".etl") returned -1 [0202.764] lstrlenW (lpString=".docx") returned 5 [0202.764] lstrcmpiW (lpString1=".docx", lpString2="g.etl") returned -1 [0202.764] lstrlenW (lpString=".pdf") returned 4 [0202.764] lstrcmpiW (lpString1=".pdf", lpString2=".etl") returned 1 [0202.764] lstrlenW (lpString=".xls") returned 4 [0202.764] lstrcmpiW (lpString1=".xls", lpString2=".etl") returned 1 [0202.764] lstrlenW (lpString=".xlsx") returned 5 [0202.764] lstrcmpiW (lpString1=".xlsx", lpString2="g.etl") returned -1 [0202.765] lstrlenW (lpString=".ppt") returned 4 [0202.765] lstrcmpiW (lpString1=".ppt", lpString2=".etl") returned 1 [0202.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.765] lstrlenW (lpString=".zip") returned 4 [0202.765] lstrcmpiW (lpString1=".zip", lpString2=".etl") returned 1 [0202.765] lstrlenW (lpString=".rar") returned 4 [0202.765] lstrcmpiW (lpString1=".rar", lpString2=".etl") returned 1 [0202.765] lstrlenW (lpString=".bz2") returned 4 [0202.765] lstrcmpiW (lpString1=".bz2", lpString2=".etl") returned -1 [0202.765] lstrlenW (lpString=".7z") returned 3 [0202.765] lstrcmpiW (lpString1=".7z", lpString2="etl") returned -1 [0202.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.765] lstrlenW (lpString=".dbf") returned 4 [0202.765] lstrcmpiW (lpString1=".dbf", lpString2=".etl") returned -1 [0202.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.765] lstrlenW (lpString=".1cd") returned 4 [0202.765] lstrcmpiW (lpString1=".1cd", lpString2=".etl") returned -1 [0202.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.765] lstrlenW (lpString=".jpg") returned 4 [0202.765] lstrcmpiW (lpString1=".jpg", lpString2=".etl") returned 1 [0202.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.765] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.765] lstrlenW (lpString=".doc") returned 4 [0202.765] lstrcmpiW (lpString1=".doc", lpString2=".etl") returned -1 [0202.765] lstrlenW (lpString=".docx") returned 5 [0202.765] lstrcmpiW (lpString1=".docx", lpString2="g.etl") returned -1 [0202.765] lstrlenW (lpString=".pdf") returned 4 [0202.766] lstrcmpiW (lpString1=".pdf", lpString2=".etl") returned 1 [0202.766] lstrlenW (lpString=".xls") returned 4 [0202.766] lstrcmpiW (lpString1=".xls", lpString2=".etl") returned 1 [0202.766] lstrlenW (lpString=".xlsx") returned 5 [0202.766] lstrcmpiW (lpString1=".xlsx", lpString2="g.etl") returned -1 [0202.766] lstrlenW (lpString=".ppt") returned 4 [0202.766] lstrcmpiW (lpString1=".ppt", lpString2=".etl") returned 1 [0202.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.766] lstrlenW (lpString=".zip") returned 4 [0202.766] lstrcmpiW (lpString1=".zip", lpString2=".etl") returned 1 [0202.766] lstrlenW (lpString=".rar") returned 4 [0202.766] lstrcmpiW (lpString1=".rar", lpString2=".etl") returned 1 [0202.766] lstrlenW (lpString=".bz2") returned 4 [0202.766] lstrcmpiW (lpString1=".bz2", lpString2=".etl") returned -1 [0202.766] lstrlenW (lpString=".7z") returned 3 [0202.766] lstrcmpiW (lpString1=".7z", lpString2="etl") returned -1 [0202.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.766] lstrlenW (lpString=".dbf") returned 4 [0202.766] lstrcmpiW (lpString1=".dbf", lpString2=".etl") returned -1 [0202.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.766] lstrlenW (lpString=".1cd") returned 4 [0202.766] lstrcmpiW (lpString1=".1cd", lpString2=".etl") returned -1 [0202.766] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog.etl") returned 93 [0202.766] lstrlenW (lpString=".jpg") returned 4 [0202.766] lstrcmpiW (lpString1=".jpg", lpString2=".etl") returned 1 [0202.766] lstrcmpiW (lpString1=".etl", lpString2=".wiki") returned -1 [0202.766] lstrlenW (lpString="ExplorerStartupLog_RunOnce.etl") returned 30 [0202.766] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.767] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=16384) returned 1 [0202.767] CloseHandle (hObject=0x2d4) returned 1 [0202.767] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl")) returned 0x2020 [0202.767] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.767] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.767] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.767] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.768] GetLastError () returned 0x0 [0202.768] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x4000, lpOverlapped=0x0) returned 1 [0202.769] WriteFile (in: hFile=0x344, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x4010, lpOverlapped=0x0) returned 1 [0202.770] ReadFile (in: hFile=0x2d4, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.770] WriteFile (in: hFile=0x344, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x110, lpOverlapped=0x0) returned 1 [0202.771] SetEndOfFile (hFile=0x344) returned 1 [0202.771] CloseHandle (hObject=0x344) returned 1 [0202.771] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.771] SetEndOfFile (hFile=0x2d4) returned 1 [0202.772] CloseHandle (hObject=0x2d4) returned 1 [0202.772] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.772] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\explorer\\explorerstartuplog_runonce.etl")) returned 1 [0202.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.772] lstrlenW (lpString=".doc") returned 4 [0202.772] lstrcmpiW (lpString1=".doc", lpString2=".etl") returned -1 [0202.772] lstrlenW (lpString=".docx") returned 5 [0202.772] lstrcmpiW (lpString1=".docx", lpString2="e.etl") returned -1 [0202.772] lstrlenW (lpString=".pdf") returned 4 [0202.772] lstrcmpiW (lpString1=".pdf", lpString2=".etl") returned 1 [0202.772] lstrlenW (lpString=".xls") returned 4 [0202.772] lstrcmpiW (lpString1=".xls", lpString2=".etl") returned 1 [0202.772] lstrlenW (lpString=".xlsx") returned 5 [0202.772] lstrcmpiW (lpString1=".xlsx", lpString2="e.etl") returned -1 [0202.772] lstrlenW (lpString=".ppt") returned 4 [0202.772] lstrcmpiW (lpString1=".ppt", lpString2=".etl") returned 1 [0202.772] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.772] lstrlenW (lpString=".zip") returned 4 [0202.772] lstrcmpiW (lpString1=".zip", lpString2=".etl") returned 1 [0202.772] lstrlenW (lpString=".rar") returned 4 [0202.772] lstrcmpiW (lpString1=".rar", lpString2=".etl") returned 1 [0202.773] lstrlenW (lpString=".bz2") returned 4 [0202.773] lstrcmpiW (lpString1=".bz2", lpString2=".etl") returned -1 [0202.773] lstrlenW (lpString=".7z") returned 3 [0202.773] lstrcmpiW (lpString1=".7z", lpString2="etl") returned -1 [0202.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.773] lstrlenW (lpString=".dbf") returned 4 [0202.773] lstrcmpiW (lpString1=".dbf", lpString2=".etl") returned -1 [0202.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.773] lstrlenW (lpString=".1cd") returned 4 [0202.773] lstrcmpiW (lpString1=".1cd", lpString2=".etl") returned -1 [0202.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.773] lstrlenW (lpString=".jpg") returned 4 [0202.773] lstrcmpiW (lpString1=".jpg", lpString2=".etl") returned 1 [0202.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.773] lstrlenW (lpString=".doc") returned 4 [0202.773] lstrcmpiW (lpString1=".doc", lpString2=".etl") returned -1 [0202.773] lstrlenW (lpString=".docx") returned 5 [0202.773] lstrcmpiW (lpString1=".docx", lpString2="e.etl") returned -1 [0202.773] lstrlenW (lpString=".pdf") returned 4 [0202.773] lstrcmpiW (lpString1=".pdf", lpString2=".etl") returned 1 [0202.773] lstrlenW (lpString=".xls") returned 4 [0202.773] lstrcmpiW (lpString1=".xls", lpString2=".etl") returned 1 [0202.773] lstrlenW (lpString=".xlsx") returned 5 [0202.773] lstrcmpiW (lpString1=".xlsx", lpString2="e.etl") returned -1 [0202.773] lstrlenW (lpString=".ppt") returned 4 [0202.773] lstrcmpiW (lpString1=".ppt", lpString2=".etl") returned 1 [0202.773] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.773] lstrlenW (lpString=".zip") returned 4 [0202.773] lstrcmpiW (lpString1=".zip", lpString2=".etl") returned 1 [0202.773] lstrlenW (lpString=".rar") returned 4 [0202.773] lstrcmpiW (lpString1=".rar", lpString2=".etl") returned 1 [0202.773] lstrlenW (lpString=".bz2") returned 4 [0202.773] lstrcmpiW (lpString1=".bz2", lpString2=".etl") returned -1 [0202.774] lstrlenW (lpString=".7z") returned 3 [0202.774] lstrcmpiW (lpString1=".7z", lpString2="etl") returned -1 [0202.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.774] lstrlenW (lpString=".dbf") returned 4 [0202.774] lstrcmpiW (lpString1=".dbf", lpString2=".etl") returned -1 [0202.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.774] lstrlenW (lpString=".1cd") returned 4 [0202.774] lstrcmpiW (lpString1=".1cd", lpString2=".etl") returned -1 [0202.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Explorer\\ExplorerStartupLog_RunOnce.etl") returned 101 [0202.774] lstrlenW (lpString=".jpg") returned 4 [0202.774] lstrcmpiW (lpString1=".jpg", lpString2=".etl") returned 1 [0202.774] lstrcmpiW (lpString1=".IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]", lpString2=".wiki") returned -1 [0202.774] lstrlenW (lpString="28-8f3193-f30905ea[1]") returned 21 [0202.774] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.990] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=236865) returned 1 [0202.998] CloseHandle (hObject=0x358) returned 1 [0202.998] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1]")) returned 0x2020 [0202.998] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.009] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.009] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.009] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.014] GetLastError () returned 0x0 [0203.014] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x39d41, lpOverlapped=0x0) returned 1 [0203.031] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x39d50, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x39d50, lpOverlapped=0x0) returned 1 [0203.035] ReadFile (in: hFile=0x358, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.035] WriteFile (in: hFile=0x2d4, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0203.035] SetEndOfFile (hFile=0x2d4) returned 1 [0203.035] CloseHandle (hObject=0x2d4) returned 1 [0203.035] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.035] SetEndOfFile (hFile=0x358) returned 1 [0203.037] CloseHandle (hObject=0x358) returned 1 [0203.037] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.038] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\28-8f3193-f30905ea[1]")) returned 1 [0203.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.038] lstrlenW (lpString=".doc") returned 4 [0203.038] lstrcmpiW (lpString1=".doc", lpString2="a[1]") returned -1 [0203.038] lstrlenW (lpString=".docx") returned 5 [0203.038] lstrcmpiW (lpString1=".docx", lpString2="ea[1]") returned -1 [0203.038] lstrlenW (lpString=".pdf") returned 4 [0203.038] lstrcmpiW (lpString1=".pdf", lpString2="a[1]") returned -1 [0203.038] lstrlenW (lpString=".xls") returned 4 [0203.038] lstrcmpiW (lpString1=".xls", lpString2="a[1]") returned -1 [0203.038] lstrlenW (lpString=".xlsx") returned 5 [0203.038] lstrcmpiW (lpString1=".xlsx", lpString2="ea[1]") returned -1 [0203.038] lstrlenW (lpString=".ppt") returned 4 [0203.038] lstrcmpiW (lpString1=".ppt", lpString2="a[1]") returned -1 [0203.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.038] lstrlenW (lpString=".zip") returned 4 [0203.038] lstrcmpiW (lpString1=".zip", lpString2="a[1]") returned -1 [0203.038] lstrlenW (lpString=".rar") returned 4 [0203.038] lstrcmpiW (lpString1=".rar", lpString2="a[1]") returned -1 [0203.038] lstrlenW (lpString=".bz2") returned 4 [0203.038] lstrcmpiW (lpString1=".bz2", lpString2="a[1]") returned -1 [0203.038] lstrlenW (lpString=".7z") returned 3 [0203.038] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.038] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.038] lstrlenW (lpString=".dbf") returned 4 [0203.038] lstrcmpiW (lpString1=".dbf", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.039] lstrlenW (lpString=".1cd") returned 4 [0203.039] lstrcmpiW (lpString1=".1cd", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.039] lstrlenW (lpString=".jpg") returned 4 [0203.039] lstrcmpiW (lpString1=".jpg", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.039] lstrlenW (lpString=".doc") returned 4 [0203.039] lstrcmpiW (lpString1=".doc", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString=".docx") returned 5 [0203.039] lstrcmpiW (lpString1=".docx", lpString2="ea[1]") returned -1 [0203.039] lstrlenW (lpString=".pdf") returned 4 [0203.039] lstrcmpiW (lpString1=".pdf", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString=".xls") returned 4 [0203.039] lstrcmpiW (lpString1=".xls", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString=".xlsx") returned 5 [0203.039] lstrcmpiW (lpString1=".xlsx", lpString2="ea[1]") returned -1 [0203.039] lstrlenW (lpString=".ppt") returned 4 [0203.039] lstrcmpiW (lpString1=".ppt", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.039] lstrlenW (lpString=".zip") returned 4 [0203.039] lstrcmpiW (lpString1=".zip", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString=".rar") returned 4 [0203.039] lstrcmpiW (lpString1=".rar", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString=".bz2") returned 4 [0203.039] lstrcmpiW (lpString1=".bz2", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString=".7z") returned 3 [0203.039] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.039] lstrlenW (lpString=".dbf") returned 4 [0203.039] lstrcmpiW (lpString1=".dbf", lpString2="a[1]") returned -1 [0203.039] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.039] lstrlenW (lpString=".1cd") returned 4 [0203.040] lstrcmpiW (lpString1=".1cd", lpString2="a[1]") returned -1 [0203.040] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\28-8f3193-f30905ea[1]") returned 133 [0203.040] lstrlenW (lpString=".jpg") returned 4 [0203.040] lstrcmpiW (lpString1=".jpg", lpString2="a[1]") returned -1 [0203.040] lstrcmpiW (lpString1=".loaded_1", lpString2=".wiki") returned -1 [0203.040] lstrlenW (lpString="cb=gapi[1].loaded_1") returned 19 [0203.040] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.041] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=81727) returned 1 [0203.041] CloseHandle (hObject=0x344) returned 1 [0203.041] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1")) returned 0x2020 [0203.041] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.041] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.041] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.041] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.042] GetLastError () returned 0x0 [0203.042] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x13f3f, lpOverlapped=0x0) returned 1 [0203.045] WriteFile (in: hFile=0x358, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x13f40, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x13f40, lpOverlapped=0x0) returned 1 [0203.047] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.047] WriteFile (in: hFile=0x358, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0203.047] SetEndOfFile (hFile=0x358) returned 1 [0203.047] CloseHandle (hObject=0x358) returned 1 [0203.047] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.047] SetEndOfFile (hFile=0x344) returned 1 [0203.048] CloseHandle (hObject=0x344) returned 1 [0203.048] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.048] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cb=gapi[1].loaded_1")) returned 1 [0203.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.049] lstrlenW (lpString=".doc") returned 4 [0203.049] lstrcmpiW (lpString1=".doc", lpString2="ed_1") returned -1 [0203.049] lstrlenW (lpString=".docx") returned 5 [0203.049] lstrcmpiW (lpString1=".docx", lpString2="ded_1") returned -1 [0203.049] lstrlenW (lpString=".pdf") returned 4 [0203.049] lstrcmpiW (lpString1=".pdf", lpString2="ed_1") returned -1 [0203.049] lstrlenW (lpString=".xls") returned 4 [0203.049] lstrcmpiW (lpString1=".xls", lpString2="ed_1") returned -1 [0203.049] lstrlenW (lpString=".xlsx") returned 5 [0203.049] lstrcmpiW (lpString1=".xlsx", lpString2="ded_1") returned -1 [0203.049] lstrlenW (lpString=".ppt") returned 4 [0203.049] lstrcmpiW (lpString1=".ppt", lpString2="ed_1") returned -1 [0203.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.049] lstrlenW (lpString=".zip") returned 4 [0203.049] lstrcmpiW (lpString1=".zip", lpString2="ed_1") returned -1 [0203.049] lstrlenW (lpString=".rar") returned 4 [0203.049] lstrcmpiW (lpString1=".rar", lpString2="ed_1") returned -1 [0203.049] lstrlenW (lpString=".bz2") returned 4 [0203.049] lstrcmpiW (lpString1=".bz2", lpString2="ed_1") returned -1 [0203.049] lstrlenW (lpString=".7z") returned 3 [0203.049] lstrcmpiW (lpString1=".7z", lpString2="d_1") returned -1 [0203.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.049] lstrlenW (lpString=".dbf") returned 4 [0203.049] lstrcmpiW (lpString1=".dbf", lpString2="ed_1") returned -1 [0203.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.049] lstrlenW (lpString=".1cd") returned 4 [0203.049] lstrcmpiW (lpString1=".1cd", lpString2="ed_1") returned -1 [0203.049] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.049] lstrlenW (lpString=".jpg") returned 4 [0203.050] lstrcmpiW (lpString1=".jpg", lpString2="ed_1") returned -1 [0203.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.050] lstrlenW (lpString=".doc") returned 4 [0203.050] lstrcmpiW (lpString1=".doc", lpString2="ed_1") returned -1 [0203.050] lstrlenW (lpString=".docx") returned 5 [0203.050] lstrcmpiW (lpString1=".docx", lpString2="ded_1") returned -1 [0203.050] lstrlenW (lpString=".pdf") returned 4 [0203.050] lstrcmpiW (lpString1=".pdf", lpString2="ed_1") returned -1 [0203.050] lstrlenW (lpString=".xls") returned 4 [0203.050] lstrcmpiW (lpString1=".xls", lpString2="ed_1") returned -1 [0203.050] lstrlenW (lpString=".xlsx") returned 5 [0203.050] lstrcmpiW (lpString1=".xlsx", lpString2="ded_1") returned -1 [0203.050] lstrlenW (lpString=".ppt") returned 4 [0203.050] lstrcmpiW (lpString1=".ppt", lpString2="ed_1") returned -1 [0203.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.050] lstrlenW (lpString=".zip") returned 4 [0203.050] lstrcmpiW (lpString1=".zip", lpString2="ed_1") returned -1 [0203.050] lstrlenW (lpString=".rar") returned 4 [0203.050] lstrcmpiW (lpString1=".rar", lpString2="ed_1") returned -1 [0203.050] lstrlenW (lpString=".bz2") returned 4 [0203.050] lstrcmpiW (lpString1=".bz2", lpString2="ed_1") returned -1 [0203.050] lstrlenW (lpString=".7z") returned 3 [0203.050] lstrcmpiW (lpString1=".7z", lpString2="d_1") returned -1 [0203.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.050] lstrlenW (lpString=".dbf") returned 4 [0203.050] lstrcmpiW (lpString1=".dbf", lpString2="ed_1") returned -1 [0203.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.050] lstrlenW (lpString=".1cd") returned 4 [0203.050] lstrcmpiW (lpString1=".1cd", lpString2="ed_1") returned -1 [0203.050] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cb=gapi[1].loaded_1") returned 131 [0203.050] lstrlenW (lpString=".jpg") returned 4 [0203.051] lstrcmpiW (lpString1=".jpg", lpString2="ed_1") returned -1 [0203.051] lstrcmpiW (lpString1=".eot", lpString2=".wiki") returned -1 [0203.051] lstrlenW (lpString="cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 50 [0203.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.052] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=18233) returned 1 [0203.052] CloseHandle (hObject=0x344) returned 1 [0203.052] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot")) returned 0x2020 [0203.052] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.052] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.052] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.052] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.053] GetLastError () returned 0x0 [0203.053] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x4739, lpOverlapped=0x0) returned 1 [0203.100] WriteFile (in: hFile=0x358, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x4740, lpOverlapped=0x0) returned 1 [0203.102] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.102] WriteFile (in: hFile=0x358, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x138, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x138, lpOverlapped=0x0) returned 1 [0203.102] SetEndOfFile (hFile=0x358) returned 1 [0203.104] CloseHandle (hObject=0x358) returned 1 [0203.105] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.105] SetEndOfFile (hFile=0x344) returned 1 [0203.108] CloseHandle (hObject=0x344) returned 1 [0203.110] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.113] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\cjzkeoubrn4kerxqtauh3fy6323mhuzfjmgtvxag2ie[1].eot")) returned 1 [0203.113] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.113] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.113] lstrlenW (lpString=".doc") returned 4 [0203.113] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.113] lstrlenW (lpString=".docx") returned 5 [0203.113] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.113] lstrlenW (lpString=".pdf") returned 4 [0203.113] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.113] lstrlenW (lpString=".xls") returned 4 [0203.113] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.121] lstrlenW (lpString=".xlsx") returned 5 [0203.121] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.124] lstrlenW (lpString=".ppt") returned 4 [0203.124] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.124] lstrlenW (lpString=".zip") returned 4 [0203.130] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.130] lstrlenW (lpString=".rar") returned 4 [0203.130] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.132] lstrlenW (lpString=".bz2") returned 4 [0203.133] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.133] lstrlenW (lpString=".7z") returned 3 [0203.133] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.133] lstrlenW (lpString=".dbf") returned 4 [0203.133] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.133] lstrlenW (lpString=".1cd") returned 4 [0203.133] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.133] lstrlenW (lpString=".jpg") returned 4 [0203.133] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.133] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.133] lstrlenW (lpString=".doc") returned 4 [0203.145] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.148] lstrlenW (lpString=".docx") returned 5 [0203.148] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.148] lstrlenW (lpString=".pdf") returned 4 [0203.148] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.148] lstrlenW (lpString=".xls") returned 4 [0203.148] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.148] lstrlenW (lpString=".xlsx") returned 5 [0203.148] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.154] lstrlenW (lpString=".ppt") returned 4 [0203.154] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.155] lstrlenW (lpString=".zip") returned 4 [0203.155] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.155] lstrlenW (lpString=".rar") returned 4 [0203.155] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.155] lstrlenW (lpString=".bz2") returned 4 [0203.155] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.155] lstrlenW (lpString=".7z") returned 3 [0203.155] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.155] lstrlenW (lpString=".dbf") returned 4 [0203.155] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.155] lstrlenW (lpString=".1cd") returned 4 [0203.155] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\cJZKeOuBrn4kERxqtaUH3fY6323mHUZFJMgTvxaG2iE[1].eot") returned 162 [0203.155] lstrlenW (lpString=".jpg") returned 4 [0203.155] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.156] lstrcmpiW (lpString1=".IE5\\ABV8L7MY\\Standard[1]", lpString2=".wiki") returned -1 [0203.156] lstrlenW (lpString="Standard[1]") returned 11 [0203.156] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\standard[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.239] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=87081) returned 1 [0203.239] CloseHandle (hObject=0x344) returned 1 [0203.239] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\standard[1]")) returned 0x2020 [0203.239] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\standard[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\standard[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.239] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.239] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.239] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\standard[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.240] GetLastError () returned 0x0 [0203.240] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x15429, lpOverlapped=0x0) returned 1 [0203.243] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x15430, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x15430, lpOverlapped=0x0) returned 1 [0203.245] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.245] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1 [0203.245] SetEndOfFile (hFile=0x354) returned 1 [0203.245] CloseHandle (hObject=0x354) returned 1 [0203.245] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.245] SetEndOfFile (hFile=0x344) returned 1 [0203.247] CloseHandle (hObject=0x344) returned 1 [0203.247] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.247] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\standard[1]")) returned 1 [0203.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.247] lstrlenW (lpString=".doc") returned 4 [0203.247] lstrcmpiW (lpString1=".doc", lpString2="d[1]") returned -1 [0203.247] lstrlenW (lpString=".docx") returned 5 [0203.247] lstrcmpiW (lpString1=".docx", lpString2="rd[1]") returned -1 [0203.247] lstrlenW (lpString=".pdf") returned 4 [0203.247] lstrcmpiW (lpString1=".pdf", lpString2="d[1]") returned -1 [0203.247] lstrlenW (lpString=".xls") returned 4 [0203.247] lstrcmpiW (lpString1=".xls", lpString2="d[1]") returned -1 [0203.247] lstrlenW (lpString=".xlsx") returned 5 [0203.247] lstrcmpiW (lpString1=".xlsx", lpString2="rd[1]") returned -1 [0203.247] lstrlenW (lpString=".ppt") returned 4 [0203.247] lstrcmpiW (lpString1=".ppt", lpString2="d[1]") returned -1 [0203.247] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.247] lstrlenW (lpString=".zip") returned 4 [0203.247] lstrcmpiW (lpString1=".zip", lpString2="d[1]") returned -1 [0203.247] lstrlenW (lpString=".rar") returned 4 [0203.247] lstrcmpiW (lpString1=".rar", lpString2="d[1]") returned -1 [0203.247] lstrlenW (lpString=".bz2") returned 4 [0203.248] lstrcmpiW (lpString1=".bz2", lpString2="d[1]") returned -1 [0203.248] lstrlenW (lpString=".7z") returned 3 [0203.248] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.248] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.248] lstrlenW (lpString=".dbf") returned 4 [0203.248] lstrcmpiW (lpString1=".dbf", lpString2="d[1]") returned -1 [0203.248] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.248] lstrlenW (lpString=".1cd") returned 4 [0203.248] lstrcmpiW (lpString1=".1cd", lpString2="d[1]") returned -1 [0203.248] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.248] lstrlenW (lpString=".jpg") returned 4 [0203.248] lstrcmpiW (lpString1=".jpg", lpString2="d[1]") returned -1 [0203.248] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.248] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.248] lstrlenW (lpString=".doc") returned 4 [0203.248] lstrcmpiW (lpString1=".doc", lpString2="d[1]") returned -1 [0203.248] lstrlenW (lpString=".docx") returned 5 [0203.248] lstrcmpiW (lpString1=".docx", lpString2="rd[1]") returned -1 [0203.248] lstrlenW (lpString=".pdf") returned 4 [0203.248] lstrcmpiW (lpString1=".pdf", lpString2="d[1]") returned -1 [0203.248] lstrlenW (lpString=".xls") returned 4 [0203.248] lstrcmpiW (lpString1=".xls", lpString2="d[1]") returned -1 [0203.248] lstrlenW (lpString=".xlsx") returned 5 [0203.248] lstrcmpiW (lpString1=".xlsx", lpString2="rd[1]") returned -1 [0203.248] lstrlenW (lpString=".ppt") returned 4 [0203.248] lstrcmpiW (lpString1=".ppt", lpString2="d[1]") returned -1 [0203.248] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.248] lstrlenW (lpString=".zip") returned 4 [0203.248] lstrcmpiW (lpString1=".zip", lpString2="d[1]") returned -1 [0203.248] lstrlenW (lpString=".rar") returned 4 [0203.248] lstrcmpiW (lpString1=".rar", lpString2="d[1]") returned -1 [0203.248] lstrlenW (lpString=".bz2") returned 4 [0203.248] lstrcmpiW (lpString1=".bz2", lpString2="d[1]") returned -1 [0203.249] lstrlenW (lpString=".7z") returned 3 [0203.249] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.249] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.249] lstrlenW (lpString=".dbf") returned 4 [0203.249] lstrcmpiW (lpString1=".dbf", lpString2="d[1]") returned -1 [0203.249] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.249] lstrlenW (lpString=".1cd") returned 4 [0203.249] lstrcmpiW (lpString1=".1cd", lpString2="d[1]") returned -1 [0203.249] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\Standard[1]") returned 123 [0203.249] lstrlenW (lpString=".jpg") returned 4 [0203.249] lstrcmpiW (lpString1=".jpg", lpString2="d[1]") returned -1 [0203.249] lstrcmpiW (lpString1=".IE5\\ABV8L7MY\\v2[1]", lpString2=".wiki") returned -1 [0203.249] lstrlenW (lpString="v2[1]") returned 5 [0203.249] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.250] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=11733) returned 1 [0203.250] CloseHandle (hObject=0x344) returned 1 [0203.250] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[1]")) returned 0x2020 [0203.251] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.251] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.251] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.251] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.251] GetLastError () returned 0x0 [0203.251] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x2dd5, lpOverlapped=0x0) returned 1 [0203.253] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x2de0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x2de0, lpOverlapped=0x0) returned 1 [0203.254] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.254] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xde, lpOverlapped=0x0) returned 1 [0203.254] SetEndOfFile (hFile=0x354) returned 1 [0203.255] CloseHandle (hObject=0x354) returned 1 [0203.255] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.255] SetEndOfFile (hFile=0x344) returned 1 [0203.255] CloseHandle (hObject=0x344) returned 1 [0203.255] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.256] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[1]")) returned 1 [0203.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.256] lstrlenW (lpString=".doc") returned 4 [0203.256] lstrcmpiW (lpString1=".doc", lpString2="2[1]") returned -1 [0203.256] lstrlenW (lpString=".docx") returned 5 [0203.256] lstrcmpiW (lpString1=".docx", lpString2="v2[1]") returned -1 [0203.256] lstrlenW (lpString=".pdf") returned 4 [0203.256] lstrcmpiW (lpString1=".pdf", lpString2="2[1]") returned -1 [0203.256] lstrlenW (lpString=".xls") returned 4 [0203.256] lstrcmpiW (lpString1=".xls", lpString2="2[1]") returned -1 [0203.256] lstrlenW (lpString=".xlsx") returned 5 [0203.256] lstrcmpiW (lpString1=".xlsx", lpString2="v2[1]") returned -1 [0203.256] lstrlenW (lpString=".ppt") returned 4 [0203.256] lstrcmpiW (lpString1=".ppt", lpString2="2[1]") returned -1 [0203.256] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.256] lstrlenW (lpString=".zip") returned 4 [0203.256] lstrcmpiW (lpString1=".zip", lpString2="2[1]") returned -1 [0203.256] lstrlenW (lpString=".rar") returned 4 [0203.256] lstrcmpiW (lpString1=".rar", lpString2="2[1]") returned -1 [0203.256] lstrlenW (lpString=".bz2") returned 4 [0203.256] lstrcmpiW (lpString1=".bz2", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString=".7z") returned 3 [0203.257] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.257] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.257] lstrlenW (lpString=".dbf") returned 4 [0203.257] lstrcmpiW (lpString1=".dbf", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.257] lstrlenW (lpString=".1cd") returned 4 [0203.257] lstrcmpiW (lpString1=".1cd", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.257] lstrlenW (lpString=".jpg") returned 4 [0203.257] lstrcmpiW (lpString1=".jpg", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.257] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.257] lstrlenW (lpString=".doc") returned 4 [0203.257] lstrcmpiW (lpString1=".doc", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString=".docx") returned 5 [0203.257] lstrcmpiW (lpString1=".docx", lpString2="v2[1]") returned -1 [0203.257] lstrlenW (lpString=".pdf") returned 4 [0203.257] lstrcmpiW (lpString1=".pdf", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString=".xls") returned 4 [0203.257] lstrcmpiW (lpString1=".xls", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString=".xlsx") returned 5 [0203.257] lstrcmpiW (lpString1=".xlsx", lpString2="v2[1]") returned -1 [0203.257] lstrlenW (lpString=".ppt") returned 4 [0203.257] lstrcmpiW (lpString1=".ppt", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.257] lstrlenW (lpString=".zip") returned 4 [0203.257] lstrcmpiW (lpString1=".zip", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString=".rar") returned 4 [0203.257] lstrcmpiW (lpString1=".rar", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString=".bz2") returned 4 [0203.257] lstrcmpiW (lpString1=".bz2", lpString2="2[1]") returned -1 [0203.257] lstrlenW (lpString=".7z") returned 3 [0203.257] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.258] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.258] lstrlenW (lpString=".dbf") returned 4 [0203.258] lstrcmpiW (lpString1=".dbf", lpString2="2[1]") returned -1 [0203.258] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.258] lstrlenW (lpString=".1cd") returned 4 [0203.258] lstrcmpiW (lpString1=".1cd", lpString2="2[1]") returned -1 [0203.258] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[1]") returned 117 [0203.258] lstrlenW (lpString=".jpg") returned 4 [0203.258] lstrcmpiW (lpString1=".jpg", lpString2="2[1]") returned -1 [0203.258] lstrcmpiW (lpString1=".IE5\\ABV8L7MY\\v2[2]", lpString2=".wiki") returned -1 [0203.258] lstrlenW (lpString="v2[2]") returned 5 [0203.258] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[2]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.258] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=11561) returned 1 [0203.259] CloseHandle (hObject=0x344) returned 1 [0203.259] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[2]")) returned 0x2020 [0203.259] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[2].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[2]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.259] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.259] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.259] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[2].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.259] GetLastError () returned 0x0 [0203.259] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x2d29, lpOverlapped=0x0) returned 1 [0203.261] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x2d30, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x2d30, lpOverlapped=0x0) returned 1 [0203.262] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.262] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xde, lpOverlapped=0x0) returned 1 [0203.262] SetEndOfFile (hFile=0x354) returned 1 [0203.263] CloseHandle (hObject=0x354) returned 1 [0203.263] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.263] SetEndOfFile (hFile=0x344) returned 1 [0203.263] CloseHandle (hObject=0x344) returned 1 [0203.263] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.264] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[2]")) returned 1 [0203.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.264] lstrlenW (lpString=".doc") returned 4 [0203.264] lstrcmpiW (lpString1=".doc", lpString2="2[2]") returned -1 [0203.264] lstrlenW (lpString=".docx") returned 5 [0203.264] lstrcmpiW (lpString1=".docx", lpString2="v2[2]") returned -1 [0203.264] lstrlenW (lpString=".pdf") returned 4 [0203.264] lstrcmpiW (lpString1=".pdf", lpString2="2[2]") returned -1 [0203.264] lstrlenW (lpString=".xls") returned 4 [0203.264] lstrcmpiW (lpString1=".xls", lpString2="2[2]") returned -1 [0203.264] lstrlenW (lpString=".xlsx") returned 5 [0203.264] lstrcmpiW (lpString1=".xlsx", lpString2="v2[2]") returned -1 [0203.264] lstrlenW (lpString=".ppt") returned 4 [0203.264] lstrcmpiW (lpString1=".ppt", lpString2="2[2]") returned -1 [0203.264] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.264] lstrlenW (lpString=".zip") returned 4 [0203.264] lstrcmpiW (lpString1=".zip", lpString2="2[2]") returned -1 [0203.264] lstrlenW (lpString=".rar") returned 4 [0203.264] lstrcmpiW (lpString1=".rar", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString=".bz2") returned 4 [0203.265] lstrcmpiW (lpString1=".bz2", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString=".7z") returned 3 [0203.265] lstrcmpiW (lpString1=".7z", lpString2="[2]") returned -1 [0203.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.265] lstrlenW (lpString=".dbf") returned 4 [0203.265] lstrcmpiW (lpString1=".dbf", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.265] lstrlenW (lpString=".1cd") returned 4 [0203.265] lstrcmpiW (lpString1=".1cd", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.265] lstrlenW (lpString=".jpg") returned 4 [0203.265] lstrcmpiW (lpString1=".jpg", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.265] lstrlenW (lpString=".doc") returned 4 [0203.265] lstrcmpiW (lpString1=".doc", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString=".docx") returned 5 [0203.265] lstrcmpiW (lpString1=".docx", lpString2="v2[2]") returned -1 [0203.265] lstrlenW (lpString=".pdf") returned 4 [0203.265] lstrcmpiW (lpString1=".pdf", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString=".xls") returned 4 [0203.265] lstrcmpiW (lpString1=".xls", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString=".xlsx") returned 5 [0203.265] lstrcmpiW (lpString1=".xlsx", lpString2="v2[2]") returned -1 [0203.265] lstrlenW (lpString=".ppt") returned 4 [0203.265] lstrcmpiW (lpString1=".ppt", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.265] lstrlenW (lpString=".zip") returned 4 [0203.265] lstrcmpiW (lpString1=".zip", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString=".rar") returned 4 [0203.265] lstrcmpiW (lpString1=".rar", lpString2="2[2]") returned -1 [0203.265] lstrlenW (lpString=".bz2") returned 4 [0203.265] lstrcmpiW (lpString1=".bz2", lpString2="2[2]") returned -1 [0203.266] lstrlenW (lpString=".7z") returned 3 [0203.266] lstrcmpiW (lpString1=".7z", lpString2="[2]") returned -1 [0203.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.266] lstrlenW (lpString=".dbf") returned 4 [0203.266] lstrcmpiW (lpString1=".dbf", lpString2="2[2]") returned -1 [0203.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.266] lstrlenW (lpString=".1cd") returned 4 [0203.266] lstrcmpiW (lpString1=".1cd", lpString2="2[2]") returned -1 [0203.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[2]") returned 117 [0203.266] lstrlenW (lpString=".jpg") returned 4 [0203.266] lstrcmpiW (lpString1=".jpg", lpString2="2[2]") returned -1 [0203.266] lstrcmpiW (lpString1=".IE5\\ABV8L7MY\\v2[3]", lpString2=".wiki") returned -1 [0203.266] lstrlenW (lpString="v2[3]") returned 5 [0203.266] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[3]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.269] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=12200) returned 1 [0203.269] CloseHandle (hObject=0x344) returned 1 [0203.269] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[3]")) returned 0x2020 [0203.270] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[3].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[3]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.270] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.270] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.270] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[3].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.270] GetLastError () returned 0x0 [0203.270] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x2fa8, lpOverlapped=0x0) returned 1 [0203.272] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x2fb0, lpOverlapped=0x0) returned 1 [0203.273] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.273] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xde, lpOverlapped=0x0) returned 1 [0203.273] SetEndOfFile (hFile=0x354) returned 1 [0203.273] CloseHandle (hObject=0x354) returned 1 [0203.273] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.273] SetEndOfFile (hFile=0x344) returned 1 [0203.274] CloseHandle (hObject=0x344) returned 1 [0203.274] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.274] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[3]")) returned 1 [0203.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.275] lstrlenW (lpString=".doc") returned 4 [0203.275] lstrcmpiW (lpString1=".doc", lpString2="2[3]") returned -1 [0203.275] lstrlenW (lpString=".docx") returned 5 [0203.275] lstrcmpiW (lpString1=".docx", lpString2="v2[3]") returned -1 [0203.275] lstrlenW (lpString=".pdf") returned 4 [0203.275] lstrcmpiW (lpString1=".pdf", lpString2="2[3]") returned -1 [0203.275] lstrlenW (lpString=".xls") returned 4 [0203.275] lstrcmpiW (lpString1=".xls", lpString2="2[3]") returned -1 [0203.275] lstrlenW (lpString=".xlsx") returned 5 [0203.275] lstrcmpiW (lpString1=".xlsx", lpString2="v2[3]") returned -1 [0203.275] lstrlenW (lpString=".ppt") returned 4 [0203.275] lstrcmpiW (lpString1=".ppt", lpString2="2[3]") returned -1 [0203.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.275] lstrlenW (lpString=".zip") returned 4 [0203.275] lstrcmpiW (lpString1=".zip", lpString2="2[3]") returned -1 [0203.275] lstrlenW (lpString=".rar") returned 4 [0203.275] lstrcmpiW (lpString1=".rar", lpString2="2[3]") returned -1 [0203.275] lstrlenW (lpString=".bz2") returned 4 [0203.275] lstrcmpiW (lpString1=".bz2", lpString2="2[3]") returned -1 [0203.275] lstrlenW (lpString=".7z") returned 3 [0203.275] lstrcmpiW (lpString1=".7z", lpString2="[3]") returned -1 [0203.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.275] lstrlenW (lpString=".dbf") returned 4 [0203.275] lstrcmpiW (lpString1=".dbf", lpString2="2[3]") returned -1 [0203.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.275] lstrlenW (lpString=".1cd") returned 4 [0203.275] lstrcmpiW (lpString1=".1cd", lpString2="2[3]") returned -1 [0203.275] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.275] lstrlenW (lpString=".jpg") returned 4 [0203.275] lstrcmpiW (lpString1=".jpg", lpString2="2[3]") returned -1 [0203.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.276] lstrlenW (lpString=".doc") returned 4 [0203.276] lstrcmpiW (lpString1=".doc", lpString2="2[3]") returned -1 [0203.276] lstrlenW (lpString=".docx") returned 5 [0203.276] lstrcmpiW (lpString1=".docx", lpString2="v2[3]") returned -1 [0203.276] lstrlenW (lpString=".pdf") returned 4 [0203.276] lstrcmpiW (lpString1=".pdf", lpString2="2[3]") returned -1 [0203.276] lstrlenW (lpString=".xls") returned 4 [0203.276] lstrcmpiW (lpString1=".xls", lpString2="2[3]") returned -1 [0203.276] lstrlenW (lpString=".xlsx") returned 5 [0203.276] lstrcmpiW (lpString1=".xlsx", lpString2="v2[3]") returned -1 [0203.276] lstrlenW (lpString=".ppt") returned 4 [0203.276] lstrcmpiW (lpString1=".ppt", lpString2="2[3]") returned -1 [0203.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.276] lstrlenW (lpString=".zip") returned 4 [0203.276] lstrcmpiW (lpString1=".zip", lpString2="2[3]") returned -1 [0203.276] lstrlenW (lpString=".rar") returned 4 [0203.276] lstrcmpiW (lpString1=".rar", lpString2="2[3]") returned -1 [0203.276] lstrlenW (lpString=".bz2") returned 4 [0203.276] lstrcmpiW (lpString1=".bz2", lpString2="2[3]") returned -1 [0203.276] lstrlenW (lpString=".7z") returned 3 [0203.276] lstrcmpiW (lpString1=".7z", lpString2="[3]") returned -1 [0203.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.276] lstrlenW (lpString=".dbf") returned 4 [0203.276] lstrcmpiW (lpString1=".dbf", lpString2="2[3]") returned -1 [0203.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.276] lstrlenW (lpString=".1cd") returned 4 [0203.276] lstrcmpiW (lpString1=".1cd", lpString2="2[3]") returned -1 [0203.276] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[3]") returned 117 [0203.276] lstrlenW (lpString=".jpg") returned 4 [0203.276] lstrcmpiW (lpString1=".jpg", lpString2="2[3]") returned -1 [0203.277] lstrcmpiW (lpString1=".IE5\\ABV8L7MY\\v2[4]", lpString2=".wiki") returned -1 [0203.277] lstrlenW (lpString="v2[4]") returned 5 [0203.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[4]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.277] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=11689) returned 1 [0203.277] CloseHandle (hObject=0x344) returned 1 [0203.277] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[4]")) returned 0x2020 [0203.277] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[4].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.277] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[4]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.277] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.277] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.278] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[4].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.278] GetLastError () returned 0x0 [0203.278] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x2da9, lpOverlapped=0x0) returned 1 [0203.287] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x2db0, lpOverlapped=0x0) returned 1 [0203.288] ReadFile (in: hFile=0x344, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.288] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xde, lpOverlapped=0x0) returned 1 [0203.288] SetEndOfFile (hFile=0x354) returned 1 [0203.289] CloseHandle (hObject=0x354) returned 1 [0203.289] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.289] SetEndOfFile (hFile=0x344) returned 1 [0203.289] CloseHandle (hObject=0x344) returned 1 [0203.289] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.290] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\v2[4]")) returned 1 [0203.290] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.290] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.290] lstrlenW (lpString=".doc") returned 4 [0203.290] lstrcmpiW (lpString1=".doc", lpString2="2[4]") returned -1 [0203.290] lstrlenW (lpString=".docx") returned 5 [0203.290] lstrcmpiW (lpString1=".docx", lpString2="v2[4]") returned -1 [0203.290] lstrlenW (lpString=".pdf") returned 4 [0203.290] lstrcmpiW (lpString1=".pdf", lpString2="2[4]") returned -1 [0203.290] lstrlenW (lpString=".xls") returned 4 [0203.290] lstrcmpiW (lpString1=".xls", lpString2="2[4]") returned -1 [0203.290] lstrlenW (lpString=".xlsx") returned 5 [0203.290] lstrcmpiW (lpString1=".xlsx", lpString2="v2[4]") returned -1 [0203.290] lstrlenW (lpString=".ppt") returned 4 [0203.290] lstrcmpiW (lpString1=".ppt", lpString2="2[4]") returned -1 [0203.290] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.290] lstrlenW (lpString=".zip") returned 4 [0203.290] lstrcmpiW (lpString1=".zip", lpString2="2[4]") returned -1 [0203.290] lstrlenW (lpString=".rar") returned 4 [0203.290] lstrcmpiW (lpString1=".rar", lpString2="2[4]") returned -1 [0203.290] lstrlenW (lpString=".bz2") returned 4 [0203.290] lstrcmpiW (lpString1=".bz2", lpString2="2[4]") returned -1 [0203.290] lstrlenW (lpString=".7z") returned 3 [0203.290] lstrcmpiW (lpString1=".7z", lpString2="[4]") returned -1 [0203.290] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.291] lstrlenW (lpString=".dbf") returned 4 [0203.291] lstrcmpiW (lpString1=".dbf", lpString2="2[4]") returned -1 [0203.291] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.291] lstrlenW (lpString=".1cd") returned 4 [0203.291] lstrcmpiW (lpString1=".1cd", lpString2="2[4]") returned -1 [0203.291] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.291] lstrlenW (lpString=".jpg") returned 4 [0203.291] lstrcmpiW (lpString1=".jpg", lpString2="2[4]") returned -1 [0203.291] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.291] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.291] lstrlenW (lpString=".doc") returned 4 [0203.291] lstrcmpiW (lpString1=".doc", lpString2="2[4]") returned -1 [0203.291] lstrlenW (lpString=".docx") returned 5 [0203.291] lstrcmpiW (lpString1=".docx", lpString2="v2[4]") returned -1 [0203.291] lstrlenW (lpString=".pdf") returned 4 [0203.291] lstrcmpiW (lpString1=".pdf", lpString2="2[4]") returned -1 [0203.291] lstrlenW (lpString=".xls") returned 4 [0203.291] lstrcmpiW (lpString1=".xls", lpString2="2[4]") returned -1 [0203.291] lstrlenW (lpString=".xlsx") returned 5 [0203.291] lstrcmpiW (lpString1=".xlsx", lpString2="v2[4]") returned -1 [0203.291] lstrlenW (lpString=".ppt") returned 4 [0203.291] lstrcmpiW (lpString1=".ppt", lpString2="2[4]") returned -1 [0203.291] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.291] lstrlenW (lpString=".zip") returned 4 [0203.291] lstrcmpiW (lpString1=".zip", lpString2="2[4]") returned -1 [0203.291] lstrlenW (lpString=".rar") returned 4 [0203.291] lstrcmpiW (lpString1=".rar", lpString2="2[4]") returned -1 [0203.291] lstrlenW (lpString=".bz2") returned 4 [0203.291] lstrcmpiW (lpString1=".bz2", lpString2="2[4]") returned -1 [0203.291] lstrlenW (lpString=".7z") returned 3 [0203.291] lstrcmpiW (lpString1=".7z", lpString2="[4]") returned -1 [0203.291] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.291] lstrlenW (lpString=".dbf") returned 4 [0203.291] lstrcmpiW (lpString1=".dbf", lpString2="2[4]") returned -1 [0203.292] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.292] lstrlenW (lpString=".1cd") returned 4 [0203.292] lstrcmpiW (lpString1=".1cd", lpString2="2[4]") returned -1 [0203.292] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\v2[4]") returned 117 [0203.292] lstrlenW (lpString=".jpg") returned 4 [0203.292] lstrcmpiW (lpString1=".jpg", lpString2="2[4]") returned -1 [0203.292] lstrcmpiW (lpString1=".IE5\\IKQEEPZR\\adfserve[1]", lpString2=".wiki") returned -1 [0203.292] lstrlenW (lpString="adfserve[1]") returned 11 [0203.292] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfserve[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.305] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=3871) returned 1 [0203.305] CloseHandle (hObject=0x154) returned 1 [0203.305] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfserve[1]")) returned 0x2020 [0203.312] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfserve[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfserve[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.313] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.313] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.313] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfserve[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.322] GetLastError () returned 0x0 [0203.322] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0xf1f, lpOverlapped=0x0) returned 1 [0203.328] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xf20, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xf20, lpOverlapped=0x0) returned 1 [0203.329] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.329] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1 [0203.329] SetEndOfFile (hFile=0x2d8) returned 1 [0203.329] CloseHandle (hObject=0x2d8) returned 1 [0203.329] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.329] SetEndOfFile (hFile=0x154) returned 1 [0203.330] CloseHandle (hObject=0x154) returned 1 [0203.330] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.330] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfserve[1]")) returned 1 [0203.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.331] lstrlenW (lpString=".doc") returned 4 [0203.331] lstrcmpiW (lpString1=".doc", lpString2="e[1]") returned -1 [0203.331] lstrlenW (lpString=".docx") returned 5 [0203.331] lstrcmpiW (lpString1=".docx", lpString2="ve[1]") returned -1 [0203.331] lstrlenW (lpString=".pdf") returned 4 [0203.331] lstrcmpiW (lpString1=".pdf", lpString2="e[1]") returned -1 [0203.331] lstrlenW (lpString=".xls") returned 4 [0203.331] lstrcmpiW (lpString1=".xls", lpString2="e[1]") returned -1 [0203.331] lstrlenW (lpString=".xlsx") returned 5 [0203.331] lstrcmpiW (lpString1=".xlsx", lpString2="ve[1]") returned -1 [0203.331] lstrlenW (lpString=".ppt") returned 4 [0203.331] lstrcmpiW (lpString1=".ppt", lpString2="e[1]") returned -1 [0203.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.331] lstrlenW (lpString=".zip") returned 4 [0203.331] lstrcmpiW (lpString1=".zip", lpString2="e[1]") returned -1 [0203.331] lstrlenW (lpString=".rar") returned 4 [0203.331] lstrcmpiW (lpString1=".rar", lpString2="e[1]") returned -1 [0203.331] lstrlenW (lpString=".bz2") returned 4 [0203.331] lstrcmpiW (lpString1=".bz2", lpString2="e[1]") returned -1 [0203.331] lstrlenW (lpString=".7z") returned 3 [0203.331] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.331] lstrlenW (lpString=".dbf") returned 4 [0203.331] lstrcmpiW (lpString1=".dbf", lpString2="e[1]") returned -1 [0203.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.331] lstrlenW (lpString=".1cd") returned 4 [0203.331] lstrcmpiW (lpString1=".1cd", lpString2="e[1]") returned -1 [0203.331] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.332] lstrlenW (lpString=".jpg") returned 4 [0203.332] lstrcmpiW (lpString1=".jpg", lpString2="e[1]") returned -1 [0203.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.332] lstrlenW (lpString=".doc") returned 4 [0203.332] lstrcmpiW (lpString1=".doc", lpString2="e[1]") returned -1 [0203.332] lstrlenW (lpString=".docx") returned 5 [0203.332] lstrcmpiW (lpString1=".docx", lpString2="ve[1]") returned -1 [0203.332] lstrlenW (lpString=".pdf") returned 4 [0203.332] lstrcmpiW (lpString1=".pdf", lpString2="e[1]") returned -1 [0203.332] lstrlenW (lpString=".xls") returned 4 [0203.332] lstrcmpiW (lpString1=".xls", lpString2="e[1]") returned -1 [0203.332] lstrlenW (lpString=".xlsx") returned 5 [0203.332] lstrcmpiW (lpString1=".xlsx", lpString2="ve[1]") returned -1 [0203.332] lstrlenW (lpString=".ppt") returned 4 [0203.332] lstrcmpiW (lpString1=".ppt", lpString2="e[1]") returned -1 [0203.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.332] lstrlenW (lpString=".zip") returned 4 [0203.332] lstrcmpiW (lpString1=".zip", lpString2="e[1]") returned -1 [0203.332] lstrlenW (lpString=".rar") returned 4 [0203.332] lstrcmpiW (lpString1=".rar", lpString2="e[1]") returned -1 [0203.332] lstrlenW (lpString=".bz2") returned 4 [0203.332] lstrcmpiW (lpString1=".bz2", lpString2="e[1]") returned -1 [0203.332] lstrlenW (lpString=".7z") returned 3 [0203.332] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.332] lstrlenW (lpString=".dbf") returned 4 [0203.332] lstrcmpiW (lpString1=".dbf", lpString2="e[1]") returned -1 [0203.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.332] lstrlenW (lpString=".1cd") returned 4 [0203.332] lstrcmpiW (lpString1=".1cd", lpString2="e[1]") returned -1 [0203.332] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfserve[1]") returned 123 [0203.332] lstrlenW (lpString=".jpg") returned 4 [0203.332] lstrcmpiW (lpString1=".jpg", lpString2="e[1]") returned -1 [0203.333] lstrcmpiW (lpString1=".loaded_0", lpString2=".wiki") returned -1 [0203.333] lstrlenW (lpString="cb=gapi[2].loaded_0") returned 19 [0203.333] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.334] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=25918) returned 1 [0203.334] CloseHandle (hObject=0x154) returned 1 [0203.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0")) returned 0x2020 [0203.335] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.335] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.335] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.335] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.335] GetLastError () returned 0x0 [0203.335] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x653e, lpOverlapped=0x0) returned 1 [0203.337] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x6540, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x6540, lpOverlapped=0x0) returned 1 [0203.342] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.342] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0203.342] SetEndOfFile (hFile=0x2d8) returned 1 [0203.342] CloseHandle (hObject=0x2d8) returned 1 [0203.342] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.342] SetEndOfFile (hFile=0x154) returned 1 [0203.343] CloseHandle (hObject=0x154) returned 1 [0203.343] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.343] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[2].loaded_0")) returned 1 [0203.344] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.344] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.344] lstrlenW (lpString=".doc") returned 4 [0203.344] lstrcmpiW (lpString1=".doc", lpString2="ed_0") returned -1 [0203.344] lstrlenW (lpString=".docx") returned 5 [0203.344] lstrcmpiW (lpString1=".docx", lpString2="ded_0") returned -1 [0203.344] lstrlenW (lpString=".pdf") returned 4 [0203.344] lstrcmpiW (lpString1=".pdf", lpString2="ed_0") returned -1 [0203.344] lstrlenW (lpString=".xls") returned 4 [0203.344] lstrcmpiW (lpString1=".xls", lpString2="ed_0") returned -1 [0203.344] lstrlenW (lpString=".xlsx") returned 5 [0203.344] lstrcmpiW (lpString1=".xlsx", lpString2="ded_0") returned -1 [0203.344] lstrlenW (lpString=".ppt") returned 4 [0203.344] lstrcmpiW (lpString1=".ppt", lpString2="ed_0") returned -1 [0203.344] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.344] lstrlenW (lpString=".zip") returned 4 [0203.344] lstrcmpiW (lpString1=".zip", lpString2="ed_0") returned -1 [0203.344] lstrlenW (lpString=".rar") returned 4 [0203.344] lstrcmpiW (lpString1=".rar", lpString2="ed_0") returned -1 [0203.344] lstrlenW (lpString=".bz2") returned 4 [0203.344] lstrcmpiW (lpString1=".bz2", lpString2="ed_0") returned -1 [0203.344] lstrlenW (lpString=".7z") returned 3 [0203.344] lstrcmpiW (lpString1=".7z", lpString2="d_0") returned -1 [0203.344] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.344] lstrlenW (lpString=".dbf") returned 4 [0203.344] lstrcmpiW (lpString1=".dbf", lpString2="ed_0") returned -1 [0203.344] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.344] lstrlenW (lpString=".1cd") returned 4 [0203.344] lstrcmpiW (lpString1=".1cd", lpString2="ed_0") returned -1 [0203.344] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.345] lstrlenW (lpString=".jpg") returned 4 [0203.345] lstrcmpiW (lpString1=".jpg", lpString2="ed_0") returned -1 [0203.345] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.345] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.345] lstrlenW (lpString=".doc") returned 4 [0203.345] lstrcmpiW (lpString1=".doc", lpString2="ed_0") returned -1 [0203.345] lstrlenW (lpString=".docx") returned 5 [0203.345] lstrcmpiW (lpString1=".docx", lpString2="ded_0") returned -1 [0203.345] lstrlenW (lpString=".pdf") returned 4 [0203.345] lstrcmpiW (lpString1=".pdf", lpString2="ed_0") returned -1 [0203.345] lstrlenW (lpString=".xls") returned 4 [0203.345] lstrcmpiW (lpString1=".xls", lpString2="ed_0") returned -1 [0203.345] lstrlenW (lpString=".xlsx") returned 5 [0203.345] lstrcmpiW (lpString1=".xlsx", lpString2="ded_0") returned -1 [0203.345] lstrlenW (lpString=".ppt") returned 4 [0203.345] lstrcmpiW (lpString1=".ppt", lpString2="ed_0") returned -1 [0203.345] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.345] lstrlenW (lpString=".zip") returned 4 [0203.345] lstrcmpiW (lpString1=".zip", lpString2="ed_0") returned -1 [0203.345] lstrlenW (lpString=".rar") returned 4 [0203.345] lstrcmpiW (lpString1=".rar", lpString2="ed_0") returned -1 [0203.345] lstrlenW (lpString=".bz2") returned 4 [0203.345] lstrcmpiW (lpString1=".bz2", lpString2="ed_0") returned -1 [0203.345] lstrlenW (lpString=".7z") returned 3 [0203.345] lstrcmpiW (lpString1=".7z", lpString2="d_0") returned -1 [0203.345] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.345] lstrlenW (lpString=".dbf") returned 4 [0203.345] lstrcmpiW (lpString1=".dbf", lpString2="ed_0") returned -1 [0203.345] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.345] lstrlenW (lpString=".1cd") returned 4 [0203.345] lstrcmpiW (lpString1=".1cd", lpString2="ed_0") returned -1 [0203.345] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[2].loaded_0") returned 131 [0203.345] lstrlenW (lpString=".jpg") returned 4 [0203.345] lstrcmpiW (lpString1=".jpg", lpString2="ed_0") returned -1 [0203.346] lstrcmpiW (lpString1=".IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]", lpString2=".wiki") returned -1 [0203.346] lstrlenW (lpString="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 146 [0203.346] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1d;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.347] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=4869) returned 1 [0203.347] CloseHandle (hObject=0x154) returned 1 [0203.349] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1d;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]")) returned 0x2020 [0203.350] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1d;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1d;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.350] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.350] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.350] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1d;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.350] CloseHandle (hObject=0x154) returned 1 [0203.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.350] lstrlenW (lpString=".doc") returned 4 [0203.350] lstrcmpiW (lpString1=".doc", lpString2="9[1]") returned -1 [0203.350] lstrlenW (lpString=".docx") returned 5 [0203.350] lstrcmpiW (lpString1=".docx", lpString2="99[1]") returned -1 [0203.350] lstrlenW (lpString=".pdf") returned 4 [0203.350] lstrcmpiW (lpString1=".pdf", lpString2="9[1]") returned -1 [0203.350] lstrlenW (lpString=".xls") returned 4 [0203.350] lstrcmpiW (lpString1=".xls", lpString2="9[1]") returned -1 [0203.350] lstrlenW (lpString=".xlsx") returned 5 [0203.350] lstrcmpiW (lpString1=".xlsx", lpString2="99[1]") returned -1 [0203.350] lstrlenW (lpString=".ppt") returned 4 [0203.350] lstrcmpiW (lpString1=".ppt", lpString2="9[1]") returned -1 [0203.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.350] lstrlenW (lpString=".zip") returned 4 [0203.350] lstrcmpiW (lpString1=".zip", lpString2="9[1]") returned -1 [0203.350] lstrlenW (lpString=".rar") returned 4 [0203.350] lstrcmpiW (lpString1=".rar", lpString2="9[1]") returned -1 [0203.350] lstrlenW (lpString=".bz2") returned 4 [0203.350] lstrcmpiW (lpString1=".bz2", lpString2="9[1]") returned -1 [0203.350] lstrlenW (lpString=".7z") returned 3 [0203.351] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.351] lstrlenW (lpString=".dbf") returned 4 [0203.351] lstrcmpiW (lpString1=".dbf", lpString2="9[1]") returned -1 [0203.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.351] lstrlenW (lpString=".1cd") returned 4 [0203.351] lstrcmpiW (lpString1=".1cd", lpString2="9[1]") returned -1 [0203.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.351] lstrlenW (lpString=".jpg") returned 4 [0203.351] lstrcmpiW (lpString1=".jpg", lpString2="9[1]") returned -1 [0203.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.351] lstrlenW (lpString=".doc") returned 4 [0203.351] lstrcmpiW (lpString1=".doc", lpString2="9[1]") returned -1 [0203.351] lstrlenW (lpString=".docx") returned 5 [0203.351] lstrcmpiW (lpString1=".docx", lpString2="99[1]") returned -1 [0203.351] lstrlenW (lpString=".pdf") returned 4 [0203.351] lstrcmpiW (lpString1=".pdf", lpString2="9[1]") returned -1 [0203.351] lstrlenW (lpString=".xls") returned 4 [0203.351] lstrcmpiW (lpString1=".xls", lpString2="9[1]") returned -1 [0203.351] lstrlenW (lpString=".xlsx") returned 5 [0203.351] lstrcmpiW (lpString1=".xlsx", lpString2="99[1]") returned -1 [0203.351] lstrlenW (lpString=".ppt") returned 4 [0203.351] lstrcmpiW (lpString1=".ppt", lpString2="9[1]") returned -1 [0203.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.351] lstrlenW (lpString=".zip") returned 4 [0203.351] lstrcmpiW (lpString1=".zip", lpString2="9[1]") returned -1 [0203.351] lstrlenW (lpString=".rar") returned 4 [0203.351] lstrcmpiW (lpString1=".rar", lpString2="9[1]") returned -1 [0203.351] lstrlenW (lpString=".bz2") returned 4 [0203.351] lstrcmpiW (lpString1=".bz2", lpString2="9[1]") returned -1 [0203.351] lstrlenW (lpString=".7z") returned 3 [0203.351] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.352] lstrlenW (lpString=".dbf") returned 4 [0203.352] lstrcmpiW (lpString1=".dbf", lpString2="9[1]") returned -1 [0203.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.352] lstrlenW (lpString=".1cd") returned 4 [0203.352] lstrcmpiW (lpString1=".1cd", lpString2="9[1]") returned -1 [0203.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1D;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=5;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.352] lstrlenW (lpString=".jpg") returned 4 [0203.352] lstrcmpiW (lpString1=".jpg", lpString2="9[1]") returned -1 [0203.352] lstrcmpiW (lpString1=".application", lpString2=".wiki") returned -1 [0203.352] lstrlenW (lpString="GoogleInstaller_de[1].application") returned 33 [0203.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.352] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=3692) returned 1 [0203.352] CloseHandle (hObject=0x154) returned 1 [0203.352] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application")) returned 0x2020 [0203.353] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.353] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.353] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.353] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.353] GetLastError () returned 0x0 [0203.353] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0xe6c, lpOverlapped=0x0) returned 1 [0203.355] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe70, lpOverlapped=0x0) returned 1 [0203.356] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.356] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x116, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x116, lpOverlapped=0x0) returned 1 [0203.356] SetEndOfFile (hFile=0x2d8) returned 1 [0203.356] CloseHandle (hObject=0x2d8) returned 1 [0203.356] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.356] SetEndOfFile (hFile=0x154) returned 1 [0203.357] CloseHandle (hObject=0x154) returned 1 [0203.357] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.357] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\googleinstaller_de[1].application")) returned 1 [0203.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.357] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.357] lstrlenW (lpString=".doc") returned 4 [0203.357] lstrcmpiW (lpString1=".doc", lpString2="tion") returned -1 [0203.357] lstrlenW (lpString=".docx") returned 5 [0203.357] lstrcmpiW (lpString1=".docx", lpString2="ation") returned -1 [0203.357] lstrlenW (lpString=".pdf") returned 4 [0203.357] lstrcmpiW (lpString1=".pdf", lpString2="tion") returned -1 [0203.357] lstrlenW (lpString=".xls") returned 4 [0203.357] lstrcmpiW (lpString1=".xls", lpString2="tion") returned -1 [0203.357] lstrlenW (lpString=".xlsx") returned 5 [0203.358] lstrcmpiW (lpString1=".xlsx", lpString2="ation") returned -1 [0203.358] lstrlenW (lpString=".ppt") returned 4 [0203.358] lstrcmpiW (lpString1=".ppt", lpString2="tion") returned -1 [0203.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.358] lstrlenW (lpString=".zip") returned 4 [0203.358] lstrcmpiW (lpString1=".zip", lpString2="tion") returned -1 [0203.358] lstrlenW (lpString=".rar") returned 4 [0203.358] lstrcmpiW (lpString1=".rar", lpString2="tion") returned -1 [0203.358] lstrlenW (lpString=".bz2") returned 4 [0203.358] lstrcmpiW (lpString1=".bz2", lpString2="tion") returned -1 [0203.358] lstrlenW (lpString=".7z") returned 3 [0203.358] lstrcmpiW (lpString1=".7z", lpString2="ion") returned -1 [0203.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.358] lstrlenW (lpString=".dbf") returned 4 [0203.358] lstrcmpiW (lpString1=".dbf", lpString2="tion") returned -1 [0203.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.358] lstrlenW (lpString=".1cd") returned 4 [0203.358] lstrcmpiW (lpString1=".1cd", lpString2="tion") returned -1 [0203.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.358] lstrlenW (lpString=".jpg") returned 4 [0203.358] lstrcmpiW (lpString1=".jpg", lpString2="tion") returned -1 [0203.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.358] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.358] lstrlenW (lpString=".doc") returned 4 [0203.359] lstrcmpiW (lpString1=".doc", lpString2="tion") returned -1 [0203.359] lstrlenW (lpString=".docx") returned 5 [0203.359] lstrcmpiW (lpString1=".docx", lpString2="ation") returned -1 [0203.359] lstrlenW (lpString=".pdf") returned 4 [0203.359] lstrcmpiW (lpString1=".pdf", lpString2="tion") returned -1 [0203.359] lstrlenW (lpString=".xls") returned 4 [0203.359] lstrcmpiW (lpString1=".xls", lpString2="tion") returned -1 [0203.359] lstrlenW (lpString=".xlsx") returned 5 [0203.359] lstrcmpiW (lpString1=".xlsx", lpString2="ation") returned -1 [0203.359] lstrlenW (lpString=".ppt") returned 4 [0203.359] lstrcmpiW (lpString1=".ppt", lpString2="tion") returned -1 [0203.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.359] lstrlenW (lpString=".zip") returned 4 [0203.359] lstrcmpiW (lpString1=".zip", lpString2="tion") returned -1 [0203.359] lstrlenW (lpString=".rar") returned 4 [0203.359] lstrcmpiW (lpString1=".rar", lpString2="tion") returned -1 [0203.359] lstrlenW (lpString=".bz2") returned 4 [0203.359] lstrcmpiW (lpString1=".bz2", lpString2="tion") returned -1 [0203.359] lstrlenW (lpString=".7z") returned 3 [0203.359] lstrcmpiW (lpString1=".7z", lpString2="ion") returned -1 [0203.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.359] lstrlenW (lpString=".dbf") returned 4 [0203.359] lstrcmpiW (lpString1=".dbf", lpString2="tion") returned -1 [0203.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.359] lstrlenW (lpString=".1cd") returned 4 [0203.359] lstrcmpiW (lpString1=".1cd", lpString2="tion") returned -1 [0203.359] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\GoogleInstaller_de[1].application") returned 145 [0203.359] lstrlenW (lpString=".jpg") returned 4 [0203.359] lstrcmpiW (lpString1=".jpg", lpString2="tion") returned -1 [0203.359] lstrcmpiW (lpString1=".IE5\\IKQEEPZR\\js[1]", lpString2=".wiki") returned -1 [0203.360] lstrlenW (lpString="js[1]") returned 5 [0203.360] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.361] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=1225) returned 1 [0203.361] CloseHandle (hObject=0x154) returned 1 [0203.361] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[1]")) returned 0x2020 [0203.361] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.361] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.361] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.361] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.361] GetLastError () returned 0x0 [0203.361] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x4c9, lpOverlapped=0x0) returned 1 [0203.452] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0203.453] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.453] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xde, lpOverlapped=0x0) returned 1 [0203.453] SetEndOfFile (hFile=0x2d8) returned 1 [0203.453] CloseHandle (hObject=0x2d8) returned 1 [0203.453] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.453] SetEndOfFile (hFile=0x154) returned 1 [0203.454] CloseHandle (hObject=0x154) returned 1 [0203.454] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.454] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[1]")) returned 1 [0203.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.455] lstrlenW (lpString=".doc") returned 4 [0203.455] lstrcmpiW (lpString1=".doc", lpString2="s[1]") returned -1 [0203.455] lstrlenW (lpString=".docx") returned 5 [0203.455] lstrcmpiW (lpString1=".docx", lpString2="js[1]") returned -1 [0203.455] lstrlenW (lpString=".pdf") returned 4 [0203.455] lstrcmpiW (lpString1=".pdf", lpString2="s[1]") returned -1 [0203.455] lstrlenW (lpString=".xls") returned 4 [0203.455] lstrcmpiW (lpString1=".xls", lpString2="s[1]") returned -1 [0203.455] lstrlenW (lpString=".xlsx") returned 5 [0203.455] lstrcmpiW (lpString1=".xlsx", lpString2="js[1]") returned -1 [0203.455] lstrlenW (lpString=".ppt") returned 4 [0203.455] lstrcmpiW (lpString1=".ppt", lpString2="s[1]") returned -1 [0203.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.455] lstrlenW (lpString=".zip") returned 4 [0203.455] lstrcmpiW (lpString1=".zip", lpString2="s[1]") returned -1 [0203.455] lstrlenW (lpString=".rar") returned 4 [0203.455] lstrcmpiW (lpString1=".rar", lpString2="s[1]") returned -1 [0203.455] lstrlenW (lpString=".bz2") returned 4 [0203.455] lstrcmpiW (lpString1=".bz2", lpString2="s[1]") returned -1 [0203.455] lstrlenW (lpString=".7z") returned 3 [0203.455] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.455] lstrlenW (lpString=".dbf") returned 4 [0203.455] lstrcmpiW (lpString1=".dbf", lpString2="s[1]") returned -1 [0203.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.455] lstrlenW (lpString=".1cd") returned 4 [0203.455] lstrcmpiW (lpString1=".1cd", lpString2="s[1]") returned -1 [0203.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.455] lstrlenW (lpString=".jpg") returned 4 [0203.455] lstrcmpiW (lpString1=".jpg", lpString2="s[1]") returned -1 [0203.455] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.456] lstrlenW (lpString=".doc") returned 4 [0203.456] lstrcmpiW (lpString1=".doc", lpString2="s[1]") returned -1 [0203.456] lstrlenW (lpString=".docx") returned 5 [0203.456] lstrcmpiW (lpString1=".docx", lpString2="js[1]") returned -1 [0203.456] lstrlenW (lpString=".pdf") returned 4 [0203.456] lstrcmpiW (lpString1=".pdf", lpString2="s[1]") returned -1 [0203.456] lstrlenW (lpString=".xls") returned 4 [0203.456] lstrcmpiW (lpString1=".xls", lpString2="s[1]") returned -1 [0203.456] lstrlenW (lpString=".xlsx") returned 5 [0203.456] lstrcmpiW (lpString1=".xlsx", lpString2="js[1]") returned -1 [0203.456] lstrlenW (lpString=".ppt") returned 4 [0203.456] lstrcmpiW (lpString1=".ppt", lpString2="s[1]") returned -1 [0203.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.456] lstrlenW (lpString=".zip") returned 4 [0203.456] lstrcmpiW (lpString1=".zip", lpString2="s[1]") returned -1 [0203.456] lstrlenW (lpString=".rar") returned 4 [0203.456] lstrcmpiW (lpString1=".rar", lpString2="s[1]") returned -1 [0203.456] lstrlenW (lpString=".bz2") returned 4 [0203.456] lstrcmpiW (lpString1=".bz2", lpString2="s[1]") returned -1 [0203.456] lstrlenW (lpString=".7z") returned 3 [0203.456] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.456] lstrlenW (lpString=".dbf") returned 4 [0203.456] lstrcmpiW (lpString1=".dbf", lpString2="s[1]") returned -1 [0203.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.456] lstrlenW (lpString=".1cd") returned 4 [0203.456] lstrcmpiW (lpString1=".1cd", lpString2="s[1]") returned -1 [0203.456] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[1]") returned 117 [0203.456] lstrlenW (lpString=".jpg") returned 4 [0203.456] lstrcmpiW (lpString1=".jpg", lpString2="s[1]") returned -1 [0203.457] lstrcmpiW (lpString1=".eot", lpString2=".wiki") returned -1 [0203.457] lstrlenW (lpString="MemMDL2.2.17[1].eot") returned 19 [0203.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.457] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=106772) returned 1 [0203.457] CloseHandle (hObject=0x154) returned 1 [0203.457] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot")) returned 0x2020 [0203.457] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.457] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.457] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.457] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.458] GetLastError () returned 0x0 [0203.458] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x1a114, lpOverlapped=0x0) returned 1 [0203.462] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x1a120, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x1a120, lpOverlapped=0x0) returned 1 [0203.464] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.464] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0203.464] SetEndOfFile (hFile=0x2d8) returned 1 [0203.464] CloseHandle (hObject=0x2d8) returned 1 [0203.464] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.464] SetEndOfFile (hFile=0x154) returned 1 [0203.466] CloseHandle (hObject=0x154) returned 1 [0203.466] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.466] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\memmdl2.2.17[1].eot")) returned 1 [0203.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.466] lstrlenW (lpString=".doc") returned 4 [0203.466] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.466] lstrlenW (lpString=".docx") returned 5 [0203.466] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.466] lstrlenW (lpString=".pdf") returned 4 [0203.466] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.466] lstrlenW (lpString=".xls") returned 4 [0203.466] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.466] lstrlenW (lpString=".xlsx") returned 5 [0203.466] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.466] lstrlenW (lpString=".ppt") returned 4 [0203.466] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.466] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.466] lstrlenW (lpString=".zip") returned 4 [0203.467] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.467] lstrlenW (lpString=".rar") returned 4 [0203.467] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.467] lstrlenW (lpString=".bz2") returned 4 [0203.467] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.467] lstrlenW (lpString=".7z") returned 3 [0203.467] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.467] lstrlenW (lpString=".dbf") returned 4 [0203.467] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.467] lstrlenW (lpString=".1cd") returned 4 [0203.467] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.467] lstrlenW (lpString=".jpg") returned 4 [0203.467] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.467] lstrlenW (lpString=".doc") returned 4 [0203.467] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.467] lstrlenW (lpString=".docx") returned 5 [0203.467] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.467] lstrlenW (lpString=".pdf") returned 4 [0203.467] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.467] lstrlenW (lpString=".xls") returned 4 [0203.467] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.467] lstrlenW (lpString=".xlsx") returned 5 [0203.468] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.468] lstrlenW (lpString=".ppt") returned 4 [0203.468] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.468] lstrlenW (lpString=".zip") returned 4 [0203.468] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.468] lstrlenW (lpString=".rar") returned 4 [0203.468] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.468] lstrlenW (lpString=".bz2") returned 4 [0203.468] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.468] lstrlenW (lpString=".7z") returned 3 [0203.468] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.468] lstrlenW (lpString=".dbf") returned 4 [0203.468] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.468] lstrlenW (lpString=".1cd") returned 4 [0203.468] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\MemMDL2.2.17[1].eot") returned 131 [0203.468] lstrlenW (lpString=".jpg") returned 4 [0203.468] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.468] lstrcmpiW (lpString1=".IE5\\YG1R61Z8\\adfscript[1]", lpString2=".wiki") returned -1 [0203.468] lstrlenW (lpString="adfscript[1]") returned 12 [0203.468] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adfscript[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.469] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=10356) returned 1 [0203.469] CloseHandle (hObject=0x154) returned 1 [0203.469] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adfscript[1]")) returned 0x2020 [0203.470] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adfscript[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adfscript[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.470] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.470] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adfscript[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.470] GetLastError () returned 0x0 [0203.470] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x2874, lpOverlapped=0x0) returned 1 [0203.472] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x2880, lpOverlapped=0x0) returned 1 [0203.473] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.473] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xec, lpOverlapped=0x0) returned 1 [0203.473] SetEndOfFile (hFile=0x2d8) returned 1 [0203.473] CloseHandle (hObject=0x2d8) returned 1 [0203.473] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.473] SetEndOfFile (hFile=0x154) returned 1 [0203.474] CloseHandle (hObject=0x154) returned 1 [0203.474] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.474] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\adfscript[1]")) returned 1 [0203.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.474] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.474] lstrlenW (lpString=".doc") returned 4 [0203.474] lstrcmpiW (lpString1=".doc", lpString2="t[1]") returned -1 [0203.474] lstrlenW (lpString=".docx") returned 5 [0203.475] lstrcmpiW (lpString1=".docx", lpString2="pt[1]") returned -1 [0203.475] lstrlenW (lpString=".pdf") returned 4 [0203.475] lstrcmpiW (lpString1=".pdf", lpString2="t[1]") returned -1 [0203.475] lstrlenW (lpString=".xls") returned 4 [0203.475] lstrcmpiW (lpString1=".xls", lpString2="t[1]") returned -1 [0203.475] lstrlenW (lpString=".xlsx") returned 5 [0203.475] lstrcmpiW (lpString1=".xlsx", lpString2="pt[1]") returned -1 [0203.475] lstrlenW (lpString=".ppt") returned 4 [0203.475] lstrcmpiW (lpString1=".ppt", lpString2="t[1]") returned -1 [0203.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.475] lstrlenW (lpString=".zip") returned 4 [0203.475] lstrcmpiW (lpString1=".zip", lpString2="t[1]") returned -1 [0203.475] lstrlenW (lpString=".rar") returned 4 [0203.475] lstrcmpiW (lpString1=".rar", lpString2="t[1]") returned -1 [0203.475] lstrlenW (lpString=".bz2") returned 4 [0203.475] lstrcmpiW (lpString1=".bz2", lpString2="t[1]") returned -1 [0203.475] lstrlenW (lpString=".7z") returned 3 [0203.475] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.475] lstrlenW (lpString=".dbf") returned 4 [0203.475] lstrcmpiW (lpString1=".dbf", lpString2="t[1]") returned -1 [0203.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.475] lstrlenW (lpString=".1cd") returned 4 [0203.475] lstrcmpiW (lpString1=".1cd", lpString2="t[1]") returned -1 [0203.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.475] lstrlenW (lpString=".jpg") returned 4 [0203.475] lstrcmpiW (lpString1=".jpg", lpString2="t[1]") returned -1 [0203.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.475] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.475] lstrlenW (lpString=".doc") returned 4 [0203.475] lstrcmpiW (lpString1=".doc", lpString2="t[1]") returned -1 [0203.475] lstrlenW (lpString=".docx") returned 5 [0203.475] lstrcmpiW (lpString1=".docx", lpString2="pt[1]") returned -1 [0203.476] lstrlenW (lpString=".pdf") returned 4 [0203.476] lstrcmpiW (lpString1=".pdf", lpString2="t[1]") returned -1 [0203.476] lstrlenW (lpString=".xls") returned 4 [0203.476] lstrcmpiW (lpString1=".xls", lpString2="t[1]") returned -1 [0203.476] lstrlenW (lpString=".xlsx") returned 5 [0203.476] lstrcmpiW (lpString1=".xlsx", lpString2="pt[1]") returned -1 [0203.476] lstrlenW (lpString=".ppt") returned 4 [0203.476] lstrcmpiW (lpString1=".ppt", lpString2="t[1]") returned -1 [0203.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.476] lstrlenW (lpString=".zip") returned 4 [0203.476] lstrcmpiW (lpString1=".zip", lpString2="t[1]") returned -1 [0203.476] lstrlenW (lpString=".rar") returned 4 [0203.476] lstrcmpiW (lpString1=".rar", lpString2="t[1]") returned -1 [0203.476] lstrlenW (lpString=".bz2") returned 4 [0203.476] lstrcmpiW (lpString1=".bz2", lpString2="t[1]") returned -1 [0203.476] lstrlenW (lpString=".7z") returned 3 [0203.476] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.476] lstrlenW (lpString=".dbf") returned 4 [0203.476] lstrcmpiW (lpString1=".dbf", lpString2="t[1]") returned -1 [0203.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.476] lstrlenW (lpString=".1cd") returned 4 [0203.476] lstrcmpiW (lpString1=".1cd", lpString2="t[1]") returned -1 [0203.476] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\adfscript[1]") returned 124 [0203.476] lstrlenW (lpString=".jpg") returned 4 [0203.476] lstrcmpiW (lpString1=".jpg", lpString2="t[1]") returned -1 [0203.476] lstrcmpiW (lpString1=".loaded_1", lpString2=".wiki") returned -1 [0203.476] lstrlenW (lpString="cb=gapi[1].loaded_1") returned 19 [0203.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.477] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=74370) returned 1 [0203.478] CloseHandle (hObject=0x154) returned 1 [0203.478] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1")) returned 0x2020 [0203.478] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.478] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.478] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.478] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0203.478] GetLastError () returned 0x0 [0203.479] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x12282, lpOverlapped=0x0) returned 1 [0203.481] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x12290, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x12290, lpOverlapped=0x0) returned 1 [0203.484] ReadFile (in: hFile=0x154, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.484] WriteFile (in: hFile=0x2d8, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0203.484] SetEndOfFile (hFile=0x2d8) returned 1 [0203.484] CloseHandle (hObject=0x2d8) returned 1 [0203.484] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.484] SetEndOfFile (hFile=0x154) returned 1 [0203.485] CloseHandle (hObject=0x154) returned 1 [0203.485] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.485] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\cb=gapi[1].loaded_1")) returned 1 [0203.485] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.486] lstrlenW (lpString=".doc") returned 4 [0203.486] lstrcmpiW (lpString1=".doc", lpString2="ed_1") returned -1 [0203.486] lstrlenW (lpString=".docx") returned 5 [0203.486] lstrcmpiW (lpString1=".docx", lpString2="ded_1") returned -1 [0203.486] lstrlenW (lpString=".pdf") returned 4 [0203.486] lstrcmpiW (lpString1=".pdf", lpString2="ed_1") returned -1 [0203.486] lstrlenW (lpString=".xls") returned 4 [0203.486] lstrcmpiW (lpString1=".xls", lpString2="ed_1") returned -1 [0203.486] lstrlenW (lpString=".xlsx") returned 5 [0203.486] lstrcmpiW (lpString1=".xlsx", lpString2="ded_1") returned -1 [0203.486] lstrlenW (lpString=".ppt") returned 4 [0203.486] lstrcmpiW (lpString1=".ppt", lpString2="ed_1") returned -1 [0203.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.486] lstrlenW (lpString=".zip") returned 4 [0203.486] lstrcmpiW (lpString1=".zip", lpString2="ed_1") returned -1 [0203.486] lstrlenW (lpString=".rar") returned 4 [0203.486] lstrcmpiW (lpString1=".rar", lpString2="ed_1") returned -1 [0203.486] lstrlenW (lpString=".bz2") returned 4 [0203.486] lstrcmpiW (lpString1=".bz2", lpString2="ed_1") returned -1 [0203.486] lstrlenW (lpString=".7z") returned 3 [0203.486] lstrcmpiW (lpString1=".7z", lpString2="d_1") returned -1 [0203.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.486] lstrlenW (lpString=".dbf") returned 4 [0203.486] lstrcmpiW (lpString1=".dbf", lpString2="ed_1") returned -1 [0203.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.486] lstrlenW (lpString=".1cd") returned 4 [0203.486] lstrcmpiW (lpString1=".1cd", lpString2="ed_1") returned -1 [0203.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.486] lstrlenW (lpString=".jpg") returned 4 [0203.486] lstrcmpiW (lpString1=".jpg", lpString2="ed_1") returned -1 [0203.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.486] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.486] lstrlenW (lpString=".doc") returned 4 [0203.487] lstrcmpiW (lpString1=".doc", lpString2="ed_1") returned -1 [0203.487] lstrlenW (lpString=".docx") returned 5 [0203.487] lstrcmpiW (lpString1=".docx", lpString2="ded_1") returned -1 [0203.487] lstrlenW (lpString=".pdf") returned 4 [0203.487] lstrcmpiW (lpString1=".pdf", lpString2="ed_1") returned -1 [0203.487] lstrlenW (lpString=".xls") returned 4 [0203.487] lstrcmpiW (lpString1=".xls", lpString2="ed_1") returned -1 [0203.487] lstrlenW (lpString=".xlsx") returned 5 [0203.487] lstrcmpiW (lpString1=".xlsx", lpString2="ded_1") returned -1 [0203.487] lstrlenW (lpString=".ppt") returned 4 [0203.487] lstrcmpiW (lpString1=".ppt", lpString2="ed_1") returned -1 [0203.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.487] lstrlenW (lpString=".zip") returned 4 [0203.487] lstrcmpiW (lpString1=".zip", lpString2="ed_1") returned -1 [0203.487] lstrlenW (lpString=".rar") returned 4 [0203.487] lstrcmpiW (lpString1=".rar", lpString2="ed_1") returned -1 [0203.487] lstrlenW (lpString=".bz2") returned 4 [0203.487] lstrcmpiW (lpString1=".bz2", lpString2="ed_1") returned -1 [0203.487] lstrlenW (lpString=".7z") returned 3 [0203.487] lstrcmpiW (lpString1=".7z", lpString2="d_1") returned -1 [0203.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.487] lstrlenW (lpString=".dbf") returned 4 [0203.487] lstrcmpiW (lpString1=".dbf", lpString2="ed_1") returned -1 [0203.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.487] lstrlenW (lpString=".1cd") returned 4 [0203.487] lstrcmpiW (lpString1=".1cd", lpString2="ed_1") returned -1 [0203.487] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\cb=gapi[1].loaded_1") returned 131 [0203.487] lstrlenW (lpString=".jpg") returned 4 [0203.487] lstrcmpiW (lpString1=".jpg", lpString2="ed_1") returned -1 [0203.487] lstrcmpiW (lpString1=".IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]", lpString2=".wiki") returned -1 [0203.488] lstrlenW (lpString="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 146 [0203.488] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.545] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=4867) returned 1 [0203.545] CloseHandle (hObject=0x154) returned 1 [0203.546] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]")) returned 0x2020 [0203.553] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.553] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.553] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.554] SetFilePointerEx (in: hFile=0x154, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.554] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.562] CloseHandle (hObject=0x154) returned 1 [0203.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.562] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.562] lstrlenW (lpString=".doc") returned 4 [0203.570] lstrcmpiW (lpString1=".doc", lpString2="9[1]") returned -1 [0203.570] lstrlenW (lpString=".docx") returned 5 [0203.570] lstrcmpiW (lpString1=".docx", lpString2="99[1]") returned -1 [0203.570] lstrlenW (lpString=".pdf") returned 4 [0203.570] lstrcmpiW (lpString1=".pdf", lpString2="9[1]") returned -1 [0203.570] lstrlenW (lpString=".xls") returned 4 [0203.570] lstrcmpiW (lpString1=".xls", lpString2="9[1]") returned -1 [0203.570] lstrlenW (lpString=".xlsx") returned 5 [0203.571] lstrcmpiW (lpString1=".xlsx", lpString2="99[1]") returned -1 [0203.571] lstrlenW (lpString=".ppt") returned 4 [0203.571] lstrcmpiW (lpString1=".ppt", lpString2="9[1]") returned -1 [0203.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.571] lstrlenW (lpString=".zip") returned 4 [0203.571] lstrcmpiW (lpString1=".zip", lpString2="9[1]") returned -1 [0203.571] lstrlenW (lpString=".rar") returned 4 [0203.571] lstrcmpiW (lpString1=".rar", lpString2="9[1]") returned -1 [0203.571] lstrlenW (lpString=".bz2") returned 4 [0203.571] lstrcmpiW (lpString1=".bz2", lpString2="9[1]") returned -1 [0203.571] lstrlenW (lpString=".7z") returned 3 [0203.571] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.571] lstrlenW (lpString=".dbf") returned 4 [0203.571] lstrcmpiW (lpString1=".dbf", lpString2="9[1]") returned -1 [0203.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.571] lstrlenW (lpString=".1cd") returned 4 [0203.571] lstrcmpiW (lpString1=".1cd", lpString2="9[1]") returned -1 [0203.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.571] lstrlenW (lpString=".jpg") returned 4 [0203.571] lstrcmpiW (lpString1=".jpg", lpString2="9[1]") returned -1 [0203.571] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.572] lstrlenW (lpString=".doc") returned 4 [0203.572] lstrcmpiW (lpString1=".doc", lpString2="9[1]") returned -1 [0203.572] lstrlenW (lpString=".docx") returned 5 [0203.572] lstrcmpiW (lpString1=".docx", lpString2="99[1]") returned -1 [0203.572] lstrlenW (lpString=".pdf") returned 4 [0203.572] lstrcmpiW (lpString1=".pdf", lpString2="9[1]") returned -1 [0203.572] lstrlenW (lpString=".xls") returned 4 [0203.572] lstrcmpiW (lpString1=".xls", lpString2="9[1]") returned -1 [0203.572] lstrlenW (lpString=".xlsx") returned 5 [0203.572] lstrcmpiW (lpString1=".xlsx", lpString2="99[1]") returned -1 [0203.572] lstrlenW (lpString=".ppt") returned 4 [0203.572] lstrcmpiW (lpString1=".ppt", lpString2="9[1]") returned -1 [0203.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.572] lstrlenW (lpString=".zip") returned 4 [0203.572] lstrcmpiW (lpString1=".zip", lpString2="9[1]") returned -1 [0203.572] lstrlenW (lpString=".rar") returned 4 [0203.572] lstrcmpiW (lpString1=".rar", lpString2="9[1]") returned -1 [0203.572] lstrlenW (lpString=".bz2") returned 4 [0203.572] lstrcmpiW (lpString1=".bz2", lpString2="9[1]") returned -1 [0203.572] lstrlenW (lpString=".7z") returned 3 [0203.572] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.572] lstrlenW (lpString=".dbf") returned 4 [0203.572] lstrcmpiW (lpString1=".dbf", lpString2="9[1]") returned -1 [0203.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.572] lstrlenW (lpString=".1cd") returned 4 [0203.572] lstrcmpiW (lpString1=".1cd", lpString2="9[1]") returned -1 [0203.572] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.572] lstrlenW (lpString=".jpg") returned 4 [0203.572] lstrcmpiW (lpString1=".jpg", lpString2="9[1]") returned -1 [0203.573] lstrcmpiW (lpString1=".IE5\\YG1R61Z8\\thirdparty[1]", lpString2=".wiki") returned -1 [0203.573] lstrlenW (lpString="thirdparty[1]") returned 13 [0203.573] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\thirdparty[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.573] GetFileSizeEx (in: hFile=0x154, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=0) returned 1 [0203.573] CloseHandle (hObject=0x154) returned 1 [0203.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.573] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.573] lstrlenW (lpString=".doc") returned 4 [0203.573] lstrcmpiW (lpString1=".doc", lpString2="y[1]") returned -1 [0203.573] lstrlenW (lpString=".docx") returned 5 [0203.573] lstrcmpiW (lpString1=".docx", lpString2="ty[1]") returned -1 [0203.573] lstrlenW (lpString=".pdf") returned 4 [0203.573] lstrcmpiW (lpString1=".pdf", lpString2="y[1]") returned -1 [0203.573] lstrlenW (lpString=".xls") returned 4 [0203.573] lstrcmpiW (lpString1=".xls", lpString2="y[1]") returned -1 [0203.573] lstrlenW (lpString=".xlsx") returned 5 [0203.573] lstrcmpiW (lpString1=".xlsx", lpString2="ty[1]") returned -1 [0203.573] lstrlenW (lpString=".ppt") returned 4 [0203.573] lstrcmpiW (lpString1=".ppt", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.574] lstrlenW (lpString=".zip") returned 4 [0203.574] lstrcmpiW (lpString1=".zip", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString=".rar") returned 4 [0203.574] lstrcmpiW (lpString1=".rar", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString=".bz2") returned 4 [0203.574] lstrcmpiW (lpString1=".bz2", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString=".7z") returned 3 [0203.574] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.574] lstrlenW (lpString=".dbf") returned 4 [0203.574] lstrcmpiW (lpString1=".dbf", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.574] lstrlenW (lpString=".1cd") returned 4 [0203.574] lstrcmpiW (lpString1=".1cd", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.574] lstrlenW (lpString=".jpg") returned 4 [0203.574] lstrcmpiW (lpString1=".jpg", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.574] lstrlenW (lpString=".doc") returned 4 [0203.574] lstrcmpiW (lpString1=".doc", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString=".docx") returned 5 [0203.574] lstrcmpiW (lpString1=".docx", lpString2="ty[1]") returned -1 [0203.574] lstrlenW (lpString=".pdf") returned 4 [0203.574] lstrcmpiW (lpString1=".pdf", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString=".xls") returned 4 [0203.574] lstrcmpiW (lpString1=".xls", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString=".xlsx") returned 5 [0203.574] lstrcmpiW (lpString1=".xlsx", lpString2="ty[1]") returned -1 [0203.574] lstrlenW (lpString=".ppt") returned 4 [0203.574] lstrcmpiW (lpString1=".ppt", lpString2="y[1]") returned -1 [0203.574] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.574] lstrlenW (lpString=".zip") returned 4 [0203.575] lstrcmpiW (lpString1=".zip", lpString2="y[1]") returned -1 [0203.575] lstrlenW (lpString=".rar") returned 4 [0203.575] lstrcmpiW (lpString1=".rar", lpString2="y[1]") returned -1 [0203.575] lstrlenW (lpString=".bz2") returned 4 [0203.575] lstrcmpiW (lpString1=".bz2", lpString2="y[1]") returned -1 [0203.575] lstrlenW (lpString=".7z") returned 3 [0203.575] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.575] lstrlenW (lpString=".dbf") returned 4 [0203.575] lstrcmpiW (lpString1=".dbf", lpString2="y[1]") returned -1 [0203.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.575] lstrlenW (lpString=".1cd") returned 4 [0203.575] lstrcmpiW (lpString1=".1cd", lpString2="y[1]") returned -1 [0203.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\thirdparty[1]") returned 125 [0203.575] lstrlenW (lpString=".jpg") returned 4 [0203.575] lstrcmpiW (lpString1=".jpg", lpString2="y[1]") returned -1 [0203.575] lstrcmpiW (lpString1=".IE5\\YG1R61Z8\\v2[1]", lpString2=".wiki") returned -1 [0203.575] lstrlenW (lpString="v2[1]") returned 5 [0203.575] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\v2[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.703] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=13093) returned 1 [0203.703] CloseHandle (hObject=0x34c) returned 1 [0203.703] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\v2[1]")) returned 0x2020 [0203.708] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\v2[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\v2[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.708] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.708] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.708] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\v2[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.732] GetLastError () returned 0x0 [0203.732] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x3325, lpOverlapped=0x0) returned 1 [0203.734] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0203.735] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.735] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xde, lpOverlapped=0x0) returned 1 [0203.736] SetEndOfFile (hFile=0x354) returned 1 [0203.736] CloseHandle (hObject=0x354) returned 1 [0203.736] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.736] SetEndOfFile (hFile=0x34c) returned 1 [0203.737] CloseHandle (hObject=0x34c) returned 1 [0203.737] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.737] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\v2[1]")) returned 1 [0203.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.737] lstrlenW (lpString=".doc") returned 4 [0203.737] lstrcmpiW (lpString1=".doc", lpString2="2[1]") returned -1 [0203.737] lstrlenW (lpString=".docx") returned 5 [0203.737] lstrcmpiW (lpString1=".docx", lpString2="v2[1]") returned -1 [0203.737] lstrlenW (lpString=".pdf") returned 4 [0203.737] lstrcmpiW (lpString1=".pdf", lpString2="2[1]") returned -1 [0203.737] lstrlenW (lpString=".xls") returned 4 [0203.737] lstrcmpiW (lpString1=".xls", lpString2="2[1]") returned -1 [0203.737] lstrlenW (lpString=".xlsx") returned 5 [0203.737] lstrcmpiW (lpString1=".xlsx", lpString2="v2[1]") returned -1 [0203.737] lstrlenW (lpString=".ppt") returned 4 [0203.737] lstrcmpiW (lpString1=".ppt", lpString2="2[1]") returned -1 [0203.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.737] lstrlenW (lpString=".zip") returned 4 [0203.737] lstrcmpiW (lpString1=".zip", lpString2="2[1]") returned -1 [0203.737] lstrlenW (lpString=".rar") returned 4 [0203.737] lstrcmpiW (lpString1=".rar", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString=".bz2") returned 4 [0203.738] lstrcmpiW (lpString1=".bz2", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString=".7z") returned 3 [0203.738] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.738] lstrlenW (lpString=".dbf") returned 4 [0203.738] lstrcmpiW (lpString1=".dbf", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.738] lstrlenW (lpString=".1cd") returned 4 [0203.738] lstrcmpiW (lpString1=".1cd", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.738] lstrlenW (lpString=".jpg") returned 4 [0203.738] lstrcmpiW (lpString1=".jpg", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.738] lstrlenW (lpString=".doc") returned 4 [0203.738] lstrcmpiW (lpString1=".doc", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString=".docx") returned 5 [0203.738] lstrcmpiW (lpString1=".docx", lpString2="v2[1]") returned -1 [0203.738] lstrlenW (lpString=".pdf") returned 4 [0203.738] lstrcmpiW (lpString1=".pdf", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString=".xls") returned 4 [0203.738] lstrcmpiW (lpString1=".xls", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString=".xlsx") returned 5 [0203.738] lstrcmpiW (lpString1=".xlsx", lpString2="v2[1]") returned -1 [0203.738] lstrlenW (lpString=".ppt") returned 4 [0203.738] lstrcmpiW (lpString1=".ppt", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.738] lstrlenW (lpString=".zip") returned 4 [0203.738] lstrcmpiW (lpString1=".zip", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString=".rar") returned 4 [0203.738] lstrcmpiW (lpString1=".rar", lpString2="2[1]") returned -1 [0203.738] lstrlenW (lpString=".bz2") returned 4 [0203.738] lstrcmpiW (lpString1=".bz2", lpString2="2[1]") returned -1 [0203.739] lstrlenW (lpString=".7z") returned 3 [0203.739] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.739] lstrlenW (lpString=".dbf") returned 4 [0203.739] lstrcmpiW (lpString1=".dbf", lpString2="2[1]") returned -1 [0203.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.739] lstrlenW (lpString=".1cd") returned 4 [0203.739] lstrcmpiW (lpString1=".1cd", lpString2="2[1]") returned -1 [0203.739] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\v2[1]") returned 117 [0203.739] lstrlenW (lpString=".jpg") returned 4 [0203.739] lstrcmpiW (lpString1=".jpg", lpString2="2[1]") returned -1 [0203.739] lstrcmpiW (lpString1=".pat", lpString2=".wiki") returned -1 [0203.739] lstrlenW (lpString="WindowsMail.pat") returned 15 [0203.739] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.740] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=16384) returned 1 [0203.740] CloseHandle (hObject=0x34c) returned 1 [0203.740] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat")) returned 0x2020 [0203.740] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.740] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.740] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.740] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.741] GetLastError () returned 0x0 [0203.741] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x4000, lpOverlapped=0x0) returned 1 [0203.742] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x4010, lpOverlapped=0x0) returned 1 [0203.743] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.743] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0203.744] SetEndOfFile (hFile=0x354) returned 1 [0203.744] CloseHandle (hObject=0x354) returned 1 [0203.744] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.744] SetEndOfFile (hFile=0x34c) returned 1 [0203.745] CloseHandle (hObject=0x34c) returned 1 [0203.745] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.745] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.pat")) returned 1 [0203.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.745] lstrlenW (lpString=".doc") returned 4 [0203.745] lstrcmpiW (lpString1=".doc", lpString2=".pat") returned -1 [0203.745] lstrlenW (lpString=".docx") returned 5 [0203.745] lstrcmpiW (lpString1=".docx", lpString2="l.pat") returned -1 [0203.745] lstrlenW (lpString=".pdf") returned 4 [0203.745] lstrcmpiW (lpString1=".pdf", lpString2=".pat") returned 1 [0203.745] lstrlenW (lpString=".xls") returned 4 [0203.745] lstrcmpiW (lpString1=".xls", lpString2=".pat") returned 1 [0203.745] lstrlenW (lpString=".xlsx") returned 5 [0203.745] lstrcmpiW (lpString1=".xlsx", lpString2="l.pat") returned -1 [0203.745] lstrlenW (lpString=".ppt") returned 4 [0203.745] lstrcmpiW (lpString1=".ppt", lpString2=".pat") returned 1 [0203.745] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.745] lstrlenW (lpString=".zip") returned 4 [0203.745] lstrcmpiW (lpString1=".zip", lpString2=".pat") returned 1 [0203.745] lstrlenW (lpString=".rar") returned 4 [0203.745] lstrcmpiW (lpString1=".rar", lpString2=".pat") returned 1 [0203.746] lstrlenW (lpString=".bz2") returned 4 [0203.746] lstrcmpiW (lpString1=".bz2", lpString2=".pat") returned -1 [0203.746] lstrlenW (lpString=".7z") returned 3 [0203.746] lstrcmpiW (lpString1=".7z", lpString2="pat") returned -1 [0203.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.746] lstrlenW (lpString=".dbf") returned 4 [0203.746] lstrcmpiW (lpString1=".dbf", lpString2=".pat") returned -1 [0203.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.746] lstrlenW (lpString=".1cd") returned 4 [0203.746] lstrcmpiW (lpString1=".1cd", lpString2=".pat") returned -1 [0203.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.746] lstrlenW (lpString=".jpg") returned 4 [0203.746] lstrcmpiW (lpString1=".jpg", lpString2=".pat") returned -1 [0203.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.746] lstrlenW (lpString=".doc") returned 4 [0203.746] lstrcmpiW (lpString1=".doc", lpString2=".pat") returned -1 [0203.746] lstrlenW (lpString=".docx") returned 5 [0203.746] lstrcmpiW (lpString1=".docx", lpString2="l.pat") returned -1 [0203.746] lstrlenW (lpString=".pdf") returned 4 [0203.746] lstrcmpiW (lpString1=".pdf", lpString2=".pat") returned 1 [0203.746] lstrlenW (lpString=".xls") returned 4 [0203.746] lstrcmpiW (lpString1=".xls", lpString2=".pat") returned 1 [0203.746] lstrlenW (lpString=".xlsx") returned 5 [0203.746] lstrcmpiW (lpString1=".xlsx", lpString2="l.pat") returned -1 [0203.746] lstrlenW (lpString=".ppt") returned 4 [0203.746] lstrcmpiW (lpString1=".ppt", lpString2=".pat") returned 1 [0203.746] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.746] lstrlenW (lpString=".zip") returned 4 [0203.746] lstrcmpiW (lpString1=".zip", lpString2=".pat") returned 1 [0203.746] lstrlenW (lpString=".rar") returned 4 [0203.746] lstrcmpiW (lpString1=".rar", lpString2=".pat") returned 1 [0203.746] lstrlenW (lpString=".bz2") returned 4 [0203.747] lstrcmpiW (lpString1=".bz2", lpString2=".pat") returned -1 [0203.747] lstrlenW (lpString=".7z") returned 3 [0203.747] lstrcmpiW (lpString1=".7z", lpString2="pat") returned -1 [0203.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.747] lstrlenW (lpString=".dbf") returned 4 [0203.747] lstrcmpiW (lpString1=".dbf", lpString2=".pat") returned -1 [0203.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.747] lstrlenW (lpString=".1cd") returned 4 [0203.747] lstrcmpiW (lpString1=".1cd", lpString2=".pat") returned -1 [0203.747] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.pat") returned 93 [0203.747] lstrlenW (lpString=".jpg") returned 4 [0203.747] lstrcmpiW (lpString1=".jpg", lpString2=".pat") returned -1 [0203.747] lstrcmpiW (lpString1=".chk", lpString2=".wiki") returned -1 [0203.747] lstrlenW (lpString="edb.chk") returned 7 [0203.747] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.748] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=8192) returned 1 [0203.748] CloseHandle (hObject=0x34c) returned 1 [0203.748] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk")) returned 0x2020 [0203.748] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.748] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.748] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.748] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.749] GetLastError () returned 0x0 [0203.749] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x2000, lpOverlapped=0x0) returned 1 [0203.751] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0203.752] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.752] WriteFile (in: hFile=0x354, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0203.752] SetEndOfFile (hFile=0x354) returned 1 [0203.752] CloseHandle (hObject=0x354) returned 1 [0203.752] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.752] SetEndOfFile (hFile=0x34c) returned 1 [0203.753] CloseHandle (hObject=0x34c) returned 1 [0203.753] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.753] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edb.chk")) returned 1 [0203.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.753] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.753] lstrlenW (lpString=".doc") returned 4 [0203.753] lstrcmpiW (lpString1=".doc", lpString2=".chk") returned 1 [0203.753] lstrlenW (lpString=".docx") returned 5 [0203.753] lstrcmpiW (lpString1=".docx", lpString2="b.chk") returned -1 [0203.753] lstrlenW (lpString=".pdf") returned 4 [0203.753] lstrcmpiW (lpString1=".pdf", lpString2=".chk") returned 1 [0203.753] lstrlenW (lpString=".xls") returned 4 [0203.753] lstrcmpiW (lpString1=".xls", lpString2=".chk") returned 1 [0203.754] lstrlenW (lpString=".xlsx") returned 5 [0203.754] lstrcmpiW (lpString1=".xlsx", lpString2="b.chk") returned -1 [0203.754] lstrlenW (lpString=".ppt") returned 4 [0203.754] lstrcmpiW (lpString1=".ppt", lpString2=".chk") returned 1 [0203.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.754] lstrlenW (lpString=".zip") returned 4 [0203.754] lstrcmpiW (lpString1=".zip", lpString2=".chk") returned 1 [0203.754] lstrlenW (lpString=".rar") returned 4 [0203.754] lstrcmpiW (lpString1=".rar", lpString2=".chk") returned 1 [0203.754] lstrlenW (lpString=".bz2") returned 4 [0203.754] lstrcmpiW (lpString1=".bz2", lpString2=".chk") returned -1 [0203.754] lstrlenW (lpString=".7z") returned 3 [0203.754] lstrcmpiW (lpString1=".7z", lpString2="chk") returned -1 [0203.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.754] lstrlenW (lpString=".dbf") returned 4 [0203.754] lstrcmpiW (lpString1=".dbf", lpString2=".chk") returned 1 [0203.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.754] lstrlenW (lpString=".1cd") returned 4 [0203.754] lstrcmpiW (lpString1=".1cd", lpString2=".chk") returned -1 [0203.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.754] lstrlenW (lpString=".jpg") returned 4 [0203.754] lstrcmpiW (lpString1=".jpg", lpString2=".chk") returned 1 [0203.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.754] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.754] lstrlenW (lpString=".doc") returned 4 [0203.754] lstrcmpiW (lpString1=".doc", lpString2=".chk") returned 1 [0203.754] lstrlenW (lpString=".docx") returned 5 [0203.754] lstrcmpiW (lpString1=".docx", lpString2="b.chk") returned -1 [0203.754] lstrlenW (lpString=".pdf") returned 4 [0203.754] lstrcmpiW (lpString1=".pdf", lpString2=".chk") returned 1 [0203.754] lstrlenW (lpString=".xls") returned 4 [0203.754] lstrcmpiW (lpString1=".xls", lpString2=".chk") returned 1 [0203.755] lstrlenW (lpString=".xlsx") returned 5 [0203.755] lstrcmpiW (lpString1=".xlsx", lpString2="b.chk") returned -1 [0203.755] lstrlenW (lpString=".ppt") returned 4 [0203.755] lstrcmpiW (lpString1=".ppt", lpString2=".chk") returned 1 [0203.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.755] lstrlenW (lpString=".zip") returned 4 [0203.755] lstrcmpiW (lpString1=".zip", lpString2=".chk") returned 1 [0203.755] lstrlenW (lpString=".rar") returned 4 [0203.755] lstrcmpiW (lpString1=".rar", lpString2=".chk") returned 1 [0203.755] lstrlenW (lpString=".bz2") returned 4 [0203.755] lstrcmpiW (lpString1=".bz2", lpString2=".chk") returned -1 [0203.755] lstrlenW (lpString=".7z") returned 3 [0203.755] lstrcmpiW (lpString1=".7z", lpString2="chk") returned -1 [0203.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.755] lstrlenW (lpString=".dbf") returned 4 [0203.755] lstrcmpiW (lpString1=".dbf", lpString2=".chk") returned 1 [0203.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.755] lstrlenW (lpString=".1cd") returned 4 [0203.755] lstrcmpiW (lpString1=".1cd", lpString2=".chk") returned -1 [0203.755] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edb.chk") returned 74 [0203.755] lstrlenW (lpString=".jpg") returned 4 [0203.755] lstrcmpiW (lpString1=".jpg", lpString2=".chk") returned 1 [0203.755] lstrcmpiW (lpString1=".jrs", lpString2=".wiki") returned -1 [0203.755] lstrlenW (lpString="edbres00001.jrs") returned 15 [0203.755] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.756] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=2097152) returned 1 [0203.756] CloseHandle (hObject=0x34c) returned 1 [0203.756] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs")) returned 0x2020 [0203.756] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.756] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0203.757] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00001.jrs.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.757] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fc6c | out: lpNewFilePointer=0x0) returned 1 [0203.757] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fc2c | out: lpNewFilePointer=0x0) returned 1 [0203.757] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x360fc38, lpOverlapped=0x0 | out: lpBuffer=0x3ff0058*, lpNumberOfBytesRead=0x360fc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.917] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xaaaaa, lpNewFilePointer=0x0, dwMoveMethod=0x360fc2c | out: lpNewFilePointer=0x0) returned 1 [0203.917] ReadFile (in: hFile=0x34c, lpBuffer=0x4030058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x360fc38, lpOverlapped=0x0 | out: lpBuffer=0x4030058*, lpNumberOfBytesRead=0x360fc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.923] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x360fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0203.923] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1c0000, lpNewFilePointer=0x0, dwMoveMethod=0x360fc2c | out: lpNewFilePointer=0x0) returned 1 [0203.923] ReadFile (in: hFile=0x34c, lpBuffer=0x4070058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x360fc38, lpOverlapped=0x0 | out: lpBuffer=0x4070058*, lpNumberOfBytesRead=0x360fc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.942] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.942] WriteFile (in: hFile=0x34c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x360fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0203.965] SetEndOfFile (hFile=0x34c) returned 1 [0203.965] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40000) returned 0x4130060 [0203.965] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fc7c | out: lpNewFilePointer=0x0) returned 1 [0203.965] WriteFile (in: hFile=0x34c, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x360fc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x360fc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.148] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0xaaaaa, lpNewFilePointer=0x0, dwMoveMethod=0x360fc7c | out: lpNewFilePointer=0x0) returned 1 [0204.148] WriteFile (in: hFile=0x34c, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x360fc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x360fc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.150] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x1c0000, lpNewFilePointer=0x0, dwMoveMethod=0x360fc7c | out: lpNewFilePointer=0x0) returned 1 [0204.150] WriteFile (in: hFile=0x34c, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x360fc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x360fc88*=0x40000, lpOverlapped=0x0) returned 1 [0204.152] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x4130060 | out: hHeap=0x270000) returned 1 [0204.155] CloseHandle (hObject=0x34c) returned 1 [0204.155] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.155] lstrlenW (lpString=".doc") returned 4 [0204.155] lstrcmpiW (lpString1=".doc", lpString2=".jrs") returned -1 [0204.155] lstrlenW (lpString=".docx") returned 5 [0204.155] lstrcmpiW (lpString1=".docx", lpString2="1.jrs") returned -1 [0204.155] lstrlenW (lpString=".pdf") returned 4 [0204.155] lstrcmpiW (lpString1=".pdf", lpString2=".jrs") returned 1 [0204.155] lstrlenW (lpString=".xls") returned 4 [0204.155] lstrcmpiW (lpString1=".xls", lpString2=".jrs") returned 1 [0204.155] lstrlenW (lpString=".xlsx") returned 5 [0204.155] lstrcmpiW (lpString1=".xlsx", lpString2="1.jrs") returned -1 [0204.155] lstrlenW (lpString=".ppt") returned 4 [0204.155] lstrcmpiW (lpString1=".ppt", lpString2=".jrs") returned 1 [0204.155] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.155] lstrlenW (lpString=".zip") returned 4 [0204.156] lstrcmpiW (lpString1=".zip", lpString2=".jrs") returned 1 [0204.156] lstrlenW (lpString=".rar") returned 4 [0204.156] lstrcmpiW (lpString1=".rar", lpString2=".jrs") returned 1 [0204.156] lstrlenW (lpString=".bz2") returned 4 [0204.156] lstrcmpiW (lpString1=".bz2", lpString2=".jrs") returned -1 [0204.156] lstrlenW (lpString=".7z") returned 3 [0204.156] lstrcmpiW (lpString1=".7z", lpString2="jrs") returned -1 [0204.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.156] lstrlenW (lpString=".dbf") returned 4 [0204.156] lstrcmpiW (lpString1=".dbf", lpString2=".jrs") returned -1 [0204.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.156] lstrlenW (lpString=".1cd") returned 4 [0204.156] lstrcmpiW (lpString1=".1cd", lpString2=".jrs") returned -1 [0204.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.156] lstrlenW (lpString=".jpg") returned 4 [0204.156] lstrcmpiW (lpString1=".jpg", lpString2=".jrs") returned -1 [0204.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.156] lstrlenW (lpString=".doc") returned 4 [0204.156] lstrcmpiW (lpString1=".doc", lpString2=".jrs") returned -1 [0204.156] lstrlenW (lpString=".docx") returned 5 [0204.156] lstrcmpiW (lpString1=".docx", lpString2="1.jrs") returned -1 [0204.156] lstrlenW (lpString=".pdf") returned 4 [0204.156] lstrcmpiW (lpString1=".pdf", lpString2=".jrs") returned 1 [0204.156] lstrlenW (lpString=".xls") returned 4 [0204.156] lstrcmpiW (lpString1=".xls", lpString2=".jrs") returned 1 [0204.156] lstrlenW (lpString=".xlsx") returned 5 [0204.156] lstrcmpiW (lpString1=".xlsx", lpString2="1.jrs") returned -1 [0204.156] lstrlenW (lpString=".ppt") returned 4 [0204.156] lstrcmpiW (lpString1=".ppt", lpString2=".jrs") returned 1 [0204.156] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.156] lstrlenW (lpString=".zip") returned 4 [0204.156] lstrcmpiW (lpString1=".zip", lpString2=".jrs") returned 1 [0204.157] lstrlenW (lpString=".rar") returned 4 [0204.157] lstrcmpiW (lpString1=".rar", lpString2=".jrs") returned 1 [0204.157] lstrlenW (lpString=".bz2") returned 4 [0204.157] lstrcmpiW (lpString1=".bz2", lpString2=".jrs") returned -1 [0204.157] lstrlenW (lpString=".7z") returned 3 [0204.157] lstrcmpiW (lpString1=".7z", lpString2="jrs") returned -1 [0204.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.157] lstrlenW (lpString=".dbf") returned 4 [0204.157] lstrcmpiW (lpString1=".dbf", lpString2=".jrs") returned -1 [0204.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.157] lstrlenW (lpString=".1cd") returned 4 [0204.157] lstrcmpiW (lpString1=".1cd", lpString2=".jrs") returned -1 [0204.157] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00001.jrs") returned 82 [0204.157] lstrlenW (lpString=".jpg") returned 4 [0204.157] lstrcmpiW (lpString1=".jpg", lpString2=".jrs") returned -1 [0204.157] lstrcmpiW (lpString1=".default\\Cache\\D\\08\\71469d01", lpString2=".wiki") returned -1 [0204.157] lstrlenW (lpString="71469d01") returned 8 [0204.157] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0204.158] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=33382) returned 1 [0204.158] CloseHandle (hObject=0x34c) returned 1 [0204.158] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01")) returned 0x2020 [0204.158] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0204.158] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.158] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.158] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0204.159] GetLastError () returned 0x0 [0204.159] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x8266, lpOverlapped=0x0) returned 1 [0204.161] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x8270, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x8270, lpOverlapped=0x0) returned 1 [0204.163] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.163] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.163] SetEndOfFile (hFile=0x15c) returned 1 [0204.163] CloseHandle (hObject=0x15c) returned 1 [0204.163] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.163] SetEndOfFile (hFile=0x34c) returned 1 [0204.164] CloseHandle (hObject=0x34c) returned 1 [0204.164] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.164] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\d\\08\\71469d01")) returned 1 [0204.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.164] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.164] lstrlenW (lpString=".doc") returned 4 [0204.164] lstrcmpiW (lpString1=".doc", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString=".docx") returned 5 [0204.165] lstrcmpiW (lpString1=".docx", lpString2="69d01") returned -1 [0204.165] lstrlenW (lpString=".pdf") returned 4 [0204.165] lstrcmpiW (lpString1=".pdf", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString=".xls") returned 4 [0204.165] lstrcmpiW (lpString1=".xls", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString=".xlsx") returned 5 [0204.165] lstrcmpiW (lpString1=".xlsx", lpString2="69d01") returned -1 [0204.165] lstrlenW (lpString=".ppt") returned 4 [0204.165] lstrcmpiW (lpString1=".ppt", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.165] lstrlenW (lpString=".zip") returned 4 [0204.165] lstrcmpiW (lpString1=".zip", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString=".rar") returned 4 [0204.165] lstrcmpiW (lpString1=".rar", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString=".bz2") returned 4 [0204.165] lstrcmpiW (lpString1=".bz2", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString=".7z") returned 3 [0204.165] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.165] lstrlenW (lpString=".dbf") returned 4 [0204.165] lstrcmpiW (lpString1=".dbf", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.165] lstrlenW (lpString=".1cd") returned 4 [0204.165] lstrcmpiW (lpString1=".1cd", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.165] lstrlenW (lpString=".jpg") returned 4 [0204.165] lstrcmpiW (lpString1=".jpg", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.165] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.165] lstrlenW (lpString=".doc") returned 4 [0204.165] lstrcmpiW (lpString1=".doc", lpString2="9d01") returned -1 [0204.165] lstrlenW (lpString=".docx") returned 5 [0204.166] lstrcmpiW (lpString1=".docx", lpString2="69d01") returned -1 [0204.166] lstrlenW (lpString=".pdf") returned 4 [0204.166] lstrcmpiW (lpString1=".pdf", lpString2="9d01") returned -1 [0204.166] lstrlenW (lpString=".xls") returned 4 [0204.166] lstrcmpiW (lpString1=".xls", lpString2="9d01") returned -1 [0204.166] lstrlenW (lpString=".xlsx") returned 5 [0204.166] lstrcmpiW (lpString1=".xlsx", lpString2="69d01") returned -1 [0204.166] lstrlenW (lpString=".ppt") returned 4 [0204.166] lstrcmpiW (lpString1=".ppt", lpString2="9d01") returned -1 [0204.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.166] lstrlenW (lpString=".zip") returned 4 [0204.166] lstrcmpiW (lpString1=".zip", lpString2="9d01") returned -1 [0204.166] lstrlenW (lpString=".rar") returned 4 [0204.166] lstrcmpiW (lpString1=".rar", lpString2="9d01") returned -1 [0204.166] lstrlenW (lpString=".bz2") returned 4 [0204.166] lstrcmpiW (lpString1=".bz2", lpString2="9d01") returned -1 [0204.166] lstrlenW (lpString=".7z") returned 3 [0204.166] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.166] lstrlenW (lpString=".dbf") returned 4 [0204.166] lstrcmpiW (lpString1=".dbf", lpString2="9d01") returned -1 [0204.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.166] lstrlenW (lpString=".1cd") returned 4 [0204.166] lstrcmpiW (lpString1=".1cd", lpString2="9d01") returned -1 [0204.166] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\D\\08\\71469d01") returned 105 [0204.166] lstrlenW (lpString=".jpg") returned 4 [0204.166] lstrcmpiW (lpString1=".jpg", lpString2="9d01") returned -1 [0204.166] lstrcmpiW (lpString1=".default\\Cache\\E\\69\\885EEd01", lpString2=".wiki") returned -1 [0204.167] lstrlenW (lpString="885EEd01") returned 8 [0204.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0204.167] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=68898) returned 1 [0204.167] CloseHandle (hObject=0x34c) returned 1 [0204.167] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01")) returned 0x2020 [0204.167] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.167] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0204.167] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.167] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.168] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0204.168] GetLastError () returned 0x0 [0204.168] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x10d22, lpOverlapped=0x0) returned 1 [0204.209] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x10d30, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x10d30, lpOverlapped=0x0) returned 1 [0204.210] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.210] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.211] SetEndOfFile (hFile=0x15c) returned 1 [0204.211] CloseHandle (hObject=0x15c) returned 1 [0204.211] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.211] SetEndOfFile (hFile=0x34c) returned 1 [0204.212] CloseHandle (hObject=0x34c) returned 1 [0204.212] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.212] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\e\\69\\885eed01")) returned 1 [0204.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.212] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.212] lstrlenW (lpString=".doc") returned 4 [0204.212] lstrcmpiW (lpString1=".doc", lpString2="Ed01") returned -1 [0204.213] lstrlenW (lpString=".docx") returned 5 [0204.213] lstrcmpiW (lpString1=".docx", lpString2="EEd01") returned -1 [0204.213] lstrlenW (lpString=".pdf") returned 4 [0204.213] lstrcmpiW (lpString1=".pdf", lpString2="Ed01") returned -1 [0204.213] lstrlenW (lpString=".xls") returned 4 [0204.213] lstrcmpiW (lpString1=".xls", lpString2="Ed01") returned -1 [0204.213] lstrlenW (lpString=".xlsx") returned 5 [0204.213] lstrcmpiW (lpString1=".xlsx", lpString2="EEd01") returned -1 [0204.213] lstrlenW (lpString=".ppt") returned 4 [0204.213] lstrcmpiW (lpString1=".ppt", lpString2="Ed01") returned -1 [0204.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.213] lstrlenW (lpString=".zip") returned 4 [0204.213] lstrcmpiW (lpString1=".zip", lpString2="Ed01") returned -1 [0204.213] lstrlenW (lpString=".rar") returned 4 [0204.213] lstrcmpiW (lpString1=".rar", lpString2="Ed01") returned -1 [0204.213] lstrlenW (lpString=".bz2") returned 4 [0204.213] lstrcmpiW (lpString1=".bz2", lpString2="Ed01") returned -1 [0204.213] lstrlenW (lpString=".7z") returned 3 [0204.213] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.213] lstrlenW (lpString=".dbf") returned 4 [0204.213] lstrcmpiW (lpString1=".dbf", lpString2="Ed01") returned -1 [0204.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.213] lstrlenW (lpString=".1cd") returned 4 [0204.213] lstrcmpiW (lpString1=".1cd", lpString2="Ed01") returned -1 [0204.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.213] lstrlenW (lpString=".jpg") returned 4 [0204.213] lstrcmpiW (lpString1=".jpg", lpString2="Ed01") returned -1 [0204.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.213] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.213] lstrlenW (lpString=".doc") returned 4 [0204.213] lstrcmpiW (lpString1=".doc", lpString2="Ed01") returned -1 [0204.214] lstrlenW (lpString=".docx") returned 5 [0204.214] lstrcmpiW (lpString1=".docx", lpString2="EEd01") returned -1 [0204.214] lstrlenW (lpString=".pdf") returned 4 [0204.214] lstrcmpiW (lpString1=".pdf", lpString2="Ed01") returned -1 [0204.214] lstrlenW (lpString=".xls") returned 4 [0204.214] lstrcmpiW (lpString1=".xls", lpString2="Ed01") returned -1 [0204.214] lstrlenW (lpString=".xlsx") returned 5 [0204.214] lstrcmpiW (lpString1=".xlsx", lpString2="EEd01") returned -1 [0204.214] lstrlenW (lpString=".ppt") returned 4 [0204.214] lstrcmpiW (lpString1=".ppt", lpString2="Ed01") returned -1 [0204.214] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.214] lstrlenW (lpString=".zip") returned 4 [0204.214] lstrcmpiW (lpString1=".zip", lpString2="Ed01") returned -1 [0204.214] lstrlenW (lpString=".rar") returned 4 [0204.214] lstrcmpiW (lpString1=".rar", lpString2="Ed01") returned -1 [0204.214] lstrlenW (lpString=".bz2") returned 4 [0204.214] lstrcmpiW (lpString1=".bz2", lpString2="Ed01") returned -1 [0204.214] lstrlenW (lpString=".7z") returned 3 [0204.214] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.214] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.214] lstrlenW (lpString=".dbf") returned 4 [0204.214] lstrcmpiW (lpString1=".dbf", lpString2="Ed01") returned -1 [0204.214] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.214] lstrlenW (lpString=".1cd") returned 4 [0204.214] lstrcmpiW (lpString1=".1cd", lpString2="Ed01") returned -1 [0204.214] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\E\\69\\885EEd01") returned 105 [0204.214] lstrlenW (lpString=".jpg") returned 4 [0204.214] lstrcmpiW (lpString1=".jpg", lpString2="Ed01") returned -1 [0204.214] lstrcmpiW (lpString1=".default\\Cache\\F\\23\\7E0FEd01", lpString2=".wiki") returned -1 [0204.215] lstrlenW (lpString="7E0FEd01") returned 8 [0204.215] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0204.215] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=63624) returned 1 [0204.215] CloseHandle (hObject=0x34c) returned 1 [0204.216] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01")) returned 0x2020 [0204.216] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0204.216] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.216] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.216] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0204.217] GetLastError () returned 0x0 [0204.217] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0xf888, lpOverlapped=0x0) returned 1 [0204.219] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xf890, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xf890, lpOverlapped=0x0) returned 1 [0204.221] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.221] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.221] SetEndOfFile (hFile=0x15c) returned 1 [0204.221] CloseHandle (hObject=0x15c) returned 1 [0204.221] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.221] SetEndOfFile (hFile=0x34c) returned 1 [0204.223] CloseHandle (hObject=0x34c) returned 1 [0204.223] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.223] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\23\\7e0fed01")) returned 1 [0204.223] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.223] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.223] lstrlenW (lpString=".doc") returned 4 [0204.223] lstrcmpiW (lpString1=".doc", lpString2="Ed01") returned -1 [0204.223] lstrlenW (lpString=".docx") returned 5 [0204.223] lstrcmpiW (lpString1=".docx", lpString2="FEd01") returned -1 [0204.223] lstrlenW (lpString=".pdf") returned 4 [0204.223] lstrcmpiW (lpString1=".pdf", lpString2="Ed01") returned -1 [0204.223] lstrlenW (lpString=".xls") returned 4 [0204.223] lstrcmpiW (lpString1=".xls", lpString2="Ed01") returned -1 [0204.223] lstrlenW (lpString=".xlsx") returned 5 [0204.223] lstrcmpiW (lpString1=".xlsx", lpString2="FEd01") returned -1 [0204.223] lstrlenW (lpString=".ppt") returned 4 [0204.223] lstrcmpiW (lpString1=".ppt", lpString2="Ed01") returned -1 [0204.223] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.223] lstrlenW (lpString=".zip") returned 4 [0204.223] lstrcmpiW (lpString1=".zip", lpString2="Ed01") returned -1 [0204.223] lstrlenW (lpString=".rar") returned 4 [0204.224] lstrcmpiW (lpString1=".rar", lpString2="Ed01") returned -1 [0204.224] lstrlenW (lpString=".bz2") returned 4 [0204.224] lstrcmpiW (lpString1=".bz2", lpString2="Ed01") returned -1 [0204.224] lstrlenW (lpString=".7z") returned 3 [0204.224] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.224] lstrlenW (lpString=".dbf") returned 4 [0204.224] lstrcmpiW (lpString1=".dbf", lpString2="Ed01") returned -1 [0204.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.224] lstrlenW (lpString=".1cd") returned 4 [0204.224] lstrcmpiW (lpString1=".1cd", lpString2="Ed01") returned -1 [0204.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.224] lstrlenW (lpString=".jpg") returned 4 [0204.224] lstrcmpiW (lpString1=".jpg", lpString2="Ed01") returned -1 [0204.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.224] lstrlenW (lpString=".doc") returned 4 [0204.224] lstrcmpiW (lpString1=".doc", lpString2="Ed01") returned -1 [0204.224] lstrlenW (lpString=".docx") returned 5 [0204.224] lstrcmpiW (lpString1=".docx", lpString2="FEd01") returned -1 [0204.224] lstrlenW (lpString=".pdf") returned 4 [0204.224] lstrcmpiW (lpString1=".pdf", lpString2="Ed01") returned -1 [0204.224] lstrlenW (lpString=".xls") returned 4 [0204.224] lstrcmpiW (lpString1=".xls", lpString2="Ed01") returned -1 [0204.224] lstrlenW (lpString=".xlsx") returned 5 [0204.224] lstrcmpiW (lpString1=".xlsx", lpString2="FEd01") returned -1 [0204.224] lstrlenW (lpString=".ppt") returned 4 [0204.224] lstrcmpiW (lpString1=".ppt", lpString2="Ed01") returned -1 [0204.224] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.224] lstrlenW (lpString=".zip") returned 4 [0204.224] lstrcmpiW (lpString1=".zip", lpString2="Ed01") returned -1 [0204.224] lstrlenW (lpString=".rar") returned 4 [0204.224] lstrcmpiW (lpString1=".rar", lpString2="Ed01") returned -1 [0204.225] lstrlenW (lpString=".bz2") returned 4 [0204.225] lstrcmpiW (lpString1=".bz2", lpString2="Ed01") returned -1 [0204.225] lstrlenW (lpString=".7z") returned 3 [0204.225] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.225] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.225] lstrlenW (lpString=".dbf") returned 4 [0204.225] lstrcmpiW (lpString1=".dbf", lpString2="Ed01") returned -1 [0204.225] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.225] lstrlenW (lpString=".1cd") returned 4 [0204.225] lstrcmpiW (lpString1=".1cd", lpString2="Ed01") returned -1 [0204.225] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\23\\7E0FEd01") returned 105 [0204.225] lstrlenW (lpString=".jpg") returned 4 [0204.225] lstrcmpiW (lpString1=".jpg", lpString2="Ed01") returned -1 [0204.225] lstrcmpiW (lpString1=".default\\Cache\\F\\F0\\ECB2Dd01", lpString2=".wiki") returned -1 [0204.225] lstrlenW (lpString="ECB2Dd01") returned 8 [0204.225] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0204.226] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=43023) returned 1 [0204.226] CloseHandle (hObject=0x34c) returned 1 [0204.226] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01")) returned 0x2020 [0204.226] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0204.226] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.226] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.226] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0204.227] GetLastError () returned 0x0 [0204.227] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0xa80f, lpOverlapped=0x0) returned 1 [0204.544] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xa810, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xa810, lpOverlapped=0x0) returned 1 [0204.851] ReadFile (in: hFile=0x34c, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.851] WriteFile (in: hFile=0x15c, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.851] SetEndOfFile (hFile=0x15c) returned 1 [0204.851] CloseHandle (hObject=0x15c) returned 1 [0204.851] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.851] SetEndOfFile (hFile=0x34c) returned 1 [0204.852] CloseHandle (hObject=0x34c) returned 1 [0204.852] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.853] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\f\\f0\\ecb2dd01")) returned 1 [0204.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.853] lstrlenW (lpString=".doc") returned 4 [0204.853] lstrcmpiW (lpString1=".doc", lpString2="Dd01") returned -1 [0204.853] lstrlenW (lpString=".docx") returned 5 [0204.853] lstrcmpiW (lpString1=".docx", lpString2="2Dd01") returned -1 [0204.853] lstrlenW (lpString=".pdf") returned 4 [0204.853] lstrcmpiW (lpString1=".pdf", lpString2="Dd01") returned -1 [0204.853] lstrlenW (lpString=".xls") returned 4 [0204.853] lstrcmpiW (lpString1=".xls", lpString2="Dd01") returned -1 [0204.853] lstrlenW (lpString=".xlsx") returned 5 [0204.853] lstrcmpiW (lpString1=".xlsx", lpString2="2Dd01") returned -1 [0204.853] lstrlenW (lpString=".ppt") returned 4 [0204.853] lstrcmpiW (lpString1=".ppt", lpString2="Dd01") returned -1 [0204.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.853] lstrlenW (lpString=".zip") returned 4 [0204.853] lstrcmpiW (lpString1=".zip", lpString2="Dd01") returned -1 [0204.853] lstrlenW (lpString=".rar") returned 4 [0204.853] lstrcmpiW (lpString1=".rar", lpString2="Dd01") returned -1 [0204.853] lstrlenW (lpString=".bz2") returned 4 [0204.853] lstrcmpiW (lpString1=".bz2", lpString2="Dd01") returned -1 [0204.853] lstrlenW (lpString=".7z") returned 3 [0204.853] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.853] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.854] lstrlenW (lpString=".dbf") returned 4 [0204.854] lstrcmpiW (lpString1=".dbf", lpString2="Dd01") returned -1 [0204.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.854] lstrlenW (lpString=".1cd") returned 4 [0204.854] lstrcmpiW (lpString1=".1cd", lpString2="Dd01") returned -1 [0204.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.854] lstrlenW (lpString=".jpg") returned 4 [0204.854] lstrcmpiW (lpString1=".jpg", lpString2="Dd01") returned -1 [0204.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.854] lstrlenW (lpString=".doc") returned 4 [0204.854] lstrcmpiW (lpString1=".doc", lpString2="Dd01") returned -1 [0204.854] lstrlenW (lpString=".docx") returned 5 [0204.854] lstrcmpiW (lpString1=".docx", lpString2="2Dd01") returned -1 [0204.854] lstrlenW (lpString=".pdf") returned 4 [0204.854] lstrcmpiW (lpString1=".pdf", lpString2="Dd01") returned -1 [0204.854] lstrlenW (lpString=".xls") returned 4 [0204.854] lstrcmpiW (lpString1=".xls", lpString2="Dd01") returned -1 [0204.854] lstrlenW (lpString=".xlsx") returned 5 [0204.854] lstrcmpiW (lpString1=".xlsx", lpString2="2Dd01") returned -1 [0204.854] lstrlenW (lpString=".ppt") returned 4 [0204.854] lstrcmpiW (lpString1=".ppt", lpString2="Dd01") returned -1 [0204.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.854] lstrlenW (lpString=".zip") returned 4 [0204.854] lstrcmpiW (lpString1=".zip", lpString2="Dd01") returned -1 [0204.854] lstrlenW (lpString=".rar") returned 4 [0204.854] lstrcmpiW (lpString1=".rar", lpString2="Dd01") returned -1 [0204.854] lstrlenW (lpString=".bz2") returned 4 [0204.854] lstrcmpiW (lpString1=".bz2", lpString2="Dd01") returned -1 [0204.854] lstrlenW (lpString=".7z") returned 3 [0204.854] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.854] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.854] lstrlenW (lpString=".dbf") returned 4 [0204.855] lstrcmpiW (lpString1=".dbf", lpString2="Dd01") returned -1 [0204.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.855] lstrlenW (lpString=".1cd") returned 4 [0204.855] lstrcmpiW (lpString1=".1cd", lpString2="Dd01") returned -1 [0204.855] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\F\\F0\\ECB2Dd01") returned 105 [0204.855] lstrlenW (lpString=".jpg") returned 4 [0204.855] lstrcmpiW (lpString1=".jpg", lpString2="Dd01") returned -1 [0204.855] lstrcmpiW (lpString1=".default\\Cache\\_CACHE_MAP_", lpString2=".wiki") returned -1 [0204.855] lstrlenW (lpString="_CACHE_MAP_") returned 11 [0204.855] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0205.050] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=8468) returned 1 [0205.050] CloseHandle (hObject=0x348) returned 1 [0205.050] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_")) returned 0x2020 [0205.050] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0205.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0205.051] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.051] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0205.051] GetLastError () returned 0x0 [0205.051] ReadFile (in: hFile=0x348, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x2114, lpOverlapped=0x0) returned 1 [0205.053] WriteFile (in: hFile=0x324, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0x2120, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0x2120, lpOverlapped=0x0) returned 1 [0205.054] ReadFile (in: hFile=0x348, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x0, lpOverlapped=0x0) returned 1 [0205.054] WriteFile (in: hFile=0x324, lpBuffer=0x3ff0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesWritten=0x360fc9c*=0xea, lpOverlapped=0x0) returned 1 [0205.055] SetEndOfFile (hFile=0x324) returned 1 [0205.055] CloseHandle (hObject=0x324) returned 1 [0205.055] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.055] SetEndOfFile (hFile=0x348) returned 1 [0205.056] CloseHandle (hObject=0x348) returned 1 [0205.056] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0205.056] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_map_")) returned 1 [0205.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.056] lstrlenW (lpString=".doc") returned 4 [0205.056] lstrcmpiW (lpString1=".doc", lpString2="MAP_") returned -1 [0205.056] lstrlenW (lpString=".docx") returned 5 [0205.056] lstrcmpiW (lpString1=".docx", lpString2="_MAP_") returned -1 [0205.056] lstrlenW (lpString=".pdf") returned 4 [0205.056] lstrcmpiW (lpString1=".pdf", lpString2="MAP_") returned -1 [0205.056] lstrlenW (lpString=".xls") returned 4 [0205.056] lstrcmpiW (lpString1=".xls", lpString2="MAP_") returned -1 [0205.056] lstrlenW (lpString=".xlsx") returned 5 [0205.056] lstrcmpiW (lpString1=".xlsx", lpString2="_MAP_") returned -1 [0205.056] lstrlenW (lpString=".ppt") returned 4 [0205.056] lstrcmpiW (lpString1=".ppt", lpString2="MAP_") returned -1 [0205.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.056] lstrlenW (lpString=".zip") returned 4 [0205.057] lstrcmpiW (lpString1=".zip", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString=".rar") returned 4 [0205.057] lstrcmpiW (lpString1=".rar", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString=".bz2") returned 4 [0205.057] lstrcmpiW (lpString1=".bz2", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString=".7z") returned 3 [0205.057] lstrcmpiW (lpString1=".7z", lpString2="AP_") returned -1 [0205.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.057] lstrlenW (lpString=".dbf") returned 4 [0205.057] lstrcmpiW (lpString1=".dbf", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.057] lstrlenW (lpString=".1cd") returned 4 [0205.057] lstrcmpiW (lpString1=".1cd", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.057] lstrlenW (lpString=".jpg") returned 4 [0205.057] lstrcmpiW (lpString1=".jpg", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.057] lstrlenW (lpString=".doc") returned 4 [0205.057] lstrcmpiW (lpString1=".doc", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString=".docx") returned 5 [0205.057] lstrcmpiW (lpString1=".docx", lpString2="_MAP_") returned -1 [0205.057] lstrlenW (lpString=".pdf") returned 4 [0205.057] lstrcmpiW (lpString1=".pdf", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString=".xls") returned 4 [0205.057] lstrcmpiW (lpString1=".xls", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString=".xlsx") returned 5 [0205.057] lstrcmpiW (lpString1=".xlsx", lpString2="_MAP_") returned -1 [0205.057] lstrlenW (lpString=".ppt") returned 4 [0205.057] lstrcmpiW (lpString1=".ppt", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.057] lstrlenW (lpString=".zip") returned 4 [0205.057] lstrcmpiW (lpString1=".zip", lpString2="MAP_") returned -1 [0205.057] lstrlenW (lpString=".rar") returned 4 [0205.057] lstrcmpiW (lpString1=".rar", lpString2="MAP_") returned -1 [0205.058] lstrlenW (lpString=".bz2") returned 4 [0205.058] lstrcmpiW (lpString1=".bz2", lpString2="MAP_") returned -1 [0205.058] lstrlenW (lpString=".7z") returned 3 [0205.058] lstrcmpiW (lpString1=".7z", lpString2="AP_") returned -1 [0205.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.058] lstrlenW (lpString=".dbf") returned 4 [0205.058] lstrcmpiW (lpString1=".dbf", lpString2="MAP_") returned -1 [0205.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.058] lstrlenW (lpString=".1cd") returned 4 [0205.058] lstrcmpiW (lpString1=".1cd", lpString2="MAP_") returned -1 [0205.058] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_MAP_") returned 103 [0205.058] lstrlenW (lpString=".jpg") returned 4 [0205.058] lstrcmpiW (lpString1=".jpg", lpString2="MAP_") returned -1 [0205.058] lstrcmpiW (lpString1=".sqlite", lpString2=".wiki") returned -1 [0205.058] lstrlenW (lpString="index.sqlite") returned 12 [0205.058] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0205.059] GetFileSizeEx (in: hFile=0x348, lpFileSize=0x360ff1c | out: lpFileSize=0x360ff1c*=262144) returned 1 [0205.059] CloseHandle (hObject=0x348) returned 1 [0205.059] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite")) returned 0x2020 [0205.059] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0205.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x348 [0205.059] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.059] SetFilePointerEx (in: hFile=0x348, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x360fec8 | out: lpNewFilePointer=0x0) returned 1 [0205.059] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\OfflineCache\\index.sqlite.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\offlinecache\\index.sqlite.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x324 [0205.060] GetLastError () returned 0x0 [0205.060] ReadFile (in: hFile=0x348, lpBuffer=0x3ff0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x360fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ff0020*, lpNumberOfBytesRead=0x360fed4*=0x40000, lpOverlapped=0x0) returned 1 [0205.066] WriteFile (hFile=0x324, lpBuffer=0x3ff0020, nNumberOfBytesToWrite=0x40010, lpNumberOfBytesWritten=0x360fc9c, lpOverlapped=0x0) Thread: id = 75 os_tid = 0x578 [0183.695] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x3946430 [0183.695] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x4100048 [0183.696] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e3700 [0183.696] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6) returned 0x3221f8 [0183.696] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e3718 [0183.696] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x4300020 [0183.696] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e3730 [0183.696] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2e3730, Size=0x20) returned 0x3655c8 [0183.697] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e3730 [0183.697] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2e3730, Size=0x20) returned 0x365690 [0183.697] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.697] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.697] Wow64DisableWow64FsRedirection (in: OldValue=0x385ff58 | out: OldValue=0x385ff58*=0x0) returned 1 [0183.697] lstrlenW (lpString="kernel32.dll") returned 12 [0183.697] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x3655c8 | out: hHeap=0x270000) returned 1 [0183.697] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.697] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x365690 | out: hHeap=0x270000) returned 1 [0183.697] Sleep (dwMilliseconds=0x64) [0183.997] lstrcmpiW (lpString1=".ttf", lpString2=".wiki") returned -1 [0183.997] lstrlenW (lpString="kor_boot.ttf") returned 12 [0183.997] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0184.101] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=2371360) returned 1 [0184.101] CloseHandle (hObject=0x300) returned 1 [0184.101] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0184.101] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.101] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.102] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.102] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.102] lstrlenW (lpString=".doc") returned 4 [0184.102] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0184.102] lstrlenW (lpString=".docx") returned 5 [0184.102] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0184.102] lstrlenW (lpString=".pdf") returned 4 [0184.102] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0184.102] lstrlenW (lpString=".xls") returned 4 [0184.102] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0184.102] lstrlenW (lpString=".xlsx") returned 5 [0184.102] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0184.102] lstrlenW (lpString=".ppt") returned 4 [0184.102] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0184.102] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.102] lstrlenW (lpString=".zip") returned 4 [0184.102] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0184.102] lstrlenW (lpString=".rar") returned 4 [0184.102] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0184.102] lstrlenW (lpString=".bz2") returned 4 [0184.102] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0184.102] lstrlenW (lpString=".7z") returned 3 [0184.102] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0184.102] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.102] lstrlenW (lpString=".dbf") returned 4 [0184.102] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0184.102] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.102] lstrlenW (lpString=".1cd") returned 4 [0184.102] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0184.102] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.102] lstrlenW (lpString=".jpg") returned 4 [0184.103] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0184.103] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.103] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.103] lstrlenW (lpString=".doc") returned 4 [0184.103] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0184.103] lstrlenW (lpString=".docx") returned 5 [0184.103] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0184.103] lstrlenW (lpString=".pdf") returned 4 [0184.103] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0184.103] lstrlenW (lpString=".xls") returned 4 [0184.103] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0184.103] lstrlenW (lpString=".xlsx") returned 5 [0184.103] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0184.103] lstrlenW (lpString=".ppt") returned 4 [0184.103] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0184.103] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.103] lstrlenW (lpString=".zip") returned 4 [0184.103] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0184.103] lstrlenW (lpString=".rar") returned 4 [0184.103] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0184.103] lstrlenW (lpString=".bz2") returned 4 [0184.103] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0184.103] lstrlenW (lpString=".7z") returned 3 [0184.103] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0184.103] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.103] lstrlenW (lpString=".dbf") returned 4 [0184.103] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0184.103] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.103] lstrlenW (lpString=".1cd") returned 4 [0184.103] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0184.103] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0184.103] lstrlenW (lpString=".jpg") returned 4 [0184.103] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0184.104] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0184.104] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0184.104] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0184.104] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=93248) returned 1 [0184.104] CloseHandle (hObject=0x300) returned 1 [0184.104] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0184.104] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.104] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.104] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.104] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.104] lstrlenW (lpString=".doc") returned 4 [0184.104] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.104] lstrlenW (lpString=".docx") returned 5 [0184.104] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0184.105] lstrlenW (lpString=".pdf") returned 4 [0184.105] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.105] lstrlenW (lpString=".xls") returned 4 [0184.105] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.105] lstrlenW (lpString=".xlsx") returned 5 [0184.105] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0184.105] lstrlenW (lpString=".ppt") returned 4 [0184.105] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.105] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.105] lstrlenW (lpString=".zip") returned 4 [0184.105] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.105] lstrlenW (lpString=".rar") returned 4 [0184.105] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.105] lstrlenW (lpString=".bz2") returned 4 [0184.105] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.105] lstrlenW (lpString=".7z") returned 3 [0184.105] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.105] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.105] lstrlenW (lpString=".dbf") returned 4 [0184.105] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.105] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.105] lstrlenW (lpString=".1cd") returned 4 [0184.105] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.105] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.105] lstrlenW (lpString=".jpg") returned 4 [0184.105] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.105] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.105] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.105] lstrlenW (lpString=".doc") returned 4 [0184.105] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.105] lstrlenW (lpString=".docx") returned 5 [0184.105] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0184.105] lstrlenW (lpString=".pdf") returned 4 [0184.106] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.106] lstrlenW (lpString=".xls") returned 4 [0184.106] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.106] lstrlenW (lpString=".xlsx") returned 5 [0184.106] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0184.106] lstrlenW (lpString=".ppt") returned 4 [0184.106] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.106] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.106] lstrlenW (lpString=".zip") returned 4 [0184.106] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.106] lstrlenW (lpString=".rar") returned 4 [0184.106] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.106] lstrlenW (lpString=".bz2") returned 4 [0184.106] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.106] lstrlenW (lpString=".7z") returned 3 [0184.106] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.106] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.106] lstrlenW (lpString=".dbf") returned 4 [0184.106] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.106] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.106] lstrlenW (lpString=".1cd") returned 4 [0184.106] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.106] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0184.106] lstrlenW (lpString=".jpg") returned 4 [0184.106] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.106] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0184.106] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0184.106] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0184.107] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=90688) returned 1 [0184.107] CloseHandle (hObject=0x300) returned 1 [0184.107] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0184.107] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.107] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.107] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.107] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.107] lstrlenW (lpString=".doc") returned 4 [0184.107] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.107] lstrlenW (lpString=".docx") returned 5 [0184.107] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0184.107] lstrlenW (lpString=".pdf") returned 4 [0184.107] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.107] lstrlenW (lpString=".xls") returned 4 [0184.107] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.107] lstrlenW (lpString=".xlsx") returned 5 [0184.107] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0184.107] lstrlenW (lpString=".ppt") returned 4 [0184.107] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.107] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.107] lstrlenW (lpString=".zip") returned 4 [0184.107] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.108] lstrlenW (lpString=".rar") returned 4 [0184.108] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.108] lstrlenW (lpString=".bz2") returned 4 [0184.108] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.108] lstrlenW (lpString=".7z") returned 3 [0184.108] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.108] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.108] lstrlenW (lpString=".dbf") returned 4 [0184.108] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.108] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.108] lstrlenW (lpString=".1cd") returned 4 [0184.108] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.108] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.108] lstrlenW (lpString=".jpg") returned 4 [0184.108] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.108] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.108] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.108] lstrlenW (lpString=".doc") returned 4 [0184.108] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.108] lstrlenW (lpString=".docx") returned 5 [0184.108] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0184.108] lstrlenW (lpString=".pdf") returned 4 [0184.108] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.108] lstrlenW (lpString=".xls") returned 4 [0184.108] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.108] lstrlenW (lpString=".xlsx") returned 5 [0184.108] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0184.108] lstrlenW (lpString=".ppt") returned 4 [0184.108] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.108] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.108] lstrlenW (lpString=".zip") returned 4 [0184.109] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.109] lstrlenW (lpString=".rar") returned 4 [0184.109] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.109] lstrlenW (lpString=".bz2") returned 4 [0184.109] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.109] lstrlenW (lpString=".7z") returned 3 [0184.109] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.109] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.109] lstrlenW (lpString=".dbf") returned 4 [0184.109] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.109] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.109] lstrlenW (lpString=".1cd") returned 4 [0184.109] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.109] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0184.109] lstrlenW (lpString=".jpg") returned 4 [0184.109] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.109] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0184.109] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0184.109] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0184.109] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=90704) returned 1 [0184.110] CloseHandle (hObject=0x300) returned 1 [0184.110] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0184.110] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.110] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.110] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.110] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.110] lstrlenW (lpString=".doc") returned 4 [0184.110] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.110] lstrlenW (lpString=".docx") returned 5 [0184.110] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0184.110] lstrlenW (lpString=".pdf") returned 4 [0184.110] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.110] lstrlenW (lpString=".xls") returned 4 [0184.110] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.110] lstrlenW (lpString=".xlsx") returned 5 [0184.110] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0184.110] lstrlenW (lpString=".ppt") returned 4 [0184.110] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.110] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.110] lstrlenW (lpString=".zip") returned 4 [0184.110] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.110] lstrlenW (lpString=".rar") returned 4 [0184.110] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.110] lstrlenW (lpString=".bz2") returned 4 [0184.110] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.110] lstrlenW (lpString=".7z") returned 3 [0184.110] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.110] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.111] lstrlenW (lpString=".dbf") returned 4 [0184.111] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.111] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.111] lstrlenW (lpString=".1cd") returned 4 [0184.111] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.111] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.111] lstrlenW (lpString=".jpg") returned 4 [0184.111] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.111] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.111] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.111] lstrlenW (lpString=".doc") returned 4 [0184.111] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.111] lstrlenW (lpString=".docx") returned 5 [0184.111] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0184.111] lstrlenW (lpString=".pdf") returned 4 [0184.111] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.111] lstrlenW (lpString=".xls") returned 4 [0184.111] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.111] lstrlenW (lpString=".xlsx") returned 5 [0184.111] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0184.111] lstrlenW (lpString=".ppt") returned 4 [0184.111] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.111] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.111] lstrlenW (lpString=".zip") returned 4 [0184.111] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.111] lstrlenW (lpString=".rar") returned 4 [0184.111] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.111] lstrlenW (lpString=".bz2") returned 4 [0184.111] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.111] lstrlenW (lpString=".7z") returned 3 [0184.111] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.111] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.112] lstrlenW (lpString=".dbf") returned 4 [0184.112] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.112] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.112] lstrlenW (lpString=".1cd") returned 4 [0184.112] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.112] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0184.112] lstrlenW (lpString=".jpg") returned 4 [0184.112] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.112] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0184.112] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0184.112] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0184.112] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=76352) returned 1 [0184.112] CloseHandle (hObject=0x300) returned 1 [0184.112] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0184.112] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.112] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.112] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.113] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.113] lstrlenW (lpString=".doc") returned 4 [0184.113] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.113] lstrlenW (lpString=".docx") returned 5 [0184.113] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0184.113] lstrlenW (lpString=".pdf") returned 4 [0184.113] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.113] lstrlenW (lpString=".xls") returned 4 [0184.113] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.113] lstrlenW (lpString=".xlsx") returned 5 [0184.113] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0184.113] lstrlenW (lpString=".ppt") returned 4 [0184.113] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.113] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.113] lstrlenW (lpString=".zip") returned 4 [0184.113] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.113] lstrlenW (lpString=".rar") returned 4 [0184.113] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.113] lstrlenW (lpString=".bz2") returned 4 [0184.113] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.113] lstrlenW (lpString=".7z") returned 3 [0184.113] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.113] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.113] lstrlenW (lpString=".dbf") returned 4 [0184.113] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.113] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.113] lstrlenW (lpString=".1cd") returned 4 [0184.113] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.113] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.113] lstrlenW (lpString=".jpg") returned 4 [0184.113] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.113] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.113] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.113] lstrlenW (lpString=".doc") returned 4 [0184.114] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.114] lstrlenW (lpString=".docx") returned 5 [0184.114] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0184.114] lstrlenW (lpString=".pdf") returned 4 [0184.114] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.114] lstrlenW (lpString=".xls") returned 4 [0184.114] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.114] lstrlenW (lpString=".xlsx") returned 5 [0184.114] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0184.114] lstrlenW (lpString=".ppt") returned 4 [0184.114] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.114] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.114] lstrlenW (lpString=".zip") returned 4 [0184.114] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.114] lstrlenW (lpString=".rar") returned 4 [0184.114] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.114] lstrlenW (lpString=".bz2") returned 4 [0184.114] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.114] lstrlenW (lpString=".7z") returned 3 [0184.114] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.114] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.114] lstrlenW (lpString=".dbf") returned 4 [0184.114] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.114] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.114] lstrlenW (lpString=".1cd") returned 4 [0184.114] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.114] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0184.114] lstrlenW (lpString=".jpg") returned 4 [0184.114] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.114] lstrcmpiW (lpString1=".mui", lpString2=".wiki") returned -1 [0184.115] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0184.115] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0184.115] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=75344) returned 1 [0184.115] CloseHandle (hObject=0x300) returned 1 [0184.115] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0184.115] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.115] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.115] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.115] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.115] lstrlenW (lpString=".doc") returned 4 [0184.115] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.115] lstrlenW (lpString=".docx") returned 5 [0184.115] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0184.115] lstrlenW (lpString=".pdf") returned 4 [0184.115] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.115] lstrlenW (lpString=".xls") returned 4 [0184.115] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.115] lstrlenW (lpString=".xlsx") returned 5 [0184.116] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0184.116] lstrlenW (lpString=".ppt") returned 4 [0184.116] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.116] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.116] lstrlenW (lpString=".zip") returned 4 [0184.116] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.116] lstrlenW (lpString=".rar") returned 4 [0184.116] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.116] lstrlenW (lpString=".bz2") returned 4 [0184.116] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.116] lstrlenW (lpString=".7z") returned 3 [0184.116] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.116] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.116] lstrlenW (lpString=".dbf") returned 4 [0184.116] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.116] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.116] lstrlenW (lpString=".1cd") returned 4 [0184.116] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.116] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.116] lstrlenW (lpString=".jpg") returned 4 [0184.116] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.116] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.116] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.116] lstrlenW (lpString=".doc") returned 4 [0184.116] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0184.116] lstrlenW (lpString=".docx") returned 5 [0184.116] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0184.116] lstrlenW (lpString=".pdf") returned 4 [0184.116] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0184.116] lstrlenW (lpString=".xls") returned 4 [0184.116] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0184.116] lstrlenW (lpString=".xlsx") returned 5 [0184.117] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0184.117] lstrlenW (lpString=".ppt") returned 4 [0184.117] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0184.117] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.117] lstrlenW (lpString=".zip") returned 4 [0184.117] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0184.117] lstrlenW (lpString=".rar") returned 4 [0184.117] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0184.117] lstrlenW (lpString=".bz2") returned 4 [0184.117] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0184.117] lstrlenW (lpString=".7z") returned 3 [0184.117] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0184.117] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.117] lstrlenW (lpString=".dbf") returned 4 [0184.117] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0184.117] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.117] lstrlenW (lpString=".1cd") returned 4 [0184.117] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0184.117] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0184.117] lstrlenW (lpString=".jpg") returned 4 [0184.117] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0184.117] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0184.117] lstrlenW (lpString="memtest.exe") returned 11 [0184.117] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x300 [0184.118] GetFileSizeEx (in: hFile=0x300, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=485760) returned 1 [0184.118] CloseHandle (hObject=0x300) returned 1 [0184.118] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0184.118] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.118] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.118] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0184.118] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0184.118] lstrlenW (lpString=".doc") returned 4 [0184.118] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0184.118] lstrlenW (lpString=".docx") returned 5 [0184.118] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0184.118] lstrlenW (lpString=".pdf") returned 4 [0184.118] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0184.118] lstrlenW (lpString=".xls") returned 4 [0184.118] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0184.118] lstrlenW (lpString=".xlsx") returned 5 [0184.118] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0184.118] lstrlenW (lpString=".ppt") returned 4 [0184.118] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0184.118] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0184.118] lstrlenW (lpString=".zip") returned 4 [0184.118] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0184.118] lstrlenW (lpString=".rar") returned 4 [0184.118] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0184.118] lstrlenW (lpString=".bz2") returned 4 [0184.119] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0184.119] lstrlenW (lpString=".7z") returned 3 [0184.119] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0184.133] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.003] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.008] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.027] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.360] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0186.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0186.885] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0186.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0186.899] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0186.906] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0186.919] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0186.920] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0186.926] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0186.927] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.104] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.160] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\Journal.exe" (normalized: "c:\\program files\\windows journal\\journal.exe"), lpNewFileName="C:\\Program Files\\Windows Journal\\Journal.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows journal\\journal.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Journal\\NBDoc.DLL" (normalized: "c:\\program files\\windows journal\\nbdoc.dll"), lpNewFileName="C:\\Program Files\\Windows Journal\\NBDoc.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows journal\\nbdoc.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.166] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Mail\\msoe.dll" (normalized: "c:\\program files\\windows mail\\msoe.dll"), lpNewFileName="C:\\Program Files\\Windows Mail\\msoe.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows mail\\msoe.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.167] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Mail\\MSOERES.dll" (normalized: "c:\\program files\\windows mail\\msoeres.dll"), lpNewFileName="C:\\Program Files\\Windows Mail\\MSOERES.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows mail\\msoeres.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.175] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Media Player\\setup_wm.exe" (normalized: "c:\\program files\\windows media player\\setup_wm.exe"), lpNewFileName="C:\\Program Files\\Windows Media Player\\setup_wm.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows media player\\setup_wm.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.179] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe"), lpNewFileName="C:\\Program Files\\Windows NT\\Accessories\\wordpad.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows nt\\accessories\\wordpad.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0189.184] MoveFileW (lpExistingFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll"), lpNewFileName="C:\\Program Files\\Windows Photo Viewer\\PhotoViewer.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\windows photo viewer\\photoviewer.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.977] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prcr.x3d"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\plug_ins3d\\prcr.x3d.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\plug_ins3d\\prcr.x3d.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.977] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\rt3d.dll" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rt3d.dll"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\rt3d.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\rt3d.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.982] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeFanHeitiStd-Bold.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobefanheitistd-bold.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.982] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeGothicStd-Bold.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobegothicstd-bold.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.982] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeHeitiStd-Regular.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobeheitistd-regular.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.982] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMingStd-Light.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemingstd-light.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.983] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeMyungjoStd-Medium.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobemyungjostd-medium.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.984] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\AdobeSongStd-Light.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\adobesongstd-light.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.985] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozGoPr6N-Medium.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozgopr6n-medium.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0191.986] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\CIDFont\\KozMinPr6N-Regular.otf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\cidfont\\kozminpr6n-regular.otf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0192.203] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara131.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara131.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\ara131.lex.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\ara131.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.960] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mraut.dll" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\ink\\mraut.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0194.740] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\microsoft shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0194.742] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.csd"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.CSD.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.csd.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0194.744] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.tts"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.TTS.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.tts.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0194.744] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.unt"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.UNT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.unt.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0194.745] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.wih"), lpNewFileName="C:\\Program Files (x86)\\Common Files\\SpeechEngines\\Microsoft\\TTS20\\en-US\\enu-dsk\\M1033DSK.WIH.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\common files\\speechengines\\microsoft\\tts20\\en-us\\enu-dsk\\m1033dsk.wih.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.240] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\classes.jsa"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\classes.jsa.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.240] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\classes.jsa", dwFileAttributes=0x20) returned 0 [0195.240] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\jvm.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\jvm.dll"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\client\\jvm.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\client\\jvm.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0195.269] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jfxwebkit.dll" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jfxwebkit.dll"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\bin\\jfxwebkit.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\bin\\jfxwebkit.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.733] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\gkmedias.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\gkmedias.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\gkmedias.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\gkmedias.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0197.752] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozjs.dll" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozjs.dll"), lpNewFileName="C:\\Program Files (x86)\\Mozilla Firefox\\mozjs.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\mozilla firefox\\mozjs.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0198.358] MoveFileW (lpExistingFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp"), lpNewFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0198.359] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrupd10116_mui.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0198.359] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc6c | out: lpNewFilePointer=0x0) returned 1 [0198.359] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc2c | out: lpNewFilePointer=0x0) returned 1 [0198.359] ReadFile (in: hFile=0x354, lpBuffer=0x4300058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc38, lpOverlapped=0x0 | out: lpBuffer=0x4300058*, lpNumberOfBytesRead=0x385fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.365] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x589aaa, lpNewFilePointer=0x0, dwMoveMethod=0x385fc2c | out: lpNewFilePointer=0x0) returned 1 [0198.365] ReadFile (in: hFile=0x354, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc38, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x385fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.371] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x385fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0198.371] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x105d000, lpNewFilePointer=0x0, dwMoveMethod=0x385fc2c | out: lpNewFilePointer=0x0) returned 1 [0198.371] ReadFile (in: hFile=0x354, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc38, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x385fc38*=0x40000, lpOverlapped=0x0) returned 1 [0198.389] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0198.389] WriteFile (in: hFile=0x354, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xc011a, lpNumberOfBytesWritten=0x385fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fcb0*=0xc011a, lpOverlapped=0x0) returned 1 [0198.548] SetEndOfFile (hFile=0x354) returned 1 [0198.548] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40000) returned 0x4130060 [0198.551] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc7c | out: lpNewFilePointer=0x0) returned 1 [0198.551] WriteFile (in: hFile=0x354, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x385fc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x385fc88*=0x40000, lpOverlapped=0x0) returned 1 [0198.552] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x589aaa, lpNewFilePointer=0x0, dwMoveMethod=0x385fc7c | out: lpNewFilePointer=0x0) returned 1 [0198.552] WriteFile (in: hFile=0x354, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x385fc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x385fc88*=0x40000, lpOverlapped=0x0) returned 1 [0198.553] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x105d000, lpNewFilePointer=0x0, dwMoveMethod=0x385fc7c | out: lpNewFilePointer=0x0) returned 1 [0198.553] WriteFile (in: hFile=0x354, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x385fc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x385fc88*=0x40000, lpOverlapped=0x0) returned 1 [0198.555] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x4130060 | out: hHeap=0x270000) returned 1 [0198.555] CloseHandle (hObject=0x354) returned 1 [0198.555] SetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.556] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.556] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.556] lstrlenW (lpString=".doc") returned 4 [0198.556] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0198.556] lstrlenW (lpString=".docx") returned 5 [0198.556] lstrcmpiW (lpString1=".docx", lpString2="I.msp") returned -1 [0198.556] lstrlenW (lpString=".pdf") returned 4 [0198.556] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0198.556] lstrlenW (lpString=".xls") returned 4 [0198.556] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0198.556] lstrlenW (lpString=".xlsx") returned 5 [0198.556] lstrcmpiW (lpString1=".xlsx", lpString2="I.msp") returned -1 [0198.556] lstrlenW (lpString=".ppt") returned 4 [0198.556] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0198.556] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.556] lstrlenW (lpString=".zip") returned 4 [0198.556] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0198.556] lstrlenW (lpString=".rar") returned 4 [0198.556] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0198.556] lstrlenW (lpString=".bz2") returned 4 [0198.556] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0198.556] lstrlenW (lpString=".7z") returned 3 [0198.556] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0198.556] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.556] lstrlenW (lpString=".dbf") returned 4 [0198.556] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0198.556] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.556] lstrlenW (lpString=".1cd") returned 4 [0198.556] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0198.556] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.556] lstrlenW (lpString=".jpg") returned 4 [0198.556] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0198.557] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.557] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.557] lstrlenW (lpString=".doc") returned 4 [0198.557] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0198.557] lstrlenW (lpString=".docx") returned 5 [0198.557] lstrcmpiW (lpString1=".docx", lpString2="I.msp") returned -1 [0198.557] lstrlenW (lpString=".pdf") returned 4 [0198.557] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0198.557] lstrlenW (lpString=".xls") returned 4 [0198.557] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0198.557] lstrlenW (lpString=".xlsx") returned 5 [0198.557] lstrcmpiW (lpString1=".xlsx", lpString2="I.msp") returned -1 [0198.557] lstrlenW (lpString=".ppt") returned 4 [0198.557] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0198.557] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.557] lstrlenW (lpString=".zip") returned 4 [0198.557] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0198.557] lstrlenW (lpString=".rar") returned 4 [0198.557] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0198.557] lstrlenW (lpString=".bz2") returned 4 [0198.557] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0198.557] lstrlenW (lpString=".7z") returned 3 [0198.557] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0198.557] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.557] lstrlenW (lpString=".dbf") returned 4 [0198.557] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0198.557] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.557] lstrlenW (lpString=".1cd") returned 4 [0198.557] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0198.557] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrUpd10116_MUI.msp") returned 62 [0198.557] lstrlenW (lpString=".jpg") returned 4 [0198.557] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0198.558] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0198.558] lstrlenW (lpString="ONINTL.REST.trx_dll") returned 19 [0198.558] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.990] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=260960) returned 1 [0198.990] CloseHandle (hObject=0x150) returned 1 [0198.990] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll")) returned 0x2020 [0198.990] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.990] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\onintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.990] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.990] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.990] lstrlenW (lpString=".doc") returned 4 [0198.990] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0198.990] lstrlenW (lpString=".docx") returned 5 [0198.990] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0198.990] lstrlenW (lpString=".pdf") returned 4 [0198.990] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0198.991] lstrlenW (lpString=".xls") returned 4 [0198.991] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0198.991] lstrlenW (lpString=".xlsx") returned 5 [0198.991] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0198.991] lstrlenW (lpString=".ppt") returned 4 [0198.991] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0198.991] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.991] lstrlenW (lpString=".zip") returned 4 [0198.991] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0198.991] lstrlenW (lpString=".rar") returned 4 [0198.991] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0198.991] lstrlenW (lpString=".bz2") returned 4 [0198.991] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0198.991] lstrlenW (lpString=".7z") returned 3 [0198.991] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0198.991] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.991] lstrlenW (lpString=".dbf") returned 4 [0198.991] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0198.991] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.991] lstrlenW (lpString=".1cd") returned 4 [0198.991] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0198.991] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.991] lstrlenW (lpString=".jpg") returned 4 [0198.991] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0198.991] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.991] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.991] lstrlenW (lpString=".doc") returned 4 [0198.991] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0198.991] lstrlenW (lpString=".docx") returned 5 [0198.991] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0198.991] lstrlenW (lpString=".pdf") returned 4 [0198.991] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0198.992] lstrlenW (lpString=".xls") returned 4 [0198.992] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0198.992] lstrlenW (lpString=".xlsx") returned 5 [0198.992] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0198.992] lstrlenW (lpString=".ppt") returned 4 [0198.992] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0198.992] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.992] lstrlenW (lpString=".zip") returned 4 [0198.992] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0198.992] lstrlenW (lpString=".rar") returned 4 [0198.992] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0198.992] lstrlenW (lpString=".bz2") returned 4 [0198.992] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0198.992] lstrlenW (lpString=".7z") returned 3 [0198.992] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0198.992] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.992] lstrlenW (lpString=".dbf") returned 4 [0198.992] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0198.992] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.992] lstrlenW (lpString=".1cd") returned 4 [0198.992] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0198.992] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\ONINTL.REST.trx_dll") returned 67 [0198.992] lstrlenW (lpString=".jpg") returned 4 [0198.992] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0198.992] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0198.992] lstrlenW (lpString="OUTLWVW.DLL.trx_dll") returned 19 [0198.992] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.993] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=11104) returned 1 [0198.993] CloseHandle (hObject=0x150) returned 1 [0198.993] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll")) returned 0x2020 [0198.993] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.993] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\outlwvw.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.993] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.993] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.993] lstrlenW (lpString=".doc") returned 4 [0198.993] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0198.993] lstrlenW (lpString=".docx") returned 5 [0198.993] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0198.993] lstrlenW (lpString=".pdf") returned 4 [0198.993] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0198.993] lstrlenW (lpString=".xls") returned 4 [0198.993] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0198.993] lstrlenW (lpString=".xlsx") returned 5 [0198.993] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0198.993] lstrlenW (lpString=".ppt") returned 4 [0198.993] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0198.993] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.993] lstrlenW (lpString=".zip") returned 4 [0198.993] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString=".rar") returned 4 [0198.994] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString=".bz2") returned 4 [0198.994] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString=".7z") returned 3 [0198.994] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0198.994] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.994] lstrlenW (lpString=".dbf") returned 4 [0198.994] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.994] lstrlenW (lpString=".1cd") returned 4 [0198.994] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.994] lstrlenW (lpString=".jpg") returned 4 [0198.994] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.994] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.994] lstrlenW (lpString=".doc") returned 4 [0198.994] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString=".docx") returned 5 [0198.994] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0198.994] lstrlenW (lpString=".pdf") returned 4 [0198.994] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString=".xls") returned 4 [0198.994] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString=".xlsx") returned 5 [0198.994] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0198.994] lstrlenW (lpString=".ppt") returned 4 [0198.994] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.994] lstrlenW (lpString=".zip") returned 4 [0198.994] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString=".rar") returned 4 [0198.994] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0198.994] lstrlenW (lpString=".bz2") returned 4 [0198.995] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0198.995] lstrlenW (lpString=".7z") returned 3 [0198.995] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0198.995] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.995] lstrlenW (lpString=".dbf") returned 4 [0198.995] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0198.995] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.995] lstrlenW (lpString=".1cd") returned 4 [0198.995] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0198.995] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\OUTLWVW.DLL.trx_dll") returned 67 [0198.995] lstrlenW (lpString=".jpg") returned 4 [0198.995] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0198.995] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0198.995] lstrlenW (lpString="PPINTL.DLL.trx_dll") returned 18 [0198.995] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.995] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=52576) returned 1 [0198.995] CloseHandle (hObject=0x150) returned 1 [0198.995] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll")) returned 0x2020 [0198.996] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.996] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.996] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.996] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.996] lstrlenW (lpString=".doc") returned 4 [0198.996] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0198.996] lstrlenW (lpString=".docx") returned 5 [0198.996] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0198.996] lstrlenW (lpString=".pdf") returned 4 [0198.996] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0198.996] lstrlenW (lpString=".xls") returned 4 [0198.996] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0198.996] lstrlenW (lpString=".xlsx") returned 5 [0198.996] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0198.996] lstrlenW (lpString=".ppt") returned 4 [0198.996] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0198.996] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.996] lstrlenW (lpString=".zip") returned 4 [0198.996] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0198.996] lstrlenW (lpString=".rar") returned 4 [0198.996] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0198.996] lstrlenW (lpString=".bz2") returned 4 [0198.996] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0198.996] lstrlenW (lpString=".7z") returned 3 [0198.996] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0198.996] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.996] lstrlenW (lpString=".dbf") returned 4 [0198.996] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0198.996] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.996] lstrlenW (lpString=".1cd") returned 4 [0198.996] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0198.996] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.997] lstrlenW (lpString=".jpg") returned 4 [0198.997] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0198.997] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.997] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.997] lstrlenW (lpString=".doc") returned 4 [0198.997] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0198.997] lstrlenW (lpString=".docx") returned 5 [0198.997] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0198.997] lstrlenW (lpString=".pdf") returned 4 [0198.997] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0198.997] lstrlenW (lpString=".xls") returned 4 [0198.997] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0198.997] lstrlenW (lpString=".xlsx") returned 5 [0198.997] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0198.997] lstrlenW (lpString=".ppt") returned 4 [0198.997] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0198.997] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.997] lstrlenW (lpString=".zip") returned 4 [0198.997] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0198.997] lstrlenW (lpString=".rar") returned 4 [0198.997] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0198.997] lstrlenW (lpString=".bz2") returned 4 [0198.997] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0198.997] lstrlenW (lpString=".7z") returned 3 [0198.997] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0198.997] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.997] lstrlenW (lpString=".dbf") returned 4 [0198.997] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0198.997] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.997] lstrlenW (lpString=".1cd") returned 4 [0198.997] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0198.997] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.DLL.trx_dll") returned 66 [0198.997] lstrlenW (lpString=".jpg") returned 4 [0198.997] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0198.998] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0198.998] lstrlenW (lpString="PPINTL.REST.trx_dll") returned 19 [0198.998] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0198.998] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=286560) returned 1 [0198.998] CloseHandle (hObject=0x150) returned 1 [0198.998] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll")) returned 0x2020 [0198.998] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.998] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\ppintl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.998] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0198.998] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0198.998] lstrlenW (lpString=".doc") returned 4 [0198.998] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0198.998] lstrlenW (lpString=".docx") returned 5 [0198.998] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0198.998] lstrlenW (lpString=".pdf") returned 4 [0198.999] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString=".xls") returned 4 [0198.999] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString=".xlsx") returned 5 [0198.999] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0198.999] lstrlenW (lpString=".ppt") returned 4 [0198.999] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0198.999] lstrlenW (lpString=".zip") returned 4 [0198.999] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString=".rar") returned 4 [0198.999] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString=".bz2") returned 4 [0198.999] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString=".7z") returned 3 [0198.999] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0198.999] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0198.999] lstrlenW (lpString=".dbf") returned 4 [0198.999] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0198.999] lstrlenW (lpString=".1cd") returned 4 [0198.999] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0198.999] lstrlenW (lpString=".jpg") returned 4 [0198.999] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0198.999] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0198.999] lstrlenW (lpString=".doc") returned 4 [0198.999] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString=".docx") returned 5 [0198.999] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0198.999] lstrlenW (lpString=".pdf") returned 4 [0198.999] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0198.999] lstrlenW (lpString=".xls") returned 4 [0199.000] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.000] lstrlenW (lpString=".xlsx") returned 5 [0199.000] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.000] lstrlenW (lpString=".ppt") returned 4 [0199.000] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.000] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0199.000] lstrlenW (lpString=".zip") returned 4 [0199.000] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.000] lstrlenW (lpString=".rar") returned 4 [0199.000] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.000] lstrlenW (lpString=".bz2") returned 4 [0199.000] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.000] lstrlenW (lpString=".7z") returned 3 [0199.000] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.000] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0199.000] lstrlenW (lpString=".dbf") returned 4 [0199.000] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.000] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0199.000] lstrlenW (lpString=".1cd") returned 4 [0199.000] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.000] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PPINTL.REST.trx_dll") returned 67 [0199.000] lstrlenW (lpString=".jpg") returned 4 [0199.000] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.000] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0199.000] lstrlenW (lpString="PUB6INTL.DLL.trx_dll") returned 20 [0199.000] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.001] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=107360) returned 1 [0199.001] CloseHandle (hObject=0x150) returned 1 [0199.001] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll")) returned 0x2020 [0199.002] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.002] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.dll.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.002] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.002] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.002] lstrlenW (lpString=".doc") returned 4 [0199.002] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.002] lstrlenW (lpString=".docx") returned 5 [0199.002] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.002] lstrlenW (lpString=".pdf") returned 4 [0199.002] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.002] lstrlenW (lpString=".xls") returned 4 [0199.002] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.002] lstrlenW (lpString=".xlsx") returned 5 [0199.002] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.002] lstrlenW (lpString=".ppt") returned 4 [0199.002] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.002] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.002] lstrlenW (lpString=".zip") returned 4 [0199.002] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.002] lstrlenW (lpString=".rar") returned 4 [0199.002] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.002] lstrlenW (lpString=".bz2") returned 4 [0199.002] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.002] lstrlenW (lpString=".7z") returned 3 [0199.002] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.002] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.002] lstrlenW (lpString=".dbf") returned 4 [0199.002] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.002] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.002] lstrlenW (lpString=".1cd") returned 4 [0199.002] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.002] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.003] lstrlenW (lpString=".jpg") returned 4 [0199.003] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.003] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.003] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.003] lstrlenW (lpString=".doc") returned 4 [0199.003] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.003] lstrlenW (lpString=".docx") returned 5 [0199.003] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.003] lstrlenW (lpString=".pdf") returned 4 [0199.003] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.003] lstrlenW (lpString=".xls") returned 4 [0199.003] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.003] lstrlenW (lpString=".xlsx") returned 5 [0199.003] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.003] lstrlenW (lpString=".ppt") returned 4 [0199.003] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.003] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.003] lstrlenW (lpString=".zip") returned 4 [0199.003] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.003] lstrlenW (lpString=".rar") returned 4 [0199.003] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.003] lstrlenW (lpString=".bz2") returned 4 [0199.003] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.003] lstrlenW (lpString=".7z") returned 3 [0199.003] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.003] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.003] lstrlenW (lpString=".dbf") returned 4 [0199.003] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.003] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.003] lstrlenW (lpString=".1cd") returned 4 [0199.003] lstrcmpiW (lpString1=".1cd", lpString2="_dll") returned -1 [0199.003] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.DLL.trx_dll") returned 68 [0199.003] lstrlenW (lpString=".jpg") returned 4 [0199.003] lstrcmpiW (lpString1=".jpg", lpString2="_dll") returned -1 [0199.004] lstrcmpiW (lpString1=".trx_dll", lpString2=".wiki") returned -1 [0199.004] lstrlenW (lpString="PUB6INTL.REST.trx_dll") returned 21 [0199.004] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.004] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=581984) returned 1 [0199.004] CloseHandle (hObject=0x150) returned 1 [0199.004] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll")) returned 0x2020 [0199.004] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.004] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\pub6intl.rest.trx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.004] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned 69 [0199.004] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned 69 [0199.004] lstrlenW (lpString=".doc") returned 4 [0199.004] lstrcmpiW (lpString1=".doc", lpString2="_dll") returned -1 [0199.004] lstrlenW (lpString=".docx") returned 5 [0199.004] lstrcmpiW (lpString1=".docx", lpString2="x_dll") returned -1 [0199.004] lstrlenW (lpString=".pdf") returned 4 [0199.005] lstrcmpiW (lpString1=".pdf", lpString2="_dll") returned -1 [0199.005] lstrlenW (lpString=".xls") returned 4 [0199.005] lstrcmpiW (lpString1=".xls", lpString2="_dll") returned -1 [0199.005] lstrlenW (lpString=".xlsx") returned 5 [0199.005] lstrcmpiW (lpString1=".xlsx", lpString2="x_dll") returned -1 [0199.005] lstrlenW (lpString=".ppt") returned 4 [0199.005] lstrcmpiW (lpString1=".ppt", lpString2="_dll") returned -1 [0199.005] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned 69 [0199.005] lstrlenW (lpString=".zip") returned 4 [0199.005] lstrcmpiW (lpString1=".zip", lpString2="_dll") returned -1 [0199.005] lstrlenW (lpString=".rar") returned 4 [0199.005] lstrcmpiW (lpString1=".rar", lpString2="_dll") returned -1 [0199.005] lstrlenW (lpString=".bz2") returned 4 [0199.005] lstrcmpiW (lpString1=".bz2", lpString2="_dll") returned -1 [0199.005] lstrlenW (lpString=".7z") returned 3 [0199.005] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0199.005] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\PUB6INTL.REST.trx_dll") returned 69 [0199.005] lstrlenW (lpString=".dbf") returned 4 [0199.005] lstrcmpiW (lpString1=".dbf", lpString2="_dll") returned -1 [0199.472] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=151552) returned 1 [0199.472] CloseHandle (hObject=0x2d4) returned 1 [0199.472] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi")) returned 0x20 [0199.472] GetFileAttributesW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.472] CreateFileW (lpFileName="C:\\ProgramData\\Package Cache\\{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}v11.0.61030\\packages\\vcRuntimeMinimum_amd64\\vc_runtimeMinimum_x64.msi" (normalized: "c:\\programdata\\package cache\\{cf2bea3c-26ea-32f8-aa9b-331f7e34ba97}v11.0.61030\\packages\\vcruntimeminimum_amd64\\vc_runtimeminimum_x64.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.475] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=66208) returned 1 [0199.475] CloseHandle (hObject=0x2d4) returned 1 [0199.475] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 0x2020 [0199.475] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.475] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.476] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.476] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.476] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.476] GetLastError () returned 0x0 [0199.476] ReadFile (in: hFile=0x2d4, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x102a0, lpOverlapped=0x0) returned 1 [0199.543] WriteFile (in: hFile=0x15c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x102b0, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x102b0, lpOverlapped=0x0) returned 1 [0199.545] ReadFile (in: hFile=0x2d4, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.545] WriteFile (in: hFile=0x15c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0199.545] SetEndOfFile (hFile=0x15c) returned 1 [0199.552] CloseHandle (hObject=0x15c) returned 1 [0199.552] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.552] SetEndOfFile (hFile=0x2d4) returned 1 [0199.553] CloseHandle (hObject=0x2d4) returned 1 [0199.553] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.554] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\profiles\\wscrgb.icc")) returned 1 [0199.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.554] lstrlenW (lpString=".doc") returned 4 [0199.554] lstrcmpiW (lpString1=".doc", lpString2=".icc") returned -1 [0199.554] lstrlenW (lpString=".docx") returned 5 [0199.554] lstrcmpiW (lpString1=".docx", lpString2="B.icc") returned -1 [0199.554] lstrlenW (lpString=".pdf") returned 4 [0199.554] lstrcmpiW (lpString1=".pdf", lpString2=".icc") returned 1 [0199.554] lstrlenW (lpString=".xls") returned 4 [0199.554] lstrcmpiW (lpString1=".xls", lpString2=".icc") returned 1 [0199.554] lstrlenW (lpString=".xlsx") returned 5 [0199.554] lstrcmpiW (lpString1=".xlsx", lpString2="B.icc") returned -1 [0199.554] lstrlenW (lpString=".ppt") returned 4 [0199.554] lstrcmpiW (lpString1=".ppt", lpString2=".icc") returned 1 [0199.554] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.554] lstrlenW (lpString=".zip") returned 4 [0199.554] lstrcmpiW (lpString1=".zip", lpString2=".icc") returned 1 [0199.554] lstrlenW (lpString=".rar") returned 4 [0199.554] lstrcmpiW (lpString1=".rar", lpString2=".icc") returned 1 [0199.555] lstrlenW (lpString=".bz2") returned 4 [0199.555] lstrcmpiW (lpString1=".bz2", lpString2=".icc") returned -1 [0199.555] lstrlenW (lpString=".7z") returned 3 [0199.555] lstrcmpiW (lpString1=".7z", lpString2="icc") returned -1 [0199.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.555] lstrlenW (lpString=".dbf") returned 4 [0199.555] lstrcmpiW (lpString1=".dbf", lpString2=".icc") returned -1 [0199.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.555] lstrlenW (lpString=".1cd") returned 4 [0199.555] lstrcmpiW (lpString1=".1cd", lpString2=".icc") returned -1 [0199.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.555] lstrlenW (lpString=".jpg") returned 4 [0199.555] lstrcmpiW (lpString1=".jpg", lpString2=".icc") returned 1 [0199.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.555] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.555] lstrlenW (lpString=".doc") returned 4 [0199.555] lstrcmpiW (lpString1=".doc", lpString2=".icc") returned -1 [0199.555] lstrlenW (lpString=".docx") returned 5 [0199.555] lstrcmpiW (lpString1=".docx", lpString2="B.icc") returned -1 [0199.555] lstrlenW (lpString=".pdf") returned 4 [0199.555] lstrcmpiW (lpString1=".pdf", lpString2=".icc") returned 1 [0199.555] lstrlenW (lpString=".xls") returned 4 [0199.555] lstrcmpiW (lpString1=".xls", lpString2=".icc") returned 1 [0199.555] lstrlenW (lpString=".xlsx") returned 5 [0199.555] lstrcmpiW (lpString1=".xlsx", lpString2="B.icc") returned -1 [0199.555] lstrlenW (lpString=".ppt") returned 4 [0199.555] lstrcmpiW (lpString1=".ppt", lpString2=".icc") returned 1 [0199.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.556] lstrlenW (lpString=".zip") returned 4 [0199.556] lstrcmpiW (lpString1=".zip", lpString2=".icc") returned 1 [0199.556] lstrlenW (lpString=".rar") returned 4 [0199.556] lstrcmpiW (lpString1=".rar", lpString2=".icc") returned 1 [0199.556] lstrlenW (lpString=".bz2") returned 4 [0199.556] lstrcmpiW (lpString1=".bz2", lpString2=".icc") returned -1 [0199.556] lstrlenW (lpString=".7z") returned 3 [0199.556] lstrcmpiW (lpString1=".7z", lpString2="icc") returned -1 [0199.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.556] lstrlenW (lpString=".dbf") returned 4 [0199.556] lstrcmpiW (lpString1=".dbf", lpString2=".icc") returned -1 [0199.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.556] lstrlenW (lpString=".1cd") returned 4 [0199.556] lstrcmpiW (lpString1=".1cd", lpString2=".icc") returned -1 [0199.556] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\Profiles\\wscRGB.icc") returned 75 [0199.556] lstrlenW (lpString=".jpg") returned 4 [0199.556] lstrcmpiW (lpString1=".jpg", lpString2=".icc") returned 1 [0199.556] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0199.556] lstrlenW (lpString="clickonce_bootstrap.exe") returned 23 [0199.556] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.558] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=15440) returned 1 [0199.558] CloseHandle (hObject=0x2d4) returned 1 [0199.558] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe")) returned 0x80 [0199.558] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.558] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.558] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.558] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.559] GetLastError () returned 0x0 [0199.559] ReadFile (in: hFile=0x2d4, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x3c50, lpOverlapped=0x0) returned 1 [0199.572] WriteFile (in: hFile=0x15c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x3c60, lpOverlapped=0x0) returned 1 [0199.573] ReadFile (in: hFile=0x2d4, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.573] WriteFile (in: hFile=0x15c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x102, lpOverlapped=0x0) returned 1 [0199.573] SetEndOfFile (hFile=0x15c) returned 1 [0199.573] CloseHandle (hObject=0x15c) returned 1 [0199.573] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.573] SetEndOfFile (hFile=0x2d4) returned 1 [0199.574] CloseHandle (hObject=0x2d4) returned 1 [0199.574] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x80) returned 1 [0199.574] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe")) returned 1 [0199.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.575] lstrlenW (lpString=".doc") returned 4 [0199.575] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0199.575] lstrlenW (lpString=".docx") returned 5 [0199.575] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0199.575] lstrlenW (lpString=".pdf") returned 4 [0199.575] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0199.575] lstrlenW (lpString=".xls") returned 4 [0199.575] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0199.575] lstrlenW (lpString=".xlsx") returned 5 [0199.575] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0199.575] lstrlenW (lpString=".ppt") returned 4 [0199.575] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0199.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.575] lstrlenW (lpString=".zip") returned 4 [0199.575] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0199.575] lstrlenW (lpString=".rar") returned 4 [0199.575] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0199.575] lstrlenW (lpString=".bz2") returned 4 [0199.575] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0199.575] lstrlenW (lpString=".7z") returned 3 [0199.575] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0199.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.575] lstrlenW (lpString=".dbf") returned 4 [0199.575] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0199.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.575] lstrlenW (lpString=".1cd") returned 4 [0199.575] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0199.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.575] lstrlenW (lpString=".jpg") returned 4 [0199.575] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0199.575] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.576] lstrlenW (lpString=".doc") returned 4 [0199.576] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0199.576] lstrlenW (lpString=".docx") returned 5 [0199.576] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0199.576] lstrlenW (lpString=".pdf") returned 4 [0199.576] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0199.576] lstrlenW (lpString=".xls") returned 4 [0199.576] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0199.576] lstrlenW (lpString=".xlsx") returned 5 [0199.576] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0199.576] lstrlenW (lpString=".ppt") returned 4 [0199.576] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0199.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.576] lstrlenW (lpString=".zip") returned 4 [0199.576] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0199.576] lstrlenW (lpString=".rar") returned 4 [0199.576] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0199.576] lstrlenW (lpString=".bz2") returned 4 [0199.576] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0199.576] lstrlenW (lpString=".7z") returned 3 [0199.576] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0199.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.576] lstrlenW (lpString=".dbf") returned 4 [0199.576] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0199.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.576] lstrlenW (lpString=".1cd") returned 4 [0199.576] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0199.576] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe") returned 157 [0199.576] lstrlenW (lpString=".jpg") returned 4 [0199.576] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0199.577] lstrcmpiW (lpString1=".cdf-ms", lpString2=".wiki") returned -1 [0199.577] lstrlenW (lpString="clickonce_bootstrap.exe.cdf-ms") returned 30 [0199.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.577] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=17104) returned 1 [0199.577] CloseHandle (hObject=0x2d4) returned 1 [0199.577] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms")) returned 0x2020 [0199.577] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.577] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.578] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.578] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.578] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.578] GetLastError () returned 0x0 [0199.578] ReadFile (in: hFile=0x2d4, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x42d0, lpOverlapped=0x0) returned 1 [0199.583] WriteFile (in: hFile=0x15c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x42e0, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x42e0, lpOverlapped=0x0) returned 1 [0199.584] ReadFile (in: hFile=0x2d4, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.584] WriteFile (in: hFile=0x15c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x110, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x110, lpOverlapped=0x0) returned 1 [0199.584] SetEndOfFile (hFile=0x15c) returned 1 [0199.584] CloseHandle (hObject=0x15c) returned 1 [0199.584] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.584] SetEndOfFile (hFile=0x2d4) returned 1 [0199.585] CloseHandle (hObject=0x2d4) returned 1 [0199.585] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.585] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms")) returned 1 [0199.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.586] lstrlenW (lpString=".doc") returned 4 [0199.586] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0199.586] lstrlenW (lpString=".docx") returned 5 [0199.586] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0199.586] lstrlenW (lpString=".pdf") returned 4 [0199.586] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0199.586] lstrlenW (lpString=".xls") returned 4 [0199.586] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0199.586] lstrlenW (lpString=".xlsx") returned 5 [0199.586] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0199.586] lstrlenW (lpString=".ppt") returned 4 [0199.586] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0199.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.586] lstrlenW (lpString=".zip") returned 4 [0199.586] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0199.586] lstrlenW (lpString=".rar") returned 4 [0199.586] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0199.586] lstrlenW (lpString=".bz2") returned 4 [0199.586] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0199.586] lstrlenW (lpString=".7z") returned 3 [0199.586] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.586] lstrlenW (lpString=".dbf") returned 4 [0199.586] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0199.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.586] lstrlenW (lpString=".1cd") returned 4 [0199.586] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0199.586] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.587] lstrlenW (lpString=".jpg") returned 4 [0199.587] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0199.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.587] lstrlenW (lpString=".doc") returned 4 [0199.587] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0199.587] lstrlenW (lpString=".docx") returned 5 [0199.587] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0199.587] lstrlenW (lpString=".pdf") returned 4 [0199.587] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0199.587] lstrlenW (lpString=".xls") returned 4 [0199.587] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0199.587] lstrlenW (lpString=".xlsx") returned 5 [0199.587] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0199.587] lstrlenW (lpString=".ppt") returned 4 [0199.587] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0199.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.587] lstrlenW (lpString=".zip") returned 4 [0199.587] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0199.587] lstrlenW (lpString=".rar") returned 4 [0199.587] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0199.587] lstrlenW (lpString=".bz2") returned 4 [0199.587] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0199.587] lstrlenW (lpString=".7z") returned 3 [0199.587] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.587] lstrlenW (lpString=".dbf") returned 4 [0199.587] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0199.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.587] lstrlenW (lpString=".1cd") returned 4 [0199.587] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0199.587] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.cdf-ms") returned 164 [0199.587] lstrlenW (lpString=".jpg") returned 4 [0199.588] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0199.588] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0199.588] lstrlenW (lpString="clickonce_bootstrap.exe.manifest") returned 32 [0199.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.588] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=13643) returned 1 [0199.588] CloseHandle (hObject=0x2d4) returned 1 [0199.588] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest")) returned 0x2020 [0199.588] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.588] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.589] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.589] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.589] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.589] GetLastError () returned 0x0 [0199.589] ReadFile (in: hFile=0x2d4, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x354b, lpOverlapped=0x0) returned 1 [0199.596] WriteFile (in: hFile=0x15c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x3550, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x3550, lpOverlapped=0x0) returned 1 [0199.598] ReadFile (in: hFile=0x2d4, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.598] WriteFile (in: hFile=0x15c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x114, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x114, lpOverlapped=0x0) returned 1 [0199.598] SetEndOfFile (hFile=0x15c) returned 1 [0199.598] CloseHandle (hObject=0x15c) returned 1 [0199.598] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.598] SetEndOfFile (hFile=0x2d4) returned 1 [0199.599] CloseHandle (hObject=0x2d4) returned 1 [0199.599] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.599] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest")) returned 1 [0199.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.599] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.599] lstrlenW (lpString=".doc") returned 4 [0199.599] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0199.599] lstrlenW (lpString=".docx") returned 5 [0199.599] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0199.599] lstrlenW (lpString=".pdf") returned 4 [0199.599] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0199.599] lstrlenW (lpString=".xls") returned 4 [0199.599] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString=".xlsx") returned 5 [0199.600] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0199.600] lstrlenW (lpString=".ppt") returned 4 [0199.600] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.600] lstrlenW (lpString=".zip") returned 4 [0199.600] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString=".rar") returned 4 [0199.600] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString=".bz2") returned 4 [0199.600] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString=".7z") returned 3 [0199.600] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0199.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.600] lstrlenW (lpString=".dbf") returned 4 [0199.600] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.600] lstrlenW (lpString=".1cd") returned 4 [0199.600] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.600] lstrlenW (lpString=".jpg") returned 4 [0199.600] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.600] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.600] lstrlenW (lpString=".doc") returned 4 [0199.600] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString=".docx") returned 5 [0199.600] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0199.600] lstrlenW (lpString=".pdf") returned 4 [0199.600] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString=".xls") returned 4 [0199.600] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0199.600] lstrlenW (lpString=".xlsx") returned 5 [0199.600] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0199.601] lstrlenW (lpString=".ppt") returned 4 [0199.601] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0199.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.601] lstrlenW (lpString=".zip") returned 4 [0199.601] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0199.601] lstrlenW (lpString=".rar") returned 4 [0199.601] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0199.601] lstrlenW (lpString=".bz2") returned 4 [0199.601] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0199.601] lstrlenW (lpString=".7z") returned 3 [0199.601] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0199.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.601] lstrlenW (lpString=".dbf") returned 4 [0199.601] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0199.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.601] lstrlenW (lpString=".1cd") returned 4 [0199.601] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0199.601] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap.exe.manifest") returned 166 [0199.601] lstrlenW (lpString=".jpg") returned 4 [0199.601] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0199.622] lstrcmpiW (lpString1=".cdf-ms", lpString2=".wiki") returned -1 [0199.622] lstrlenW (lpString="clickonce_bootstrap_unsigned.cdf-ms") returned 35 [0199.622] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.623] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=3808) returned 1 [0199.623] CloseHandle (hObject=0x34c) returned 1 [0199.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms")) returned 0x2020 [0199.623] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.623] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.623] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.623] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0199.624] GetLastError () returned 0x0 [0199.624] ReadFile (in: hFile=0x34c, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0xee0, lpOverlapped=0x0) returned 1 [0199.625] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xef0, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xef0, lpOverlapped=0x0) returned 1 [0199.626] ReadFile (in: hFile=0x34c, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.626] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x11a, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x11a, lpOverlapped=0x0) returned 1 [0199.627] SetEndOfFile (hFile=0x344) returned 1 [0199.627] CloseHandle (hObject=0x344) returned 1 [0199.627] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.627] SetEndOfFile (hFile=0x34c) returned 1 [0199.627] CloseHandle (hObject=0x34c) returned 1 [0199.628] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.628] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms")) returned 1 [0199.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.628] lstrlenW (lpString=".doc") returned 4 [0199.628] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0199.628] lstrlenW (lpString=".docx") returned 5 [0199.628] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0199.628] lstrlenW (lpString=".pdf") returned 4 [0199.628] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0199.628] lstrlenW (lpString=".xls") returned 4 [0199.628] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0199.628] lstrlenW (lpString=".xlsx") returned 5 [0199.628] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0199.628] lstrlenW (lpString=".ppt") returned 4 [0199.628] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0199.628] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.628] lstrlenW (lpString=".zip") returned 4 [0199.629] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0199.629] lstrlenW (lpString=".rar") returned 4 [0199.629] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0199.629] lstrlenW (lpString=".bz2") returned 4 [0199.629] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0199.629] lstrlenW (lpString=".7z") returned 3 [0199.629] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.629] lstrlenW (lpString=".dbf") returned 4 [0199.629] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0199.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.629] lstrlenW (lpString=".1cd") returned 4 [0199.629] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0199.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.629] lstrlenW (lpString=".jpg") returned 4 [0199.629] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0199.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.629] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.629] lstrlenW (lpString=".doc") returned 4 [0199.629] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0199.629] lstrlenW (lpString=".docx") returned 5 [0199.629] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0199.629] lstrlenW (lpString=".pdf") returned 4 [0199.629] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0199.630] lstrlenW (lpString=".xls") returned 4 [0199.630] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0199.630] lstrlenW (lpString=".xlsx") returned 5 [0199.630] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0199.630] lstrlenW (lpString=".ppt") returned 4 [0199.630] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0199.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.630] lstrlenW (lpString=".zip") returned 4 [0199.630] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0199.630] lstrlenW (lpString=".rar") returned 4 [0199.630] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0199.630] lstrlenW (lpString=".bz2") returned 4 [0199.630] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0199.630] lstrlenW (lpString=".7z") returned 3 [0199.630] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.630] lstrlenW (lpString=".dbf") returned 4 [0199.630] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0199.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.630] lstrlenW (lpString=".1cd") returned 4 [0199.630] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0199.630] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.cdf-ms") returned 169 [0199.630] lstrlenW (lpString=".jpg") returned 4 [0199.630] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0199.630] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0199.630] lstrlenW (lpString="clickonce_bootstrap_unsigned.manifest") returned 37 [0199.630] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.631] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=1376) returned 1 [0199.631] CloseHandle (hObject=0x34c) returned 1 [0199.631] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest")) returned 0x2020 [0199.631] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.631] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.631] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.631] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0199.637] GetLastError () returned 0x0 [0199.637] ReadFile (in: hFile=0x34c, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x560, lpOverlapped=0x0) returned 1 [0199.638] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x570, lpOverlapped=0x0) returned 1 [0199.639] ReadFile (in: hFile=0x34c, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.639] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x11e, lpOverlapped=0x0) returned 1 [0199.639] SetEndOfFile (hFile=0x344) returned 1 [0199.640] CloseHandle (hObject=0x344) returned 1 [0199.640] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.640] SetEndOfFile (hFile=0x34c) returned 1 [0199.640] CloseHandle (hObject=0x34c) returned 1 [0199.640] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.641] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest")) returned 1 [0199.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.641] lstrlenW (lpString=".doc") returned 4 [0199.641] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0199.641] lstrlenW (lpString=".docx") returned 5 [0199.641] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0199.641] lstrlenW (lpString=".pdf") returned 4 [0199.641] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0199.641] lstrlenW (lpString=".xls") returned 4 [0199.641] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0199.641] lstrlenW (lpString=".xlsx") returned 5 [0199.641] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0199.641] lstrlenW (lpString=".ppt") returned 4 [0199.641] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0199.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.641] lstrlenW (lpString=".zip") returned 4 [0199.641] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0199.641] lstrlenW (lpString=".rar") returned 4 [0199.641] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0199.641] lstrlenW (lpString=".bz2") returned 4 [0199.641] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0199.641] lstrlenW (lpString=".7z") returned 3 [0199.641] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0199.641] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.641] lstrlenW (lpString=".dbf") returned 4 [0199.641] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.642] lstrlenW (lpString=".1cd") returned 4 [0199.642] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.642] lstrlenW (lpString=".jpg") returned 4 [0199.642] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.642] lstrlenW (lpString=".doc") returned 4 [0199.642] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString=".docx") returned 5 [0199.642] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0199.642] lstrlenW (lpString=".pdf") returned 4 [0199.642] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString=".xls") returned 4 [0199.642] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString=".xlsx") returned 5 [0199.642] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0199.642] lstrlenW (lpString=".ppt") returned 4 [0199.642] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.642] lstrlenW (lpString=".zip") returned 4 [0199.642] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString=".rar") returned 4 [0199.642] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString=".bz2") returned 4 [0199.642] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString=".7z") returned 3 [0199.642] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0199.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.642] lstrlenW (lpString=".dbf") returned 4 [0199.642] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0199.642] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.643] lstrlenW (lpString=".1cd") returned 4 [0199.643] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0199.643] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\clickonce_bootstrap_unsigned.manifest") returned 171 [0199.643] lstrlenW (lpString=".jpg") returned 4 [0199.643] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0199.643] lstrcmpiW (lpString1=".exe", lpString2=".wiki") returned -1 [0199.643] lstrlenW (lpString="GoogleUpdateSetup.exe") returned 21 [0199.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.643] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=1130328) returned 1 [0199.643] CloseHandle (hObject=0x34c) returned 1 [0199.643] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe")) returned 0x20 [0199.643] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.643] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.643] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.644] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.644] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0199.644] GetLastError () returned 0x0 [0199.644] ReadFile (in: hFile=0x34c, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0199.673] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0199.758] ReadFile (in: hFile=0x34c, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x13f68, lpOverlapped=0x0) returned 1 [0199.767] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x13f70, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x13f70, lpOverlapped=0x0) returned 1 [0199.771] ReadFile (in: hFile=0x34c, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0199.771] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0199.772] SetEndOfFile (hFile=0x344) returned 1 [0199.772] CloseHandle (hObject=0x344) returned 1 [0199.772] SetFilePointerEx (in: hFile=0x34c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.772] SetEndOfFile (hFile=0x34c) returned 1 [0199.773] CloseHandle (hObject=0x34c) returned 1 [0199.773] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0199.774] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\googleupdatesetup.exe")) returned 0 [0199.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.774] lstrlenW (lpString=".doc") returned 4 [0199.774] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0199.774] lstrlenW (lpString=".docx") returned 5 [0199.774] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0199.774] lstrlenW (lpString=".pdf") returned 4 [0199.774] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0199.774] lstrlenW (lpString=".xls") returned 4 [0199.774] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0199.774] lstrlenW (lpString=".xlsx") returned 5 [0199.774] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0199.774] lstrlenW (lpString=".ppt") returned 4 [0199.774] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0199.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.774] lstrlenW (lpString=".zip") returned 4 [0199.774] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0199.774] lstrlenW (lpString=".rar") returned 4 [0199.774] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0199.774] lstrlenW (lpString=".bz2") returned 4 [0199.774] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0199.774] lstrlenW (lpString=".7z") returned 3 [0199.774] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0199.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.774] lstrlenW (lpString=".dbf") returned 4 [0199.774] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0199.774] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.774] lstrlenW (lpString=".1cd") returned 4 [0199.775] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0199.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.775] lstrlenW (lpString=".jpg") returned 4 [0199.775] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0199.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.775] lstrlenW (lpString=".doc") returned 4 [0199.775] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0199.775] lstrlenW (lpString=".docx") returned 5 [0199.775] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0199.775] lstrlenW (lpString=".pdf") returned 4 [0199.775] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0199.775] lstrlenW (lpString=".xls") returned 4 [0199.775] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0199.775] lstrlenW (lpString=".xlsx") returned 5 [0199.775] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0199.775] lstrlenW (lpString=".ppt") returned 4 [0199.775] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0199.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.775] lstrlenW (lpString=".zip") returned 4 [0199.775] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0199.775] lstrlenW (lpString=".rar") returned 4 [0199.775] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0199.775] lstrlenW (lpString=".bz2") returned 4 [0199.775] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0199.775] lstrlenW (lpString=".7z") returned 3 [0199.775] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0199.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.775] lstrlenW (lpString=".dbf") returned 4 [0199.775] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0199.775] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.775] lstrlenW (lpString=".1cd") returned 4 [0199.775] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0199.776] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\goog...app_baa8013a79450f71_0001.0003_290679d077f4cfec\\GoogleUpdateSetup.exe") returned 155 [0199.776] lstrlenW (lpString=".jpg") returned 4 [0199.776] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0199.776] lstrlenW (lpString="metadata") returned 8 [0199.776] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\crashpad\\metadata"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0199.777] GetFileSizeEx (in: hFile=0x34c, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=0) returned 1 [0199.777] CloseHandle (hObject=0x34c) returned 1 [0199.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.777] lstrlenW (lpString=".doc") returned 4 [0199.777] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0199.777] lstrlenW (lpString=".docx") returned 5 [0199.777] lstrcmpiW (lpString1=".docx", lpString2="adata") returned -1 [0199.777] lstrlenW (lpString=".pdf") returned 4 [0199.777] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0199.777] lstrlenW (lpString=".xls") returned 4 [0199.777] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0199.777] lstrlenW (lpString=".xlsx") returned 5 [0199.777] lstrcmpiW (lpString1=".xlsx", lpString2="adata") returned -1 [0199.777] lstrlenW (lpString=".ppt") returned 4 [0199.777] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0199.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.777] lstrlenW (lpString=".zip") returned 4 [0199.777] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0199.777] lstrlenW (lpString=".rar") returned 4 [0199.777] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0199.777] lstrlenW (lpString=".bz2") returned 4 [0199.777] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0199.777] lstrlenW (lpString=".7z") returned 3 [0199.777] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0199.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.777] lstrlenW (lpString=".dbf") returned 4 [0199.777] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0199.777] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.777] lstrlenW (lpString=".1cd") returned 4 [0199.778] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0199.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.778] lstrlenW (lpString=".jpg") returned 4 [0199.778] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0199.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.778] lstrlenW (lpString=".doc") returned 4 [0199.778] lstrcmpiW (lpString1=".doc", lpString2="data") returned -1 [0199.778] lstrlenW (lpString=".docx") returned 5 [0199.778] lstrcmpiW (lpString1=".docx", lpString2="adata") returned -1 [0199.778] lstrlenW (lpString=".pdf") returned 4 [0199.778] lstrcmpiW (lpString1=".pdf", lpString2="data") returned -1 [0199.778] lstrlenW (lpString=".xls") returned 4 [0199.778] lstrcmpiW (lpString1=".xls", lpString2="data") returned -1 [0199.778] lstrlenW (lpString=".xlsx") returned 5 [0199.778] lstrcmpiW (lpString1=".xlsx", lpString2="adata") returned -1 [0199.778] lstrlenW (lpString=".ppt") returned 4 [0199.778] lstrcmpiW (lpString1=".ppt", lpString2="data") returned -1 [0199.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.778] lstrlenW (lpString=".zip") returned 4 [0199.778] lstrcmpiW (lpString1=".zip", lpString2="data") returned -1 [0199.778] lstrlenW (lpString=".rar") returned 4 [0199.778] lstrcmpiW (lpString1=".rar", lpString2="data") returned -1 [0199.778] lstrlenW (lpString=".bz2") returned 4 [0199.778] lstrcmpiW (lpString1=".bz2", lpString2="data") returned -1 [0199.778] lstrlenW (lpString=".7z") returned 3 [0199.778] lstrcmpiW (lpString1=".7z", lpString2="ata") returned -1 [0199.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.778] lstrlenW (lpString=".dbf") returned 4 [0199.778] lstrcmpiW (lpString1=".dbf", lpString2="data") returned -1 [0199.778] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.778] lstrlenW (lpString=".1cd") returned 4 [0199.778] lstrcmpiW (lpString1=".1cd", lpString2="data") returned -1 [0199.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Crashpad\\metadata") returned 85 [0199.779] lstrlenW (lpString=".jpg") returned 4 [0199.779] lstrcmpiW (lpString1=".jpg", lpString2="data") returned -1 [0199.779] lstrlenW (lpString="data_0") returned 6 [0199.779] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0199.825] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=45056) returned 1 [0199.825] CloseHandle (hObject=0x370) returned 1 [0199.825] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 0x2020 [0199.825] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0199.825] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.825] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0199.825] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0199.897] GetLastError () returned 0x0 [0199.897] ReadFile (in: hFile=0x370, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0xb000, lpOverlapped=0x0) returned 1 [0200.093] WriteFile (in: hFile=0x378, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xb010, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xb010, lpOverlapped=0x0) returned 1 [0200.256] ReadFile (in: hFile=0x370, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.256] WriteFile (in: hFile=0x378, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0200.257] SetEndOfFile (hFile=0x378) returned 1 [0200.257] CloseHandle (hObject=0x378) returned 1 [0200.257] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.257] SetEndOfFile (hFile=0x370) returned 1 [0200.258] CloseHandle (hObject=0x370) returned 1 [0200.258] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.258] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_0")) returned 1 [0200.258] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.258] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.258] lstrlenW (lpString=".doc") returned 4 [0200.258] lstrcmpiW (lpString1=".doc", lpString2="ta_0") returned -1 [0200.258] lstrlenW (lpString=".docx") returned 5 [0200.258] lstrcmpiW (lpString1=".docx", lpString2="ata_0") returned -1 [0200.258] lstrlenW (lpString=".pdf") returned 4 [0200.258] lstrcmpiW (lpString1=".pdf", lpString2="ta_0") returned -1 [0200.258] lstrlenW (lpString=".xls") returned 4 [0200.258] lstrcmpiW (lpString1=".xls", lpString2="ta_0") returned -1 [0200.258] lstrlenW (lpString=".xlsx") returned 5 [0200.258] lstrcmpiW (lpString1=".xlsx", lpString2="ata_0") returned -1 [0200.259] lstrlenW (lpString=".ppt") returned 4 [0200.259] lstrcmpiW (lpString1=".ppt", lpString2="ta_0") returned -1 [0200.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.259] lstrlenW (lpString=".zip") returned 4 [0200.259] lstrcmpiW (lpString1=".zip", lpString2="ta_0") returned -1 [0200.259] lstrlenW (lpString=".rar") returned 4 [0200.259] lstrcmpiW (lpString1=".rar", lpString2="ta_0") returned -1 [0200.259] lstrlenW (lpString=".bz2") returned 4 [0200.259] lstrcmpiW (lpString1=".bz2", lpString2="ta_0") returned -1 [0200.259] lstrlenW (lpString=".7z") returned 3 [0200.259] lstrcmpiW (lpString1=".7z", lpString2="a_0") returned -1 [0200.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.259] lstrlenW (lpString=".dbf") returned 4 [0200.259] lstrcmpiW (lpString1=".dbf", lpString2="ta_0") returned -1 [0200.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.259] lstrlenW (lpString=".1cd") returned 4 [0200.259] lstrcmpiW (lpString1=".1cd", lpString2="ta_0") returned -1 [0200.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.259] lstrlenW (lpString=".jpg") returned 4 [0200.259] lstrcmpiW (lpString1=".jpg", lpString2="ta_0") returned -1 [0200.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.259] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.259] lstrlenW (lpString=".doc") returned 4 [0200.259] lstrcmpiW (lpString1=".doc", lpString2="ta_0") returned -1 [0200.259] lstrlenW (lpString=".docx") returned 5 [0200.259] lstrcmpiW (lpString1=".docx", lpString2="ata_0") returned -1 [0200.259] lstrlenW (lpString=".pdf") returned 4 [0200.259] lstrcmpiW (lpString1=".pdf", lpString2="ta_0") returned -1 [0200.259] lstrlenW (lpString=".xls") returned 4 [0200.259] lstrcmpiW (lpString1=".xls", lpString2="ta_0") returned -1 [0200.259] lstrlenW (lpString=".xlsx") returned 5 [0200.259] lstrcmpiW (lpString1=".xlsx", lpString2="ata_0") returned -1 [0200.259] lstrlenW (lpString=".ppt") returned 4 [0200.260] lstrcmpiW (lpString1=".ppt", lpString2="ta_0") returned -1 [0200.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.260] lstrlenW (lpString=".zip") returned 4 [0200.260] lstrcmpiW (lpString1=".zip", lpString2="ta_0") returned -1 [0200.260] lstrlenW (lpString=".rar") returned 4 [0200.260] lstrcmpiW (lpString1=".rar", lpString2="ta_0") returned -1 [0200.260] lstrlenW (lpString=".bz2") returned 4 [0200.260] lstrcmpiW (lpString1=".bz2", lpString2="ta_0") returned -1 [0200.260] lstrlenW (lpString=".7z") returned 3 [0200.260] lstrcmpiW (lpString1=".7z", lpString2="a_0") returned -1 [0200.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.260] lstrlenW (lpString=".dbf") returned 4 [0200.260] lstrcmpiW (lpString1=".dbf", lpString2="ta_0") returned -1 [0200.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.260] lstrlenW (lpString=".1cd") returned 4 [0200.260] lstrcmpiW (lpString1=".1cd", lpString2="ta_0") returned -1 [0200.260] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_0") returned 88 [0200.260] lstrlenW (lpString=".jpg") returned 4 [0200.260] lstrcmpiW (lpString1=".jpg", lpString2="ta_0") returned -1 [0200.260] lstrlenW (lpString="CURRENT") returned 7 [0200.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.261] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=16) returned 1 [0200.261] CloseHandle (hObject=0x370) returned 1 [0200.261] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 0x2020 [0200.261] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.261] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.261] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.261] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0200.262] GetLastError () returned 0x0 [0200.262] ReadFile (in: hFile=0x370, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x10, lpOverlapped=0x0) returned 1 [0200.263] WriteFile (in: hFile=0x378, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x20, lpOverlapped=0x0) returned 1 [0200.264] ReadFile (in: hFile=0x370, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.264] WriteFile (in: hFile=0x378, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0200.264] SetEndOfFile (hFile=0x378) returned 1 [0200.264] CloseHandle (hObject=0x378) returned 1 [0200.265] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.265] SetEndOfFile (hFile=0x370) returned 1 [0200.265] CloseHandle (hObject=0x370) returned 1 [0200.265] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.265] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\current")) returned 1 [0200.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.266] lstrlenW (lpString=".doc") returned 4 [0200.266] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0200.266] lstrlenW (lpString=".docx") returned 5 [0200.266] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0200.266] lstrlenW (lpString=".pdf") returned 4 [0200.266] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0200.266] lstrlenW (lpString=".xls") returned 4 [0200.266] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0200.266] lstrlenW (lpString=".xlsx") returned 5 [0200.266] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0200.266] lstrlenW (lpString=".ppt") returned 4 [0200.266] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0200.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.266] lstrlenW (lpString=".zip") returned 4 [0200.266] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0200.266] lstrlenW (lpString=".rar") returned 4 [0200.266] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0200.266] lstrlenW (lpString=".bz2") returned 4 [0200.266] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0200.266] lstrlenW (lpString=".7z") returned 3 [0200.266] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0200.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.266] lstrlenW (lpString=".dbf") returned 4 [0200.266] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0200.266] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.266] lstrlenW (lpString=".1cd") returned 4 [0200.266] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0200.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.267] lstrlenW (lpString=".jpg") returned 4 [0200.267] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0200.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.267] lstrlenW (lpString=".doc") returned 4 [0200.267] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0200.267] lstrlenW (lpString=".docx") returned 5 [0200.267] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0200.267] lstrlenW (lpString=".pdf") returned 4 [0200.267] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0200.267] lstrlenW (lpString=".xls") returned 4 [0200.267] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0200.267] lstrlenW (lpString=".xlsx") returned 5 [0200.267] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0200.267] lstrlenW (lpString=".ppt") returned 4 [0200.267] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0200.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.267] lstrlenW (lpString=".zip") returned 4 [0200.267] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0200.267] lstrlenW (lpString=".rar") returned 4 [0200.267] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0200.267] lstrlenW (lpString=".bz2") returned 4 [0200.267] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0200.267] lstrlenW (lpString=".7z") returned 3 [0200.267] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0200.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.267] lstrlenW (lpString=".dbf") returned 4 [0200.267] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0200.267] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.267] lstrlenW (lpString=".1cd") returned 4 [0200.267] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0200.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\CURRENT") returned 99 [0200.268] lstrlenW (lpString=".jpg") returned 4 [0200.268] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0200.268] lstrlenW (lpString="LOCK") returned 4 [0200.268] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\lock"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0200.268] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=0) returned 1 [0200.268] CloseHandle (hObject=0x370) returned 1 [0200.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.268] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.268] lstrlenW (lpString=".doc") returned 4 [0200.268] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0200.268] lstrlenW (lpString=".docx") returned 5 [0200.269] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0200.269] lstrlenW (lpString=".pdf") returned 4 [0200.269] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0200.269] lstrlenW (lpString=".xls") returned 4 [0200.269] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0200.269] lstrlenW (lpString=".xlsx") returned 5 [0200.269] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0200.269] lstrlenW (lpString=".ppt") returned 4 [0200.269] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0200.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.269] lstrlenW (lpString=".zip") returned 4 [0200.269] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0200.269] lstrlenW (lpString=".rar") returned 4 [0200.269] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0200.269] lstrlenW (lpString=".bz2") returned 4 [0200.269] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0200.269] lstrlenW (lpString=".7z") returned 3 [0200.269] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0200.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.269] lstrlenW (lpString=".dbf") returned 4 [0200.269] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0200.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.269] lstrlenW (lpString=".1cd") returned 4 [0200.269] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0200.269] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.269] lstrlenW (lpString=".jpg") returned 4 [0200.269] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0200.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.270] lstrlenW (lpString=".doc") returned 4 [0200.270] lstrcmpiW (lpString1=".doc", lpString2="LOCK") returned -1 [0200.270] lstrlenW (lpString=".docx") returned 5 [0200.270] lstrcmpiW (lpString1=".docx", lpString2="\\LOCK") returned -1 [0200.270] lstrlenW (lpString=".pdf") returned 4 [0200.270] lstrcmpiW (lpString1=".pdf", lpString2="LOCK") returned -1 [0200.270] lstrlenW (lpString=".xls") returned 4 [0200.270] lstrcmpiW (lpString1=".xls", lpString2="LOCK") returned -1 [0200.270] lstrlenW (lpString=".xlsx") returned 5 [0200.270] lstrcmpiW (lpString1=".xlsx", lpString2="\\LOCK") returned -1 [0200.270] lstrlenW (lpString=".ppt") returned 4 [0200.270] lstrcmpiW (lpString1=".ppt", lpString2="LOCK") returned -1 [0200.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.270] lstrlenW (lpString=".zip") returned 4 [0200.270] lstrcmpiW (lpString1=".zip", lpString2="LOCK") returned -1 [0200.270] lstrlenW (lpString=".rar") returned 4 [0200.270] lstrcmpiW (lpString1=".rar", lpString2="LOCK") returned -1 [0200.270] lstrlenW (lpString=".bz2") returned 4 [0200.270] lstrcmpiW (lpString1=".bz2", lpString2="LOCK") returned -1 [0200.270] lstrlenW (lpString=".7z") returned 3 [0200.270] lstrcmpiW (lpString1=".7z", lpString2="OCK") returned -1 [0200.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.270] lstrlenW (lpString=".dbf") returned 4 [0200.270] lstrcmpiW (lpString1=".dbf", lpString2="LOCK") returned -1 [0200.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.270] lstrlenW (lpString=".1cd") returned 4 [0200.270] lstrcmpiW (lpString1=".1cd", lpString2="LOCK") returned -1 [0200.270] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOCK") returned 96 [0200.270] lstrlenW (lpString=".jpg") returned 4 [0200.270] lstrcmpiW (lpString1=".jpg", lpString2="LOCK") returned -1 [0200.271] lstrlenW (lpString="LOG") returned 3 [0200.271] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0200.528] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=154) returned 1 [0200.528] CloseHandle (hObject=0x378) returned 1 [0200.528] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 0x2020 [0200.528] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.528] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0200.529] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.529] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0200.529] GetLastError () returned 0x0 [0200.529] ReadFile (in: hFile=0x378, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x9a, lpOverlapped=0x0) returned 1 [0200.533] WriteFile (in: hFile=0x350, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0200.533] ReadFile (in: hFile=0x378, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.534] WriteFile (in: hFile=0x350, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xda, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xda, lpOverlapped=0x0) returned 1 [0200.534] SetEndOfFile (hFile=0x350) returned 1 [0200.534] CloseHandle (hObject=0x350) returned 1 [0200.534] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.534] SetEndOfFile (hFile=0x378) returned 1 [0200.535] CloseHandle (hObject=0x378) returned 1 [0200.535] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.535] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\log")) returned 1 [0200.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.535] lstrlenW (lpString=".doc") returned 4 [0200.535] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0200.535] lstrlenW (lpString=".docx") returned 5 [0200.535] lstrcmpiW (lpString1=".docx", lpString2="s\\LOG") returned -1 [0200.535] lstrlenW (lpString=".pdf") returned 4 [0200.535] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0200.535] lstrlenW (lpString=".xls") returned 4 [0200.535] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0200.535] lstrlenW (lpString=".xlsx") returned 5 [0200.535] lstrcmpiW (lpString1=".xlsx", lpString2="s\\LOG") returned -1 [0200.535] lstrlenW (lpString=".ppt") returned 4 [0200.535] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0200.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.536] lstrlenW (lpString=".zip") returned 4 [0200.536] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0200.536] lstrlenW (lpString=".rar") returned 4 [0200.536] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0200.536] lstrlenW (lpString=".bz2") returned 4 [0200.536] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0200.536] lstrlenW (lpString=".7z") returned 3 [0200.536] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0200.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.536] lstrlenW (lpString=".dbf") returned 4 [0200.536] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0200.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.536] lstrlenW (lpString=".1cd") returned 4 [0200.536] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0200.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.536] lstrlenW (lpString=".jpg") returned 4 [0200.536] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0200.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.536] lstrlenW (lpString=".doc") returned 4 [0200.536] lstrcmpiW (lpString1=".doc", lpString2="\\LOG") returned -1 [0200.536] lstrlenW (lpString=".docx") returned 5 [0200.536] lstrcmpiW (lpString1=".docx", lpString2="s\\LOG") returned -1 [0200.536] lstrlenW (lpString=".pdf") returned 4 [0200.536] lstrcmpiW (lpString1=".pdf", lpString2="\\LOG") returned -1 [0200.536] lstrlenW (lpString=".xls") returned 4 [0200.536] lstrcmpiW (lpString1=".xls", lpString2="\\LOG") returned -1 [0200.536] lstrlenW (lpString=".xlsx") returned 5 [0200.536] lstrcmpiW (lpString1=".xlsx", lpString2="s\\LOG") returned -1 [0200.536] lstrlenW (lpString=".ppt") returned 4 [0200.536] lstrcmpiW (lpString1=".ppt", lpString2="\\LOG") returned -1 [0200.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.536] lstrlenW (lpString=".zip") returned 4 [0200.537] lstrcmpiW (lpString1=".zip", lpString2="\\LOG") returned -1 [0200.537] lstrlenW (lpString=".rar") returned 4 [0200.537] lstrcmpiW (lpString1=".rar", lpString2="\\LOG") returned -1 [0200.537] lstrlenW (lpString=".bz2") returned 4 [0200.537] lstrcmpiW (lpString1=".bz2", lpString2="\\LOG") returned -1 [0200.537] lstrlenW (lpString=".7z") returned 3 [0200.537] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0200.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.537] lstrlenW (lpString=".dbf") returned 4 [0200.537] lstrcmpiW (lpString1=".dbf", lpString2="\\LOG") returned -1 [0200.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.537] lstrlenW (lpString=".1cd") returned 4 [0200.537] lstrcmpiW (lpString1=".1cd", lpString2="\\LOG") returned -1 [0200.537] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\LOG") returned 95 [0200.537] lstrlenW (lpString=".jpg") returned 4 [0200.537] lstrcmpiW (lpString1=".jpg", lpString2="\\LOG") returned -1 [0200.537] lstrlenW (lpString="MANIFEST-000001") returned 15 [0200.537] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0200.538] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=41) returned 1 [0200.538] CloseHandle (hObject=0x378) returned 1 [0200.538] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 0x2020 [0200.538] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0200.538] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.538] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.538] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0200.538] GetLastError () returned 0x0 [0200.539] ReadFile (in: hFile=0x378, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x29, lpOverlapped=0x0) returned 1 [0200.539] WriteFile (in: hFile=0x350, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x30, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x30, lpOverlapped=0x0) returned 1 [0200.540] ReadFile (in: hFile=0x378, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.540] WriteFile (in: hFile=0x350, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0200.540] SetEndOfFile (hFile=0x350) returned 1 [0200.541] CloseHandle (hObject=0x350) returned 1 [0200.541] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.541] SetEndOfFile (hFile=0x378) returned 1 [0200.541] CloseHandle (hObject=0x378) returned 1 [0200.541] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.542] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension rules\\manifest-000001")) returned 1 [0200.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.542] lstrlenW (lpString=".doc") returned 4 [0200.542] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0200.542] lstrlenW (lpString=".docx") returned 5 [0200.542] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0200.542] lstrlenW (lpString=".pdf") returned 4 [0200.542] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0200.542] lstrlenW (lpString=".xls") returned 4 [0200.542] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0200.542] lstrlenW (lpString=".xlsx") returned 5 [0200.542] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0200.542] lstrlenW (lpString=".ppt") returned 4 [0200.542] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0200.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.542] lstrlenW (lpString=".zip") returned 4 [0200.542] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0200.542] lstrlenW (lpString=".rar") returned 4 [0200.542] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0200.542] lstrlenW (lpString=".bz2") returned 4 [0200.542] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0200.542] lstrlenW (lpString=".7z") returned 3 [0200.542] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0200.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.543] lstrlenW (lpString=".dbf") returned 4 [0200.543] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0200.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.543] lstrlenW (lpString=".1cd") returned 4 [0200.543] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0200.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.543] lstrlenW (lpString=".jpg") returned 4 [0200.543] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0200.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.543] lstrlenW (lpString=".doc") returned 4 [0200.543] lstrcmpiW (lpString1=".doc", lpString2="0001") returned -1 [0200.543] lstrlenW (lpString=".docx") returned 5 [0200.543] lstrcmpiW (lpString1=".docx", lpString2="00001") returned -1 [0200.543] lstrlenW (lpString=".pdf") returned 4 [0200.543] lstrcmpiW (lpString1=".pdf", lpString2="0001") returned -1 [0200.543] lstrlenW (lpString=".xls") returned 4 [0200.543] lstrcmpiW (lpString1=".xls", lpString2="0001") returned -1 [0200.543] lstrlenW (lpString=".xlsx") returned 5 [0200.543] lstrcmpiW (lpString1=".xlsx", lpString2="00001") returned -1 [0200.543] lstrlenW (lpString=".ppt") returned 4 [0200.543] lstrcmpiW (lpString1=".ppt", lpString2="0001") returned -1 [0200.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.543] lstrlenW (lpString=".zip") returned 4 [0200.543] lstrcmpiW (lpString1=".zip", lpString2="0001") returned -1 [0200.543] lstrlenW (lpString=".rar") returned 4 [0200.543] lstrcmpiW (lpString1=".rar", lpString2="0001") returned -1 [0200.543] lstrlenW (lpString=".bz2") returned 4 [0200.543] lstrcmpiW (lpString1=".bz2", lpString2="0001") returned -1 [0200.543] lstrlenW (lpString=".7z") returned 3 [0200.543] lstrcmpiW (lpString1=".7z", lpString2="001") returned -1 [0200.543] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.543] lstrlenW (lpString=".dbf") returned 4 [0200.543] lstrcmpiW (lpString1=".dbf", lpString2="0001") returned -1 [0200.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.544] lstrlenW (lpString=".1cd") returned 4 [0200.544] lstrcmpiW (lpString1=".1cd", lpString2="0001") returned -1 [0200.544] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension Rules\\MANIFEST-000001") returned 107 [0200.544] lstrlenW (lpString=".jpg") returned 4 [0200.544] lstrcmpiW (lpString1=".jpg", lpString2="0001") returned -1 [0200.544] lstrlenW (lpString="CURRENT") returned 7 [0200.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0200.544] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=16) returned 1 [0200.544] CloseHandle (hObject=0x378) returned 1 [0200.544] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 0x2020 [0200.544] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0200.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0200.545] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.545] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.545] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0200.545] GetLastError () returned 0x0 [0200.545] ReadFile (in: hFile=0x378, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x10, lpOverlapped=0x0) returned 1 [0200.734] WriteFile (in: hFile=0x350, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x20, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x20, lpOverlapped=0x0) returned 1 [0200.734] ReadFile (in: hFile=0x378, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0200.734] WriteFile (in: hFile=0x350, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0200.735] SetEndOfFile (hFile=0x350) returned 1 [0200.735] CloseHandle (hObject=0x350) returned 1 [0200.735] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0200.735] SetEndOfFile (hFile=0x378) returned 1 [0200.736] CloseHandle (hObject=0x378) returned 1 [0200.736] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0200.736] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\extension state\\current")) returned 1 [0200.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.736] lstrlenW (lpString=".doc") returned 4 [0200.736] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0200.736] lstrlenW (lpString=".docx") returned 5 [0200.736] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0200.736] lstrlenW (lpString=".pdf") returned 4 [0200.736] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0200.736] lstrlenW (lpString=".xls") returned 4 [0200.736] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0200.736] lstrlenW (lpString=".xlsx") returned 5 [0200.736] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0200.736] lstrlenW (lpString=".ppt") returned 4 [0200.736] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0200.736] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.736] lstrlenW (lpString=".zip") returned 4 [0200.736] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0200.736] lstrlenW (lpString=".rar") returned 4 [0200.736] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0200.737] lstrlenW (lpString=".bz2") returned 4 [0200.737] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0200.737] lstrlenW (lpString=".7z") returned 3 [0200.737] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0200.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.737] lstrlenW (lpString=".dbf") returned 4 [0200.737] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0200.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.737] lstrlenW (lpString=".1cd") returned 4 [0200.737] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0200.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.737] lstrlenW (lpString=".jpg") returned 4 [0200.737] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0200.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.737] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.737] lstrlenW (lpString=".doc") returned 4 [0200.737] lstrcmpiW (lpString1=".doc", lpString2="RENT") returned -1 [0200.737] lstrlenW (lpString=".docx") returned 5 [0200.737] lstrcmpiW (lpString1=".docx", lpString2="RRENT") returned -1 [0200.737] lstrlenW (lpString=".pdf") returned 4 [0200.737] lstrcmpiW (lpString1=".pdf", lpString2="RENT") returned -1 [0200.737] lstrlenW (lpString=".xls") returned 4 [0200.737] lstrcmpiW (lpString1=".xls", lpString2="RENT") returned -1 [0200.737] lstrlenW (lpString=".xlsx") returned 5 [0200.738] lstrcmpiW (lpString1=".xlsx", lpString2="RRENT") returned -1 [0200.738] lstrlenW (lpString=".ppt") returned 4 [0200.738] lstrcmpiW (lpString1=".ppt", lpString2="RENT") returned -1 [0200.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.738] lstrlenW (lpString=".zip") returned 4 [0200.738] lstrcmpiW (lpString1=".zip", lpString2="RENT") returned -1 [0200.738] lstrlenW (lpString=".rar") returned 4 [0200.738] lstrcmpiW (lpString1=".rar", lpString2="RENT") returned -1 [0200.738] lstrlenW (lpString=".bz2") returned 4 [0200.738] lstrcmpiW (lpString1=".bz2", lpString2="RENT") returned -1 [0200.738] lstrlenW (lpString=".7z") returned 3 [0200.738] lstrcmpiW (lpString1=".7z", lpString2="ENT") returned -1 [0200.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.738] lstrlenW (lpString=".dbf") returned 4 [0200.738] lstrcmpiW (lpString1=".dbf", lpString2="RENT") returned -1 [0200.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.738] lstrlenW (lpString=".1cd") returned 4 [0200.738] lstrcmpiW (lpString1=".1cd", lpString2="RENT") returned -1 [0200.738] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Extension State\\CURRENT") returned 99 [0200.738] lstrlenW (lpString=".jpg") returned 4 [0200.738] lstrcmpiW (lpString1=".jpg", lpString2="RENT") returned -1 [0200.738] lstrcmpiW (lpString1=".tmp", lpString2=".wiki") returned -1 [0200.738] lstrlenW (lpString="2B03.tmp") returned 8 [0200.738] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\jumplisticonsold\\2b03.tmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.070] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=0) returned 1 [0201.071] CloseHandle (hObject=0x350) returned 1 [0201.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.071] lstrlenW (lpString=".doc") returned 4 [0201.071] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0201.071] lstrlenW (lpString=".docx") returned 5 [0201.071] lstrcmpiW (lpString1=".docx", lpString2="3.tmp") returned -1 [0201.071] lstrlenW (lpString=".pdf") returned 4 [0201.071] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0201.071] lstrlenW (lpString=".xls") returned 4 [0201.071] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0201.071] lstrlenW (lpString=".xlsx") returned 5 [0201.071] lstrcmpiW (lpString1=".xlsx", lpString2="3.tmp") returned -1 [0201.071] lstrlenW (lpString=".ppt") returned 4 [0201.071] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0201.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.071] lstrlenW (lpString=".zip") returned 4 [0201.071] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0201.071] lstrlenW (lpString=".rar") returned 4 [0201.071] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0201.071] lstrlenW (lpString=".bz2") returned 4 [0201.071] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0201.071] lstrlenW (lpString=".7z") returned 3 [0201.071] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0201.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.071] lstrlenW (lpString=".dbf") returned 4 [0201.071] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0201.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.071] lstrlenW (lpString=".1cd") returned 4 [0201.071] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0201.071] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.072] lstrlenW (lpString=".jpg") returned 4 [0201.072] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0201.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.072] lstrlenW (lpString=".doc") returned 4 [0201.072] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0201.072] lstrlenW (lpString=".docx") returned 5 [0201.072] lstrcmpiW (lpString1=".docx", lpString2="3.tmp") returned -1 [0201.072] lstrlenW (lpString=".pdf") returned 4 [0201.072] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0201.072] lstrlenW (lpString=".xls") returned 4 [0201.072] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0201.072] lstrlenW (lpString=".xlsx") returned 5 [0201.072] lstrcmpiW (lpString1=".xlsx", lpString2="3.tmp") returned -1 [0201.072] lstrlenW (lpString=".ppt") returned 4 [0201.072] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0201.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.072] lstrlenW (lpString=".zip") returned 4 [0201.072] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0201.072] lstrlenW (lpString=".rar") returned 4 [0201.072] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0201.072] lstrlenW (lpString=".bz2") returned 4 [0201.072] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0201.072] lstrlenW (lpString=".7z") returned 3 [0201.072] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0201.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.072] lstrlenW (lpString=".dbf") returned 4 [0201.072] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0201.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.072] lstrlenW (lpString=".1cd") returned 4 [0201.072] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0201.072] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\JumpListIconsOld\\2B03.tmp") returned 101 [0201.072] lstrlenW (lpString=".jpg") returned 4 [0201.072] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0201.073] lstrcmpiW (lpString1=".db-journal", lpString2=".wiki") returned -1 [0201.073] lstrlenW (lpString="previews_opt_out.db-journal") returned 27 [0201.073] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\previews_opt_out.db-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.073] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=0) returned 1 [0201.073] CloseHandle (hObject=0x350) returned 1 [0201.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.073] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.073] lstrlenW (lpString=".doc") returned 4 [0201.073] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString=".docx") returned 5 [0201.074] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.074] lstrlenW (lpString=".pdf") returned 4 [0201.074] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString=".xls") returned 4 [0201.074] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString=".xlsx") returned 5 [0201.074] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.074] lstrlenW (lpString=".ppt") returned 4 [0201.074] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.074] lstrlenW (lpString=".zip") returned 4 [0201.074] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString=".rar") returned 4 [0201.074] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString=".bz2") returned 4 [0201.074] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString=".7z") returned 3 [0201.074] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.074] lstrlenW (lpString=".dbf") returned 4 [0201.074] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.074] lstrlenW (lpString=".1cd") returned 4 [0201.074] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.074] lstrlenW (lpString=".jpg") returned 4 [0201.074] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.074] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.074] lstrlenW (lpString=".doc") returned 4 [0201.074] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.074] lstrlenW (lpString=".docx") returned 5 [0201.075] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.075] lstrlenW (lpString=".pdf") returned 4 [0201.075] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.075] lstrlenW (lpString=".xls") returned 4 [0201.075] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.075] lstrlenW (lpString=".xlsx") returned 5 [0201.075] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.075] lstrlenW (lpString=".ppt") returned 4 [0201.075] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.075] lstrlenW (lpString=".zip") returned 4 [0201.075] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.075] lstrlenW (lpString=".rar") returned 4 [0201.075] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.075] lstrlenW (lpString=".bz2") returned 4 [0201.075] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.075] lstrlenW (lpString=".7z") returned 3 [0201.075] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.075] lstrlenW (lpString=".dbf") returned 4 [0201.075] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.075] lstrlenW (lpString=".1cd") returned 4 [0201.075] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\previews_opt_out.db-journal") returned 103 [0201.075] lstrlenW (lpString=".jpg") returned 4 [0201.075] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.075] lstrlenW (lpString="QuotaManager") returned 12 [0201.075] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.076] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=15360) returned 1 [0201.076] CloseHandle (hObject=0x350) returned 1 [0201.076] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager")) returned 0x2020 [0201.076] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.076] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.076] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.076] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.077] GetLastError () returned 0x0 [0201.077] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x3c00, lpOverlapped=0x0) returned 1 [0201.079] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x3c10, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x3c10, lpOverlapped=0x0) returned 1 [0201.081] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.081] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xec, lpOverlapped=0x0) returned 1 [0201.081] SetEndOfFile (hFile=0x2d8) returned 1 [0201.081] CloseHandle (hObject=0x2d8) returned 1 [0201.081] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.081] SetEndOfFile (hFile=0x350) returned 1 [0201.082] CloseHandle (hObject=0x350) returned 1 [0201.082] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.082] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager")) returned 1 [0201.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.082] lstrlenW (lpString=".doc") returned 4 [0201.082] lstrcmpiW (lpString1=".doc", lpString2="ager") returned -1 [0201.082] lstrlenW (lpString=".docx") returned 5 [0201.082] lstrcmpiW (lpString1=".docx", lpString2="nager") returned -1 [0201.082] lstrlenW (lpString=".pdf") returned 4 [0201.082] lstrcmpiW (lpString1=".pdf", lpString2="ager") returned -1 [0201.082] lstrlenW (lpString=".xls") returned 4 [0201.082] lstrcmpiW (lpString1=".xls", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString=".xlsx") returned 5 [0201.083] lstrcmpiW (lpString1=".xlsx", lpString2="nager") returned -1 [0201.083] lstrlenW (lpString=".ppt") returned 4 [0201.083] lstrcmpiW (lpString1=".ppt", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.083] lstrlenW (lpString=".zip") returned 4 [0201.083] lstrcmpiW (lpString1=".zip", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString=".rar") returned 4 [0201.083] lstrcmpiW (lpString1=".rar", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString=".bz2") returned 4 [0201.083] lstrcmpiW (lpString1=".bz2", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString=".7z") returned 3 [0201.083] lstrcmpiW (lpString1=".7z", lpString2="ger") returned -1 [0201.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.083] lstrlenW (lpString=".dbf") returned 4 [0201.083] lstrcmpiW (lpString1=".dbf", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.083] lstrlenW (lpString=".1cd") returned 4 [0201.083] lstrcmpiW (lpString1=".1cd", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.083] lstrlenW (lpString=".jpg") returned 4 [0201.083] lstrcmpiW (lpString1=".jpg", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.083] lstrlenW (lpString=".doc") returned 4 [0201.083] lstrcmpiW (lpString1=".doc", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString=".docx") returned 5 [0201.083] lstrcmpiW (lpString1=".docx", lpString2="nager") returned -1 [0201.083] lstrlenW (lpString=".pdf") returned 4 [0201.083] lstrcmpiW (lpString1=".pdf", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString=".xls") returned 4 [0201.083] lstrcmpiW (lpString1=".xls", lpString2="ager") returned -1 [0201.083] lstrlenW (lpString=".xlsx") returned 5 [0201.084] lstrcmpiW (lpString1=".xlsx", lpString2="nager") returned -1 [0201.084] lstrlenW (lpString=".ppt") returned 4 [0201.084] lstrcmpiW (lpString1=".ppt", lpString2="ager") returned -1 [0201.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.084] lstrlenW (lpString=".zip") returned 4 [0201.084] lstrcmpiW (lpString1=".zip", lpString2="ager") returned -1 [0201.084] lstrlenW (lpString=".rar") returned 4 [0201.084] lstrcmpiW (lpString1=".rar", lpString2="ager") returned -1 [0201.084] lstrlenW (lpString=".bz2") returned 4 [0201.084] lstrcmpiW (lpString1=".bz2", lpString2="ager") returned -1 [0201.084] lstrlenW (lpString=".7z") returned 3 [0201.084] lstrcmpiW (lpString1=".7z", lpString2="ger") returned -1 [0201.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.084] lstrlenW (lpString=".dbf") returned 4 [0201.084] lstrcmpiW (lpString1=".dbf", lpString2="ager") returned -1 [0201.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.084] lstrlenW (lpString=".1cd") returned 4 [0201.084] lstrcmpiW (lpString1=".1cd", lpString2="ager") returned -1 [0201.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager") returned 88 [0201.084] lstrlenW (lpString=".jpg") returned 4 [0201.084] lstrcmpiW (lpString1=".jpg", lpString2="ager") returned -1 [0201.084] lstrlenW (lpString="QuotaManager-journal") returned 20 [0201.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\quotamanager-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.085] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=0) returned 1 [0201.085] CloseHandle (hObject=0x350) returned 1 [0201.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.085] lstrlenW (lpString=".doc") returned 4 [0201.085] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.085] lstrlenW (lpString=".docx") returned 5 [0201.085] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.085] lstrlenW (lpString=".pdf") returned 4 [0201.085] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.085] lstrlenW (lpString=".xls") returned 4 [0201.085] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.085] lstrlenW (lpString=".xlsx") returned 5 [0201.085] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.085] lstrlenW (lpString=".ppt") returned 4 [0201.085] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.085] lstrlenW (lpString=".zip") returned 4 [0201.085] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.085] lstrlenW (lpString=".rar") returned 4 [0201.085] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.085] lstrlenW (lpString=".bz2") returned 4 [0201.085] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.085] lstrlenW (lpString=".7z") returned 3 [0201.085] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.085] lstrlenW (lpString=".dbf") returned 4 [0201.085] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.086] lstrlenW (lpString=".1cd") returned 4 [0201.086] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.086] lstrlenW (lpString=".jpg") returned 4 [0201.086] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.086] lstrlenW (lpString=".doc") returned 4 [0201.086] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString=".docx") returned 5 [0201.086] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.086] lstrlenW (lpString=".pdf") returned 4 [0201.086] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString=".xls") returned 4 [0201.086] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString=".xlsx") returned 5 [0201.086] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.086] lstrlenW (lpString=".ppt") returned 4 [0201.086] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.086] lstrlenW (lpString=".zip") returned 4 [0201.086] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString=".rar") returned 4 [0201.086] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString=".bz2") returned 4 [0201.086] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString=".7z") returned 3 [0201.086] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.086] lstrlenW (lpString=".dbf") returned 4 [0201.086] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.087] lstrlenW (lpString=".1cd") returned 4 [0201.087] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.087] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\QuotaManager-journal") returned 96 [0201.087] lstrlenW (lpString=".jpg") returned 4 [0201.087] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.087] lstrlenW (lpString="README") returned 6 [0201.087] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.087] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=180) returned 1 [0201.087] CloseHandle (hObject=0x350) returned 1 [0201.087] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme")) returned 0x2020 [0201.087] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.088] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.088] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.088] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.088] GetLastError () returned 0x0 [0201.088] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0xb4, lpOverlapped=0x0) returned 1 [0201.089] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0201.090] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.090] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0201.090] SetEndOfFile (hFile=0x2d8) returned 1 [0201.090] CloseHandle (hObject=0x2d8) returned 1 [0201.090] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.090] SetEndOfFile (hFile=0x350) returned 1 [0201.091] CloseHandle (hObject=0x350) returned 1 [0201.091] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.091] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\readme")) returned 1 [0201.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.091] lstrlenW (lpString=".doc") returned 4 [0201.092] lstrcmpiW (lpString1=".doc", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString=".docx") returned 5 [0201.092] lstrcmpiW (lpString1=".docx", lpString2="EADME") returned -1 [0201.092] lstrlenW (lpString=".pdf") returned 4 [0201.092] lstrcmpiW (lpString1=".pdf", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString=".xls") returned 4 [0201.092] lstrcmpiW (lpString1=".xls", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString=".xlsx") returned 5 [0201.092] lstrcmpiW (lpString1=".xlsx", lpString2="EADME") returned -1 [0201.092] lstrlenW (lpString=".ppt") returned 4 [0201.092] lstrcmpiW (lpString1=".ppt", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.092] lstrlenW (lpString=".zip") returned 4 [0201.092] lstrcmpiW (lpString1=".zip", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString=".rar") returned 4 [0201.092] lstrcmpiW (lpString1=".rar", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString=".bz2") returned 4 [0201.092] lstrcmpiW (lpString1=".bz2", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString=".7z") returned 3 [0201.092] lstrcmpiW (lpString1=".7z", lpString2="DME") returned -1 [0201.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.092] lstrlenW (lpString=".dbf") returned 4 [0201.092] lstrcmpiW (lpString1=".dbf", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.092] lstrlenW (lpString=".1cd") returned 4 [0201.092] lstrcmpiW (lpString1=".1cd", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.092] lstrlenW (lpString=".jpg") returned 4 [0201.092] lstrcmpiW (lpString1=".jpg", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.092] lstrlenW (lpString=".doc") returned 4 [0201.092] lstrcmpiW (lpString1=".doc", lpString2="ADME") returned -1 [0201.092] lstrlenW (lpString=".docx") returned 5 [0201.093] lstrcmpiW (lpString1=".docx", lpString2="EADME") returned -1 [0201.093] lstrlenW (lpString=".pdf") returned 4 [0201.093] lstrcmpiW (lpString1=".pdf", lpString2="ADME") returned -1 [0201.093] lstrlenW (lpString=".xls") returned 4 [0201.093] lstrcmpiW (lpString1=".xls", lpString2="ADME") returned -1 [0201.093] lstrlenW (lpString=".xlsx") returned 5 [0201.093] lstrcmpiW (lpString1=".xlsx", lpString2="EADME") returned -1 [0201.093] lstrlenW (lpString=".ppt") returned 4 [0201.093] lstrcmpiW (lpString1=".ppt", lpString2="ADME") returned -1 [0201.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.093] lstrlenW (lpString=".zip") returned 4 [0201.093] lstrcmpiW (lpString1=".zip", lpString2="ADME") returned -1 [0201.093] lstrlenW (lpString=".rar") returned 4 [0201.093] lstrcmpiW (lpString1=".rar", lpString2="ADME") returned -1 [0201.093] lstrlenW (lpString=".bz2") returned 4 [0201.093] lstrcmpiW (lpString1=".bz2", lpString2="ADME") returned -1 [0201.093] lstrlenW (lpString=".7z") returned 3 [0201.093] lstrcmpiW (lpString1=".7z", lpString2="DME") returned -1 [0201.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.093] lstrlenW (lpString=".dbf") returned 4 [0201.093] lstrcmpiW (lpString1=".dbf", lpString2="ADME") returned -1 [0201.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.093] lstrlenW (lpString=".1cd") returned 4 [0201.093] lstrcmpiW (lpString1=".1cd", lpString2="ADME") returned -1 [0201.093] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\README") returned 82 [0201.093] lstrlenW (lpString=".jpg") returned 4 [0201.093] lstrcmpiW (lpString1=".jpg", lpString2="ADME") returned -1 [0201.093] lstrlenW (lpString="Secure Preferences") returned 18 [0201.093] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.094] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=35651) returned 1 [0201.094] CloseHandle (hObject=0x350) returned 1 [0201.094] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences")) returned 0x2020 [0201.094] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.094] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.094] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.094] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.095] GetLastError () returned 0x0 [0201.095] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x8b43, lpOverlapped=0x0) returned 1 [0201.097] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x8b50, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x8b50, lpOverlapped=0x0) returned 1 [0201.098] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.098] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0201.098] SetEndOfFile (hFile=0x2d8) returned 1 [0201.099] CloseHandle (hObject=0x2d8) returned 1 [0201.099] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.099] SetEndOfFile (hFile=0x350) returned 1 [0201.100] CloseHandle (hObject=0x350) returned 1 [0201.100] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.100] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\secure preferences")) returned 1 [0201.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.100] lstrlenW (lpString=".doc") returned 4 [0201.100] lstrcmpiW (lpString1=".doc", lpString2="nces") returned -1 [0201.100] lstrlenW (lpString=".docx") returned 5 [0201.100] lstrcmpiW (lpString1=".docx", lpString2="ences") returned -1 [0201.100] lstrlenW (lpString=".pdf") returned 4 [0201.100] lstrcmpiW (lpString1=".pdf", lpString2="nces") returned -1 [0201.100] lstrlenW (lpString=".xls") returned 4 [0201.100] lstrcmpiW (lpString1=".xls", lpString2="nces") returned -1 [0201.100] lstrlenW (lpString=".xlsx") returned 5 [0201.100] lstrcmpiW (lpString1=".xlsx", lpString2="ences") returned -1 [0201.100] lstrlenW (lpString=".ppt") returned 4 [0201.100] lstrcmpiW (lpString1=".ppt", lpString2="nces") returned -1 [0201.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.100] lstrlenW (lpString=".zip") returned 4 [0201.100] lstrcmpiW (lpString1=".zip", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString=".rar") returned 4 [0201.101] lstrcmpiW (lpString1=".rar", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString=".bz2") returned 4 [0201.101] lstrcmpiW (lpString1=".bz2", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString=".7z") returned 3 [0201.101] lstrcmpiW (lpString1=".7z", lpString2="ces") returned -1 [0201.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.101] lstrlenW (lpString=".dbf") returned 4 [0201.101] lstrcmpiW (lpString1=".dbf", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.101] lstrlenW (lpString=".1cd") returned 4 [0201.101] lstrcmpiW (lpString1=".1cd", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.101] lstrlenW (lpString=".jpg") returned 4 [0201.101] lstrcmpiW (lpString1=".jpg", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.101] lstrlenW (lpString=".doc") returned 4 [0201.101] lstrcmpiW (lpString1=".doc", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString=".docx") returned 5 [0201.101] lstrcmpiW (lpString1=".docx", lpString2="ences") returned -1 [0201.101] lstrlenW (lpString=".pdf") returned 4 [0201.101] lstrcmpiW (lpString1=".pdf", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString=".xls") returned 4 [0201.101] lstrcmpiW (lpString1=".xls", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString=".xlsx") returned 5 [0201.101] lstrcmpiW (lpString1=".xlsx", lpString2="ences") returned -1 [0201.101] lstrlenW (lpString=".ppt") returned 4 [0201.101] lstrcmpiW (lpString1=".ppt", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.101] lstrlenW (lpString=".zip") returned 4 [0201.101] lstrcmpiW (lpString1=".zip", lpString2="nces") returned -1 [0201.101] lstrlenW (lpString=".rar") returned 4 [0201.101] lstrcmpiW (lpString1=".rar", lpString2="nces") returned -1 [0201.102] lstrlenW (lpString=".bz2") returned 4 [0201.102] lstrcmpiW (lpString1=".bz2", lpString2="nces") returned -1 [0201.102] lstrlenW (lpString=".7z") returned 3 [0201.102] lstrcmpiW (lpString1=".7z", lpString2="ces") returned -1 [0201.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.102] lstrlenW (lpString=".dbf") returned 4 [0201.102] lstrcmpiW (lpString1=".dbf", lpString2="nces") returned -1 [0201.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.102] lstrlenW (lpString=".1cd") returned 4 [0201.102] lstrcmpiW (lpString1=".1cd", lpString2="nces") returned -1 [0201.102] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Secure Preferences") returned 94 [0201.102] lstrlenW (lpString=".jpg") returned 4 [0201.102] lstrcmpiW (lpString1=".jpg", lpString2="nces") returned -1 [0201.102] lstrlenW (lpString="Shortcuts") returned 9 [0201.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.102] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=12288) returned 1 [0201.102] CloseHandle (hObject=0x350) returned 1 [0201.103] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts")) returned 0x2020 [0201.103] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.103] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.103] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.103] GetLastError () returned 0x0 [0201.103] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x3000, lpOverlapped=0x0) returned 1 [0201.348] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x3010, lpOverlapped=0x0) returned 1 [0201.349] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.349] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0201.349] SetEndOfFile (hFile=0x2d8) returned 1 [0201.349] CloseHandle (hObject=0x2d8) returned 1 [0201.349] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.349] SetEndOfFile (hFile=0x350) returned 1 [0201.350] CloseHandle (hObject=0x350) returned 1 [0201.350] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.350] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\shortcuts")) returned 1 [0201.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.350] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.350] lstrlenW (lpString=".doc") returned 4 [0201.350] lstrcmpiW (lpString1=".doc", lpString2="cuts") returned -1 [0201.350] lstrlenW (lpString=".docx") returned 5 [0201.351] lstrcmpiW (lpString1=".docx", lpString2="tcuts") returned -1 [0201.351] lstrlenW (lpString=".pdf") returned 4 [0201.351] lstrcmpiW (lpString1=".pdf", lpString2="cuts") returned -1 [0201.351] lstrlenW (lpString=".xls") returned 4 [0201.351] lstrcmpiW (lpString1=".xls", lpString2="cuts") returned -1 [0201.351] lstrlenW (lpString=".xlsx") returned 5 [0201.351] lstrcmpiW (lpString1=".xlsx", lpString2="tcuts") returned -1 [0201.351] lstrlenW (lpString=".ppt") returned 4 [0201.351] lstrcmpiW (lpString1=".ppt", lpString2="cuts") returned -1 [0201.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.351] lstrlenW (lpString=".zip") returned 4 [0201.351] lstrcmpiW (lpString1=".zip", lpString2="cuts") returned -1 [0201.351] lstrlenW (lpString=".rar") returned 4 [0201.351] lstrcmpiW (lpString1=".rar", lpString2="cuts") returned -1 [0201.351] lstrlenW (lpString=".bz2") returned 4 [0201.351] lstrcmpiW (lpString1=".bz2", lpString2="cuts") returned -1 [0201.351] lstrlenW (lpString=".7z") returned 3 [0201.351] lstrcmpiW (lpString1=".7z", lpString2="uts") returned -1 [0201.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.351] lstrlenW (lpString=".dbf") returned 4 [0201.351] lstrcmpiW (lpString1=".dbf", lpString2="cuts") returned -1 [0201.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.351] lstrlenW (lpString=".1cd") returned 4 [0201.351] lstrcmpiW (lpString1=".1cd", lpString2="cuts") returned -1 [0201.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.351] lstrlenW (lpString=".jpg") returned 4 [0201.351] lstrcmpiW (lpString1=".jpg", lpString2="cuts") returned -1 [0201.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.351] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.351] lstrlenW (lpString=".doc") returned 4 [0201.351] lstrcmpiW (lpString1=".doc", lpString2="cuts") returned -1 [0201.351] lstrlenW (lpString=".docx") returned 5 [0201.351] lstrcmpiW (lpString1=".docx", lpString2="tcuts") returned -1 [0201.352] lstrlenW (lpString=".pdf") returned 4 [0201.352] lstrcmpiW (lpString1=".pdf", lpString2="cuts") returned -1 [0201.352] lstrlenW (lpString=".xls") returned 4 [0201.352] lstrcmpiW (lpString1=".xls", lpString2="cuts") returned -1 [0201.352] lstrlenW (lpString=".xlsx") returned 5 [0201.352] lstrcmpiW (lpString1=".xlsx", lpString2="tcuts") returned -1 [0201.352] lstrlenW (lpString=".ppt") returned 4 [0201.352] lstrcmpiW (lpString1=".ppt", lpString2="cuts") returned -1 [0201.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.352] lstrlenW (lpString=".zip") returned 4 [0201.352] lstrcmpiW (lpString1=".zip", lpString2="cuts") returned -1 [0201.352] lstrlenW (lpString=".rar") returned 4 [0201.352] lstrcmpiW (lpString1=".rar", lpString2="cuts") returned -1 [0201.352] lstrlenW (lpString=".bz2") returned 4 [0201.352] lstrcmpiW (lpString1=".bz2", lpString2="cuts") returned -1 [0201.352] lstrlenW (lpString=".7z") returned 3 [0201.352] lstrcmpiW (lpString1=".7z", lpString2="uts") returned -1 [0201.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.352] lstrlenW (lpString=".dbf") returned 4 [0201.352] lstrcmpiW (lpString1=".dbf", lpString2="cuts") returned -1 [0201.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.352] lstrlenW (lpString=".1cd") returned 4 [0201.352] lstrcmpiW (lpString1=".1cd", lpString2="cuts") returned -1 [0201.352] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Shortcuts") returned 85 [0201.352] lstrlenW (lpString=".jpg") returned 4 [0201.352] lstrcmpiW (lpString1=".jpg", lpString2="cuts") returned -1 [0201.352] lstrlenW (lpString="Safe Browsing Channel IDs-journal") returned 33 [0201.352] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing channel ids-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.353] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=0) returned 1 [0201.353] CloseHandle (hObject=0x350) returned 1 [0201.353] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.353] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.353] lstrlenW (lpString=".doc") returned 4 [0201.353] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.353] lstrlenW (lpString=".docx") returned 5 [0201.353] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.353] lstrlenW (lpString=".pdf") returned 4 [0201.353] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.353] lstrlenW (lpString=".xls") returned 4 [0201.353] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.353] lstrlenW (lpString=".xlsx") returned 5 [0201.354] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.354] lstrlenW (lpString=".ppt") returned 4 [0201.354] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.354] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.354] lstrlenW (lpString=".zip") returned 4 [0201.354] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.354] lstrlenW (lpString=".rar") returned 4 [0201.354] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.354] lstrlenW (lpString=".bz2") returned 4 [0201.354] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.354] lstrlenW (lpString=".7z") returned 3 [0201.354] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.354] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.354] lstrlenW (lpString=".dbf") returned 4 [0201.354] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.354] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.354] lstrlenW (lpString=".1cd") returned 4 [0201.354] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.354] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.354] lstrlenW (lpString=".jpg") returned 4 [0201.354] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.354] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.354] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.354] lstrlenW (lpString=".doc") returned 4 [0201.354] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.354] lstrlenW (lpString=".docx") returned 5 [0201.354] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.354] lstrlenW (lpString=".pdf") returned 4 [0201.354] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.354] lstrlenW (lpString=".xls") returned 4 [0201.354] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.354] lstrlenW (lpString=".xlsx") returned 5 [0201.354] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.355] lstrlenW (lpString=".ppt") returned 4 [0201.355] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.355] lstrlenW (lpString=".zip") returned 4 [0201.355] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.355] lstrlenW (lpString=".rar") returned 4 [0201.355] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.355] lstrlenW (lpString=".bz2") returned 4 [0201.355] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.355] lstrlenW (lpString=".7z") returned 3 [0201.355] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.355] lstrlenW (lpString=".dbf") returned 4 [0201.355] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.355] lstrlenW (lpString=".1cd") returned 4 [0201.355] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.355] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Channel IDs-journal") returned 101 [0201.355] lstrlenW (lpString=".jpg") returned 4 [0201.355] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.355] lstrlenW (lpString="Safe Browsing Cookies") returned 21 [0201.355] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.356] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=7168) returned 1 [0201.356] CloseHandle (hObject=0x350) returned 1 [0201.356] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies")) returned 0x2020 [0201.356] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.356] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.356] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.356] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.357] GetLastError () returned 0x0 [0201.357] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x1c00, lpOverlapped=0x0) returned 1 [0201.359] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0201.360] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.360] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0201.360] SetEndOfFile (hFile=0x2d8) returned 1 [0201.360] CloseHandle (hObject=0x2d8) returned 1 [0201.360] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.360] SetEndOfFile (hFile=0x350) returned 1 [0201.361] CloseHandle (hObject=0x350) returned 1 [0201.361] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.361] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies")) returned 1 [0201.361] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.361] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.361] lstrlenW (lpString=".doc") returned 4 [0201.362] lstrcmpiW (lpString1=".doc", lpString2="kies") returned -1 [0201.362] lstrlenW (lpString=".docx") returned 5 [0201.362] lstrcmpiW (lpString1=".docx", lpString2="okies") returned -1 [0201.362] lstrlenW (lpString=".pdf") returned 4 [0201.362] lstrcmpiW (lpString1=".pdf", lpString2="kies") returned -1 [0201.362] lstrlenW (lpString=".xls") returned 4 [0201.362] lstrcmpiW (lpString1=".xls", lpString2="kies") returned -1 [0201.362] lstrlenW (lpString=".xlsx") returned 5 [0201.362] lstrcmpiW (lpString1=".xlsx", lpString2="okies") returned -1 [0201.362] lstrlenW (lpString=".ppt") returned 4 [0201.362] lstrcmpiW (lpString1=".ppt", lpString2="kies") returned -1 [0201.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.362] lstrlenW (lpString=".zip") returned 4 [0201.362] lstrcmpiW (lpString1=".zip", lpString2="kies") returned -1 [0201.362] lstrlenW (lpString=".rar") returned 4 [0201.362] lstrcmpiW (lpString1=".rar", lpString2="kies") returned -1 [0201.362] lstrlenW (lpString=".bz2") returned 4 [0201.362] lstrcmpiW (lpString1=".bz2", lpString2="kies") returned -1 [0201.362] lstrlenW (lpString=".7z") returned 3 [0201.362] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0201.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.362] lstrlenW (lpString=".dbf") returned 4 [0201.362] lstrcmpiW (lpString1=".dbf", lpString2="kies") returned -1 [0201.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.362] lstrlenW (lpString=".1cd") returned 4 [0201.362] lstrcmpiW (lpString1=".1cd", lpString2="kies") returned -1 [0201.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.362] lstrlenW (lpString=".jpg") returned 4 [0201.362] lstrcmpiW (lpString1=".jpg", lpString2="kies") returned -1 [0201.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.362] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.362] lstrlenW (lpString=".doc") returned 4 [0201.362] lstrcmpiW (lpString1=".doc", lpString2="kies") returned -1 [0201.363] lstrlenW (lpString=".docx") returned 5 [0201.363] lstrcmpiW (lpString1=".docx", lpString2="okies") returned -1 [0201.363] lstrlenW (lpString=".pdf") returned 4 [0201.363] lstrcmpiW (lpString1=".pdf", lpString2="kies") returned -1 [0201.363] lstrlenW (lpString=".xls") returned 4 [0201.363] lstrcmpiW (lpString1=".xls", lpString2="kies") returned -1 [0201.363] lstrlenW (lpString=".xlsx") returned 5 [0201.363] lstrcmpiW (lpString1=".xlsx", lpString2="okies") returned -1 [0201.363] lstrlenW (lpString=".ppt") returned 4 [0201.363] lstrcmpiW (lpString1=".ppt", lpString2="kies") returned -1 [0201.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.363] lstrlenW (lpString=".zip") returned 4 [0201.363] lstrcmpiW (lpString1=".zip", lpString2="kies") returned -1 [0201.363] lstrlenW (lpString=".rar") returned 4 [0201.363] lstrcmpiW (lpString1=".rar", lpString2="kies") returned -1 [0201.363] lstrlenW (lpString=".bz2") returned 4 [0201.363] lstrcmpiW (lpString1=".bz2", lpString2="kies") returned -1 [0201.363] lstrlenW (lpString=".7z") returned 3 [0201.363] lstrcmpiW (lpString1=".7z", lpString2="ies") returned -1 [0201.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.363] lstrlenW (lpString=".dbf") returned 4 [0201.363] lstrcmpiW (lpString1=".dbf", lpString2="kies") returned -1 [0201.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.363] lstrlenW (lpString=".1cd") returned 4 [0201.363] lstrcmpiW (lpString1=".1cd", lpString2="kies") returned -1 [0201.363] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies") returned 89 [0201.363] lstrlenW (lpString=".jpg") returned 4 [0201.363] lstrcmpiW (lpString1=".jpg", lpString2="kies") returned -1 [0201.363] lstrlenW (lpString="Safe Browsing Cookies-journal") returned 29 [0201.364] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\safe browsing cookies-journal"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.364] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=0) returned 1 [0201.364] CloseHandle (hObject=0x350) returned 1 [0201.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.364] lstrlenW (lpString=".doc") returned 4 [0201.364] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.364] lstrlenW (lpString=".docx") returned 5 [0201.364] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.364] lstrlenW (lpString=".pdf") returned 4 [0201.364] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.364] lstrlenW (lpString=".xls") returned 4 [0201.364] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.364] lstrlenW (lpString=".xlsx") returned 5 [0201.364] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.364] lstrlenW (lpString=".ppt") returned 4 [0201.364] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.364] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.364] lstrlenW (lpString=".zip") returned 4 [0201.364] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString=".rar") returned 4 [0201.365] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString=".bz2") returned 4 [0201.365] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString=".7z") returned 3 [0201.365] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.365] lstrlenW (lpString=".dbf") returned 4 [0201.365] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.365] lstrlenW (lpString=".1cd") returned 4 [0201.365] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.365] lstrlenW (lpString=".jpg") returned 4 [0201.365] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.365] lstrlenW (lpString=".doc") returned 4 [0201.365] lstrcmpiW (lpString1=".doc", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString=".docx") returned 5 [0201.365] lstrcmpiW (lpString1=".docx", lpString2="urnal") returned -1 [0201.365] lstrlenW (lpString=".pdf") returned 4 [0201.365] lstrcmpiW (lpString1=".pdf", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString=".xls") returned 4 [0201.365] lstrcmpiW (lpString1=".xls", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString=".xlsx") returned 5 [0201.365] lstrcmpiW (lpString1=".xlsx", lpString2="urnal") returned -1 [0201.365] lstrlenW (lpString=".ppt") returned 4 [0201.365] lstrcmpiW (lpString1=".ppt", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.365] lstrlenW (lpString=".zip") returned 4 [0201.365] lstrcmpiW (lpString1=".zip", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString=".rar") returned 4 [0201.365] lstrcmpiW (lpString1=".rar", lpString2="rnal") returned -1 [0201.365] lstrlenW (lpString=".bz2") returned 4 [0201.366] lstrcmpiW (lpString1=".bz2", lpString2="rnal") returned -1 [0201.366] lstrlenW (lpString=".7z") returned 3 [0201.366] lstrcmpiW (lpString1=".7z", lpString2="nal") returned -1 [0201.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.366] lstrlenW (lpString=".dbf") returned 4 [0201.366] lstrcmpiW (lpString1=".dbf", lpString2="rnal") returned -1 [0201.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.366] lstrlenW (lpString=".1cd") returned 4 [0201.366] lstrcmpiW (lpString1=".1cd", lpString2="rnal") returned -1 [0201.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Safe Browsing Cookies-journal") returned 97 [0201.366] lstrlenW (lpString=".jpg") returned 4 [0201.366] lstrcmpiW (lpString1=".jpg", lpString2="rnal") returned -1 [0201.366] lstrcmpiW (lpString1=".feedsdb-ms", lpString2=".wiki") returned -1 [0201.366] lstrlenW (lpString="FeedsStore.feedsdb-ms") returned 21 [0201.366] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.367] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=6656) returned 1 [0201.367] CloseHandle (hObject=0x350) returned 1 [0201.367] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms")) returned 0x2020 [0201.367] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.367] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.368] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.368] GetLastError () returned 0x0 [0201.368] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x1a00, lpOverlapped=0x0) returned 1 [0201.370] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x1a10, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x1a10, lpOverlapped=0x0) returned 1 [0201.370] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.370] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0201.371] SetEndOfFile (hFile=0x2d8) returned 1 [0201.371] CloseHandle (hObject=0x2d8) returned 1 [0201.371] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.371] SetEndOfFile (hFile=0x350) returned 1 [0201.372] CloseHandle (hObject=0x350) returned 1 [0201.372] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.372] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\feedsstore.feedsdb-ms")) returned 1 [0201.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.372] lstrlenW (lpString=".doc") returned 4 [0201.372] lstrcmpiW (lpString1=".doc", lpString2="b-ms") returned -1 [0201.372] lstrlenW (lpString=".docx") returned 5 [0201.372] lstrcmpiW (lpString1=".docx", lpString2="db-ms") returned -1 [0201.372] lstrlenW (lpString=".pdf") returned 4 [0201.372] lstrcmpiW (lpString1=".pdf", lpString2="b-ms") returned -1 [0201.372] lstrlenW (lpString=".xls") returned 4 [0201.372] lstrcmpiW (lpString1=".xls", lpString2="b-ms") returned -1 [0201.372] lstrlenW (lpString=".xlsx") returned 5 [0201.372] lstrcmpiW (lpString1=".xlsx", lpString2="db-ms") returned -1 [0201.372] lstrlenW (lpString=".ppt") returned 4 [0201.372] lstrcmpiW (lpString1=".ppt", lpString2="b-ms") returned -1 [0201.372] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.372] lstrlenW (lpString=".zip") returned 4 [0201.372] lstrcmpiW (lpString1=".zip", lpString2="b-ms") returned -1 [0201.372] lstrlenW (lpString=".rar") returned 4 [0201.372] lstrcmpiW (lpString1=".rar", lpString2="b-ms") returned -1 [0201.372] lstrlenW (lpString=".bz2") returned 4 [0201.373] lstrcmpiW (lpString1=".bz2", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString=".7z") returned 3 [0201.373] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.373] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.373] lstrlenW (lpString=".dbf") returned 4 [0201.373] lstrcmpiW (lpString1=".dbf", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.373] lstrlenW (lpString=".1cd") returned 4 [0201.373] lstrcmpiW (lpString1=".1cd", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.373] lstrlenW (lpString=".jpg") returned 4 [0201.373] lstrcmpiW (lpString1=".jpg", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.373] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.373] lstrlenW (lpString=".doc") returned 4 [0201.373] lstrcmpiW (lpString1=".doc", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString=".docx") returned 5 [0201.373] lstrcmpiW (lpString1=".docx", lpString2="db-ms") returned -1 [0201.373] lstrlenW (lpString=".pdf") returned 4 [0201.373] lstrcmpiW (lpString1=".pdf", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString=".xls") returned 4 [0201.373] lstrcmpiW (lpString1=".xls", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString=".xlsx") returned 5 [0201.373] lstrcmpiW (lpString1=".xlsx", lpString2="db-ms") returned -1 [0201.373] lstrlenW (lpString=".ppt") returned 4 [0201.373] lstrcmpiW (lpString1=".ppt", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.373] lstrlenW (lpString=".zip") returned 4 [0201.373] lstrcmpiW (lpString1=".zip", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString=".rar") returned 4 [0201.373] lstrcmpiW (lpString1=".rar", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString=".bz2") returned 4 [0201.373] lstrcmpiW (lpString1=".bz2", lpString2="b-ms") returned -1 [0201.373] lstrlenW (lpString=".7z") returned 3 [0201.374] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.374] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.374] lstrlenW (lpString=".dbf") returned 4 [0201.374] lstrcmpiW (lpString1=".dbf", lpString2="b-ms") returned -1 [0201.374] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.374] lstrlenW (lpString=".1cd") returned 4 [0201.374] lstrcmpiW (lpString1=".1cd", lpString2="b-ms") returned -1 [0201.374] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\FeedsStore.feedsdb-ms") returned 81 [0201.374] lstrlenW (lpString=".jpg") returned 4 [0201.374] lstrcmpiW (lpString1=".jpg", lpString2="b-ms") returned -1 [0201.374] lstrcmpiW (lpString1=".feed-ms", lpString2=".wiki") returned -1 [0201.374] lstrlenW (lpString="Microsoft at Home~.feed-ms") returned 26 [0201.374] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.375] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=28672) returned 1 [0201.375] CloseHandle (hObject=0x350) returned 1 [0201.375] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms")) returned 0x2020 [0201.375] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.375] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.375] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.375] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.376] GetLastError () returned 0x0 [0201.376] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x7000, lpOverlapped=0x0) returned 1 [0201.381] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x7010, lpOverlapped=0x0) returned 1 [0201.382] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.382] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x108, lpOverlapped=0x0) returned 1 [0201.382] SetEndOfFile (hFile=0x2d8) returned 1 [0201.383] CloseHandle (hObject=0x2d8) returned 1 [0201.383] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.383] SetEndOfFile (hFile=0x350) returned 1 [0201.384] CloseHandle (hObject=0x350) returned 1 [0201.384] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.384] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at home~.feed-ms")) returned 1 [0201.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.384] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.385] lstrlenW (lpString=".doc") returned 4 [0201.385] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0201.385] lstrlenW (lpString=".docx") returned 5 [0201.385] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0201.385] lstrlenW (lpString=".pdf") returned 4 [0201.385] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0201.385] lstrlenW (lpString=".xls") returned 4 [0201.385] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0201.385] lstrlenW (lpString=".xlsx") returned 5 [0201.385] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0201.385] lstrlenW (lpString=".ppt") returned 4 [0201.385] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0201.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.385] lstrlenW (lpString=".zip") returned 4 [0201.385] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0201.385] lstrlenW (lpString=".rar") returned 4 [0201.385] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0201.385] lstrlenW (lpString=".bz2") returned 4 [0201.385] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0201.385] lstrlenW (lpString=".7z") returned 3 [0201.385] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.385] lstrlenW (lpString=".dbf") returned 4 [0201.385] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0201.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.385] lstrlenW (lpString=".1cd") returned 4 [0201.385] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0201.385] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.386] lstrlenW (lpString=".jpg") returned 4 [0201.386] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0201.386] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.386] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.386] lstrlenW (lpString=".doc") returned 4 [0201.386] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0201.386] lstrlenW (lpString=".docx") returned 5 [0201.386] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0201.386] lstrlenW (lpString=".pdf") returned 4 [0201.386] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0201.386] lstrlenW (lpString=".xls") returned 4 [0201.386] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0201.386] lstrlenW (lpString=".xlsx") returned 5 [0201.386] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0201.386] lstrlenW (lpString=".ppt") returned 4 [0201.386] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0201.386] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.386] lstrlenW (lpString=".zip") returned 4 [0201.386] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0201.386] lstrlenW (lpString=".rar") returned 4 [0201.386] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0201.386] lstrlenW (lpString=".bz2") returned 4 [0201.386] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0201.386] lstrlenW (lpString=".7z") returned 3 [0201.386] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.386] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.387] lstrlenW (lpString=".dbf") returned 4 [0201.387] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0201.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.387] lstrlenW (lpString=".1cd") returned 4 [0201.387] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0201.387] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Home~.feed-ms") returned 103 [0201.387] lstrlenW (lpString=".jpg") returned 4 [0201.387] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0201.387] lstrcmpiW (lpString1=".feed-ms", lpString2=".wiki") returned -1 [0201.387] lstrlenW (lpString="Microsoft at Work~.feed-ms") returned 26 [0201.387] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.388] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=28672) returned 1 [0201.388] CloseHandle (hObject=0x350) returned 1 [0201.388] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms")) returned 0x2020 [0201.388] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.388] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.388] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.388] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0201.389] GetLastError () returned 0x0 [0201.389] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x7000, lpOverlapped=0x0) returned 1 [0201.720] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x7010, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x7010, lpOverlapped=0x0) returned 1 [0201.721] ReadFile (in: hFile=0x350, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.721] WriteFile (in: hFile=0x2d8, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x108, lpOverlapped=0x0) returned 1 [0201.722] SetEndOfFile (hFile=0x2d8) returned 1 [0201.722] CloseHandle (hObject=0x2d8) returned 1 [0201.722] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.722] SetEndOfFile (hFile=0x350) returned 1 [0201.723] CloseHandle (hObject=0x350) returned 1 [0201.723] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.723] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\feeds\\microsoft feeds~\\microsoft at work~.feed-ms")) returned 1 [0201.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.723] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.723] lstrlenW (lpString=".doc") returned 4 [0201.723] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0201.723] lstrlenW (lpString=".docx") returned 5 [0201.723] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0201.723] lstrlenW (lpString=".pdf") returned 4 [0201.723] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0201.723] lstrlenW (lpString=".xls") returned 4 [0201.723] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0201.723] lstrlenW (lpString=".xlsx") returned 5 [0201.723] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0201.723] lstrlenW (lpString=".ppt") returned 4 [0201.723] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.724] lstrlenW (lpString=".zip") returned 4 [0201.724] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString=".rar") returned 4 [0201.724] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString=".bz2") returned 4 [0201.724] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString=".7z") returned 3 [0201.724] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.724] lstrlenW (lpString=".dbf") returned 4 [0201.724] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.724] lstrlenW (lpString=".1cd") returned 4 [0201.724] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.724] lstrlenW (lpString=".jpg") returned 4 [0201.724] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.724] lstrlenW (lpString=".doc") returned 4 [0201.724] lstrcmpiW (lpString1=".doc", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString=".docx") returned 5 [0201.724] lstrcmpiW (lpString1=".docx", lpString2="ed-ms") returned -1 [0201.724] lstrlenW (lpString=".pdf") returned 4 [0201.724] lstrcmpiW (lpString1=".pdf", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString=".xls") returned 4 [0201.724] lstrcmpiW (lpString1=".xls", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString=".xlsx") returned 5 [0201.724] lstrcmpiW (lpString1=".xlsx", lpString2="ed-ms") returned -1 [0201.724] lstrlenW (lpString=".ppt") returned 4 [0201.724] lstrcmpiW (lpString1=".ppt", lpString2="d-ms") returned -1 [0201.724] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.724] lstrlenW (lpString=".zip") returned 4 [0201.725] lstrcmpiW (lpString1=".zip", lpString2="d-ms") returned -1 [0201.725] lstrlenW (lpString=".rar") returned 4 [0201.725] lstrcmpiW (lpString1=".rar", lpString2="d-ms") returned -1 [0201.725] lstrlenW (lpString=".bz2") returned 4 [0201.725] lstrcmpiW (lpString1=".bz2", lpString2="d-ms") returned -1 [0201.725] lstrlenW (lpString=".7z") returned 3 [0201.725] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0201.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.725] lstrlenW (lpString=".dbf") returned 4 [0201.725] lstrcmpiW (lpString1=".dbf", lpString2="d-ms") returned -1 [0201.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.725] lstrlenW (lpString=".1cd") returned 4 [0201.725] lstrcmpiW (lpString1=".1cd", lpString2="d-ms") returned -1 [0201.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Feeds\\Microsoft Feeds~\\Microsoft at Work~.feed-ms") returned 103 [0201.725] lstrlenW (lpString=".jpg") returned 4 [0201.725] lstrcmpiW (lpString1=".jpg", lpString2="d-ms") returned -1 [0201.725] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.725] lstrlenW (lpString="09_Music_played_the_most.wpl") returned 28 [0201.725] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0201.986] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=1025) returned 1 [0201.986] CloseHandle (hObject=0x344) returned 1 [0201.986] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl")) returned 0x2020 [0201.987] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0201.987] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.987] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.987] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.987] GetLastError () returned 0x0 [0201.988] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x401, lpOverlapped=0x0) returned 1 [0201.989] WriteFile (in: hFile=0x34c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x410, lpOverlapped=0x0) returned 1 [0201.990] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.990] WriteFile (in: hFile=0x34c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x10c, lpOverlapped=0x0) returned 1 [0201.990] SetEndOfFile (hFile=0x34c) returned 1 [0201.991] CloseHandle (hObject=0x34c) returned 1 [0201.991] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.991] SetEndOfFile (hFile=0x344) returned 1 [0201.991] CloseHandle (hObject=0x344) returned 1 [0201.991] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.992] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\09_music_played_the_most.wpl")) returned 1 [0201.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.992] lstrlenW (lpString=".doc") returned 4 [0201.992] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.992] lstrlenW (lpString=".docx") returned 5 [0201.992] lstrcmpiW (lpString1=".docx", lpString2="t.wpl") returned -1 [0201.992] lstrlenW (lpString=".pdf") returned 4 [0201.992] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.992] lstrlenW (lpString=".xls") returned 4 [0201.992] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.992] lstrlenW (lpString=".xlsx") returned 5 [0201.992] lstrcmpiW (lpString1=".xlsx", lpString2="t.wpl") returned -1 [0201.992] lstrlenW (lpString=".ppt") returned 4 [0201.992] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.992] lstrlenW (lpString=".zip") returned 4 [0201.992] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.992] lstrlenW (lpString=".rar") returned 4 [0201.992] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.992] lstrlenW (lpString=".bz2") returned 4 [0201.992] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.992] lstrlenW (lpString=".7z") returned 3 [0201.992] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.993] lstrlenW (lpString=".dbf") returned 4 [0201.993] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.993] lstrlenW (lpString=".1cd") returned 4 [0201.993] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.993] lstrlenW (lpString=".jpg") returned 4 [0201.993] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.993] lstrlenW (lpString=".doc") returned 4 [0201.993] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.993] lstrlenW (lpString=".docx") returned 5 [0201.993] lstrcmpiW (lpString1=".docx", lpString2="t.wpl") returned -1 [0201.993] lstrlenW (lpString=".pdf") returned 4 [0201.993] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.993] lstrlenW (lpString=".xls") returned 4 [0201.993] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0201.993] lstrlenW (lpString=".xlsx") returned 5 [0201.993] lstrcmpiW (lpString1=".xlsx", lpString2="t.wpl") returned -1 [0201.993] lstrlenW (lpString=".ppt") returned 4 [0201.993] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0201.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.993] lstrlenW (lpString=".zip") returned 4 [0201.993] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0201.993] lstrlenW (lpString=".rar") returned 4 [0201.993] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0201.993] lstrlenW (lpString=".bz2") returned 4 [0201.993] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0201.993] lstrlenW (lpString=".7z") returned 3 [0201.993] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0201.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.993] lstrlenW (lpString=".dbf") returned 4 [0201.994] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0201.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.994] lstrlenW (lpString=".1cd") returned 4 [0201.994] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0201.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\09_Music_played_the_most.wpl") returned 125 [0201.994] lstrlenW (lpString=".jpg") returned 4 [0201.994] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0201.994] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.994] lstrlenW (lpString="12_All_Video.wpl") returned 16 [0201.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0201.994] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=1079) returned 1 [0201.994] CloseHandle (hObject=0x344) returned 1 [0201.995] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl")) returned 0x2020 [0201.995] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0201.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0201.995] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.995] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.995] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0201.995] GetLastError () returned 0x0 [0201.995] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x437, lpOverlapped=0x0) returned 1 [0201.997] WriteFile (in: hFile=0x34c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x440, lpOverlapped=0x0) returned 1 [0201.998] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0201.998] WriteFile (in: hFile=0x34c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0201.998] SetEndOfFile (hFile=0x34c) returned 1 [0201.998] CloseHandle (hObject=0x34c) returned 1 [0201.998] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0201.998] SetEndOfFile (hFile=0x344) returned 1 [0201.999] CloseHandle (hObject=0x344) returned 1 [0201.999] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.999] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\12_all_video.wpl")) returned 1 [0201.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0201.999] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0201.999] lstrlenW (lpString=".doc") returned 4 [0201.999] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0201.999] lstrlenW (lpString=".docx") returned 5 [0201.999] lstrcmpiW (lpString1=".docx", lpString2="o.wpl") returned -1 [0201.999] lstrlenW (lpString=".pdf") returned 4 [0201.999] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0201.999] lstrlenW (lpString=".xls") returned 4 [0202.000] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.000] lstrlenW (lpString=".xlsx") returned 5 [0202.000] lstrcmpiW (lpString1=".xlsx", lpString2="o.wpl") returned -1 [0202.000] lstrlenW (lpString=".ppt") returned 4 [0202.000] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0202.000] lstrlenW (lpString=".zip") returned 4 [0202.000] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.000] lstrlenW (lpString=".rar") returned 4 [0202.000] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.000] lstrlenW (lpString=".bz2") returned 4 [0202.000] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.000] lstrlenW (lpString=".7z") returned 3 [0202.000] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0202.000] lstrlenW (lpString=".dbf") returned 4 [0202.000] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0202.000] lstrlenW (lpString=".1cd") returned 4 [0202.000] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0202.000] lstrlenW (lpString=".jpg") returned 4 [0202.000] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0202.000] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0202.000] lstrlenW (lpString=".doc") returned 4 [0202.000] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.000] lstrlenW (lpString=".docx") returned 5 [0202.000] lstrcmpiW (lpString1=".docx", lpString2="o.wpl") returned -1 [0202.000] lstrlenW (lpString=".pdf") returned 4 [0202.000] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.000] lstrlenW (lpString=".xls") returned 4 [0202.000] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.001] lstrlenW (lpString=".xlsx") returned 5 [0202.001] lstrcmpiW (lpString1=".xlsx", lpString2="o.wpl") returned -1 [0202.001] lstrlenW (lpString=".ppt") returned 4 [0202.001] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.001] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0202.001] lstrlenW (lpString=".zip") returned 4 [0202.001] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.001] lstrlenW (lpString=".rar") returned 4 [0202.001] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.001] lstrlenW (lpString=".bz2") returned 4 [0202.001] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.001] lstrlenW (lpString=".7z") returned 3 [0202.001] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.001] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0202.001] lstrlenW (lpString=".dbf") returned 4 [0202.001] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.001] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0202.001] lstrlenW (lpString=".1cd") returned 4 [0202.001] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.001] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\12_All_Video.wpl") returned 113 [0202.001] lstrlenW (lpString=".jpg") returned 4 [0202.002] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.002] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.002] lstrlenW (lpString="01_Music_auto_rated_at_5_stars.wpl") returned 34 [0202.003] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.004] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=1044) returned 1 [0202.004] CloseHandle (hObject=0x344) returned 1 [0202.004] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl")) returned 0x2020 [0202.004] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.004] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.005] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.005] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.005] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0202.005] GetLastError () returned 0x0 [0202.005] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x414, lpOverlapped=0x0) returned 1 [0202.007] WriteFile (in: hFile=0x34c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x420, lpOverlapped=0x0) returned 1 [0202.007] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.007] WriteFile (in: hFile=0x34c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x118, lpOverlapped=0x0) returned 1 [0202.008] SetEndOfFile (hFile=0x34c) returned 1 [0202.008] CloseHandle (hObject=0x34c) returned 1 [0202.008] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.008] SetEndOfFile (hFile=0x344) returned 1 [0202.009] CloseHandle (hObject=0x344) returned 1 [0202.009] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.009] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\01_music_auto_rated_at_5_stars.wpl")) returned 1 [0202.009] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.009] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.009] lstrlenW (lpString=".doc") returned 4 [0202.009] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.009] lstrlenW (lpString=".docx") returned 5 [0202.009] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.009] lstrlenW (lpString=".pdf") returned 4 [0202.009] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.009] lstrlenW (lpString=".xls") returned 4 [0202.009] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.009] lstrlenW (lpString=".xlsx") returned 5 [0202.009] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.009] lstrlenW (lpString=".ppt") returned 4 [0202.009] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.009] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.009] lstrlenW (lpString=".zip") returned 4 [0202.009] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.009] lstrlenW (lpString=".rar") returned 4 [0202.009] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.010] lstrlenW (lpString=".bz2") returned 4 [0202.010] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.010] lstrlenW (lpString=".7z") returned 3 [0202.010] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.010] lstrlenW (lpString=".dbf") returned 4 [0202.010] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.010] lstrlenW (lpString=".1cd") returned 4 [0202.010] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.010] lstrlenW (lpString=".jpg") returned 4 [0202.010] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.010] lstrlenW (lpString=".doc") returned 4 [0202.010] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.010] lstrlenW (lpString=".docx") returned 5 [0202.010] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.010] lstrlenW (lpString=".pdf") returned 4 [0202.010] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.010] lstrlenW (lpString=".xls") returned 4 [0202.010] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.010] lstrlenW (lpString=".xlsx") returned 5 [0202.010] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.010] lstrlenW (lpString=".ppt") returned 4 [0202.010] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.010] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.010] lstrlenW (lpString=".zip") returned 4 [0202.010] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.010] lstrlenW (lpString=".rar") returned 4 [0202.010] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.010] lstrlenW (lpString=".bz2") returned 4 [0202.011] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.011] lstrlenW (lpString=".7z") returned 3 [0202.011] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.011] lstrlenW (lpString=".dbf") returned 4 [0202.011] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.011] lstrlenW (lpString=".1cd") returned 4 [0202.011] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.011] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\01_Music_auto_rated_at_5_stars.wpl") returned 131 [0202.011] lstrlenW (lpString=".jpg") returned 4 [0202.011] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.011] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.011] lstrlenW (lpString="02_Music_added_in_the_last_month.wpl") returned 36 [0202.011] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.012] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=1279) returned 1 [0202.012] CloseHandle (hObject=0x344) returned 1 [0202.012] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl")) returned 0x2020 [0202.012] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.012] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.012] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.012] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0202.013] GetLastError () returned 0x0 [0202.013] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x4ff, lpOverlapped=0x0) returned 1 [0202.015] WriteFile (in: hFile=0x34c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x500, lpOverlapped=0x0) returned 1 [0202.015] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.015] WriteFile (in: hFile=0x34c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x11c, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x11c, lpOverlapped=0x0) returned 1 [0202.016] SetEndOfFile (hFile=0x34c) returned 1 [0202.016] CloseHandle (hObject=0x34c) returned 1 [0202.016] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.016] SetEndOfFile (hFile=0x344) returned 1 [0202.017] CloseHandle (hObject=0x344) returned 1 [0202.017] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.017] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\02_music_added_in_the_last_month.wpl")) returned 1 [0202.017] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.017] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.017] lstrlenW (lpString=".doc") returned 4 [0202.017] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.017] lstrlenW (lpString=".docx") returned 5 [0202.017] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0202.017] lstrlenW (lpString=".pdf") returned 4 [0202.017] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.017] lstrlenW (lpString=".xls") returned 4 [0202.017] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.017] lstrlenW (lpString=".xlsx") returned 5 [0202.017] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0202.017] lstrlenW (lpString=".ppt") returned 4 [0202.018] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.018] lstrlenW (lpString=".zip") returned 4 [0202.018] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.018] lstrlenW (lpString=".rar") returned 4 [0202.018] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.018] lstrlenW (lpString=".bz2") returned 4 [0202.018] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.018] lstrlenW (lpString=".7z") returned 3 [0202.018] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.018] lstrlenW (lpString=".dbf") returned 4 [0202.018] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.018] lstrlenW (lpString=".1cd") returned 4 [0202.018] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.018] lstrlenW (lpString=".jpg") returned 4 [0202.018] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.018] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.018] lstrlenW (lpString=".doc") returned 4 [0202.018] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.018] lstrlenW (lpString=".docx") returned 5 [0202.018] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0202.018] lstrlenW (lpString=".pdf") returned 4 [0202.018] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.018] lstrlenW (lpString=".xls") returned 4 [0202.018] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.018] lstrlenW (lpString=".xlsx") returned 5 [0202.018] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0202.018] lstrlenW (lpString=".ppt") returned 4 [0202.018] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.019] lstrlenW (lpString=".zip") returned 4 [0202.019] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.019] lstrlenW (lpString=".rar") returned 4 [0202.019] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.019] lstrlenW (lpString=".bz2") returned 4 [0202.019] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.019] lstrlenW (lpString=".7z") returned 3 [0202.019] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.019] lstrlenW (lpString=".dbf") returned 4 [0202.019] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.019] lstrlenW (lpString=".1cd") returned 4 [0202.019] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.019] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\02_Music_added_in_the_last_month.wpl") returned 133 [0202.019] lstrlenW (lpString=".jpg") returned 4 [0202.019] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.019] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.019] lstrlenW (lpString="03_Music_rated_at_4_or_5_stars.wpl") returned 34 [0202.019] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.020] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=1267) returned 1 [0202.020] CloseHandle (hObject=0x344) returned 1 [0202.020] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl")) returned 0x2020 [0202.020] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.020] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.020] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.020] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0202.021] GetLastError () returned 0x0 [0202.021] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x4f3, lpOverlapped=0x0) returned 1 [0202.204] WriteFile (in: hFile=0x34c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x500, lpOverlapped=0x0) returned 1 [0202.204] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.205] WriteFile (in: hFile=0x34c, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x118, lpOverlapped=0x0) returned 1 [0202.205] SetEndOfFile (hFile=0x34c) returned 1 [0202.563] CloseHandle (hObject=0x34c) returned 1 [0202.654] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.654] SetEndOfFile (hFile=0x344) returned 1 [0202.654] CloseHandle (hObject=0x344) returned 1 [0202.654] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.655] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\03_music_rated_at_4_or_5_stars.wpl")) returned 1 [0202.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.655] lstrlenW (lpString=".doc") returned 4 [0202.655] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.655] lstrlenW (lpString=".docx") returned 5 [0202.655] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.655] lstrlenW (lpString=".pdf") returned 4 [0202.655] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.655] lstrlenW (lpString=".xls") returned 4 [0202.655] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.655] lstrlenW (lpString=".xlsx") returned 5 [0202.655] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.655] lstrlenW (lpString=".ppt") returned 4 [0202.655] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.655] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.655] lstrlenW (lpString=".zip") returned 4 [0202.655] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.663] lstrlenW (lpString=".rar") returned 4 [0202.663] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.668] lstrlenW (lpString=".bz2") returned 4 [0202.668] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.668] lstrlenW (lpString=".7z") returned 3 [0202.671] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.671] lstrlenW (lpString=".dbf") returned 4 [0202.671] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.671] lstrlenW (lpString=".1cd") returned 4 [0202.671] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.671] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.671] lstrlenW (lpString=".jpg") returned 4 [0202.676] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.681] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.681] lstrlenW (lpString=".doc") returned 4 [0202.681] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.686] lstrlenW (lpString=".docx") returned 5 [0202.689] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.689] lstrlenW (lpString=".pdf") returned 4 [0202.689] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.689] lstrlenW (lpString=".xls") returned 4 [0202.689] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.689] lstrlenW (lpString=".xlsx") returned 5 [0202.689] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.689] lstrlenW (lpString=".ppt") returned 4 [0202.689] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.689] lstrlenW (lpString=".zip") returned 4 [0202.690] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.690] lstrlenW (lpString=".rar") returned 4 [0202.690] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.690] lstrlenW (lpString=".bz2") returned 4 [0202.690] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.690] lstrlenW (lpString=".7z") returned 3 [0202.690] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.690] lstrlenW (lpString=".dbf") returned 4 [0202.690] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.690] lstrlenW (lpString=".1cd") returned 4 [0202.690] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\03_Music_rated_at_4_or_5_stars.wpl") returned 131 [0202.690] lstrlenW (lpString=".jpg") returned 4 [0202.690] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.690] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.690] lstrlenW (lpString="12_All_Video.wpl") returned 16 [0202.690] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.691] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=1079) returned 1 [0202.691] CloseHandle (hObject=0x344) returned 1 [0202.691] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl")) returned 0x2020 [0202.691] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.691] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.691] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0202.691] GetLastError () returned 0x0 [0202.691] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x437, lpOverlapped=0x0) returned 1 [0202.693] WriteFile (in: hFile=0x354, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x440, lpOverlapped=0x0) returned 1 [0202.694] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.694] WriteFile (in: hFile=0x354, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0202.694] SetEndOfFile (hFile=0x354) returned 1 [0202.694] CloseHandle (hObject=0x354) returned 1 [0202.694] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.694] SetEndOfFile (hFile=0x344) returned 1 [0202.695] CloseHandle (hObject=0x344) returned 1 [0202.695] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.695] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\12_all_video.wpl")) returned 1 [0202.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.695] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.695] lstrlenW (lpString=".doc") returned 4 [0202.695] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.695] lstrlenW (lpString=".docx") returned 5 [0202.695] lstrcmpiW (lpString1=".docx", lpString2="o.wpl") returned -1 [0202.695] lstrlenW (lpString=".pdf") returned 4 [0202.695] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.695] lstrlenW (lpString=".xls") returned 4 [0202.695] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.695] lstrlenW (lpString=".xlsx") returned 5 [0202.695] lstrcmpiW (lpString1=".xlsx", lpString2="o.wpl") returned -1 [0202.696] lstrlenW (lpString=".ppt") returned 4 [0202.696] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.696] lstrlenW (lpString=".zip") returned 4 [0202.696] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.696] lstrlenW (lpString=".rar") returned 4 [0202.696] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.696] lstrlenW (lpString=".bz2") returned 4 [0202.696] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.696] lstrlenW (lpString=".7z") returned 3 [0202.696] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.696] lstrlenW (lpString=".dbf") returned 4 [0202.696] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.696] lstrlenW (lpString=".1cd") returned 4 [0202.696] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.696] lstrlenW (lpString=".jpg") returned 4 [0202.696] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.696] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.696] lstrlenW (lpString=".doc") returned 4 [0202.696] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.696] lstrlenW (lpString=".docx") returned 5 [0202.696] lstrcmpiW (lpString1=".docx", lpString2="o.wpl") returned -1 [0202.696] lstrlenW (lpString=".pdf") returned 4 [0202.696] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.696] lstrlenW (lpString=".xls") returned 4 [0202.696] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.696] lstrlenW (lpString=".xlsx") returned 5 [0202.696] lstrcmpiW (lpString1=".xlsx", lpString2="o.wpl") returned -1 [0202.696] lstrlenW (lpString=".ppt") returned 4 [0202.696] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.697] lstrlenW (lpString=".zip") returned 4 [0202.697] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.697] lstrlenW (lpString=".rar") returned 4 [0202.697] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.697] lstrlenW (lpString=".bz2") returned 4 [0202.697] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.697] lstrlenW (lpString=".7z") returned 3 [0202.697] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.697] lstrlenW (lpString=".dbf") returned 4 [0202.697] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.697] lstrlenW (lpString=".1cd") returned 4 [0202.697] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\12_All_Video.wpl") returned 113 [0202.697] lstrlenW (lpString=".jpg") returned 4 [0202.697] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.697] lstrcmpiW (lpString1=".FSD", lpString2=".wiki") returned -1 [0202.697] lstrlenW (lpString="FSD-CNRY.FSD") returned 12 [0202.697] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.700] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=131072) returned 1 [0202.700] CloseHandle (hObject=0x344) returned 1 [0202.701] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd")) returned 0x2020 [0202.701] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.701] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.701] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0202.703] GetLastError () returned 0x0 [0202.703] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x20000, lpOverlapped=0x0) returned 1 [0202.707] WriteFile (in: hFile=0x154, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x20010, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x20010, lpOverlapped=0x0) returned 1 [0202.710] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.710] WriteFile (in: hFile=0x154, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xec, lpOverlapped=0x0) returned 1 [0202.710] SetEndOfFile (hFile=0x154) returned 1 [0202.710] CloseHandle (hObject=0x154) returned 1 [0202.710] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.710] SetEndOfFile (hFile=0x344) returned 1 [0202.712] CloseHandle (hObject=0x344) returned 1 [0202.712] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.712] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-cnry.fsd")) returned 1 [0202.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.712] lstrlenW (lpString=".doc") returned 4 [0202.712] lstrcmpiW (lpString1=".doc", lpString2=".FSD") returned -1 [0202.712] lstrlenW (lpString=".docx") returned 5 [0202.712] lstrcmpiW (lpString1=".docx", lpString2="Y.FSD") returned -1 [0202.712] lstrlenW (lpString=".pdf") returned 4 [0202.712] lstrcmpiW (lpString1=".pdf", lpString2=".FSD") returned 1 [0202.712] lstrlenW (lpString=".xls") returned 4 [0202.712] lstrcmpiW (lpString1=".xls", lpString2=".FSD") returned 1 [0202.712] lstrlenW (lpString=".xlsx") returned 5 [0202.712] lstrcmpiW (lpString1=".xlsx", lpString2="Y.FSD") returned -1 [0202.712] lstrlenW (lpString=".ppt") returned 4 [0202.712] lstrcmpiW (lpString1=".ppt", lpString2=".FSD") returned 1 [0202.712] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.712] lstrlenW (lpString=".zip") returned 4 [0202.712] lstrcmpiW (lpString1=".zip", lpString2=".FSD") returned 1 [0202.712] lstrlenW (lpString=".rar") returned 4 [0202.712] lstrcmpiW (lpString1=".rar", lpString2=".FSD") returned 1 [0202.713] lstrlenW (lpString=".bz2") returned 4 [0202.713] lstrcmpiW (lpString1=".bz2", lpString2=".FSD") returned -1 [0202.713] lstrlenW (lpString=".7z") returned 3 [0202.713] lstrcmpiW (lpString1=".7z", lpString2="FSD") returned -1 [0202.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.713] lstrlenW (lpString=".dbf") returned 4 [0202.713] lstrcmpiW (lpString1=".dbf", lpString2=".FSD") returned -1 [0202.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.713] lstrlenW (lpString=".1cd") returned 4 [0202.713] lstrcmpiW (lpString1=".1cd", lpString2=".FSD") returned -1 [0202.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.713] lstrlenW (lpString=".jpg") returned 4 [0202.713] lstrcmpiW (lpString1=".jpg", lpString2=".FSD") returned 1 [0202.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.713] lstrlenW (lpString=".doc") returned 4 [0202.713] lstrcmpiW (lpString1=".doc", lpString2=".FSD") returned -1 [0202.713] lstrlenW (lpString=".docx") returned 5 [0202.713] lstrcmpiW (lpString1=".docx", lpString2="Y.FSD") returned -1 [0202.713] lstrlenW (lpString=".pdf") returned 4 [0202.713] lstrcmpiW (lpString1=".pdf", lpString2=".FSD") returned 1 [0202.713] lstrlenW (lpString=".xls") returned 4 [0202.713] lstrcmpiW (lpString1=".xls", lpString2=".FSD") returned 1 [0202.713] lstrlenW (lpString=".xlsx") returned 5 [0202.713] lstrcmpiW (lpString1=".xlsx", lpString2="Y.FSD") returned -1 [0202.713] lstrlenW (lpString=".ppt") returned 4 [0202.713] lstrcmpiW (lpString1=".ppt", lpString2=".FSD") returned 1 [0202.713] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.713] lstrlenW (lpString=".zip") returned 4 [0202.713] lstrcmpiW (lpString1=".zip", lpString2=".FSD") returned 1 [0202.713] lstrlenW (lpString=".rar") returned 4 [0202.713] lstrcmpiW (lpString1=".rar", lpString2=".FSD") returned 1 [0202.713] lstrlenW (lpString=".bz2") returned 4 [0202.713] lstrcmpiW (lpString1=".bz2", lpString2=".FSD") returned -1 [0202.713] lstrlenW (lpString=".7z") returned 3 [0202.714] lstrcmpiW (lpString1=".7z", lpString2="FSD") returned -1 [0202.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.714] lstrlenW (lpString=".dbf") returned 4 [0202.714] lstrcmpiW (lpString1=".dbf", lpString2=".FSD") returned -1 [0202.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.714] lstrlenW (lpString=".1cd") returned 4 [0202.714] lstrcmpiW (lpString1=".1cd", lpString2=".FSD") returned -1 [0202.714] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-CNRY.FSD") returned 94 [0202.714] lstrlenW (lpString=".jpg") returned 4 [0202.714] lstrcmpiW (lpString1=".jpg", lpString2=".FSD") returned 1 [0202.714] lstrcmpiW (lpString1=".FSD", lpString2=".wiki") returned -1 [0202.714] lstrlenW (lpString="FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 46 [0202.714] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.715] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=131072) returned 1 [0202.715] CloseHandle (hObject=0x344) returned 1 [0202.715] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd")) returned 0x2020 [0202.715] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.715] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.715] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.715] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0202.716] GetLastError () returned 0x0 [0202.716] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x20000, lpOverlapped=0x0) returned 1 [0202.720] WriteFile (in: hFile=0x154, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x20010, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x20010, lpOverlapped=0x0) returned 1 [0202.724] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.724] WriteFile (in: hFile=0x154, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x130, lpOverlapped=0x0) returned 1 [0202.724] SetEndOfFile (hFile=0x154) returned 1 [0202.724] CloseHandle (hObject=0x154) returned 1 [0202.724] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.725] SetEndOfFile (hFile=0x344) returned 1 [0202.726] CloseHandle (hObject=0x344) returned 1 [0202.726] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.726] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsd-{48508c83-ec67-468f-aa1f-6f3caf625658}.fsd")) returned 1 [0202.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.726] lstrlenW (lpString=".doc") returned 4 [0202.726] lstrcmpiW (lpString1=".doc", lpString2=".FSD") returned -1 [0202.726] lstrlenW (lpString=".docx") returned 5 [0202.726] lstrcmpiW (lpString1=".docx", lpString2="}.FSD") returned -1 [0202.726] lstrlenW (lpString=".pdf") returned 4 [0202.727] lstrcmpiW (lpString1=".pdf", lpString2=".FSD") returned 1 [0202.727] lstrlenW (lpString=".xls") returned 4 [0202.727] lstrcmpiW (lpString1=".xls", lpString2=".FSD") returned 1 [0202.727] lstrlenW (lpString=".xlsx") returned 5 [0202.727] lstrcmpiW (lpString1=".xlsx", lpString2="}.FSD") returned -1 [0202.727] lstrlenW (lpString=".ppt") returned 4 [0202.727] lstrcmpiW (lpString1=".ppt", lpString2=".FSD") returned 1 [0202.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.727] lstrlenW (lpString=".zip") returned 4 [0202.727] lstrcmpiW (lpString1=".zip", lpString2=".FSD") returned 1 [0202.727] lstrlenW (lpString=".rar") returned 4 [0202.727] lstrcmpiW (lpString1=".rar", lpString2=".FSD") returned 1 [0202.727] lstrlenW (lpString=".bz2") returned 4 [0202.727] lstrcmpiW (lpString1=".bz2", lpString2=".FSD") returned -1 [0202.727] lstrlenW (lpString=".7z") returned 3 [0202.727] lstrcmpiW (lpString1=".7z", lpString2="FSD") returned -1 [0202.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.727] lstrlenW (lpString=".dbf") returned 4 [0202.727] lstrcmpiW (lpString1=".dbf", lpString2=".FSD") returned -1 [0202.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.727] lstrlenW (lpString=".1cd") returned 4 [0202.727] lstrcmpiW (lpString1=".1cd", lpString2=".FSD") returned -1 [0202.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.727] lstrlenW (lpString=".jpg") returned 4 [0202.727] lstrcmpiW (lpString1=".jpg", lpString2=".FSD") returned 1 [0202.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.727] lstrlenW (lpString=".doc") returned 4 [0202.727] lstrcmpiW (lpString1=".doc", lpString2=".FSD") returned -1 [0202.727] lstrlenW (lpString=".docx") returned 5 [0202.727] lstrcmpiW (lpString1=".docx", lpString2="}.FSD") returned -1 [0202.727] lstrlenW (lpString=".pdf") returned 4 [0202.728] lstrcmpiW (lpString1=".pdf", lpString2=".FSD") returned 1 [0202.728] lstrlenW (lpString=".xls") returned 4 [0202.728] lstrcmpiW (lpString1=".xls", lpString2=".FSD") returned 1 [0202.728] lstrlenW (lpString=".xlsx") returned 5 [0202.728] lstrcmpiW (lpString1=".xlsx", lpString2="}.FSD") returned -1 [0202.728] lstrlenW (lpString=".ppt") returned 4 [0202.728] lstrcmpiW (lpString1=".ppt", lpString2=".FSD") returned 1 [0202.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.728] lstrlenW (lpString=".zip") returned 4 [0202.728] lstrcmpiW (lpString1=".zip", lpString2=".FSD") returned 1 [0202.728] lstrlenW (lpString=".rar") returned 4 [0202.728] lstrcmpiW (lpString1=".rar", lpString2=".FSD") returned 1 [0202.728] lstrlenW (lpString=".bz2") returned 4 [0202.728] lstrcmpiW (lpString1=".bz2", lpString2=".FSD") returned -1 [0202.728] lstrlenW (lpString=".7z") returned 3 [0202.728] lstrcmpiW (lpString1=".7z", lpString2="FSD") returned -1 [0202.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.728] lstrlenW (lpString=".dbf") returned 4 [0202.728] lstrcmpiW (lpString1=".dbf", lpString2=".FSD") returned -1 [0202.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.728] lstrlenW (lpString=".1cd") returned 4 [0202.728] lstrcmpiW (lpString1=".1cd", lpString2=".FSD") returned -1 [0202.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSD-{48508C83-EC67-468F-AA1F-6F3CAF625658}.FSD") returned 128 [0202.728] lstrlenW (lpString=".jpg") returned 4 [0202.728] lstrcmpiW (lpString1=".jpg", lpString2=".FSD") returned 1 [0202.728] lstrcmpiW (lpString1=".FSF", lpString2=".wiki") returned -1 [0202.728] lstrlenW (lpString="FSF-CTBL.FSF") returned 12 [0202.728] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.729] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=114) returned 1 [0202.729] CloseHandle (hObject=0x344) returned 1 [0202.729] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf")) returned 0x2020 [0202.729] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.729] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.729] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.729] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0202.730] GetLastError () returned 0x0 [0202.730] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x72, lpOverlapped=0x0) returned 1 [0202.746] WriteFile (in: hFile=0x154, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x80, lpOverlapped=0x0) returned 1 [0202.747] ReadFile (in: hFile=0x344, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.747] WriteFile (in: hFile=0x154, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xec, lpOverlapped=0x0) returned 1 [0202.747] SetEndOfFile (hFile=0x154) returned 1 [0202.747] CloseHandle (hObject=0x154) returned 1 [0202.748] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.748] SetEndOfFile (hFile=0x344) returned 1 [0202.748] CloseHandle (hObject=0x344) returned 1 [0202.748] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.748] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\office\\14.0\\officefilecache\\fsf-ctbl.fsf")) returned 1 [0202.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.749] lstrlenW (lpString=".doc") returned 4 [0202.749] lstrcmpiW (lpString1=".doc", lpString2=".FSF") returned -1 [0202.749] lstrlenW (lpString=".docx") returned 5 [0202.749] lstrcmpiW (lpString1=".docx", lpString2="L.FSF") returned -1 [0202.749] lstrlenW (lpString=".pdf") returned 4 [0202.749] lstrcmpiW (lpString1=".pdf", lpString2=".FSF") returned 1 [0202.749] lstrlenW (lpString=".xls") returned 4 [0202.749] lstrcmpiW (lpString1=".xls", lpString2=".FSF") returned 1 [0202.749] lstrlenW (lpString=".xlsx") returned 5 [0202.749] lstrcmpiW (lpString1=".xlsx", lpString2="L.FSF") returned -1 [0202.749] lstrlenW (lpString=".ppt") returned 4 [0202.749] lstrcmpiW (lpString1=".ppt", lpString2=".FSF") returned 1 [0202.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.749] lstrlenW (lpString=".zip") returned 4 [0202.749] lstrcmpiW (lpString1=".zip", lpString2=".FSF") returned 1 [0202.749] lstrlenW (lpString=".rar") returned 4 [0202.749] lstrcmpiW (lpString1=".rar", lpString2=".FSF") returned 1 [0202.749] lstrlenW (lpString=".bz2") returned 4 [0202.749] lstrcmpiW (lpString1=".bz2", lpString2=".FSF") returned -1 [0202.749] lstrlenW (lpString=".7z") returned 3 [0202.749] lstrcmpiW (lpString1=".7z", lpString2="FSF") returned -1 [0202.749] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.749] lstrlenW (lpString=".dbf") returned 4 [0202.750] lstrcmpiW (lpString1=".dbf", lpString2=".FSF") returned -1 [0202.750] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.750] lstrlenW (lpString=".1cd") returned 4 [0202.750] lstrcmpiW (lpString1=".1cd", lpString2=".FSF") returned -1 [0202.750] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.750] lstrlenW (lpString=".jpg") returned 4 [0202.750] lstrcmpiW (lpString1=".jpg", lpString2=".FSF") returned 1 [0202.750] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.750] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.750] lstrlenW (lpString=".doc") returned 4 [0202.750] lstrcmpiW (lpString1=".doc", lpString2=".FSF") returned -1 [0202.750] lstrlenW (lpString=".docx") returned 5 [0202.750] lstrcmpiW (lpString1=".docx", lpString2="L.FSF") returned -1 [0202.750] lstrlenW (lpString=".pdf") returned 4 [0202.750] lstrcmpiW (lpString1=".pdf", lpString2=".FSF") returned 1 [0202.750] lstrlenW (lpString=".xls") returned 4 [0202.750] lstrcmpiW (lpString1=".xls", lpString2=".FSF") returned 1 [0202.750] lstrlenW (lpString=".xlsx") returned 5 [0202.750] lstrcmpiW (lpString1=".xlsx", lpString2="L.FSF") returned -1 [0202.750] lstrlenW (lpString=".ppt") returned 4 [0202.750] lstrcmpiW (lpString1=".ppt", lpString2=".FSF") returned 1 [0202.750] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.750] lstrlenW (lpString=".zip") returned 4 [0202.750] lstrcmpiW (lpString1=".zip", lpString2=".FSF") returned 1 [0202.750] lstrlenW (lpString=".rar") returned 4 [0202.750] lstrcmpiW (lpString1=".rar", lpString2=".FSF") returned 1 [0202.750] lstrlenW (lpString=".bz2") returned 4 [0202.750] lstrcmpiW (lpString1=".bz2", lpString2=".FSF") returned -1 [0202.750] lstrlenW (lpString=".7z") returned 3 [0202.750] lstrcmpiW (lpString1=".7z", lpString2="FSF") returned -1 [0202.750] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.750] lstrlenW (lpString=".dbf") returned 4 [0202.750] lstrcmpiW (lpString1=".dbf", lpString2=".FSF") returned -1 [0202.751] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.751] lstrlenW (lpString=".1cd") returned 4 [0202.751] lstrcmpiW (lpString1=".1cd", lpString2=".FSF") returned -1 [0202.751] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Office\\14.0\\OfficeFileCache\\FSF-CTBL.FSF") returned 94 [0202.751] lstrlenW (lpString=".jpg") returned 4 [0202.751] lstrcmpiW (lpString1=".jpg", lpString2=".FSF") returned 1 [0202.751] lstrcmpiW (lpString1=".obi", lpString2=".wiki") returned -1 [0202.751] lstrlenW (lpString="Outlook.sharing.xml.obi") returned 23 [0202.751] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.774] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=185) returned 1 [0202.774] CloseHandle (hObject=0x2d4) returned 1 [0202.775] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi")) returned 0x2020 [0202.775] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0202.775] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.775] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.775] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0202.775] GetLastError () returned 0x0 [0202.775] ReadFile (in: hFile=0x2d4, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0xb9, lpOverlapped=0x0) returned 1 [0202.776] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xc0, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xc0, lpOverlapped=0x0) returned 1 [0202.777] ReadFile (in: hFile=0x2d4, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0202.777] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x102, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x102, lpOverlapped=0x0) returned 1 [0202.777] SetEndOfFile (hFile=0x344) returned 1 [0202.777] CloseHandle (hObject=0x344) returned 1 [0202.777] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0202.777] SetEndOfFile (hFile=0x2d4) returned 1 [0202.778] CloseHandle (hObject=0x2d4) returned 1 [0202.778] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.778] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\outlook\\outlook.sharing.xml.obi")) returned 1 [0202.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.779] lstrlenW (lpString=".doc") returned 4 [0202.779] lstrcmpiW (lpString1=".doc", lpString2=".obi") returned -1 [0202.779] lstrlenW (lpString=".docx") returned 5 [0202.779] lstrcmpiW (lpString1=".docx", lpString2="l.obi") returned -1 [0202.779] lstrlenW (lpString=".pdf") returned 4 [0202.779] lstrcmpiW (lpString1=".pdf", lpString2=".obi") returned 1 [0202.779] lstrlenW (lpString=".xls") returned 4 [0202.779] lstrcmpiW (lpString1=".xls", lpString2=".obi") returned 1 [0202.779] lstrlenW (lpString=".xlsx") returned 5 [0202.779] lstrcmpiW (lpString1=".xlsx", lpString2="l.obi") returned -1 [0202.779] lstrlenW (lpString=".ppt") returned 4 [0202.779] lstrcmpiW (lpString1=".ppt", lpString2=".obi") returned 1 [0202.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.779] lstrlenW (lpString=".zip") returned 4 [0202.779] lstrcmpiW (lpString1=".zip", lpString2=".obi") returned 1 [0202.779] lstrlenW (lpString=".rar") returned 4 [0202.779] lstrcmpiW (lpString1=".rar", lpString2=".obi") returned 1 [0202.779] lstrlenW (lpString=".bz2") returned 4 [0202.779] lstrcmpiW (lpString1=".bz2", lpString2=".obi") returned -1 [0202.779] lstrlenW (lpString=".7z") returned 3 [0202.779] lstrcmpiW (lpString1=".7z", lpString2="obi") returned -1 [0202.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.779] lstrlenW (lpString=".dbf") returned 4 [0202.779] lstrcmpiW (lpString1=".dbf", lpString2=".obi") returned -1 [0202.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.779] lstrlenW (lpString=".1cd") returned 4 [0202.779] lstrcmpiW (lpString1=".1cd", lpString2=".obi") returned -1 [0202.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.779] lstrlenW (lpString=".jpg") returned 4 [0202.779] lstrcmpiW (lpString1=".jpg", lpString2=".obi") returned -1 [0202.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.780] lstrlenW (lpString=".doc") returned 4 [0202.780] lstrcmpiW (lpString1=".doc", lpString2=".obi") returned -1 [0202.780] lstrlenW (lpString=".docx") returned 5 [0202.780] lstrcmpiW (lpString1=".docx", lpString2="l.obi") returned -1 [0202.780] lstrlenW (lpString=".pdf") returned 4 [0202.780] lstrcmpiW (lpString1=".pdf", lpString2=".obi") returned 1 [0202.780] lstrlenW (lpString=".xls") returned 4 [0202.780] lstrcmpiW (lpString1=".xls", lpString2=".obi") returned 1 [0202.780] lstrlenW (lpString=".xlsx") returned 5 [0202.780] lstrcmpiW (lpString1=".xlsx", lpString2="l.obi") returned -1 [0202.780] lstrlenW (lpString=".ppt") returned 4 [0202.780] lstrcmpiW (lpString1=".ppt", lpString2=".obi") returned 1 [0202.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.780] lstrlenW (lpString=".zip") returned 4 [0202.780] lstrcmpiW (lpString1=".zip", lpString2=".obi") returned 1 [0202.780] lstrlenW (lpString=".rar") returned 4 [0202.780] lstrcmpiW (lpString1=".rar", lpString2=".obi") returned 1 [0202.780] lstrlenW (lpString=".bz2") returned 4 [0202.780] lstrcmpiW (lpString1=".bz2", lpString2=".obi") returned -1 [0202.780] lstrlenW (lpString=".7z") returned 3 [0202.780] lstrcmpiW (lpString1=".7z", lpString2="obi") returned -1 [0202.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.780] lstrlenW (lpString=".dbf") returned 4 [0202.780] lstrcmpiW (lpString1=".dbf", lpString2=".obi") returned -1 [0202.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.780] lstrlenW (lpString=".1cd") returned 4 [0202.780] lstrcmpiW (lpString1=".1cd", lpString2=".obi") returned -1 [0202.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Outlook\\Outlook.sharing.xml.obi") returned 85 [0202.780] lstrlenW (lpString=".jpg") returned 4 [0202.780] lstrcmpiW (lpString1=".jpg", lpString2=".obi") returned -1 [0202.781] lstrcmpiW (lpString1=".IE5\\9QH4S0GZ\\async_usersync[1]", lpString2=".wiki") returned -1 [0202.781] lstrlenW (lpString="async_usersync[1]") returned 17 [0202.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.108] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=1035) returned 1 [0203.108] CloseHandle (hObject=0x344) returned 1 [0203.108] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1]")) returned 0x2020 [0203.108] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.110] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.110] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.110] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.774] GetLastError () returned 0x0 [0203.774] ReadFile (in: hFile=0x358, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x40b, lpOverlapped=0x0) returned 1 [0203.776] WriteFile (in: hFile=0x354, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x410, lpOverlapped=0x0) returned 1 [0203.777] ReadFile (in: hFile=0x358, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0203.777] WriteFile (in: hFile=0x354, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0203.777] SetEndOfFile (hFile=0x354) returned 1 [0203.778] CloseHandle (hObject=0x354) returned 1 [0203.778] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.778] SetEndOfFile (hFile=0x358) returned 1 [0203.778] CloseHandle (hObject=0x358) returned 1 [0203.778] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.779] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[1]")) returned 1 [0203.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.779] lstrlenW (lpString=".doc") returned 4 [0203.779] lstrcmpiW (lpString1=".doc", lpString2="c[1]") returned -1 [0203.779] lstrlenW (lpString=".docx") returned 5 [0203.779] lstrcmpiW (lpString1=".docx", lpString2="nc[1]") returned -1 [0203.779] lstrlenW (lpString=".pdf") returned 4 [0203.779] lstrcmpiW (lpString1=".pdf", lpString2="c[1]") returned -1 [0203.779] lstrlenW (lpString=".xls") returned 4 [0203.779] lstrcmpiW (lpString1=".xls", lpString2="c[1]") returned -1 [0203.779] lstrlenW (lpString=".xlsx") returned 5 [0203.779] lstrcmpiW (lpString1=".xlsx", lpString2="nc[1]") returned -1 [0203.779] lstrlenW (lpString=".ppt") returned 4 [0203.779] lstrcmpiW (lpString1=".ppt", lpString2="c[1]") returned -1 [0203.779] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.779] lstrlenW (lpString=".zip") returned 4 [0203.779] lstrcmpiW (lpString1=".zip", lpString2="c[1]") returned -1 [0203.779] lstrlenW (lpString=".rar") returned 4 [0203.779] lstrcmpiW (lpString1=".rar", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString=".bz2") returned 4 [0203.780] lstrcmpiW (lpString1=".bz2", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString=".7z") returned 3 [0203.780] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.780] lstrlenW (lpString=".dbf") returned 4 [0203.780] lstrcmpiW (lpString1=".dbf", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.780] lstrlenW (lpString=".1cd") returned 4 [0203.780] lstrcmpiW (lpString1=".1cd", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.780] lstrlenW (lpString=".jpg") returned 4 [0203.780] lstrcmpiW (lpString1=".jpg", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.780] lstrlenW (lpString=".doc") returned 4 [0203.780] lstrcmpiW (lpString1=".doc", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString=".docx") returned 5 [0203.780] lstrcmpiW (lpString1=".docx", lpString2="nc[1]") returned -1 [0203.780] lstrlenW (lpString=".pdf") returned 4 [0203.780] lstrcmpiW (lpString1=".pdf", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString=".xls") returned 4 [0203.780] lstrcmpiW (lpString1=".xls", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString=".xlsx") returned 5 [0203.780] lstrcmpiW (lpString1=".xlsx", lpString2="nc[1]") returned -1 [0203.780] lstrlenW (lpString=".ppt") returned 4 [0203.780] lstrcmpiW (lpString1=".ppt", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.780] lstrlenW (lpString=".zip") returned 4 [0203.780] lstrcmpiW (lpString1=".zip", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString=".rar") returned 4 [0203.780] lstrcmpiW (lpString1=".rar", lpString2="c[1]") returned -1 [0203.780] lstrlenW (lpString=".bz2") returned 4 [0203.781] lstrcmpiW (lpString1=".bz2", lpString2="c[1]") returned -1 [0203.781] lstrlenW (lpString=".7z") returned 3 [0203.781] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.781] lstrlenW (lpString=".dbf") returned 4 [0203.781] lstrcmpiW (lpString1=".dbf", lpString2="c[1]") returned -1 [0203.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.781] lstrlenW (lpString=".1cd") returned 4 [0203.781] lstrcmpiW (lpString1=".1cd", lpString2="c[1]") returned -1 [0203.781] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[1]") returned 129 [0203.781] lstrlenW (lpString=".jpg") returned 4 [0203.781] lstrcmpiW (lpString1=".jpg", lpString2="c[1]") returned -1 [0203.781] lstrcmpiW (lpString1=".jrs", lpString2=".wiki") returned -1 [0203.781] lstrlenW (lpString="edbres00002.jrs") returned 15 [0203.781] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.782] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=2097152) returned 1 [0203.782] CloseHandle (hObject=0x358) returned 1 [0203.782] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs")) returned 0x2020 [0203.782] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.782] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0203.783] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\edbres00002.jrs.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.783] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc6c | out: lpNewFilePointer=0x0) returned 1 [0203.783] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc2c | out: lpNewFilePointer=0x0) returned 1 [0203.783] ReadFile (in: hFile=0x358, lpBuffer=0x4300058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc38, lpOverlapped=0x0 | out: lpBuffer=0x4300058*, lpNumberOfBytesRead=0x385fc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.787] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xaaaaa, lpNewFilePointer=0x0, dwMoveMethod=0x385fc2c | out: lpNewFilePointer=0x0) returned 1 [0203.787] ReadFile (in: hFile=0x358, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc38, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x385fc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.798] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x385fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0203.798] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1c0000, lpNewFilePointer=0x0, dwMoveMethod=0x385fc2c | out: lpNewFilePointer=0x0) returned 1 [0203.798] ReadFile (in: hFile=0x358, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc38, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x385fc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.814] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.814] WriteFile (in: hFile=0x358, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x385fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0203.983] SetEndOfFile (hFile=0x358) returned 1 [0203.983] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40000) returned 0x42a0008 [0203.987] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc7c | out: lpNewFilePointer=0x0) returned 1 [0203.987] WriteFile (in: hFile=0x358, lpBuffer=0x42a0008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x385fc88, lpOverlapped=0x0 | out: lpBuffer=0x42a0008*, lpNumberOfBytesWritten=0x385fc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.988] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0xaaaaa, lpNewFilePointer=0x0, dwMoveMethod=0x385fc7c | out: lpNewFilePointer=0x0) returned 1 [0203.989] WriteFile (in: hFile=0x358, lpBuffer=0x42a0008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x385fc88, lpOverlapped=0x0 | out: lpBuffer=0x42a0008*, lpNumberOfBytesWritten=0x385fc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.991] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x1c0000, lpNewFilePointer=0x0, dwMoveMethod=0x385fc7c | out: lpNewFilePointer=0x0) returned 1 [0203.991] WriteFile (in: hFile=0x358, lpBuffer=0x42a0008*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x385fc88, lpOverlapped=0x0 | out: lpBuffer=0x42a0008*, lpNumberOfBytesWritten=0x385fc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.992] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x42a0008 | out: hHeap=0x270000) returned 1 [0203.992] CloseHandle (hObject=0x358) returned 1 [0203.992] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.992] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.992] lstrlenW (lpString=".doc") returned 4 [0203.992] lstrcmpiW (lpString1=".doc", lpString2=".jrs") returned -1 [0203.992] lstrlenW (lpString=".docx") returned 5 [0203.992] lstrcmpiW (lpString1=".docx", lpString2="2.jrs") returned -1 [0203.993] lstrlenW (lpString=".pdf") returned 4 [0203.993] lstrcmpiW (lpString1=".pdf", lpString2=".jrs") returned 1 [0203.993] lstrlenW (lpString=".xls") returned 4 [0203.993] lstrcmpiW (lpString1=".xls", lpString2=".jrs") returned 1 [0203.993] lstrlenW (lpString=".xlsx") returned 5 [0203.993] lstrcmpiW (lpString1=".xlsx", lpString2="2.jrs") returned -1 [0203.993] lstrlenW (lpString=".ppt") returned 4 [0203.993] lstrcmpiW (lpString1=".ppt", lpString2=".jrs") returned 1 [0203.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.993] lstrlenW (lpString=".zip") returned 4 [0203.993] lstrcmpiW (lpString1=".zip", lpString2=".jrs") returned 1 [0203.993] lstrlenW (lpString=".rar") returned 4 [0203.993] lstrcmpiW (lpString1=".rar", lpString2=".jrs") returned 1 [0203.993] lstrlenW (lpString=".bz2") returned 4 [0203.993] lstrcmpiW (lpString1=".bz2", lpString2=".jrs") returned -1 [0203.993] lstrlenW (lpString=".7z") returned 3 [0203.993] lstrcmpiW (lpString1=".7z", lpString2="jrs") returned -1 [0203.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.993] lstrlenW (lpString=".dbf") returned 4 [0203.993] lstrcmpiW (lpString1=".dbf", lpString2=".jrs") returned -1 [0203.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.993] lstrlenW (lpString=".1cd") returned 4 [0203.993] lstrcmpiW (lpString1=".1cd", lpString2=".jrs") returned -1 [0203.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.993] lstrlenW (lpString=".jpg") returned 4 [0203.993] lstrcmpiW (lpString1=".jpg", lpString2=".jrs") returned -1 [0203.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.993] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.993] lstrlenW (lpString=".doc") returned 4 [0203.993] lstrcmpiW (lpString1=".doc", lpString2=".jrs") returned -1 [0203.993] lstrlenW (lpString=".docx") returned 5 [0203.993] lstrcmpiW (lpString1=".docx", lpString2="2.jrs") returned -1 [0203.993] lstrlenW (lpString=".pdf") returned 4 [0203.994] lstrcmpiW (lpString1=".pdf", lpString2=".jrs") returned 1 [0203.994] lstrlenW (lpString=".xls") returned 4 [0203.994] lstrcmpiW (lpString1=".xls", lpString2=".jrs") returned 1 [0203.994] lstrlenW (lpString=".xlsx") returned 5 [0203.994] lstrcmpiW (lpString1=".xlsx", lpString2="2.jrs") returned -1 [0203.994] lstrlenW (lpString=".ppt") returned 4 [0203.994] lstrcmpiW (lpString1=".ppt", lpString2=".jrs") returned 1 [0203.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.994] lstrlenW (lpString=".zip") returned 4 [0203.994] lstrcmpiW (lpString1=".zip", lpString2=".jrs") returned 1 [0203.994] lstrlenW (lpString=".rar") returned 4 [0203.994] lstrcmpiW (lpString1=".rar", lpString2=".jrs") returned 1 [0203.994] lstrlenW (lpString=".bz2") returned 4 [0203.994] lstrcmpiW (lpString1=".bz2", lpString2=".jrs") returned -1 [0203.994] lstrlenW (lpString=".7z") returned 3 [0203.994] lstrcmpiW (lpString1=".7z", lpString2="jrs") returned -1 [0203.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.994] lstrlenW (lpString=".dbf") returned 4 [0203.994] lstrcmpiW (lpString1=".dbf", lpString2=".jrs") returned -1 [0203.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.994] lstrlenW (lpString=".1cd") returned 4 [0203.994] lstrcmpiW (lpString1=".1cd", lpString2=".jrs") returned -1 [0203.994] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\edbres00002.jrs") returned 82 [0203.994] lstrlenW (lpString=".jpg") returned 4 [0203.994] lstrcmpiW (lpString1=".jpg", lpString2=".jrs") returned -1 [0203.994] lstrcmpiW (lpString1=".default\\Cache\\0\\98\\B60F3d01", lpString2=".wiki") returned -1 [0203.994] lstrlenW (lpString="B60F3d01") returned 8 [0203.994] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.996] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=46718) returned 1 [0203.996] CloseHandle (hObject=0x358) returned 1 [0203.996] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01")) returned 0x2020 [0203.996] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0203.996] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.996] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0203.996] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.997] GetLastError () returned 0x0 [0203.997] ReadFile (in: hFile=0x358, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0xb67e, lpOverlapped=0x0) returned 1 [0204.025] WriteFile (in: hFile=0x378, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xb680, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xb680, lpOverlapped=0x0) returned 1 [0204.026] ReadFile (in: hFile=0x358, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.026] WriteFile (in: hFile=0x378, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.026] SetEndOfFile (hFile=0x378) returned 1 [0204.026] CloseHandle (hObject=0x378) returned 1 [0204.026] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.027] SetEndOfFile (hFile=0x358) returned 1 [0204.027] CloseHandle (hObject=0x358) returned 1 [0204.028] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.028] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\0\\98\\b60f3d01")) returned 1 [0204.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.028] lstrlenW (lpString=".doc") returned 4 [0204.028] lstrcmpiW (lpString1=".doc", lpString2="3d01") returned -1 [0204.028] lstrlenW (lpString=".docx") returned 5 [0204.028] lstrcmpiW (lpString1=".docx", lpString2="F3d01") returned -1 [0204.028] lstrlenW (lpString=".pdf") returned 4 [0204.028] lstrcmpiW (lpString1=".pdf", lpString2="3d01") returned -1 [0204.028] lstrlenW (lpString=".xls") returned 4 [0204.028] lstrcmpiW (lpString1=".xls", lpString2="3d01") returned -1 [0204.028] lstrlenW (lpString=".xlsx") returned 5 [0204.028] lstrcmpiW (lpString1=".xlsx", lpString2="F3d01") returned -1 [0204.028] lstrlenW (lpString=".ppt") returned 4 [0204.028] lstrcmpiW (lpString1=".ppt", lpString2="3d01") returned -1 [0204.028] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.028] lstrlenW (lpString=".zip") returned 4 [0204.028] lstrcmpiW (lpString1=".zip", lpString2="3d01") returned -1 [0204.028] lstrlenW (lpString=".rar") returned 4 [0204.028] lstrcmpiW (lpString1=".rar", lpString2="3d01") returned -1 [0204.028] lstrlenW (lpString=".bz2") returned 4 [0204.028] lstrcmpiW (lpString1=".bz2", lpString2="3d01") returned -1 [0204.028] lstrlenW (lpString=".7z") returned 3 [0204.029] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.029] lstrlenW (lpString=".dbf") returned 4 [0204.029] lstrcmpiW (lpString1=".dbf", lpString2="3d01") returned -1 [0204.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.029] lstrlenW (lpString=".1cd") returned 4 [0204.029] lstrcmpiW (lpString1=".1cd", lpString2="3d01") returned -1 [0204.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.029] lstrlenW (lpString=".jpg") returned 4 [0204.029] lstrcmpiW (lpString1=".jpg", lpString2="3d01") returned -1 [0204.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.029] lstrlenW (lpString=".doc") returned 4 [0204.029] lstrcmpiW (lpString1=".doc", lpString2="3d01") returned -1 [0204.029] lstrlenW (lpString=".docx") returned 5 [0204.029] lstrcmpiW (lpString1=".docx", lpString2="F3d01") returned -1 [0204.029] lstrlenW (lpString=".pdf") returned 4 [0204.029] lstrcmpiW (lpString1=".pdf", lpString2="3d01") returned -1 [0204.029] lstrlenW (lpString=".xls") returned 4 [0204.029] lstrcmpiW (lpString1=".xls", lpString2="3d01") returned -1 [0204.029] lstrlenW (lpString=".xlsx") returned 5 [0204.029] lstrcmpiW (lpString1=".xlsx", lpString2="F3d01") returned -1 [0204.029] lstrlenW (lpString=".ppt") returned 4 [0204.029] lstrcmpiW (lpString1=".ppt", lpString2="3d01") returned -1 [0204.029] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.030] lstrlenW (lpString=".zip") returned 4 [0204.030] lstrcmpiW (lpString1=".zip", lpString2="3d01") returned -1 [0204.030] lstrlenW (lpString=".rar") returned 4 [0204.030] lstrcmpiW (lpString1=".rar", lpString2="3d01") returned -1 [0204.030] lstrlenW (lpString=".bz2") returned 4 [0204.030] lstrcmpiW (lpString1=".bz2", lpString2="3d01") returned -1 [0204.030] lstrlenW (lpString=".7z") returned 3 [0204.030] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.030] lstrlenW (lpString=".dbf") returned 4 [0204.030] lstrcmpiW (lpString1=".dbf", lpString2="3d01") returned -1 [0204.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.030] lstrlenW (lpString=".1cd") returned 4 [0204.030] lstrcmpiW (lpString1=".1cd", lpString2="3d01") returned -1 [0204.030] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\0\\98\\B60F3d01") returned 105 [0204.030] lstrlenW (lpString=".jpg") returned 4 [0204.030] lstrcmpiW (lpString1=".jpg", lpString2="3d01") returned -1 [0204.030] lstrcmpiW (lpString1=".default\\Cache\\1\\C2\\0B619d01", lpString2=".wiki") returned -1 [0204.030] lstrlenW (lpString="0B619d01") returned 8 [0204.030] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.031] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=43525) returned 1 [0204.031] CloseHandle (hObject=0x358) returned 1 [0204.046] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01")) returned 0x2020 [0204.046] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.046] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.046] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.046] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0204.047] GetLastError () returned 0x0 [0204.047] ReadFile (in: hFile=0x354, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0xaa05, lpOverlapped=0x0) returned 1 [0204.051] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xaa10, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xaa10, lpOverlapped=0x0) returned 1 [0204.053] ReadFile (in: hFile=0x354, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.053] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.053] SetEndOfFile (hFile=0x344) returned 1 [0204.053] CloseHandle (hObject=0x344) returned 1 [0204.053] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.053] SetEndOfFile (hFile=0x354) returned 1 [0204.054] CloseHandle (hObject=0x354) returned 1 [0204.054] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.055] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\c2\\0b619d01")) returned 1 [0204.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.055] lstrlenW (lpString=".doc") returned 4 [0204.055] lstrcmpiW (lpString1=".doc", lpString2="9d01") returned -1 [0204.055] lstrlenW (lpString=".docx") returned 5 [0204.055] lstrcmpiW (lpString1=".docx", lpString2="19d01") returned -1 [0204.055] lstrlenW (lpString=".pdf") returned 4 [0204.055] lstrcmpiW (lpString1=".pdf", lpString2="9d01") returned -1 [0204.055] lstrlenW (lpString=".xls") returned 4 [0204.055] lstrcmpiW (lpString1=".xls", lpString2="9d01") returned -1 [0204.055] lstrlenW (lpString=".xlsx") returned 5 [0204.055] lstrcmpiW (lpString1=".xlsx", lpString2="19d01") returned -1 [0204.055] lstrlenW (lpString=".ppt") returned 4 [0204.055] lstrcmpiW (lpString1=".ppt", lpString2="9d01") returned -1 [0204.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.055] lstrlenW (lpString=".zip") returned 4 [0204.055] lstrcmpiW (lpString1=".zip", lpString2="9d01") returned -1 [0204.055] lstrlenW (lpString=".rar") returned 4 [0204.055] lstrcmpiW (lpString1=".rar", lpString2="9d01") returned -1 [0204.055] lstrlenW (lpString=".bz2") returned 4 [0204.055] lstrcmpiW (lpString1=".bz2", lpString2="9d01") returned -1 [0204.055] lstrlenW (lpString=".7z") returned 3 [0204.055] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.055] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.055] lstrlenW (lpString=".dbf") returned 4 [0204.056] lstrcmpiW (lpString1=".dbf", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.056] lstrlenW (lpString=".1cd") returned 4 [0204.056] lstrcmpiW (lpString1=".1cd", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.056] lstrlenW (lpString=".jpg") returned 4 [0204.056] lstrcmpiW (lpString1=".jpg", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.056] lstrlenW (lpString=".doc") returned 4 [0204.056] lstrcmpiW (lpString1=".doc", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString=".docx") returned 5 [0204.056] lstrcmpiW (lpString1=".docx", lpString2="19d01") returned -1 [0204.056] lstrlenW (lpString=".pdf") returned 4 [0204.056] lstrcmpiW (lpString1=".pdf", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString=".xls") returned 4 [0204.056] lstrcmpiW (lpString1=".xls", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString=".xlsx") returned 5 [0204.056] lstrcmpiW (lpString1=".xlsx", lpString2="19d01") returned -1 [0204.056] lstrlenW (lpString=".ppt") returned 4 [0204.056] lstrcmpiW (lpString1=".ppt", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.056] lstrlenW (lpString=".zip") returned 4 [0204.056] lstrcmpiW (lpString1=".zip", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString=".rar") returned 4 [0204.056] lstrcmpiW (lpString1=".rar", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString=".bz2") returned 4 [0204.056] lstrcmpiW (lpString1=".bz2", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString=".7z") returned 3 [0204.056] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.056] lstrlenW (lpString=".dbf") returned 4 [0204.056] lstrcmpiW (lpString1=".dbf", lpString2="9d01") returned -1 [0204.056] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.057] lstrlenW (lpString=".1cd") returned 4 [0204.057] lstrcmpiW (lpString1=".1cd", lpString2="9d01") returned -1 [0204.057] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\C2\\0B619d01") returned 105 [0204.057] lstrlenW (lpString=".jpg") returned 4 [0204.057] lstrcmpiW (lpString1=".jpg", lpString2="9d01") returned -1 [0204.057] lstrcmpiW (lpString1=".default\\Cache\\3\\4B\\1D8FDd01", lpString2=".wiki") returned -1 [0204.057] lstrlenW (lpString="1D8FDd01") returned 8 [0204.057] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.078] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=132419) returned 1 [0204.078] CloseHandle (hObject=0x354) returned 1 [0204.078] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01")) returned 0x2020 [0204.078] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.078] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.078] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0204.079] GetLastError () returned 0x0 [0204.079] ReadFile (in: hFile=0x354, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x20543, lpOverlapped=0x0) returned 1 [0204.094] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x20550, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x20550, lpOverlapped=0x0) returned 1 [0204.097] ReadFile (in: hFile=0x354, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.097] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.097] SetEndOfFile (hFile=0x344) returned 1 [0204.097] CloseHandle (hObject=0x344) returned 1 [0204.097] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.097] SetEndOfFile (hFile=0x354) returned 1 [0204.099] CloseHandle (hObject=0x354) returned 1 [0204.099] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.099] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\3\\4b\\1d8fdd01")) returned 1 [0204.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.099] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.099] lstrlenW (lpString=".doc") returned 4 [0204.099] lstrcmpiW (lpString1=".doc", lpString2="Dd01") returned -1 [0204.099] lstrlenW (lpString=".docx") returned 5 [0204.099] lstrcmpiW (lpString1=".docx", lpString2="FDd01") returned -1 [0204.099] lstrlenW (lpString=".pdf") returned 4 [0204.099] lstrcmpiW (lpString1=".pdf", lpString2="Dd01") returned -1 [0204.099] lstrlenW (lpString=".xls") returned 4 [0204.099] lstrcmpiW (lpString1=".xls", lpString2="Dd01") returned -1 [0204.099] lstrlenW (lpString=".xlsx") returned 5 [0204.099] lstrcmpiW (lpString1=".xlsx", lpString2="FDd01") returned -1 [0204.099] lstrlenW (lpString=".ppt") returned 4 [0204.100] lstrcmpiW (lpString1=".ppt", lpString2="Dd01") returned -1 [0204.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.100] lstrlenW (lpString=".zip") returned 4 [0204.100] lstrcmpiW (lpString1=".zip", lpString2="Dd01") returned -1 [0204.100] lstrlenW (lpString=".rar") returned 4 [0204.100] lstrcmpiW (lpString1=".rar", lpString2="Dd01") returned -1 [0204.100] lstrlenW (lpString=".bz2") returned 4 [0204.100] lstrcmpiW (lpString1=".bz2", lpString2="Dd01") returned -1 [0204.100] lstrlenW (lpString=".7z") returned 3 [0204.100] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.100] lstrlenW (lpString=".dbf") returned 4 [0204.100] lstrcmpiW (lpString1=".dbf", lpString2="Dd01") returned -1 [0204.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.100] lstrlenW (lpString=".1cd") returned 4 [0204.100] lstrcmpiW (lpString1=".1cd", lpString2="Dd01") returned -1 [0204.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.100] lstrlenW (lpString=".jpg") returned 4 [0204.100] lstrcmpiW (lpString1=".jpg", lpString2="Dd01") returned -1 [0204.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.100] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.100] lstrlenW (lpString=".doc") returned 4 [0204.100] lstrcmpiW (lpString1=".doc", lpString2="Dd01") returned -1 [0204.100] lstrlenW (lpString=".docx") returned 5 [0204.100] lstrcmpiW (lpString1=".docx", lpString2="FDd01") returned -1 [0204.100] lstrlenW (lpString=".pdf") returned 4 [0204.100] lstrcmpiW (lpString1=".pdf", lpString2="Dd01") returned -1 [0204.100] lstrlenW (lpString=".xls") returned 4 [0204.100] lstrcmpiW (lpString1=".xls", lpString2="Dd01") returned -1 [0204.100] lstrlenW (lpString=".xlsx") returned 5 [0204.100] lstrcmpiW (lpString1=".xlsx", lpString2="FDd01") returned -1 [0204.100] lstrlenW (lpString=".ppt") returned 4 [0204.100] lstrcmpiW (lpString1=".ppt", lpString2="Dd01") returned -1 [0204.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.101] lstrlenW (lpString=".zip") returned 4 [0204.101] lstrcmpiW (lpString1=".zip", lpString2="Dd01") returned -1 [0204.101] lstrlenW (lpString=".rar") returned 4 [0204.101] lstrcmpiW (lpString1=".rar", lpString2="Dd01") returned -1 [0204.101] lstrlenW (lpString=".bz2") returned 4 [0204.101] lstrcmpiW (lpString1=".bz2", lpString2="Dd01") returned -1 [0204.101] lstrlenW (lpString=".7z") returned 3 [0204.101] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.101] lstrlenW (lpString=".dbf") returned 4 [0204.101] lstrcmpiW (lpString1=".dbf", lpString2="Dd01") returned -1 [0204.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.101] lstrlenW (lpString=".1cd") returned 4 [0204.101] lstrcmpiW (lpString1=".1cd", lpString2="Dd01") returned -1 [0204.101] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\3\\4B\\1D8FDd01") returned 105 [0204.101] lstrlenW (lpString=".jpg") returned 4 [0204.101] lstrcmpiW (lpString1=".jpg", lpString2="Dd01") returned -1 [0204.101] lstrcmpiW (lpString1=".default\\Cache\\9\\61\\28E95d01", lpString2=".wiki") returned -1 [0204.101] lstrlenW (lpString="28E95d01") returned 8 [0204.101] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.102] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=43337) returned 1 [0204.102] CloseHandle (hObject=0x354) returned 1 [0204.102] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01")) returned 0x2020 [0204.102] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.102] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.102] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.102] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0204.103] GetLastError () returned 0x0 [0204.103] ReadFile (in: hFile=0x354, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0xa949, lpOverlapped=0x0) returned 1 [0204.111] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xa950, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xa950, lpOverlapped=0x0) returned 1 [0204.112] ReadFile (in: hFile=0x354, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.112] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.112] SetEndOfFile (hFile=0x344) returned 1 [0204.112] CloseHandle (hObject=0x344) returned 1 [0204.112] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.112] SetEndOfFile (hFile=0x354) returned 1 [0204.113] CloseHandle (hObject=0x354) returned 1 [0204.113] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.114] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\61\\28e95d01")) returned 1 [0204.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.114] lstrlenW (lpString=".doc") returned 4 [0204.114] lstrcmpiW (lpString1=".doc", lpString2="5d01") returned -1 [0204.114] lstrlenW (lpString=".docx") returned 5 [0204.114] lstrcmpiW (lpString1=".docx", lpString2="95d01") returned -1 [0204.114] lstrlenW (lpString=".pdf") returned 4 [0204.114] lstrcmpiW (lpString1=".pdf", lpString2="5d01") returned -1 [0204.114] lstrlenW (lpString=".xls") returned 4 [0204.114] lstrcmpiW (lpString1=".xls", lpString2="5d01") returned -1 [0204.114] lstrlenW (lpString=".xlsx") returned 5 [0204.114] lstrcmpiW (lpString1=".xlsx", lpString2="95d01") returned -1 [0204.114] lstrlenW (lpString=".ppt") returned 4 [0204.114] lstrcmpiW (lpString1=".ppt", lpString2="5d01") returned -1 [0204.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.114] lstrlenW (lpString=".zip") returned 4 [0204.114] lstrcmpiW (lpString1=".zip", lpString2="5d01") returned -1 [0204.114] lstrlenW (lpString=".rar") returned 4 [0204.114] lstrcmpiW (lpString1=".rar", lpString2="5d01") returned -1 [0204.114] lstrlenW (lpString=".bz2") returned 4 [0204.114] lstrcmpiW (lpString1=".bz2", lpString2="5d01") returned -1 [0204.114] lstrlenW (lpString=".7z") returned 3 [0204.114] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.114] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.115] lstrlenW (lpString=".dbf") returned 4 [0204.115] lstrcmpiW (lpString1=".dbf", lpString2="5d01") returned -1 [0204.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.115] lstrlenW (lpString=".1cd") returned 4 [0204.115] lstrcmpiW (lpString1=".1cd", lpString2="5d01") returned -1 [0204.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.115] lstrlenW (lpString=".jpg") returned 4 [0204.115] lstrcmpiW (lpString1=".jpg", lpString2="5d01") returned -1 [0204.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.115] lstrlenW (lpString=".doc") returned 4 [0204.115] lstrcmpiW (lpString1=".doc", lpString2="5d01") returned -1 [0204.115] lstrlenW (lpString=".docx") returned 5 [0204.115] lstrcmpiW (lpString1=".docx", lpString2="95d01") returned -1 [0204.115] lstrlenW (lpString=".pdf") returned 4 [0204.115] lstrcmpiW (lpString1=".pdf", lpString2="5d01") returned -1 [0204.115] lstrlenW (lpString=".xls") returned 4 [0204.115] lstrcmpiW (lpString1=".xls", lpString2="5d01") returned -1 [0204.115] lstrlenW (lpString=".xlsx") returned 5 [0204.115] lstrcmpiW (lpString1=".xlsx", lpString2="95d01") returned -1 [0204.115] lstrlenW (lpString=".ppt") returned 4 [0204.115] lstrcmpiW (lpString1=".ppt", lpString2="5d01") returned -1 [0204.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.115] lstrlenW (lpString=".zip") returned 4 [0204.115] lstrcmpiW (lpString1=".zip", lpString2="5d01") returned -1 [0204.115] lstrlenW (lpString=".rar") returned 4 [0204.115] lstrcmpiW (lpString1=".rar", lpString2="5d01") returned -1 [0204.115] lstrlenW (lpString=".bz2") returned 4 [0204.115] lstrcmpiW (lpString1=".bz2", lpString2="5d01") returned -1 [0204.115] lstrlenW (lpString=".7z") returned 3 [0204.115] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.115] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.115] lstrlenW (lpString=".dbf") returned 4 [0204.115] lstrcmpiW (lpString1=".dbf", lpString2="5d01") returned -1 [0204.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.116] lstrlenW (lpString=".1cd") returned 4 [0204.116] lstrcmpiW (lpString1=".1cd", lpString2="5d01") returned -1 [0204.116] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\61\\28E95d01") returned 105 [0204.116] lstrlenW (lpString=".jpg") returned 4 [0204.116] lstrcmpiW (lpString1=".jpg", lpString2="5d01") returned -1 [0204.116] lstrcmpiW (lpString1=".default\\Cache\\9\\E0\\F17B2d01", lpString2=".wiki") returned -1 [0204.116] lstrlenW (lpString="F17B2d01") returned 8 [0204.116] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.116] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=16463) returned 1 [0204.116] CloseHandle (hObject=0x354) returned 1 [0204.117] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01")) returned 0x2020 [0204.117] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.117] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.117] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.117] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0204.117] GetLastError () returned 0x0 [0204.117] ReadFile (in: hFile=0x354, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x404f, lpOverlapped=0x0) returned 1 [0204.404] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0x4050, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0x4050, lpOverlapped=0x0) returned 1 [0204.405] ReadFile (in: hFile=0x354, lpBuffer=0x4300020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x385fed4, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesRead=0x385fed4*=0x0, lpOverlapped=0x0) returned 1 [0204.405] WriteFile (in: hFile=0x344, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x385fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.406] SetEndOfFile (hFile=0x344) returned 1 [0204.406] CloseHandle (hObject=0x344) returned 1 [0204.406] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.406] SetEndOfFile (hFile=0x354) returned 1 [0204.407] CloseHandle (hObject=0x354) returned 1 [0204.407] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.407] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\e0\\f17b2d01")) returned 1 [0204.407] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.407] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.407] lstrlenW (lpString=".doc") returned 4 [0204.407] lstrcmpiW (lpString1=".doc", lpString2="2d01") returned -1 [0204.407] lstrlenW (lpString=".docx") returned 5 [0204.407] lstrcmpiW (lpString1=".docx", lpString2="B2d01") returned -1 [0204.407] lstrlenW (lpString=".pdf") returned 4 [0204.407] lstrcmpiW (lpString1=".pdf", lpString2="2d01") returned -1 [0204.407] lstrlenW (lpString=".xls") returned 4 [0204.407] lstrcmpiW (lpString1=".xls", lpString2="2d01") returned -1 [0204.407] lstrlenW (lpString=".xlsx") returned 5 [0204.407] lstrcmpiW (lpString1=".xlsx", lpString2="B2d01") returned -1 [0204.407] lstrlenW (lpString=".ppt") returned 4 [0204.407] lstrcmpiW (lpString1=".ppt", lpString2="2d01") returned -1 [0204.407] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.407] lstrlenW (lpString=".zip") returned 4 [0204.407] lstrcmpiW (lpString1=".zip", lpString2="2d01") returned -1 [0204.407] lstrlenW (lpString=".rar") returned 4 [0204.408] lstrcmpiW (lpString1=".rar", lpString2="2d01") returned -1 [0204.408] lstrlenW (lpString=".bz2") returned 4 [0204.408] lstrcmpiW (lpString1=".bz2", lpString2="2d01") returned -1 [0204.408] lstrlenW (lpString=".7z") returned 3 [0204.408] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.408] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.408] lstrlenW (lpString=".dbf") returned 4 [0204.408] lstrcmpiW (lpString1=".dbf", lpString2="2d01") returned -1 [0204.408] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.408] lstrlenW (lpString=".1cd") returned 4 [0204.408] lstrcmpiW (lpString1=".1cd", lpString2="2d01") returned -1 [0204.408] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.408] lstrlenW (lpString=".jpg") returned 4 [0204.408] lstrcmpiW (lpString1=".jpg", lpString2="2d01") returned -1 [0204.408] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.408] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.408] lstrlenW (lpString=".doc") returned 4 [0204.408] lstrcmpiW (lpString1=".doc", lpString2="2d01") returned -1 [0204.408] lstrlenW (lpString=".docx") returned 5 [0204.408] lstrcmpiW (lpString1=".docx", lpString2="B2d01") returned -1 [0204.408] lstrlenW (lpString=".pdf") returned 4 [0204.408] lstrcmpiW (lpString1=".pdf", lpString2="2d01") returned -1 [0204.408] lstrlenW (lpString=".xls") returned 4 [0204.408] lstrcmpiW (lpString1=".xls", lpString2="2d01") returned -1 [0204.408] lstrlenW (lpString=".xlsx") returned 5 [0204.408] lstrcmpiW (lpString1=".xlsx", lpString2="B2d01") returned -1 [0204.408] lstrlenW (lpString=".ppt") returned 4 [0204.408] lstrcmpiW (lpString1=".ppt", lpString2="2d01") returned -1 [0204.408] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.408] lstrlenW (lpString=".zip") returned 4 [0204.408] lstrcmpiW (lpString1=".zip", lpString2="2d01") returned -1 [0204.408] lstrlenW (lpString=".rar") returned 4 [0204.408] lstrcmpiW (lpString1=".rar", lpString2="2d01") returned -1 [0204.409] lstrlenW (lpString=".bz2") returned 4 [0204.409] lstrcmpiW (lpString1=".bz2", lpString2="2d01") returned -1 [0204.409] lstrlenW (lpString=".7z") returned 3 [0204.409] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.409] lstrlenW (lpString=".dbf") returned 4 [0204.409] lstrcmpiW (lpString1=".dbf", lpString2="2d01") returned -1 [0204.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.409] lstrlenW (lpString=".1cd") returned 4 [0204.409] lstrcmpiW (lpString1=".1cd", lpString2="2d01") returned -1 [0204.409] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\E0\\F17B2d01") returned 105 [0204.409] lstrlenW (lpString=".jpg") returned 4 [0204.409] lstrcmpiW (lpString1=".jpg", lpString2="2d01") returned -1 [0204.409] lstrcmpiW (lpString1=".default\\Cache\\_CACHE_002_", lpString2=".wiki") returned -1 [0204.409] lstrlenW (lpString="_CACHE_002_") returned 11 [0204.409] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.574] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x385ff1c | out: lpFileSize=0x385ff1c*=4194304) returned 1 [0204.574] CloseHandle (hObject=0x354) returned 1 [0204.574] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_")) returned 0x2020 [0204.574] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.574] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0204.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_002_.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_002_.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0204.668] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc6c | out: lpNewFilePointer=0x0) returned 1 [0204.668] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fc2c | out: lpNewFilePointer=0x0) returned 1 [0204.668] ReadFile (in: hFile=0x354, lpBuffer=0x4300058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc38, lpOverlapped=0x0 | out: lpBuffer=0x4300058*, lpNumberOfBytesRead=0x385fc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.676] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x155555, lpNewFilePointer=0x0, dwMoveMethod=0x385fc2c | out: lpNewFilePointer=0x0) returned 1 [0204.676] ReadFile (in: hFile=0x354, lpBuffer=0x4340058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc38, lpOverlapped=0x0 | out: lpBuffer=0x4340058*, lpNumberOfBytesRead=0x385fc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.680] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x385fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0204.680] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x3c0000, lpNewFilePointer=0x0, dwMoveMethod=0x385fc2c | out: lpNewFilePointer=0x0) returned 1 [0204.680] ReadFile (in: hFile=0x354, lpBuffer=0x4380058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x385fc38, lpOverlapped=0x0 | out: lpBuffer=0x4380058*, lpNumberOfBytesRead=0x385fc38*=0x40000, lpOverlapped=0x0) returned 1 [0204.695] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x385fec8 | out: lpNewFilePointer=0x0) returned 1 [0204.695] WriteFile (in: hFile=0x354, lpBuffer=0x4300020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x385fcb0, lpOverlapped=0x0 | out: lpBuffer=0x4300020*, lpNumberOfBytesWritten=0x385fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0204.925] SetEndOfFile (hFile=0x354) returned 1 [0205.052] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40000) returned 0x4130060 Thread: id = 76 os_tid = 0x560 [0183.697] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x4110050 [0183.698] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10000) returned 0x4120058 [0183.698] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e3730 [0183.698] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x6) returned 0x322208 [0183.698] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e3748 [0183.698] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x100000) returned 0x4410020 [0183.698] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e3760 [0183.698] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2e3760, Size=0x20) returned 0x365690 [0183.698] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x10) returned 0x2e3760 [0183.698] RtlReAllocateHeap (Heap=0x270000, Flags=0x0, Ptr=0x2e3760, Size=0x20) returned 0x3655c8 [0183.699] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x74d80000 [0183.699] GetProcAddress (hModule=0x74d80000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x74dad650 [0183.699] Wow64DisableWow64FsRedirection (in: OldValue=0x3baff58 | out: OldValue=0x3baff58*=0x0) returned 1 [0183.699] lstrlenW (lpString="kernel32.dll") returned 12 [0183.699] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x365690 | out: hHeap=0x270000) returned 1 [0183.699] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0183.699] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x3655c8 | out: hHeap=0x270000) returned 1 [0183.699] Sleep (dwMilliseconds=0x64) [0183.996] lstrcmpiW (lpString1=".ttf", lpString2=".wiki") returned -1 [0183.997] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0183.997] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0184.243] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1984228) returned 1 [0184.244] CloseHandle (hObject=0x310) returned 1 [0184.244] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0184.244] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.244] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0184.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.244] lstrlenW (lpString=".doc") returned 4 [0184.244] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0184.244] lstrlenW (lpString=".docx") returned 5 [0184.244] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0184.244] lstrlenW (lpString=".pdf") returned 4 [0184.244] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0184.244] lstrlenW (lpString=".xls") returned 4 [0184.244] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0184.244] lstrlenW (lpString=".xlsx") returned 5 [0184.244] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0184.244] lstrlenW (lpString=".ppt") returned 4 [0184.244] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0184.244] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.244] lstrlenW (lpString=".zip") returned 4 [0184.244] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0184.244] lstrlenW (lpString=".rar") returned 4 [0184.244] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0184.244] lstrlenW (lpString=".bz2") returned 4 [0184.244] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0184.244] lstrlenW (lpString=".7z") returned 3 [0184.245] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0184.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.245] lstrlenW (lpString=".dbf") returned 4 [0184.245] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0184.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.245] lstrlenW (lpString=".1cd") returned 4 [0184.245] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0184.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.245] lstrlenW (lpString=".jpg") returned 4 [0184.245] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0184.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.245] lstrlenW (lpString=".doc") returned 4 [0184.245] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0184.245] lstrlenW (lpString=".docx") returned 5 [0184.245] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0184.245] lstrlenW (lpString=".pdf") returned 4 [0184.245] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0184.245] lstrlenW (lpString=".xls") returned 4 [0184.245] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0184.245] lstrlenW (lpString=".xlsx") returned 5 [0184.245] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0184.245] lstrlenW (lpString=".ppt") returned 4 [0184.245] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0184.245] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.245] lstrlenW (lpString=".zip") returned 4 [0184.245] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0184.245] lstrlenW (lpString=".rar") returned 4 [0184.245] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0184.245] lstrlenW (lpString=".bz2") returned 4 [0184.245] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0184.245] lstrlenW (lpString=".7z") returned 3 [0184.245] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0184.246] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.246] lstrlenW (lpString=".dbf") returned 4 [0184.246] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0184.246] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.246] lstrlenW (lpString=".1cd") returned 4 [0184.246] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0184.246] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0184.246] lstrlenW (lpString=".jpg") returned 4 [0184.246] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0184.246] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0184.246] lstrlenW (lpString="Microsoft.Ink.dll") returned 17 [0184.246] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0184.430] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=507904) returned 1 [0184.430] CloseHandle (hObject=0x318) returned 1 [0184.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0184.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.430] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.430] lstrlenW (lpString=".doc") returned 4 [0184.430] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.430] lstrlenW (lpString=".docx") returned 5 [0184.430] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0184.430] lstrlenW (lpString=".pdf") returned 4 [0184.430] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.430] lstrlenW (lpString=".xls") returned 4 [0184.430] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.430] lstrlenW (lpString=".xlsx") returned 5 [0184.430] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0184.431] lstrlenW (lpString=".ppt") returned 4 [0184.431] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.431] lstrlenW (lpString=".zip") returned 4 [0184.431] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.431] lstrlenW (lpString=".rar") returned 4 [0184.431] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.431] lstrlenW (lpString=".bz2") returned 4 [0184.431] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.431] lstrlenW (lpString=".7z") returned 3 [0184.431] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.431] lstrlenW (lpString=".dbf") returned 4 [0184.431] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.431] lstrlenW (lpString=".1cd") returned 4 [0184.431] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.431] lstrlenW (lpString=".jpg") returned 4 [0184.431] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.431] lstrlenW (lpString=".doc") returned 4 [0184.431] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.431] lstrlenW (lpString=".docx") returned 5 [0184.431] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0184.431] lstrlenW (lpString=".pdf") returned 4 [0184.431] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.431] lstrlenW (lpString=".xls") returned 4 [0184.431] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.431] lstrlenW (lpString=".xlsx") returned 5 [0184.431] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0184.431] lstrlenW (lpString=".ppt") returned 4 [0184.432] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.432] lstrlenW (lpString=".zip") returned 4 [0184.432] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.432] lstrlenW (lpString=".rar") returned 4 [0184.432] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.432] lstrlenW (lpString=".bz2") returned 4 [0184.432] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.432] lstrlenW (lpString=".7z") returned 3 [0184.432] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.432] lstrlenW (lpString=".dbf") returned 4 [0184.432] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.432] lstrlenW (lpString=".1cd") returned 4 [0184.432] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0184.432] lstrlenW (lpString=".jpg") returned 4 [0184.432] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.432] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0184.432] lstrlenW (lpString="promointl.dll") returned 13 [0184.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0184.519] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=15760) returned 1 [0184.519] CloseHandle (hObject=0x320) returned 1 [0184.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll")) returned 0x20 [0184.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\promointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.520] lstrlenW (lpString=".doc") returned 4 [0184.520] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.520] lstrlenW (lpString=".docx") returned 5 [0184.520] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0184.520] lstrlenW (lpString=".pdf") returned 4 [0184.520] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.520] lstrlenW (lpString=".xls") returned 4 [0184.520] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.520] lstrlenW (lpString=".xlsx") returned 5 [0184.520] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0184.520] lstrlenW (lpString=".ppt") returned 4 [0184.520] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.520] lstrlenW (lpString=".zip") returned 4 [0184.520] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.520] lstrlenW (lpString=".rar") returned 4 [0184.520] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.520] lstrlenW (lpString=".bz2") returned 4 [0184.520] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.520] lstrlenW (lpString=".7z") returned 3 [0184.520] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.520] lstrlenW (lpString=".dbf") returned 4 [0184.520] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.520] lstrlenW (lpString=".1cd") returned 4 [0184.520] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.520] lstrlenW (lpString=".jpg") returned 4 [0184.520] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.520] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.521] lstrlenW (lpString=".doc") returned 4 [0184.521] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.521] lstrlenW (lpString=".docx") returned 5 [0184.521] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0184.521] lstrlenW (lpString=".pdf") returned 4 [0184.521] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.521] lstrlenW (lpString=".xls") returned 4 [0184.521] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.521] lstrlenW (lpString=".xlsx") returned 5 [0184.521] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0184.521] lstrlenW (lpString=".ppt") returned 4 [0184.521] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.521] lstrlenW (lpString=".zip") returned 4 [0184.521] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.521] lstrlenW (lpString=".rar") returned 4 [0184.521] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.521] lstrlenW (lpString=".bz2") returned 4 [0184.521] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.521] lstrlenW (lpString=".7z") returned 3 [0184.521] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.521] lstrlenW (lpString=".dbf") returned 4 [0184.521] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.521] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.521] lstrlenW (lpString=".1cd") returned 4 [0184.522] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.522] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\promointl.dll") returned 106 [0184.522] lstrlenW (lpString=".jpg") returned 4 [0184.522] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.522] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0184.522] lstrlenW (lpString="pidgenx.dll") returned 11 [0184.522] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x314 [0184.796] GetFileSizeEx (in: hFile=0x314, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1463568) returned 1 [0184.796] CloseHandle (hObject=0x314) returned 1 [0184.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll")) returned 0x20 [0184.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0184.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0184.796] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.797] lstrlenW (lpString=".doc") returned 4 [0184.797] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.797] lstrlenW (lpString=".docx") returned 5 [0184.797] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0184.797] lstrlenW (lpString=".pdf") returned 4 [0184.797] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.797] lstrlenW (lpString=".xls") returned 4 [0184.797] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.797] lstrlenW (lpString=".xlsx") returned 5 [0184.797] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0184.797] lstrlenW (lpString=".ppt") returned 4 [0184.797] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.797] lstrlenW (lpString=".zip") returned 4 [0184.797] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.797] lstrlenW (lpString=".rar") returned 4 [0184.797] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.797] lstrlenW (lpString=".bz2") returned 4 [0184.797] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.797] lstrlenW (lpString=".7z") returned 3 [0184.797] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.797] lstrlenW (lpString=".dbf") returned 4 [0184.797] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.797] lstrlenW (lpString=".1cd") returned 4 [0184.797] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.797] lstrlenW (lpString=".jpg") returned 4 [0184.797] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.797] lstrlenW (lpString=".doc") returned 4 [0184.798] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0184.798] lstrlenW (lpString=".docx") returned 5 [0184.798] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0184.798] lstrlenW (lpString=".pdf") returned 4 [0184.798] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0184.798] lstrlenW (lpString=".xls") returned 4 [0184.798] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0184.798] lstrlenW (lpString=".xlsx") returned 5 [0184.798] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0184.798] lstrlenW (lpString=".ppt") returned 4 [0184.798] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0184.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.798] lstrlenW (lpString=".zip") returned 4 [0184.798] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0184.798] lstrlenW (lpString=".rar") returned 4 [0184.798] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0184.798] lstrlenW (lpString=".bz2") returned 4 [0184.798] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0184.798] lstrlenW (lpString=".7z") returned 3 [0184.798] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0184.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.798] lstrlenW (lpString=".dbf") returned 4 [0184.798] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0184.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.798] lstrlenW (lpString=".1cd") returned 4 [0184.798] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0184.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\pidgenx.dll") returned 91 [0184.798] lstrlenW (lpString=".jpg") returned 4 [0184.798] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0184.799] lstrcmpiW (lpString1=".ELM", lpString2=".wiki") returned -1 [0184.799] lstrlenW (lpString="JOURNAL.ELM") returned 11 [0184.799] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0185.006] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=47666) returned 1 [0185.013] CloseHandle (hObject=0x25c) returned 1 [0185.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm")) returned 0x20 [0185.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.030] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\journal.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.031] lstrlenW (lpString=".doc") returned 4 [0185.031] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0185.031] lstrlenW (lpString=".docx") returned 5 [0185.031] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0185.031] lstrlenW (lpString=".pdf") returned 4 [0185.031] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0185.031] lstrlenW (lpString=".xls") returned 4 [0185.031] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0185.031] lstrlenW (lpString=".xlsx") returned 5 [0185.031] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0185.031] lstrlenW (lpString=".ppt") returned 4 [0185.031] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0185.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.031] lstrlenW (lpString=".zip") returned 4 [0185.031] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0185.031] lstrlenW (lpString=".rar") returned 4 [0185.031] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0185.031] lstrlenW (lpString=".bz2") returned 4 [0185.031] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0185.031] lstrlenW (lpString=".7z") returned 3 [0185.031] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0185.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.031] lstrlenW (lpString=".dbf") returned 4 [0185.031] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0185.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.031] lstrlenW (lpString=".1cd") returned 4 [0185.031] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0185.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.031] lstrlenW (lpString=".jpg") returned 4 [0185.031] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0185.031] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.032] lstrlenW (lpString=".doc") returned 4 [0185.032] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0185.032] lstrlenW (lpString=".docx") returned 5 [0185.032] lstrcmpiW (lpString1=".docx", lpString2="L.ELM") returned -1 [0185.032] lstrlenW (lpString=".pdf") returned 4 [0185.032] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0185.032] lstrlenW (lpString=".xls") returned 4 [0185.032] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0185.032] lstrlenW (lpString=".xlsx") returned 5 [0185.032] lstrcmpiW (lpString1=".xlsx", lpString2="L.ELM") returned -1 [0185.032] lstrlenW (lpString=".ppt") returned 4 [0185.032] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0185.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.032] lstrlenW (lpString=".zip") returned 4 [0185.032] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0185.032] lstrlenW (lpString=".rar") returned 4 [0185.032] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0185.032] lstrlenW (lpString=".bz2") returned 4 [0185.032] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0185.032] lstrlenW (lpString=".7z") returned 3 [0185.032] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0185.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.032] lstrlenW (lpString=".dbf") returned 4 [0185.032] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0185.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.032] lstrlenW (lpString=".1cd") returned 4 [0185.032] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0185.032] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\JOURNAL.ELM") returned 75 [0185.032] lstrlenW (lpString=".jpg") returned 4 [0185.032] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0185.033] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0185.033] lstrlenW (lpString="msader15.dll") returned 12 [0185.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0185.033] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=8192) returned 1 [0185.033] CloseHandle (hObject=0x25c) returned 1 [0185.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll")) returned 0x20 [0185.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.033] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msader15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.033] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.033] lstrlenW (lpString=".doc") returned 4 [0185.033] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0185.034] lstrlenW (lpString=".docx") returned 5 [0185.034] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0185.034] lstrlenW (lpString=".pdf") returned 4 [0185.034] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0185.034] lstrlenW (lpString=".xls") returned 4 [0185.034] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0185.034] lstrlenW (lpString=".xlsx") returned 5 [0185.034] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0185.034] lstrlenW (lpString=".ppt") returned 4 [0185.034] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0185.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.034] lstrlenW (lpString=".zip") returned 4 [0185.034] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0185.034] lstrlenW (lpString=".rar") returned 4 [0185.034] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0185.034] lstrlenW (lpString=".bz2") returned 4 [0185.034] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0185.034] lstrlenW (lpString=".7z") returned 3 [0185.034] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0185.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.034] lstrlenW (lpString=".dbf") returned 4 [0185.034] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0185.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.034] lstrlenW (lpString=".1cd") returned 4 [0185.034] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0185.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.034] lstrlenW (lpString=".jpg") returned 4 [0185.034] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0185.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.034] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.034] lstrlenW (lpString=".doc") returned 4 [0185.034] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0185.034] lstrlenW (lpString=".docx") returned 5 [0185.035] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0185.035] lstrlenW (lpString=".pdf") returned 4 [0185.035] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0185.035] lstrlenW (lpString=".xls") returned 4 [0185.035] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0185.035] lstrlenW (lpString=".xlsx") returned 5 [0185.035] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0185.035] lstrlenW (lpString=".ppt") returned 4 [0185.035] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0185.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.035] lstrlenW (lpString=".zip") returned 4 [0185.035] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0185.035] lstrlenW (lpString=".rar") returned 4 [0185.035] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0185.035] lstrlenW (lpString=".bz2") returned 4 [0185.035] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0185.035] lstrlenW (lpString=".7z") returned 3 [0185.035] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0185.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.035] lstrlenW (lpString=".dbf") returned 4 [0185.035] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0185.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.035] lstrlenW (lpString=".1cd") returned 4 [0185.035] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0185.035] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msader15.dll") returned 53 [0185.035] lstrlenW (lpString=".jpg") returned 4 [0185.035] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0185.035] lstrcmpiW (lpString1=".dll", lpString2=".wiki") returned -1 [0185.035] lstrlenW (lpString="msado15.dll") returned 11 [0185.035] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0185.037] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1499136) returned 1 [0185.037] CloseHandle (hObject=0x25c) returned 1 [0185.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll")) returned 0x20 [0185.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll" (normalized: "c:\\program files\\common files\\system\\ado\\msado15.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.037] lstrlenW (lpString=".doc") returned 4 [0185.037] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0185.037] lstrlenW (lpString=".docx") returned 5 [0185.037] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0185.037] lstrlenW (lpString=".pdf") returned 4 [0185.037] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0185.037] lstrlenW (lpString=".xls") returned 4 [0185.037] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0185.037] lstrlenW (lpString=".xlsx") returned 5 [0185.037] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0185.037] lstrlenW (lpString=".ppt") returned 4 [0185.037] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0185.037] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.037] lstrlenW (lpString=".zip") returned 4 [0185.037] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0185.037] lstrlenW (lpString=".rar") returned 4 [0185.037] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0185.038] lstrlenW (lpString=".bz2") returned 4 [0185.038] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0185.038] lstrlenW (lpString=".7z") returned 3 [0185.038] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0185.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.038] lstrlenW (lpString=".dbf") returned 4 [0185.038] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0185.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.038] lstrlenW (lpString=".1cd") returned 4 [0185.038] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0185.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.038] lstrlenW (lpString=".jpg") returned 4 [0185.038] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0185.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.038] lstrlenW (lpString=".doc") returned 4 [0185.038] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0185.038] lstrlenW (lpString=".docx") returned 5 [0185.038] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0185.038] lstrlenW (lpString=".pdf") returned 4 [0185.038] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0185.038] lstrlenW (lpString=".xls") returned 4 [0185.038] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0185.038] lstrlenW (lpString=".xlsx") returned 5 [0185.038] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0185.038] lstrlenW (lpString=".ppt") returned 4 [0185.038] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0185.038] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.038] lstrlenW (lpString=".zip") returned 4 [0185.038] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0185.038] lstrlenW (lpString=".rar") returned 4 [0185.038] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0185.039] lstrlenW (lpString=".bz2") returned 4 [0185.039] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0185.039] lstrlenW (lpString=".7z") returned 3 [0185.039] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0185.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.039] lstrlenW (lpString=".dbf") returned 4 [0185.039] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0185.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.039] lstrlenW (lpString=".1cd") returned 4 [0185.039] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0185.039] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado15.dll") returned 52 [0185.039] lstrlenW (lpString=".jpg") returned 4 [0185.039] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0185.039] lstrcmpiW (lpString1=".tlb", lpString2=".wiki") returned -1 [0185.039] lstrlenW (lpString="msado20.tlb") returned 11 [0185.039] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0185.039] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=69632) returned 1 [0185.040] CloseHandle (hObject=0x25c) returned 1 [0185.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb")) returned 0x20 [0185.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.040] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado20.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.040] lstrlenW (lpString=".doc") returned 4 [0185.040] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0185.040] lstrlenW (lpString=".docx") returned 5 [0185.040] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0185.040] lstrlenW (lpString=".pdf") returned 4 [0185.040] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0185.040] lstrlenW (lpString=".xls") returned 4 [0185.040] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0185.040] lstrlenW (lpString=".xlsx") returned 5 [0185.040] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0185.040] lstrlenW (lpString=".ppt") returned 4 [0185.040] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0185.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.040] lstrlenW (lpString=".zip") returned 4 [0185.040] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0185.040] lstrlenW (lpString=".rar") returned 4 [0185.040] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0185.040] lstrlenW (lpString=".bz2") returned 4 [0185.040] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0185.040] lstrlenW (lpString=".7z") returned 3 [0185.040] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0185.040] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.041] lstrlenW (lpString=".dbf") returned 4 [0185.041] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0185.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.041] lstrlenW (lpString=".1cd") returned 4 [0185.041] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0185.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.041] lstrlenW (lpString=".jpg") returned 4 [0185.041] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0185.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.041] lstrlenW (lpString=".doc") returned 4 [0185.041] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0185.041] lstrlenW (lpString=".docx") returned 5 [0185.041] lstrcmpiW (lpString1=".docx", lpString2="0.tlb") returned -1 [0185.041] lstrlenW (lpString=".pdf") returned 4 [0185.041] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0185.041] lstrlenW (lpString=".xls") returned 4 [0185.041] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0185.041] lstrlenW (lpString=".xlsx") returned 5 [0185.041] lstrcmpiW (lpString1=".xlsx", lpString2="0.tlb") returned -1 [0185.041] lstrlenW (lpString=".ppt") returned 4 [0185.041] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0185.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.041] lstrlenW (lpString=".zip") returned 4 [0185.041] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0185.041] lstrlenW (lpString=".rar") returned 4 [0185.041] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0185.041] lstrlenW (lpString=".bz2") returned 4 [0185.041] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0185.041] lstrlenW (lpString=".7z") returned 3 [0185.041] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0185.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.041] lstrlenW (lpString=".dbf") returned 4 [0185.041] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0185.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.042] lstrlenW (lpString=".1cd") returned 4 [0185.042] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0185.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado20.tlb") returned 52 [0185.042] lstrlenW (lpString=".jpg") returned 4 [0185.042] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0185.042] lstrcmpiW (lpString1=".tlb", lpString2=".wiki") returned -1 [0185.042] lstrlenW (lpString="msado21.tlb") returned 11 [0185.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0185.042] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=73728) returned 1 [0185.042] CloseHandle (hObject=0x25c) returned 1 [0185.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb")) returned 0x20 [0185.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.042] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado21.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.043] lstrlenW (lpString=".doc") returned 4 [0185.043] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0185.043] lstrlenW (lpString=".docx") returned 5 [0185.043] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0185.043] lstrlenW (lpString=".pdf") returned 4 [0185.043] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0185.043] lstrlenW (lpString=".xls") returned 4 [0185.043] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0185.043] lstrlenW (lpString=".xlsx") returned 5 [0185.043] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0185.043] lstrlenW (lpString=".ppt") returned 4 [0185.043] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0185.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.043] lstrlenW (lpString=".zip") returned 4 [0185.043] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0185.043] lstrlenW (lpString=".rar") returned 4 [0185.043] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0185.043] lstrlenW (lpString=".bz2") returned 4 [0185.043] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0185.043] lstrlenW (lpString=".7z") returned 3 [0185.043] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0185.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.043] lstrlenW (lpString=".dbf") returned 4 [0185.043] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0185.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.043] lstrlenW (lpString=".1cd") returned 4 [0185.043] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0185.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.043] lstrlenW (lpString=".jpg") returned 4 [0185.043] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0185.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.043] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.044] lstrlenW (lpString=".doc") returned 4 [0185.044] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0185.044] lstrlenW (lpString=".docx") returned 5 [0185.044] lstrcmpiW (lpString1=".docx", lpString2="1.tlb") returned -1 [0185.044] lstrlenW (lpString=".pdf") returned 4 [0185.044] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0185.044] lstrlenW (lpString=".xls") returned 4 [0185.044] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0185.044] lstrlenW (lpString=".xlsx") returned 5 [0185.044] lstrcmpiW (lpString1=".xlsx", lpString2="1.tlb") returned -1 [0185.044] lstrlenW (lpString=".ppt") returned 4 [0185.044] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0185.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.044] lstrlenW (lpString=".zip") returned 4 [0185.044] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0185.044] lstrlenW (lpString=".rar") returned 4 [0185.044] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0185.044] lstrlenW (lpString=".bz2") returned 4 [0185.044] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0185.044] lstrlenW (lpString=".7z") returned 3 [0185.044] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0185.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.044] lstrlenW (lpString=".dbf") returned 4 [0185.044] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0185.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.044] lstrlenW (lpString=".1cd") returned 4 [0185.044] lstrcmpiW (lpString1=".1cd", lpString2=".tlb") returned -1 [0185.044] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado21.tlb") returned 52 [0185.044] lstrlenW (lpString=".jpg") returned 4 [0185.044] lstrcmpiW (lpString1=".jpg", lpString2=".tlb") returned -1 [0185.044] lstrcmpiW (lpString1=".tlb", lpString2=".wiki") returned -1 [0185.045] lstrlenW (lpString="msado25.tlb") returned 11 [0185.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x25c [0185.045] GetFileSizeEx (in: hFile=0x25c, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=94208) returned 1 [0185.045] CloseHandle (hObject=0x25c) returned 1 [0185.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb")) returned 0x20 [0185.045] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.045] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb" (normalized: "c:\\program files\\common files\\system\\ado\\msado25.tlb"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0185.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0185.045] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0185.045] lstrlenW (lpString=".doc") returned 4 [0185.045] lstrcmpiW (lpString1=".doc", lpString2=".tlb") returned -1 [0185.045] lstrlenW (lpString=".docx") returned 5 [0185.045] lstrcmpiW (lpString1=".docx", lpString2="5.tlb") returned -1 [0185.045] lstrlenW (lpString=".pdf") returned 4 [0185.045] lstrcmpiW (lpString1=".pdf", lpString2=".tlb") returned -1 [0185.045] lstrlenW (lpString=".xls") returned 4 [0185.045] lstrcmpiW (lpString1=".xls", lpString2=".tlb") returned 1 [0185.045] lstrlenW (lpString=".xlsx") returned 5 [0185.045] lstrcmpiW (lpString1=".xlsx", lpString2="5.tlb") returned -1 [0185.046] lstrlenW (lpString=".ppt") returned 4 [0185.046] lstrcmpiW (lpString1=".ppt", lpString2=".tlb") returned -1 [0185.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0185.046] lstrlenW (lpString=".zip") returned 4 [0185.046] lstrcmpiW (lpString1=".zip", lpString2=".tlb") returned 1 [0185.046] lstrlenW (lpString=".rar") returned 4 [0185.046] lstrcmpiW (lpString1=".rar", lpString2=".tlb") returned -1 [0185.046] lstrlenW (lpString=".bz2") returned 4 [0185.046] lstrcmpiW (lpString1=".bz2", lpString2=".tlb") returned -1 [0185.046] lstrlenW (lpString=".7z") returned 3 [0185.046] lstrcmpiW (lpString1=".7z", lpString2="tlb") returned -1 [0185.046] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\msado25.tlb") returned 52 [0185.046] lstrlenW (lpString=".dbf") returned 4 [0185.046] lstrcmpiW (lpString1=".dbf", lpString2=".tlb") returned -1 [0185.108] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.116] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.116] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.116] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.117] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0185.360] lstrcmpiW (lpString1=".MID", lpString2=".wiki") returned -1 [0185.464] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=6165) returned 1 [0185.465] CloseHandle (hObject=0x380) returned 1 [0185.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0185.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0185.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0187.238] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.306] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.308] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.569] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0187.886] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ONMAIN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\onmain.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.164] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ORGCHART.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\orgchart.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.335] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PROOF\\1033\\MSGR3EN.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\proof\\1033\\msgr3en.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\GREETING.DPV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\greeting.dpv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.381] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\INVITE.DPV.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\invite.dpv.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.392] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\PUBWIZ\\NEWS98.POC.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\pubwiz\\news98.poc.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\sg.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.439] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\SOCIALCONNECTOR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\socialconnector.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.441] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\STSLIST.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\stslist.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.665] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\UML.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\uml.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.669] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISBRGR.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\visbrgr.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.673] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VISLIB.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\vislib.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWDWG.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\vviewdwg.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.675] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\VVIEWER.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\vviewer.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.678] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WINPROJ.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\winproj.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.679] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\Wordcnv.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\wordcnv.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.680] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WORDICON.EXE.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\wordicon.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.681] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\WWLIB.DLL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\wwlib.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.683] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\XOCR3.PSP.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\microsoft office\\office14\\xocr3.psp.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.698] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationCore.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationcore.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.699] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\PresentationFramework.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\presentationframework.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.702] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.0\\System.ServiceModel.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.0\\system.servicemodel.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0188.710] MoveFileW (lpExistingFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll"), lpNewFileName="C:\\Program Files\\Reference Assemblies\\Microsoft\\Framework\\v3.5\\System.Data.Entity.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files\\reference assemblies\\microsoft\\framework\\v3.5\\system.data.entity.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0190.102] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=294808) returned 1 [0190.102] CloseHandle (hObject=0x1e4) returned 1 [0190.102] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroBroker.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrobroker.exe")) returned 0x20 [0190.102] GetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroBroker.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrobroker.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0190.102] CreateFileW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Reader\\AcroBroker.exe" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\reader\\acrobroker.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0193.351] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est133.lex" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est133.lex"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Resource\\Linguistics\\Providers\\Proximity\\11.00\\est133.lex.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\resource\\linguistics\\providers\\proximity\\11.00\\est133.lex.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.381] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\acroread.msi"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\acroread.msi.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.381] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\AcroRead.msi", dwFileAttributes=0x20) returned 0 [0193.382] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\data1.cab"), lpNewFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\adobe\\reader 10.0\\setup files\\{ac76ba86-7ad7-ffff-7b44-aa0000000001}\\data1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0193.382] SetFileAttributesW (lpFileName="C:\\Program Files (x86)\\Adobe\\Reader 10.0\\Setup Files\\{AC76BA86-7AD7-FFFF-7B44-AA0000000001}\\Data1.cab", dwFileAttributes=0x20) returned 0 [0196.012] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfxrt.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\jfxrt.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\jfxrt.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0196.017] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\plugin.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\plugin.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\plugin.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0196.017] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\resources.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\resources.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\resources.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0196.019] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\rt.jar"), lpNewFileName="C:\\Program Files (x86)\\Java\\jre7\\lib\\rt.jar.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\java\\jre7\\lib\\rt.jar.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0198.113] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows Media Player\\setup_wm.exe" (normalized: "c:\\program files (x86)\\windows media player\\setup_wm.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows Media Player\\setup_wm.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows media player\\setup_wm.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0198.118] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\wordpad.exe" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\wordpad.exe"), lpNewFileName="C:\\Program Files (x86)\\Windows NT\\Accessories\\wordpad.exe.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows nt\\accessories\\wordpad.exe.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0198.124] MoveFileW (lpExistingFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingEngine.dll" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingengine.dll"), lpNewFileName="C:\\Program Files (x86)\\Windows Photo Viewer\\ImagingEngine.dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\program files (x86)\\windows photo viewer\\imagingengine.dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0198.128] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0198.128] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0198.128] CreateFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0198.129] GetLastError () returned 0x0 [0198.129] ReadFile (in: hFile=0x378, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x3d800, lpOverlapped=0x0) returned 1 [0198.143] WriteFile (in: hFile=0x370, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x3d810, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x3d810, lpOverlapped=0x0) returned 1 [0198.147] ReadFile (in: hFile=0x378, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0198.400] WriteFile (in: hFile=0x370, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x100, lpOverlapped=0x0) returned 1 [0198.400] SetEndOfFile (hFile=0x370) returned 1 [0198.400] CloseHandle (hObject=0x370) returned 1 [0198.400] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0198.400] SetEndOfFile (hFile=0x378) returned 1 [0198.454] CloseHandle (hObject=0x378) returned 1 [0198.454] SetFileAttributesW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x20) returned 1 [0198.454] DeleteFileW (lpFileName="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp" (normalized: "c:\\programdata\\adobe\\arm\\reader_10.0.0\\adberdrsecupd10111.msp")) returned 1 [0198.455] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.455] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.455] lstrlenW (lpString=".doc") returned 4 [0198.455] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0198.455] lstrlenW (lpString=".docx") returned 5 [0198.455] lstrcmpiW (lpString1=".docx", lpString2="1.msp") returned -1 [0198.455] lstrlenW (lpString=".pdf") returned 4 [0198.455] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0198.455] lstrlenW (lpString=".xls") returned 4 [0198.455] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0198.455] lstrlenW (lpString=".xlsx") returned 5 [0198.455] lstrcmpiW (lpString1=".xlsx", lpString2="1.msp") returned -1 [0198.455] lstrlenW (lpString=".ppt") returned 4 [0198.455] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0198.455] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.455] lstrlenW (lpString=".zip") returned 4 [0198.455] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0198.455] lstrlenW (lpString=".rar") returned 4 [0198.455] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0198.455] lstrlenW (lpString=".bz2") returned 4 [0198.455] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0198.455] lstrlenW (lpString=".7z") returned 3 [0198.455] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0198.455] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.455] lstrlenW (lpString=".dbf") returned 4 [0198.455] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0198.455] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.455] lstrlenW (lpString=".1cd") returned 4 [0198.455] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0198.455] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.455] lstrlenW (lpString=".jpg") returned 4 [0198.455] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0198.456] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.456] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.456] lstrlenW (lpString=".doc") returned 4 [0198.456] lstrcmpiW (lpString1=".doc", lpString2=".msp") returned -1 [0198.456] lstrlenW (lpString=".docx") returned 5 [0198.456] lstrcmpiW (lpString1=".docx", lpString2="1.msp") returned -1 [0198.456] lstrlenW (lpString=".pdf") returned 4 [0198.456] lstrcmpiW (lpString1=".pdf", lpString2=".msp") returned 1 [0198.456] lstrlenW (lpString=".xls") returned 4 [0198.456] lstrcmpiW (lpString1=".xls", lpString2=".msp") returned 1 [0198.456] lstrlenW (lpString=".xlsx") returned 5 [0198.456] lstrcmpiW (lpString1=".xlsx", lpString2="1.msp") returned -1 [0198.456] lstrlenW (lpString=".ppt") returned 4 [0198.456] lstrcmpiW (lpString1=".ppt", lpString2=".msp") returned 1 [0198.456] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.456] lstrlenW (lpString=".zip") returned 4 [0198.456] lstrcmpiW (lpString1=".zip", lpString2=".msp") returned 1 [0198.456] lstrlenW (lpString=".rar") returned 4 [0198.456] lstrcmpiW (lpString1=".rar", lpString2=".msp") returned 1 [0198.456] lstrlenW (lpString=".bz2") returned 4 [0198.456] lstrcmpiW (lpString1=".bz2", lpString2=".msp") returned -1 [0198.456] lstrlenW (lpString=".7z") returned 3 [0198.456] lstrcmpiW (lpString1=".7z", lpString2="msp") returned -1 [0198.456] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.456] lstrlenW (lpString=".dbf") returned 4 [0198.456] lstrcmpiW (lpString1=".dbf", lpString2=".msp") returned -1 [0198.456] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.456] lstrlenW (lpString=".1cd") returned 4 [0198.456] lstrcmpiW (lpString1=".1cd", lpString2=".msp") returned -1 [0198.456] lstrlenW (lpString="C:\\ProgramData\\Adobe\\ARM\\Reader_10.0.0\\AdbeRdrSecUpd10111.msp") returned 61 [0198.456] lstrlenW (lpString=".jpg") returned 4 [0198.456] lstrcmpiW (lpString1=".jpg", lpString2=".msp") returned -1 [0198.457] lstrcmpiW (lpString1=".H1W", lpString2=".wiki") returned -1 [0198.457] lstrlenW (lpString="Help_MKWD_AssetId.H1W") returned 21 [0198.457] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.514] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=222716) returned 1 [0198.514] CloseHandle (hObject=0x388) returned 1 [0198.514] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w")) returned 0x2026 [0198.514] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.514] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mkwd_assetid.h1w"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.514] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.514] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.514] lstrlenW (lpString=".doc") returned 4 [0198.514] lstrcmpiW (lpString1=".doc", lpString2=".H1W") returned -1 [0198.514] lstrlenW (lpString=".docx") returned 5 [0198.514] lstrcmpiW (lpString1=".docx", lpString2="d.H1W") returned -1 [0198.514] lstrlenW (lpString=".pdf") returned 4 [0198.514] lstrcmpiW (lpString1=".pdf", lpString2=".H1W") returned 1 [0198.514] lstrlenW (lpString=".xls") returned 4 [0198.515] lstrcmpiW (lpString1=".xls", lpString2=".H1W") returned 1 [0198.515] lstrlenW (lpString=".xlsx") returned 5 [0198.515] lstrcmpiW (lpString1=".xlsx", lpString2="d.H1W") returned -1 [0198.515] lstrlenW (lpString=".ppt") returned 4 [0198.515] lstrcmpiW (lpString1=".ppt", lpString2=".H1W") returned 1 [0198.515] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.515] lstrlenW (lpString=".zip") returned 4 [0198.515] lstrcmpiW (lpString1=".zip", lpString2=".H1W") returned 1 [0198.515] lstrlenW (lpString=".rar") returned 4 [0198.515] lstrcmpiW (lpString1=".rar", lpString2=".H1W") returned 1 [0198.515] lstrlenW (lpString=".bz2") returned 4 [0198.515] lstrcmpiW (lpString1=".bz2", lpString2=".H1W") returned -1 [0198.515] lstrlenW (lpString=".7z") returned 3 [0198.515] lstrcmpiW (lpString1=".7z", lpString2="H1W") returned -1 [0198.515] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.515] lstrlenW (lpString=".dbf") returned 4 [0198.515] lstrcmpiW (lpString1=".dbf", lpString2=".H1W") returned -1 [0198.515] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.515] lstrlenW (lpString=".1cd") returned 4 [0198.515] lstrcmpiW (lpString1=".1cd", lpString2=".H1W") returned -1 [0198.515] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.515] lstrlenW (lpString=".jpg") returned 4 [0198.515] lstrcmpiW (lpString1=".jpg", lpString2=".H1W") returned 1 [0198.515] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.515] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.515] lstrlenW (lpString=".doc") returned 4 [0198.515] lstrcmpiW (lpString1=".doc", lpString2=".H1W") returned -1 [0198.515] lstrlenW (lpString=".docx") returned 5 [0198.515] lstrcmpiW (lpString1=".docx", lpString2="d.H1W") returned -1 [0198.515] lstrlenW (lpString=".pdf") returned 4 [0198.515] lstrcmpiW (lpString1=".pdf", lpString2=".H1W") returned 1 [0198.515] lstrlenW (lpString=".xls") returned 4 [0198.515] lstrcmpiW (lpString1=".xls", lpString2=".H1W") returned 1 [0198.515] lstrlenW (lpString=".xlsx") returned 5 [0198.516] lstrcmpiW (lpString1=".xlsx", lpString2="d.H1W") returned -1 [0198.516] lstrlenW (lpString=".ppt") returned 4 [0198.516] lstrcmpiW (lpString1=".ppt", lpString2=".H1W") returned 1 [0198.516] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.516] lstrlenW (lpString=".zip") returned 4 [0198.516] lstrcmpiW (lpString1=".zip", lpString2=".H1W") returned 1 [0198.516] lstrlenW (lpString=".rar") returned 4 [0198.516] lstrcmpiW (lpString1=".rar", lpString2=".H1W") returned 1 [0198.516] lstrlenW (lpString=".bz2") returned 4 [0198.516] lstrcmpiW (lpString1=".bz2", lpString2=".H1W") returned -1 [0198.516] lstrlenW (lpString=".7z") returned 3 [0198.516] lstrcmpiW (lpString1=".7z", lpString2="H1W") returned -1 [0198.516] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.516] lstrlenW (lpString=".dbf") returned 4 [0198.516] lstrcmpiW (lpString1=".dbf", lpString2=".H1W") returned -1 [0198.516] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.516] lstrlenW (lpString=".1cd") returned 4 [0198.516] lstrcmpiW (lpString1=".1cd", lpString2=".H1W") returned -1 [0198.516] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MKWD_AssetId.H1W") returned 74 [0198.516] lstrlenW (lpString=".jpg") returned 4 [0198.516] lstrcmpiW (lpString1=".jpg", lpString2=".H1W") returned 1 [0198.516] lstrcmpiW (lpString1=".H1H", lpString2=".wiki") returned -1 [0198.516] lstrlenW (lpString="Help_MTOC_help.H1H") returned 18 [0198.516] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.517] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=499482) returned 1 [0198.517] CloseHandle (hObject=0x388) returned 1 [0198.517] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h")) returned 0x2026 [0198.517] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.517] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mtoc_help.h1h"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.517] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.517] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.517] lstrlenW (lpString=".doc") returned 4 [0198.517] lstrcmpiW (lpString1=".doc", lpString2=".H1H") returned -1 [0198.517] lstrlenW (lpString=".docx") returned 5 [0198.517] lstrcmpiW (lpString1=".docx", lpString2="p.H1H") returned -1 [0198.517] lstrlenW (lpString=".pdf") returned 4 [0198.517] lstrcmpiW (lpString1=".pdf", lpString2=".H1H") returned 1 [0198.517] lstrlenW (lpString=".xls") returned 4 [0198.517] lstrcmpiW (lpString1=".xls", lpString2=".H1H") returned 1 [0198.517] lstrlenW (lpString=".xlsx") returned 5 [0198.517] lstrcmpiW (lpString1=".xlsx", lpString2="p.H1H") returned -1 [0198.517] lstrlenW (lpString=".ppt") returned 4 [0198.517] lstrcmpiW (lpString1=".ppt", lpString2=".H1H") returned 1 [0198.517] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.517] lstrlenW (lpString=".zip") returned 4 [0198.518] lstrcmpiW (lpString1=".zip", lpString2=".H1H") returned 1 [0198.518] lstrlenW (lpString=".rar") returned 4 [0198.518] lstrcmpiW (lpString1=".rar", lpString2=".H1H") returned 1 [0198.518] lstrlenW (lpString=".bz2") returned 4 [0198.518] lstrcmpiW (lpString1=".bz2", lpString2=".H1H") returned -1 [0198.518] lstrlenW (lpString=".7z") returned 3 [0198.518] lstrcmpiW (lpString1=".7z", lpString2="H1H") returned -1 [0198.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.518] lstrlenW (lpString=".dbf") returned 4 [0198.518] lstrcmpiW (lpString1=".dbf", lpString2=".H1H") returned -1 [0198.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.518] lstrlenW (lpString=".1cd") returned 4 [0198.518] lstrcmpiW (lpString1=".1cd", lpString2=".H1H") returned -1 [0198.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.518] lstrlenW (lpString=".jpg") returned 4 [0198.518] lstrcmpiW (lpString1=".jpg", lpString2=".H1H") returned 1 [0198.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.518] lstrlenW (lpString=".doc") returned 4 [0198.518] lstrcmpiW (lpString1=".doc", lpString2=".H1H") returned -1 [0198.518] lstrlenW (lpString=".docx") returned 5 [0198.518] lstrcmpiW (lpString1=".docx", lpString2="p.H1H") returned -1 [0198.518] lstrlenW (lpString=".pdf") returned 4 [0198.518] lstrcmpiW (lpString1=".pdf", lpString2=".H1H") returned 1 [0198.518] lstrlenW (lpString=".xls") returned 4 [0198.518] lstrcmpiW (lpString1=".xls", lpString2=".H1H") returned 1 [0198.518] lstrlenW (lpString=".xlsx") returned 5 [0198.518] lstrcmpiW (lpString1=".xlsx", lpString2="p.H1H") returned -1 [0198.518] lstrlenW (lpString=".ppt") returned 4 [0198.518] lstrcmpiW (lpString1=".ppt", lpString2=".H1H") returned 1 [0198.518] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.518] lstrlenW (lpString=".zip") returned 4 [0198.518] lstrcmpiW (lpString1=".zip", lpString2=".H1H") returned 1 [0198.518] lstrlenW (lpString=".rar") returned 4 [0198.519] lstrcmpiW (lpString1=".rar", lpString2=".H1H") returned 1 [0198.519] lstrlenW (lpString=".bz2") returned 4 [0198.519] lstrcmpiW (lpString1=".bz2", lpString2=".H1H") returned -1 [0198.519] lstrlenW (lpString=".7z") returned 3 [0198.519] lstrcmpiW (lpString1=".7z", lpString2="H1H") returned -1 [0198.519] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.519] lstrlenW (lpString=".dbf") returned 4 [0198.519] lstrcmpiW (lpString1=".dbf", lpString2=".H1H") returned -1 [0198.519] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.519] lstrlenW (lpString=".1cd") returned 4 [0198.519] lstrcmpiW (lpString1=".1cd", lpString2=".H1H") returned -1 [0198.519] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MTOC_help.H1H") returned 71 [0198.519] lstrlenW (lpString=".jpg") returned 4 [0198.519] lstrcmpiW (lpString1=".jpg", lpString2=".H1H") returned 1 [0198.519] lstrcmpiW (lpString1=".H1D", lpString2=".wiki") returned -1 [0198.519] lstrlenW (lpString="Help_MValidator.H1D") returned 19 [0198.519] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.519] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=14660) returned 1 [0198.519] CloseHandle (hObject=0x388) returned 1 [0198.520] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d")) returned 0x2026 [0198.520] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.520] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.h1d"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.520] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.520] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.520] lstrlenW (lpString=".doc") returned 4 [0198.520] lstrcmpiW (lpString1=".doc", lpString2=".H1D") returned -1 [0198.520] lstrlenW (lpString=".docx") returned 5 [0198.520] lstrcmpiW (lpString1=".docx", lpString2="r.H1D") returned -1 [0198.520] lstrlenW (lpString=".pdf") returned 4 [0198.520] lstrcmpiW (lpString1=".pdf", lpString2=".H1D") returned 1 [0198.520] lstrlenW (lpString=".xls") returned 4 [0198.520] lstrcmpiW (lpString1=".xls", lpString2=".H1D") returned 1 [0198.520] lstrlenW (lpString=".xlsx") returned 5 [0198.520] lstrcmpiW (lpString1=".xlsx", lpString2="r.H1D") returned -1 [0198.520] lstrlenW (lpString=".ppt") returned 4 [0198.520] lstrcmpiW (lpString1=".ppt", lpString2=".H1D") returned 1 [0198.520] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.520] lstrlenW (lpString=".zip") returned 4 [0198.520] lstrcmpiW (lpString1=".zip", lpString2=".H1D") returned 1 [0198.520] lstrlenW (lpString=".rar") returned 4 [0198.520] lstrcmpiW (lpString1=".rar", lpString2=".H1D") returned 1 [0198.520] lstrlenW (lpString=".bz2") returned 4 [0198.520] lstrcmpiW (lpString1=".bz2", lpString2=".H1D") returned -1 [0198.520] lstrlenW (lpString=".7z") returned 3 [0198.520] lstrcmpiW (lpString1=".7z", lpString2="H1D") returned -1 [0198.520] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.520] lstrlenW (lpString=".dbf") returned 4 [0198.520] lstrcmpiW (lpString1=".dbf", lpString2=".H1D") returned -1 [0198.520] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.520] lstrlenW (lpString=".1cd") returned 4 [0198.521] lstrcmpiW (lpString1=".1cd", lpString2=".H1D") returned -1 [0198.521] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.521] lstrlenW (lpString=".jpg") returned 4 [0198.521] lstrcmpiW (lpString1=".jpg", lpString2=".H1D") returned 1 [0198.521] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.521] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.521] lstrlenW (lpString=".doc") returned 4 [0198.521] lstrcmpiW (lpString1=".doc", lpString2=".H1D") returned -1 [0198.521] lstrlenW (lpString=".docx") returned 5 [0198.521] lstrcmpiW (lpString1=".docx", lpString2="r.H1D") returned -1 [0198.521] lstrlenW (lpString=".pdf") returned 4 [0198.521] lstrcmpiW (lpString1=".pdf", lpString2=".H1D") returned 1 [0198.521] lstrlenW (lpString=".xls") returned 4 [0198.521] lstrcmpiW (lpString1=".xls", lpString2=".H1D") returned 1 [0198.521] lstrlenW (lpString=".xlsx") returned 5 [0198.521] lstrcmpiW (lpString1=".xlsx", lpString2="r.H1D") returned -1 [0198.521] lstrlenW (lpString=".ppt") returned 4 [0198.521] lstrcmpiW (lpString1=".ppt", lpString2=".H1D") returned 1 [0198.521] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.521] lstrlenW (lpString=".zip") returned 4 [0198.521] lstrcmpiW (lpString1=".zip", lpString2=".H1D") returned 1 [0198.521] lstrlenW (lpString=".rar") returned 4 [0198.521] lstrcmpiW (lpString1=".rar", lpString2=".H1D") returned 1 [0198.521] lstrlenW (lpString=".bz2") returned 4 [0198.521] lstrcmpiW (lpString1=".bz2", lpString2=".H1D") returned -1 [0198.521] lstrlenW (lpString=".7z") returned 3 [0198.521] lstrcmpiW (lpString1=".7z", lpString2="H1D") returned -1 [0198.521] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.521] lstrlenW (lpString=".dbf") returned 4 [0198.521] lstrcmpiW (lpString1=".dbf", lpString2=".H1D") returned -1 [0198.521] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.521] lstrlenW (lpString=".1cd") returned 4 [0198.521] lstrcmpiW (lpString1=".1cd", lpString2=".H1D") returned -1 [0198.521] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.H1D") returned 72 [0198.522] lstrlenW (lpString=".jpg") returned 4 [0198.522] lstrcmpiW (lpString1=".jpg", lpString2=".H1D") returned 1 [0198.522] lstrcmpiW (lpString1=".Lck", lpString2=".wiki") returned -1 [0198.522] lstrlenW (lpString="Help_MValidator.Lck") returned 19 [0198.522] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.522] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=4) returned 1 [0198.522] CloseHandle (hObject=0x388) returned 1 [0198.522] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck")) returned 0x2026 [0198.522] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.523] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help_mvalidator.lck"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.523] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.523] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.523] lstrlenW (lpString=".doc") returned 4 [0198.523] lstrcmpiW (lpString1=".doc", lpString2=".Lck") returned -1 [0198.523] lstrlenW (lpString=".docx") returned 5 [0198.523] lstrcmpiW (lpString1=".docx", lpString2="r.Lck") returned -1 [0198.523] lstrlenW (lpString=".pdf") returned 4 [0198.523] lstrcmpiW (lpString1=".pdf", lpString2=".Lck") returned 1 [0198.523] lstrlenW (lpString=".xls") returned 4 [0198.523] lstrcmpiW (lpString1=".xls", lpString2=".Lck") returned 1 [0198.523] lstrlenW (lpString=".xlsx") returned 5 [0198.523] lstrcmpiW (lpString1=".xlsx", lpString2="r.Lck") returned -1 [0198.523] lstrlenW (lpString=".ppt") returned 4 [0198.523] lstrcmpiW (lpString1=".ppt", lpString2=".Lck") returned 1 [0198.523] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.523] lstrlenW (lpString=".zip") returned 4 [0198.523] lstrcmpiW (lpString1=".zip", lpString2=".Lck") returned 1 [0198.523] lstrlenW (lpString=".rar") returned 4 [0198.523] lstrcmpiW (lpString1=".rar", lpString2=".Lck") returned 1 [0198.523] lstrlenW (lpString=".bz2") returned 4 [0198.523] lstrcmpiW (lpString1=".bz2", lpString2=".Lck") returned -1 [0198.523] lstrlenW (lpString=".7z") returned 3 [0198.523] lstrcmpiW (lpString1=".7z", lpString2="Lck") returned -1 [0198.523] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.523] lstrlenW (lpString=".dbf") returned 4 [0198.523] lstrcmpiW (lpString1=".dbf", lpString2=".Lck") returned -1 [0198.523] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.523] lstrlenW (lpString=".1cd") returned 4 [0198.523] lstrcmpiW (lpString1=".1cd", lpString2=".Lck") returned -1 [0198.523] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.523] lstrlenW (lpString=".jpg") returned 4 [0198.523] lstrcmpiW (lpString1=".jpg", lpString2=".Lck") returned -1 [0198.524] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.524] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.524] lstrlenW (lpString=".doc") returned 4 [0198.524] lstrcmpiW (lpString1=".doc", lpString2=".Lck") returned -1 [0198.524] lstrlenW (lpString=".docx") returned 5 [0198.524] lstrcmpiW (lpString1=".docx", lpString2="r.Lck") returned -1 [0198.524] lstrlenW (lpString=".pdf") returned 4 [0198.524] lstrcmpiW (lpString1=".pdf", lpString2=".Lck") returned 1 [0198.524] lstrlenW (lpString=".xls") returned 4 [0198.524] lstrcmpiW (lpString1=".xls", lpString2=".Lck") returned 1 [0198.524] lstrlenW (lpString=".xlsx") returned 5 [0198.524] lstrcmpiW (lpString1=".xlsx", lpString2="r.Lck") returned -1 [0198.524] lstrlenW (lpString=".ppt") returned 4 [0198.524] lstrcmpiW (lpString1=".ppt", lpString2=".Lck") returned 1 [0198.524] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.524] lstrlenW (lpString=".zip") returned 4 [0198.524] lstrcmpiW (lpString1=".zip", lpString2=".Lck") returned 1 [0198.524] lstrlenW (lpString=".rar") returned 4 [0198.524] lstrcmpiW (lpString1=".rar", lpString2=".Lck") returned 1 [0198.524] lstrlenW (lpString=".bz2") returned 4 [0198.524] lstrcmpiW (lpString1=".bz2", lpString2=".Lck") returned -1 [0198.524] lstrlenW (lpString=".7z") returned 3 [0198.524] lstrcmpiW (lpString1=".7z", lpString2="Lck") returned -1 [0198.524] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.524] lstrlenW (lpString=".dbf") returned 4 [0198.524] lstrcmpiW (lpString1=".dbf", lpString2=".Lck") returned -1 [0198.524] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.524] lstrlenW (lpString=".1cd") returned 4 [0198.524] lstrcmpiW (lpString1=".1cd", lpString2=".Lck") returned -1 [0198.524] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help_MValidator.Lck") returned 72 [0198.524] lstrlenW (lpString=".jpg") returned 4 [0198.524] lstrcmpiW (lpString1=".jpg", lpString2=".Lck") returned -1 [0198.525] lstrcmpiW (lpString1=".H1Q", lpString2=".wiki") returned -1 [0198.525] lstrlenW (lpString="Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 46 [0198.525] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.525] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=873232) returned 1 [0198.525] CloseHandle (hObject=0x388) returned 1 [0198.525] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q")) returned 0x2026 [0198.525] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.525] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q" (normalized: "c:\\programdata\\microsoft\\assistance\\client\\1.0\\en-us\\help{9daa54e8-cd95-4107-8e7f-ba3f24732d95}.h1q"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.525] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.525] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.525] lstrlenW (lpString=".doc") returned 4 [0198.525] lstrcmpiW (lpString1=".doc", lpString2=".H1Q") returned -1 [0198.525] lstrlenW (lpString=".docx") returned 5 [0198.525] lstrcmpiW (lpString1=".docx", lpString2="}.H1Q") returned -1 [0198.525] lstrlenW (lpString=".pdf") returned 4 [0198.525] lstrcmpiW (lpString1=".pdf", lpString2=".H1Q") returned 1 [0198.525] lstrlenW (lpString=".xls") returned 4 [0198.526] lstrcmpiW (lpString1=".xls", lpString2=".H1Q") returned 1 [0198.526] lstrlenW (lpString=".xlsx") returned 5 [0198.526] lstrcmpiW (lpString1=".xlsx", lpString2="}.H1Q") returned -1 [0198.526] lstrlenW (lpString=".ppt") returned 4 [0198.526] lstrcmpiW (lpString1=".ppt", lpString2=".H1Q") returned 1 [0198.526] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.526] lstrlenW (lpString=".zip") returned 4 [0198.526] lstrcmpiW (lpString1=".zip", lpString2=".H1Q") returned 1 [0198.526] lstrlenW (lpString=".rar") returned 4 [0198.526] lstrcmpiW (lpString1=".rar", lpString2=".H1Q") returned 1 [0198.526] lstrlenW (lpString=".bz2") returned 4 [0198.526] lstrcmpiW (lpString1=".bz2", lpString2=".H1Q") returned -1 [0198.526] lstrlenW (lpString=".7z") returned 3 [0198.526] lstrcmpiW (lpString1=".7z", lpString2="H1Q") returned -1 [0198.526] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.526] lstrlenW (lpString=".dbf") returned 4 [0198.526] lstrcmpiW (lpString1=".dbf", lpString2=".H1Q") returned -1 [0198.526] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.526] lstrlenW (lpString=".1cd") returned 4 [0198.526] lstrcmpiW (lpString1=".1cd", lpString2=".H1Q") returned -1 [0198.526] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.526] lstrlenW (lpString=".jpg") returned 4 [0198.526] lstrcmpiW (lpString1=".jpg", lpString2=".H1Q") returned 1 [0198.526] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.526] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.526] lstrlenW (lpString=".doc") returned 4 [0198.526] lstrcmpiW (lpString1=".doc", lpString2=".H1Q") returned -1 [0198.526] lstrlenW (lpString=".docx") returned 5 [0198.526] lstrcmpiW (lpString1=".docx", lpString2="}.H1Q") returned -1 [0198.526] lstrlenW (lpString=".pdf") returned 4 [0198.526] lstrcmpiW (lpString1=".pdf", lpString2=".H1Q") returned 1 [0198.526] lstrlenW (lpString=".xls") returned 4 [0198.526] lstrcmpiW (lpString1=".xls", lpString2=".H1Q") returned 1 [0198.526] lstrlenW (lpString=".xlsx") returned 5 [0198.527] lstrcmpiW (lpString1=".xlsx", lpString2="}.H1Q") returned -1 [0198.527] lstrlenW (lpString=".ppt") returned 4 [0198.527] lstrcmpiW (lpString1=".ppt", lpString2=".H1Q") returned 1 [0198.527] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.527] lstrlenW (lpString=".zip") returned 4 [0198.527] lstrcmpiW (lpString1=".zip", lpString2=".H1Q") returned 1 [0198.527] lstrlenW (lpString=".rar") returned 4 [0198.527] lstrcmpiW (lpString1=".rar", lpString2=".H1Q") returned 1 [0198.527] lstrlenW (lpString=".bz2") returned 4 [0198.527] lstrcmpiW (lpString1=".bz2", lpString2=".H1Q") returned -1 [0198.527] lstrlenW (lpString=".7z") returned 3 [0198.527] lstrcmpiW (lpString1=".7z", lpString2="H1Q") returned -1 [0198.527] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.527] lstrlenW (lpString=".dbf") returned 4 [0198.527] lstrcmpiW (lpString1=".dbf", lpString2=".H1Q") returned -1 [0198.527] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.527] lstrlenW (lpString=".1cd") returned 4 [0198.527] lstrcmpiW (lpString1=".1cd", lpString2=".H1Q") returned -1 [0198.527] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Assistance\\Client\\1.0\\en-US\\Help{9DAA54E8-CD95-4107-8E7F-BA3F24732D95}.H1Q") returned 99 [0198.527] lstrlenW (lpString=".jpg") returned 4 [0198.527] lstrcmpiW (lpString1=".jpg", lpString2=".H1Q") returned 1 [0198.527] lstrcmpiW (lpString1=".ico", lpString2=".wiki") returned -1 [0198.527] lstrlenW (lpString="folder.ico") returned 10 [0198.527] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0198.528] GetFileSizeEx (in: hFile=0x388, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=53411) returned 1 [0198.528] CloseHandle (hObject=0x388) returned 1 [0198.528] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico")) returned 0x20 [0198.528] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0198.528] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico" (normalized: "c:\\programdata\\microsoft\\device stage\\task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.529] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico") returned 92 [0198.529] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico") returned 92 [0198.529] lstrlenW (lpString=".doc") returned 4 [0198.529] lstrcmpiW (lpString1=".doc", lpString2=".ico") returned -1 [0198.529] lstrlenW (lpString=".docx") returned 5 [0198.529] lstrcmpiW (lpString1=".docx", lpString2="r.ico") returned -1 [0198.529] lstrlenW (lpString=".pdf") returned 4 [0198.529] lstrcmpiW (lpString1=".pdf", lpString2=".ico") returned 1 [0198.529] lstrlenW (lpString=".xls") returned 4 [0198.529] lstrcmpiW (lpString1=".xls", lpString2=".ico") returned 1 [0198.529] lstrlenW (lpString=".xlsx") returned 5 [0198.529] lstrcmpiW (lpString1=".xlsx", lpString2="r.ico") returned -1 [0198.529] lstrlenW (lpString=".ppt") returned 4 [0198.529] lstrcmpiW (lpString1=".ppt", lpString2=".ico") returned 1 [0198.529] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico") returned 92 [0198.529] lstrlenW (lpString=".zip") returned 4 [0198.529] lstrcmpiW (lpString1=".zip", lpString2=".ico") returned 1 [0198.529] lstrlenW (lpString=".rar") returned 4 [0198.529] lstrcmpiW (lpString1=".rar", lpString2=".ico") returned 1 [0198.529] lstrlenW (lpString=".bz2") returned 4 [0198.529] lstrcmpiW (lpString1=".bz2", lpString2=".ico") returned -1 [0198.529] lstrlenW (lpString=".7z") returned 3 [0198.529] lstrcmpiW (lpString1=".7z", lpString2="ico") returned -1 [0198.529] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Device Stage\\Task\\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\\folder.ico") returned 92 [0198.529] lstrlenW (lpString=".dbf") returned 4 [0198.529] lstrcmpiW (lpString1=".dbf", lpString2=".ico") returned -1 [0198.536] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0198.536] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0198.536] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Active.GRL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\mf\\active.grl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.536] CloseHandle (hObject=0x388) returned 1 [0198.536] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0198.536] SetFilePointerEx (in: hFile=0x388, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0198.537] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\MF\\Pending.GRL.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\mf\\pending.grl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0198.537] CloseHandle (hObject=0x388) returned 1 [0198.540] MoveFileW (lpExistingFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll"), lpNewFileName="C:\\ProgramData\\Microsoft\\OFFICE\\UICaptions\\1036\\MSOINTL.REST.trx_dll.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\office\\uicaptions\\1036\\msointl.rest.trx_dll.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0199.109] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.109] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.109] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql3285.tmp.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0199.110] GetLastError () returned 0x0 [0199.110] ReadFile (in: hFile=0x2d8, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x5000, lpOverlapped=0x0) returned 1 [0199.112] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x5010, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x5010, lpOverlapped=0x0) returned 1 [0199.113] ReadFile (in: hFile=0x2d8, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0199.113] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xea, lpOverlapped=0x0) returned 1 [0199.113] SetEndOfFile (hFile=0x358) returned 1 [0199.113] CloseHandle (hObject=0x358) returned 1 [0199.113] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.113] SetEndOfFile (hFile=0x2d8) returned 1 [0199.114] CloseHandle (hObject=0x2d8) returned 1 [0199.114] SetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.114] DeleteFileW (lpFileName="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp" (normalized: "c:\\programdata\\microsoft\\rac\\temp\\sql3285.tmp")) returned 1 [0199.115] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.115] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.115] lstrlenW (lpString=".doc") returned 4 [0199.115] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0199.115] lstrlenW (lpString=".docx") returned 5 [0199.115] lstrcmpiW (lpString1=".docx", lpString2="5.tmp") returned -1 [0199.115] lstrlenW (lpString=".pdf") returned 4 [0199.115] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0199.115] lstrlenW (lpString=".xls") returned 4 [0199.115] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0199.115] lstrlenW (lpString=".xlsx") returned 5 [0199.115] lstrcmpiW (lpString1=".xlsx", lpString2="5.tmp") returned -1 [0199.115] lstrlenW (lpString=".ppt") returned 4 [0199.115] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0199.115] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.115] lstrlenW (lpString=".zip") returned 4 [0199.115] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0199.115] lstrlenW (lpString=".rar") returned 4 [0199.115] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0199.115] lstrlenW (lpString=".bz2") returned 4 [0199.115] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0199.115] lstrlenW (lpString=".7z") returned 3 [0199.115] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0199.116] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.116] lstrlenW (lpString=".dbf") returned 4 [0199.116] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0199.116] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.116] lstrlenW (lpString=".1cd") returned 4 [0199.116] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0199.116] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.116] lstrlenW (lpString=".jpg") returned 4 [0199.116] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0199.116] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.116] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.116] lstrlenW (lpString=".doc") returned 4 [0199.116] lstrcmpiW (lpString1=".doc", lpString2=".tmp") returned -1 [0199.116] lstrlenW (lpString=".docx") returned 5 [0199.116] lstrcmpiW (lpString1=".docx", lpString2="5.tmp") returned -1 [0199.116] lstrlenW (lpString=".pdf") returned 4 [0199.116] lstrcmpiW (lpString1=".pdf", lpString2=".tmp") returned -1 [0199.116] lstrlenW (lpString=".xls") returned 4 [0199.116] lstrcmpiW (lpString1=".xls", lpString2=".tmp") returned 1 [0199.116] lstrlenW (lpString=".xlsx") returned 5 [0199.116] lstrcmpiW (lpString1=".xlsx", lpString2="5.tmp") returned -1 [0199.116] lstrlenW (lpString=".ppt") returned 4 [0199.116] lstrcmpiW (lpString1=".ppt", lpString2=".tmp") returned -1 [0199.116] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.116] lstrlenW (lpString=".zip") returned 4 [0199.116] lstrcmpiW (lpString1=".zip", lpString2=".tmp") returned 1 [0199.116] lstrlenW (lpString=".rar") returned 4 [0199.116] lstrcmpiW (lpString1=".rar", lpString2=".tmp") returned -1 [0199.116] lstrlenW (lpString=".bz2") returned 4 [0199.116] lstrcmpiW (lpString1=".bz2", lpString2=".tmp") returned -1 [0199.116] lstrlenW (lpString=".7z") returned 3 [0199.116] lstrcmpiW (lpString1=".7z", lpString2="tmp") returned -1 [0199.116] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.117] lstrlenW (lpString=".dbf") returned 4 [0199.117] lstrcmpiW (lpString1=".dbf", lpString2=".tmp") returned -1 [0199.117] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.117] lstrlenW (lpString=".1cd") returned 4 [0199.117] lstrcmpiW (lpString1=".1cd", lpString2=".tmp") returned -1 [0199.117] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\RAC\\Temp\\sql3285.tmp") returned 45 [0199.117] lstrlenW (lpString=".jpg") returned 4 [0199.117] lstrcmpiW (lpString1=".jpg", lpString2=".tmp") returned -1 [0199.117] lstrcmpiW (lpString1=".devicemetadata-ms", lpString2=".wiki") returned -1 [0199.117] lstrlenW (lpString="34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 54 [0199.117] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.117] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=14134) returned 1 [0199.117] CloseHandle (hObject=0x2d8) returned 1 [0199.118] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms")) returned 0x20 [0199.118] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.118] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.118] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.118] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.118] lstrlenW (lpString=".doc") returned 4 [0199.118] lstrcmpiW (lpString1=".doc", lpString2="a-ms") returned -1 [0199.118] lstrlenW (lpString=".docx") returned 5 [0199.118] lstrcmpiW (lpString1=".docx", lpString2="ta-ms") returned -1 [0199.118] lstrlenW (lpString=".pdf") returned 4 [0199.118] lstrcmpiW (lpString1=".pdf", lpString2="a-ms") returned -1 [0199.118] lstrlenW (lpString=".xls") returned 4 [0199.118] lstrcmpiW (lpString1=".xls", lpString2="a-ms") returned -1 [0199.118] lstrlenW (lpString=".xlsx") returned 5 [0199.118] lstrcmpiW (lpString1=".xlsx", lpString2="ta-ms") returned -1 [0199.118] lstrlenW (lpString=".ppt") returned 4 [0199.118] lstrcmpiW (lpString1=".ppt", lpString2="a-ms") returned -1 [0199.118] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.118] lstrlenW (lpString=".zip") returned 4 [0199.118] lstrcmpiW (lpString1=".zip", lpString2="a-ms") returned -1 [0199.118] lstrlenW (lpString=".rar") returned 4 [0199.118] lstrcmpiW (lpString1=".rar", lpString2="a-ms") returned -1 [0199.118] lstrlenW (lpString=".bz2") returned 4 [0199.118] lstrcmpiW (lpString1=".bz2", lpString2="a-ms") returned -1 [0199.118] lstrlenW (lpString=".7z") returned 3 [0199.118] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.118] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.119] lstrlenW (lpString=".dbf") returned 4 [0199.119] lstrcmpiW (lpString1=".dbf", lpString2="a-ms") returned -1 [0199.119] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.119] lstrlenW (lpString=".1cd") returned 4 [0199.119] lstrcmpiW (lpString1=".1cd", lpString2="a-ms") returned -1 [0199.119] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.119] lstrlenW (lpString=".jpg") returned 4 [0199.119] lstrcmpiW (lpString1=".jpg", lpString2="a-ms") returned -1 [0199.119] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.119] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.119] lstrlenW (lpString=".doc") returned 4 [0199.119] lstrcmpiW (lpString1=".doc", lpString2="a-ms") returned -1 [0199.119] lstrlenW (lpString=".docx") returned 5 [0199.119] lstrcmpiW (lpString1=".docx", lpString2="ta-ms") returned -1 [0199.119] lstrlenW (lpString=".pdf") returned 4 [0199.119] lstrcmpiW (lpString1=".pdf", lpString2="a-ms") returned -1 [0199.119] lstrlenW (lpString=".xls") returned 4 [0199.119] lstrcmpiW (lpString1=".xls", lpString2="a-ms") returned -1 [0199.119] lstrlenW (lpString=".xlsx") returned 5 [0199.119] lstrcmpiW (lpString1=".xlsx", lpString2="ta-ms") returned -1 [0199.119] lstrlenW (lpString=".ppt") returned 4 [0199.119] lstrcmpiW (lpString1=".ppt", lpString2="a-ms") returned -1 [0199.119] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.119] lstrlenW (lpString=".zip") returned 4 [0199.119] lstrcmpiW (lpString1=".zip", lpString2="a-ms") returned -1 [0199.119] lstrlenW (lpString=".rar") returned 4 [0199.119] lstrcmpiW (lpString1=".rar", lpString2="a-ms") returned -1 [0199.119] lstrlenW (lpString=".bz2") returned 4 [0199.119] lstrcmpiW (lpString1=".bz2", lpString2="a-ms") returned -1 [0199.119] lstrlenW (lpString=".7z") returned 3 [0199.119] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.119] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.119] lstrlenW (lpString=".dbf") returned 4 [0199.120] lstrcmpiW (lpString1=".dbf", lpString2="a-ms") returned -1 [0199.120] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.120] lstrlenW (lpString=".1cd") returned 4 [0199.120] lstrcmpiW (lpString1=".1cd", lpString2="a-ms") returned -1 [0199.120] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\34e548a8-3268-4dde-bedf-c40f9b6c814a.devicemetadata-ms") returned 113 [0199.120] lstrlenW (lpString=".jpg") returned 4 [0199.120] lstrcmpiW (lpString1=".jpg", lpString2="a-ms") returned -1 [0199.120] lstrcmpiW (lpString1=".devicemetadata-ms", lpString2=".wiki") returned -1 [0199.120] lstrlenW (lpString="63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 54 [0199.120] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.120] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=110457) returned 1 [0199.120] CloseHandle (hObject=0x2d8) returned 1 [0199.120] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms")) returned 0x20 [0199.120] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.121] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms" (normalized: "c:\\programdata\\microsoft\\windows\\devicemetadatastore\\en-us\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.121] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.121] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.121] lstrlenW (lpString=".doc") returned 4 [0199.121] lstrcmpiW (lpString1=".doc", lpString2="a-ms") returned -1 [0199.121] lstrlenW (lpString=".docx") returned 5 [0199.121] lstrcmpiW (lpString1=".docx", lpString2="ta-ms") returned -1 [0199.121] lstrlenW (lpString=".pdf") returned 4 [0199.121] lstrcmpiW (lpString1=".pdf", lpString2="a-ms") returned -1 [0199.121] lstrlenW (lpString=".xls") returned 4 [0199.121] lstrcmpiW (lpString1=".xls", lpString2="a-ms") returned -1 [0199.121] lstrlenW (lpString=".xlsx") returned 5 [0199.121] lstrcmpiW (lpString1=".xlsx", lpString2="ta-ms") returned -1 [0199.121] lstrlenW (lpString=".ppt") returned 4 [0199.121] lstrcmpiW (lpString1=".ppt", lpString2="a-ms") returned -1 [0199.121] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.121] lstrlenW (lpString=".zip") returned 4 [0199.121] lstrcmpiW (lpString1=".zip", lpString2="a-ms") returned -1 [0199.121] lstrlenW (lpString=".rar") returned 4 [0199.121] lstrcmpiW (lpString1=".rar", lpString2="a-ms") returned -1 [0199.121] lstrlenW (lpString=".bz2") returned 4 [0199.121] lstrcmpiW (lpString1=".bz2", lpString2="a-ms") returned -1 [0199.121] lstrlenW (lpString=".7z") returned 3 [0199.121] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.121] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.121] lstrlenW (lpString=".dbf") returned 4 [0199.121] lstrcmpiW (lpString1=".dbf", lpString2="a-ms") returned -1 [0199.121] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.121] lstrlenW (lpString=".1cd") returned 4 [0199.121] lstrcmpiW (lpString1=".1cd", lpString2="a-ms") returned -1 [0199.121] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.122] lstrlenW (lpString=".jpg") returned 4 [0199.122] lstrcmpiW (lpString1=".jpg", lpString2="a-ms") returned -1 [0199.122] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.122] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.122] lstrlenW (lpString=".doc") returned 4 [0199.122] lstrcmpiW (lpString1=".doc", lpString2="a-ms") returned -1 [0199.122] lstrlenW (lpString=".docx") returned 5 [0199.122] lstrcmpiW (lpString1=".docx", lpString2="ta-ms") returned -1 [0199.122] lstrlenW (lpString=".pdf") returned 4 [0199.122] lstrcmpiW (lpString1=".pdf", lpString2="a-ms") returned -1 [0199.122] lstrlenW (lpString=".xls") returned 4 [0199.122] lstrcmpiW (lpString1=".xls", lpString2="a-ms") returned -1 [0199.122] lstrlenW (lpString=".xlsx") returned 5 [0199.122] lstrcmpiW (lpString1=".xlsx", lpString2="ta-ms") returned -1 [0199.122] lstrlenW (lpString=".ppt") returned 4 [0199.122] lstrcmpiW (lpString1=".ppt", lpString2="a-ms") returned -1 [0199.122] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.122] lstrlenW (lpString=".zip") returned 4 [0199.122] lstrcmpiW (lpString1=".zip", lpString2="a-ms") returned -1 [0199.122] lstrlenW (lpString=".rar") returned 4 [0199.122] lstrcmpiW (lpString1=".rar", lpString2="a-ms") returned -1 [0199.122] lstrlenW (lpString=".bz2") returned 4 [0199.122] lstrcmpiW (lpString1=".bz2", lpString2="a-ms") returned -1 [0199.122] lstrlenW (lpString=".7z") returned 3 [0199.122] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.122] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.122] lstrlenW (lpString=".dbf") returned 4 [0199.122] lstrcmpiW (lpString1=".dbf", lpString2="a-ms") returned -1 [0199.122] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.122] lstrlenW (lpString=".1cd") returned 4 [0199.122] lstrcmpiW (lpString1=".1cd", lpString2="a-ms") returned -1 [0199.122] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\DeviceMetadataStore\\en-US\\63921eef-8415-4368-9201-f0df4af5778f.devicemetadata-ms") returned 113 [0199.122] lstrlenW (lpString=".jpg") returned 4 [0199.123] lstrcmpiW (lpString1=".jpg", lpString2="a-ms") returned -1 [0199.123] lstrcmpiW (lpString1=".wma", lpString2=".wiki") returned 1 [0199.123] lstrlenW (lpString="Ringtone 01.wma") returned 15 [0199.123] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.124] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=201833) returned 1 [0199.124] CloseHandle (hObject=0x2d8) returned 1 [0199.124] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma")) returned 0x20 [0199.124] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.124] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 01.wma"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.124] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.124] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.124] lstrlenW (lpString=".doc") returned 4 [0199.124] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0199.124] lstrlenW (lpString=".docx") returned 5 [0199.124] lstrcmpiW (lpString1=".docx", lpString2="1.wma") returned -1 [0199.124] lstrlenW (lpString=".pdf") returned 4 [0199.124] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0199.124] lstrlenW (lpString=".xls") returned 4 [0199.124] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0199.124] lstrlenW (lpString=".xlsx") returned 5 [0199.124] lstrcmpiW (lpString1=".xlsx", lpString2="1.wma") returned -1 [0199.124] lstrlenW (lpString=".ppt") returned 4 [0199.124] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0199.124] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.124] lstrlenW (lpString=".zip") returned 4 [0199.124] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0199.124] lstrlenW (lpString=".rar") returned 4 [0199.125] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0199.125] lstrlenW (lpString=".bz2") returned 4 [0199.125] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0199.125] lstrlenW (lpString=".7z") returned 3 [0199.125] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0199.125] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.125] lstrlenW (lpString=".dbf") returned 4 [0199.125] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0199.125] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.125] lstrlenW (lpString=".1cd") returned 4 [0199.125] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0199.125] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.125] lstrlenW (lpString=".jpg") returned 4 [0199.125] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0199.125] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.125] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.125] lstrlenW (lpString=".doc") returned 4 [0199.125] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0199.125] lstrlenW (lpString=".docx") returned 5 [0199.125] lstrcmpiW (lpString1=".docx", lpString2="1.wma") returned -1 [0199.125] lstrlenW (lpString=".pdf") returned 4 [0199.125] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0199.125] lstrlenW (lpString=".xls") returned 4 [0199.125] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0199.125] lstrlenW (lpString=".xlsx") returned 5 [0199.125] lstrcmpiW (lpString1=".xlsx", lpString2="1.wma") returned -1 [0199.125] lstrlenW (lpString=".ppt") returned 4 [0199.125] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0199.125] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.125] lstrlenW (lpString=".zip") returned 4 [0199.125] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0199.125] lstrlenW (lpString=".rar") returned 4 [0199.125] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0199.125] lstrlenW (lpString=".bz2") returned 4 [0199.126] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0199.126] lstrlenW (lpString=".7z") returned 3 [0199.126] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0199.126] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.126] lstrlenW (lpString=".dbf") returned 4 [0199.126] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0199.126] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.126] lstrlenW (lpString=".1cd") returned 4 [0199.126] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0199.126] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 01.wma") returned 58 [0199.126] lstrlenW (lpString=".jpg") returned 4 [0199.126] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0199.126] lstrcmpiW (lpString1=".wma", lpString2=".wiki") returned 1 [0199.126] lstrlenW (lpString="Ringtone 02.wma") returned 15 [0199.126] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.128] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=139199) returned 1 [0199.128] CloseHandle (hObject=0x2d8) returned 1 [0199.128] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma")) returned 0x20 [0199.128] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.128] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 02.wma"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.128] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.128] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.128] lstrlenW (lpString=".doc") returned 4 [0199.128] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0199.128] lstrlenW (lpString=".docx") returned 5 [0199.128] lstrcmpiW (lpString1=".docx", lpString2="2.wma") returned -1 [0199.128] lstrlenW (lpString=".pdf") returned 4 [0199.128] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0199.128] lstrlenW (lpString=".xls") returned 4 [0199.128] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0199.128] lstrlenW (lpString=".xlsx") returned 5 [0199.128] lstrcmpiW (lpString1=".xlsx", lpString2="2.wma") returned -1 [0199.128] lstrlenW (lpString=".ppt") returned 4 [0199.128] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0199.128] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.128] lstrlenW (lpString=".zip") returned 4 [0199.128] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0199.128] lstrlenW (lpString=".rar") returned 4 [0199.128] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0199.128] lstrlenW (lpString=".bz2") returned 4 [0199.128] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0199.128] lstrlenW (lpString=".7z") returned 3 [0199.128] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0199.129] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.129] lstrlenW (lpString=".dbf") returned 4 [0199.129] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0199.129] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.129] lstrlenW (lpString=".1cd") returned 4 [0199.129] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0199.129] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.129] lstrlenW (lpString=".jpg") returned 4 [0199.129] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0199.129] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.129] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.129] lstrlenW (lpString=".doc") returned 4 [0199.129] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0199.129] lstrlenW (lpString=".docx") returned 5 [0199.129] lstrcmpiW (lpString1=".docx", lpString2="2.wma") returned -1 [0199.129] lstrlenW (lpString=".pdf") returned 4 [0199.129] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0199.129] lstrlenW (lpString=".xls") returned 4 [0199.129] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0199.129] lstrlenW (lpString=".xlsx") returned 5 [0199.129] lstrcmpiW (lpString1=".xlsx", lpString2="2.wma") returned -1 [0199.129] lstrlenW (lpString=".ppt") returned 4 [0199.129] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0199.129] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.129] lstrlenW (lpString=".zip") returned 4 [0199.129] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0199.129] lstrlenW (lpString=".rar") returned 4 [0199.129] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0199.129] lstrlenW (lpString=".bz2") returned 4 [0199.129] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0199.129] lstrlenW (lpString=".7z") returned 3 [0199.129] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0199.129] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.130] lstrlenW (lpString=".dbf") returned 4 [0199.130] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0199.130] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.130] lstrlenW (lpString=".1cd") returned 4 [0199.130] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0199.130] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 02.wma") returned 58 [0199.130] lstrlenW (lpString=".jpg") returned 4 [0199.130] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0199.130] lstrcmpiW (lpString1=".wma", lpString2=".wiki") returned 1 [0199.130] lstrlenW (lpString="Ringtone 03.wma") returned 15 [0199.130] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.131] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=94457) returned 1 [0199.131] CloseHandle (hObject=0x2d8) returned 1 [0199.131] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma")) returned 0x20 [0199.131] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.131] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 03.wma"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.131] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.131] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.131] lstrlenW (lpString=".doc") returned 4 [0199.131] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0199.131] lstrlenW (lpString=".docx") returned 5 [0199.131] lstrcmpiW (lpString1=".docx", lpString2="3.wma") returned -1 [0199.131] lstrlenW (lpString=".pdf") returned 4 [0199.131] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0199.131] lstrlenW (lpString=".xls") returned 4 [0199.131] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0199.131] lstrlenW (lpString=".xlsx") returned 5 [0199.131] lstrcmpiW (lpString1=".xlsx", lpString2="3.wma") returned -1 [0199.131] lstrlenW (lpString=".ppt") returned 4 [0199.131] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0199.131] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.131] lstrlenW (lpString=".zip") returned 4 [0199.132] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0199.132] lstrlenW (lpString=".rar") returned 4 [0199.132] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0199.132] lstrlenW (lpString=".bz2") returned 4 [0199.132] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0199.132] lstrlenW (lpString=".7z") returned 3 [0199.132] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0199.132] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.132] lstrlenW (lpString=".dbf") returned 4 [0199.132] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0199.132] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.132] lstrlenW (lpString=".1cd") returned 4 [0199.132] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0199.132] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.132] lstrlenW (lpString=".jpg") returned 4 [0199.132] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0199.132] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.132] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.132] lstrlenW (lpString=".doc") returned 4 [0199.132] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0199.132] lstrlenW (lpString=".docx") returned 5 [0199.132] lstrcmpiW (lpString1=".docx", lpString2="3.wma") returned -1 [0199.132] lstrlenW (lpString=".pdf") returned 4 [0199.132] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0199.132] lstrlenW (lpString=".xls") returned 4 [0199.132] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0199.132] lstrlenW (lpString=".xlsx") returned 5 [0199.132] lstrcmpiW (lpString1=".xlsx", lpString2="3.wma") returned -1 [0199.132] lstrlenW (lpString=".ppt") returned 4 [0199.132] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0199.132] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.132] lstrlenW (lpString=".zip") returned 4 [0199.133] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0199.133] lstrlenW (lpString=".rar") returned 4 [0199.133] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0199.133] lstrlenW (lpString=".bz2") returned 4 [0199.133] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0199.133] lstrlenW (lpString=".7z") returned 3 [0199.133] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0199.133] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.133] lstrlenW (lpString=".dbf") returned 4 [0199.133] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0199.133] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.133] lstrlenW (lpString=".1cd") returned 4 [0199.133] lstrcmpiW (lpString1=".1cd", lpString2=".wma") returned -1 [0199.133] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 03.wma") returned 58 [0199.133] lstrlenW (lpString=".jpg") returned 4 [0199.133] lstrcmpiW (lpString1=".jpg", lpString2=".wma") returned -1 [0199.133] lstrcmpiW (lpString1=".wma", lpString2=".wiki") returned 1 [0199.133] lstrlenW (lpString="Ringtone 04.wma") returned 15 [0199.133] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0199.134] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=237625) returned 1 [0199.134] CloseHandle (hObject=0x2d8) returned 1 [0199.134] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma")) returned 0x20 [0199.134] GetFileAttributesW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.134] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma" (normalized: "c:\\programdata\\microsoft\\windows\\ringtones\\ringtone 04.wma"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0199.134] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned 58 [0199.134] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned 58 [0199.134] lstrlenW (lpString=".doc") returned 4 [0199.135] lstrcmpiW (lpString1=".doc", lpString2=".wma") returned -1 [0199.135] lstrlenW (lpString=".docx") returned 5 [0199.135] lstrcmpiW (lpString1=".docx", lpString2="4.wma") returned -1 [0199.135] lstrlenW (lpString=".pdf") returned 4 [0199.135] lstrcmpiW (lpString1=".pdf", lpString2=".wma") returned -1 [0199.135] lstrlenW (lpString=".xls") returned 4 [0199.135] lstrcmpiW (lpString1=".xls", lpString2=".wma") returned 1 [0199.135] lstrlenW (lpString=".xlsx") returned 5 [0199.135] lstrcmpiW (lpString1=".xlsx", lpString2="4.wma") returned -1 [0199.135] lstrlenW (lpString=".ppt") returned 4 [0199.135] lstrcmpiW (lpString1=".ppt", lpString2=".wma") returned -1 [0199.135] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned 58 [0199.135] lstrlenW (lpString=".zip") returned 4 [0199.135] lstrcmpiW (lpString1=".zip", lpString2=".wma") returned 1 [0199.135] lstrlenW (lpString=".rar") returned 4 [0199.135] lstrcmpiW (lpString1=".rar", lpString2=".wma") returned -1 [0199.135] lstrlenW (lpString=".bz2") returned 4 [0199.135] lstrcmpiW (lpString1=".bz2", lpString2=".wma") returned -1 [0199.135] lstrlenW (lpString=".7z") returned 3 [0199.135] lstrcmpiW (lpString1=".7z", lpString2="wma") returned -1 [0199.135] lstrlenW (lpString="C:\\ProgramData\\Microsoft\\Windows\\Ringtones\\Ringtone 04.wma") returned 58 [0199.135] lstrlenW (lpString=".dbf") returned 4 [0199.135] lstrcmpiW (lpString1=".dbf", lpString2=".wma") returned -1 [0199.199] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{929FBD26-9020-399B-9A7A-751D61F0B942}v12.0.21005\\packages\\vcRuntimeAdditional_amd64\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{929fbd26-9020-399b-9a7a-751d61f0b942}v12.0.21005\\packages\\vcruntimeadditional_amd64\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0199.200] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{B175520C-86A2-35A7-8619-86DC379688B9}v11.0.61030\\packages\\vcRuntimeAdditional_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{b175520c-86a2-35a7-8619-86dc379688b9}v11.0.61030\\packages\\vcruntimeadditional_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0199.409] MoveFileW (lpExistingFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab"), lpNewFileName="C:\\ProgramData\\Package Cache\\{F8CFEB22-A2E7-3971-9EDA-4B11EDEFC185}v12.0.21005\\packages\\vcRuntimeAdditional_x86\\cab1.cab.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\programdata\\package cache\\{f8cfeb22-a2e7-3971-9eda-4b11edefc185}v12.0.21005\\packages\\vcruntimeadditional_x86\\cab1.cab.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0 [0199.410] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=35116) returned 1 [0199.410] CloseHandle (hObject=0x150) returned 1 [0199.410] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst")) returned 0x2020 [0199.410] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.410] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.410] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.410] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0199.420] GetLastError () returned 0x0 [0199.420] ReadFile (in: hFile=0x150, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x892c, lpOverlapped=0x0) returned 1 [0199.428] WriteFile (in: hFile=0x388, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x8930, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x8930, lpOverlapped=0x0) returned 1 [0199.430] ReadFile (in: hFile=0x150, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0199.431] WriteFile (in: hFile=0x388, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xf8, lpOverlapped=0x0) returned 1 [0199.431] SetEndOfFile (hFile=0x388) returned 1 [0199.431] CloseHandle (hObject=0x388) returned 1 [0199.431] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.431] SetEndOfFile (hFile=0x150) returned 1 [0199.433] CloseHandle (hObject=0x150) returned 1 [0199.433] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.433] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobecmapfnt10.lst")) returned 1 [0199.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.434] lstrlenW (lpString=".doc") returned 4 [0199.434] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0199.434] lstrlenW (lpString=".docx") returned 5 [0199.434] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0199.434] lstrlenW (lpString=".pdf") returned 4 [0199.434] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0199.434] lstrlenW (lpString=".xls") returned 4 [0199.434] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0199.434] lstrlenW (lpString=".xlsx") returned 5 [0199.434] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0199.434] lstrlenW (lpString=".ppt") returned 4 [0199.434] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0199.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.434] lstrlenW (lpString=".zip") returned 4 [0199.434] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0199.434] lstrlenW (lpString=".rar") returned 4 [0199.434] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0199.434] lstrlenW (lpString=".bz2") returned 4 [0199.434] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0199.434] lstrlenW (lpString=".7z") returned 3 [0199.434] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0199.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.434] lstrlenW (lpString=".dbf") returned 4 [0199.434] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0199.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.434] lstrlenW (lpString=".1cd") returned 4 [0199.434] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0199.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.434] lstrlenW (lpString=".jpg") returned 4 [0199.434] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0199.434] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.435] lstrlenW (lpString=".doc") returned 4 [0199.435] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0199.435] lstrlenW (lpString=".docx") returned 5 [0199.435] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0199.435] lstrlenW (lpString=".pdf") returned 4 [0199.435] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0199.435] lstrlenW (lpString=".xls") returned 4 [0199.435] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0199.435] lstrlenW (lpString=".xlsx") returned 5 [0199.435] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0199.435] lstrlenW (lpString=".ppt") returned 4 [0199.435] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0199.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.435] lstrlenW (lpString=".zip") returned 4 [0199.435] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0199.435] lstrlenW (lpString=".rar") returned 4 [0199.435] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0199.435] lstrlenW (lpString=".bz2") returned 4 [0199.435] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0199.435] lstrlenW (lpString=".7z") returned 3 [0199.435] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0199.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.435] lstrlenW (lpString=".dbf") returned 4 [0199.435] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0199.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.435] lstrlenW (lpString=".1cd") returned 4 [0199.435] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0199.435] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeCMapFnt10.lst") returned 81 [0199.435] lstrlenW (lpString=".jpg") returned 4 [0199.435] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0199.436] lstrcmpiW (lpString1=".lst", lpString2=".wiki") returned -1 [0199.436] lstrlenW (lpString="AdobeSysFnt10.lst") returned 17 [0199.436] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.437] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=138459) returned 1 [0199.437] CloseHandle (hObject=0x150) returned 1 [0199.437] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst")) returned 0x2020 [0199.437] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.437] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.437] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.437] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0199.438] GetLastError () returned 0x0 [0199.438] ReadFile (in: hFile=0x150, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x21cdb, lpOverlapped=0x0) returned 1 [0199.442] WriteFile (in: hFile=0x388, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x21ce0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x21ce0, lpOverlapped=0x0) returned 1 [0199.445] ReadFile (in: hFile=0x150, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0199.445] WriteFile (in: hFile=0x388, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xf6, lpOverlapped=0x0) returned 1 [0199.445] SetEndOfFile (hFile=0x388) returned 1 [0199.446] CloseHandle (hObject=0x388) returned 1 [0199.446] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.446] SetEndOfFile (hFile=0x150) returned 1 [0199.447] CloseHandle (hObject=0x150) returned 1 [0199.447] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.448] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\adobesysfnt10.lst")) returned 1 [0199.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.448] lstrlenW (lpString=".doc") returned 4 [0199.448] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0199.448] lstrlenW (lpString=".docx") returned 5 [0199.448] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0199.448] lstrlenW (lpString=".pdf") returned 4 [0199.448] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0199.448] lstrlenW (lpString=".xls") returned 4 [0199.448] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0199.448] lstrlenW (lpString=".xlsx") returned 5 [0199.448] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0199.448] lstrlenW (lpString=".ppt") returned 4 [0199.448] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0199.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.448] lstrlenW (lpString=".zip") returned 4 [0199.448] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0199.448] lstrlenW (lpString=".rar") returned 4 [0199.448] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0199.448] lstrlenW (lpString=".bz2") returned 4 [0199.448] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0199.448] lstrlenW (lpString=".7z") returned 3 [0199.448] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0199.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.448] lstrlenW (lpString=".dbf") returned 4 [0199.448] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0199.448] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.449] lstrlenW (lpString=".1cd") returned 4 [0199.449] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0199.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.449] lstrlenW (lpString=".jpg") returned 4 [0199.449] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0199.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.449] lstrlenW (lpString=".doc") returned 4 [0199.449] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0199.449] lstrlenW (lpString=".docx") returned 5 [0199.449] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0199.449] lstrlenW (lpString=".pdf") returned 4 [0199.449] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0199.449] lstrlenW (lpString=".xls") returned 4 [0199.449] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0199.449] lstrlenW (lpString=".xlsx") returned 5 [0199.449] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0199.449] lstrlenW (lpString=".ppt") returned 4 [0199.449] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0199.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.449] lstrlenW (lpString=".zip") returned 4 [0199.449] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0199.449] lstrlenW (lpString=".rar") returned 4 [0199.449] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0199.449] lstrlenW (lpString=".bz2") returned 4 [0199.449] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0199.449] lstrlenW (lpString=".7z") returned 3 [0199.449] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0199.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.449] lstrlenW (lpString=".dbf") returned 4 [0199.449] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0199.449] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.449] lstrlenW (lpString=".1cd") returned 4 [0199.449] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0199.450] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\AdobeSysFnt10.lst") returned 80 [0199.450] lstrlenW (lpString=".jpg") returned 4 [0199.450] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0199.450] lstrcmpiW (lpString1=".lst", lpString2=".wiki") returned -1 [0199.450] lstrlenW (lpString="AcroFnt10.lst") returned 13 [0199.450] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.451] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=53188) returned 1 [0199.451] CloseHandle (hObject=0x150) returned 1 [0199.451] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst")) returned 0x2020 [0199.451] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.451] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.451] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.451] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0199.452] GetLastError () returned 0x0 [0199.452] ReadFile (in: hFile=0x150, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0xcfc4, lpOverlapped=0x0) returned 1 [0199.454] WriteFile (in: hFile=0x388, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xcfd0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xcfd0, lpOverlapped=0x0) returned 1 [0199.456] ReadFile (in: hFile=0x150, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0199.457] WriteFile (in: hFile=0x388, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xee, lpOverlapped=0x0) returned 1 [0199.457] SetEndOfFile (hFile=0x388) returned 1 [0199.457] CloseHandle (hObject=0x388) returned 1 [0199.457] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.457] SetEndOfFile (hFile=0x150) returned 1 [0199.458] CloseHandle (hObject=0x150) returned 1 [0199.458] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.458] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\cache\\acrofnt10.lst")) returned 1 [0199.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.459] lstrlenW (lpString=".doc") returned 4 [0199.459] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0199.459] lstrlenW (lpString=".docx") returned 5 [0199.459] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0199.459] lstrlenW (lpString=".pdf") returned 4 [0199.459] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0199.459] lstrlenW (lpString=".xls") returned 4 [0199.459] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0199.459] lstrlenW (lpString=".xlsx") returned 5 [0199.459] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0199.459] lstrlenW (lpString=".ppt") returned 4 [0199.459] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0199.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.459] lstrlenW (lpString=".zip") returned 4 [0199.459] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0199.459] lstrlenW (lpString=".rar") returned 4 [0199.459] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0199.459] lstrlenW (lpString=".bz2") returned 4 [0199.459] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0199.459] lstrlenW (lpString=".7z") returned 3 [0199.459] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0199.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.459] lstrlenW (lpString=".dbf") returned 4 [0199.459] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0199.459] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.459] lstrlenW (lpString=".1cd") returned 4 [0199.459] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0199.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.460] lstrlenW (lpString=".jpg") returned 4 [0199.460] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0199.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.460] lstrlenW (lpString=".doc") returned 4 [0199.460] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0199.460] lstrlenW (lpString=".docx") returned 5 [0199.460] lstrcmpiW (lpString1=".docx", lpString2="0.lst") returned -1 [0199.460] lstrlenW (lpString=".pdf") returned 4 [0199.460] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0199.460] lstrlenW (lpString=".xls") returned 4 [0199.460] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0199.460] lstrlenW (lpString=".xlsx") returned 5 [0199.460] lstrcmpiW (lpString1=".xlsx", lpString2="0.lst") returned -1 [0199.460] lstrlenW (lpString=".ppt") returned 4 [0199.460] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0199.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.460] lstrlenW (lpString=".zip") returned 4 [0199.460] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0199.460] lstrlenW (lpString=".rar") returned 4 [0199.460] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0199.460] lstrlenW (lpString=".bz2") returned 4 [0199.460] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0199.460] lstrlenW (lpString=".7z") returned 3 [0199.460] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0199.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.460] lstrlenW (lpString=".dbf") returned 4 [0199.460] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0199.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.460] lstrlenW (lpString=".1cd") returned 4 [0199.460] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0199.460] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\Cache\\AcroFnt10.lst") returned 82 [0199.461] lstrlenW (lpString=".jpg") returned 4 [0199.461] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0199.461] lstrcmpiW (lpString1=".0\\SharedDataEvents", lpString2=".wiki") returned -1 [0199.461] lstrlenW (lpString="SharedDataEvents") returned 16 [0199.461] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.461] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=5120) returned 1 [0199.461] CloseHandle (hObject=0x150) returned 1 [0199.461] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents")) returned 0x2020 [0199.461] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.462] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.462] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.462] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0199.462] GetLastError () returned 0x0 [0199.462] ReadFile (in: hFile=0x150, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x1400, lpOverlapped=0x0) returned 1 [0199.464] WriteFile (in: hFile=0x388, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x1410, lpOverlapped=0x0) returned 1 [0199.465] ReadFile (in: hFile=0x150, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0199.465] WriteFile (in: hFile=0x388, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xf4, lpOverlapped=0x0) returned 1 [0199.465] SetEndOfFile (hFile=0x388) returned 1 [0199.465] CloseHandle (hObject=0x388) returned 1 [0199.465] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.465] SetEndOfFile (hFile=0x150) returned 1 [0199.466] CloseHandle (hObject=0x150) returned 1 [0199.466] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.466] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\acrobat\\10.0\\shareddataevents")) returned 1 [0199.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.467] lstrlenW (lpString=".doc") returned 4 [0199.467] lstrcmpiW (lpString1=".doc", lpString2="ents") returned -1 [0199.467] lstrlenW (lpString=".docx") returned 5 [0199.467] lstrcmpiW (lpString1=".docx", lpString2="vents") returned -1 [0199.467] lstrlenW (lpString=".pdf") returned 4 [0199.467] lstrcmpiW (lpString1=".pdf", lpString2="ents") returned -1 [0199.467] lstrlenW (lpString=".xls") returned 4 [0199.467] lstrcmpiW (lpString1=".xls", lpString2="ents") returned -1 [0199.467] lstrlenW (lpString=".xlsx") returned 5 [0199.467] lstrcmpiW (lpString1=".xlsx", lpString2="vents") returned -1 [0199.467] lstrlenW (lpString=".ppt") returned 4 [0199.467] lstrcmpiW (lpString1=".ppt", lpString2="ents") returned -1 [0199.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.467] lstrlenW (lpString=".zip") returned 4 [0199.467] lstrcmpiW (lpString1=".zip", lpString2="ents") returned -1 [0199.467] lstrlenW (lpString=".rar") returned 4 [0199.467] lstrcmpiW (lpString1=".rar", lpString2="ents") returned -1 [0199.467] lstrlenW (lpString=".bz2") returned 4 [0199.467] lstrcmpiW (lpString1=".bz2", lpString2="ents") returned -1 [0199.467] lstrlenW (lpString=".7z") returned 3 [0199.467] lstrcmpiW (lpString1=".7z", lpString2="nts") returned -1 [0199.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.467] lstrlenW (lpString=".dbf") returned 4 [0199.467] lstrcmpiW (lpString1=".dbf", lpString2="ents") returned -1 [0199.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.467] lstrlenW (lpString=".1cd") returned 4 [0199.467] lstrcmpiW (lpString1=".1cd", lpString2="ents") returned -1 [0199.467] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.467] lstrlenW (lpString=".jpg") returned 4 [0199.467] lstrcmpiW (lpString1=".jpg", lpString2="ents") returned -1 [0199.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.468] lstrlenW (lpString=".doc") returned 4 [0199.468] lstrcmpiW (lpString1=".doc", lpString2="ents") returned -1 [0199.468] lstrlenW (lpString=".docx") returned 5 [0199.468] lstrcmpiW (lpString1=".docx", lpString2="vents") returned -1 [0199.468] lstrlenW (lpString=".pdf") returned 4 [0199.468] lstrcmpiW (lpString1=".pdf", lpString2="ents") returned -1 [0199.468] lstrlenW (lpString=".xls") returned 4 [0199.468] lstrcmpiW (lpString1=".xls", lpString2="ents") returned -1 [0199.468] lstrlenW (lpString=".xlsx") returned 5 [0199.468] lstrcmpiW (lpString1=".xlsx", lpString2="vents") returned -1 [0199.468] lstrlenW (lpString=".ppt") returned 4 [0199.468] lstrcmpiW (lpString1=".ppt", lpString2="ents") returned -1 [0199.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.468] lstrlenW (lpString=".zip") returned 4 [0199.468] lstrcmpiW (lpString1=".zip", lpString2="ents") returned -1 [0199.468] lstrlenW (lpString=".rar") returned 4 [0199.468] lstrcmpiW (lpString1=".rar", lpString2="ents") returned -1 [0199.468] lstrlenW (lpString=".bz2") returned 4 [0199.468] lstrcmpiW (lpString1=".bz2", lpString2="ents") returned -1 [0199.468] lstrlenW (lpString=".7z") returned 3 [0199.468] lstrcmpiW (lpString1=".7z", lpString2="nts") returned -1 [0199.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.468] lstrlenW (lpString=".dbf") returned 4 [0199.468] lstrcmpiW (lpString1=".dbf", lpString2="ents") returned -1 [0199.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.468] lstrlenW (lpString=".1cd") returned 4 [0199.468] lstrcmpiW (lpString1=".1cd", lpString2="ents") returned -1 [0199.468] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Acrobat\\10.0\\SharedDataEvents") returned 79 [0199.468] lstrlenW (lpString=".jpg") returned 4 [0199.468] lstrcmpiW (lpString1=".jpg", lpString2="ents") returned -1 [0199.469] lstrcmpiW (lpString1=".lst", lpString2=".wiki") returned -1 [0199.469] lstrlenW (lpString="ACECache11.lst") returned 14 [0199.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.469] GetFileSizeEx (in: hFile=0x150, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1180) returned 1 [0199.469] CloseHandle (hObject=0x150) returned 1 [0199.469] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst")) returned 0x2020 [0199.469] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.469] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x150 [0199.469] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.469] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x388 [0199.470] GetLastError () returned 0x0 [0199.470] ReadFile (in: hFile=0x150, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x49c, lpOverlapped=0x0) returned 1 [0199.531] WriteFile (in: hFile=0x388, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x4a0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x4a0, lpOverlapped=0x0) returned 1 [0199.532] ReadFile (in: hFile=0x150, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0199.532] WriteFile (in: hFile=0x388, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xf0, lpOverlapped=0x0) returned 1 [0199.532] SetEndOfFile (hFile=0x388) returned 1 [0199.533] CloseHandle (hObject=0x388) returned 1 [0199.533] SetFilePointerEx (in: hFile=0x150, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.533] SetEndOfFile (hFile=0x150) returned 1 [0199.533] CloseHandle (hObject=0x150) returned 1 [0199.533] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.534] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\adobe\\color\\acecache11.lst")) returned 1 [0199.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.534] lstrlenW (lpString=".doc") returned 4 [0199.534] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0199.534] lstrlenW (lpString=".docx") returned 5 [0199.534] lstrcmpiW (lpString1=".docx", lpString2="1.lst") returned -1 [0199.534] lstrlenW (lpString=".pdf") returned 4 [0199.534] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0199.534] lstrlenW (lpString=".xls") returned 4 [0199.534] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0199.534] lstrlenW (lpString=".xlsx") returned 5 [0199.534] lstrcmpiW (lpString1=".xlsx", lpString2="1.lst") returned -1 [0199.534] lstrlenW (lpString=".ppt") returned 4 [0199.534] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0199.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.534] lstrlenW (lpString=".zip") returned 4 [0199.534] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0199.534] lstrlenW (lpString=".rar") returned 4 [0199.534] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0199.534] lstrlenW (lpString=".bz2") returned 4 [0199.534] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0199.534] lstrlenW (lpString=".7z") returned 3 [0199.534] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0199.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.534] lstrlenW (lpString=".dbf") returned 4 [0199.535] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0199.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.535] lstrlenW (lpString=".1cd") returned 4 [0199.535] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0199.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.535] lstrlenW (lpString=".jpg") returned 4 [0199.535] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0199.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.535] lstrlenW (lpString=".doc") returned 4 [0199.535] lstrcmpiW (lpString1=".doc", lpString2=".lst") returned -1 [0199.535] lstrlenW (lpString=".docx") returned 5 [0199.535] lstrcmpiW (lpString1=".docx", lpString2="1.lst") returned -1 [0199.535] lstrlenW (lpString=".pdf") returned 4 [0199.535] lstrcmpiW (lpString1=".pdf", lpString2=".lst") returned 1 [0199.535] lstrlenW (lpString=".xls") returned 4 [0199.535] lstrcmpiW (lpString1=".xls", lpString2=".lst") returned 1 [0199.535] lstrlenW (lpString=".xlsx") returned 5 [0199.535] lstrcmpiW (lpString1=".xlsx", lpString2="1.lst") returned -1 [0199.535] lstrlenW (lpString=".ppt") returned 4 [0199.535] lstrcmpiW (lpString1=".ppt", lpString2=".lst") returned 1 [0199.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.535] lstrlenW (lpString=".zip") returned 4 [0199.535] lstrcmpiW (lpString1=".zip", lpString2=".lst") returned 1 [0199.535] lstrlenW (lpString=".rar") returned 4 [0199.535] lstrcmpiW (lpString1=".rar", lpString2=".lst") returned 1 [0199.535] lstrlenW (lpString=".bz2") returned 4 [0199.535] lstrcmpiW (lpString1=".bz2", lpString2=".lst") returned -1 [0199.535] lstrlenW (lpString=".7z") returned 3 [0199.535] lstrcmpiW (lpString1=".7z", lpString2="lst") returned -1 [0199.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.535] lstrlenW (lpString=".dbf") returned 4 [0199.535] lstrcmpiW (lpString1=".dbf", lpString2=".lst") returned -1 [0199.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.536] lstrlenW (lpString=".1cd") returned 4 [0199.536] lstrcmpiW (lpString1=".1cd", lpString2=".lst") returned -1 [0199.536] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Adobe\\Color\\ACECache11.lst") returned 70 [0199.536] lstrlenW (lpString=".jpg") returned 4 [0199.536] lstrcmpiW (lpString1=".jpg", lpString2=".lst") returned -1 [0199.723] lstrcmpiW (lpString1=".cdf-ms", lpString2=".wiki") returned -1 [0199.723] lstrlenW (lpString="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 66 [0199.723] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.725] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=0) returned 1 [0199.725] CloseHandle (hObject=0x15c) returned 1 [0199.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.725] lstrlenW (lpString=".doc") returned 4 [0199.725] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0199.725] lstrlenW (lpString=".docx") returned 5 [0199.725] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0199.725] lstrlenW (lpString=".pdf") returned 4 [0199.725] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0199.725] lstrlenW (lpString=".xls") returned 4 [0199.725] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0199.725] lstrlenW (lpString=".xlsx") returned 5 [0199.725] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0199.725] lstrlenW (lpString=".ppt") returned 4 [0199.725] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0199.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.725] lstrlenW (lpString=".zip") returned 4 [0199.725] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0199.725] lstrlenW (lpString=".rar") returned 4 [0199.725] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0199.725] lstrlenW (lpString=".bz2") returned 4 [0199.725] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0199.725] lstrlenW (lpString=".7z") returned 3 [0199.725] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.725] lstrlenW (lpString=".dbf") returned 4 [0199.725] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0199.725] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.726] lstrlenW (lpString=".1cd") returned 4 [0199.726] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0199.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.726] lstrlenW (lpString=".jpg") returned 4 [0199.726] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0199.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.726] lstrlenW (lpString=".doc") returned 4 [0199.726] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0199.726] lstrlenW (lpString=".docx") returned 5 [0199.726] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0199.726] lstrlenW (lpString=".pdf") returned 4 [0199.726] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0199.726] lstrlenW (lpString=".xls") returned 4 [0199.726] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0199.726] lstrlenW (lpString=".xlsx") returned 5 [0199.726] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0199.726] lstrlenW (lpString=".ppt") returned 4 [0199.726] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0199.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.726] lstrlenW (lpString=".zip") returned 4 [0199.726] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0199.726] lstrlenW (lpString=".rar") returned 4 [0199.726] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0199.726] lstrlenW (lpString=".bz2") returned 4 [0199.726] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0199.726] lstrlenW (lpString=".7z") returned 3 [0199.726] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.726] lstrlenW (lpString=".dbf") returned 4 [0199.726] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0199.726] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.726] lstrlenW (lpString=".1cd") returned 4 [0199.727] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0199.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.cdf-ms") returned 155 [0199.727] lstrlenW (lpString=".jpg") returned 4 [0199.727] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0199.727] lstrcmpiW (lpString1=".manifest", lpString2=".wiki") returned -1 [0199.727] lstrlenW (lpString="clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 68 [0199.727] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x15c [0199.727] GetFileSizeEx (in: hFile=0x15c, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=0) returned 1 [0199.727] CloseHandle (hObject=0x15c) returned 1 [0199.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.727] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.727] lstrlenW (lpString=".doc") returned 4 [0199.727] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0199.727] lstrlenW (lpString=".docx") returned 5 [0199.728] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0199.728] lstrlenW (lpString=".pdf") returned 4 [0199.728] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0199.728] lstrlenW (lpString=".xls") returned 4 [0199.728] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0199.728] lstrlenW (lpString=".xlsx") returned 5 [0199.728] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0199.728] lstrlenW (lpString=".ppt") returned 4 [0199.728] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0199.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.728] lstrlenW (lpString=".zip") returned 4 [0199.728] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0199.728] lstrlenW (lpString=".rar") returned 4 [0199.728] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0199.728] lstrlenW (lpString=".bz2") returned 4 [0199.728] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0199.728] lstrlenW (lpString=".7z") returned 3 [0199.728] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0199.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.728] lstrlenW (lpString=".dbf") returned 4 [0199.728] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0199.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.728] lstrlenW (lpString=".1cd") returned 4 [0199.728] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0199.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.728] lstrlenW (lpString=".jpg") returned 4 [0199.728] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0199.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.728] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.728] lstrlenW (lpString=".doc") returned 4 [0199.728] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0199.728] lstrlenW (lpString=".docx") returned 5 [0199.729] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0199.729] lstrlenW (lpString=".pdf") returned 4 [0199.729] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0199.729] lstrlenW (lpString=".xls") returned 4 [0199.729] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0199.729] lstrlenW (lpString=".xlsx") returned 5 [0199.729] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0199.729] lstrlenW (lpString=".ppt") returned 4 [0199.729] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0199.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.729] lstrlenW (lpString=".zip") returned 4 [0199.729] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0199.729] lstrlenW (lpString=".rar") returned 4 [0199.729] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0199.729] lstrlenW (lpString=".bz2") returned 4 [0199.729] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0199.729] lstrlenW (lpString=".7z") returned 3 [0199.729] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0199.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.729] lstrlenW (lpString=".dbf") returned 4 [0199.729] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0199.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.729] lstrlenW (lpString=".1cd") returned 4 [0199.729] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0199.729] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\clic...exe_baa8013a79450f71_0001.0003_none_855491bb37a51715.manifest") returned 157 [0199.729] lstrlenW (lpString=".jpg") returned 4 [0199.729] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0199.729] lstrcmpiW (lpString1=".cdf-ms", lpString2=".wiki") returned -1 [0199.729] lstrlenW (lpString="goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 66 [0199.730] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0199.802] GetFileSizeEx (in: hFile=0x370, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=14512) returned 1 [0199.802] CloseHandle (hObject=0x370) returned 1 [0199.802] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms")) returned 0x2020 [0199.802] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.802] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0199.803] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.803] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.803] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0199.803] GetLastError () returned 0x0 [0199.803] ReadFile (in: hFile=0x370, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x38b0, lpOverlapped=0x0) returned 1 [0199.805] WriteFile (in: hFile=0x2d4, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x38c0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x38c0, lpOverlapped=0x0) returned 1 [0199.806] ReadFile (in: hFile=0x370, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0199.806] WriteFile (in: hFile=0x2d4, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x158, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x158, lpOverlapped=0x0) returned 1 [0199.806] SetEndOfFile (hFile=0x2d4) returned 1 [0199.806] CloseHandle (hObject=0x2d4) returned 1 [0199.806] SetFilePointerEx (in: hFile=0x370, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.806] SetEndOfFile (hFile=0x370) returned 1 [0199.807] CloseHandle (hObject=0x370) returned 1 [0199.807] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0199.807] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\apps\\2.0\\dqq19bcj.jax\\yvorlgor.pnt\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms")) returned 1 [0199.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.808] lstrlenW (lpString=".doc") returned 4 [0199.808] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0199.808] lstrlenW (lpString=".docx") returned 5 [0199.808] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0199.808] lstrlenW (lpString=".pdf") returned 4 [0199.808] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0199.808] lstrlenW (lpString=".xls") returned 4 [0199.808] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0199.808] lstrlenW (lpString=".xlsx") returned 5 [0199.808] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0199.808] lstrlenW (lpString=".ppt") returned 4 [0199.808] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0199.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.808] lstrlenW (lpString=".zip") returned 4 [0199.808] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0199.808] lstrlenW (lpString=".rar") returned 4 [0199.808] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0199.808] lstrlenW (lpString=".bz2") returned 4 [0199.808] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0199.808] lstrlenW (lpString=".7z") returned 3 [0199.808] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.808] lstrlenW (lpString=".dbf") returned 4 [0199.808] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0199.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.808] lstrlenW (lpString=".1cd") returned 4 [0199.808] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0199.808] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.808] lstrlenW (lpString=".jpg") returned 4 [0199.808] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0199.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.809] lstrlenW (lpString=".doc") returned 4 [0199.809] lstrcmpiW (lpString1=".doc", lpString2="f-ms") returned -1 [0199.809] lstrlenW (lpString=".docx") returned 5 [0199.809] lstrcmpiW (lpString1=".docx", lpString2="df-ms") returned -1 [0199.809] lstrlenW (lpString=".pdf") returned 4 [0199.809] lstrcmpiW (lpString1=".pdf", lpString2="f-ms") returned -1 [0199.809] lstrlenW (lpString=".xls") returned 4 [0199.809] lstrcmpiW (lpString1=".xls", lpString2="f-ms") returned -1 [0199.809] lstrlenW (lpString=".xlsx") returned 5 [0199.809] lstrcmpiW (lpString1=".xlsx", lpString2="df-ms") returned -1 [0199.809] lstrlenW (lpString=".ppt") returned 4 [0199.809] lstrcmpiW (lpString1=".ppt", lpString2="f-ms") returned -1 [0199.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.809] lstrlenW (lpString=".zip") returned 4 [0199.809] lstrcmpiW (lpString1=".zip", lpString2="f-ms") returned -1 [0199.809] lstrlenW (lpString=".rar") returned 4 [0199.809] lstrcmpiW (lpString1=".rar", lpString2="f-ms") returned -1 [0199.809] lstrlenW (lpString=".bz2") returned 4 [0199.809] lstrcmpiW (lpString1=".bz2", lpString2="f-ms") returned -1 [0199.809] lstrlenW (lpString=".7z") returned 3 [0199.809] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0199.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.809] lstrlenW (lpString=".dbf") returned 4 [0199.809] lstrcmpiW (lpString1=".dbf", lpString2="f-ms") returned -1 [0199.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.809] lstrlenW (lpString=".1cd") returned 4 [0199.809] lstrcmpiW (lpString1=".1cd", lpString2="f-ms") returned -1 [0199.809] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Apps\\2.0\\DQQ19BCJ.JAX\\YVORLGOR.PNT\\manifests\\goog...app_baa8013a79450f71_0001.0003_none_677c9e37069a7e2a.cdf-ms") returned 155 [0199.809] lstrlenW (lpString=".jpg") returned 4 [0199.809] lstrcmpiW (lpString1=".jpg", lpString2="f-ms") returned -1 [0199.810] lstrlenW (lpString="data_3") returned 6 [0199.810] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0199.848] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=4202496) returned 1 [0199.848] CloseHandle (hObject=0x344) returned 1 [0199.848] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3")) returned 0x2020 [0199.848] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0199.848] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0199.849] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\google\\chrome\\user data\\default\\cache\\data_3.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0199.849] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc6c | out: lpNewFilePointer=0x0) returned 1 [0199.849] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc2c | out: lpNewFilePointer=0x0) returned 1 [0199.849] ReadFile (in: hFile=0x344, lpBuffer=0x4410058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3bafc38, lpOverlapped=0x0 | out: lpBuffer=0x4410058*, lpNumberOfBytesRead=0x3bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0199.856] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x156000, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc2c | out: lpNewFilePointer=0x0) returned 1 [0199.857] ReadFile (in: hFile=0x344, lpBuffer=0x4450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3bafc38, lpOverlapped=0x0 | out: lpBuffer=0x4450058*, lpNumberOfBytesRead=0x3bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0199.860] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3bafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0199.860] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x3c2000, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc2c | out: lpNewFilePointer=0x0) returned 1 [0199.860] ReadFile (in: hFile=0x344, lpBuffer=0x4490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3bafc38, lpOverlapped=0x0 | out: lpBuffer=0x4490058*, lpNumberOfBytesRead=0x3bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0199.977] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0199.977] WriteFile (in: hFile=0x344, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xc00f8, lpNumberOfBytesWritten=0x3bafcb0, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafcb0*=0xc00f8, lpOverlapped=0x0) returned 1 [0201.889] SetEndOfFile (hFile=0x344) returned 1 [0201.889] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40000) returned 0x4130060 [0201.889] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc7c | out: lpNewFilePointer=0x0) returned 1 [0201.889] WriteFile (in: hFile=0x344, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3bafc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x3bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0201.890] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x156000, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc7c | out: lpNewFilePointer=0x0) returned 1 [0201.890] WriteFile (in: hFile=0x344, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3bafc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x3bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0201.892] SetFilePointerEx (in: hFile=0x344, liDistanceToMove=0x3c2000, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc7c | out: lpNewFilePointer=0x0) returned 1 [0201.892] WriteFile (in: hFile=0x344, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3bafc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x3bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0201.894] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x4130060 | out: hHeap=0x270000) returned 1 [0201.894] CloseHandle (hObject=0x344) returned 1 [0201.894] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0201.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.894] lstrlenW (lpString=".doc") returned 4 [0201.894] lstrcmpiW (lpString1=".doc", lpString2="ta_3") returned -1 [0201.894] lstrlenW (lpString=".docx") returned 5 [0201.894] lstrcmpiW (lpString1=".docx", lpString2="ata_3") returned -1 [0201.894] lstrlenW (lpString=".pdf") returned 4 [0201.894] lstrcmpiW (lpString1=".pdf", lpString2="ta_3") returned -1 [0201.894] lstrlenW (lpString=".xls") returned 4 [0201.894] lstrcmpiW (lpString1=".xls", lpString2="ta_3") returned -1 [0201.894] lstrlenW (lpString=".xlsx") returned 5 [0201.894] lstrcmpiW (lpString1=".xlsx", lpString2="ata_3") returned -1 [0201.894] lstrlenW (lpString=".ppt") returned 4 [0201.894] lstrcmpiW (lpString1=".ppt", lpString2="ta_3") returned -1 [0201.894] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.894] lstrlenW (lpString=".zip") returned 4 [0201.894] lstrcmpiW (lpString1=".zip", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString=".rar") returned 4 [0201.895] lstrcmpiW (lpString1=".rar", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString=".bz2") returned 4 [0201.895] lstrcmpiW (lpString1=".bz2", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString=".7z") returned 3 [0201.895] lstrcmpiW (lpString1=".7z", lpString2="a_3") returned -1 [0201.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.895] lstrlenW (lpString=".dbf") returned 4 [0201.895] lstrcmpiW (lpString1=".dbf", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.895] lstrlenW (lpString=".1cd") returned 4 [0201.895] lstrcmpiW (lpString1=".1cd", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.895] lstrlenW (lpString=".jpg") returned 4 [0201.895] lstrcmpiW (lpString1=".jpg", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.895] lstrlenW (lpString=".doc") returned 4 [0201.895] lstrcmpiW (lpString1=".doc", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString=".docx") returned 5 [0201.895] lstrcmpiW (lpString1=".docx", lpString2="ata_3") returned -1 [0201.895] lstrlenW (lpString=".pdf") returned 4 [0201.895] lstrcmpiW (lpString1=".pdf", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString=".xls") returned 4 [0201.895] lstrcmpiW (lpString1=".xls", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString=".xlsx") returned 5 [0201.895] lstrcmpiW (lpString1=".xlsx", lpString2="ata_3") returned -1 [0201.895] lstrlenW (lpString=".ppt") returned 4 [0201.895] lstrcmpiW (lpString1=".ppt", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.895] lstrlenW (lpString=".zip") returned 4 [0201.895] lstrcmpiW (lpString1=".zip", lpString2="ta_3") returned -1 [0201.895] lstrlenW (lpString=".rar") returned 4 [0201.896] lstrcmpiW (lpString1=".rar", lpString2="ta_3") returned -1 [0201.896] lstrlenW (lpString=".bz2") returned 4 [0201.896] lstrcmpiW (lpString1=".bz2", lpString2="ta_3") returned -1 [0201.896] lstrlenW (lpString=".7z") returned 3 [0201.896] lstrcmpiW (lpString1=".7z", lpString2="a_3") returned -1 [0201.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.896] lstrlenW (lpString=".dbf") returned 4 [0201.896] lstrcmpiW (lpString1=".dbf", lpString2="ta_3") returned -1 [0201.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.896] lstrlenW (lpString=".1cd") returned 4 [0201.896] lstrcmpiW (lpString1=".1cd", lpString2="ta_3") returned -1 [0201.896] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cache\\data_3") returned 88 [0201.896] lstrlenW (lpString=".jpg") returned 4 [0201.896] lstrcmpiW (lpString1=".jpg", lpString2="ta_3") returned -1 [0201.896] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0201.896] lstrlenW (lpString="11_All_Pictures.wpl") returned 19 [0201.896] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0201.996] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=585) returned 1 [0201.996] CloseHandle (hObject=0x350) returned 1 [0202.006] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl")) returned 0x2020 [0202.014] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.014] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.021] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.022] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0202.022] GetLastError () returned 0x0 [0202.022] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x249, lpOverlapped=0x0) returned 1 [0202.023] WriteFile (in: hFile=0x2d8, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x250, lpOverlapped=0x0) returned 1 [0202.024] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0202.024] WriteFile (in: hFile=0x2d8, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xfa, lpOverlapped=0x0) returned 1 [0202.024] SetEndOfFile (hFile=0x2d8) returned 1 [0202.024] CloseHandle (hObject=0x2d8) returned 1 [0202.024] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.024] SetEndOfFile (hFile=0x350) returned 1 [0202.025] CloseHandle (hObject=0x350) returned 1 [0202.025] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.025] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\0000e713\\11_all_pictures.wpl")) returned 1 [0202.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.026] lstrlenW (lpString=".doc") returned 4 [0202.026] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.026] lstrlenW (lpString=".docx") returned 5 [0202.026] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.026] lstrlenW (lpString=".pdf") returned 4 [0202.026] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.026] lstrlenW (lpString=".xls") returned 4 [0202.026] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.026] lstrlenW (lpString=".xlsx") returned 5 [0202.026] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.026] lstrlenW (lpString=".ppt") returned 4 [0202.026] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.026] lstrlenW (lpString=".zip") returned 4 [0202.026] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.026] lstrlenW (lpString=".rar") returned 4 [0202.026] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.026] lstrlenW (lpString=".bz2") returned 4 [0202.026] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.026] lstrlenW (lpString=".7z") returned 3 [0202.026] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.026] lstrlenW (lpString=".dbf") returned 4 [0202.026] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.026] lstrlenW (lpString=".1cd") returned 4 [0202.026] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.026] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.026] lstrlenW (lpString=".jpg") returned 4 [0202.026] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.027] lstrlenW (lpString=".doc") returned 4 [0202.027] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.027] lstrlenW (lpString=".docx") returned 5 [0202.027] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.027] lstrlenW (lpString=".pdf") returned 4 [0202.027] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.027] lstrlenW (lpString=".xls") returned 4 [0202.027] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.027] lstrlenW (lpString=".xlsx") returned 5 [0202.027] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.027] lstrlenW (lpString=".ppt") returned 4 [0202.027] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.027] lstrlenW (lpString=".zip") returned 4 [0202.027] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.027] lstrlenW (lpString=".rar") returned 4 [0202.027] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.027] lstrlenW (lpString=".bz2") returned 4 [0202.027] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.027] lstrlenW (lpString=".7z") returned 3 [0202.027] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.027] lstrlenW (lpString=".dbf") returned 4 [0202.027] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.027] lstrlenW (lpString=".1cd") returned 4 [0202.027] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.027] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\0000E713\\11_All_Pictures.wpl") returned 116 [0202.027] lstrlenW (lpString=".jpg") returned 4 [0202.027] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.028] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.028] lstrlenW (lpString="04_Music_played_in_the_last_month.wpl") returned 37 [0202.028] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.651] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1284) returned 1 [0202.651] CloseHandle (hObject=0x350) returned 1 [0202.652] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl")) returned 0x2020 [0202.652] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.652] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.652] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.652] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.653] GetLastError () returned 0x0 [0202.653] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x504, lpOverlapped=0x0) returned 1 [0202.656] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x510, lpOverlapped=0x0) returned 1 [0202.657] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0202.657] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x11e, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x11e, lpOverlapped=0x0) returned 1 [0202.657] SetEndOfFile (hFile=0x358) returned 1 [0202.657] CloseHandle (hObject=0x358) returned 1 [0202.657] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.657] SetEndOfFile (hFile=0x350) returned 1 [0202.658] CloseHandle (hObject=0x350) returned 1 [0202.658] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.658] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\04_music_played_in_the_last_month.wpl")) returned 1 [0202.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.658] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.658] lstrlenW (lpString=".doc") returned 4 [0202.658] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.659] lstrlenW (lpString=".docx") returned 5 [0202.659] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0202.659] lstrlenW (lpString=".pdf") returned 4 [0202.659] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.659] lstrlenW (lpString=".xls") returned 4 [0202.659] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.659] lstrlenW (lpString=".xlsx") returned 5 [0202.659] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0202.659] lstrlenW (lpString=".ppt") returned 4 [0202.659] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.659] lstrlenW (lpString=".zip") returned 4 [0202.659] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.659] lstrlenW (lpString=".rar") returned 4 [0202.659] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.659] lstrlenW (lpString=".bz2") returned 4 [0202.659] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.659] lstrlenW (lpString=".7z") returned 3 [0202.659] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.659] lstrlenW (lpString=".dbf") returned 4 [0202.659] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.659] lstrlenW (lpString=".1cd") returned 4 [0202.659] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.659] lstrlenW (lpString=".jpg") returned 4 [0202.659] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.659] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.659] lstrlenW (lpString=".doc") returned 4 [0202.659] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.659] lstrlenW (lpString=".docx") returned 5 [0202.660] lstrcmpiW (lpString1=".docx", lpString2="h.wpl") returned -1 [0202.660] lstrlenW (lpString=".pdf") returned 4 [0202.660] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.660] lstrlenW (lpString=".xls") returned 4 [0202.660] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.660] lstrlenW (lpString=".xlsx") returned 5 [0202.660] lstrcmpiW (lpString1=".xlsx", lpString2="h.wpl") returned -1 [0202.660] lstrlenW (lpString=".ppt") returned 4 [0202.660] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.660] lstrlenW (lpString=".zip") returned 4 [0202.660] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.660] lstrlenW (lpString=".rar") returned 4 [0202.660] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.660] lstrlenW (lpString=".bz2") returned 4 [0202.660] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.660] lstrlenW (lpString=".7z") returned 3 [0202.660] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.660] lstrlenW (lpString=".dbf") returned 4 [0202.660] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.660] lstrlenW (lpString=".1cd") returned 4 [0202.660] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.660] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\04_Music_played_in_the_last_month.wpl") returned 134 [0202.660] lstrlenW (lpString=".jpg") returned 4 [0202.660] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.660] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.660] lstrlenW (lpString="08_Video_rated_at_4_or_5_stars.wpl") returned 34 [0202.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.661] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1020) returned 1 [0202.661] CloseHandle (hObject=0x350) returned 1 [0202.661] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl")) returned 0x2020 [0202.661] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.661] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.661] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.661] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.662] GetLastError () returned 0x0 [0202.662] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x3fc, lpOverlapped=0x0) returned 1 [0202.663] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x400, lpOverlapped=0x0) returned 1 [0202.664] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0202.664] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x118, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x118, lpOverlapped=0x0) returned 1 [0202.664] SetEndOfFile (hFile=0x358) returned 1 [0202.664] CloseHandle (hObject=0x358) returned 1 [0202.664] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.665] SetEndOfFile (hFile=0x350) returned 1 [0202.665] CloseHandle (hObject=0x350) returned 1 [0202.665] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.666] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\08_video_rated_at_4_or_5_stars.wpl")) returned 1 [0202.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.666] lstrlenW (lpString=".doc") returned 4 [0202.666] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.666] lstrlenW (lpString=".docx") returned 5 [0202.666] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.666] lstrlenW (lpString=".pdf") returned 4 [0202.666] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.666] lstrlenW (lpString=".xls") returned 4 [0202.666] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.666] lstrlenW (lpString=".xlsx") returned 5 [0202.666] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.666] lstrlenW (lpString=".ppt") returned 4 [0202.666] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.666] lstrlenW (lpString=".zip") returned 4 [0202.666] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.666] lstrlenW (lpString=".rar") returned 4 [0202.666] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.666] lstrlenW (lpString=".bz2") returned 4 [0202.666] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.666] lstrlenW (lpString=".7z") returned 3 [0202.666] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.666] lstrlenW (lpString=".dbf") returned 4 [0202.666] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.666] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.666] lstrlenW (lpString=".1cd") returned 4 [0202.667] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.667] lstrlenW (lpString=".jpg") returned 4 [0202.667] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.667] lstrlenW (lpString=".doc") returned 4 [0202.667] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.667] lstrlenW (lpString=".docx") returned 5 [0202.667] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.667] lstrlenW (lpString=".pdf") returned 4 [0202.667] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.667] lstrlenW (lpString=".xls") returned 4 [0202.667] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.667] lstrlenW (lpString=".xlsx") returned 5 [0202.667] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.667] lstrlenW (lpString=".ppt") returned 4 [0202.667] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.667] lstrlenW (lpString=".zip") returned 4 [0202.667] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.667] lstrlenW (lpString=".rar") returned 4 [0202.667] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.667] lstrlenW (lpString=".bz2") returned 4 [0202.667] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.667] lstrlenW (lpString=".7z") returned 3 [0202.667] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.667] lstrlenW (lpString=".dbf") returned 4 [0202.667] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.667] lstrlenW (lpString=".1cd") returned 4 [0202.667] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.667] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\08_Video_rated_at_4_or_5_stars.wpl") returned 131 [0202.668] lstrlenW (lpString=".jpg") returned 4 [0202.668] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.668] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.668] lstrlenW (lpString="09_Music_played_the_most.wpl") returned 28 [0202.668] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.669] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1025) returned 1 [0202.669] CloseHandle (hObject=0x350) returned 1 [0202.669] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl")) returned 0x2020 [0202.669] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.669] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.669] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.669] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.670] GetLastError () returned 0x0 [0202.670] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x401, lpOverlapped=0x0) returned 1 [0202.671] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x410, lpOverlapped=0x0) returned 1 [0202.672] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0202.672] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x10c, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x10c, lpOverlapped=0x0) returned 1 [0202.672] SetEndOfFile (hFile=0x358) returned 1 [0202.673] CloseHandle (hObject=0x358) returned 1 [0202.673] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.673] SetEndOfFile (hFile=0x350) returned 1 [0202.673] CloseHandle (hObject=0x350) returned 1 [0202.673] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.674] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\09_music_played_the_most.wpl")) returned 1 [0202.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.674] lstrlenW (lpString=".doc") returned 4 [0202.674] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.674] lstrlenW (lpString=".docx") returned 5 [0202.674] lstrcmpiW (lpString1=".docx", lpString2="t.wpl") returned -1 [0202.674] lstrlenW (lpString=".pdf") returned 4 [0202.674] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.674] lstrlenW (lpString=".xls") returned 4 [0202.674] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.674] lstrlenW (lpString=".xlsx") returned 5 [0202.674] lstrcmpiW (lpString1=".xlsx", lpString2="t.wpl") returned -1 [0202.674] lstrlenW (lpString=".ppt") returned 4 [0202.674] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.674] lstrlenW (lpString=".zip") returned 4 [0202.674] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.674] lstrlenW (lpString=".rar") returned 4 [0202.674] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.674] lstrlenW (lpString=".bz2") returned 4 [0202.674] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.674] lstrlenW (lpString=".7z") returned 3 [0202.674] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.674] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.675] lstrlenW (lpString=".dbf") returned 4 [0202.675] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.675] lstrlenW (lpString=".1cd") returned 4 [0202.675] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.675] lstrlenW (lpString=".jpg") returned 4 [0202.675] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.675] lstrlenW (lpString=".doc") returned 4 [0202.675] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.675] lstrlenW (lpString=".docx") returned 5 [0202.675] lstrcmpiW (lpString1=".docx", lpString2="t.wpl") returned -1 [0202.675] lstrlenW (lpString=".pdf") returned 4 [0202.675] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.675] lstrlenW (lpString=".xls") returned 4 [0202.675] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.675] lstrlenW (lpString=".xlsx") returned 5 [0202.675] lstrcmpiW (lpString1=".xlsx", lpString2="t.wpl") returned -1 [0202.675] lstrlenW (lpString=".ppt") returned 4 [0202.675] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.675] lstrlenW (lpString=".zip") returned 4 [0202.675] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.675] lstrlenW (lpString=".rar") returned 4 [0202.675] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.675] lstrlenW (lpString=".bz2") returned 4 [0202.675] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.675] lstrlenW (lpString=".7z") returned 3 [0202.675] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.675] lstrlenW (lpString=".dbf") returned 4 [0202.675] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.675] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.676] lstrlenW (lpString=".1cd") returned 4 [0202.676] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.676] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\09_Music_played_the_most.wpl") returned 125 [0202.676] lstrlenW (lpString=".jpg") returned 4 [0202.676] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.676] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.676] lstrlenW (lpString="10_All_Music.wpl") returned 16 [0202.676] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.677] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1063) returned 1 [0202.677] CloseHandle (hObject=0x350) returned 1 [0202.677] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl")) returned 0x2020 [0202.677] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.677] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.677] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.677] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.678] GetLastError () returned 0x0 [0202.678] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x427, lpOverlapped=0x0) returned 1 [0202.682] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x430, lpOverlapped=0x0) returned 1 [0202.682] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0202.682] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xf4, lpOverlapped=0x0) returned 1 [0202.683] SetEndOfFile (hFile=0x358) returned 1 [0202.683] CloseHandle (hObject=0x358) returned 1 [0202.683] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.683] SetEndOfFile (hFile=0x350) returned 1 [0202.684] CloseHandle (hObject=0x350) returned 1 [0202.684] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.684] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\10_all_music.wpl")) returned 1 [0202.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.684] lstrlenW (lpString=".doc") returned 4 [0202.684] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.684] lstrlenW (lpString=".docx") returned 5 [0202.684] lstrcmpiW (lpString1=".docx", lpString2="c.wpl") returned -1 [0202.684] lstrlenW (lpString=".pdf") returned 4 [0202.684] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.684] lstrlenW (lpString=".xls") returned 4 [0202.684] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.684] lstrlenW (lpString=".xlsx") returned 5 [0202.684] lstrcmpiW (lpString1=".xlsx", lpString2="c.wpl") returned -1 [0202.684] lstrlenW (lpString=".ppt") returned 4 [0202.684] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.684] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.684] lstrlenW (lpString=".zip") returned 4 [0202.684] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.684] lstrlenW (lpString=".rar") returned 4 [0202.684] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.684] lstrlenW (lpString=".bz2") returned 4 [0202.684] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.685] lstrlenW (lpString=".7z") returned 3 [0202.685] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.685] lstrlenW (lpString=".dbf") returned 4 [0202.685] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.685] lstrlenW (lpString=".1cd") returned 4 [0202.685] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.685] lstrlenW (lpString=".jpg") returned 4 [0202.685] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.685] lstrlenW (lpString=".doc") returned 4 [0202.685] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.685] lstrlenW (lpString=".docx") returned 5 [0202.685] lstrcmpiW (lpString1=".docx", lpString2="c.wpl") returned -1 [0202.685] lstrlenW (lpString=".pdf") returned 4 [0202.685] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.685] lstrlenW (lpString=".xls") returned 4 [0202.685] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.685] lstrlenW (lpString=".xlsx") returned 5 [0202.685] lstrcmpiW (lpString1=".xlsx", lpString2="c.wpl") returned -1 [0202.685] lstrlenW (lpString=".ppt") returned 4 [0202.685] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.685] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.685] lstrlenW (lpString=".zip") returned 4 [0202.685] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.685] lstrlenW (lpString=".rar") returned 4 [0202.685] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.685] lstrlenW (lpString=".bz2") returned 4 [0202.685] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.685] lstrlenW (lpString=".7z") returned 3 [0202.685] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.686] lstrlenW (lpString=".dbf") returned 4 [0202.686] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.686] lstrlenW (lpString=".1cd") returned 4 [0202.686] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.686] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\10_All_Music.wpl") returned 113 [0202.686] lstrlenW (lpString=".jpg") returned 4 [0202.686] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.686] lstrcmpiW (lpString1=".wpl", lpString2=".wiki") returned 1 [0202.686] lstrlenW (lpString="11_All_Pictures.wpl") returned 19 [0202.686] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.687] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=585) returned 1 [0202.687] CloseHandle (hObject=0x350) returned 1 [0202.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl")) returned 0x2020 [0202.687] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0202.687] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0202.687] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.688] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.688] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0202.688] GetLastError () returned 0x0 [0202.688] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x249, lpOverlapped=0x0) returned 1 [0202.868] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x250, lpOverlapped=0x0) returned 1 [0202.874] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0202.874] WriteFile (in: hFile=0x358, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xfa, lpOverlapped=0x0) returned 1 [0202.874] SetEndOfFile (hFile=0x358) returned 1 [0202.874] CloseHandle (hObject=0x358) returned 1 [0202.874] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0202.874] SetEndOfFile (hFile=0x350) returned 1 [0202.875] CloseHandle (hObject=0x350) returned 1 [0202.875] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0202.875] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\media player\\sync playlists\\en-us\\00010c6e\\11_all_pictures.wpl")) returned 1 [0202.875] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.875] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.875] lstrlenW (lpString=".doc") returned 4 [0202.875] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.875] lstrlenW (lpString=".docx") returned 5 [0202.875] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.875] lstrlenW (lpString=".pdf") returned 4 [0202.875] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.875] lstrlenW (lpString=".xls") returned 4 [0202.875] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.875] lstrlenW (lpString=".xlsx") returned 5 [0202.876] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.876] lstrlenW (lpString=".ppt") returned 4 [0202.876] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.876] lstrlenW (lpString=".zip") returned 4 [0202.876] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.876] lstrlenW (lpString=".rar") returned 4 [0202.876] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.876] lstrlenW (lpString=".bz2") returned 4 [0202.876] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.876] lstrlenW (lpString=".7z") returned 3 [0202.876] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.876] lstrlenW (lpString=".dbf") returned 4 [0202.876] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.876] lstrlenW (lpString=".1cd") returned 4 [0202.876] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.876] lstrlenW (lpString=".jpg") returned 4 [0202.876] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.876] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.876] lstrlenW (lpString=".doc") returned 4 [0202.876] lstrcmpiW (lpString1=".doc", lpString2=".wpl") returned -1 [0202.876] lstrlenW (lpString=".docx") returned 5 [0202.877] lstrcmpiW (lpString1=".docx", lpString2="s.wpl") returned -1 [0202.877] lstrlenW (lpString=".pdf") returned 4 [0202.877] lstrcmpiW (lpString1=".pdf", lpString2=".wpl") returned -1 [0202.877] lstrlenW (lpString=".xls") returned 4 [0202.877] lstrcmpiW (lpString1=".xls", lpString2=".wpl") returned 1 [0202.877] lstrlenW (lpString=".xlsx") returned 5 [0202.877] lstrcmpiW (lpString1=".xlsx", lpString2="s.wpl") returned -1 [0202.877] lstrlenW (lpString=".ppt") returned 4 [0202.877] lstrcmpiW (lpString1=".ppt", lpString2=".wpl") returned -1 [0202.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.877] lstrlenW (lpString=".zip") returned 4 [0202.877] lstrcmpiW (lpString1=".zip", lpString2=".wpl") returned 1 [0202.877] lstrlenW (lpString=".rar") returned 4 [0202.877] lstrcmpiW (lpString1=".rar", lpString2=".wpl") returned -1 [0202.877] lstrlenW (lpString=".bz2") returned 4 [0202.877] lstrcmpiW (lpString1=".bz2", lpString2=".wpl") returned -1 [0202.877] lstrlenW (lpString=".7z") returned 3 [0202.877] lstrcmpiW (lpString1=".7z", lpString2="wpl") returned -1 [0202.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.877] lstrlenW (lpString=".dbf") returned 4 [0202.877] lstrcmpiW (lpString1=".dbf", lpString2=".wpl") returned -1 [0202.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.877] lstrlenW (lpString=".1cd") returned 4 [0202.877] lstrcmpiW (lpString1=".1cd", lpString2=".wpl") returned -1 [0202.877] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Media Player\\Sync Playlists\\en-US\\00010C6E\\11_All_Pictures.wpl") returned 116 [0202.877] lstrlenW (lpString=".jpg") returned 4 [0202.877] lstrcmpiW (lpString1=".jpg", lpString2=".wpl") returned -1 [0202.877] lstrcmpiW (lpString1=".IE5\\9QH4S0GZ\\async_usersync[3]", lpString2=".wiki") returned -1 [0202.877] lstrlenW (lpString="async_usersync[3]") returned 17 [0202.877] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x344 [0203.027] GetFileSizeEx (in: hFile=0x344, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1330) returned 1 [0203.040] CloseHandle (hObject=0x344) returned 1 [0203.043] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3]")) returned 0x2020 [0203.043] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.051] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.054] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.054] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.054] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.055] GetLastError () returned 0x0 [0203.055] ReadFile (in: hFile=0x2d4, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x532, lpOverlapped=0x0) returned 1 [0203.057] WriteFile (in: hFile=0x154, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x540, lpOverlapped=0x0) returned 1 [0203.057] ReadFile (in: hFile=0x2d4, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.057] WriteFile (in: hFile=0x154, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xf6, lpOverlapped=0x0) returned 1 [0203.058] SetEndOfFile (hFile=0x154) returned 1 [0203.058] CloseHandle (hObject=0x154) returned 1 [0203.058] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.058] SetEndOfFile (hFile=0x2d4) returned 1 [0203.058] CloseHandle (hObject=0x2d4) returned 1 [0203.059] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.059] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\async_usersync[3]")) returned 1 [0203.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.059] lstrlenW (lpString=".doc") returned 4 [0203.059] lstrcmpiW (lpString1=".doc", lpString2="c[3]") returned -1 [0203.059] lstrlenW (lpString=".docx") returned 5 [0203.059] lstrcmpiW (lpString1=".docx", lpString2="nc[3]") returned -1 [0203.059] lstrlenW (lpString=".pdf") returned 4 [0203.059] lstrcmpiW (lpString1=".pdf", lpString2="c[3]") returned -1 [0203.059] lstrlenW (lpString=".xls") returned 4 [0203.059] lstrcmpiW (lpString1=".xls", lpString2="c[3]") returned -1 [0203.059] lstrlenW (lpString=".xlsx") returned 5 [0203.059] lstrcmpiW (lpString1=".xlsx", lpString2="nc[3]") returned -1 [0203.059] lstrlenW (lpString=".ppt") returned 4 [0203.059] lstrcmpiW (lpString1=".ppt", lpString2="c[3]") returned -1 [0203.059] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.059] lstrlenW (lpString=".zip") returned 4 [0203.059] lstrcmpiW (lpString1=".zip", lpString2="c[3]") returned -1 [0203.059] lstrlenW (lpString=".rar") returned 4 [0203.059] lstrcmpiW (lpString1=".rar", lpString2="c[3]") returned -1 [0203.059] lstrlenW (lpString=".bz2") returned 4 [0203.059] lstrcmpiW (lpString1=".bz2", lpString2="c[3]") returned -1 [0203.059] lstrlenW (lpString=".7z") returned 3 [0203.060] lstrcmpiW (lpString1=".7z", lpString2="[3]") returned -1 [0203.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.060] lstrlenW (lpString=".dbf") returned 4 [0203.060] lstrcmpiW (lpString1=".dbf", lpString2="c[3]") returned -1 [0203.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.060] lstrlenW (lpString=".1cd") returned 4 [0203.060] lstrcmpiW (lpString1=".1cd", lpString2="c[3]") returned -1 [0203.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.060] lstrlenW (lpString=".jpg") returned 4 [0203.060] lstrcmpiW (lpString1=".jpg", lpString2="c[3]") returned -1 [0203.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.060] lstrlenW (lpString=".doc") returned 4 [0203.060] lstrcmpiW (lpString1=".doc", lpString2="c[3]") returned -1 [0203.060] lstrlenW (lpString=".docx") returned 5 [0203.060] lstrcmpiW (lpString1=".docx", lpString2="nc[3]") returned -1 [0203.060] lstrlenW (lpString=".pdf") returned 4 [0203.060] lstrcmpiW (lpString1=".pdf", lpString2="c[3]") returned -1 [0203.060] lstrlenW (lpString=".xls") returned 4 [0203.060] lstrcmpiW (lpString1=".xls", lpString2="c[3]") returned -1 [0203.060] lstrlenW (lpString=".xlsx") returned 5 [0203.060] lstrcmpiW (lpString1=".xlsx", lpString2="nc[3]") returned -1 [0203.060] lstrlenW (lpString=".ppt") returned 4 [0203.060] lstrcmpiW (lpString1=".ppt", lpString2="c[3]") returned -1 [0203.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.060] lstrlenW (lpString=".zip") returned 4 [0203.060] lstrcmpiW (lpString1=".zip", lpString2="c[3]") returned -1 [0203.060] lstrlenW (lpString=".rar") returned 4 [0203.060] lstrcmpiW (lpString1=".rar", lpString2="c[3]") returned -1 [0203.060] lstrlenW (lpString=".bz2") returned 4 [0203.060] lstrcmpiW (lpString1=".bz2", lpString2="c[3]") returned -1 [0203.060] lstrlenW (lpString=".7z") returned 3 [0203.060] lstrcmpiW (lpString1=".7z", lpString2="[3]") returned -1 [0203.060] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.060] lstrlenW (lpString=".dbf") returned 4 [0203.061] lstrcmpiW (lpString1=".dbf", lpString2="c[3]") returned -1 [0203.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.061] lstrlenW (lpString=".1cd") returned 4 [0203.061] lstrcmpiW (lpString1=".1cd", lpString2="c[3]") returned -1 [0203.061] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\async_usersync[3]") returned 129 [0203.061] lstrlenW (lpString=".jpg") returned 4 [0203.061] lstrcmpiW (lpString1=".jpg", lpString2="c[3]") returned -1 [0203.061] lstrcmpiW (lpString1=".IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]", lpString2=".wiki") returned -1 [0203.061] lstrlenW (lpString="f8-028d9f-f30905ea[1]") returned 21 [0203.061] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\f8-028d9f-f30905ea[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.061] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=236065) returned 1 [0203.061] CloseHandle (hObject=0x2d4) returned 1 [0203.061] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\f8-028d9f-f30905ea[1]")) returned 0x2020 [0203.062] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\f8-028d9f-f30905ea[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\f8-028d9f-f30905ea[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.062] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.062] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.062] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\f8-028d9f-f30905ea[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.062] GetLastError () returned 0x0 [0203.062] ReadFile (in: hFile=0x2d4, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x39a21, lpOverlapped=0x0) returned 1 [0203.068] WriteFile (in: hFile=0x154, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x39a30, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x39a30, lpOverlapped=0x0) returned 1 [0203.072] ReadFile (in: hFile=0x2d4, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.072] WriteFile (in: hFile=0x154, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xfe, lpOverlapped=0x0) returned 1 [0203.072] SetEndOfFile (hFile=0x154) returned 1 [0203.072] CloseHandle (hObject=0x154) returned 1 [0203.072] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.072] SetEndOfFile (hFile=0x2d4) returned 1 [0203.074] CloseHandle (hObject=0x2d4) returned 1 [0203.074] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.074] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\f8-028d9f-f30905ea[1]")) returned 1 [0203.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.075] lstrlenW (lpString=".doc") returned 4 [0203.075] lstrcmpiW (lpString1=".doc", lpString2="a[1]") returned -1 [0203.075] lstrlenW (lpString=".docx") returned 5 [0203.075] lstrcmpiW (lpString1=".docx", lpString2="ea[1]") returned -1 [0203.075] lstrlenW (lpString=".pdf") returned 4 [0203.075] lstrcmpiW (lpString1=".pdf", lpString2="a[1]") returned -1 [0203.075] lstrlenW (lpString=".xls") returned 4 [0203.075] lstrcmpiW (lpString1=".xls", lpString2="a[1]") returned -1 [0203.075] lstrlenW (lpString=".xlsx") returned 5 [0203.075] lstrcmpiW (lpString1=".xlsx", lpString2="ea[1]") returned -1 [0203.075] lstrlenW (lpString=".ppt") returned 4 [0203.075] lstrcmpiW (lpString1=".ppt", lpString2="a[1]") returned -1 [0203.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.075] lstrlenW (lpString=".zip") returned 4 [0203.075] lstrcmpiW (lpString1=".zip", lpString2="a[1]") returned -1 [0203.075] lstrlenW (lpString=".rar") returned 4 [0203.075] lstrcmpiW (lpString1=".rar", lpString2="a[1]") returned -1 [0203.075] lstrlenW (lpString=".bz2") returned 4 [0203.075] lstrcmpiW (lpString1=".bz2", lpString2="a[1]") returned -1 [0203.075] lstrlenW (lpString=".7z") returned 3 [0203.075] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.075] lstrlenW (lpString=".dbf") returned 4 [0203.075] lstrcmpiW (lpString1=".dbf", lpString2="a[1]") returned -1 [0203.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.075] lstrlenW (lpString=".1cd") returned 4 [0203.075] lstrcmpiW (lpString1=".1cd", lpString2="a[1]") returned -1 [0203.075] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.075] lstrlenW (lpString=".jpg") returned 4 [0203.075] lstrcmpiW (lpString1=".jpg", lpString2="a[1]") returned -1 [0203.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.076] lstrlenW (lpString=".doc") returned 4 [0203.076] lstrcmpiW (lpString1=".doc", lpString2="a[1]") returned -1 [0203.076] lstrlenW (lpString=".docx") returned 5 [0203.076] lstrcmpiW (lpString1=".docx", lpString2="ea[1]") returned -1 [0203.076] lstrlenW (lpString=".pdf") returned 4 [0203.076] lstrcmpiW (lpString1=".pdf", lpString2="a[1]") returned -1 [0203.076] lstrlenW (lpString=".xls") returned 4 [0203.076] lstrcmpiW (lpString1=".xls", lpString2="a[1]") returned -1 [0203.076] lstrlenW (lpString=".xlsx") returned 5 [0203.076] lstrcmpiW (lpString1=".xlsx", lpString2="ea[1]") returned -1 [0203.076] lstrlenW (lpString=".ppt") returned 4 [0203.076] lstrcmpiW (lpString1=".ppt", lpString2="a[1]") returned -1 [0203.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.076] lstrlenW (lpString=".zip") returned 4 [0203.076] lstrcmpiW (lpString1=".zip", lpString2="a[1]") returned -1 [0203.076] lstrlenW (lpString=".rar") returned 4 [0203.076] lstrcmpiW (lpString1=".rar", lpString2="a[1]") returned -1 [0203.076] lstrlenW (lpString=".bz2") returned 4 [0203.076] lstrcmpiW (lpString1=".bz2", lpString2="a[1]") returned -1 [0203.076] lstrlenW (lpString=".7z") returned 3 [0203.076] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.076] lstrlenW (lpString=".dbf") returned 4 [0203.076] lstrcmpiW (lpString1=".dbf", lpString2="a[1]") returned -1 [0203.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.076] lstrlenW (lpString=".1cd") returned 4 [0203.076] lstrcmpiW (lpString1=".1cd", lpString2="a[1]") returned -1 [0203.076] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\f8-028d9f-f30905ea[1]") returned 133 [0203.076] lstrlenW (lpString=".jpg") returned 4 [0203.076] lstrcmpiW (lpString1=".jpg", lpString2="a[1]") returned -1 [0203.077] lstrcmpiW (lpString1=".IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]", lpString2=".wiki") returned -1 [0203.077] lstrlenW (lpString="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 146 [0203.077] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.077] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=3234) returned 1 [0203.077] CloseHandle (hObject=0x2d4) returned 1 [0203.077] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]")) returned 0x2020 [0203.077] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.078] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.078] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.078] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.078] CloseHandle (hObject=0x2d4) returned 1 [0203.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.078] lstrlenW (lpString=".doc") returned 4 [0203.078] lstrcmpiW (lpString1=".doc", lpString2="8[1]") returned -1 [0203.078] lstrlenW (lpString=".docx") returned 5 [0203.078] lstrcmpiW (lpString1=".docx", lpString2="48[1]") returned -1 [0203.078] lstrlenW (lpString=".pdf") returned 4 [0203.078] lstrcmpiW (lpString1=".pdf", lpString2="8[1]") returned -1 [0203.078] lstrlenW (lpString=".xls") returned 4 [0203.078] lstrcmpiW (lpString1=".xls", lpString2="8[1]") returned -1 [0203.078] lstrlenW (lpString=".xlsx") returned 5 [0203.078] lstrcmpiW (lpString1=".xlsx", lpString2="48[1]") returned -1 [0203.078] lstrlenW (lpString=".ppt") returned 4 [0203.078] lstrcmpiW (lpString1=".ppt", lpString2="8[1]") returned -1 [0203.078] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.078] lstrlenW (lpString=".zip") returned 4 [0203.078] lstrcmpiW (lpString1=".zip", lpString2="8[1]") returned -1 [0203.078] lstrlenW (lpString=".rar") returned 4 [0203.078] lstrcmpiW (lpString1=".rar", lpString2="8[1]") returned -1 [0203.078] lstrlenW (lpString=".bz2") returned 4 [0203.078] lstrcmpiW (lpString1=".bz2", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString=".7z") returned 3 [0203.079] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.079] lstrlenW (lpString=".dbf") returned 4 [0203.079] lstrcmpiW (lpString1=".dbf", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.079] lstrlenW (lpString=".1cd") returned 4 [0203.079] lstrcmpiW (lpString1=".1cd", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.079] lstrlenW (lpString=".jpg") returned 4 [0203.079] lstrcmpiW (lpString1=".jpg", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.079] lstrlenW (lpString=".doc") returned 4 [0203.079] lstrcmpiW (lpString1=".doc", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString=".docx") returned 5 [0203.079] lstrcmpiW (lpString1=".docx", lpString2="48[1]") returned -1 [0203.079] lstrlenW (lpString=".pdf") returned 4 [0203.079] lstrcmpiW (lpString1=".pdf", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString=".xls") returned 4 [0203.079] lstrcmpiW (lpString1=".xls", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString=".xlsx") returned 5 [0203.079] lstrcmpiW (lpString1=".xlsx", lpString2="48[1]") returned -1 [0203.079] lstrlenW (lpString=".ppt") returned 4 [0203.079] lstrcmpiW (lpString1=".ppt", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.079] lstrlenW (lpString=".zip") returned 4 [0203.079] lstrcmpiW (lpString1=".zip", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString=".rar") returned 4 [0203.079] lstrcmpiW (lpString1=".rar", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString=".bz2") returned 4 [0203.079] lstrcmpiW (lpString1=".bz2", lpString2="8[1]") returned -1 [0203.079] lstrlenW (lpString=".7z") returned 3 [0203.079] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.080] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.080] lstrlenW (lpString=".dbf") returned 4 [0203.080] lstrcmpiW (lpString1=".dbf", lpString2="8[1]") returned -1 [0203.080] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.080] lstrlenW (lpString=".1cd") returned 4 [0203.080] lstrcmpiW (lpString1=".1cd", lpString2="8[1]") returned -1 [0203.080] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.080] lstrlenW (lpString=".jpg") returned 4 [0203.080] lstrcmpiW (lpString1=".jpg", lpString2="8[1]") returned -1 [0203.080] lstrcmpiW (lpString1=".IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]", lpString2=".wiki") returned -1 [0203.080] lstrlenW (lpString="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 146 [0203.080] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.081] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=4869) returned 1 [0203.081] CloseHandle (hObject=0x2d4) returned 1 [0203.081] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]")) returned 0x2020 [0203.081] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.081] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.081] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.081] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.082] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.082] CloseHandle (hObject=0x2d4) returned 1 [0203.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.082] lstrlenW (lpString=".doc") returned 4 [0203.082] lstrcmpiW (lpString1=".doc", lpString2="9[1]") returned -1 [0203.082] lstrlenW (lpString=".docx") returned 5 [0203.082] lstrcmpiW (lpString1=".docx", lpString2="99[1]") returned -1 [0203.082] lstrlenW (lpString=".pdf") returned 4 [0203.082] lstrcmpiW (lpString1=".pdf", lpString2="9[1]") returned -1 [0203.082] lstrlenW (lpString=".xls") returned 4 [0203.082] lstrcmpiW (lpString1=".xls", lpString2="9[1]") returned -1 [0203.082] lstrlenW (lpString=".xlsx") returned 5 [0203.082] lstrcmpiW (lpString1=".xlsx", lpString2="99[1]") returned -1 [0203.082] lstrlenW (lpString=".ppt") returned 4 [0203.082] lstrcmpiW (lpString1=".ppt", lpString2="9[1]") returned -1 [0203.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.082] lstrlenW (lpString=".zip") returned 4 [0203.082] lstrcmpiW (lpString1=".zip", lpString2="9[1]") returned -1 [0203.082] lstrlenW (lpString=".rar") returned 4 [0203.082] lstrcmpiW (lpString1=".rar", lpString2="9[1]") returned -1 [0203.082] lstrlenW (lpString=".bz2") returned 4 [0203.082] lstrcmpiW (lpString1=".bz2", lpString2="9[1]") returned -1 [0203.082] lstrlenW (lpString=".7z") returned 3 [0203.082] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.082] lstrlenW (lpString=".dbf") returned 4 [0203.082] lstrcmpiW (lpString1=".dbf", lpString2="9[1]") returned -1 [0203.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.082] lstrlenW (lpString=".1cd") returned 4 [0203.082] lstrcmpiW (lpString1=".1cd", lpString2="9[1]") returned -1 [0203.082] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.082] lstrlenW (lpString=".jpg") returned 4 [0203.083] lstrcmpiW (lpString1=".jpg", lpString2="9[1]") returned -1 [0203.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.083] lstrlenW (lpString=".doc") returned 4 [0203.083] lstrcmpiW (lpString1=".doc", lpString2="9[1]") returned -1 [0203.083] lstrlenW (lpString=".docx") returned 5 [0203.083] lstrcmpiW (lpString1=".docx", lpString2="99[1]") returned -1 [0203.083] lstrlenW (lpString=".pdf") returned 4 [0203.083] lstrcmpiW (lpString1=".pdf", lpString2="9[1]") returned -1 [0203.083] lstrlenW (lpString=".xls") returned 4 [0203.083] lstrcmpiW (lpString1=".xls", lpString2="9[1]") returned -1 [0203.083] lstrlenW (lpString=".xlsx") returned 5 [0203.083] lstrcmpiW (lpString1=".xlsx", lpString2="99[1]") returned -1 [0203.083] lstrlenW (lpString=".ppt") returned 4 [0203.083] lstrcmpiW (lpString1=".ppt", lpString2="9[1]") returned -1 [0203.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.083] lstrlenW (lpString=".zip") returned 4 [0203.083] lstrcmpiW (lpString1=".zip", lpString2="9[1]") returned -1 [0203.083] lstrlenW (lpString=".rar") returned 4 [0203.083] lstrcmpiW (lpString1=".rar", lpString2="9[1]") returned -1 [0203.083] lstrlenW (lpString=".bz2") returned 4 [0203.083] lstrcmpiW (lpString1=".bz2", lpString2="9[1]") returned -1 [0203.083] lstrlenW (lpString=".7z") returned 3 [0203.083] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.083] lstrlenW (lpString=".dbf") returned 4 [0203.083] lstrcmpiW (lpString1=".dbf", lpString2="9[1]") returned -1 [0203.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.083] lstrlenW (lpString=".1cd") returned 4 [0203.083] lstrcmpiW (lpString1=".1cd", lpString2="9[1]") returned -1 [0203.083] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE12;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=1;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.083] lstrlenW (lpString=".jpg") returned 4 [0203.083] lstrcmpiW (lpString1=".jpg", lpString2="9[1]") returned -1 [0203.084] lstrcmpiW (lpString1=".IE5\\9QH4S0GZ\\js[1]", lpString2=".wiki") returned -1 [0203.084] lstrlenW (lpString="js[1]") returned 5 [0203.084] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\js[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.085] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=961) returned 1 [0203.085] CloseHandle (hObject=0x2d4) returned 1 [0203.085] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\js[1]")) returned 0x2020 [0203.085] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\js[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\js[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.085] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.085] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.085] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\js[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x154 [0203.086] GetLastError () returned 0x0 [0203.086] ReadFile (in: hFile=0x2d4, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x3c1, lpOverlapped=0x0) returned 1 [0203.087] WriteFile (in: hFile=0x154, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0203.088] ReadFile (in: hFile=0x2d4, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.088] WriteFile (in: hFile=0x154, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xde, lpOverlapped=0x0) returned 1 [0203.089] SetEndOfFile (hFile=0x154) returned 1 [0203.089] CloseHandle (hObject=0x154) returned 1 [0203.089] SetFilePointerEx (in: hFile=0x2d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.089] SetEndOfFile (hFile=0x2d4) returned 1 [0203.089] CloseHandle (hObject=0x2d4) returned 1 [0203.090] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.090] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\js[1]")) returned 1 [0203.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.090] lstrlenW (lpString=".doc") returned 4 [0203.090] lstrcmpiW (lpString1=".doc", lpString2="s[1]") returned -1 [0203.090] lstrlenW (lpString=".docx") returned 5 [0203.090] lstrcmpiW (lpString1=".docx", lpString2="js[1]") returned -1 [0203.090] lstrlenW (lpString=".pdf") returned 4 [0203.090] lstrcmpiW (lpString1=".pdf", lpString2="s[1]") returned -1 [0203.090] lstrlenW (lpString=".xls") returned 4 [0203.090] lstrcmpiW (lpString1=".xls", lpString2="s[1]") returned -1 [0203.090] lstrlenW (lpString=".xlsx") returned 5 [0203.090] lstrcmpiW (lpString1=".xlsx", lpString2="js[1]") returned -1 [0203.090] lstrlenW (lpString=".ppt") returned 4 [0203.090] lstrcmpiW (lpString1=".ppt", lpString2="s[1]") returned -1 [0203.090] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.090] lstrlenW (lpString=".zip") returned 4 [0203.090] lstrcmpiW (lpString1=".zip", lpString2="s[1]") returned -1 [0203.090] lstrlenW (lpString=".rar") returned 4 [0203.090] lstrcmpiW (lpString1=".rar", lpString2="s[1]") returned -1 [0203.090] lstrlenW (lpString=".bz2") returned 4 [0203.090] lstrcmpiW (lpString1=".bz2", lpString2="s[1]") returned -1 [0203.090] lstrlenW (lpString=".7z") returned 3 [0203.090] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.091] lstrlenW (lpString=".dbf") returned 4 [0203.091] lstrcmpiW (lpString1=".dbf", lpString2="s[1]") returned -1 [0203.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.091] lstrlenW (lpString=".1cd") returned 4 [0203.091] lstrcmpiW (lpString1=".1cd", lpString2="s[1]") returned -1 [0203.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.091] lstrlenW (lpString=".jpg") returned 4 [0203.091] lstrcmpiW (lpString1=".jpg", lpString2="s[1]") returned -1 [0203.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.091] lstrlenW (lpString=".doc") returned 4 [0203.091] lstrcmpiW (lpString1=".doc", lpString2="s[1]") returned -1 [0203.091] lstrlenW (lpString=".docx") returned 5 [0203.091] lstrcmpiW (lpString1=".docx", lpString2="js[1]") returned -1 [0203.091] lstrlenW (lpString=".pdf") returned 4 [0203.091] lstrcmpiW (lpString1=".pdf", lpString2="s[1]") returned -1 [0203.091] lstrlenW (lpString=".xls") returned 4 [0203.091] lstrcmpiW (lpString1=".xls", lpString2="s[1]") returned -1 [0203.091] lstrlenW (lpString=".xlsx") returned 5 [0203.091] lstrcmpiW (lpString1=".xlsx", lpString2="js[1]") returned -1 [0203.091] lstrlenW (lpString=".ppt") returned 4 [0203.091] lstrcmpiW (lpString1=".ppt", lpString2="s[1]") returned -1 [0203.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.091] lstrlenW (lpString=".zip") returned 4 [0203.091] lstrcmpiW (lpString1=".zip", lpString2="s[1]") returned -1 [0203.091] lstrlenW (lpString=".rar") returned 4 [0203.091] lstrcmpiW (lpString1=".rar", lpString2="s[1]") returned -1 [0203.091] lstrlenW (lpString=".bz2") returned 4 [0203.091] lstrcmpiW (lpString1=".bz2", lpString2="s[1]") returned -1 [0203.091] lstrlenW (lpString=".7z") returned 3 [0203.091] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.091] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.092] lstrlenW (lpString=".dbf") returned 4 [0203.092] lstrcmpiW (lpString1=".dbf", lpString2="s[1]") returned -1 [0203.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.092] lstrlenW (lpString=".1cd") returned 4 [0203.092] lstrcmpiW (lpString1=".1cd", lpString2="s[1]") returned -1 [0203.092] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\js[1]") returned 117 [0203.092] lstrlenW (lpString=".jpg") returned 4 [0203.092] lstrcmpiW (lpString1=".jpg", lpString2="s[1]") returned -1 [0203.092] lstrcmpiW (lpString1=".eot", lpString2=".wiki") returned -1 [0203.092] lstrlenW (lpString="latest[1].eot") returned 13 [0203.092] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d4 [0203.092] GetFileSizeEx (in: hFile=0x2d4, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=35047) returned 1 [0203.092] CloseHandle (hObject=0x2d4) returned 1 [0203.092] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot")) returned 0x2020 [0203.103] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.103] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.103] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.103] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.112] GetLastError () returned 0x0 [0203.112] ReadFile (in: hFile=0x378, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x88e7, lpOverlapped=0x0) returned 1 [0203.114] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x88f0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x88f0, lpOverlapped=0x0) returned 1 [0203.116] ReadFile (in: hFile=0x378, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.116] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xee, lpOverlapped=0x0) returned 1 [0203.116] SetEndOfFile (hFile=0x34c) returned 1 [0203.116] CloseHandle (hObject=0x34c) returned 1 [0203.117] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.118] SetEndOfFile (hFile=0x378) returned 1 [0203.118] CloseHandle (hObject=0x378) returned 1 [0203.118] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.119] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\latest[1].eot")) returned 1 [0203.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.119] lstrlenW (lpString=".doc") returned 4 [0203.119] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.119] lstrlenW (lpString=".docx") returned 5 [0203.119] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.119] lstrlenW (lpString=".pdf") returned 4 [0203.119] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.119] lstrlenW (lpString=".xls") returned 4 [0203.119] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.119] lstrlenW (lpString=".xlsx") returned 5 [0203.119] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.119] lstrlenW (lpString=".ppt") returned 4 [0203.119] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.119] lstrlenW (lpString=".zip") returned 4 [0203.119] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.119] lstrlenW (lpString=".rar") returned 4 [0203.119] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.119] lstrlenW (lpString=".bz2") returned 4 [0203.119] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.119] lstrlenW (lpString=".7z") returned 3 [0203.119] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.119] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.120] lstrlenW (lpString=".dbf") returned 4 [0203.120] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.120] lstrlenW (lpString=".1cd") returned 4 [0203.120] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.120] lstrlenW (lpString=".jpg") returned 4 [0203.120] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.120] lstrlenW (lpString=".doc") returned 4 [0203.120] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.120] lstrlenW (lpString=".docx") returned 5 [0203.120] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.120] lstrlenW (lpString=".pdf") returned 4 [0203.120] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.120] lstrlenW (lpString=".xls") returned 4 [0203.120] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.120] lstrlenW (lpString=".xlsx") returned 5 [0203.120] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.120] lstrlenW (lpString=".ppt") returned 4 [0203.120] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.120] lstrlenW (lpString=".zip") returned 4 [0203.120] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.120] lstrlenW (lpString=".rar") returned 4 [0203.120] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.120] lstrlenW (lpString=".bz2") returned 4 [0203.120] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.120] lstrlenW (lpString=".7z") returned 3 [0203.120] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.120] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.120] lstrlenW (lpString=".dbf") returned 4 [0203.120] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.121] lstrlenW (lpString=".1cd") returned 4 [0203.121] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.121] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\latest[1].eot") returned 125 [0203.121] lstrlenW (lpString=".jpg") returned 4 [0203.121] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.121] lstrcmpiW (lpString1=".IE5\\9QH4S0GZ\\meversion[1]", lpString2=".wiki") returned -1 [0203.121] lstrlenW (lpString="meversion[1]") returned 12 [0203.121] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\meversion[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.122] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=4480) returned 1 [0203.122] CloseHandle (hObject=0x378) returned 1 [0203.122] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\meversion[1]")) returned 0x2020 [0203.122] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\meversion[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\meversion[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.122] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.122] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.122] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\meversion[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.123] GetLastError () returned 0x0 [0203.123] ReadFile (in: hFile=0x378, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x1180, lpOverlapped=0x0) returned 1 [0203.124] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x1190, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x1190, lpOverlapped=0x0) returned 1 [0203.125] ReadFile (in: hFile=0x378, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.125] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xec, lpOverlapped=0x0) returned 1 [0203.126] SetEndOfFile (hFile=0x34c) returned 1 [0203.126] CloseHandle (hObject=0x34c) returned 1 [0203.126] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.126] SetEndOfFile (hFile=0x378) returned 1 [0203.126] CloseHandle (hObject=0x378) returned 1 [0203.127] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.127] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\9qh4s0gz\\meversion[1]")) returned 1 [0203.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.127] lstrlenW (lpString=".doc") returned 4 [0203.127] lstrcmpiW (lpString1=".doc", lpString2="n[1]") returned -1 [0203.127] lstrlenW (lpString=".docx") returned 5 [0203.127] lstrcmpiW (lpString1=".docx", lpString2="on[1]") returned -1 [0203.127] lstrlenW (lpString=".pdf") returned 4 [0203.127] lstrcmpiW (lpString1=".pdf", lpString2="n[1]") returned -1 [0203.127] lstrlenW (lpString=".xls") returned 4 [0203.127] lstrcmpiW (lpString1=".xls", lpString2="n[1]") returned -1 [0203.127] lstrlenW (lpString=".xlsx") returned 5 [0203.127] lstrcmpiW (lpString1=".xlsx", lpString2="on[1]") returned -1 [0203.127] lstrlenW (lpString=".ppt") returned 4 [0203.127] lstrcmpiW (lpString1=".ppt", lpString2="n[1]") returned -1 [0203.127] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.127] lstrlenW (lpString=".zip") returned 4 [0203.127] lstrcmpiW (lpString1=".zip", lpString2="n[1]") returned -1 [0203.127] lstrlenW (lpString=".rar") returned 4 [0203.127] lstrcmpiW (lpString1=".rar", lpString2="n[1]") returned -1 [0203.127] lstrlenW (lpString=".bz2") returned 4 [0203.127] lstrcmpiW (lpString1=".bz2", lpString2="n[1]") returned -1 [0203.127] lstrlenW (lpString=".7z") returned 3 [0203.127] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.128] lstrlenW (lpString=".dbf") returned 4 [0203.128] lstrcmpiW (lpString1=".dbf", lpString2="n[1]") returned -1 [0203.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.128] lstrlenW (lpString=".1cd") returned 4 [0203.128] lstrcmpiW (lpString1=".1cd", lpString2="n[1]") returned -1 [0203.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.128] lstrlenW (lpString=".jpg") returned 4 [0203.128] lstrcmpiW (lpString1=".jpg", lpString2="n[1]") returned -1 [0203.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.128] lstrlenW (lpString=".doc") returned 4 [0203.128] lstrcmpiW (lpString1=".doc", lpString2="n[1]") returned -1 [0203.128] lstrlenW (lpString=".docx") returned 5 [0203.128] lstrcmpiW (lpString1=".docx", lpString2="on[1]") returned -1 [0203.128] lstrlenW (lpString=".pdf") returned 4 [0203.128] lstrcmpiW (lpString1=".pdf", lpString2="n[1]") returned -1 [0203.128] lstrlenW (lpString=".xls") returned 4 [0203.128] lstrcmpiW (lpString1=".xls", lpString2="n[1]") returned -1 [0203.128] lstrlenW (lpString=".xlsx") returned 5 [0203.128] lstrcmpiW (lpString1=".xlsx", lpString2="on[1]") returned -1 [0203.128] lstrlenW (lpString=".ppt") returned 4 [0203.128] lstrcmpiW (lpString1=".ppt", lpString2="n[1]") returned -1 [0203.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.128] lstrlenW (lpString=".zip") returned 4 [0203.128] lstrcmpiW (lpString1=".zip", lpString2="n[1]") returned -1 [0203.128] lstrlenW (lpString=".rar") returned 4 [0203.128] lstrcmpiW (lpString1=".rar", lpString2="n[1]") returned -1 [0203.128] lstrlenW (lpString=".bz2") returned 4 [0203.128] lstrcmpiW (lpString1=".bz2", lpString2="n[1]") returned -1 [0203.128] lstrlenW (lpString=".7z") returned 3 [0203.128] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.128] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.128] lstrlenW (lpString=".dbf") returned 4 [0203.129] lstrcmpiW (lpString1=".dbf", lpString2="n[1]") returned -1 [0203.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.129] lstrlenW (lpString=".1cd") returned 4 [0203.129] lstrcmpiW (lpString1=".1cd", lpString2="n[1]") returned -1 [0203.129] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\9QH4S0GZ\\meversion[1]") returned 124 [0203.129] lstrlenW (lpString=".jpg") returned 4 [0203.129] lstrcmpiW (lpString1=".jpg", lpString2="n[1]") returned -1 [0203.129] lstrcmpiW (lpString1=".loaded_0", lpString2=".wiki") returned -1 [0203.129] lstrlenW (lpString="cb=gapi[1].loaded_0") returned 19 [0203.129] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.131] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=117238) returned 1 [0203.131] CloseHandle (hObject=0x378) returned 1 [0203.131] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0")) returned 0x2020 [0203.131] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.131] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.131] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.131] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.132] GetLastError () returned 0x0 [0203.132] ReadFile (in: hFile=0x378, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x1c9f6, lpOverlapped=0x0) returned 1 [0203.138] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x1ca00, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x1ca00, lpOverlapped=0x0) returned 1 [0203.141] ReadFile (in: hFile=0x378, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.141] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xfa, lpOverlapped=0x0) returned 1 [0203.141] SetEndOfFile (hFile=0x34c) returned 1 [0203.141] CloseHandle (hObject=0x34c) returned 1 [0203.141] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.141] SetEndOfFile (hFile=0x378) returned 1 [0203.142] CloseHandle (hObject=0x378) returned 1 [0203.143] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.143] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\cb=gapi[1].loaded_0")) returned 1 [0203.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.143] lstrlenW (lpString=".doc") returned 4 [0203.143] lstrcmpiW (lpString1=".doc", lpString2="ed_0") returned -1 [0203.143] lstrlenW (lpString=".docx") returned 5 [0203.143] lstrcmpiW (lpString1=".docx", lpString2="ded_0") returned -1 [0203.143] lstrlenW (lpString=".pdf") returned 4 [0203.143] lstrcmpiW (lpString1=".pdf", lpString2="ed_0") returned -1 [0203.143] lstrlenW (lpString=".xls") returned 4 [0203.143] lstrcmpiW (lpString1=".xls", lpString2="ed_0") returned -1 [0203.143] lstrlenW (lpString=".xlsx") returned 5 [0203.143] lstrcmpiW (lpString1=".xlsx", lpString2="ded_0") returned -1 [0203.143] lstrlenW (lpString=".ppt") returned 4 [0203.143] lstrcmpiW (lpString1=".ppt", lpString2="ed_0") returned -1 [0203.143] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.143] lstrlenW (lpString=".zip") returned 4 [0203.143] lstrcmpiW (lpString1=".zip", lpString2="ed_0") returned -1 [0203.143] lstrlenW (lpString=".rar") returned 4 [0203.143] lstrcmpiW (lpString1=".rar", lpString2="ed_0") returned -1 [0203.143] lstrlenW (lpString=".bz2") returned 4 [0203.143] lstrcmpiW (lpString1=".bz2", lpString2="ed_0") returned -1 [0203.143] lstrlenW (lpString=".7z") returned 3 [0203.144] lstrcmpiW (lpString1=".7z", lpString2="d_0") returned -1 [0203.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.144] lstrlenW (lpString=".dbf") returned 4 [0203.144] lstrcmpiW (lpString1=".dbf", lpString2="ed_0") returned -1 [0203.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.144] lstrlenW (lpString=".1cd") returned 4 [0203.144] lstrcmpiW (lpString1=".1cd", lpString2="ed_0") returned -1 [0203.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.144] lstrlenW (lpString=".jpg") returned 4 [0203.144] lstrcmpiW (lpString1=".jpg", lpString2="ed_0") returned -1 [0203.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.144] lstrlenW (lpString=".doc") returned 4 [0203.144] lstrcmpiW (lpString1=".doc", lpString2="ed_0") returned -1 [0203.144] lstrlenW (lpString=".docx") returned 5 [0203.144] lstrcmpiW (lpString1=".docx", lpString2="ded_0") returned -1 [0203.144] lstrlenW (lpString=".pdf") returned 4 [0203.144] lstrcmpiW (lpString1=".pdf", lpString2="ed_0") returned -1 [0203.144] lstrlenW (lpString=".xls") returned 4 [0203.144] lstrcmpiW (lpString1=".xls", lpString2="ed_0") returned -1 [0203.144] lstrlenW (lpString=".xlsx") returned 5 [0203.144] lstrcmpiW (lpString1=".xlsx", lpString2="ded_0") returned -1 [0203.144] lstrlenW (lpString=".ppt") returned 4 [0203.144] lstrcmpiW (lpString1=".ppt", lpString2="ed_0") returned -1 [0203.144] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.144] lstrlenW (lpString=".zip") returned 4 [0203.144] lstrcmpiW (lpString1=".zip", lpString2="ed_0") returned -1 [0203.144] lstrlenW (lpString=".rar") returned 4 [0203.144] lstrcmpiW (lpString1=".rar", lpString2="ed_0") returned -1 [0203.144] lstrlenW (lpString=".bz2") returned 4 [0203.144] lstrcmpiW (lpString1=".bz2", lpString2="ed_0") returned -1 [0203.144] lstrlenW (lpString=".7z") returned 3 [0203.144] lstrcmpiW (lpString1=".7z", lpString2="d_0") returned -1 [0203.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.145] lstrlenW (lpString=".dbf") returned 4 [0203.145] lstrcmpiW (lpString1=".dbf", lpString2="ed_0") returned -1 [0203.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.145] lstrlenW (lpString=".1cd") returned 4 [0203.145] lstrcmpiW (lpString1=".1cd", lpString2="ed_0") returned -1 [0203.145] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\cb=gapi[1].loaded_0") returned 131 [0203.145] lstrlenW (lpString=".jpg") returned 4 [0203.145] lstrcmpiW (lpString1=".jpg", lpString2="ed_0") returned -1 [0203.145] lstrcmpiW (lpString1=".eot", lpString2=".wiki") returned -1 [0203.145] lstrlenW (lpString="DevCMDL2.2.18[1].eot") returned 20 [0203.145] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.146] GetFileSizeEx (in: hFile=0x378, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=10812) returned 1 [0203.146] CloseHandle (hObject=0x378) returned 1 [0203.146] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot")) returned 0x2020 [0203.146] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.146] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0203.146] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.147] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.147] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.147] GetLastError () returned 0x0 [0203.147] ReadFile (in: hFile=0x378, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x2a3c, lpOverlapped=0x0) returned 1 [0203.149] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x2a40, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x2a40, lpOverlapped=0x0) returned 1 [0203.150] ReadFile (in: hFile=0x378, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.150] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xfc, lpOverlapped=0x0) returned 1 [0203.150] SetEndOfFile (hFile=0x34c) returned 1 [0203.150] CloseHandle (hObject=0x34c) returned 1 [0203.150] SetFilePointerEx (in: hFile=0x378, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.150] SetEndOfFile (hFile=0x378) returned 1 [0203.151] CloseHandle (hObject=0x378) returned 1 [0203.151] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.151] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\devcmdl2.2.18[1].eot")) returned 1 [0203.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.152] lstrlenW (lpString=".doc") returned 4 [0203.152] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.152] lstrlenW (lpString=".docx") returned 5 [0203.152] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.152] lstrlenW (lpString=".pdf") returned 4 [0203.152] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.152] lstrlenW (lpString=".xls") returned 4 [0203.152] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.152] lstrlenW (lpString=".xlsx") returned 5 [0203.152] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.152] lstrlenW (lpString=".ppt") returned 4 [0203.152] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.152] lstrlenW (lpString=".zip") returned 4 [0203.152] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.152] lstrlenW (lpString=".rar") returned 4 [0203.152] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.152] lstrlenW (lpString=".bz2") returned 4 [0203.152] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.152] lstrlenW (lpString=".7z") returned 3 [0203.152] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.152] lstrlenW (lpString=".dbf") returned 4 [0203.152] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.152] lstrlenW (lpString=".1cd") returned 4 [0203.152] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.152] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.152] lstrlenW (lpString=".jpg") returned 4 [0203.152] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.153] lstrlenW (lpString=".doc") returned 4 [0203.153] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.153] lstrlenW (lpString=".docx") returned 5 [0203.153] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.153] lstrlenW (lpString=".pdf") returned 4 [0203.153] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.153] lstrlenW (lpString=".xls") returned 4 [0203.153] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.153] lstrlenW (lpString=".xlsx") returned 5 [0203.153] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.153] lstrlenW (lpString=".ppt") returned 4 [0203.153] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.153] lstrlenW (lpString=".zip") returned 4 [0203.153] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.153] lstrlenW (lpString=".rar") returned 4 [0203.153] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.153] lstrlenW (lpString=".bz2") returned 4 [0203.153] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.153] lstrlenW (lpString=".7z") returned 3 [0203.153] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.153] lstrlenW (lpString=".dbf") returned 4 [0203.153] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.153] lstrlenW (lpString=".1cd") returned 4 [0203.153] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.153] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\DevCMDL2.2.18[1].eot") returned 132 [0203.153] lstrlenW (lpString=".jpg") returned 4 [0203.153] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.154] lstrcmpiW (lpString1=".IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]", lpString2=".wiki") returned -1 [0203.154] lstrlenW (lpString="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 146 [0203.154] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.241] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=4692) returned 1 [0203.241] CloseHandle (hObject=0x350) returned 1 [0203.241] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]")) returned 0x2020 [0203.252] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.252] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.252] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.253] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.260] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\abv8l7my\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1b;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.260] CloseHandle (hObject=0x350) returned 1 [0203.261] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.271] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.271] lstrlenW (lpString=".doc") returned 4 [0203.279] lstrcmpiW (lpString1=".doc", lpString2="8[1]") returned -1 [0203.279] lstrlenW (lpString=".docx") returned 5 [0203.279] lstrcmpiW (lpString1=".docx", lpString2="48[1]") returned -1 [0203.279] lstrlenW (lpString=".pdf") returned 4 [0203.279] lstrcmpiW (lpString1=".pdf", lpString2="8[1]") returned -1 [0203.279] lstrlenW (lpString=".xls") returned 4 [0203.279] lstrcmpiW (lpString1=".xls", lpString2="8[1]") returned -1 [0203.279] lstrlenW (lpString=".xlsx") returned 5 [0203.279] lstrcmpiW (lpString1=".xlsx", lpString2="48[1]") returned -1 [0203.279] lstrlenW (lpString=".ppt") returned 4 [0203.279] lstrcmpiW (lpString1=".ppt", lpString2="8[1]") returned -1 [0203.279] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.280] lstrlenW (lpString=".zip") returned 4 [0203.280] lstrcmpiW (lpString1=".zip", lpString2="8[1]") returned -1 [0203.280] lstrlenW (lpString=".rar") returned 4 [0203.280] lstrcmpiW (lpString1=".rar", lpString2="8[1]") returned -1 [0203.280] lstrlenW (lpString=".bz2") returned 4 [0203.280] lstrcmpiW (lpString1=".bz2", lpString2="8[1]") returned -1 [0203.280] lstrlenW (lpString=".7z") returned 3 [0203.280] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.280] lstrlenW (lpString=".dbf") returned 4 [0203.280] lstrcmpiW (lpString1=".dbf", lpString2="8[1]") returned -1 [0203.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.280] lstrlenW (lpString=".1cd") returned 4 [0203.280] lstrcmpiW (lpString1=".1cd", lpString2="8[1]") returned -1 [0203.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.280] lstrlenW (lpString=".jpg") returned 4 [0203.280] lstrcmpiW (lpString1=".jpg", lpString2="8[1]") returned -1 [0203.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.280] lstrlenW (lpString=".doc") returned 4 [0203.280] lstrcmpiW (lpString1=".doc", lpString2="8[1]") returned -1 [0203.280] lstrlenW (lpString=".docx") returned 5 [0203.280] lstrcmpiW (lpString1=".docx", lpString2="48[1]") returned -1 [0203.280] lstrlenW (lpString=".pdf") returned 4 [0203.280] lstrcmpiW (lpString1=".pdf", lpString2="8[1]") returned -1 [0203.280] lstrlenW (lpString=".xls") returned 4 [0203.280] lstrcmpiW (lpString1=".xls", lpString2="8[1]") returned -1 [0203.280] lstrlenW (lpString=".xlsx") returned 5 [0203.280] lstrcmpiW (lpString1=".xlsx", lpString2="48[1]") returned -1 [0203.280] lstrlenW (lpString=".ppt") returned 4 [0203.280] lstrcmpiW (lpString1=".ppt", lpString2="8[1]") returned -1 [0203.280] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.281] lstrlenW (lpString=".zip") returned 4 [0203.281] lstrcmpiW (lpString1=".zip", lpString2="8[1]") returned -1 [0203.281] lstrlenW (lpString=".rar") returned 4 [0203.281] lstrcmpiW (lpString1=".rar", lpString2="8[1]") returned -1 [0203.281] lstrlenW (lpString=".bz2") returned 4 [0203.281] lstrcmpiW (lpString1=".bz2", lpString2="8[1]") returned -1 [0203.281] lstrlenW (lpString=".7z") returned 3 [0203.281] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.281] lstrlenW (lpString=".dbf") returned 4 [0203.281] lstrcmpiW (lpString1=".dbf", lpString2="8[1]") returned -1 [0203.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.281] lstrlenW (lpString=".1cd") returned 4 [0203.281] lstrcmpiW (lpString1=".1cd", lpString2="8[1]") returned -1 [0203.281] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\ABV8L7MY\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1B;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=3;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.281] lstrlenW (lpString=".jpg") returned 4 [0203.281] lstrcmpiW (lpString1=".jpg", lpString2="8[1]") returned -1 [0203.281] lstrcmpiW (lpString1=".IE5\\IKQEEPZR\\adfscript[1]", lpString2=".wiki") returned -1 [0203.281] lstrlenW (lpString="adfscript[1]") returned 12 [0203.281] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfscript[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.295] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=10352) returned 1 [0203.295] CloseHandle (hObject=0x354) returned 1 [0203.295] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfscript[1]")) returned 0x2020 [0203.295] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfscript[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfscript[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.295] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.295] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.295] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfscript[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.296] GetLastError () returned 0x0 [0203.296] ReadFile (in: hFile=0x354, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x2870, lpOverlapped=0x0) returned 1 [0203.298] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x2880, lpOverlapped=0x0) returned 1 [0203.299] ReadFile (in: hFile=0x354, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.299] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xec, lpOverlapped=0x0) returned 1 [0203.299] SetEndOfFile (hFile=0x350) returned 1 [0203.299] CloseHandle (hObject=0x350) returned 1 [0203.299] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.299] SetEndOfFile (hFile=0x354) returned 1 [0203.300] CloseHandle (hObject=0x354) returned 1 [0203.300] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.300] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\adfscript[1]")) returned 1 [0203.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.300] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.300] lstrlenW (lpString=".doc") returned 4 [0203.300] lstrcmpiW (lpString1=".doc", lpString2="t[1]") returned -1 [0203.300] lstrlenW (lpString=".docx") returned 5 [0203.300] lstrcmpiW (lpString1=".docx", lpString2="pt[1]") returned -1 [0203.300] lstrlenW (lpString=".pdf") returned 4 [0203.300] lstrcmpiW (lpString1=".pdf", lpString2="t[1]") returned -1 [0203.300] lstrlenW (lpString=".xls") returned 4 [0203.300] lstrcmpiW (lpString1=".xls", lpString2="t[1]") returned -1 [0203.300] lstrlenW (lpString=".xlsx") returned 5 [0203.301] lstrcmpiW (lpString1=".xlsx", lpString2="pt[1]") returned -1 [0203.301] lstrlenW (lpString=".ppt") returned 4 [0203.301] lstrcmpiW (lpString1=".ppt", lpString2="t[1]") returned -1 [0203.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.301] lstrlenW (lpString=".zip") returned 4 [0203.301] lstrcmpiW (lpString1=".zip", lpString2="t[1]") returned -1 [0203.301] lstrlenW (lpString=".rar") returned 4 [0203.301] lstrcmpiW (lpString1=".rar", lpString2="t[1]") returned -1 [0203.301] lstrlenW (lpString=".bz2") returned 4 [0203.301] lstrcmpiW (lpString1=".bz2", lpString2="t[1]") returned -1 [0203.301] lstrlenW (lpString=".7z") returned 3 [0203.301] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.301] lstrlenW (lpString=".dbf") returned 4 [0203.301] lstrcmpiW (lpString1=".dbf", lpString2="t[1]") returned -1 [0203.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.301] lstrlenW (lpString=".1cd") returned 4 [0203.301] lstrcmpiW (lpString1=".1cd", lpString2="t[1]") returned -1 [0203.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.301] lstrlenW (lpString=".jpg") returned 4 [0203.301] lstrcmpiW (lpString1=".jpg", lpString2="t[1]") returned -1 [0203.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.301] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.301] lstrlenW (lpString=".doc") returned 4 [0203.301] lstrcmpiW (lpString1=".doc", lpString2="t[1]") returned -1 [0203.301] lstrlenW (lpString=".docx") returned 5 [0203.301] lstrcmpiW (lpString1=".docx", lpString2="pt[1]") returned -1 [0203.301] lstrlenW (lpString=".pdf") returned 4 [0203.301] lstrcmpiW (lpString1=".pdf", lpString2="t[1]") returned -1 [0203.301] lstrlenW (lpString=".xls") returned 4 [0203.301] lstrcmpiW (lpString1=".xls", lpString2="t[1]") returned -1 [0203.301] lstrlenW (lpString=".xlsx") returned 5 [0203.301] lstrcmpiW (lpString1=".xlsx", lpString2="pt[1]") returned -1 [0203.301] lstrlenW (lpString=".ppt") returned 4 [0203.302] lstrcmpiW (lpString1=".ppt", lpString2="t[1]") returned -1 [0203.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.302] lstrlenW (lpString=".zip") returned 4 [0203.302] lstrcmpiW (lpString1=".zip", lpString2="t[1]") returned -1 [0203.302] lstrlenW (lpString=".rar") returned 4 [0203.302] lstrcmpiW (lpString1=".rar", lpString2="t[1]") returned -1 [0203.302] lstrlenW (lpString=".bz2") returned 4 [0203.302] lstrcmpiW (lpString1=".bz2", lpString2="t[1]") returned -1 [0203.302] lstrlenW (lpString=".7z") returned 3 [0203.302] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.302] lstrlenW (lpString=".dbf") returned 4 [0203.302] lstrcmpiW (lpString1=".dbf", lpString2="t[1]") returned -1 [0203.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.302] lstrlenW (lpString=".1cd") returned 4 [0203.302] lstrcmpiW (lpString1=".1cd", lpString2="t[1]") returned -1 [0203.302] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\adfscript[1]") returned 124 [0203.302] lstrlenW (lpString=".jpg") returned 4 [0203.302] lstrcmpiW (lpString1=".jpg", lpString2="t[1]") returned -1 [0203.302] lstrcmpiW (lpString1=".IE5\\IKQEEPZR\\async_usersync[1]", lpString2=".wiki") returned -1 [0203.302] lstrlenW (lpString="async_usersync[1]") returned 17 [0203.302] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\async_usersync[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.303] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1347) returned 1 [0203.303] CloseHandle (hObject=0x354) returned 1 [0203.303] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\async_usersync[1]")) returned 0x2020 [0203.303] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\async_usersync[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\async_usersync[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.303] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.303] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.303] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\async_usersync[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.304] GetLastError () returned 0x0 [0203.304] ReadFile (in: hFile=0x354, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x543, lpOverlapped=0x0) returned 1 [0203.305] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x550, lpOverlapped=0x0) returned 1 [0203.306] ReadFile (in: hFile=0x354, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.306] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xf6, lpOverlapped=0x0) returned 1 [0203.306] SetEndOfFile (hFile=0x350) returned 1 [0203.306] CloseHandle (hObject=0x350) returned 1 [0203.306] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.306] SetEndOfFile (hFile=0x354) returned 1 [0203.307] CloseHandle (hObject=0x354) returned 1 [0203.307] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.307] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\async_usersync[1]")) returned 1 [0203.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.308] lstrlenW (lpString=".doc") returned 4 [0203.308] lstrcmpiW (lpString1=".doc", lpString2="c[1]") returned -1 [0203.308] lstrlenW (lpString=".docx") returned 5 [0203.308] lstrcmpiW (lpString1=".docx", lpString2="nc[1]") returned -1 [0203.308] lstrlenW (lpString=".pdf") returned 4 [0203.308] lstrcmpiW (lpString1=".pdf", lpString2="c[1]") returned -1 [0203.308] lstrlenW (lpString=".xls") returned 4 [0203.308] lstrcmpiW (lpString1=".xls", lpString2="c[1]") returned -1 [0203.308] lstrlenW (lpString=".xlsx") returned 5 [0203.308] lstrcmpiW (lpString1=".xlsx", lpString2="nc[1]") returned -1 [0203.308] lstrlenW (lpString=".ppt") returned 4 [0203.308] lstrcmpiW (lpString1=".ppt", lpString2="c[1]") returned -1 [0203.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.308] lstrlenW (lpString=".zip") returned 4 [0203.308] lstrcmpiW (lpString1=".zip", lpString2="c[1]") returned -1 [0203.308] lstrlenW (lpString=".rar") returned 4 [0203.308] lstrcmpiW (lpString1=".rar", lpString2="c[1]") returned -1 [0203.308] lstrlenW (lpString=".bz2") returned 4 [0203.308] lstrcmpiW (lpString1=".bz2", lpString2="c[1]") returned -1 [0203.308] lstrlenW (lpString=".7z") returned 3 [0203.308] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.308] lstrlenW (lpString=".dbf") returned 4 [0203.308] lstrcmpiW (lpString1=".dbf", lpString2="c[1]") returned -1 [0203.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.308] lstrlenW (lpString=".1cd") returned 4 [0203.308] lstrcmpiW (lpString1=".1cd", lpString2="c[1]") returned -1 [0203.308] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.308] lstrlenW (lpString=".jpg") returned 4 [0203.308] lstrcmpiW (lpString1=".jpg", lpString2="c[1]") returned -1 [0203.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.309] lstrlenW (lpString=".doc") returned 4 [0203.309] lstrcmpiW (lpString1=".doc", lpString2="c[1]") returned -1 [0203.309] lstrlenW (lpString=".docx") returned 5 [0203.309] lstrcmpiW (lpString1=".docx", lpString2="nc[1]") returned -1 [0203.309] lstrlenW (lpString=".pdf") returned 4 [0203.309] lstrcmpiW (lpString1=".pdf", lpString2="c[1]") returned -1 [0203.309] lstrlenW (lpString=".xls") returned 4 [0203.309] lstrcmpiW (lpString1=".xls", lpString2="c[1]") returned -1 [0203.309] lstrlenW (lpString=".xlsx") returned 5 [0203.309] lstrcmpiW (lpString1=".xlsx", lpString2="nc[1]") returned -1 [0203.309] lstrlenW (lpString=".ppt") returned 4 [0203.309] lstrcmpiW (lpString1=".ppt", lpString2="c[1]") returned -1 [0203.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.309] lstrlenW (lpString=".zip") returned 4 [0203.309] lstrcmpiW (lpString1=".zip", lpString2="c[1]") returned -1 [0203.309] lstrlenW (lpString=".rar") returned 4 [0203.309] lstrcmpiW (lpString1=".rar", lpString2="c[1]") returned -1 [0203.309] lstrlenW (lpString=".bz2") returned 4 [0203.309] lstrcmpiW (lpString1=".bz2", lpString2="c[1]") returned -1 [0203.309] lstrlenW (lpString=".7z") returned 3 [0203.309] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.309] lstrlenW (lpString=".dbf") returned 4 [0203.309] lstrcmpiW (lpString1=".dbf", lpString2="c[1]") returned -1 [0203.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.309] lstrlenW (lpString=".1cd") returned 4 [0203.309] lstrcmpiW (lpString1=".1cd", lpString2="c[1]") returned -1 [0203.309] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\async_usersync[1]") returned 129 [0203.309] lstrlenW (lpString=".jpg") returned 4 [0203.309] lstrcmpiW (lpString1=".jpg", lpString2="c[1]") returned -1 [0203.310] lstrcmpiW (lpString1=".eot", lpString2=".wiki") returned -1 [0203.310] lstrlenW (lpString="b2fd15[1].eot") returned 13 [0203.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.310] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=34534) returned 1 [0203.310] CloseHandle (hObject=0x354) returned 1 [0203.310] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot")) returned 0x2020 [0203.310] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.310] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.311] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.311] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.311] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.311] GetLastError () returned 0x0 [0203.311] ReadFile (in: hFile=0x354, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x86e6, lpOverlapped=0x0) returned 1 [0203.314] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x86f0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x86f0, lpOverlapped=0x0) returned 1 [0203.315] ReadFile (in: hFile=0x354, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.315] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xee, lpOverlapped=0x0) returned 1 [0203.315] SetEndOfFile (hFile=0x350) returned 1 [0203.315] CloseHandle (hObject=0x350) returned 1 [0203.316] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.316] SetEndOfFile (hFile=0x354) returned 1 [0203.316] CloseHandle (hObject=0x354) returned 1 [0203.317] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.317] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\b2fd15[1].eot")) returned 1 [0203.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.317] lstrlenW (lpString=".doc") returned 4 [0203.317] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.317] lstrlenW (lpString=".docx") returned 5 [0203.317] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.317] lstrlenW (lpString=".pdf") returned 4 [0203.317] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.317] lstrlenW (lpString=".xls") returned 4 [0203.317] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.317] lstrlenW (lpString=".xlsx") returned 5 [0203.317] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.317] lstrlenW (lpString=".ppt") returned 4 [0203.317] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.317] lstrlenW (lpString=".zip") returned 4 [0203.317] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.317] lstrlenW (lpString=".rar") returned 4 [0203.317] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.317] lstrlenW (lpString=".bz2") returned 4 [0203.317] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.317] lstrlenW (lpString=".7z") returned 3 [0203.317] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.317] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.318] lstrlenW (lpString=".dbf") returned 4 [0203.318] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.318] lstrlenW (lpString=".1cd") returned 4 [0203.318] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.318] lstrlenW (lpString=".jpg") returned 4 [0203.318] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.318] lstrlenW (lpString=".doc") returned 4 [0203.318] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.318] lstrlenW (lpString=".docx") returned 5 [0203.318] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.318] lstrlenW (lpString=".pdf") returned 4 [0203.318] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.318] lstrlenW (lpString=".xls") returned 4 [0203.318] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.318] lstrlenW (lpString=".xlsx") returned 5 [0203.318] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.318] lstrlenW (lpString=".ppt") returned 4 [0203.318] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.318] lstrlenW (lpString=".zip") returned 4 [0203.318] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.318] lstrlenW (lpString=".rar") returned 4 [0203.318] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.318] lstrlenW (lpString=".bz2") returned 4 [0203.318] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.318] lstrlenW (lpString=".7z") returned 3 [0203.318] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.318] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.318] lstrlenW (lpString=".dbf") returned 4 [0203.318] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.319] lstrlenW (lpString=".1cd") returned 4 [0203.319] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.319] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\b2fd15[1].eot") returned 125 [0203.319] lstrlenW (lpString=".jpg") returned 4 [0203.319] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.319] lstrcmpiW (lpString1=".loaded_0", lpString2=".wiki") returned -1 [0203.319] lstrlenW (lpString="cb=gapi[1].loaded_0") returned 19 [0203.319] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.319] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=135645) returned 1 [0203.319] CloseHandle (hObject=0x354) returned 1 [0203.319] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0")) returned 0x2020 [0203.319] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.320] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.320] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.320] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.320] GetLastError () returned 0x0 [0203.320] ReadFile (in: hFile=0x354, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x211dd, lpOverlapped=0x0) returned 1 [0203.324] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x211e0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x211e0, lpOverlapped=0x0) returned 1 [0203.363] ReadFile (in: hFile=0x354, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.363] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xfa, lpOverlapped=0x0) returned 1 [0203.363] SetEndOfFile (hFile=0x350) returned 1 [0203.363] CloseHandle (hObject=0x350) returned 1 [0203.364] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.364] SetEndOfFile (hFile=0x354) returned 1 [0203.365] CloseHandle (hObject=0x354) returned 1 [0203.365] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.365] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\cb=gapi[1].loaded_0")) returned 1 [0203.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.365] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.365] lstrlenW (lpString=".doc") returned 4 [0203.365] lstrcmpiW (lpString1=".doc", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString=".docx") returned 5 [0203.366] lstrcmpiW (lpString1=".docx", lpString2="ded_0") returned -1 [0203.366] lstrlenW (lpString=".pdf") returned 4 [0203.366] lstrcmpiW (lpString1=".pdf", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString=".xls") returned 4 [0203.366] lstrcmpiW (lpString1=".xls", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString=".xlsx") returned 5 [0203.366] lstrcmpiW (lpString1=".xlsx", lpString2="ded_0") returned -1 [0203.366] lstrlenW (lpString=".ppt") returned 4 [0203.366] lstrcmpiW (lpString1=".ppt", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.366] lstrlenW (lpString=".zip") returned 4 [0203.366] lstrcmpiW (lpString1=".zip", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString=".rar") returned 4 [0203.366] lstrcmpiW (lpString1=".rar", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString=".bz2") returned 4 [0203.366] lstrcmpiW (lpString1=".bz2", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString=".7z") returned 3 [0203.366] lstrcmpiW (lpString1=".7z", lpString2="d_0") returned -1 [0203.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.366] lstrlenW (lpString=".dbf") returned 4 [0203.366] lstrcmpiW (lpString1=".dbf", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.366] lstrlenW (lpString=".1cd") returned 4 [0203.366] lstrcmpiW (lpString1=".1cd", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.366] lstrlenW (lpString=".jpg") returned 4 [0203.366] lstrcmpiW (lpString1=".jpg", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.366] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.366] lstrlenW (lpString=".doc") returned 4 [0203.366] lstrcmpiW (lpString1=".doc", lpString2="ed_0") returned -1 [0203.366] lstrlenW (lpString=".docx") returned 5 [0203.367] lstrcmpiW (lpString1=".docx", lpString2="ded_0") returned -1 [0203.367] lstrlenW (lpString=".pdf") returned 4 [0203.367] lstrcmpiW (lpString1=".pdf", lpString2="ed_0") returned -1 [0203.367] lstrlenW (lpString=".xls") returned 4 [0203.367] lstrcmpiW (lpString1=".xls", lpString2="ed_0") returned -1 [0203.367] lstrlenW (lpString=".xlsx") returned 5 [0203.367] lstrcmpiW (lpString1=".xlsx", lpString2="ded_0") returned -1 [0203.367] lstrlenW (lpString=".ppt") returned 4 [0203.367] lstrcmpiW (lpString1=".ppt", lpString2="ed_0") returned -1 [0203.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.367] lstrlenW (lpString=".zip") returned 4 [0203.367] lstrcmpiW (lpString1=".zip", lpString2="ed_0") returned -1 [0203.367] lstrlenW (lpString=".rar") returned 4 [0203.367] lstrcmpiW (lpString1=".rar", lpString2="ed_0") returned -1 [0203.367] lstrlenW (lpString=".bz2") returned 4 [0203.367] lstrcmpiW (lpString1=".bz2", lpString2="ed_0") returned -1 [0203.367] lstrlenW (lpString=".7z") returned 3 [0203.367] lstrcmpiW (lpString1=".7z", lpString2="d_0") returned -1 [0203.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.367] lstrlenW (lpString=".dbf") returned 4 [0203.367] lstrcmpiW (lpString1=".dbf", lpString2="ed_0") returned -1 [0203.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.367] lstrlenW (lpString=".1cd") returned 4 [0203.367] lstrcmpiW (lpString1=".1cd", lpString2="ed_0") returned -1 [0203.367] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\cb=gapi[1].loaded_0") returned 131 [0203.367] lstrlenW (lpString=".jpg") returned 4 [0203.367] lstrcmpiW (lpString1=".jpg", lpString2="ed_0") returned -1 [0203.367] lstrcmpiW (lpString1=".IE5\\IKQEEPZR\\js[2]", lpString2=".wiki") returned -1 [0203.367] lstrlenW (lpString="js[2]") returned 5 [0203.367] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[2]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.368] GetFileSizeEx (in: hFile=0x354, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1378) returned 1 [0203.368] CloseHandle (hObject=0x354) returned 1 [0203.368] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[2]")) returned 0x2020 [0203.368] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[2].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[2]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x354 [0203.368] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.368] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.368] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[2].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.369] GetLastError () returned 0x0 [0203.369] ReadFile (in: hFile=0x354, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x562, lpOverlapped=0x0) returned 1 [0203.373] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x570, lpOverlapped=0x0) returned 1 [0203.374] ReadFile (in: hFile=0x354, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.374] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xde, lpOverlapped=0x0) returned 1 [0203.374] SetEndOfFile (hFile=0x350) returned 1 [0203.374] CloseHandle (hObject=0x350) returned 1 [0203.374] SetFilePointerEx (in: hFile=0x354, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.374] SetEndOfFile (hFile=0x354) returned 1 [0203.375] CloseHandle (hObject=0x354) returned 1 [0203.375] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.375] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\js[2]")) returned 1 [0203.376] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.376] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.376] lstrlenW (lpString=".doc") returned 4 [0203.376] lstrcmpiW (lpString1=".doc", lpString2="s[2]") returned -1 [0203.376] lstrlenW (lpString=".docx") returned 5 [0203.376] lstrcmpiW (lpString1=".docx", lpString2="js[2]") returned -1 [0203.376] lstrlenW (lpString=".pdf") returned 4 [0203.376] lstrcmpiW (lpString1=".pdf", lpString2="s[2]") returned -1 [0203.376] lstrlenW (lpString=".xls") returned 4 [0203.376] lstrcmpiW (lpString1=".xls", lpString2="s[2]") returned -1 [0203.376] lstrlenW (lpString=".xlsx") returned 5 [0203.376] lstrcmpiW (lpString1=".xlsx", lpString2="js[2]") returned -1 [0203.376] lstrlenW (lpString=".ppt") returned 4 [0203.376] lstrcmpiW (lpString1=".ppt", lpString2="s[2]") returned -1 [0203.376] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.376] lstrlenW (lpString=".zip") returned 4 [0203.376] lstrcmpiW (lpString1=".zip", lpString2="s[2]") returned -1 [0203.376] lstrlenW (lpString=".rar") returned 4 [0203.376] lstrcmpiW (lpString1=".rar", lpString2="s[2]") returned -1 [0203.376] lstrlenW (lpString=".bz2") returned 4 [0203.376] lstrcmpiW (lpString1=".bz2", lpString2="s[2]") returned -1 [0203.376] lstrlenW (lpString=".7z") returned 3 [0203.376] lstrcmpiW (lpString1=".7z", lpString2="[2]") returned -1 [0203.376] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.376] lstrlenW (lpString=".dbf") returned 4 [0203.376] lstrcmpiW (lpString1=".dbf", lpString2="s[2]") returned -1 [0203.376] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.376] lstrlenW (lpString=".1cd") returned 4 [0203.376] lstrcmpiW (lpString1=".1cd", lpString2="s[2]") returned -1 [0203.376] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.376] lstrlenW (lpString=".jpg") returned 4 [0203.376] lstrcmpiW (lpString1=".jpg", lpString2="s[2]") returned -1 [0203.377] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.377] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.377] lstrlenW (lpString=".doc") returned 4 [0203.377] lstrcmpiW (lpString1=".doc", lpString2="s[2]") returned -1 [0203.377] lstrlenW (lpString=".docx") returned 5 [0203.377] lstrcmpiW (lpString1=".docx", lpString2="js[2]") returned -1 [0203.377] lstrlenW (lpString=".pdf") returned 4 [0203.377] lstrcmpiW (lpString1=".pdf", lpString2="s[2]") returned -1 [0203.377] lstrlenW (lpString=".xls") returned 4 [0203.377] lstrcmpiW (lpString1=".xls", lpString2="s[2]") returned -1 [0203.377] lstrlenW (lpString=".xlsx") returned 5 [0203.377] lstrcmpiW (lpString1=".xlsx", lpString2="js[2]") returned -1 [0203.377] lstrlenW (lpString=".ppt") returned 4 [0203.377] lstrcmpiW (lpString1=".ppt", lpString2="s[2]") returned -1 [0203.377] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.377] lstrlenW (lpString=".zip") returned 4 [0203.377] lstrcmpiW (lpString1=".zip", lpString2="s[2]") returned -1 [0203.377] lstrlenW (lpString=".rar") returned 4 [0203.377] lstrcmpiW (lpString1=".rar", lpString2="s[2]") returned -1 [0203.377] lstrlenW (lpString=".bz2") returned 4 [0203.377] lstrcmpiW (lpString1=".bz2", lpString2="s[2]") returned -1 [0203.377] lstrlenW (lpString=".7z") returned 3 [0203.377] lstrcmpiW (lpString1=".7z", lpString2="[2]") returned -1 [0203.377] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.377] lstrlenW (lpString=".dbf") returned 4 [0203.377] lstrcmpiW (lpString1=".dbf", lpString2="s[2]") returned -1 [0203.377] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.377] lstrlenW (lpString=".1cd") returned 4 [0203.377] lstrcmpiW (lpString1=".1cd", lpString2="s[2]") returned -1 [0203.377] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\js[2]") returned 117 [0203.377] lstrlenW (lpString=".jpg") returned 4 [0203.377] lstrcmpiW (lpString1=".jpg", lpString2="s[2]") returned -1 [0203.378] lstrcmpiW (lpString1=".eot", lpString2=".wiki") returned -1 [0203.378] lstrlenW (lpString="latest[1].eot") returned 13 [0203.378] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.459] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=31299) returned 1 [0203.459] CloseHandle (hObject=0x350) returned 1 [0203.459] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot")) returned 0x2020 [0203.459] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.459] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.460] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.471] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.477] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.480] GetLastError () returned 0x0 [0203.488] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x7a43, lpOverlapped=0x0) returned 1 [0203.490] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x7a50, lpOverlapped=0x0) returned 1 [0203.492] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.492] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xee, lpOverlapped=0x0) returned 1 [0203.492] SetEndOfFile (hFile=0x34c) returned 1 [0203.492] CloseHandle (hObject=0x34c) returned 1 [0203.492] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.492] SetEndOfFile (hFile=0x350) returned 1 [0203.493] CloseHandle (hObject=0x350) returned 1 [0203.493] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.493] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\ikqeepzr\\latest[1].eot")) returned 1 [0203.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.493] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.493] lstrlenW (lpString=".doc") returned 4 [0203.493] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.493] lstrlenW (lpString=".docx") returned 5 [0203.493] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.493] lstrlenW (lpString=".pdf") returned 4 [0203.493] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.494] lstrlenW (lpString=".xls") returned 4 [0203.494] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.494] lstrlenW (lpString=".xlsx") returned 5 [0203.494] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.494] lstrlenW (lpString=".ppt") returned 4 [0203.494] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.494] lstrlenW (lpString=".zip") returned 4 [0203.494] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.494] lstrlenW (lpString=".rar") returned 4 [0203.494] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.494] lstrlenW (lpString=".bz2") returned 4 [0203.494] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.494] lstrlenW (lpString=".7z") returned 3 [0203.494] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.494] lstrlenW (lpString=".dbf") returned 4 [0203.494] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.494] lstrlenW (lpString=".1cd") returned 4 [0203.494] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.494] lstrlenW (lpString=".jpg") returned 4 [0203.494] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.494] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.494] lstrlenW (lpString=".doc") returned 4 [0203.494] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.494] lstrlenW (lpString=".docx") returned 5 [0203.494] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.494] lstrlenW (lpString=".pdf") returned 4 [0203.494] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.494] lstrlenW (lpString=".xls") returned 4 [0203.495] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.495] lstrlenW (lpString=".xlsx") returned 5 [0203.495] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.495] lstrlenW (lpString=".ppt") returned 4 [0203.495] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.495] lstrlenW (lpString=".zip") returned 4 [0203.495] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.495] lstrlenW (lpString=".rar") returned 4 [0203.495] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.495] lstrlenW (lpString=".bz2") returned 4 [0203.495] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.495] lstrlenW (lpString=".7z") returned 3 [0203.495] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.495] lstrlenW (lpString=".dbf") returned 4 [0203.495] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.495] lstrlenW (lpString=".1cd") returned 4 [0203.495] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.495] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\IKQEEPZR\\latest[1].eot") returned 125 [0203.495] lstrlenW (lpString=".jpg") returned 4 [0203.495] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.495] lstrcmpiW (lpString1=".IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]", lpString2=".wiki") returned -1 [0203.495] lstrlenW (lpString="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 146 [0203.495] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.529] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=2243) returned 1 [0203.529] CloseHandle (hObject=0x350) returned 1 [0203.529] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]")) returned 0x2020 [0203.529] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.529] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.529] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.529] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.529] CloseHandle (hObject=0x350) returned 1 [0203.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.529] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.529] lstrlenW (lpString=".doc") returned 4 [0203.529] lstrcmpiW (lpString1=".doc", lpString2="8[1]") returned -1 [0203.529] lstrlenW (lpString=".docx") returned 5 [0203.529] lstrcmpiW (lpString1=".docx", lpString2="48[1]") returned -1 [0203.529] lstrlenW (lpString=".pdf") returned 4 [0203.529] lstrcmpiW (lpString1=".pdf", lpString2="8[1]") returned -1 [0203.530] lstrlenW (lpString=".xls") returned 4 [0203.530] lstrcmpiW (lpString1=".xls", lpString2="8[1]") returned -1 [0203.530] lstrlenW (lpString=".xlsx") returned 5 [0203.530] lstrcmpiW (lpString1=".xlsx", lpString2="48[1]") returned -1 [0203.530] lstrlenW (lpString=".ppt") returned 4 [0203.530] lstrcmpiW (lpString1=".ppt", lpString2="8[1]") returned -1 [0203.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.530] lstrlenW (lpString=".zip") returned 4 [0203.530] lstrcmpiW (lpString1=".zip", lpString2="8[1]") returned -1 [0203.530] lstrlenW (lpString=".rar") returned 4 [0203.530] lstrcmpiW (lpString1=".rar", lpString2="8[1]") returned -1 [0203.530] lstrlenW (lpString=".bz2") returned 4 [0203.530] lstrcmpiW (lpString1=".bz2", lpString2="8[1]") returned -1 [0203.530] lstrlenW (lpString=".7z") returned 3 [0203.530] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.530] lstrlenW (lpString=".dbf") returned 4 [0203.530] lstrcmpiW (lpString1=".dbf", lpString2="8[1]") returned -1 [0203.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.530] lstrlenW (lpString=".1cd") returned 4 [0203.530] lstrcmpiW (lpString1=".1cd", lpString2="8[1]") returned -1 [0203.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.530] lstrlenW (lpString=".jpg") returned 4 [0203.530] lstrcmpiW (lpString1=".jpg", lpString2="8[1]") returned -1 [0203.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.530] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.530] lstrlenW (lpString=".doc") returned 4 [0203.530] lstrcmpiW (lpString1=".doc", lpString2="8[1]") returned -1 [0203.530] lstrlenW (lpString=".docx") returned 5 [0203.530] lstrcmpiW (lpString1=".docx", lpString2="48[1]") returned -1 [0203.530] lstrlenW (lpString=".pdf") returned 4 [0203.530] lstrcmpiW (lpString1=".pdf", lpString2="8[1]") returned -1 [0203.531] lstrlenW (lpString=".xls") returned 4 [0203.531] lstrcmpiW (lpString1=".xls", lpString2="8[1]") returned -1 [0203.531] lstrlenW (lpString=".xlsx") returned 5 [0203.531] lstrcmpiW (lpString1=".xlsx", lpString2="48[1]") returned -1 [0203.531] lstrlenW (lpString=".ppt") returned 4 [0203.531] lstrcmpiW (lpString1=".ppt", lpString2="8[1]") returned -1 [0203.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.531] lstrlenW (lpString=".zip") returned 4 [0203.531] lstrcmpiW (lpString1=".zip", lpString2="8[1]") returned -1 [0203.531] lstrlenW (lpString=".rar") returned 4 [0203.531] lstrcmpiW (lpString1=".rar", lpString2="8[1]") returned -1 [0203.531] lstrlenW (lpString=".bz2") returned 4 [0203.531] lstrcmpiW (lpString1=".bz2", lpString2="8[1]") returned -1 [0203.531] lstrlenW (lpString=".7z") returned 3 [0203.531] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.531] lstrlenW (lpString=".dbf") returned 4 [0203.531] lstrcmpiW (lpString1=".dbf", lpString2="8[1]") returned -1 [0203.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.531] lstrlenW (lpString=".1cd") returned 4 [0203.531] lstrcmpiW (lpString1=".1cd", lpString2="8[1]") returned -1 [0203.531] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=627518548;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=627518548[1]") returned 258 [0203.531] lstrlenW (lpString=".jpg") returned 4 [0203.531] lstrcmpiW (lpString1=".jpg", lpString2="8[1]") returned -1 [0203.531] lstrcmpiW (lpString1=".IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]", lpString2=".wiki") returned -1 [0203.531] lstrlenW (lpString="getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 146 [0203.531] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.532] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=2418) returned 1 [0203.532] CloseHandle (hObject=0x350) returned 1 [0203.532] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]")) returned 0x2020 [0203.532] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.532] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.533] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.533] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.533] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\getype=homepage;kvpg=msn%2fde-de;kvugc=0;kvmn=msndede1c;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0203.533] CloseHandle (hObject=0x350) returned 1 [0203.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.533] lstrlenW (lpString=".doc") returned 4 [0203.533] lstrcmpiW (lpString1=".doc", lpString2="9[1]") returned -1 [0203.533] lstrlenW (lpString=".docx") returned 5 [0203.533] lstrcmpiW (lpString1=".docx", lpString2="99[1]") returned -1 [0203.533] lstrlenW (lpString=".pdf") returned 4 [0203.533] lstrcmpiW (lpString1=".pdf", lpString2="9[1]") returned -1 [0203.533] lstrlenW (lpString=".xls") returned 4 [0203.533] lstrcmpiW (lpString1=".xls", lpString2="9[1]") returned -1 [0203.533] lstrlenW (lpString=".xlsx") returned 5 [0203.533] lstrcmpiW (lpString1=".xlsx", lpString2="99[1]") returned -1 [0203.533] lstrlenW (lpString=".ppt") returned 4 [0203.533] lstrcmpiW (lpString1=".ppt", lpString2="9[1]") returned -1 [0203.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.533] lstrlenW (lpString=".zip") returned 4 [0203.533] lstrcmpiW (lpString1=".zip", lpString2="9[1]") returned -1 [0203.533] lstrlenW (lpString=".rar") returned 4 [0203.533] lstrcmpiW (lpString1=".rar", lpString2="9[1]") returned -1 [0203.533] lstrlenW (lpString=".bz2") returned 4 [0203.533] lstrcmpiW (lpString1=".bz2", lpString2="9[1]") returned -1 [0203.533] lstrlenW (lpString=".7z") returned 3 [0203.533] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.533] lstrlenW (lpString=".dbf") returned 4 [0203.533] lstrcmpiW (lpString1=".dbf", lpString2="9[1]") returned -1 [0203.533] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.534] lstrlenW (lpString=".1cd") returned 4 [0203.534] lstrcmpiW (lpString1=".1cd", lpString2="9[1]") returned -1 [0203.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.534] lstrlenW (lpString=".jpg") returned 4 [0203.534] lstrcmpiW (lpString1=".jpg", lpString2="9[1]") returned -1 [0203.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.534] lstrlenW (lpString=".doc") returned 4 [0203.534] lstrcmpiW (lpString1=".doc", lpString2="9[1]") returned -1 [0203.534] lstrlenW (lpString=".docx") returned 5 [0203.534] lstrcmpiW (lpString1=".docx", lpString2="99[1]") returned -1 [0203.534] lstrlenW (lpString=".pdf") returned 4 [0203.534] lstrcmpiW (lpString1=".pdf", lpString2="9[1]") returned -1 [0203.534] lstrlenW (lpString=".xls") returned 4 [0203.534] lstrcmpiW (lpString1=".xls", lpString2="9[1]") returned -1 [0203.534] lstrlenW (lpString=".xlsx") returned 5 [0203.534] lstrcmpiW (lpString1=".xlsx", lpString2="99[1]") returned -1 [0203.534] lstrlenW (lpString=".ppt") returned 4 [0203.534] lstrcmpiW (lpString1=".ppt", lpString2="9[1]") returned -1 [0203.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.534] lstrlenW (lpString=".zip") returned 4 [0203.534] lstrcmpiW (lpString1=".zip", lpString2="9[1]") returned -1 [0203.534] lstrlenW (lpString=".rar") returned 4 [0203.534] lstrcmpiW (lpString1=".rar", lpString2="9[1]") returned -1 [0203.534] lstrlenW (lpString=".bz2") returned 4 [0203.534] lstrcmpiW (lpString1=".bz2", lpString2="9[1]") returned -1 [0203.534] lstrlenW (lpString=".7z") returned 3 [0203.534] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.534] lstrlenW (lpString=".dbf") returned 4 [0203.534] lstrcmpiW (lpString1=".dbf", lpString2="9[1]") returned -1 [0203.534] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.535] lstrlenW (lpString=".1cd") returned 4 [0203.535] lstrcmpiW (lpString1=".1cd", lpString2="9[1]") returned -1 [0203.535] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\getype=homepage;kvpg=msn%2Fde-de;kvugc=0;kvmn=MSNDEDE1C;kvgrp=852361999;kvismob=2;extmirroring=0;kvtile=4;target=_blank;aduho=600;grp=852361999[1]") returned 258 [0203.535] lstrlenW (lpString=".jpg") returned 4 [0203.535] lstrcmpiW (lpString1=".jpg", lpString2="9[1]") returned -1 [0203.535] lstrcmpiW (lpString1=".IE5\\YG1R61Z8\\js[1]", lpString2=".wiki") returned -1 [0203.535] lstrlenW (lpString="js[1]") returned 5 [0203.535] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[1]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.535] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1208) returned 1 [0203.535] CloseHandle (hObject=0x350) returned 1 [0203.535] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[1]")) returned 0x2020 [0203.535] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[1].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[1]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.536] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.536] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.536] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[1].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.536] GetLastError () returned 0x0 [0203.536] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x4b8, lpOverlapped=0x0) returned 1 [0203.538] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0203.539] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.539] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xde, lpOverlapped=0x0) returned 1 [0203.539] SetEndOfFile (hFile=0x34c) returned 1 [0203.539] CloseHandle (hObject=0x34c) returned 1 [0203.539] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.539] SetEndOfFile (hFile=0x350) returned 1 [0203.540] CloseHandle (hObject=0x350) returned 1 [0203.540] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.540] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[1]")) returned 1 [0203.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.540] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.540] lstrlenW (lpString=".doc") returned 4 [0203.540] lstrcmpiW (lpString1=".doc", lpString2="s[1]") returned -1 [0203.540] lstrlenW (lpString=".docx") returned 5 [0203.540] lstrcmpiW (lpString1=".docx", lpString2="js[1]") returned -1 [0203.540] lstrlenW (lpString=".pdf") returned 4 [0203.540] lstrcmpiW (lpString1=".pdf", lpString2="s[1]") returned -1 [0203.541] lstrlenW (lpString=".xls") returned 4 [0203.541] lstrcmpiW (lpString1=".xls", lpString2="s[1]") returned -1 [0203.541] lstrlenW (lpString=".xlsx") returned 5 [0203.541] lstrcmpiW (lpString1=".xlsx", lpString2="js[1]") returned -1 [0203.541] lstrlenW (lpString=".ppt") returned 4 [0203.541] lstrcmpiW (lpString1=".ppt", lpString2="s[1]") returned -1 [0203.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.541] lstrlenW (lpString=".zip") returned 4 [0203.541] lstrcmpiW (lpString1=".zip", lpString2="s[1]") returned -1 [0203.541] lstrlenW (lpString=".rar") returned 4 [0203.541] lstrcmpiW (lpString1=".rar", lpString2="s[1]") returned -1 [0203.541] lstrlenW (lpString=".bz2") returned 4 [0203.541] lstrcmpiW (lpString1=".bz2", lpString2="s[1]") returned -1 [0203.541] lstrlenW (lpString=".7z") returned 3 [0203.541] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.541] lstrlenW (lpString=".dbf") returned 4 [0203.541] lstrcmpiW (lpString1=".dbf", lpString2="s[1]") returned -1 [0203.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.541] lstrlenW (lpString=".1cd") returned 4 [0203.541] lstrcmpiW (lpString1=".1cd", lpString2="s[1]") returned -1 [0203.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.541] lstrlenW (lpString=".jpg") returned 4 [0203.541] lstrcmpiW (lpString1=".jpg", lpString2="s[1]") returned -1 [0203.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.541] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.541] lstrlenW (lpString=".doc") returned 4 [0203.541] lstrcmpiW (lpString1=".doc", lpString2="s[1]") returned -1 [0203.541] lstrlenW (lpString=".docx") returned 5 [0203.541] lstrcmpiW (lpString1=".docx", lpString2="js[1]") returned -1 [0203.541] lstrlenW (lpString=".pdf") returned 4 [0203.541] lstrcmpiW (lpString1=".pdf", lpString2="s[1]") returned -1 [0203.542] lstrlenW (lpString=".xls") returned 4 [0203.542] lstrcmpiW (lpString1=".xls", lpString2="s[1]") returned -1 [0203.542] lstrlenW (lpString=".xlsx") returned 5 [0203.542] lstrcmpiW (lpString1=".xlsx", lpString2="js[1]") returned -1 [0203.542] lstrlenW (lpString=".ppt") returned 4 [0203.542] lstrcmpiW (lpString1=".ppt", lpString2="s[1]") returned -1 [0203.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.542] lstrlenW (lpString=".zip") returned 4 [0203.542] lstrcmpiW (lpString1=".zip", lpString2="s[1]") returned -1 [0203.542] lstrlenW (lpString=".rar") returned 4 [0203.542] lstrcmpiW (lpString1=".rar", lpString2="s[1]") returned -1 [0203.542] lstrlenW (lpString=".bz2") returned 4 [0203.542] lstrcmpiW (lpString1=".bz2", lpString2="s[1]") returned -1 [0203.542] lstrlenW (lpString=".7z") returned 3 [0203.542] lstrcmpiW (lpString1=".7z", lpString2="[1]") returned -1 [0203.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.542] lstrlenW (lpString=".dbf") returned 4 [0203.542] lstrcmpiW (lpString1=".dbf", lpString2="s[1]") returned -1 [0203.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.542] lstrlenW (lpString=".1cd") returned 4 [0203.542] lstrcmpiW (lpString1=".1cd", lpString2="s[1]") returned -1 [0203.542] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[1]") returned 117 [0203.542] lstrlenW (lpString=".jpg") returned 4 [0203.542] lstrcmpiW (lpString1=".jpg", lpString2="s[1]") returned -1 [0203.542] lstrcmpiW (lpString1=".IE5\\YG1R61Z8\\js[2]", lpString2=".wiki") returned -1 [0203.542] lstrlenW (lpString="js[2]") returned 5 [0203.542] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[2]"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.543] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=961) returned 1 [0203.543] CloseHandle (hObject=0x350) returned 1 [0203.543] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[2]")) returned 0x2020 [0203.544] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[2].id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[2]"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.544] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.544] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.544] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2].id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[2].id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.544] GetLastError () returned 0x0 [0203.544] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x3c1, lpOverlapped=0x0) returned 1 [0203.546] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0203.547] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.547] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xde, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xde, lpOverlapped=0x0) returned 1 [0203.547] SetEndOfFile (hFile=0x34c) returned 1 [0203.547] CloseHandle (hObject=0x34c) returned 1 [0203.547] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.547] SetEndOfFile (hFile=0x350) returned 1 [0203.548] CloseHandle (hObject=0x350) returned 1 [0203.548] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2].id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.548] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\js[2]")) returned 1 [0203.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.548] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.549] lstrlenW (lpString=".doc") returned 4 [0203.549] lstrcmpiW (lpString1=".doc", lpString2="s[2]") returned -1 [0203.549] lstrlenW (lpString=".docx") returned 5 [0203.549] lstrcmpiW (lpString1=".docx", lpString2="js[2]") returned -1 [0203.549] lstrlenW (lpString=".pdf") returned 4 [0203.549] lstrcmpiW (lpString1=".pdf", lpString2="s[2]") returned -1 [0203.549] lstrlenW (lpString=".xls") returned 4 [0203.549] lstrcmpiW (lpString1=".xls", lpString2="s[2]") returned -1 [0203.549] lstrlenW (lpString=".xlsx") returned 5 [0203.549] lstrcmpiW (lpString1=".xlsx", lpString2="js[2]") returned -1 [0203.549] lstrlenW (lpString=".ppt") returned 4 [0203.549] lstrcmpiW (lpString1=".ppt", lpString2="s[2]") returned -1 [0203.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.549] lstrlenW (lpString=".zip") returned 4 [0203.549] lstrcmpiW (lpString1=".zip", lpString2="s[2]") returned -1 [0203.549] lstrlenW (lpString=".rar") returned 4 [0203.549] lstrcmpiW (lpString1=".rar", lpString2="s[2]") returned -1 [0203.549] lstrlenW (lpString=".bz2") returned 4 [0203.549] lstrcmpiW (lpString1=".bz2", lpString2="s[2]") returned -1 [0203.549] lstrlenW (lpString=".7z") returned 3 [0203.549] lstrcmpiW (lpString1=".7z", lpString2="[2]") returned -1 [0203.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.549] lstrlenW (lpString=".dbf") returned 4 [0203.549] lstrcmpiW (lpString1=".dbf", lpString2="s[2]") returned -1 [0203.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.549] lstrlenW (lpString=".1cd") returned 4 [0203.549] lstrcmpiW (lpString1=".1cd", lpString2="s[2]") returned -1 [0203.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.549] lstrlenW (lpString=".jpg") returned 4 [0203.549] lstrcmpiW (lpString1=".jpg", lpString2="s[2]") returned -1 [0203.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.549] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.549] lstrlenW (lpString=".doc") returned 4 [0203.549] lstrcmpiW (lpString1=".doc", lpString2="s[2]") returned -1 [0203.550] lstrlenW (lpString=".docx") returned 5 [0203.550] lstrcmpiW (lpString1=".docx", lpString2="js[2]") returned -1 [0203.550] lstrlenW (lpString=".pdf") returned 4 [0203.550] lstrcmpiW (lpString1=".pdf", lpString2="s[2]") returned -1 [0203.550] lstrlenW (lpString=".xls") returned 4 [0203.550] lstrcmpiW (lpString1=".xls", lpString2="s[2]") returned -1 [0203.550] lstrlenW (lpString=".xlsx") returned 5 [0203.550] lstrcmpiW (lpString1=".xlsx", lpString2="js[2]") returned -1 [0203.550] lstrlenW (lpString=".ppt") returned 4 [0203.550] lstrcmpiW (lpString1=".ppt", lpString2="s[2]") returned -1 [0203.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.550] lstrlenW (lpString=".zip") returned 4 [0203.550] lstrcmpiW (lpString1=".zip", lpString2="s[2]") returned -1 [0203.550] lstrlenW (lpString=".rar") returned 4 [0203.550] lstrcmpiW (lpString1=".rar", lpString2="s[2]") returned -1 [0203.550] lstrlenW (lpString=".bz2") returned 4 [0203.550] lstrcmpiW (lpString1=".bz2", lpString2="s[2]") returned -1 [0203.550] lstrlenW (lpString=".7z") returned 3 [0203.550] lstrcmpiW (lpString1=".7z", lpString2="[2]") returned -1 [0203.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.550] lstrlenW (lpString=".dbf") returned 4 [0203.550] lstrcmpiW (lpString1=".dbf", lpString2="s[2]") returned -1 [0203.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.550] lstrlenW (lpString=".1cd") returned 4 [0203.550] lstrcmpiW (lpString1=".1cd", lpString2="s[2]") returned -1 [0203.550] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\js[2]") returned 117 [0203.550] lstrlenW (lpString=".jpg") returned 4 [0203.550] lstrcmpiW (lpString1=".jpg", lpString2="s[2]") returned -1 [0203.550] lstrcmpiW (lpString1=".eot", lpString2=".wiki") returned -1 [0203.550] lstrlenW (lpString="latest[1].eot") returned 13 [0203.551] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.551] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=29012) returned 1 [0203.551] CloseHandle (hObject=0x350) returned 1 [0203.552] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot")) returned 0x2020 [0203.552] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.552] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.552] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.552] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.552] GetLastError () returned 0x0 [0203.552] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x7154, lpOverlapped=0x0) returned 1 [0203.555] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x7160, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x7160, lpOverlapped=0x0) returned 1 [0203.556] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.556] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xee, lpOverlapped=0x0) returned 1 [0203.556] SetEndOfFile (hFile=0x34c) returned 1 [0203.556] CloseHandle (hObject=0x34c) returned 1 [0203.556] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.556] SetEndOfFile (hFile=0x350) returned 1 [0203.557] CloseHandle (hObject=0x350) returned 1 [0203.557] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.557] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[1].eot")) returned 1 [0203.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.557] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.558] lstrlenW (lpString=".doc") returned 4 [0203.558] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.558] lstrlenW (lpString=".docx") returned 5 [0203.558] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.558] lstrlenW (lpString=".pdf") returned 4 [0203.558] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.558] lstrlenW (lpString=".xls") returned 4 [0203.558] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.558] lstrlenW (lpString=".xlsx") returned 5 [0203.558] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.558] lstrlenW (lpString=".ppt") returned 4 [0203.558] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.558] lstrlenW (lpString=".zip") returned 4 [0203.558] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.558] lstrlenW (lpString=".rar") returned 4 [0203.558] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.558] lstrlenW (lpString=".bz2") returned 4 [0203.558] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.558] lstrlenW (lpString=".7z") returned 3 [0203.558] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.558] lstrlenW (lpString=".dbf") returned 4 [0203.558] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.558] lstrlenW (lpString=".1cd") returned 4 [0203.558] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.558] lstrlenW (lpString=".jpg") returned 4 [0203.558] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.558] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.558] lstrlenW (lpString=".doc") returned 4 [0203.558] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.559] lstrlenW (lpString=".docx") returned 5 [0203.559] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.559] lstrlenW (lpString=".pdf") returned 4 [0203.559] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.559] lstrlenW (lpString=".xls") returned 4 [0203.559] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.559] lstrlenW (lpString=".xlsx") returned 5 [0203.559] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.559] lstrlenW (lpString=".ppt") returned 4 [0203.559] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.559] lstrlenW (lpString=".zip") returned 4 [0203.559] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.559] lstrlenW (lpString=".rar") returned 4 [0203.559] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.559] lstrlenW (lpString=".bz2") returned 4 [0203.559] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.559] lstrlenW (lpString=".7z") returned 3 [0203.559] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.559] lstrlenW (lpString=".dbf") returned 4 [0203.559] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.559] lstrlenW (lpString=".1cd") returned 4 [0203.559] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.559] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[1].eot") returned 125 [0203.559] lstrlenW (lpString=".jpg") returned 4 [0203.559] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.559] lstrcmpiW (lpString1=".eot", lpString2=".wiki") returned -1 [0203.559] lstrlenW (lpString="latest[2].eot") returned 13 [0203.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.560] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=28315) returned 1 [0203.560] CloseHandle (hObject=0x350) returned 1 [0203.560] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot")) returned 0x2020 [0203.560] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.560] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.560] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.560] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.561] GetLastError () returned 0x0 [0203.561] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x6e9b, lpOverlapped=0x0) returned 1 [0203.563] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x6ea0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x6ea0, lpOverlapped=0x0) returned 1 [0203.564] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.564] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xee, lpOverlapped=0x0) returned 1 [0203.564] SetEndOfFile (hFile=0x34c) returned 1 [0203.564] CloseHandle (hObject=0x34c) returned 1 [0203.564] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.564] SetEndOfFile (hFile=0x350) returned 1 [0203.565] CloseHandle (hObject=0x350) returned 1 [0203.565] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.565] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[2].eot")) returned 1 [0203.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.566] lstrlenW (lpString=".doc") returned 4 [0203.566] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.566] lstrlenW (lpString=".docx") returned 5 [0203.566] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.566] lstrlenW (lpString=".pdf") returned 4 [0203.566] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.566] lstrlenW (lpString=".xls") returned 4 [0203.566] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.566] lstrlenW (lpString=".xlsx") returned 5 [0203.566] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.566] lstrlenW (lpString=".ppt") returned 4 [0203.566] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.566] lstrlenW (lpString=".zip") returned 4 [0203.566] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.566] lstrlenW (lpString=".rar") returned 4 [0203.566] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.566] lstrlenW (lpString=".bz2") returned 4 [0203.566] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.566] lstrlenW (lpString=".7z") returned 3 [0203.566] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.566] lstrlenW (lpString=".dbf") returned 4 [0203.566] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.566] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.566] lstrlenW (lpString=".1cd") returned 4 [0203.566] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.567] lstrlenW (lpString=".jpg") returned 4 [0203.567] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.567] lstrlenW (lpString=".doc") returned 4 [0203.567] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.567] lstrlenW (lpString=".docx") returned 5 [0203.567] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.567] lstrlenW (lpString=".pdf") returned 4 [0203.567] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.567] lstrlenW (lpString=".xls") returned 4 [0203.567] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.567] lstrlenW (lpString=".xlsx") returned 5 [0203.567] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.567] lstrlenW (lpString=".ppt") returned 4 [0203.567] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.567] lstrlenW (lpString=".zip") returned 4 [0203.567] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.567] lstrlenW (lpString=".rar") returned 4 [0203.567] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.567] lstrlenW (lpString=".bz2") returned 4 [0203.567] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.567] lstrlenW (lpString=".7z") returned 3 [0203.567] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.567] lstrlenW (lpString=".dbf") returned 4 [0203.567] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.567] lstrlenW (lpString=".1cd") returned 4 [0203.567] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.567] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[2].eot") returned 125 [0203.567] lstrlenW (lpString=".jpg") returned 4 [0203.568] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.568] lstrcmpiW (lpString1=".eot", lpString2=".wiki") returned -1 [0203.568] lstrlenW (lpString="latest[3].eot") returned 13 [0203.568] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.568] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=30643) returned 1 [0203.568] CloseHandle (hObject=0x350) returned 1 [0203.569] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot")) returned 0x2020 [0203.569] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.569] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.569] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.569] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.569] GetLastError () returned 0x0 [0203.569] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x77b3, lpOverlapped=0x0) returned 1 [0203.686] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x77c0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x77c0, lpOverlapped=0x0) returned 1 [0203.687] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.687] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xee, lpOverlapped=0x0) returned 1 [0203.687] SetEndOfFile (hFile=0x34c) returned 1 [0203.687] CloseHandle (hObject=0x34c) returned 1 [0203.687] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.687] SetEndOfFile (hFile=0x350) returned 1 [0203.688] CloseHandle (hObject=0x350) returned 1 [0203.688] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.688] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows\\temporary internet files\\low\\content.ie5\\yg1r61z8\\latest[3].eot")) returned 1 [0203.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.689] lstrlenW (lpString=".doc") returned 4 [0203.689] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.689] lstrlenW (lpString=".docx") returned 5 [0203.689] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.689] lstrlenW (lpString=".pdf") returned 4 [0203.689] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.689] lstrlenW (lpString=".xls") returned 4 [0203.689] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.689] lstrlenW (lpString=".xlsx") returned 5 [0203.689] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.689] lstrlenW (lpString=".ppt") returned 4 [0203.689] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.689] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.689] lstrlenW (lpString=".zip") returned 4 [0203.689] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.689] lstrlenW (lpString=".rar") returned 4 [0203.689] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.689] lstrlenW (lpString=".bz2") returned 4 [0203.689] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.689] lstrlenW (lpString=".7z") returned 3 [0203.689] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.690] lstrlenW (lpString=".dbf") returned 4 [0203.690] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.690] lstrlenW (lpString=".1cd") returned 4 [0203.690] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.690] lstrlenW (lpString=".jpg") returned 4 [0203.690] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.690] lstrlenW (lpString=".doc") returned 4 [0203.690] lstrcmpiW (lpString1=".doc", lpString2=".eot") returned -1 [0203.690] lstrlenW (lpString=".docx") returned 5 [0203.690] lstrcmpiW (lpString1=".docx", lpString2="].eot") returned -1 [0203.690] lstrlenW (lpString=".pdf") returned 4 [0203.690] lstrcmpiW (lpString1=".pdf", lpString2=".eot") returned 1 [0203.690] lstrlenW (lpString=".xls") returned 4 [0203.690] lstrcmpiW (lpString1=".xls", lpString2=".eot") returned 1 [0203.690] lstrlenW (lpString=".xlsx") returned 5 [0203.690] lstrcmpiW (lpString1=".xlsx", lpString2="].eot") returned -1 [0203.690] lstrlenW (lpString=".ppt") returned 4 [0203.690] lstrcmpiW (lpString1=".ppt", lpString2=".eot") returned 1 [0203.690] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.690] lstrlenW (lpString=".zip") returned 4 [0203.690] lstrcmpiW (lpString1=".zip", lpString2=".eot") returned 1 [0203.690] lstrlenW (lpString=".rar") returned 4 [0203.690] lstrcmpiW (lpString1=".rar", lpString2=".eot") returned 1 [0203.690] lstrlenW (lpString=".bz2") returned 4 [0203.690] lstrcmpiW (lpString1=".bz2", lpString2=".eot") returned -1 [0203.690] lstrlenW (lpString=".7z") returned 3 [0203.690] lstrcmpiW (lpString1=".7z", lpString2="eot") returned -1 [0203.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.691] lstrlenW (lpString=".dbf") returned 4 [0203.691] lstrcmpiW (lpString1=".dbf", lpString2=".eot") returned -1 [0203.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.691] lstrlenW (lpString=".1cd") returned 4 [0203.691] lstrcmpiW (lpString1=".1cd", lpString2=".eot") returned -1 [0203.691] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows\\Temporary Internet Files\\Low\\Content.IE5\\YG1R61Z8\\latest[3].eot") returned 125 [0203.691] lstrlenW (lpString=".jpg") returned 4 [0203.691] lstrcmpiW (lpString1=".jpg", lpString2=".eot") returned 1 [0203.691] lstrcmpiW (lpString1=".oeaccount", lpString2=".wiki") returned -1 [0203.691] lstrlenW (lpString="account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 55 [0203.691] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.692] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=1736) returned 1 [0203.692] CloseHandle (hObject=0x350) returned 1 [0203.692] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount")) returned 0x2020 [0203.692] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.692] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.692] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.692] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x34c [0203.693] GetLastError () returned 0x0 [0203.693] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x6c8, lpOverlapped=0x0) returned 1 [0203.694] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0203.695] ReadFile (in: hFile=0x350, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0203.695] WriteFile (in: hFile=0x34c, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x142, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x142, lpOverlapped=0x0) returned 1 [0203.695] SetEndOfFile (hFile=0x34c) returned 1 [0203.695] CloseHandle (hObject=0x34c) returned 1 [0203.696] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.696] SetEndOfFile (hFile=0x350) returned 1 [0203.696] CloseHandle (hObject=0x350) returned 1 [0203.696] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.697] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\account{af0db737-2ef9-4633-bf5e-1a6761ed1577}.oeaccount")) returned 1 [0203.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.697] lstrlenW (lpString=".doc") returned 4 [0203.697] lstrcmpiW (lpString1=".doc", lpString2="ount") returned -1 [0203.697] lstrlenW (lpString=".docx") returned 5 [0203.697] lstrcmpiW (lpString1=".docx", lpString2="count") returned -1 [0203.697] lstrlenW (lpString=".pdf") returned 4 [0203.697] lstrcmpiW (lpString1=".pdf", lpString2="ount") returned -1 [0203.697] lstrlenW (lpString=".xls") returned 4 [0203.697] lstrcmpiW (lpString1=".xls", lpString2="ount") returned -1 [0203.697] lstrlenW (lpString=".xlsx") returned 5 [0203.697] lstrcmpiW (lpString1=".xlsx", lpString2="count") returned -1 [0203.697] lstrlenW (lpString=".ppt") returned 4 [0203.697] lstrcmpiW (lpString1=".ppt", lpString2="ount") returned -1 [0203.697] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.697] lstrlenW (lpString=".zip") returned 4 [0203.697] lstrcmpiW (lpString1=".zip", lpString2="ount") returned -1 [0203.697] lstrlenW (lpString=".rar") returned 4 [0203.697] lstrcmpiW (lpString1=".rar", lpString2="ount") returned -1 [0203.697] lstrlenW (lpString=".bz2") returned 4 [0203.697] lstrcmpiW (lpString1=".bz2", lpString2="ount") returned -1 [0203.697] lstrlenW (lpString=".7z") returned 3 [0203.697] lstrcmpiW (lpString1=".7z", lpString2="unt") returned -1 [0203.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.698] lstrlenW (lpString=".dbf") returned 4 [0203.698] lstrcmpiW (lpString1=".dbf", lpString2="ount") returned -1 [0203.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.698] lstrlenW (lpString=".1cd") returned 4 [0203.698] lstrcmpiW (lpString1=".1cd", lpString2="ount") returned -1 [0203.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.698] lstrlenW (lpString=".jpg") returned 4 [0203.698] lstrcmpiW (lpString1=".jpg", lpString2="ount") returned -1 [0203.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.698] lstrlenW (lpString=".doc") returned 4 [0203.698] lstrcmpiW (lpString1=".doc", lpString2="ount") returned -1 [0203.698] lstrlenW (lpString=".docx") returned 5 [0203.698] lstrcmpiW (lpString1=".docx", lpString2="count") returned -1 [0203.698] lstrlenW (lpString=".pdf") returned 4 [0203.698] lstrcmpiW (lpString1=".pdf", lpString2="ount") returned -1 [0203.698] lstrlenW (lpString=".xls") returned 4 [0203.698] lstrcmpiW (lpString1=".xls", lpString2="ount") returned -1 [0203.698] lstrlenW (lpString=".xlsx") returned 5 [0203.698] lstrcmpiW (lpString1=".xlsx", lpString2="count") returned -1 [0203.698] lstrlenW (lpString=".ppt") returned 4 [0203.698] lstrcmpiW (lpString1=".ppt", lpString2="ount") returned -1 [0203.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.698] lstrlenW (lpString=".zip") returned 4 [0203.698] lstrcmpiW (lpString1=".zip", lpString2="ount") returned -1 [0203.698] lstrlenW (lpString=".rar") returned 4 [0203.698] lstrcmpiW (lpString1=".rar", lpString2="ount") returned -1 [0203.698] lstrlenW (lpString=".bz2") returned 4 [0203.698] lstrcmpiW (lpString1=".bz2", lpString2="ount") returned -1 [0203.698] lstrlenW (lpString=".7z") returned 3 [0203.698] lstrcmpiW (lpString1=".7z", lpString2="unt") returned -1 [0203.698] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.699] lstrlenW (lpString=".dbf") returned 4 [0203.699] lstrcmpiW (lpString1=".dbf", lpString2="ount") returned -1 [0203.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.699] lstrlenW (lpString=".1cd") returned 4 [0203.699] lstrcmpiW (lpString1=".1cd", lpString2="ount") returned -1 [0203.699] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\account{AF0DB737-2EF9-4633-BF5E-1A6761ED1577}.oeaccount") returned 122 [0203.699] lstrlenW (lpString=".jpg") returned 4 [0203.699] lstrcmpiW (lpString1=".jpg", lpString2="ount") returned -1 [0203.699] lstrcmpiW (lpString1=".MSMessageStore", lpString2=".wiki") returned -1 [0203.699] lstrlenW (lpString="WindowsMail.MSMessageStore") returned 26 [0203.699] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.700] GetFileSizeEx (in: hFile=0x350, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=2121728) returned 1 [0203.700] CloseHandle (hObject=0x350) returned 1 [0203.700] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore")) returned 0x2020 [0203.700] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0203.700] MoveFileW (lpExistingFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore"), lpNewFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 1 [0203.701] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\backup\\old\\windowsmail.msmessagestore.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x350 [0203.701] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc6c | out: lpNewFilePointer=0x0) returned 1 [0203.701] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc2c | out: lpNewFilePointer=0x0) returned 1 [0203.701] ReadFile (in: hFile=0x350, lpBuffer=0x4410058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3bafc38, lpOverlapped=0x0 | out: lpBuffer=0x4410058*, lpNumberOfBytesRead=0x3bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.705] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xacaaa, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc2c | out: lpNewFilePointer=0x0) returned 1 [0203.705] ReadFile (in: hFile=0x350, lpBuffer=0x4450058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3bafc38, lpOverlapped=0x0 | out: lpBuffer=0x4450058*, lpNumberOfBytesRead=0x3bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.711] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x3bafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0203.711] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1c6000, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc2c | out: lpNewFilePointer=0x0) returned 1 [0203.711] ReadFile (in: hFile=0x350, lpBuffer=0x4490058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x3bafc38, lpOverlapped=0x0 | out: lpBuffer=0x4490058*, lpNumberOfBytesRead=0x3bafc38*=0x40000, lpOverlapped=0x0) returned 1 [0203.873] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0203.873] WriteFile (in: hFile=0x350, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xc0120, lpNumberOfBytesWritten=0x3bafcb0, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafcb0*=0xc0120, lpOverlapped=0x0) returned 1 [0203.887] SetEndOfFile (hFile=0x350) returned 1 [0203.887] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0x40000) returned 0x4130060 [0203.887] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc7c | out: lpNewFilePointer=0x0) returned 1 [0203.887] WriteFile (in: hFile=0x350, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3bafc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x3bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.909] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0xacaaa, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc7c | out: lpNewFilePointer=0x0) returned 1 [0203.909] WriteFile (in: hFile=0x350, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3bafc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x3bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.911] SetFilePointerEx (in: hFile=0x350, liDistanceToMove=0x1c6000, lpNewFilePointer=0x0, dwMoveMethod=0x3bafc7c | out: lpNewFilePointer=0x0) returned 1 [0203.911] WriteFile (in: hFile=0x350, lpBuffer=0x4130060*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x3bafc88, lpOverlapped=0x0 | out: lpBuffer=0x4130060*, lpNumberOfBytesWritten=0x3bafc88*=0x40000, lpOverlapped=0x0) returned 1 [0203.913] HeapFree (in: hHeap=0x270000, dwFlags=0x0, lpMem=0x4130060 | out: hHeap=0x270000) returned 1 [0203.913] CloseHandle (hObject=0x350) returned 1 [0203.913] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0203.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.913] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.913] lstrlenW (lpString=".doc") returned 4 [0203.913] lstrcmpiW (lpString1=".doc", lpString2="tore") returned -1 [0203.913] lstrlenW (lpString=".docx") returned 5 [0203.913] lstrcmpiW (lpString1=".docx", lpString2="Store") returned -1 [0203.913] lstrlenW (lpString=".pdf") returned 4 [0203.913] lstrcmpiW (lpString1=".pdf", lpString2="tore") returned -1 [0203.913] lstrlenW (lpString=".xls") returned 4 [0203.913] lstrcmpiW (lpString1=".xls", lpString2="tore") returned -1 [0203.913] lstrlenW (lpString=".xlsx") returned 5 [0203.913] lstrcmpiW (lpString1=".xlsx", lpString2="Store") returned -1 [0203.914] lstrlenW (lpString=".ppt") returned 4 [0203.914] lstrcmpiW (lpString1=".ppt", lpString2="tore") returned -1 [0203.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.914] lstrlenW (lpString=".zip") returned 4 [0203.914] lstrcmpiW (lpString1=".zip", lpString2="tore") returned -1 [0203.914] lstrlenW (lpString=".rar") returned 4 [0203.914] lstrcmpiW (lpString1=".rar", lpString2="tore") returned -1 [0203.914] lstrlenW (lpString=".bz2") returned 4 [0203.914] lstrcmpiW (lpString1=".bz2", lpString2="tore") returned -1 [0203.914] lstrlenW (lpString=".7z") returned 3 [0203.914] lstrcmpiW (lpString1=".7z", lpString2="ore") returned -1 [0203.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.914] lstrlenW (lpString=".dbf") returned 4 [0203.914] lstrcmpiW (lpString1=".dbf", lpString2="tore") returned -1 [0203.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.914] lstrlenW (lpString=".1cd") returned 4 [0203.914] lstrcmpiW (lpString1=".1cd", lpString2="tore") returned -1 [0203.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.914] lstrlenW (lpString=".jpg") returned 4 [0203.914] lstrcmpiW (lpString1=".jpg", lpString2="tore") returned -1 [0203.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.914] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.914] lstrlenW (lpString=".doc") returned 4 [0203.914] lstrcmpiW (lpString1=".doc", lpString2="tore") returned -1 [0203.914] lstrlenW (lpString=".docx") returned 5 [0203.914] lstrcmpiW (lpString1=".docx", lpString2="Store") returned -1 [0203.914] lstrlenW (lpString=".pdf") returned 4 [0203.914] lstrcmpiW (lpString1=".pdf", lpString2="tore") returned -1 [0203.914] lstrlenW (lpString=".xls") returned 4 [0203.914] lstrcmpiW (lpString1=".xls", lpString2="tore") returned -1 [0203.914] lstrlenW (lpString=".xlsx") returned 5 [0203.914] lstrcmpiW (lpString1=".xlsx", lpString2="Store") returned -1 [0203.914] lstrlenW (lpString=".ppt") returned 4 [0203.915] lstrcmpiW (lpString1=".ppt", lpString2="tore") returned -1 [0203.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.915] lstrlenW (lpString=".zip") returned 4 [0203.915] lstrcmpiW (lpString1=".zip", lpString2="tore") returned -1 [0203.915] lstrlenW (lpString=".rar") returned 4 [0203.915] lstrcmpiW (lpString1=".rar", lpString2="tore") returned -1 [0203.915] lstrlenW (lpString=".bz2") returned 4 [0203.915] lstrcmpiW (lpString1=".bz2", lpString2="tore") returned -1 [0203.915] lstrlenW (lpString=".7z") returned 3 [0203.915] lstrcmpiW (lpString1=".7z", lpString2="ore") returned -1 [0203.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.915] lstrlenW (lpString=".dbf") returned 4 [0203.915] lstrcmpiW (lpString1=".dbf", lpString2="tore") returned -1 [0203.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.915] lstrlenW (lpString=".1cd") returned 4 [0203.915] lstrcmpiW (lpString1=".1cd", lpString2="tore") returned -1 [0203.915] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\Backup\\old\\WindowsMail.MSMessageStore") returned 104 [0203.915] lstrlenW (lpString=".jpg") returned 4 [0203.915] lstrcmpiW (lpString1=".jpg", lpString2="tore") returned -1 [0203.915] lstrcmpiW (lpString1=".pat", lpString2=".wiki") returned -1 [0203.915] lstrlenW (lpString="WindowsMail.pat") returned 15 [0203.915] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\microsoft\\windows mail\\windowsmail.pat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.020] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=0) returned 1 [0204.020] CloseHandle (hObject=0x2d8) returned 1 [0204.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.020] lstrlenW (lpString=".doc") returned 4 [0204.020] lstrcmpiW (lpString1=".doc", lpString2=".pat") returned -1 [0204.020] lstrlenW (lpString=".docx") returned 5 [0204.020] lstrcmpiW (lpString1=".docx", lpString2="l.pat") returned -1 [0204.020] lstrlenW (lpString=".pdf") returned 4 [0204.020] lstrcmpiW (lpString1=".pdf", lpString2=".pat") returned 1 [0204.020] lstrlenW (lpString=".xls") returned 4 [0204.020] lstrcmpiW (lpString1=".xls", lpString2=".pat") returned 1 [0204.020] lstrlenW (lpString=".xlsx") returned 5 [0204.020] lstrcmpiW (lpString1=".xlsx", lpString2="l.pat") returned -1 [0204.020] lstrlenW (lpString=".ppt") returned 4 [0204.020] lstrcmpiW (lpString1=".ppt", lpString2=".pat") returned 1 [0204.020] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.020] lstrlenW (lpString=".zip") returned 4 [0204.020] lstrcmpiW (lpString1=".zip", lpString2=".pat") returned 1 [0204.020] lstrlenW (lpString=".rar") returned 4 [0204.020] lstrcmpiW (lpString1=".rar", lpString2=".pat") returned 1 [0204.021] lstrlenW (lpString=".bz2") returned 4 [0204.021] lstrcmpiW (lpString1=".bz2", lpString2=".pat") returned -1 [0204.021] lstrlenW (lpString=".7z") returned 3 [0204.021] lstrcmpiW (lpString1=".7z", lpString2="pat") returned -1 [0204.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.021] lstrlenW (lpString=".dbf") returned 4 [0204.021] lstrcmpiW (lpString1=".dbf", lpString2=".pat") returned -1 [0204.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.021] lstrlenW (lpString=".1cd") returned 4 [0204.021] lstrcmpiW (lpString1=".1cd", lpString2=".pat") returned -1 [0204.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.021] lstrlenW (lpString=".jpg") returned 4 [0204.021] lstrcmpiW (lpString1=".jpg", lpString2=".pat") returned -1 [0204.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.021] lstrlenW (lpString=".doc") returned 4 [0204.021] lstrcmpiW (lpString1=".doc", lpString2=".pat") returned -1 [0204.021] lstrlenW (lpString=".docx") returned 5 [0204.021] lstrcmpiW (lpString1=".docx", lpString2="l.pat") returned -1 [0204.021] lstrlenW (lpString=".pdf") returned 4 [0204.021] lstrcmpiW (lpString1=".pdf", lpString2=".pat") returned 1 [0204.021] lstrlenW (lpString=".xls") returned 4 [0204.021] lstrcmpiW (lpString1=".xls", lpString2=".pat") returned 1 [0204.021] lstrlenW (lpString=".xlsx") returned 5 [0204.021] lstrcmpiW (lpString1=".xlsx", lpString2="l.pat") returned -1 [0204.021] lstrlenW (lpString=".ppt") returned 4 [0204.021] lstrcmpiW (lpString1=".ppt", lpString2=".pat") returned 1 [0204.021] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.021] lstrlenW (lpString=".zip") returned 4 [0204.021] lstrcmpiW (lpString1=".zip", lpString2=".pat") returned 1 [0204.021] lstrlenW (lpString=".rar") returned 4 [0204.021] lstrcmpiW (lpString1=".rar", lpString2=".pat") returned 1 [0204.021] lstrlenW (lpString=".bz2") returned 4 [0204.022] lstrcmpiW (lpString1=".bz2", lpString2=".pat") returned -1 [0204.022] lstrlenW (lpString=".7z") returned 3 [0204.022] lstrcmpiW (lpString1=".7z", lpString2="pat") returned -1 [0204.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.022] lstrlenW (lpString=".dbf") returned 4 [0204.022] lstrcmpiW (lpString1=".dbf", lpString2=".pat") returned -1 [0204.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.022] lstrlenW (lpString=".1cd") returned 4 [0204.022] lstrcmpiW (lpString1=".1cd", lpString2=".pat") returned -1 [0204.022] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Microsoft\\Windows Mail\\WindowsMail.pat") returned 82 [0204.022] lstrlenW (lpString=".jpg") returned 4 [0204.022] lstrcmpiW (lpString1=".jpg", lpString2=".pat") returned -1 [0204.022] lstrcmpiW (lpString1=".default\\Cache\\1\\0B\\FCBF5d01", lpString2=".wiki") returned -1 [0204.022] lstrlenW (lpString="FCBF5d01") returned 8 [0204.022] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.042] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=132349) returned 1 [0204.042] CloseHandle (hObject=0x358) returned 1 [0204.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01")) returned 0x2020 [0204.042] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.042] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.042] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.042] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0204.043] GetLastError () returned 0x0 [0204.043] ReadFile (in: hFile=0x358, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x204fd, lpOverlapped=0x0) returned 1 [0204.059] WriteFile (in: hFile=0x378, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x20500, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x20500, lpOverlapped=0x0) returned 1 [0204.062] ReadFile (in: hFile=0x358, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0204.062] WriteFile (in: hFile=0x378, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.062] SetEndOfFile (hFile=0x378) returned 1 [0204.062] CloseHandle (hObject=0x378) returned 1 [0204.062] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.062] SetEndOfFile (hFile=0x358) returned 1 [0204.064] CloseHandle (hObject=0x358) returned 1 [0204.064] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.064] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\1\\0b\\fcbf5d01")) returned 1 [0204.064] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.064] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.064] lstrlenW (lpString=".doc") returned 4 [0204.064] lstrcmpiW (lpString1=".doc", lpString2="5d01") returned -1 [0204.064] lstrlenW (lpString=".docx") returned 5 [0204.064] lstrcmpiW (lpString1=".docx", lpString2="F5d01") returned -1 [0204.064] lstrlenW (lpString=".pdf") returned 4 [0204.065] lstrcmpiW (lpString1=".pdf", lpString2="5d01") returned -1 [0204.065] lstrlenW (lpString=".xls") returned 4 [0204.065] lstrcmpiW (lpString1=".xls", lpString2="5d01") returned -1 [0204.065] lstrlenW (lpString=".xlsx") returned 5 [0204.065] lstrcmpiW (lpString1=".xlsx", lpString2="F5d01") returned -1 [0204.065] lstrlenW (lpString=".ppt") returned 4 [0204.065] lstrcmpiW (lpString1=".ppt", lpString2="5d01") returned -1 [0204.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.065] lstrlenW (lpString=".zip") returned 4 [0204.065] lstrcmpiW (lpString1=".zip", lpString2="5d01") returned -1 [0204.065] lstrlenW (lpString=".rar") returned 4 [0204.065] lstrcmpiW (lpString1=".rar", lpString2="5d01") returned -1 [0204.065] lstrlenW (lpString=".bz2") returned 4 [0204.065] lstrcmpiW (lpString1=".bz2", lpString2="5d01") returned -1 [0204.065] lstrlenW (lpString=".7z") returned 3 [0204.065] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.065] lstrlenW (lpString=".dbf") returned 4 [0204.065] lstrcmpiW (lpString1=".dbf", lpString2="5d01") returned -1 [0204.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.065] lstrlenW (lpString=".1cd") returned 4 [0204.065] lstrcmpiW (lpString1=".1cd", lpString2="5d01") returned -1 [0204.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.065] lstrlenW (lpString=".jpg") returned 4 [0204.065] lstrcmpiW (lpString1=".jpg", lpString2="5d01") returned -1 [0204.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.065] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.065] lstrlenW (lpString=".doc") returned 4 [0204.065] lstrcmpiW (lpString1=".doc", lpString2="5d01") returned -1 [0204.065] lstrlenW (lpString=".docx") returned 5 [0204.065] lstrcmpiW (lpString1=".docx", lpString2="F5d01") returned -1 [0204.065] lstrlenW (lpString=".pdf") returned 4 [0204.065] lstrcmpiW (lpString1=".pdf", lpString2="5d01") returned -1 [0204.066] lstrlenW (lpString=".xls") returned 4 [0204.066] lstrcmpiW (lpString1=".xls", lpString2="5d01") returned -1 [0204.066] lstrlenW (lpString=".xlsx") returned 5 [0204.066] lstrcmpiW (lpString1=".xlsx", lpString2="F5d01") returned -1 [0204.066] lstrlenW (lpString=".ppt") returned 4 [0204.066] lstrcmpiW (lpString1=".ppt", lpString2="5d01") returned -1 [0204.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.066] lstrlenW (lpString=".zip") returned 4 [0204.066] lstrcmpiW (lpString1=".zip", lpString2="5d01") returned -1 [0204.066] lstrlenW (lpString=".rar") returned 4 [0204.066] lstrcmpiW (lpString1=".rar", lpString2="5d01") returned -1 [0204.066] lstrlenW (lpString=".bz2") returned 4 [0204.066] lstrcmpiW (lpString1=".bz2", lpString2="5d01") returned -1 [0204.066] lstrlenW (lpString=".7z") returned 3 [0204.066] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.066] lstrlenW (lpString=".dbf") returned 4 [0204.066] lstrcmpiW (lpString1=".dbf", lpString2="5d01") returned -1 [0204.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.066] lstrlenW (lpString=".1cd") returned 4 [0204.066] lstrcmpiW (lpString1=".1cd", lpString2="5d01") returned -1 [0204.066] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\1\\0B\\FCBF5d01") returned 105 [0204.066] lstrlenW (lpString=".jpg") returned 4 [0204.066] lstrcmpiW (lpString1=".jpg", lpString2="5d01") returned -1 [0204.066] lstrcmpiW (lpString1=".default\\Cache\\9\\10\\16A09d01", lpString2=".wiki") returned -1 [0204.066] lstrlenW (lpString="16A09d01") returned 8 [0204.066] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.067] GetFileSizeEx (in: hFile=0x358, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=21327) returned 1 [0204.067] CloseHandle (hObject=0x358) returned 1 [0204.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01")) returned 0x2020 [0204.067] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x358 [0204.068] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.068] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.068] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x378 [0204.068] GetLastError () returned 0x0 [0204.068] ReadFile (in: hFile=0x358, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x534f, lpOverlapped=0x0) returned 1 [0204.081] WriteFile (in: hFile=0x378, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x5350, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x5350, lpOverlapped=0x0) returned 1 [0204.082] ReadFile (in: hFile=0x358, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0204.082] WriteFile (in: hFile=0x378, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.082] SetEndOfFile (hFile=0x378) returned 1 [0204.083] CloseHandle (hObject=0x378) returned 1 [0204.083] SetFilePointerEx (in: hFile=0x358, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.083] SetEndOfFile (hFile=0x358) returned 1 [0204.083] CloseHandle (hObject=0x358) returned 1 [0204.084] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.084] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\10\\16a09d01")) returned 1 [0204.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.084] lstrlenW (lpString=".doc") returned 4 [0204.084] lstrcmpiW (lpString1=".doc", lpString2="9d01") returned -1 [0204.084] lstrlenW (lpString=".docx") returned 5 [0204.084] lstrcmpiW (lpString1=".docx", lpString2="09d01") returned -1 [0204.084] lstrlenW (lpString=".pdf") returned 4 [0204.084] lstrcmpiW (lpString1=".pdf", lpString2="9d01") returned -1 [0204.084] lstrlenW (lpString=".xls") returned 4 [0204.084] lstrcmpiW (lpString1=".xls", lpString2="9d01") returned -1 [0204.084] lstrlenW (lpString=".xlsx") returned 5 [0204.084] lstrcmpiW (lpString1=".xlsx", lpString2="09d01") returned -1 [0204.084] lstrlenW (lpString=".ppt") returned 4 [0204.084] lstrcmpiW (lpString1=".ppt", lpString2="9d01") returned -1 [0204.084] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.084] lstrlenW (lpString=".zip") returned 4 [0204.084] lstrcmpiW (lpString1=".zip", lpString2="9d01") returned -1 [0204.084] lstrlenW (lpString=".rar") returned 4 [0204.084] lstrcmpiW (lpString1=".rar", lpString2="9d01") returned -1 [0204.084] lstrlenW (lpString=".bz2") returned 4 [0204.084] lstrcmpiW (lpString1=".bz2", lpString2="9d01") returned -1 [0204.084] lstrlenW (lpString=".7z") returned 3 [0204.084] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.085] lstrlenW (lpString=".dbf") returned 4 [0204.085] lstrcmpiW (lpString1=".dbf", lpString2="9d01") returned -1 [0204.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.085] lstrlenW (lpString=".1cd") returned 4 [0204.085] lstrcmpiW (lpString1=".1cd", lpString2="9d01") returned -1 [0204.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.085] lstrlenW (lpString=".jpg") returned 4 [0204.085] lstrcmpiW (lpString1=".jpg", lpString2="9d01") returned -1 [0204.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.085] lstrlenW (lpString=".doc") returned 4 [0204.085] lstrcmpiW (lpString1=".doc", lpString2="9d01") returned -1 [0204.085] lstrlenW (lpString=".docx") returned 5 [0204.085] lstrcmpiW (lpString1=".docx", lpString2="09d01") returned -1 [0204.085] lstrlenW (lpString=".pdf") returned 4 [0204.085] lstrcmpiW (lpString1=".pdf", lpString2="9d01") returned -1 [0204.085] lstrlenW (lpString=".xls") returned 4 [0204.085] lstrcmpiW (lpString1=".xls", lpString2="9d01") returned -1 [0204.085] lstrlenW (lpString=".xlsx") returned 5 [0204.085] lstrcmpiW (lpString1=".xlsx", lpString2="09d01") returned -1 [0204.085] lstrlenW (lpString=".ppt") returned 4 [0204.085] lstrcmpiW (lpString1=".ppt", lpString2="9d01") returned -1 [0204.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.085] lstrlenW (lpString=".zip") returned 4 [0204.085] lstrcmpiW (lpString1=".zip", lpString2="9d01") returned -1 [0204.085] lstrlenW (lpString=".rar") returned 4 [0204.085] lstrcmpiW (lpString1=".rar", lpString2="9d01") returned -1 [0204.085] lstrlenW (lpString=".bz2") returned 4 [0204.085] lstrcmpiW (lpString1=".bz2", lpString2="9d01") returned -1 [0204.085] lstrlenW (lpString=".7z") returned 3 [0204.085] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.085] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.085] lstrlenW (lpString=".dbf") returned 4 [0204.086] lstrcmpiW (lpString1=".dbf", lpString2="9d01") returned -1 [0204.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.086] lstrlenW (lpString=".1cd") returned 4 [0204.086] lstrcmpiW (lpString1=".1cd", lpString2="9d01") returned -1 [0204.086] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\10\\16A09d01") returned 105 [0204.086] lstrlenW (lpString=".jpg") returned 4 [0204.086] lstrcmpiW (lpString1=".jpg", lpString2="9d01") returned -1 [0204.086] lstrcmpiW (lpString1=".default\\Cache\\9\\2C\\24B53d01", lpString2=".wiki") returned -1 [0204.086] lstrlenW (lpString="24B53d01") returned 8 [0204.086] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.105] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=78805) returned 1 [0204.105] CloseHandle (hObject=0x2d8) returned 1 [0204.105] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01")) returned 0x2020 [0204.105] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.105] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.105] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.105] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0204.106] GetLastError () returned 0x0 [0204.106] ReadFile (in: hFile=0x2d8, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x133d5, lpOverlapped=0x0) returned 1 [0204.120] WriteFile (in: hFile=0x370, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x133e0, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x133e0, lpOverlapped=0x0) returned 1 [0204.122] ReadFile (in: hFile=0x2d8, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0204.122] WriteFile (in: hFile=0x370, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.122] SetEndOfFile (hFile=0x370) returned 1 [0204.122] CloseHandle (hObject=0x370) returned 1 [0204.122] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.123] SetEndOfFile (hFile=0x2d8) returned 1 [0204.124] CloseHandle (hObject=0x2d8) returned 1 [0204.124] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.124] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\9\\2c\\24b53d01")) returned 1 [0204.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.124] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.124] lstrlenW (lpString=".doc") returned 4 [0204.124] lstrcmpiW (lpString1=".doc", lpString2="3d01") returned -1 [0204.124] lstrlenW (lpString=".docx") returned 5 [0204.124] lstrcmpiW (lpString1=".docx", lpString2="53d01") returned -1 [0204.124] lstrlenW (lpString=".pdf") returned 4 [0204.124] lstrcmpiW (lpString1=".pdf", lpString2="3d01") returned -1 [0204.124] lstrlenW (lpString=".xls") returned 4 [0204.124] lstrcmpiW (lpString1=".xls", lpString2="3d01") returned -1 [0204.124] lstrlenW (lpString=".xlsx") returned 5 [0204.124] lstrcmpiW (lpString1=".xlsx", lpString2="53d01") returned -1 [0204.124] lstrlenW (lpString=".ppt") returned 4 [0204.124] lstrcmpiW (lpString1=".ppt", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.125] lstrlenW (lpString=".zip") returned 4 [0204.125] lstrcmpiW (lpString1=".zip", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString=".rar") returned 4 [0204.125] lstrcmpiW (lpString1=".rar", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString=".bz2") returned 4 [0204.125] lstrcmpiW (lpString1=".bz2", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString=".7z") returned 3 [0204.125] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.125] lstrlenW (lpString=".dbf") returned 4 [0204.125] lstrcmpiW (lpString1=".dbf", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.125] lstrlenW (lpString=".1cd") returned 4 [0204.125] lstrcmpiW (lpString1=".1cd", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.125] lstrlenW (lpString=".jpg") returned 4 [0204.125] lstrcmpiW (lpString1=".jpg", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.125] lstrlenW (lpString=".doc") returned 4 [0204.125] lstrcmpiW (lpString1=".doc", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString=".docx") returned 5 [0204.125] lstrcmpiW (lpString1=".docx", lpString2="53d01") returned -1 [0204.125] lstrlenW (lpString=".pdf") returned 4 [0204.125] lstrcmpiW (lpString1=".pdf", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString=".xls") returned 4 [0204.125] lstrcmpiW (lpString1=".xls", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString=".xlsx") returned 5 [0204.125] lstrcmpiW (lpString1=".xlsx", lpString2="53d01") returned -1 [0204.125] lstrlenW (lpString=".ppt") returned 4 [0204.125] lstrcmpiW (lpString1=".ppt", lpString2="3d01") returned -1 [0204.125] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.125] lstrlenW (lpString=".zip") returned 4 [0204.126] lstrcmpiW (lpString1=".zip", lpString2="3d01") returned -1 [0204.126] lstrlenW (lpString=".rar") returned 4 [0204.126] lstrcmpiW (lpString1=".rar", lpString2="3d01") returned -1 [0204.126] lstrlenW (lpString=".bz2") returned 4 [0204.126] lstrcmpiW (lpString1=".bz2", lpString2="3d01") returned -1 [0204.126] lstrlenW (lpString=".7z") returned 3 [0204.126] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.126] lstrlenW (lpString=".dbf") returned 4 [0204.126] lstrcmpiW (lpString1=".dbf", lpString2="3d01") returned -1 [0204.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.126] lstrlenW (lpString=".1cd") returned 4 [0204.126] lstrcmpiW (lpString1=".1cd", lpString2="3d01") returned -1 [0204.126] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\9\\2C\\24B53d01") returned 105 [0204.126] lstrlenW (lpString=".jpg") returned 4 [0204.126] lstrcmpiW (lpString1=".jpg", lpString2="3d01") returned -1 [0204.126] lstrcmpiW (lpString1=".default\\Cache\\C\\E6\\9DCB7d01", lpString2=".wiki") returned -1 [0204.126] lstrlenW (lpString="9DCB7d01") returned 8 [0204.126] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.127] GetFileSizeEx (in: hFile=0x2d8, lpFileSize=0x3baff1c | out: lpFileSize=0x3baff1c*=137273) returned 1 [0204.127] CloseHandle (hObject=0x2d8) returned 1 [0204.127] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01")) returned 0x2020 [0204.127] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01.id-9c354b42.[bitlocker@foxmail.com ].wiki")) returned 0xffffffff [0204.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2d8 [0204.127] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.127] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.127] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01.id-9C354B42.[bitlocker@foxmail.com ].wiki" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01.id-9c354b42.[bitlocker@foxmail.com ].wiki"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x370 [0204.128] GetLastError () returned 0x0 [0204.128] ReadFile (in: hFile=0x2d8, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x21839, lpOverlapped=0x0) returned 1 [0204.449] WriteFile (in: hFile=0x370, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0x21840, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0x21840, lpOverlapped=0x0) returned 1 [0204.702] ReadFile (in: hFile=0x2d8, lpBuffer=0x4410020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x3bafed4, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesRead=0x3bafed4*=0x0, lpOverlapped=0x0) returned 1 [0204.702] WriteFile (in: hFile=0x370, lpBuffer=0x4410020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x3bafc9c, lpOverlapped=0x0 | out: lpBuffer=0x4410020*, lpNumberOfBytesWritten=0x3bafc9c*=0xe4, lpOverlapped=0x0) returned 1 [0204.702] SetEndOfFile (hFile=0x370) returned 1 [0204.702] CloseHandle (hObject=0x370) returned 1 [0204.702] SetFilePointerEx (in: hFile=0x2d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x3bafec8 | out: lpNewFilePointer=0x0) returned 1 [0204.702] SetEndOfFile (hFile=0x2d8) returned 1 [0204.704] CloseHandle (hObject=0x2d8) returned 1 [0204.704] SetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01.id-9C354B42.[bitlocker@foxmail.com ].wiki", dwFileAttributes=0x2020) returned 1 [0204.704] DeleteFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\c\\e6\\9dcb7d01")) returned 1 [0204.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.704] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.704] lstrlenW (lpString=".doc") returned 4 [0204.705] lstrcmpiW (lpString1=".doc", lpString2="7d01") returned -1 [0204.705] lstrlenW (lpString=".docx") returned 5 [0204.705] lstrcmpiW (lpString1=".docx", lpString2="B7d01") returned -1 [0204.705] lstrlenW (lpString=".pdf") returned 4 [0204.705] lstrcmpiW (lpString1=".pdf", lpString2="7d01") returned -1 [0204.705] lstrlenW (lpString=".xls") returned 4 [0204.705] lstrcmpiW (lpString1=".xls", lpString2="7d01") returned -1 [0204.705] lstrlenW (lpString=".xlsx") returned 5 [0204.705] lstrcmpiW (lpString1=".xlsx", lpString2="B7d01") returned -1 [0204.705] lstrlenW (lpString=".ppt") returned 4 [0204.705] lstrcmpiW (lpString1=".ppt", lpString2="7d01") returned -1 [0204.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.705] lstrlenW (lpString=".zip") returned 4 [0204.705] lstrcmpiW (lpString1=".zip", lpString2="7d01") returned -1 [0204.705] lstrlenW (lpString=".rar") returned 4 [0204.705] lstrcmpiW (lpString1=".rar", lpString2="7d01") returned -1 [0204.705] lstrlenW (lpString=".bz2") returned 4 [0204.705] lstrcmpiW (lpString1=".bz2", lpString2="7d01") returned -1 [0204.705] lstrlenW (lpString=".7z") returned 3 [0204.705] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.705] lstrlenW (lpString=".dbf") returned 4 [0204.705] lstrcmpiW (lpString1=".dbf", lpString2="7d01") returned -1 [0204.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.705] lstrlenW (lpString=".1cd") returned 4 [0204.705] lstrcmpiW (lpString1=".1cd", lpString2="7d01") returned -1 [0204.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.705] lstrlenW (lpString=".jpg") returned 4 [0204.705] lstrcmpiW (lpString1=".jpg", lpString2="7d01") returned -1 [0204.705] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.706] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.706] lstrlenW (lpString=".doc") returned 4 [0204.706] lstrcmpiW (lpString1=".doc", lpString2="7d01") returned -1 [0204.706] lstrlenW (lpString=".docx") returned 5 [0204.706] lstrcmpiW (lpString1=".docx", lpString2="B7d01") returned -1 [0204.706] lstrlenW (lpString=".pdf") returned 4 [0204.706] lstrcmpiW (lpString1=".pdf", lpString2="7d01") returned -1 [0204.706] lstrlenW (lpString=".xls") returned 4 [0204.706] lstrcmpiW (lpString1=".xls", lpString2="7d01") returned -1 [0204.706] lstrlenW (lpString=".xlsx") returned 5 [0204.706] lstrcmpiW (lpString1=".xlsx", lpString2="B7d01") returned -1 [0204.706] lstrlenW (lpString=".ppt") returned 4 [0204.706] lstrcmpiW (lpString1=".ppt", lpString2="7d01") returned -1 [0204.706] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.706] lstrlenW (lpString=".zip") returned 4 [0204.706] lstrcmpiW (lpString1=".zip", lpString2="7d01") returned -1 [0204.706] lstrlenW (lpString=".rar") returned 4 [0204.706] lstrcmpiW (lpString1=".rar", lpString2="7d01") returned -1 [0204.706] lstrlenW (lpString=".bz2") returned 4 [0204.706] lstrcmpiW (lpString1=".bz2", lpString2="7d01") returned -1 [0204.706] lstrlenW (lpString=".7z") returned 3 [0204.706] lstrcmpiW (lpString1=".7z", lpString2="d01") returned -1 [0204.706] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.706] lstrlenW (lpString=".dbf") returned 4 [0204.706] lstrcmpiW (lpString1=".dbf", lpString2="7d01") returned -1 [0204.706] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.706] lstrlenW (lpString=".1cd") returned 4 [0204.706] lstrcmpiW (lpString1=".1cd", lpString2="7d01") returned -1 [0204.706] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\C\\E6\\9DCB7d01") returned 105 [0204.706] lstrlenW (lpString=".jpg") returned 4 [0204.706] lstrcmpiW (lpString1=".jpg", lpString2="7d01") returned -1 [0204.707] lstrcmpiW (lpString1=".default\\Cache\\_CACHE_003_", lpString2=".wiki") returned -1 [0204.707] lstrlenW (lpString="_CACHE_003_") returned 11 [0204.707] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Local\\Mozilla\\Firefox\\Profiles\\silmbjec.default\\Cache\\_CACHE_003_" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\local\\mozilla\\firefox\\profiles\\silmbjec.default\\cache\\_cache_003_"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 77 os_tid = 0x53c [0183.699] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x4130060 [0183.700] lstrlenW (lpString="C:") returned 2 [0183.700] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x3cefd00 | out: lpFindFileData=0x3cefd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x38d34c0 [0183.700] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0183.700] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0183.700] lstrlenW (lpString="$Recycle.Bin") returned 12 [0183.700] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0183.700] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x4140068 [0183.700] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0183.700] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x3cefa84 | out: lpFindFileData=0x3cefa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x38d3500 [0183.700] FindNextFileW (in: hFindFile=0x38d3500, lpFindFileData=0x3cefa84 | out: lpFindFileData=0x3cefa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.700] FindNextFileW (in: hFindFile=0x38d3500, lpFindFileData=0x3cefa84 | out: lpFindFileData=0x3cefa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcf1a3640, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xcf1a3640, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0183.700] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0183.700] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0183.701] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0183.701] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0183.701] RtlAllocateHeap (HeapHandle=0x270000, Flags=0x0, Size=0xfffe) returned 0x4150070 [0183.701] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0183.701] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x3cef808 | out: lpFindFileData=0x3cef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcf1a3640, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xcf1a3640, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x38d3540 [0183.701] FindNextFileW (in: hFindFile=0x38d3540, lpFindFileData=0x3cef808 | out: lpFindFileData=0x3cef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xcf1a3640, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xcf1a3640, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0183.701] FindNextFileW (in: hFindFile=0x38d3540, lpFindFileData=0x3cef808 | out: lpFindFileData=0x3cef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xcf1a3640, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0xcf1a3640, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0xcf1c97a0, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0183.701] lstrlenW (lpString="desktop.ini") returned 11 [0183.701] lstrlenW (lpString=".1cd") returned 4 [0183.701] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0183.701] lstrlenW (lpString=".3ds") returned 4 [0183.701] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0183.701] lstrlenW (lpString=".3fr") returned 4 [0183.701] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0183.701] lstrlenW (lpString=".3g2") returned 4 [0183.701] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0183.701] lstrlenW (lpString=".3gp") returned 4 [0183.701] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0183.701] lstrlenW (lpString=".7z") returned 3 [0183.702] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0183.702] lstrlenW (lpString=".accda") returned 6 [0183.702] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0183.702] lstrlenW (lpString=".accdb") returned 6 [0183.702] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0183.702] lstrlenW (lpString=".accdc") returned 6 [0183.702] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0183.702] lstrlenW (lpString=".accde") returned 6 [0183.702] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0183.702] lstrlenW (lpString=".accdt") returned 6 [0183.702] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0183.702] lstrlenW (lpString=".accdw") returned 6 [0183.702] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0183.702] lstrlenW (lpString=".adb") returned 4 [0183.702] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0183.702] lstrlenW (lpString=".adp") returned 4 [0183.702] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0183.702] lstrlenW (lpString=".ai") returned 3 [0183.702] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0183.702] lstrlenW (lpString=".ai3") returned 4 [0183.702] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0183.702] lstrlenW (lpString=".ai4") returned 4 [0183.702] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0183.702] lstrlenW (lpString=".ai5") returned 4 [0183.702] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0183.702] lstrlenW (lpString=".ai6") returned 4 [0183.702] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0183.702] lstrlenW (lpString=".ai7") returned 4 [0183.702] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0183.702] lstrlenW (lpString=".ai8") returned 4 [0183.702] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0183.702] lstrlenW (lpString=".anim") returned 5 [0183.702] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0183.702] lstrlenW (lpString=".arw") returned 4 [0183.702] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".as") returned 3 [0183.703] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0183.703] lstrlenW (lpString=".asa") returned 4 [0183.703] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".asc") returned 4 [0183.703] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".ascx") returned 5 [0183.703] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0183.703] lstrlenW (lpString=".asm") returned 4 [0183.703] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".asmx") returned 5 [0183.703] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0183.703] lstrlenW (lpString=".asp") returned 4 [0183.703] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".aspx") returned 5 [0183.703] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0183.703] lstrlenW (lpString=".asr") returned 4 [0183.703] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".asx") returned 4 [0183.703] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".avi") returned 4 [0183.703] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".avs") returned 4 [0183.703] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".backup") returned 7 [0183.703] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0183.703] lstrlenW (lpString=".bak") returned 4 [0183.703] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".bay") returned 4 [0183.703] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".bd") returned 3 [0183.703] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0183.703] lstrlenW (lpString=".bin") returned 4 [0183.703] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0183.703] lstrlenW (lpString=".bmp") returned 4 [0183.703] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".bz2") returned 4 [0183.704] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".c") returned 2 [0183.704] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0183.704] lstrlenW (lpString=".cdr") returned 4 [0183.704] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".cer") returned 4 [0183.704] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".cf") returned 3 [0183.704] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0183.704] lstrlenW (lpString=".cfc") returned 4 [0183.704] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".cfm") returned 4 [0183.704] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".cfml") returned 5 [0183.704] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0183.704] lstrlenW (lpString=".cfu") returned 4 [0183.704] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".chm") returned 4 [0183.704] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".cin") returned 4 [0183.704] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".class") returned 6 [0183.704] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0183.704] lstrlenW (lpString=".clx") returned 4 [0183.704] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".config") returned 7 [0183.704] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0183.704] lstrlenW (lpString=".cpp") returned 4 [0183.704] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".cr2") returned 4 [0183.704] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".crt") returned 4 [0183.704] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0183.704] lstrlenW (lpString=".crw") returned 4 [0183.705] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".cs") returned 3 [0183.705] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0183.705] lstrlenW (lpString=".css") returned 4 [0183.705] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".csv") returned 4 [0183.705] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".cub") returned 4 [0183.705] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".dae") returned 4 [0183.705] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".dat") returned 4 [0183.705] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".db") returned 3 [0183.705] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0183.705] lstrlenW (lpString=".dbf") returned 4 [0183.705] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".dbx") returned 4 [0183.705] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".dc3") returned 4 [0183.705] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".dcm") returned 4 [0183.705] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".dcr") returned 4 [0183.705] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".der") returned 4 [0183.705] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".dib") returned 4 [0183.705] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".dic") returned 4 [0183.705] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".dif") returned 4 [0183.705] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0183.705] lstrlenW (lpString=".divx") returned 5 [0183.705] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0183.705] lstrlenW (lpString=".djvu") returned 5 [0183.706] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0183.706] lstrlenW (lpString=".dng") returned 4 [0183.706] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0183.706] lstrlenW (lpString=".doc") returned 4 [0183.706] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0183.706] lstrlenW (lpString=".docm") returned 5 [0183.706] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0183.706] lstrlenW (lpString=".docx") returned 5 [0183.706] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0183.706] lstrlenW (lpString=".dot") returned 4 [0183.706] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0183.706] lstrlenW (lpString=".dotm") returned 5 [0183.706] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0183.706] lstrlenW (lpString=".dotx") returned 5 [0183.706] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0183.706] lstrlenW (lpString=".dpx") returned 4 [0183.706] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0183.706] lstrlenW (lpString=".dqy") returned 4 [0183.706] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0183.706] lstrlenW (lpString=".dsn") returned 4 [0183.706] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0183.706] lstrlenW (lpString=".dt") returned 3 [0183.706] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0183.706] lstrlenW (lpString=".dtd") returned 4 [0183.706] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0183.706] lstrlenW (lpString=".dwg") returned 4 [0183.706] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0183.706] lstrlenW (lpString=".dwt") returned 4 [0183.706] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0183.706] lstrlenW (lpString=".dx") returned 3 [0183.706] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0183.706] lstrlenW (lpString=".dxf") returned 4 [0183.706] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0183.706] lstrlenW (lpString=".edml") returned 5 [0183.706] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0183.706] lstrlenW (lpString=".efd") returned 4 [0183.707] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".elf") returned 4 [0183.707] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".emf") returned 4 [0183.707] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".emz") returned 4 [0183.707] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".epf") returned 4 [0183.707] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".eps") returned 4 [0183.707] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".epsf") returned 5 [0183.707] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0183.707] lstrlenW (lpString=".epsp") returned 5 [0183.707] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0183.707] lstrlenW (lpString=".erf") returned 4 [0183.707] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".exr") returned 4 [0183.707] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".f4v") returned 4 [0183.707] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".fido") returned 5 [0183.707] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0183.707] lstrlenW (lpString=".flm") returned 4 [0183.707] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".flv") returned 4 [0183.707] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".frm") returned 4 [0183.707] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".fxg") returned 4 [0183.707] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".geo") returned 4 [0183.707] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0183.707] lstrlenW (lpString=".gif") returned 4 [0183.707] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".grs") returned 4 [0183.708] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".gz") returned 3 [0183.708] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0183.708] lstrlenW (lpString=".h") returned 2 [0183.708] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0183.708] lstrlenW (lpString=".hdr") returned 4 [0183.708] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".hpp") returned 4 [0183.708] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".hta") returned 4 [0183.708] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".htc") returned 4 [0183.708] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".htm") returned 4 [0183.708] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".html") returned 5 [0183.708] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0183.708] lstrlenW (lpString=".icb") returned 4 [0183.708] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".ics") returned 4 [0183.708] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".iff") returned 4 [0183.708] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".inc") returned 4 [0183.708] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0183.708] lstrlenW (lpString=".indd") returned 5 [0183.708] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0183.708] lstrlenW (lpString=".ini") returned 4 [0183.708] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0183.708] FindNextFileW (in: hFindFile=0x38d3540, lpFindFileData=0x3cef808 | out: lpFindFileData=0x3cef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x99b98230, ftCreationTime.dwHighDateTime=0x1d58773, ftLastAccessTime.dwLowDateTime=0x99b98230, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0x99bbe390, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki", cAlternateFileName="DESKTO~1.WIK")) returned 1 [0183.708] lstrlenW (lpString="desktop.ini.id-9C354B42.[bitlocker@foxmail.com ].wiki") returned 53 [0183.708] lstrlenW (lpString=".1cd") returned 4 [0183.708] lstrcmpiW (lpString1=".1cd", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".3ds") returned 4 [0183.709] lstrcmpiW (lpString1=".3ds", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".3fr") returned 4 [0183.709] lstrcmpiW (lpString1=".3fr", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".3g2") returned 4 [0183.709] lstrcmpiW (lpString1=".3g2", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".3gp") returned 4 [0183.709] lstrcmpiW (lpString1=".3gp", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".7z") returned 3 [0183.709] lstrcmpiW (lpString1=".7z", lpString2="iki") returned -1 [0183.709] lstrlenW (lpString=".accda") returned 6 [0183.709] lstrcmpiW (lpString1=".accda", lpString2="].wiki") returned -1 [0183.709] lstrlenW (lpString=".accdb") returned 6 [0183.709] lstrcmpiW (lpString1=".accdb", lpString2="].wiki") returned -1 [0183.709] lstrlenW (lpString=".accdc") returned 6 [0183.709] lstrcmpiW (lpString1=".accdc", lpString2="].wiki") returned -1 [0183.709] lstrlenW (lpString=".accde") returned 6 [0183.709] lstrcmpiW (lpString1=".accde", lpString2="].wiki") returned -1 [0183.709] lstrlenW (lpString=".accdt") returned 6 [0183.709] lstrcmpiW (lpString1=".accdt", lpString2="].wiki") returned -1 [0183.709] lstrlenW (lpString=".accdw") returned 6 [0183.709] lstrcmpiW (lpString1=".accdw", lpString2="].wiki") returned -1 [0183.709] lstrlenW (lpString=".adb") returned 4 [0183.709] lstrcmpiW (lpString1=".adb", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".adp") returned 4 [0183.709] lstrcmpiW (lpString1=".adp", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".ai") returned 3 [0183.709] lstrcmpiW (lpString1=".ai", lpString2="iki") returned -1 [0183.709] lstrlenW (lpString=".ai3") returned 4 [0183.709] lstrcmpiW (lpString1=".ai3", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".ai4") returned 4 [0183.709] lstrcmpiW (lpString1=".ai4", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".ai5") returned 4 [0183.709] lstrcmpiW (lpString1=".ai5", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".ai6") returned 4 [0183.709] lstrcmpiW (lpString1=".ai6", lpString2="wiki") returned -1 [0183.709] lstrlenW (lpString=".ai7") returned 4 [0183.710] lstrcmpiW (lpString1=".ai7", lpString2="wiki") returned -1 [0183.710] lstrlenW (lpString=".ai8") returned 4 [0183.710] lstrcmpiW (lpString1=".ai8", lpString2="wiki") returned -1 [0183.710] lstrlenW (lpString=".anim") returned 5 [0183.710] lstrcmpiW (lpString1=".anim", lpString2=".wiki") returned -1 [0183.710] lstrlenW (lpString=".arw") returned 4 [0183.710] lstrcmpiW (lpString1=".arw", lpString2="wiki") returned -1 [0183.710] lstrlenW (lpString=".as") returned 3 [0183.710] lstrcmpiW (lpString1=".as", lpString2="iki") returned -1 [0183.710] lstrlenW (lpString=".asa") returned 4 [0183.710] lstrcmpiW (lpString1=".asa", lpString2="wiki") returned -1 [0183.710] lstrlenW (lpString=".asc") returned 4 [0183.710] lstrcmpiW (lpString1=".asc", lpString2="wiki") returned -1 [0183.710] lstrlenW (lpString=".ascx") returned 5 [0183.710] lstrcmpiW (lpString1=".ascx", lpString2=".wiki") returned -1 [0183.710] lstrlenW (lpString=".asm") returned 4 [0183.710] lstrcmpiW (lpString1=".asm", lpString2="wiki") returned -1 [0183.710] lstrlenW (lpString=".asmx") returned 5 [0183.710] lstrcmpiW (lpString1=".asmx", lpString2=".wiki") returned -1 [0183.710] lstrlenW (lpString=".asp") returned 4 [0183.710] lstrcmpiW (lpString1=".asp", lpString2="wiki") returned -1 [0183.710] lstrlenW (lpString=".aspx") returned 5 [0183.710] lstrcmpiW (lpString1=".aspx", lpString2=".wiki") returned -1 [0183.710] lstrlenW (lpString=".asr") returned 4 [0183.711] lstrcmpiW (lpString1=".asr", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".asx") returned 4 [0183.711] lstrcmpiW (lpString1=".asx", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".avi") returned 4 [0183.711] lstrcmpiW (lpString1=".avi", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".avs") returned 4 [0183.711] lstrcmpiW (lpString1=".avs", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".backup") returned 7 [0183.711] lstrcmpiW (lpString1=".backup", lpString2=" ].wiki") returned 1 [0183.711] lstrlenW (lpString=".bak") returned 4 [0183.711] lstrcmpiW (lpString1=".bak", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".bay") returned 4 [0183.711] lstrcmpiW (lpString1=".bay", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".bd") returned 3 [0183.711] lstrcmpiW (lpString1=".bd", lpString2="iki") returned -1 [0183.711] lstrlenW (lpString=".bin") returned 4 [0183.711] lstrcmpiW (lpString1=".bin", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".bmp") returned 4 [0183.711] lstrcmpiW (lpString1=".bmp", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".bz2") returned 4 [0183.711] lstrcmpiW (lpString1=".bz2", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".c") returned 2 [0183.711] lstrcmpiW (lpString1=".c", lpString2="ki") returned -1 [0183.711] lstrlenW (lpString=".cdr") returned 4 [0183.711] lstrcmpiW (lpString1=".cdr", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".cer") returned 4 [0183.711] lstrcmpiW (lpString1=".cer", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".cf") returned 3 [0183.711] lstrcmpiW (lpString1=".cf", lpString2="iki") returned -1 [0183.711] lstrlenW (lpString=".cfc") returned 4 [0183.711] lstrcmpiW (lpString1=".cfc", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".cfm") returned 4 [0183.711] lstrcmpiW (lpString1=".cfm", lpString2="wiki") returned -1 [0183.711] lstrlenW (lpString=".cfml") returned 5 [0183.711] lstrcmpiW (lpString1=".cfml", lpString2=".wiki") returned -1 [0183.712] lstrlenW (lpString=".cfu") returned 4 [0183.712] lstrcmpiW (lpString1=".cfu", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".chm") returned 4 [0183.712] lstrcmpiW (lpString1=".chm", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".cin") returned 4 [0183.712] lstrcmpiW (lpString1=".cin", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".class") returned 6 [0183.712] lstrcmpiW (lpString1=".class", lpString2="].wiki") returned -1 [0183.712] lstrlenW (lpString=".clx") returned 4 [0183.712] lstrcmpiW (lpString1=".clx", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".config") returned 7 [0183.712] lstrcmpiW (lpString1=".config", lpString2=" ].wiki") returned 1 [0183.712] lstrlenW (lpString=".cpp") returned 4 [0183.712] lstrcmpiW (lpString1=".cpp", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".cr2") returned 4 [0183.712] lstrcmpiW (lpString1=".cr2", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".crt") returned 4 [0183.712] lstrcmpiW (lpString1=".crt", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".crw") returned 4 [0183.712] lstrcmpiW (lpString1=".crw", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".cs") returned 3 [0183.712] lstrcmpiW (lpString1=".cs", lpString2="iki") returned -1 [0183.712] lstrlenW (lpString=".css") returned 4 [0183.712] lstrcmpiW (lpString1=".css", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".csv") returned 4 [0183.712] lstrcmpiW (lpString1=".csv", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".cub") returned 4 [0183.712] lstrcmpiW (lpString1=".cub", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".dae") returned 4 [0183.712] lstrcmpiW (lpString1=".dae", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".dat") returned 4 [0183.712] lstrcmpiW (lpString1=".dat", lpString2="wiki") returned -1 [0183.712] lstrlenW (lpString=".db") returned 3 [0183.712] lstrcmpiW (lpString1=".db", lpString2="iki") returned -1 [0183.712] lstrlenW (lpString=".dbf") returned 4 [0183.713] lstrcmpiW (lpString1=".dbf", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".dbx") returned 4 [0183.713] lstrcmpiW (lpString1=".dbx", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".dc3") returned 4 [0183.713] lstrcmpiW (lpString1=".dc3", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".dcm") returned 4 [0183.713] lstrcmpiW (lpString1=".dcm", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".dcr") returned 4 [0183.713] lstrcmpiW (lpString1=".dcr", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".der") returned 4 [0183.713] lstrcmpiW (lpString1=".der", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".dib") returned 4 [0183.713] lstrcmpiW (lpString1=".dib", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".dic") returned 4 [0183.713] lstrcmpiW (lpString1=".dic", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".dif") returned 4 [0183.713] lstrcmpiW (lpString1=".dif", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".divx") returned 5 [0183.713] lstrcmpiW (lpString1=".divx", lpString2=".wiki") returned -1 [0183.713] lstrlenW (lpString=".djvu") returned 5 [0183.713] lstrcmpiW (lpString1=".djvu", lpString2=".wiki") returned -1 [0183.713] lstrlenW (lpString=".dng") returned 4 [0183.713] lstrcmpiW (lpString1=".dng", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".doc") returned 4 [0183.713] lstrcmpiW (lpString1=".doc", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".docm") returned 5 [0183.713] lstrcmpiW (lpString1=".docm", lpString2=".wiki") returned -1 [0183.713] lstrlenW (lpString=".docx") returned 5 [0183.713] lstrcmpiW (lpString1=".docx", lpString2=".wiki") returned -1 [0183.713] lstrlenW (lpString=".dot") returned 4 [0183.713] lstrcmpiW (lpString1=".dot", lpString2="wiki") returned -1 [0183.713] lstrlenW (lpString=".dotm") returned 5 [0183.713] lstrcmpiW (lpString1=".dotm", lpString2=".wiki") returned -1 [0183.713] lstrlenW (lpString=".dotx") returned 5 [0183.713] lstrcmpiW (lpString1=".dotx", lpString2=".wiki") returned -1 [0183.714] lstrlenW (lpString=".dpx") returned 4 [0183.714] lstrcmpiW (lpString1=".dpx", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".dqy") returned 4 [0183.714] lstrcmpiW (lpString1=".dqy", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".dsn") returned 4 [0183.714] lstrcmpiW (lpString1=".dsn", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".dt") returned 3 [0183.714] lstrcmpiW (lpString1=".dt", lpString2="iki") returned -1 [0183.714] lstrlenW (lpString=".dtd") returned 4 [0183.714] lstrcmpiW (lpString1=".dtd", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".dwg") returned 4 [0183.714] lstrcmpiW (lpString1=".dwg", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".dwt") returned 4 [0183.714] lstrcmpiW (lpString1=".dwt", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".dx") returned 3 [0183.714] lstrcmpiW (lpString1=".dx", lpString2="iki") returned -1 [0183.714] lstrlenW (lpString=".dxf") returned 4 [0183.714] lstrcmpiW (lpString1=".dxf", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".edml") returned 5 [0183.714] lstrcmpiW (lpString1=".edml", lpString2=".wiki") returned -1 [0183.714] lstrlenW (lpString=".efd") returned 4 [0183.714] lstrcmpiW (lpString1=".efd", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".elf") returned 4 [0183.714] lstrcmpiW (lpString1=".elf", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".emf") returned 4 [0183.714] lstrcmpiW (lpString1=".emf", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".emz") returned 4 [0183.714] lstrcmpiW (lpString1=".emz", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".epf") returned 4 [0183.714] lstrcmpiW (lpString1=".epf", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".eps") returned 4 [0183.714] lstrcmpiW (lpString1=".eps", lpString2="wiki") returned -1 [0183.714] lstrlenW (lpString=".epsf") returned 5 [0183.714] lstrcmpiW (lpString1=".epsf", lpString2=".wiki") returned -1 [0183.714] lstrlenW (lpString=".epsp") returned 5 [0183.714] lstrcmpiW (lpString1=".epsp", lpString2=".wiki") returned -1 [0183.714] lstrlenW (lpString=".erf") returned 4 [0183.715] lstrcmpiW (lpString1=".erf", lpString2="wiki") returned -1 [0183.715] lstrlenW (lpString=".exr") returned 4 [0183.715] lstrcmpiW (lpString1=".exr", lpString2="wiki") returned -1 [0183.715] lstrlenW (lpString=".f4v") returned 4 [0183.715] lstrcmpiW (lpString1=".f4v", lpString2="wiki") returned -1 [0183.715] lstrlenW (lpString=".fido") returned 5 [0183.715] lstrcmpiW (lpString1=".fido", lpString2=".wiki") returned -1 [0183.715] lstrlenW (lpString=".flm") returned 4 [0183.715] lstrcmpiW (lpString1=".flm", lpString2="wiki") returned -1 [0183.715] lstrlenW (lpString=".flv") returned 4 [0183.715] lstrcmpiW (lpString1=".flv", lpString2="wiki") returned -1 [0183.715] lstrlenW (lpString=".frm") returned 4 [0183.715] lstrcmpiW (lpString1=".frm", lpString2="wiki") returned -1 [0183.715] lstrlenW (lpString=".fxg") returned 4 [0183.715] lstrcmpiW (lpString1=".fxg", lpString2="wiki") returned -1 [0183.715] lstrlenW (lpString=".geo") returned 4 [0183.715] lstrcmpiW (lpString1=".geo", lpString2="wiki") returned -1 [0183.715] lstrlenW (lpString=".gif") returned 4 [0183.715] lstrcmpiW (lpString1=".gif", lpString2="wiki") returned -1 [0183.715] lstrlenW (lpString=".grs") returned 4 [0183.715] lstrcmpiW (lpString1=".grs", lpString2="wiki") returned -1 [0191.631] FindNextFileW (in: hFindFile=0x38d3dc0, lpFindFileData=0x3ceee18 | out: lpFindFileData=0x3ceee18*(dwFileAttributes=0x2016, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xd97d7f40, ftLastWriteTime.dwHighDateTime=0x1d2dda0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0191.631] FindNextFileW (in: hFindFile=0x38d3dc0, lpFindFileData=0x3ceee18 | out: lpFindFileData=0x3ceee18*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0xd97d7f40, ftCreationTime.dwHighDateTime=0x1d2dda0, ftLastAccessTime.dwLowDateTime=0xd97d7f40, ftLastAccessTime.dwHighDateTime=0x1d2dda0, ftLastWriteTime.dwLowDateTime=0xed0fc650, ftLastWriteTime.dwHighDateTime=0x1d35d05, nFileSizeHigh=0x0, nFileSizeLow=0x4000, dwReserved0=0x0, dwReserved1=0x0, cFileName="index.dat", cAlternateFileName="")) returned 1 Thread: id = 82 os_tid = 0x318 Thread: id = 83 os_tid = 0x324 Thread: id = 84 os_tid = 0x7e8 Process: id = "12" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x6d828000" os_pid = "0x5d4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x5d8" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e003" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 59 os_tid = 0x5ec [0183.240] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14fc30 | out: lpSystemTimeAsFileTime=0x14fc30*(dwLowDateTime=0xee4527a0, dwHighDateTime=0x1d58773)) [0183.240] GetCurrentProcessId () returned 0x5d4 [0183.240] GetCurrentThreadId () returned 0x5ec [0183.240] GetTickCount () returned 0x113ba6a [0183.240] QueryPerformanceCounter (in: lpPerformanceCount=0x14fc38 | out: lpPerformanceCount=0x14fc38*=11422199222) returned 1 [0183.241] GetModuleHandleW (lpModuleName=0x0) returned 0x4a1c0000 [0183.241] __set_app_type (_Type=0x1) [0183.242] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a1e7810) returned 0x0 [0183.242] __getmainargs (in: _Argc=0x4a20a608, _Argv=0x4a20a618, _Env=0x4a20a610, _DoWildCard=0, _StartInfo=0x4a1ee0f4 | out: _Argc=0x4a20a608, _Argv=0x4a20a618, _Env=0x4a20a610) returned 0 [0183.243] GetCurrentThreadId () returned 0x5ec [0183.243] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5ec) returned 0x3c [0183.243] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c30000 [0183.243] GetProcAddress (hModule=0x76c30000, lpProcName="SetThreadUILanguage") returned 0x76c46d40 [0183.243] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0183.243] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0183.244] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14fbc8 | out: phkResult=0x14fbc8*=0x0) returned 0x2 [0183.244] VirtualQuery (in: lpAddress=0x14fbb0, lpBuffer=0x14fb30, dwLength=0x30 | out: lpBuffer=0x14fb30*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0183.244] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14fb30, dwLength=0x30 | out: lpBuffer=0x14fb30*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0183.244] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14fb30, dwLength=0x30 | out: lpBuffer=0x14fb30*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0183.244] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14fb30, dwLength=0x30 | out: lpBuffer=0x14fb30*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0183.244] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14fb30, dwLength=0x30 | out: lpBuffer=0x14fb30*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0183.244] GetConsoleOutputCP () returned 0x1b5 [0183.244] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0183.245] SetConsoleCtrlHandler (HandlerRoutine=0x4a1e3184, Add=1) returned 1 [0183.245] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.245] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0183.245] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.245] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a1ee194 | out: lpMode=0x4a1ee194) returned 0 [0183.245] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.245] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a1ee198 | out: lpMode=0x4a1ee198) returned 0 [0183.245] GetEnvironmentStringsW () returned 0x2e8aa0* [0183.246] GetProcessHeap () returned 0x2d0000 [0183.246] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xab4) returned 0x2e9560 [0183.246] FreeEnvironmentStringsW (penv=0x2e8aa0) returned 1 [0183.246] GetProcessHeap () returned 0x2d0000 [0183.246] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x8) returned 0x2e8920 [0183.246] GetEnvironmentStringsW () returned 0x2e8aa0* [0183.246] GetProcessHeap () returned 0x2d0000 [0183.246] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xab4) returned 0x2ea020 [0183.246] FreeEnvironmentStringsW (penv=0x2e8aa0) returned 1 [0183.246] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14ea88 | out: phkResult=0x14ea88*=0x44) returned 0x0 [0183.246] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x0, lpData=0x14eaa0*=0x18, lpcbData=0x14ea84*=0x1000) returned 0x2 [0183.246] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x4, lpData=0x14eaa0*=0x1, lpcbData=0x14ea84*=0x4) returned 0x0 [0183.246] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x0, lpData=0x14eaa0*=0x1, lpcbData=0x14ea84*=0x1000) returned 0x2 [0183.246] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x4, lpData=0x14eaa0*=0x0, lpcbData=0x14ea84*=0x4) returned 0x0 [0183.246] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x4, lpData=0x14eaa0*=0x40, lpcbData=0x14ea84*=0x4) returned 0x0 [0183.246] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x4, lpData=0x14eaa0*=0x40, lpcbData=0x14ea84*=0x4) returned 0x0 [0183.246] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x0, lpData=0x14eaa0*=0x40, lpcbData=0x14ea84*=0x1000) returned 0x2 [0183.247] RegCloseKey (hKey=0x44) returned 0x0 [0183.247] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14ea88 | out: phkResult=0x14ea88*=0x44) returned 0x0 [0183.247] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x0, lpData=0x14eaa0*=0x40, lpcbData=0x14ea84*=0x1000) returned 0x2 [0183.247] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x4, lpData=0x14eaa0*=0x1, lpcbData=0x14ea84*=0x4) returned 0x0 [0183.247] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x0, lpData=0x14eaa0*=0x1, lpcbData=0x14ea84*=0x1000) returned 0x2 [0183.247] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x4, lpData=0x14eaa0*=0x0, lpcbData=0x14ea84*=0x4) returned 0x0 [0183.247] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x4, lpData=0x14eaa0*=0x9, lpcbData=0x14ea84*=0x4) returned 0x0 [0183.247] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x4, lpData=0x14eaa0*=0x9, lpcbData=0x14ea84*=0x4) returned 0x0 [0183.247] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14ea80, lpData=0x14eaa0, lpcbData=0x14ea84*=0x1000 | out: lpType=0x14ea80*=0x0, lpData=0x14eaa0*=0x9, lpcbData=0x14ea84*=0x1000) returned 0x2 [0183.247] RegCloseKey (hKey=0x44) returned 0x0 [0183.247] time (in: timer=0x0 | out: timer=0x0) returned 0x5daca6e6 [0183.247] srand (_Seed=0x5daca6e6) [0183.247] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0183.247] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0183.248] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a1fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0183.248] GetProcessHeap () returned 0x2d0000 [0183.248] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x218) returned 0x2eaae0 [0183.248] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2eaaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0183.248] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0183.248] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0183.248] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0183.248] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0183.248] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0183.248] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0183.248] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0183.248] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0183.248] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0183.248] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0183.249] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0183.249] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0183.249] GetProcessHeap () returned 0x2d0000 [0183.249] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9560 | out: hHeap=0x2d0000) returned 1 [0183.249] GetEnvironmentStringsW () returned 0x2e8aa0* [0183.249] GetProcessHeap () returned 0x2d0000 [0183.249] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xacc) returned 0x2ead00 [0183.249] FreeEnvironmentStringsW (penv=0x2e8aa0) returned 1 [0183.249] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0183.249] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0183.249] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0183.249] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0183.249] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0183.249] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0183.249] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0183.249] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0183.249] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0183.249] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0183.249] GetProcessHeap () returned 0x2d0000 [0183.249] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x38) returned 0x2e64d0 [0183.249] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f890 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0183.249] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x14f890, lpFilePart=0x14f870 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14f870*="system32") returned 0x13 [0183.249] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0183.249] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x14f5a0 | out: lpFindFileData=0x14f5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0x2eb7e0 [0183.250] FindClose (in: hFindFile=0x2eb7e0 | out: hFindFile=0x2eb7e0) returned 1 [0183.250] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x14f5a0 | out: lpFindFileData=0x14f5a0*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x99474030, ftLastAccessTime.dwHighDateTime=0x1d58773, ftLastWriteTime.dwLowDateTime=0x99474030, ftLastWriteTime.dwHighDateTime=0x1d58773, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0x2eb7e0 [0183.250] FindClose (in: hFindFile=0x2eb7e0 | out: hFindFile=0x2eb7e0) returned 1 [0183.250] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0183.250] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0183.250] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0183.250] GetProcessHeap () returned 0x2d0000 [0183.250] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ead00 | out: hHeap=0x2d0000) returned 1 [0183.250] GetEnvironmentStringsW () returned 0x2ead00* [0183.250] GetProcessHeap () returned 0x2d0000 [0183.250] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xafc) returned 0x2e8aa0 [0183.250] FreeEnvironmentStringsW (penv=0x2ead00) returned 1 [0183.250] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a1fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0183.250] GetProcessHeap () returned 0x2d0000 [0183.250] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e64d0 | out: hHeap=0x2d0000) returned 1 [0183.250] GetProcessHeap () returned 0x2d0000 [0183.250] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4016) returned 0x2ead00 [0183.251] GetProcessHeap () returned 0x2d0000 [0183.251] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ead00 | out: hHeap=0x2d0000) returned 1 [0183.251] GetConsoleOutputCP () returned 0x1b5 [0183.251] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0183.251] GetUserDefaultLCID () returned 0x409 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a1f7b50, cchData=8 | out: lpLCData=":") returned 2 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f9a0, cchData=128 | out: lpLCData="0") returned 2 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f9a0, cchData=128 | out: lpLCData="0") returned 2 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f9a0, cchData=128 | out: lpLCData="1") returned 2 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a20a740, cchData=8 | out: lpLCData="/") returned 2 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a20a4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a20a460, cchData=32 | out: lpLCData="Tue") returned 4 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a20a420, cchData=32 | out: lpLCData="Wed") returned 4 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a20a3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a20a3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a20a360, cchData=32 | out: lpLCData="Sat") returned 4 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a20a700, cchData=32 | out: lpLCData="Sun") returned 4 [0183.252] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a1f7b40, cchData=8 | out: lpLCData=".") returned 2 [0183.253] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a20a4e0, cchData=8 | out: lpLCData=",") returned 2 [0183.253] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0183.253] GetProcessHeap () returned 0x2d0000 [0183.253] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x20c) returned 0x2e9620 [0183.253] GetConsoleTitleW (in: lpConsoleTitle=0x2e9620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0183.254] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.254] GetFileType (hFile=0xf4) returned 0x3 [0183.255] BrandingFormatString () returned 0x2e9840 [0183.260] GetVersion () returned 0x1db10106 [0183.260] _vsnwprintf (in: _Buffer=0x14fb10, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x14faa8 | out: _Buffer="6.1.7601") returned 8 [0183.260] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.260] GetFileType (hFile=0xf4) returned 0x3 [0183.260] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a206340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0183.261] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a206340, nSize=0x2000, Arguments=0x14fab0 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0183.261] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.261] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0183.261] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14fa38, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14fa38*=0x24, lpOverlapped=0x0) returned 1 [0183.261] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14fad8 | out: _Buffer="\r\n") returned 2 [0183.261] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.261] GetFileType (hFile=0xf4) returned 0x3 [0183.261] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.261] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0183.261] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14faa8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14faa8*=0x2, lpOverlapped=0x0) returned 1 [0183.261] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x14fad8 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0183.261] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.261] GetFileType (hFile=0xf4) returned 0x3 [0183.261] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.261] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0183.261] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x14faa8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14faa8*=0x3f, lpOverlapped=0x0) returned 1 [0183.261] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14fad8 | out: _Buffer="\r\n") returned 2 [0183.261] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.261] GetFileType (hFile=0xf4) returned 0x3 [0183.261] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.261] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0183.261] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14faa8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14faa8*=0x2, lpOverlapped=0x0) returned 1 [0183.262] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76c30000 [0183.262] GetProcAddress (hModule=0x76c30000, lpProcName="CopyFileExW") returned 0x76c423d0 [0183.262] GetProcAddress (hModule=0x76c30000, lpProcName="IsDebuggerPresent") returned 0x76c38290 [0183.262] GetProcAddress (hModule=0x76c30000, lpProcName="SetConsoleInputExeNameW") returned 0x76c417e0 [0183.262] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.262] GetFileType (hFile=0xe8) returned 0x3 [0183.262] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0183.262] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x14f900 | out: TokenHandle=0x14f900*=0x0) returned 0xc000007c [0183.262] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x14f900 | out: TokenHandle=0x14f900*=0x50) returned 0x0 [0183.262] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x14f910, TokenInformationLength=0x4, ReturnLength=0x14f918 | out: TokenInformation=0x14f910, ReturnLength=0x14f918) returned 0x0 [0183.263] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x14f918, TokenInformationLength=0x4, ReturnLength=0x14f910 | out: TokenInformation=0x14f918, ReturnLength=0x14f910) returned 0x0 [0183.263] NtClose (Handle=0x50) returned 0x0 [0183.263] GetProcessHeap () returned 0x2d0000 [0183.263] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eaae0 | out: hHeap=0x2d0000) returned 1 [0183.264] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f618 | out: _Buffer="\r\n") returned 2 [0183.264] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.264] GetFileType (hFile=0xf4) returned 0x3 [0183.264] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.264] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0183.264] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f5e8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14f5e8*=0x2, lpOverlapped=0x0) returned 1 [0183.264] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0183.264] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a1fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0183.264] _vsnwprintf (in: _Buffer=0x4a1eeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f628 | out: _Buffer="C:\\Windows\\system32") returned 19 [0183.264] _vsnwprintf (in: _Buffer=0x4a1eeb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x14f628 | out: _Buffer=">") returned 1 [0183.264] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.264] GetFileType (hFile=0xf4) returned 0x3 [0183.264] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.264] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0183.265] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x14f618, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14f618*=0x14, lpOverlapped=0x0) returned 1 [0183.265] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.265] GetFileType (hFile=0xe8) returned 0x3 [0183.265] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.265] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.265] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0183.265] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.265] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.265] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0183.265] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.265] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.265] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0183.265] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.265] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.265] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.265] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0183.265] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.265] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.266] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0183.266] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.266] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.266] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0183.266] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.266] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.266] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0183.266] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.266] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.266] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0183.266] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.266] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.266] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0183.266] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.266] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.266] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0183.266] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.266] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.266] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.266] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0183.266] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.266] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.267] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0183.267] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.267] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.267] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0183.267] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.267] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.267] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0183.267] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.267] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.267] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0183.267] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.267] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.267] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0183.267] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.267] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.267] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0183.267] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.267] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.267] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.267] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0183.267] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.267] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.268] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0183.268] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.268] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.268] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0183.268] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.268] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.268] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0183.268] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.268] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.268] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0183.268] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.268] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.268] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0183.268] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.268] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.268] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.268] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0183.269] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.269] GetFileType (hFile=0xe8) returned 0x3 [0183.269] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.269] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.269] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.269] GetFileType (hFile=0xf4) returned 0x3 [0183.269] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.269] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0183.269] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x14f8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14f8f8*=0x18, lpOverlapped=0x0) returned 1 [0183.269] GetProcessHeap () returned 0x2d0000 [0183.269] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4012) returned 0x2eb310 [0183.269] GetProcessHeap () returned 0x2d0000 [0183.269] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb310 | out: hHeap=0x2d0000) returned 1 [0183.269] _wcsicmp (_String1="mode", _String2=")") returned 68 [0183.270] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0183.270] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0183.270] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0183.270] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0183.270] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0183.270] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0183.270] GetProcessHeap () returned 0x2d0000 [0183.270] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb0) returned 0x2e9840 [0183.270] GetProcessHeap () returned 0x2d0000 [0183.270] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1a) returned 0x2e4630 [0183.270] GetProcessHeap () returned 0x2d0000 [0183.270] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x38) returned 0x2e6550 [0183.271] GetConsoleOutputCP () returned 0x1b5 [0183.271] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0183.271] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0183.271] GetConsoleTitleW (in: lpConsoleTitle=0x14f8b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0183.272] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0183.272] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0183.272] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0183.272] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0183.272] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0183.272] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0183.272] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0183.272] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0183.272] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0183.272] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0183.272] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0183.272] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0183.272] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0183.272] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0183.272] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0183.272] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0183.272] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0183.272] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0183.272] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0183.272] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0183.272] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0183.272] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0183.272] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0183.272] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0183.272] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0183.272] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0183.272] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0183.272] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0183.272] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0183.272] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0183.272] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0183.272] _wcsicmp (_String1="mode", _String2="START") returned -6 [0183.272] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0183.272] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0183.272] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0183.272] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0183.272] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0183.272] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0183.272] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0183.273] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0183.273] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0183.273] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0183.273] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0183.273] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0183.273] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0183.273] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0183.273] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0183.273] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0183.273] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0183.273] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0183.273] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0183.273] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0183.273] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0183.273] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0183.273] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0183.273] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0183.273] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0183.273] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0183.273] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0183.273] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0183.273] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0183.273] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0183.273] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0183.273] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0183.273] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0183.273] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0183.273] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0183.273] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0183.273] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0183.273] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0183.274] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0183.274] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0183.274] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0183.274] _wcsicmp (_String1="mode", _String2="START") returned -6 [0183.274] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0183.274] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0183.274] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0183.274] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0183.274] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0183.274] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0183.274] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0183.274] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0183.274] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0183.274] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0183.274] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0183.274] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0183.274] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0183.274] GetProcessHeap () returned 0x2d0000 [0183.274] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x218) returned 0x2eaae0 [0183.274] GetProcessHeap () returned 0x2d0000 [0183.274] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x42) returned 0x2e9900 [0183.274] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0183.274] GetProcessHeap () returned 0x2d0000 [0183.274] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x420) returned 0x2eb310 [0183.275] SetErrorMode (uMode=0x0) returned 0x0 [0183.275] SetErrorMode (uMode=0x1) returned 0x0 [0183.275] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2eb320, lpFilePart=0x14f140 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14f140*="system32") returned 0x13 [0183.275] SetErrorMode (uMode=0x0) returned 0x1 [0183.275] GetProcessHeap () returned 0x2d0000 [0183.275] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2eb310, Size=0x42) returned 0x2eb310 [0183.275] GetProcessHeap () returned 0x2d0000 [0183.275] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb310) returned 0x42 [0183.275] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0183.275] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0183.275] GetProcessHeap () returned 0x2d0000 [0183.275] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x104) returned 0x2e5bb0 [0183.275] GetProcessHeap () returned 0x2d0000 [0183.275] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1f8) returned 0x2e9c60 [0183.280] GetProcessHeap () returned 0x2d0000 [0183.280] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e9c60, Size=0x106) returned 0x2e9c60 [0183.280] GetProcessHeap () returned 0x2d0000 [0183.280] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e9c60) returned 0x106 [0183.281] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0183.281] GetProcessHeap () returned 0x2d0000 [0183.281] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xe8) returned 0x2e9d80 [0183.281] GetProcessHeap () returned 0x2d0000 [0183.281] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e9d80, Size=0x7e) returned 0x2e9d80 [0183.281] GetProcessHeap () returned 0x2d0000 [0183.281] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e9d80) returned 0x7e [0183.283] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0183.283] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x14eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eeb0) returned 0x2e5cc0 [0183.283] GetProcessHeap () returned 0x2d0000 [0183.283] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x0, Size=0x28) returned 0x2e4660 [0183.283] FindClose (in: hFindFile=0x2e5cc0 | out: hFindFile=0x2e5cc0) returned 1 [0183.283] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x14eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eeb0) returned 0x2e5cc0 [0183.283] GetProcessHeap () returned 0x2d0000 [0183.283] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e4660, Size=0x8) returned 0x2e9950 [0183.283] FindClose (in: hFindFile=0x2e5cc0 | out: hFindFile=0x2e5cc0) returned 1 [0183.284] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0183.284] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0183.284] GetConsoleTitleW (in: lpConsoleTitle=0x14f400, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0183.284] GetProcessHeap () returned 0x2d0000 [0183.284] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x21c) returned 0x2eb370 [0183.284] GetConsoleTitleW (in: lpConsoleTitle=0x2eb380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0183.284] GetProcessHeap () returned 0x2d0000 [0183.284] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2eb370, Size=0x8a) returned 0x2eb370 [0183.284] GetProcessHeap () returned 0x2d0000 [0183.284] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb370) returned 0x8a [0183.284] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0183.285] GetProcessHeap () returned 0x2d0000 [0183.285] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb370 | out: hHeap=0x2d0000) returned 1 [0183.285] InitializeProcThreadAttributeList (in: lpAttributeList=0x14f1b8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14f178 | out: lpAttributeList=0x14f1b8, lpSize=0x14f178) returned 1 [0183.285] UpdateProcThreadAttribute (in: lpAttributeList=0x14f1b8, dwFlags=0x0, Attribute=0x60001, lpValue=0x14f168, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14f1b8, lpPreviousValue=0x0) returned 1 [0183.285] GetStartupInfoW (in: lpStartupInfo=0x14f2d0 | out: lpStartupInfo=0x14f2d0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0183.285] GetProcessHeap () returned 0x2d0000 [0183.285] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x20) returned 0x2e4660 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0183.285] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0183.286] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0183.286] GetProcessHeap () returned 0x2d0000 [0183.286] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e4660 | out: hHeap=0x2d0000) returned 1 [0183.286] GetProcessHeap () returned 0x2d0000 [0183.286] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x12) returned 0x2e8940 [0183.286] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x14f1f0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14f1a0 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x14f1a0*(hProcess=0x54, hThread=0x50, dwProcessId=0x728, dwThreadId=0x734)) returned 1 [0183.299] CloseHandle (hObject=0x50) returned 1 [0183.300] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0183.300] GetProcessHeap () returned 0x2d0000 [0183.300] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e8aa0 | out: hHeap=0x2d0000) returned 1 [0183.300] GetEnvironmentStringsW () returned 0x2e8aa0* [0183.300] GetProcessHeap () returned 0x2d0000 [0183.300] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xafc) returned 0x2eb370 [0183.300] FreeEnvironmentStringsW (penv=0x2e8aa0) returned 1 [0183.300] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76d50000 [0183.300] GetProcAddress (hModule=0x76d50000, lpProcName="NtQueryInformationProcess") returned 0x76da14a0 [0183.300] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14eaa8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14eaa8, ReturnLength=0x0) returned 0x0 [0183.300] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14eae0, nSize=0x380, lpNumberOfBytesRead=0x14eaa0 | out: lpBuffer=0x14eae0*, lpNumberOfBytesRead=0x14eaa0*=0x380) returned 1 [0183.300] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0183.401] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14f0e8 | out: lpExitCode=0x14f0e8*=0x0) returned 1 [0183.401] CloseHandle (hObject=0x54) returned 1 [0183.401] _vsnwprintf (in: _Buffer=0x14f358, _BufferCount=0x13, _Format="%08X", _ArgList=0x14f0f8 | out: _Buffer="00000000") returned 8 [0183.401] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0183.401] GetProcessHeap () returned 0x2d0000 [0183.401] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb370 | out: hHeap=0x2d0000) returned 1 [0183.401] GetEnvironmentStringsW () returned 0x2ee9b0* [0183.401] GetProcessHeap () returned 0x2d0000 [0183.401] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb22) returned 0x2ef4e0 [0183.401] FreeEnvironmentStringsW (penv=0x2ee9b0) returned 1 [0183.401] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0183.401] GetProcessHeap () returned 0x2d0000 [0183.401] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ef4e0 | out: hHeap=0x2d0000) returned 1 [0183.401] GetEnvironmentStringsW () returned 0x2ee9b0* [0183.401] GetProcessHeap () returned 0x2d0000 [0183.401] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb22) returned 0x2ef4e0 [0183.401] FreeEnvironmentStringsW (penv=0x2ee9b0) returned 1 [0183.402] GetProcessHeap () returned 0x2d0000 [0183.402] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e8940 | out: hHeap=0x2d0000) returned 1 [0183.402] DeleteProcThreadAttributeList (in: lpAttributeList=0x14f1b8 | out: lpAttributeList=0x14f1b8) [0183.402] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0183.402] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.402] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0183.402] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.402] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a1ee194 | out: lpMode=0x4a1ee194) returned 0 [0183.403] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.403] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a1ee198 | out: lpMode=0x4a1ee198) returned 0 [0183.403] GetConsoleOutputCP () returned 0x4e3 [0183.403] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0183.404] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0183.404] GetProcessHeap () returned 0x2d0000 [0183.404] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9d80 | out: hHeap=0x2d0000) returned 1 [0183.404] GetProcessHeap () returned 0x2d0000 [0183.404] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9c60 | out: hHeap=0x2d0000) returned 1 [0183.404] GetProcessHeap () returned 0x2d0000 [0183.404] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bb0 | out: hHeap=0x2d0000) returned 1 [0183.404] GetProcessHeap () returned 0x2d0000 [0183.404] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb310 | out: hHeap=0x2d0000) returned 1 [0183.404] GetProcessHeap () returned 0x2d0000 [0183.404] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9900 | out: hHeap=0x2d0000) returned 1 [0183.404] GetProcessHeap () returned 0x2d0000 [0183.404] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eaae0 | out: hHeap=0x2d0000) returned 1 [0183.404] GetProcessHeap () returned 0x2d0000 [0183.404] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e6550 | out: hHeap=0x2d0000) returned 1 [0183.404] GetProcessHeap () returned 0x2d0000 [0183.404] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e4630 | out: hHeap=0x2d0000) returned 1 [0183.404] GetProcessHeap () returned 0x2d0000 [0183.404] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9840 | out: hHeap=0x2d0000) returned 1 [0183.405] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f618 | out: _Buffer="\r\n") returned 2 [0183.405] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.405] GetFileType (hFile=0xf4) returned 0x3 [0183.405] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.405] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0183.405] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f5e8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14f5e8*=0x2, lpOverlapped=0x0) returned 1 [0183.405] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0183.405] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a1fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0183.405] _vsnwprintf (in: _Buffer=0x4a1eeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f628 | out: _Buffer="C:\\Windows\\system32") returned 19 [0183.405] _vsnwprintf (in: _Buffer=0x4a1eeb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x14f628 | out: _Buffer=">") returned 1 [0183.405] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.405] GetFileType (hFile=0xf4) returned 0x3 [0183.405] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.405] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0183.405] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x14f618, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14f618*=0x14, lpOverlapped=0x0) returned 1 [0183.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.405] GetFileType (hFile=0xe8) returned 0x3 [0183.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.405] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.405] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.405] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0183.405] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.405] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.406] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0183.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.406] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0183.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.406] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0183.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.406] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0183.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.406] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0183.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.406] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0183.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.406] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.406] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.406] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0183.406] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.407] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.407] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.407] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0183.407] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.407] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.407] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.407] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0183.407] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.407] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.407] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.407] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0183.407] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.407] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.407] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.407] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0183.407] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.407] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.407] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.407] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0183.407] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.407] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.407] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.407] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0183.407] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.407] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.407] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.407] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0183.408] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.408] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.408] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0183.408] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.408] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.408] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0183.408] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.408] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.408] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0183.408] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.408] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.408] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0183.408] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.408] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.408] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0183.408] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.408] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.408] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0183.408] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.408] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.408] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.408] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0183.409] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.409] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.409] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.409] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0183.409] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.409] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.409] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.409] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0183.409] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.409] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.409] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.409] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0183.409] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.409] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.409] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.409] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0183.409] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.409] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.409] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.409] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0183.409] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.409] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.409] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.409] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0183.409] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.409] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.409] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.409] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0183.409] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.410] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.410] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0183.410] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.410] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.410] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0183.410] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.410] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.410] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0183.410] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.410] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.410] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0183.410] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.410] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.410] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0183.410] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.410] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.410] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0183.410] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.410] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.410] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0183.410] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0183.411] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.411] GetFileType (hFile=0xe8) returned 0x3 [0183.411] _get_osfhandle (_FileHandle=0) returned 0xe8 [0183.411] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0183.411] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.411] GetFileType (hFile=0xf4) returned 0x3 [0183.411] _get_osfhandle (_FileHandle=1) returned 0xf4 [0183.411] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0183.411] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14f8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14f8f8*=0x24, lpOverlapped=0x0) returned 1 [0183.411] GetProcessHeap () returned 0x2d0000 [0183.411] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4012) returned 0x2f1010 [0183.411] GetProcessHeap () returned 0x2d0000 [0183.411] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2f1010 | out: hHeap=0x2d0000) returned 1 [0183.411] GetProcessHeap () returned 0x2d0000 [0183.411] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb0) returned 0x2e9840 [0183.411] GetProcessHeap () returned 0x2d0000 [0183.411] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x22) returned 0x2e4630 [0183.412] GetProcessHeap () returned 0x2d0000 [0183.412] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x48) returned 0x2f0090 [0183.412] GetConsoleOutputCP () returned 0x4e3 [0183.412] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0183.412] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0183.412] GetConsoleTitleW (in: lpConsoleTitle=0x14f8b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0183.412] GetProcessHeap () returned 0x2d0000 [0183.413] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x218) returned 0x2eaae0 [0183.413] GetProcessHeap () returned 0x2d0000 [0183.413] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x5a) returned 0x2e9a50 [0183.413] GetProcessHeap () returned 0x2d0000 [0183.413] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x420) returned 0x2eb9a0 [0183.413] SetErrorMode (uMode=0x0) returned 0x0 [0183.413] SetErrorMode (uMode=0x1) returned 0x0 [0183.413] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2eb9b0, lpFilePart=0x14f140 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x14f140*="system32") returned 0x13 [0183.413] SetErrorMode (uMode=0x0) returned 0x1 [0183.413] GetProcessHeap () returned 0x2d0000 [0183.413] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2eb9a0, Size=0x4a) returned 0x2eb9a0 [0183.413] GetProcessHeap () returned 0x2d0000 [0183.413] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb9a0) returned 0x4a [0183.413] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0183.413] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0183.413] GetProcessHeap () returned 0x2d0000 [0183.413] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x104) returned 0x2e5bb0 [0183.413] GetProcessHeap () returned 0x2d0000 [0183.413] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1f8) returned 0x2eba00 [0183.413] GetProcessHeap () returned 0x2d0000 [0183.413] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2eba00, Size=0x106) returned 0x2eba00 [0183.413] GetProcessHeap () returned 0x2d0000 [0183.413] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eba00) returned 0x106 [0183.413] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0183.413] GetProcessHeap () returned 0x2d0000 [0183.413] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xe8) returned 0x2e9c60 [0183.413] GetProcessHeap () returned 0x2d0000 [0183.413] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2e9c60, Size=0x7e) returned 0x2e9c60 [0183.414] GetProcessHeap () returned 0x2d0000 [0183.414] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2e9c60) returned 0x7e [0183.414] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0183.414] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eeb0) returned 0x2e5cc0 [0183.414] FindClose (in: hFindFile=0x2e5cc0 | out: hFindFile=0x2e5cc0) returned 1 [0183.414] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x14eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eeb0) returned 0xffffffffffffffff [0183.414] GetLastError () returned 0x2 [0183.414] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x14eeb0, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14eeb0) returned 0x2f1040 [0183.414] FindClose (in: hFindFile=0x2f1040 | out: hFindFile=0x2f1040) returned 1 [0183.414] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0183.414] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0183.414] GetConsoleTitleW (in: lpConsoleTitle=0x14f400, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0183.415] GetProcessHeap () returned 0x2d0000 [0183.415] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x21c) returned 0x2ebb20 [0183.415] GetConsoleTitleW (in: lpConsoleTitle=0x2ebb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0183.415] GetProcessHeap () returned 0x2d0000 [0183.415] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2ebb20, Size=0xa2) returned 0x2ebb20 [0183.415] GetProcessHeap () returned 0x2d0000 [0183.415] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2ebb20) returned 0xa2 [0183.415] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0183.415] GetProcessHeap () returned 0x2d0000 [0183.415] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ebb20 | out: hHeap=0x2d0000) returned 1 [0183.415] InitializeProcThreadAttributeList (in: lpAttributeList=0x14f1b8, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14f178 | out: lpAttributeList=0x14f1b8, lpSize=0x14f178) returned 1 [0183.416] UpdateProcThreadAttribute (in: lpAttributeList=0x14f1b8, dwFlags=0x0, Attribute=0x60001, lpValue=0x14f168, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14f1b8, lpPreviousValue=0x0) returned 1 [0183.416] GetStartupInfoW (in: lpStartupInfo=0x14f2d0 | out: lpStartupInfo=0x14f2d0*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0183.416] GetProcessHeap () returned 0x2d0000 [0183.416] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x20) returned 0x2e4660 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0183.416] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0183.417] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0183.417] GetProcessHeap () returned 0x2d0000 [0183.417] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e4660 | out: hHeap=0x2d0000) returned 1 [0183.417] GetProcessHeap () returned 0x2d0000 [0183.417] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x12) returned 0x2e9ac0 [0183.417] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x14f1f0*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14f1a0 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x14f1a0*(hProcess=0x50, hThread=0x54, dwProcessId=0x7c4, dwThreadId=0x4f0)) returned 1 [0183.426] CloseHandle (hObject=0x54) returned 1 [0183.426] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0183.426] GetProcessHeap () returned 0x2d0000 [0183.426] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ef4e0 | out: hHeap=0x2d0000) returned 1 [0183.426] GetEnvironmentStringsW () returned 0x2e89c0* [0183.426] GetProcessHeap () returned 0x2d0000 [0183.427] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb22) returned 0x2ee9b0 [0183.427] FreeEnvironmentStringsW (penv=0x2e89c0) returned 1 [0183.427] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14eaa8, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14eaa8, ReturnLength=0x0) returned 0x0 [0183.427] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14eae0, nSize=0x380, lpNumberOfBytesRead=0x14eaa0 | out: lpBuffer=0x14eae0*, lpNumberOfBytesRead=0x14eaa0*=0x380) returned 1 [0183.427] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0184.341] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x14f0e8 | out: lpExitCode=0x14f0e8*=0x2) returned 1 [0184.341] CloseHandle (hObject=0x50) returned 1 [0184.341] _vsnwprintf (in: _Buffer=0x14f358, _BufferCount=0x13, _Format="%08X", _ArgList=0x14f0f8 | out: _Buffer="00000002") returned 8 [0184.341] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0184.341] GetProcessHeap () returned 0x2d0000 [0184.341] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee9b0 | out: hHeap=0x2d0000) returned 1 [0184.341] GetEnvironmentStringsW () returned 0x2e89c0* [0184.342] GetProcessHeap () returned 0x2d0000 [0184.342] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb22) returned 0x2ee9b0 [0184.342] FreeEnvironmentStringsW (penv=0x2e89c0) returned 1 [0184.342] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0184.342] GetProcessHeap () returned 0x2d0000 [0184.342] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2ee9b0 | out: hHeap=0x2d0000) returned 1 [0184.342] GetEnvironmentStringsW () returned 0x2e89c0* [0184.342] GetProcessHeap () returned 0x2d0000 [0184.342] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb22) returned 0x2ee9b0 [0184.342] FreeEnvironmentStringsW (penv=0x2e89c0) returned 1 [0184.342] GetProcessHeap () returned 0x2d0000 [0184.342] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9ac0 | out: hHeap=0x2d0000) returned 1 [0184.342] DeleteProcThreadAttributeList (in: lpAttributeList=0x14f1b8 | out: lpAttributeList=0x14f1b8) [0184.342] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0184.343] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.343] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0184.343] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.343] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a1ee194 | out: lpMode=0x4a1ee194) returned 0 [0184.343] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.343] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a1ee198 | out: lpMode=0x4a1ee198) returned 0 [0184.343] GetConsoleOutputCP () returned 0x4e3 [0184.343] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0184.343] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0184.343] GetProcessHeap () returned 0x2d0000 [0184.343] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9c60 | out: hHeap=0x2d0000) returned 1 [0184.343] GetProcessHeap () returned 0x2d0000 [0184.343] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eba00 | out: hHeap=0x2d0000) returned 1 [0184.343] GetProcessHeap () returned 0x2d0000 [0184.343] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e5bb0 | out: hHeap=0x2d0000) returned 1 [0184.344] GetProcessHeap () returned 0x2d0000 [0184.344] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb9a0 | out: hHeap=0x2d0000) returned 1 [0184.344] GetProcessHeap () returned 0x2d0000 [0184.344] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9a50 | out: hHeap=0x2d0000) returned 1 [0184.344] GetProcessHeap () returned 0x2d0000 [0184.344] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eaae0 | out: hHeap=0x2d0000) returned 1 [0184.344] GetProcessHeap () returned 0x2d0000 [0184.344] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2f0090 | out: hHeap=0x2d0000) returned 1 [0184.344] GetProcessHeap () returned 0x2d0000 [0184.344] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e4630 | out: hHeap=0x2d0000) returned 1 [0184.344] GetProcessHeap () returned 0x2d0000 [0184.344] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2e9840 | out: hHeap=0x2d0000) returned 1 [0184.344] _vsnwprintf (in: _Buffer=0x4a206340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f618 | out: _Buffer="\r\n") returned 2 [0184.344] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.344] GetFileType (hFile=0xf4) returned 0x3 [0184.344] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.344] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0184.344] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f5e8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14f5e8*=0x2, lpOverlapped=0x0) returned 1 [0184.344] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a1ef360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0184.344] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a1fc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0184.344] _vsnwprintf (in: _Buffer=0x4a1eeb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f628 | out: _Buffer="C:\\Windows\\system32") returned 19 [0184.344] _vsnwprintf (in: _Buffer=0x4a1eeb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x14f628 | out: _Buffer=">") returned 1 [0184.344] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.344] GetFileType (hFile=0xf4) returned 0x3 [0184.344] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.344] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0184.344] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x14f618, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14f618*=0x14, lpOverlapped=0x0) returned 1 [0184.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.345] GetFileType (hFile=0xe8) returned 0x3 [0184.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.345] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.345] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0184.345] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0184.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.345] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.345] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0184.345] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0184.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.345] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.345] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0184.345] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0184.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.345] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.345] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0184.345] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0184.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.345] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.345] ReadFile (in: hFile=0xe8, lpBuffer=0x4a1fc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f918, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesRead=0x14f918*=0x1, lpOverlapped=0x0) returned 1 [0184.345] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a1fc320, cbMultiByte=1, lpWideCharStr=0x4a1fe328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0184.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.345] GetFileType (hFile=0xe8) returned 0x3 [0184.345] _get_osfhandle (_FileHandle=0) returned 0xe8 [0184.345] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0184.346] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.346] GetFileType (hFile=0xf4) returned 0x3 [0184.346] _get_osfhandle (_FileHandle=1) returned 0xf4 [0184.346] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4a1fc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0184.346] WriteFile (in: hFile=0xf4, lpBuffer=0x4a1fc320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x14f8f8, lpOverlapped=0x0 | out: lpBuffer=0x4a1fc320*, lpNumberOfBytesWritten=0x14f8f8*=0x5, lpOverlapped=0x0) returned 1 [0184.346] GetProcessHeap () returned 0x2d0000 [0184.346] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x4012) returned 0x2f2010 [0184.346] GetProcessHeap () returned 0x2d0000 [0184.346] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2f2010 | out: hHeap=0x2d0000) returned 1 [0184.346] GetProcessHeap () returned 0x2d0000 [0184.346] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0xb0) returned 0x2e9840 [0184.346] GetProcessHeap () returned 0x2d0000 [0184.346] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1a) returned 0x2e4630 [0184.346] GetConsoleOutputCP () returned 0x4e3 [0184.346] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a1fbfe0 | out: lpCPInfo=0x4a1fbfe0) returned 1 [0184.346] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0184.346] GetConsoleTitleW (in: lpConsoleTitle=0x14f8b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0184.347] GetProcessHeap () returned 0x2d0000 [0184.347] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x14) returned 0x2e8940 [0184.347] GetProcessHeap () returned 0x2d0000 [0184.347] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x1a) returned 0x2e4660 [0184.347] GetProcessHeap () returned 0x2d0000 [0184.347] RtlAllocateHeap (HeapHandle=0x2d0000, Flags=0x8, Size=0x21c) returned 0x2eb9a0 [0184.347] GetConsoleTitleW (in: lpConsoleTitle=0x2eb9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0184.347] GetProcessHeap () returned 0x2d0000 [0184.347] RtlReAllocateHeap (Heap=0x2d0000, Flags=0x0, Ptr=0x2eb9a0, Size=0x62) returned 0x2eb9a0 [0184.347] GetProcessHeap () returned 0x2d0000 [0184.347] RtlSizeHeap (HeapHandle=0x2d0000, Flags=0x0, MemoryPointer=0x2eb9a0) returned 0x62 [0184.347] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0184.347] GetProcessHeap () returned 0x2d0000 [0184.347] HeapFree (in: hHeap=0x2d0000, dwFlags=0x0, lpMem=0x2eb9a0 | out: hHeap=0x2d0000) returned 1 [0184.348] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0184.348] exit (_Code=2) Process: id = "13" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x6ea8b000" os_pid = "0x728" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x5d4" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e003" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 65 os_tid = 0x734 Process: id = "14" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x6c098000" os_pid = "0x7c4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "12" os_parent_pid = "0x5d4" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "64" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e003" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 72 os_tid = 0x4f0 Thread: id = 78 os_tid = 0x638 Thread: id = 79 os_tid = 0x328 Thread: id = 80 os_tid = 0x26c Thread: id = 81 os_tid = 0x5a4 Process: id = "15" image_name = "1black.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe" page_root = "0x67cde000" os_pid = "0x70c" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "11" os_parent_pid = "0x5d8" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\" -a" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000e003" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 85 os_tid = 0x5c8 [0192.805] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x18ff6c | out: lpSystemTimeAsFileTime=0x18ff6c*(dwLowDateTime=0xf3f39790, dwHighDateTime=0x1d58773)) [0192.805] GetCurrentThreadId () returned 0x5c8 [0192.805] GetCurrentProcessId () returned 0x70c [0192.805] QueryPerformanceCounter (in: lpPerformanceCount=0x18ff64 | out: lpPerformanceCount=0x18ff64*=12380237775) returned 1 [0192.821] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0192.821] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0192.821] GetLastError () returned 0x57 [0192.821] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0192.821] GetLastError () returned 0x57 [0192.821] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x74d80000 [0192.822] GetProcAddress (hModule=0x74d80000, lpProcName="InitializeCriticalSectionEx") returned 0x74d94d28 [0192.822] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0192.822] GetLastError () returned 0x57 [0192.822] GetProcAddress (hModule=0x74d80000, lpProcName="FlsAlloc") returned 0x74d94f2b [0192.822] GetProcAddress (hModule=0x74d80000, lpProcName="FlsSetValue") returned 0x74d94208 [0192.823] LoadLibraryExW (lpLibFileName="api-ms-win-core-synch-l1-2-0", hFile=0x0, dwFlags=0x800) returned 0x0 [0192.823] GetLastError () returned 0x57 [0192.823] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x800) returned 0x0 [0192.823] GetLastError () returned 0x57 [0192.823] LoadLibraryExW (lpLibFileName="kernel32", hFile=0x0, dwFlags=0x0) returned 0x74d80000 [0192.823] GetProcAddress (hModule=0x74d80000, lpProcName="InitializeCriticalSectionEx") returned 0x74d94d28 [0192.823] GetProcessHeap () returned 0x8d0000 [0192.823] LoadLibraryExW (lpLibFileName="api-ms-win-core-fibers-l1-1-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0192.823] GetLastError () returned 0x57 [0192.823] GetProcAddress (hModule=0x74d80000, lpProcName="FlsAlloc") returned 0x74d94f2b [0192.823] GetLastError () returned 0x57 [0192.823] GetProcAddress (hModule=0x74d80000, lpProcName="FlsGetValue") returned 0x74d91252 [0192.823] GetProcAddress (hModule=0x74d80000, lpProcName="FlsSetValue") returned 0x74d94208 [0192.823] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x364) returned 0x8eaef0 [0192.824] SetLastError (dwErrCode=0x57) [0192.824] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0xe00) returned 0x8eb260 [0192.825] GetStartupInfoW (in: lpStartupInfo=0x18fea4 | out: lpStartupInfo=0x18fea4*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x40faf0, hStdOutput=0x13918406, hStdError=0xfffffffe)) [0192.825] GetStdHandle (nStdHandle=0xfffffff6) returned 0x0 [0192.825] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0192.825] GetStdHandle (nStdHandle=0xfffffff4) returned 0x0 [0192.825] GetCommandLineA () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\" -a" [0192.825] GetCommandLineW () returned="\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe\" -a" [0192.825] GetACP () returned 0x4e4 [0192.825] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x220) returned 0x8ec868 [0192.825] IsValidCodePage (CodePage=0x4e4) returned 1 [0192.825] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18fec4 | out: lpCPInfo=0x18fec4) returned 1 [0192.825] GetCPInfo (in: CodePage=0x4e4, lpCPInfo=0x18f78c | out: lpCPInfo=0x18f78c) returned 1 [0192.826] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0192.826] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f528, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0192.826] GetStringTypeW (in: dwInfoType=0x1, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpCharType=0x18f7a0 | out: lpCharType=0x18f7a0) returned 1 [0192.826] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0192.826] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f4e8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0192.826] LoadLibraryExW (lpLibFileName="api-ms-win-core-localization-l1-2-1", hFile=0x0, dwFlags=0x800) returned 0x0 [0192.826] GetLastError () returned 0x57 [0192.826] GetProcAddress (hModule=0x74d80000, lpProcName="LCMapStringEx") returned 0x74e147f1 [0192.826] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0192.826] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x100, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2d8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ") returned 256 [0192.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰š‹œ\x8dž\x8f\x90‘’“”•–—˜™š›œ\x9džÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿȈ", cchWideChar=256, lpMultiByteStr=0x18fca0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ:|Í\x13Üþ\x18", lpUsedDefaultChar=0x0) returned 256 [0192.826] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x0, cchWideChar=0 | out: lpWideCharStr=0x0) returned 256 [0192.826] MultiByteToWideChar (in: CodePage=0x4e4, dwFlags=0x1, lpMultiByteStr=0x18fda0, cbMultiByte=256, lpWideCharStr=0x18f4f8, cchWideChar=256 | out: lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ") returned 256 [0192.826] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x0, cchDest=0, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=0x0) returned 256 [0192.826] LCMapStringEx (in: lpLocaleName=0x0, dwMapFlags=0x200, lpSrcStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f€\x81‚ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™š›œ\x9džŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿĀ", cchSrc=256, lpDestStr=0x18f2e8, cchDest=256, lpVersionInformation=0x0, lpReserved=0x0, lParam=0x0 | out: lpDestStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ") returned 256 [0192.826] WideCharToMultiByte (in: CodePage=0x4e4, dwFlags=0x0, lpWideCharStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f€\x81‚Ƒ„…†‡ˆ‰Š‹Œ\x8dŽ\x8f\x90‘’“”•–—˜™Š›Œ\x9dŽŸ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞŸȈ", cchWideChar=256, lpMultiByteStr=0x18fba0, cbMultiByte=256, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=" \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`ABCDEFGHIJKLMNOPQRSTUVWXYZ{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x8a\x9b\x8c\x9d\x8e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ÷ØÙÚÛÜÝÞ\x9f \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@abcdefghijklmnopqrstuvwxyz[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x9a\x8b\x9c\x8d\x9e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9eÿ ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿àáâãäåæçèéêëìíîïðñòóôõö×øùúûüýþßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ \x01\x02\x03\x04\x05\x06\x07\x08\x09\n\x0b\x0c\r\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f !\"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\x7f\x80\x81\x82\x83\x84…\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f ¡¢£¤¥¦§¨©ª«¬­®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö÷øùúûüýþÿ:|Í\x13Üþ\x18", lpUsedDefaultChar=0x0) returned 256 [0192.826] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x80) returned 0x8eca90 [0192.826] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x18fce8, nSize=0x105 | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\1black.exe")) returned 0x66 [0192.826] GetProcAddress (hModule=0x74d80000, lpProcName="AreFileApisANSI") returned 0x74e140d1 [0192.826] AreFileApisANSI () returned 1 [0192.826] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", cchWideChar=-1, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 103 [0192.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", cchWideChar=-1, lpMultiByteStr=0x4455c8, cbMultiByte=260, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", lpUsedDefaultChar=0x0) returned 103 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x76) returned 0x8dfba0 [0192.827] RtlInitializeSListHead (in: ListHead=0x4454c8 | out: ListHead=0x4454c8) [0192.827] GetLastError () returned 0x0 [0192.827] SetLastError (dwErrCode=0x0) [0192.827] GetEnvironmentStringsW () returned 0x8ecb18* [0192.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x0, cbMultiByte=0, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr=0x0, lpUsedDefaultChar=0x0) returned 1381 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x565) returned 0x8ed5f0 [0192.827] WideCharToMultiByte (in: CodePage=0x0, dwFlags=0x0, lpWideCharStr="ALLUSERSPROFILE=C:\\ProgramData", cchWideChar=1381, lpMultiByteStr=0x8ed5f0, cbMultiByte=1381, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="ALLUSERSPROFILE=C:\\ProgramData", lpUsedDefaultChar=0x0) returned 1381 [0192.827] FreeEnvironmentStringsW (penv=0x8ecb18) returned 1 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x98) returned 0x8edb60 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x1f) returned 0x8ec698 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x36) returned 0x8e1ee0 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x37) returned 0x8edc00 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x3c) returned 0x8e24c8 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x31) returned 0x8edc40 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x17) returned 0x8e7e58 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x24) returned 0x8e1f20 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x14) returned 0x8e7e78 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0xd) returned 0x8e9b28 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x25) returned 0x8edc80 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x39) returned 0x8e2510 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7e98 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x17) returned 0x8e7eb8 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0xe) returned 0x8e9b10 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x69) returned 0x8edcb0 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x3e) returned 0x8e2558 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x1b) returned 0x8ec6c0 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x1d) returned 0x8ec6e8 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x48) returned 0x8edd28 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x12) returned 0x8e7ed8 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7ef8 [0192.827] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x1b) returned 0x8ec710 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x24) returned 0x8edd78 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x29) returned 0x8edda8 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x1e) returned 0x8ec738 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x41) returned 0x8edde0 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x17) returned 0x8e7f18 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0xf) returned 0x8e9b40 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x16) returned 0x8e7f38 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x2a) returned 0x8ede30 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x29) returned 0x8ede68 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x15) returned 0x8e7f58 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x1e) returned 0x8ec760 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x2a) returned 0x8edea0 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x12) returned 0x8e7f78 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x18) returned 0x8e7f98 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x46) returned 0x8eded8 [0192.828] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8ed5f0 | out: hHeap=0x8d0000) returned 1 [0192.828] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x8, Size=0x800) returned 0x8ecb18 [0192.828] IsProcessorFeaturePresent (ProcessorFeature=0xa) returned 1 [0192.829] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x40e130) returned 0x0 [0192.829] GetStartupInfoW (in: lpStartupInfo=0x18ff08 | out: lpStartupInfo=0x18ff08*(cb=0x44, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\1Black.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x1, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0)) [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] PtInRect (lprc=0x18f980, pt=0x0) returned 0 [0192.829] DeletePwrScheme (uiID=0x0) returned 0 [0192.830] SetFocus (hWnd=0x0) returned 0x0 [0192.830] InsertMenuA (hMenu=0x0, uPosition=0x0, uFlags=0x10, uIDNewItem=0x102, lpNewItem="Файл") returned 0 [0192.830] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x8) returned 0x8edf28 [0192.830] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x20) returned 0x8ec800 [0192.830] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x8e9b58 [0192.830] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x10) returned 0x8e9b70 [0192.830] ReadProcessorPwrScheme (in: uiID=0x0, pMachineProcessorPowerPolicy=0x0 | out: pMachineProcessorPowerPolicy=0x0) returned 0 [0192.830] UnRegisterTypeLib (libID=0x18f990*(Data1=0x0, Data2=0x0, Data3=0x0, Data4=([0]=0x0, [1]=0x0, [2]=0x0, [3]=0x0, [4]=0x0, [5]=0x0, [6]=0x0, [7]=0x0)), wVerMajor=0x1, wVerMinor=0x0, lcid=0x0, syskind=0x1) returned 0x8002801c [0192.831] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe0 [0192.831] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.831] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xdc [0192.831] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.831] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe4 [0192.831] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.831] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xe8 [0192.831] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.831] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xec [0192.831] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.831] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf0 [0192.831] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.831] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf4 [0192.831] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.831] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xf8 [0192.831] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.831] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0xfc [0192.831] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x100 [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x104 [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x108 [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x10c [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x110 [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x114 [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x118 [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x11c [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x120 [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x124 [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x128 [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x12c [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] CreateEventA (lpEventAttributes=0x0, bManualReset=0, bInitialState=0, lpName=0x0) returned 0x130 [0192.832] SendMessageA (hWnd=0x0, Msg=0x0, wParam=0x0, lParam=0x0) returned 0x0 [0192.832] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e9b70 | out: hHeap=0x8d0000) returned 1 [0192.832] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8e9b58 | out: hHeap=0x8d0000) returned 1 [0192.832] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8ec800 | out: hHeap=0x8d0000) returned 1 [0192.832] HeapFree (in: hHeap=0x8d0000, dwFlags=0x0, lpMem=0x8edf28 | out: hHeap=0x8d0000) returned 1 [0192.832] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1400) returned 0x8edf28 [0192.832] GetLastError () returned 0x578 [0192.833] IsIconic (hWnd=0x0) returned 0 [0192.833] GetClientRect (in: hWnd=0x0, lpRect=0x18f980 | out: lpRect=0x18f980) returned 0 [0192.833] InvalidateRect (hWnd=0x0, lpRect=0x0, bErase=0) returned 1 [0192.846] WSAStringToAddressA (in: AddressString="", AddressFamily=-7989, lpProtocolInfo=0x0, lpAddress=0x18f900, lpAddressLength=0x18f8fc | out: lpAddress=0x18f900, lpAddressLength=0x18f8fc) returned -1 [0192.846] GetKeyState (nVirtKey=16) returned 0 [0192.846] SetFocus (hWnd=0x0) returned 0x0 [0192.846] GetSystemMetrics (nIndex=0) returned 1440 [0193.143] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x23a05f8) returned 0x0 [0193.169] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x2a705f8) returned 0x0 [0193.343] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x2f705f8) returned 0x0 [0193.582] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x34705f8) returned 0x0 [0193.952] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x39705f8) returned 0x0 [0194.252] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x3e705f8) returned 0x0 [0194.734] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x43705f8) returned 0x0 [0195.186] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x48705f8) returned 0x0 [0195.639] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x4d705f8) returned 0x0 [0195.998] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x52705f8) returned 0x0 [0196.494] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x57705f8) returned 0x0 [0196.729] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x5c705f8) returned 0x0 [0196.900] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x61705f8) returned 0x0 [0197.119] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x66705f8) returned 0x0 [0197.331] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x6b705f8) returned 0x0 [0197.509] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x70705f8) returned 0x0 [0197.524] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x75705f8) returned 0x0 [0197.848] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x7a705f8) returned 0x0 [0198.227] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x7f705f8) returned 0x0 [0198.441] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x84705f8) returned 0x0 [0198.451] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x89705f8) returned 0x0 [0198.757] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x8e705f8) returned 0x0 [0198.986] StgCreateDocfile (in: pwcsName=0x0, grfMode=0x10002, reserved=0x0, ppstgOpen=0x18f3d4 | out: ppstgOpen=0x18f3d4*=0x93705f8) returned 0x0 [0199.244] CanUserWritePwrScheme () returned 1 [0199.244] GetSystemMetrics (nIndex=46) returned 2 [0199.244] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0199.244] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0199.244] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0199.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.185] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.185] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.185] GetLastError () returned 0x578 [0200.185] SetLastError (dwErrCode=0x578) [0200.185] GetLastError () returned 0x578 [0200.185] SetLastError (dwErrCode=0x578) [0200.185] RtlAllocateHeap (HeapHandle=0x8d0000, Flags=0x0, Size=0x1000) returned 0x9007c8 [0200.185] CanUserWritePwrScheme () returned 1 [0200.186] GetSystemMetrics (nIndex=46) returned 2 [0200.186] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.186] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.186] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.186] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.191] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.191] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.191] GetLastError () returned 0x578 [0200.191] SetLastError (dwErrCode=0x578) [0200.191] CanUserWritePwrScheme () returned 1 [0200.191] GetSystemMetrics (nIndex=46) returned 2 [0200.191] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.192] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.192] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.192] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.196] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.196] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.196] GetLastError () returned 0x578 [0200.196] SetLastError (dwErrCode=0x578) [0200.196] CanUserWritePwrScheme () returned 1 [0200.197] GetSystemMetrics (nIndex=46) returned 2 [0200.197] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.197] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.197] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.197] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.203] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.203] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.203] GetLastError () returned 0x578 [0200.204] SetLastError (dwErrCode=0x578) [0200.204] CanUserWritePwrScheme () returned 1 [0200.204] GetSystemMetrics (nIndex=46) returned 2 [0200.204] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.204] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.204] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.204] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.212] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.212] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.212] GetLastError () returned 0x578 [0200.212] SetLastError (dwErrCode=0x578) [0200.212] CanUserWritePwrScheme () returned 1 [0200.212] GetSystemMetrics (nIndex=46) returned 2 [0200.212] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.212] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.212] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.212] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.217] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.217] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.217] GetLastError () returned 0x578 [0200.217] SetLastError (dwErrCode=0x578) [0200.217] CanUserWritePwrScheme () returned 1 [0200.218] GetSystemMetrics (nIndex=46) returned 2 [0200.218] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.218] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.218] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.218] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.222] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.223] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.223] GetLastError () returned 0x578 [0200.223] SetLastError (dwErrCode=0x578) [0200.223] CanUserWritePwrScheme () returned 1 [0200.223] GetSystemMetrics (nIndex=46) returned 2 [0200.223] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.223] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.223] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.223] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.228] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.228] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.228] GetLastError () returned 0x578 [0200.228] SetLastError (dwErrCode=0x578) [0200.228] CanUserWritePwrScheme () returned 1 [0200.228] GetSystemMetrics (nIndex=46) returned 2 [0200.229] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.229] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.229] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.229] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.233] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.233] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.233] GetLastError () returned 0x578 [0200.233] SetLastError (dwErrCode=0x578) [0200.234] CanUserWritePwrScheme () returned 1 [0200.234] GetSystemMetrics (nIndex=46) returned 2 [0200.234] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.234] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.234] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.234] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.239] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.239] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.239] GetLastError () returned 0x578 [0200.239] SetLastError (dwErrCode=0x578) [0200.239] CanUserWritePwrScheme () returned 1 [0200.239] GetSystemMetrics (nIndex=46) returned 2 [0200.239] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.239] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.239] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.240] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.244] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.244] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.244] GetLastError () returned 0x578 [0200.244] SetLastError (dwErrCode=0x578) [0200.244] CanUserWritePwrScheme () returned 1 [0200.245] GetSystemMetrics (nIndex=46) returned 2 [0200.245] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.245] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.245] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.245] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.250] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.250] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.250] GetLastError () returned 0x578 [0200.250] SetLastError (dwErrCode=0x578) [0200.250] CanUserWritePwrScheme () returned 1 [0200.250] GetSystemMetrics (nIndex=46) returned 2 [0200.250] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.250] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.250] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.250] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.441] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.441] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.441] GetLastError () returned 0x578 [0200.441] SetLastError (dwErrCode=0x578) [0200.441] CanUserWritePwrScheme () returned 1 [0200.442] GetSystemMetrics (nIndex=46) returned 2 [0200.442] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.442] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.442] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.442] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.447] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.447] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.447] GetLastError () returned 0x578 [0200.447] SetLastError (dwErrCode=0x578) [0200.447] CanUserWritePwrScheme () returned 1 [0200.447] GetSystemMetrics (nIndex=46) returned 2 [0200.448] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.448] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.448] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.448] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.452] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.452] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.452] GetLastError () returned 0x578 [0200.452] SetLastError (dwErrCode=0x578) [0200.452] CanUserWritePwrScheme () returned 1 [0200.453] GetSystemMetrics (nIndex=46) returned 2 [0200.453] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.453] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.453] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.453] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.458] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.458] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.458] GetLastError () returned 0x578 [0200.458] SetLastError (dwErrCode=0x578) [0200.458] CanUserWritePwrScheme () returned 1 [0200.458] GetSystemMetrics (nIndex=46) returned 2 [0200.458] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.458] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.458] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.458] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.463] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.463] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.463] GetLastError () returned 0x578 [0200.463] SetLastError (dwErrCode=0x578) [0200.463] CanUserWritePwrScheme () returned 1 [0200.464] GetSystemMetrics (nIndex=46) returned 2 [0200.464] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.464] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.464] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.464] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.471] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.471] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.471] GetLastError () returned 0x578 [0200.471] SetLastError (dwErrCode=0x578) [0200.471] CanUserWritePwrScheme () returned 1 [0200.471] GetSystemMetrics (nIndex=46) returned 2 [0200.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.476] GetLastError () returned 0x578 [0200.476] SetLastError (dwErrCode=0x578) [0200.476] CanUserWritePwrScheme () returned 1 [0200.477] GetSystemMetrics (nIndex=46) returned 2 [0200.477] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.477] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.477] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.477] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.481] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.481] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.481] GetLastError () returned 0x578 [0200.482] SetLastError (dwErrCode=0x578) [0200.482] CanUserWritePwrScheme () returned 1 [0200.482] GetSystemMetrics (nIndex=46) returned 2 [0200.482] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.482] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.482] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.482] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.487] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.487] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.487] GetLastError () returned 0x578 [0200.487] SetLastError (dwErrCode=0x578) [0200.487] CanUserWritePwrScheme () returned 1 [0200.487] GetSystemMetrics (nIndex=46) returned 2 [0200.487] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.487] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.487] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.487] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.499] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.499] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.499] GetLastError () returned 0x578 [0200.499] SetLastError (dwErrCode=0x578) [0200.499] CanUserWritePwrScheme () returned 1 [0200.500] GetSystemMetrics (nIndex=46) returned 2 [0200.500] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.500] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.500] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.500] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.505] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.505] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.505] GetLastError () returned 0x578 [0200.505] SetLastError (dwErrCode=0x578) [0200.505] CanUserWritePwrScheme () returned 1 [0200.505] GetSystemMetrics (nIndex=46) returned 2 [0200.505] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.505] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.505] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.505] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.510] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.510] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.510] GetLastError () returned 0x578 [0200.510] SetLastError (dwErrCode=0x578) [0200.510] CanUserWritePwrScheme () returned 1 [0200.510] GetSystemMetrics (nIndex=46) returned 2 [0200.510] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.510] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.510] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.510] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.515] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.515] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.515] GetLastError () returned 0x578 [0200.515] SetLastError (dwErrCode=0x578) [0200.515] CanUserWritePwrScheme () returned 1 [0200.516] GetSystemMetrics (nIndex=46) returned 2 [0200.516] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.516] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.516] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.516] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.521] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.521] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.521] GetLastError () returned 0x578 [0200.521] SetLastError (dwErrCode=0x578) [0200.521] CanUserWritePwrScheme () returned 1 [0200.521] GetSystemMetrics (nIndex=46) returned 2 [0200.521] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.521] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.521] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.521] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.526] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.526] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.526] GetLastError () returned 0x578 [0200.526] SetLastError (dwErrCode=0x578) [0200.526] CanUserWritePwrScheme () returned 1 [0200.526] GetSystemMetrics (nIndex=46) returned 2 [0200.526] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.526] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.526] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.526] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.657] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.658] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.658] GetLastError () returned 0x578 [0200.658] SetLastError (dwErrCode=0x578) [0200.658] CanUserWritePwrScheme () returned 1 [0200.658] GetSystemMetrics (nIndex=46) returned 2 [0200.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.658] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.658] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.658] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.666] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.666] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.666] GetLastError () returned 0x578 [0200.666] SetLastError (dwErrCode=0x578) [0200.666] CanUserWritePwrScheme () returned 1 [0200.666] GetSystemMetrics (nIndex=46) returned 2 [0200.666] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.666] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.666] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.666] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.671] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.671] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.671] GetLastError () returned 0x578 [0200.671] SetLastError (dwErrCode=0x578) [0200.671] CanUserWritePwrScheme () returned 1 [0200.671] GetSystemMetrics (nIndex=46) returned 2 [0200.671] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.672] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.672] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.672] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.677] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.677] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.677] GetLastError () returned 0x578 [0200.677] SetLastError (dwErrCode=0x578) [0200.677] CanUserWritePwrScheme () returned 1 [0200.677] GetSystemMetrics (nIndex=46) returned 2 [0200.677] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.677] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.677] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.677] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.682] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.682] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.682] GetLastError () returned 0x578 [0200.682] SetLastError (dwErrCode=0x578) [0200.682] CanUserWritePwrScheme () returned 1 [0200.682] GetSystemMetrics (nIndex=46) returned 2 [0200.682] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.682] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.682] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.682] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.687] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.687] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.687] GetLastError () returned 0x578 [0200.687] SetLastError (dwErrCode=0x578) [0200.687] CanUserWritePwrScheme () returned 1 [0200.688] GetSystemMetrics (nIndex=46) returned 2 [0200.688] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.688] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.688] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.688] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.693] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.693] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.693] GetLastError () returned 0x578 [0200.693] SetLastError (dwErrCode=0x578) [0200.693] CanUserWritePwrScheme () returned 1 [0200.693] GetSystemMetrics (nIndex=46) returned 2 [0200.693] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.693] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.693] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.693] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.698] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.698] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.698] GetLastError () returned 0x578 [0200.698] SetLastError (dwErrCode=0x578) [0200.698] CanUserWritePwrScheme () returned 1 [0200.698] GetSystemMetrics (nIndex=46) returned 2 [0200.698] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.698] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.698] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.698] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.703] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.703] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.703] GetLastError () returned 0x578 [0200.703] SetLastError (dwErrCode=0x578) [0200.703] CanUserWritePwrScheme () returned 1 [0200.704] GetSystemMetrics (nIndex=46) returned 2 [0200.704] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.704] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.704] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.704] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.708] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.708] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.709] GetLastError () returned 0x578 [0200.709] SetLastError (dwErrCode=0x578) [0200.709] CanUserWritePwrScheme () returned 1 [0200.709] GetSystemMetrics (nIndex=46) returned 2 [0200.709] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.709] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.709] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.709] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.714] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.714] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.714] GetLastError () returned 0x578 [0200.714] SetLastError (dwErrCode=0x578) [0200.714] CanUserWritePwrScheme () returned 1 [0200.714] GetSystemMetrics (nIndex=46) returned 2 [0200.714] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.714] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.714] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.714] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.719] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.719] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.719] GetLastError () returned 0x578 [0200.719] SetLastError (dwErrCode=0x578) [0200.719] CanUserWritePwrScheme () returned 1 [0200.719] GetSystemMetrics (nIndex=46) returned 2 [0200.719] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.719] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.720] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.720] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.724] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.724] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.724] GetLastError () returned 0x578 [0200.724] SetLastError (dwErrCode=0x578) [0200.724] CanUserWritePwrScheme () returned 1 [0200.725] GetSystemMetrics (nIndex=46) returned 2 [0200.725] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.725] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.725] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.725] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.732] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.732] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.732] GetLastError () returned 0x578 [0200.732] SetLastError (dwErrCode=0x578) [0200.732] CanUserWritePwrScheme () returned 1 [0200.733] GetSystemMetrics (nIndex=46) returned 2 [0200.733] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.733] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.733] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.733] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.822] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.822] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.822] GetLastError () returned 0x578 [0200.822] SetLastError (dwErrCode=0x578) [0200.822] CanUserWritePwrScheme () returned 1 [0200.823] GetSystemMetrics (nIndex=46) returned 2 [0200.823] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.823] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.823] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.823] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.828] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.828] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.828] GetLastError () returned 0x578 [0200.828] SetLastError (dwErrCode=0x578) [0200.828] CanUserWritePwrScheme () returned 1 [0200.828] GetSystemMetrics (nIndex=46) returned 2 [0200.828] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.828] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.828] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.828] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.834] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.834] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.834] GetLastError () returned 0x578 [0200.834] SetLastError (dwErrCode=0x578) [0200.834] CanUserWritePwrScheme () returned 1 [0200.834] GetSystemMetrics (nIndex=46) returned 2 [0200.834] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.834] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.834] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.834] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.839] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.839] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.839] GetLastError () returned 0x578 [0200.839] SetLastError (dwErrCode=0x578) [0200.839] CanUserWritePwrScheme () returned 1 [0200.839] GetSystemMetrics (nIndex=46) returned 2 [0200.839] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.839] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.839] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.839] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.844] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.844] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.844] GetLastError () returned 0x578 [0200.844] SetLastError (dwErrCode=0x578) [0200.844] CanUserWritePwrScheme () returned 1 [0200.845] GetSystemMetrics (nIndex=46) returned 2 [0200.845] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.845] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.845] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.845] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.850] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.850] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.850] GetLastError () returned 0x578 [0200.850] SetLastError (dwErrCode=0x578) [0200.850] CanUserWritePwrScheme () returned 1 [0200.850] GetSystemMetrics (nIndex=46) returned 2 [0200.850] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.850] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.850] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.850] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.855] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.855] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.855] GetLastError () returned 0x578 [0200.855] SetLastError (dwErrCode=0x578) [0200.855] CanUserWritePwrScheme () returned 1 [0200.855] GetSystemMetrics (nIndex=46) returned 2 [0200.855] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.855] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.856] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.863] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.863] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.863] GetLastError () returned 0x578 [0200.863] SetLastError (dwErrCode=0x578) [0200.863] CanUserWritePwrScheme () returned 1 [0200.864] GetSystemMetrics (nIndex=46) returned 2 [0200.864] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.864] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.864] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.864] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.869] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.869] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.869] GetLastError () returned 0x578 [0200.869] SetLastError (dwErrCode=0x578) [0200.869] CanUserWritePwrScheme () returned 1 [0200.869] GetSystemMetrics (nIndex=46) returned 2 [0200.869] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.869] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.869] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.869] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.874] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.874] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.874] GetLastError () returned 0x578 [0200.874] SetLastError (dwErrCode=0x578) [0200.874] CanUserWritePwrScheme () returned 1 [0200.874] GetSystemMetrics (nIndex=46) returned 2 [0200.874] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.874] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.874] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.874] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.879] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.879] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.879] GetLastError () returned 0x578 [0200.879] SetLastError (dwErrCode=0x578) [0200.880] CanUserWritePwrScheme () returned 1 [0200.880] GetSystemMetrics (nIndex=46) returned 2 [0200.880] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.880] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.880] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.880] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.885] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.885] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.885] GetLastError () returned 0x578 [0200.885] SetLastError (dwErrCode=0x578) [0200.885] CanUserWritePwrScheme () returned 1 [0200.885] GetSystemMetrics (nIndex=46) returned 2 [0200.885] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.885] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.885] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.885] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.890] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.890] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.890] GetLastError () returned 0x578 [0200.890] SetLastError (dwErrCode=0x578) [0200.890] CanUserWritePwrScheme () returned 1 [0200.890] GetSystemMetrics (nIndex=46) returned 2 [0200.890] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.890] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.890] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.891] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.989] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.989] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.989] GetLastError () returned 0x578 [0200.989] SetLastError (dwErrCode=0x578) [0200.989] CanUserWritePwrScheme () returned 1 [0200.989] GetSystemMetrics (nIndex=46) returned 2 [0200.989] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.989] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.989] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.989] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.994] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.994] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.994] GetLastError () returned 0x578 [0200.994] SetLastError (dwErrCode=0x578) [0200.994] CanUserWritePwrScheme () returned 1 [0200.994] GetSystemMetrics (nIndex=46) returned 2 [0200.995] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0200.995] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0200.995] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0200.995] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0200.999] GetWindowTextLengthA (hWnd=0x0) returned 0 [0200.999] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0200.999] GetLastError () returned 0x578 [0200.999] SetLastError (dwErrCode=0x578) [0200.999] CanUserWritePwrScheme () returned 1 [0201.000] GetSystemMetrics (nIndex=46) returned 2 [0201.000] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.000] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.000] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.000] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.005] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.005] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.005] GetLastError () returned 0x578 [0201.005] SetLastError (dwErrCode=0x578) [0201.005] CanUserWritePwrScheme () returned 1 [0201.005] GetSystemMetrics (nIndex=46) returned 2 [0201.005] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.005] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.005] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.005] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.010] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.010] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.010] GetLastError () returned 0x578 [0201.010] SetLastError (dwErrCode=0x578) [0201.010] CanUserWritePwrScheme () returned 1 [0201.010] GetSystemMetrics (nIndex=46) returned 2 [0201.010] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.010] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.010] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.010] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.015] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.015] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.015] GetLastError () returned 0x578 [0201.015] SetLastError (dwErrCode=0x578) [0201.015] CanUserWritePwrScheme () returned 1 [0201.016] GetSystemMetrics (nIndex=46) returned 2 [0201.016] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.016] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.016] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.016] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.021] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.021] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.021] GetLastError () returned 0x578 [0201.021] SetLastError (dwErrCode=0x578) [0201.021] CanUserWritePwrScheme () returned 1 [0201.021] GetSystemMetrics (nIndex=46) returned 2 [0201.021] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.021] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.021] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.021] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.026] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.026] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.026] GetLastError () returned 0x578 [0201.026] SetLastError (dwErrCode=0x578) [0201.026] CanUserWritePwrScheme () returned 1 [0201.026] GetSystemMetrics (nIndex=46) returned 2 [0201.026] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.026] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.026] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.026] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.031] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.031] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.031] GetLastError () returned 0x578 [0201.031] SetLastError (dwErrCode=0x578) [0201.031] CanUserWritePwrScheme () returned 1 [0201.031] GetSystemMetrics (nIndex=46) returned 2 [0201.032] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.032] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.032] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.032] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.036] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.036] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.036] GetLastError () returned 0x578 [0201.036] SetLastError (dwErrCode=0x578) [0201.037] CanUserWritePwrScheme () returned 1 [0201.037] GetSystemMetrics (nIndex=46) returned 2 [0201.037] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.037] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.037] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.037] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.042] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.042] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.042] GetLastError () returned 0x578 [0201.042] SetLastError (dwErrCode=0x578) [0201.042] CanUserWritePwrScheme () returned 1 [0201.042] GetSystemMetrics (nIndex=46) returned 2 [0201.042] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.042] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.042] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.042] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.047] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.047] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.047] GetLastError () returned 0x578 [0201.047] SetLastError (dwErrCode=0x578) [0201.047] CanUserWritePwrScheme () returned 1 [0201.047] GetSystemMetrics (nIndex=46) returned 2 [0201.047] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.047] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.047] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.047] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.055] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.055] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.055] GetLastError () returned 0x578 [0201.055] SetLastError (dwErrCode=0x578) [0201.055] CanUserWritePwrScheme () returned 1 [0201.055] GetSystemMetrics (nIndex=46) returned 2 [0201.056] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.056] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.056] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.056] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.060] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.060] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.060] GetLastError () returned 0x578 [0201.060] SetLastError (dwErrCode=0x578) [0201.060] CanUserWritePwrScheme () returned 1 [0201.061] GetSystemMetrics (nIndex=46) returned 2 [0201.061] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.061] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.061] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.061] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.066] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.066] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.066] GetLastError () returned 0x578 [0201.066] SetLastError (dwErrCode=0x578) [0201.066] CanUserWritePwrScheme () returned 1 [0201.066] GetSystemMetrics (nIndex=46) returned 2 [0201.066] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.066] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.066] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.066] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.266] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.266] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.266] GetLastError () returned 0x578 [0201.266] SetLastError (dwErrCode=0x578) [0201.266] CanUserWritePwrScheme () returned 1 [0201.266] GetSystemMetrics (nIndex=46) returned 2 [0201.266] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.266] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.266] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.266] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.272] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.272] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.272] GetLastError () returned 0x578 [0201.272] SetLastError (dwErrCode=0x578) [0201.272] CanUserWritePwrScheme () returned 1 [0201.272] GetSystemMetrics (nIndex=46) returned 2 [0201.272] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.272] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.272] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.272] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.277] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.277] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.277] GetLastError () returned 0x578 [0201.277] SetLastError (dwErrCode=0x578) [0201.277] CanUserWritePwrScheme () returned 1 [0201.277] GetSystemMetrics (nIndex=46) returned 2 [0201.277] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.277] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.277] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.278] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.282] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.282] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.282] GetLastError () returned 0x578 [0201.282] SetLastError (dwErrCode=0x578) [0201.282] CanUserWritePwrScheme () returned 1 [0201.283] GetSystemMetrics (nIndex=46) returned 2 [0201.283] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.283] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.283] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.283] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.288] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.288] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.288] GetLastError () returned 0x578 [0201.288] SetLastError (dwErrCode=0x578) [0201.288] CanUserWritePwrScheme () returned 1 [0201.288] GetSystemMetrics (nIndex=46) returned 2 [0201.288] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.288] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.288] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.288] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.293] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.293] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.293] GetLastError () returned 0x578 [0201.293] SetLastError (dwErrCode=0x578) [0201.293] CanUserWritePwrScheme () returned 1 [0201.293] GetSystemMetrics (nIndex=46) returned 2 [0201.293] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.293] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.293] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.294] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.298] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.298] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.298] GetLastError () returned 0x578 [0201.298] SetLastError (dwErrCode=0x578) [0201.298] CanUserWritePwrScheme () returned 1 [0201.299] GetSystemMetrics (nIndex=46) returned 2 [0201.299] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.299] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.299] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.299] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.304] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.304] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.304] GetLastError () returned 0x578 [0201.304] SetLastError (dwErrCode=0x578) [0201.304] CanUserWritePwrScheme () returned 1 [0201.304] GetSystemMetrics (nIndex=46) returned 2 [0201.304] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.304] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.304] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.304] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.309] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.309] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.309] GetLastError () returned 0x578 [0201.309] SetLastError (dwErrCode=0x578) [0201.309] CanUserWritePwrScheme () returned 1 [0201.310] GetSystemMetrics (nIndex=46) returned 2 [0201.310] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.310] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.310] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.310] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.317] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.317] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.317] GetLastError () returned 0x578 [0201.317] SetLastError (dwErrCode=0x578) [0201.317] CanUserWritePwrScheme () returned 1 [0201.317] GetSystemMetrics (nIndex=46) returned 2 [0201.317] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.317] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.317] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.317] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.322] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.322] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.322] GetLastError () returned 0x578 [0201.322] SetLastError (dwErrCode=0x578) [0201.322] CanUserWritePwrScheme () returned 1 [0201.323] GetSystemMetrics (nIndex=46) returned 2 [0201.323] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.323] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.323] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.323] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.327] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.327] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.328] GetLastError () returned 0x578 [0201.328] SetLastError (dwErrCode=0x578) [0201.328] CanUserWritePwrScheme () returned 1 [0201.328] GetSystemMetrics (nIndex=46) returned 2 [0201.328] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.328] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.328] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.328] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.333] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.333] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.333] GetLastError () returned 0x578 [0201.333] SetLastError (dwErrCode=0x578) [0201.333] CanUserWritePwrScheme () returned 1 [0201.334] GetSystemMetrics (nIndex=46) returned 2 [0201.334] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.334] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.334] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.334] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.338] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.338] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.338] GetLastError () returned 0x578 [0201.338] SetLastError (dwErrCode=0x578) [0201.338] CanUserWritePwrScheme () returned 1 [0201.339] GetSystemMetrics (nIndex=46) returned 2 [0201.339] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.339] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.339] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.339] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.344] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.344] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.344] GetLastError () returned 0x578 [0201.344] SetLastError (dwErrCode=0x578) [0201.344] CanUserWritePwrScheme () returned 1 [0201.344] GetSystemMetrics (nIndex=46) returned 2 [0201.344] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.344] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.344] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.344] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.643] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.643] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.643] GetLastError () returned 0x578 [0201.643] SetLastError (dwErrCode=0x578) [0201.643] CanUserWritePwrScheme () returned 1 [0201.643] GetSystemMetrics (nIndex=46) returned 2 [0201.643] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.643] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.643] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.643] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.648] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.648] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.648] GetLastError () returned 0x578 [0201.648] SetLastError (dwErrCode=0x578) [0201.648] CanUserWritePwrScheme () returned 1 [0201.649] GetSystemMetrics (nIndex=46) returned 2 [0201.649] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.649] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.649] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.649] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.654] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.654] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.654] GetLastError () returned 0x578 [0201.654] SetLastError (dwErrCode=0x578) [0201.654] CanUserWritePwrScheme () returned 1 [0201.654] GetSystemMetrics (nIndex=46) returned 2 [0201.654] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.654] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.654] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.654] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.659] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.659] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.659] GetLastError () returned 0x578 [0201.659] SetLastError (dwErrCode=0x578) [0201.659] CanUserWritePwrScheme () returned 1 [0201.660] GetSystemMetrics (nIndex=46) returned 2 [0201.660] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.660] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.660] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.660] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.664] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.664] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.665] GetLastError () returned 0x578 [0201.665] SetLastError (dwErrCode=0x578) [0201.665] CanUserWritePwrScheme () returned 1 [0201.665] GetSystemMetrics (nIndex=46) returned 2 [0201.665] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.665] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.665] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.665] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.670] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.670] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.670] GetLastError () returned 0x578 [0201.670] SetLastError (dwErrCode=0x578) [0201.670] CanUserWritePwrScheme () returned 1 [0201.670] GetSystemMetrics (nIndex=46) returned 2 [0201.670] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.670] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.670] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.670] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.675] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.676] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.676] GetLastError () returned 0x578 [0201.676] SetLastError (dwErrCode=0x578) [0201.676] CanUserWritePwrScheme () returned 1 [0201.676] GetSystemMetrics (nIndex=46) returned 2 [0201.676] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.676] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.676] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.676] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.681] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.681] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.681] GetLastError () returned 0x578 [0201.681] SetLastError (dwErrCode=0x578) [0201.681] CanUserWritePwrScheme () returned 1 [0201.681] GetSystemMetrics (nIndex=46) returned 2 [0201.681] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.681] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.681] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.681] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.686] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.686] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.686] GetLastError () returned 0x578 [0201.686] SetLastError (dwErrCode=0x578) [0201.686] CanUserWritePwrScheme () returned 1 [0201.687] GetSystemMetrics (nIndex=46) returned 2 [0201.687] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.687] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.687] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.687] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.692] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.692] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.692] GetLastError () returned 0x578 [0201.692] SetLastError (dwErrCode=0x578) [0201.692] CanUserWritePwrScheme () returned 1 [0201.692] GetSystemMetrics (nIndex=46) returned 2 [0201.692] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.692] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.692] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.692] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.697] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.697] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.697] GetLastError () returned 0x578 [0201.697] SetLastError (dwErrCode=0x578) [0201.697] CanUserWritePwrScheme () returned 1 [0201.697] GetSystemMetrics (nIndex=46) returned 2 [0201.697] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.698] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.698] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.698] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.702] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.702] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.702] GetLastError () returned 0x578 [0201.702] SetLastError (dwErrCode=0x578) [0201.702] CanUserWritePwrScheme () returned 1 [0201.703] GetSystemMetrics (nIndex=46) returned 2 [0201.703] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.703] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.703] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.703] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.710] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.710] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.710] GetLastError () returned 0x578 [0201.710] SetLastError (dwErrCode=0x578) [0201.710] CanUserWritePwrScheme () returned 1 [0201.710] GetSystemMetrics (nIndex=46) returned 2 [0201.710] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.710] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.710] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.710] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.715] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.715] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.715] GetLastError () returned 0x578 [0201.715] SetLastError (dwErrCode=0x578) [0201.715] CanUserWritePwrScheme () returned 1 [0201.716] GetSystemMetrics (nIndex=46) returned 2 [0201.716] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.716] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.716] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.716] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.764] GetLastError () returned 0x578 [0201.764] SetLastError (dwErrCode=0x578) [0201.764] CanUserWritePwrScheme () returned 1 [0201.764] GetSystemMetrics (nIndex=46) returned 2 [0201.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.764] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.764] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.764] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.772] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.772] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.772] GetLastError () returned 0x578 [0201.772] SetLastError (dwErrCode=0x578) [0201.772] CanUserWritePwrScheme () returned 1 [0201.773] GetSystemMetrics (nIndex=46) returned 2 [0201.773] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.773] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.773] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.773] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.778] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.778] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.778] GetLastError () returned 0x578 [0201.778] SetLastError (dwErrCode=0x578) [0201.778] CanUserWritePwrScheme () returned 1 [0201.778] GetSystemMetrics (nIndex=46) returned 2 [0201.778] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.778] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.778] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.778] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.783] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.783] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.783] GetLastError () returned 0x578 [0201.783] SetLastError (dwErrCode=0x578) [0201.783] CanUserWritePwrScheme () returned 1 [0201.783] GetSystemMetrics (nIndex=46) returned 2 [0201.783] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.784] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.784] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.784] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.788] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.788] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.788] GetLastError () returned 0x578 [0201.788] SetLastError (dwErrCode=0x578) [0201.788] CanUserWritePwrScheme () returned 1 [0201.789] GetSystemMetrics (nIndex=46) returned 2 [0201.789] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.789] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.789] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.789] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.794] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.794] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.794] GetLastError () returned 0x578 [0201.794] SetLastError (dwErrCode=0x578) [0201.794] CanUserWritePwrScheme () returned 1 [0201.794] GetSystemMetrics (nIndex=46) returned 2 [0201.794] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.794] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.794] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.794] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.799] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.799] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.799] GetLastError () returned 0x578 [0201.799] SetLastError (dwErrCode=0x578) [0201.800] CanUserWritePwrScheme () returned 1 [0201.800] GetSystemMetrics (nIndex=46) returned 2 [0201.800] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.800] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.800] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.800] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.805] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.805] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.805] GetLastError () returned 0x578 [0201.805] SetLastError (dwErrCode=0x578) [0201.805] CanUserWritePwrScheme () returned 1 [0201.805] GetSystemMetrics (nIndex=46) returned 2 [0201.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.805] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.805] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.810] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.810] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.810] GetLastError () returned 0x578 [0201.810] SetLastError (dwErrCode=0x578) [0201.810] CanUserWritePwrScheme () returned 1 [0201.811] GetSystemMetrics (nIndex=46) returned 2 [0201.811] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.811] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.811] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.811] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.815] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.815] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.815] GetLastError () returned 0x578 [0201.816] SetLastError (dwErrCode=0x578) [0201.816] CanUserWritePwrScheme () returned 1 [0201.816] GetSystemMetrics (nIndex=46) returned 2 [0201.816] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.816] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.816] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.816] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.821] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.821] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.821] GetLastError () returned 0x578 [0201.821] SetLastError (dwErrCode=0x578) [0201.821] CanUserWritePwrScheme () returned 1 [0201.821] GetSystemMetrics (nIndex=46) returned 2 [0201.821] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.821] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.821] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.821] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.826] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.826] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.826] GetLastError () returned 0x578 [0201.826] SetLastError (dwErrCode=0x578) [0201.826] CanUserWritePwrScheme () returned 1 [0201.827] GetSystemMetrics (nIndex=46) returned 2 [0201.827] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.827] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.827] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.827] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.832] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.832] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.832] GetLastError () returned 0x578 [0201.832] SetLastError (dwErrCode=0x578) [0201.832] CanUserWritePwrScheme () returned 1 [0201.832] GetSystemMetrics (nIndex=46) returned 2 [0201.832] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.832] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.832] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.832] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.905] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.905] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.905] GetLastError () returned 0x578 [0201.905] SetLastError (dwErrCode=0x578) [0201.905] CanUserWritePwrScheme () returned 1 [0201.905] GetSystemMetrics (nIndex=46) returned 2 [0201.905] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.905] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.905] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.905] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.910] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.910] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.910] GetLastError () returned 0x578 [0201.910] SetLastError (dwErrCode=0x578) [0201.910] CanUserWritePwrScheme () returned 1 [0201.911] GetSystemMetrics (nIndex=46) returned 2 [0201.911] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.911] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.911] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.911] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.915] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.916] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.916] GetLastError () returned 0x578 [0201.916] SetLastError (dwErrCode=0x578) [0201.916] CanUserWritePwrScheme () returned 1 [0201.916] GetSystemMetrics (nIndex=46) returned 2 [0201.916] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.916] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.916] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.916] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.921] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.921] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.921] GetLastError () returned 0x578 [0201.921] SetLastError (dwErrCode=0x578) [0201.921] CanUserWritePwrScheme () returned 1 [0201.921] GetSystemMetrics (nIndex=46) returned 2 [0201.921] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.921] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.921] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.921] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.926] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.926] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.926] GetLastError () returned 0x578 [0201.927] SetLastError (dwErrCode=0x578) [0201.927] CanUserWritePwrScheme () returned 1 [0201.927] GetSystemMetrics (nIndex=46) returned 2 [0201.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.927] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.927] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.927] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.932] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.932] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.932] GetLastError () returned 0x578 [0201.932] SetLastError (dwErrCode=0x578) [0201.932] CanUserWritePwrScheme () returned 1 [0201.932] GetSystemMetrics (nIndex=46) returned 2 [0201.932] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.932] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.932] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.932] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.937] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.937] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.937] GetLastError () returned 0x578 [0201.937] SetLastError (dwErrCode=0x578) [0201.937] CanUserWritePwrScheme () returned 1 [0201.938] GetSystemMetrics (nIndex=46) returned 2 [0201.938] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.938] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.938] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.938] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.944] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.944] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.944] GetLastError () returned 0x578 [0201.944] SetLastError (dwErrCode=0x578) [0201.944] CanUserWritePwrScheme () returned 1 [0201.944] GetSystemMetrics (nIndex=46) returned 2 [0201.944] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.944] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.944] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.944] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.949] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.949] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.949] GetLastError () returned 0x578 [0201.949] SetLastError (dwErrCode=0x578) [0201.949] CanUserWritePwrScheme () returned 1 [0201.949] GetSystemMetrics (nIndex=46) returned 2 [0201.949] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.949] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.950] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.950] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.955] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.955] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.955] GetLastError () returned 0x578 [0201.955] SetLastError (dwErrCode=0x578) [0201.955] CanUserWritePwrScheme () returned 1 [0201.955] GetSystemMetrics (nIndex=46) returned 2 [0201.955] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.955] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.955] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.955] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.960] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.960] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.960] GetLastError () returned 0x578 [0201.960] SetLastError (dwErrCode=0x578) [0201.960] CanUserWritePwrScheme () returned 1 [0201.960] GetSystemMetrics (nIndex=46) returned 2 [0201.960] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.960] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.960] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.960] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.968] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.968] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.968] GetLastError () returned 0x578 [0201.968] SetLastError (dwErrCode=0x578) [0201.968] CanUserWritePwrScheme () returned 1 [0201.968] GetSystemMetrics (nIndex=46) returned 2 [0201.968] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.968] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.968] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.968] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.973] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.973] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.973] GetLastError () returned 0x578 [0201.973] SetLastError (dwErrCode=0x578) [0201.973] CanUserWritePwrScheme () returned 1 [0201.974] GetSystemMetrics (nIndex=46) returned 2 [0201.974] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.974] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.974] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.974] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0201.978] GetWindowTextLengthA (hWnd=0x0) returned 0 [0201.978] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0201.978] GetLastError () returned 0x578 [0201.978] SetLastError (dwErrCode=0x578) [0201.979] CanUserWritePwrScheme () returned 1 [0201.979] GetSystemMetrics (nIndex=46) returned 2 [0201.979] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0201.979] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0201.979] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0201.979] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.038] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.038] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.038] GetLastError () returned 0x578 [0202.038] SetLastError (dwErrCode=0x578) [0202.038] CanUserWritePwrScheme () returned 1 [0202.039] GetSystemMetrics (nIndex=46) returned 2 [0202.039] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.039] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.039] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.039] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.044] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.044] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.044] GetLastError () returned 0x578 [0202.044] SetLastError (dwErrCode=0x578) [0202.044] CanUserWritePwrScheme () returned 1 [0202.044] GetSystemMetrics (nIndex=46) returned 2 [0202.044] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.045] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.045] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.045] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.050] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.050] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.050] GetLastError () returned 0x578 [0202.050] SetLastError (dwErrCode=0x578) [0202.050] CanUserWritePwrScheme () returned 1 [0202.050] GetSystemMetrics (nIndex=46) returned 2 [0202.050] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.050] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.050] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.050] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.055] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.055] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.055] GetLastError () returned 0x578 [0202.055] SetLastError (dwErrCode=0x578) [0202.055] CanUserWritePwrScheme () returned 1 [0202.056] GetSystemMetrics (nIndex=46) returned 2 [0202.056] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.056] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.056] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.056] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.061] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.061] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.061] GetLastError () returned 0x578 [0202.061] SetLastError (dwErrCode=0x578) [0202.061] CanUserWritePwrScheme () returned 1 [0202.061] GetSystemMetrics (nIndex=46) returned 2 [0202.061] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.061] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.061] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.061] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.066] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.066] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.066] GetLastError () returned 0x578 [0202.066] SetLastError (dwErrCode=0x578) [0202.066] CanUserWritePwrScheme () returned 1 [0202.067] GetSystemMetrics (nIndex=46) returned 2 [0202.067] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.067] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.067] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.067] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.072] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.072] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.072] GetLastError () returned 0x578 [0202.072] SetLastError (dwErrCode=0x578) [0202.072] CanUserWritePwrScheme () returned 1 [0202.072] GetSystemMetrics (nIndex=46) returned 2 [0202.072] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.072] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.072] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.072] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.077] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.077] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.077] GetLastError () returned 0x578 [0202.077] SetLastError (dwErrCode=0x578) [0202.077] CanUserWritePwrScheme () returned 1 [0202.078] GetSystemMetrics (nIndex=46) returned 2 [0202.078] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.078] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.078] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.078] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.083] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.083] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.083] GetLastError () returned 0x578 [0202.083] SetLastError (dwErrCode=0x578) [0202.083] CanUserWritePwrScheme () returned 1 [0202.083] GetSystemMetrics (nIndex=46) returned 2 [0202.083] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.083] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.083] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.083] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.088] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.088] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.088] GetLastError () returned 0x578 [0202.088] SetLastError (dwErrCode=0x578) [0202.088] CanUserWritePwrScheme () returned 1 [0202.089] GetSystemMetrics (nIndex=46) returned 2 [0202.089] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.089] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.089] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.089] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.096] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.096] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.096] GetLastError () returned 0x578 [0202.096] SetLastError (dwErrCode=0x578) [0202.096] CanUserWritePwrScheme () returned 1 [0202.097] GetSystemMetrics (nIndex=46) returned 2 [0202.097] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.097] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.097] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.097] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.102] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.102] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.102] GetLastError () returned 0x578 [0202.102] SetLastError (dwErrCode=0x578) [0202.102] CanUserWritePwrScheme () returned 1 [0202.102] GetSystemMetrics (nIndex=46) returned 2 [0202.102] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.102] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.102] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.102] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.107] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.107] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.107] GetLastError () returned 0x578 [0202.107] SetLastError (dwErrCode=0x578) [0202.107] CanUserWritePwrScheme () returned 1 [0202.107] GetSystemMetrics (nIndex=46) returned 2 [0202.107] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.107] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.107] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.107] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.112] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.112] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.112] GetLastError () returned 0x578 [0202.113] SetLastError (dwErrCode=0x578) [0202.113] CanUserWritePwrScheme () returned 1 [0202.113] GetSystemMetrics (nIndex=46) returned 2 [0202.113] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.113] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.113] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.113] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.118] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.118] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.118] GetLastError () returned 0x578 [0202.118] SetLastError (dwErrCode=0x578) [0202.118] CanUserWritePwrScheme () returned 1 [0202.118] GetSystemMetrics (nIndex=46) returned 2 [0202.118] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.118] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.118] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.118] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.207] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.207] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.207] GetLastError () returned 0x578 [0202.208] SetLastError (dwErrCode=0x578) [0202.208] CanUserWritePwrScheme () returned 1 [0202.208] GetSystemMetrics (nIndex=46) returned 2 [0202.208] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.208] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.208] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.208] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.213] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.213] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.213] GetLastError () returned 0x578 [0202.213] SetLastError (dwErrCode=0x578) [0202.213] CanUserWritePwrScheme () returned 1 [0202.213] GetSystemMetrics (nIndex=46) returned 2 [0202.213] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.213] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.214] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.214] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.218] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.218] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.218] GetLastError () returned 0x578 [0202.218] SetLastError (dwErrCode=0x578) [0202.219] CanUserWritePwrScheme () returned 1 [0202.219] GetSystemMetrics (nIndex=46) returned 2 [0202.219] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.219] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.219] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.219] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.227] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.227] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.227] GetLastError () returned 0x578 [0202.227] SetLastError (dwErrCode=0x578) [0202.227] CanUserWritePwrScheme () returned 1 [0202.227] GetSystemMetrics (nIndex=46) returned 2 [0202.227] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.227] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.227] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.227] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.232] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.232] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.232] GetLastError () returned 0x578 [0202.232] SetLastError (dwErrCode=0x578) [0202.232] CanUserWritePwrScheme () returned 1 [0202.232] GetSystemMetrics (nIndex=46) returned 2 [0202.232] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.232] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.232] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.233] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.238] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.238] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.238] GetLastError () returned 0x578 [0202.238] SetLastError (dwErrCode=0x578) [0202.238] CanUserWritePwrScheme () returned 1 [0202.238] GetSystemMetrics (nIndex=46) returned 2 [0202.238] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.238] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.238] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.238] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.243] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.243] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.243] GetLastError () returned 0x578 [0202.243] SetLastError (dwErrCode=0x578) [0202.243] CanUserWritePwrScheme () returned 1 [0202.244] GetSystemMetrics (nIndex=46) returned 2 [0202.244] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.244] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.244] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.244] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.249] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.249] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.249] GetLastError () returned 0x578 [0202.249] SetLastError (dwErrCode=0x578) [0202.249] CanUserWritePwrScheme () returned 1 [0202.249] GetSystemMetrics (nIndex=46) returned 2 [0202.249] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.249] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.249] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.249] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.254] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.254] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.254] GetLastError () returned 0x578 [0202.254] SetLastError (dwErrCode=0x578) [0202.254] CanUserWritePwrScheme () returned 1 [0202.254] GetSystemMetrics (nIndex=46) returned 2 [0202.255] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.255] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.255] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.255] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.259] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.259] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.259] GetLastError () returned 0x578 [0202.260] SetLastError (dwErrCode=0x578) [0202.260] CanUserWritePwrScheme () returned 1 [0202.260] GetSystemMetrics (nIndex=46) returned 2 [0202.260] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.260] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.260] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.260] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.265] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.265] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.265] GetLastError () returned 0x578 [0202.265] SetLastError (dwErrCode=0x578) [0202.265] CanUserWritePwrScheme () returned 1 [0202.265] GetSystemMetrics (nIndex=46) returned 2 [0202.265] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.265] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.265] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.265] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.270] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.270] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.270] GetLastError () returned 0x578 [0202.271] SetLastError (dwErrCode=0x578) [0202.271] CanUserWritePwrScheme () returned 1 [0202.271] GetSystemMetrics (nIndex=46) returned 2 [0202.271] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.271] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.271] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.271] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.276] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.276] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.276] GetLastError () returned 0x578 [0202.276] SetLastError (dwErrCode=0x578) [0202.276] CanUserWritePwrScheme () returned 1 [0202.276] GetSystemMetrics (nIndex=46) returned 2 [0202.276] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.276] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.276] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.276] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.281] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.281] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.281] GetLastError () returned 0x578 [0202.281] SetLastError (dwErrCode=0x578) [0202.281] CanUserWritePwrScheme () returned 1 [0202.282] GetSystemMetrics (nIndex=46) returned 2 [0202.282] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.282] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.282] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.282] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.568] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.568] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.568] GetLastError () returned 0x578 [0202.568] SetLastError (dwErrCode=0x578) [0202.568] CanUserWritePwrScheme () returned 1 [0202.568] GetSystemMetrics (nIndex=46) returned 2 [0202.568] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.568] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.568] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.568] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.573] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.573] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.573] GetLastError () returned 0x578 [0202.573] SetLastError (dwErrCode=0x578) [0202.573] CanUserWritePwrScheme () returned 1 [0202.574] GetSystemMetrics (nIndex=46) returned 2 [0202.574] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.574] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.574] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.574] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.579] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.579] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.579] GetLastError () returned 0x578 [0202.579] SetLastError (dwErrCode=0x578) [0202.579] CanUserWritePwrScheme () returned 1 [0202.579] GetSystemMetrics (nIndex=46) returned 2 [0202.579] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.579] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.579] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.579] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.584] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.584] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.584] GetLastError () returned 0x578 [0202.584] SetLastError (dwErrCode=0x578) [0202.584] CanUserWritePwrScheme () returned 1 [0202.585] GetSystemMetrics (nIndex=46) returned 2 [0202.585] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.585] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.585] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.585] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.589] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.589] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.589] GetLastError () returned 0x578 [0202.590] SetLastError (dwErrCode=0x578) [0202.590] CanUserWritePwrScheme () returned 1 [0202.590] GetSystemMetrics (nIndex=46) returned 2 [0202.590] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.590] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.590] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.590] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.595] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.595] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.595] GetLastError () returned 0x578 [0202.595] SetLastError (dwErrCode=0x578) [0202.595] CanUserWritePwrScheme () returned 1 [0202.595] GetSystemMetrics (nIndex=46) returned 2 [0202.595] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.595] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.595] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.595] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.600] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.600] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.600] GetLastError () returned 0x578 [0202.600] SetLastError (dwErrCode=0x578) [0202.600] CanUserWritePwrScheme () returned 1 [0202.601] GetSystemMetrics (nIndex=46) returned 2 [0202.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.605] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.605] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.605] GetLastError () returned 0x578 [0202.606] SetLastError (dwErrCode=0x578) [0202.606] CanUserWritePwrScheme () returned 1 [0202.606] GetSystemMetrics (nIndex=46) returned 2 [0202.606] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.606] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.606] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.606] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.611] GetLastError () returned 0x578 [0202.611] SetLastError (dwErrCode=0x578) [0202.611] CanUserWritePwrScheme () returned 1 [0202.611] GetSystemMetrics (nIndex=46) returned 2 [0202.611] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.611] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.611] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.619] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.619] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.619] GetLastError () returned 0x578 [0202.619] SetLastError (dwErrCode=0x578) [0202.619] CanUserWritePwrScheme () returned 1 [0202.619] GetSystemMetrics (nIndex=46) returned 2 [0202.619] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.619] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.619] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.619] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.624] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.624] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.624] GetLastError () returned 0x578 [0202.624] SetLastError (dwErrCode=0x578) [0202.624] CanUserWritePwrScheme () returned 1 [0202.625] GetSystemMetrics (nIndex=46) returned 2 [0202.625] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.625] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.625] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.625] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.629] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.630] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.630] GetLastError () returned 0x578 [0202.630] SetLastError (dwErrCode=0x578) [0202.630] CanUserWritePwrScheme () returned 1 [0202.630] GetSystemMetrics (nIndex=46) returned 2 [0202.630] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.630] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.630] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.630] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.636] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.636] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.636] GetLastError () returned 0x578 [0202.636] SetLastError (dwErrCode=0x578) [0202.636] CanUserWritePwrScheme () returned 1 [0202.636] GetSystemMetrics (nIndex=46) returned 2 [0202.636] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.636] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.636] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.637] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.641] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.642] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.642] GetLastError () returned 0x578 [0202.642] SetLastError (dwErrCode=0x578) [0202.642] CanUserWritePwrScheme () returned 1 [0202.642] GetSystemMetrics (nIndex=46) returned 2 [0202.642] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.642] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.642] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.642] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.783] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.783] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.784] GetLastError () returned 0x578 [0202.784] SetLastError (dwErrCode=0x578) [0202.784] CanUserWritePwrScheme () returned 1 [0202.784] GetSystemMetrics (nIndex=46) returned 2 [0202.784] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.784] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.784] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.784] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.789] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.789] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.789] GetLastError () returned 0x578 [0202.790] SetLastError (dwErrCode=0x578) [0202.790] CanUserWritePwrScheme () returned 1 [0202.790] GetSystemMetrics (nIndex=46) returned 2 [0202.790] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.790] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.790] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.790] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.795] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.795] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.795] GetLastError () returned 0x578 [0202.795] SetLastError (dwErrCode=0x578) [0202.795] CanUserWritePwrScheme () returned 1 [0202.795] GetSystemMetrics (nIndex=46) returned 2 [0202.795] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.795] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.795] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.795] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.800] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.800] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.800] GetLastError () returned 0x578 [0202.800] SetLastError (dwErrCode=0x578) [0202.800] CanUserWritePwrScheme () returned 1 [0202.801] GetSystemMetrics (nIndex=46) returned 2 [0202.801] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.801] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.801] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.801] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.805] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.805] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.805] GetLastError () returned 0x578 [0202.805] SetLastError (dwErrCode=0x578) [0202.805] CanUserWritePwrScheme () returned 1 [0202.806] GetSystemMetrics (nIndex=46) returned 2 [0202.806] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.806] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.806] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.806] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.813] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.813] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.813] GetLastError () returned 0x578 [0202.813] SetLastError (dwErrCode=0x578) [0202.813] CanUserWritePwrScheme () returned 1 [0202.814] GetSystemMetrics (nIndex=46) returned 2 [0202.814] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.814] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.814] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.814] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.818] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.818] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.818] GetLastError () returned 0x578 [0202.818] SetLastError (dwErrCode=0x578) [0202.819] CanUserWritePwrScheme () returned 1 [0202.819] GetSystemMetrics (nIndex=46) returned 2 [0202.819] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.819] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.819] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.819] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.824] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.824] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.824] GetLastError () returned 0x578 [0202.824] SetLastError (dwErrCode=0x578) [0202.824] CanUserWritePwrScheme () returned 1 [0202.824] GetSystemMetrics (nIndex=46) returned 2 [0202.824] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.824] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.824] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.824] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.829] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.829] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.829] GetLastError () returned 0x578 [0202.829] SetLastError (dwErrCode=0x578) [0202.829] CanUserWritePwrScheme () returned 1 [0202.829] GetSystemMetrics (nIndex=46) returned 2 [0202.829] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.829] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.829] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.830] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.834] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.834] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.834] GetLastError () returned 0x578 [0202.834] SetLastError (dwErrCode=0x578) [0202.834] CanUserWritePwrScheme () returned 1 [0202.835] GetSystemMetrics (nIndex=46) returned 2 [0202.835] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.835] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.835] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.835] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.839] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.839] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.839] GetLastError () returned 0x578 [0202.839] SetLastError (dwErrCode=0x578) [0202.840] CanUserWritePwrScheme () returned 1 [0202.840] GetSystemMetrics (nIndex=46) returned 2 [0202.840] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.840] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.840] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.840] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.845] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.845] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.845] GetLastError () returned 0x578 [0202.845] SetLastError (dwErrCode=0x578) [0202.845] CanUserWritePwrScheme () returned 1 [0202.845] GetSystemMetrics (nIndex=46) returned 2 [0202.845] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.845] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.845] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.845] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.850] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.850] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.850] GetLastError () returned 0x578 [0202.850] SetLastError (dwErrCode=0x578) [0202.850] CanUserWritePwrScheme () returned 1 [0202.851] GetSystemMetrics (nIndex=46) returned 2 [0202.851] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.851] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.851] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.851] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.855] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.855] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.855] GetLastError () returned 0x578 [0202.855] SetLastError (dwErrCode=0x578) [0202.855] CanUserWritePwrScheme () returned 1 [0202.856] GetSystemMetrics (nIndex=46) returned 2 [0202.856] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.856] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.856] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.856] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.861] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.861] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.861] GetLastError () returned 0x578 [0202.861] SetLastError (dwErrCode=0x578) [0202.861] CanUserWritePwrScheme () returned 1 [0202.861] GetSystemMetrics (nIndex=46) returned 2 [0202.861] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.861] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.861] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.861] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.902] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.902] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.902] GetLastError () returned 0x578 [0202.902] SetLastError (dwErrCode=0x578) [0202.903] CanUserWritePwrScheme () returned 1 [0202.903] GetSystemMetrics (nIndex=46) returned 2 [0202.903] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.903] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.903] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.903] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.908] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.908] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.908] GetLastError () returned 0x578 [0202.908] SetLastError (dwErrCode=0x578) [0202.908] CanUserWritePwrScheme () returned 1 [0202.908] GetSystemMetrics (nIndex=46) returned 2 [0202.908] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.908] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.908] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.908] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.913] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.913] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.913] GetLastError () returned 0x578 [0202.913] SetLastError (dwErrCode=0x578) [0202.913] CanUserWritePwrScheme () returned 1 [0202.914] GetSystemMetrics (nIndex=46) returned 2 [0202.914] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.914] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.914] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.914] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.918] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.918] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.918] GetLastError () returned 0x578 [0202.918] SetLastError (dwErrCode=0x578) [0202.919] CanUserWritePwrScheme () returned 1 [0202.919] GetSystemMetrics (nIndex=46) returned 2 [0202.919] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.919] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.919] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.919] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.924] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.924] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.924] GetLastError () returned 0x578 [0202.924] SetLastError (dwErrCode=0x578) [0202.924] CanUserWritePwrScheme () returned 1 [0202.924] GetSystemMetrics (nIndex=46) returned 2 [0202.924] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.924] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.924] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.925] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.929] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.929] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.929] GetLastError () returned 0x578 [0202.929] SetLastError (dwErrCode=0x578) [0202.929] CanUserWritePwrScheme () returned 1 [0202.930] GetSystemMetrics (nIndex=46) returned 2 [0202.930] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.930] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.930] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.930] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0202.934] GetWindowTextLengthA (hWnd=0x0) returned 0 [0202.934] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0202.934] GetLastError () returned 0x578 [0202.935] SetLastError (dwErrCode=0x578) [0202.935] CanUserWritePwrScheme () returned 1 [0202.935] GetSystemMetrics (nIndex=46) returned 2 [0202.935] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0202.935] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0202.935] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0202.935] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.459] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.459] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.459] GetLastError () returned 0x578 [0204.459] SetLastError (dwErrCode=0x578) [0204.459] CanUserWritePwrScheme () returned 1 [0204.460] GetSystemMetrics (nIndex=46) returned 2 [0204.460] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.460] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.460] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.460] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.465] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.465] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.465] GetLastError () returned 0x578 [0204.465] SetLastError (dwErrCode=0x578) [0204.465] CanUserWritePwrScheme () returned 1 [0204.465] GetSystemMetrics (nIndex=46) returned 2 [0204.465] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.465] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.465] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.465] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.470] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.470] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.470] GetLastError () returned 0x578 [0204.470] SetLastError (dwErrCode=0x578) [0204.470] CanUserWritePwrScheme () returned 1 [0204.471] GetSystemMetrics (nIndex=46) returned 2 [0204.471] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.471] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.471] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.471] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.476] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.476] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.476] GetLastError () returned 0x578 [0204.476] SetLastError (dwErrCode=0x578) [0204.476] CanUserWritePwrScheme () returned 1 [0204.476] GetSystemMetrics (nIndex=46) returned 2 [0204.476] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.476] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.476] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.476] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.481] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.481] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.481] GetLastError () returned 0x578 [0204.481] SetLastError (dwErrCode=0x578) [0204.481] CanUserWritePwrScheme () returned 1 [0204.482] GetSystemMetrics (nIndex=46) returned 2 [0204.482] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.482] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.482] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.482] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.488] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.488] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.488] GetLastError () returned 0x578 [0204.489] SetLastError (dwErrCode=0x578) [0204.489] CanUserWritePwrScheme () returned 1 [0204.489] GetSystemMetrics (nIndex=46) returned 2 [0204.489] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.489] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.489] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.489] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.494] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.494] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.494] GetLastError () returned 0x578 [0204.494] SetLastError (dwErrCode=0x578) [0204.494] CanUserWritePwrScheme () returned 1 [0204.494] GetSystemMetrics (nIndex=46) returned 2 [0204.494] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.494] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.494] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.494] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.508] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.508] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.508] GetLastError () returned 0x578 [0204.508] SetLastError (dwErrCode=0x578) [0204.508] CanUserWritePwrScheme () returned 1 [0204.509] GetSystemMetrics (nIndex=46) returned 2 [0204.509] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.509] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.509] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.509] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.514] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.514] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.514] GetLastError () returned 0x578 [0204.514] SetLastError (dwErrCode=0x578) [0204.514] CanUserWritePwrScheme () returned 1 [0204.515] GetSystemMetrics (nIndex=46) returned 2 [0204.515] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.515] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.515] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.515] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.519] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.520] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.520] GetLastError () returned 0x578 [0204.520] SetLastError (dwErrCode=0x578) [0204.520] CanUserWritePwrScheme () returned 1 [0204.520] GetSystemMetrics (nIndex=46) returned 2 [0204.520] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.520] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.520] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.520] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.525] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.525] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.525] GetLastError () returned 0x578 [0204.525] SetLastError (dwErrCode=0x578) [0204.525] CanUserWritePwrScheme () returned 1 [0204.525] GetSystemMetrics (nIndex=46) returned 2 [0204.525] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.525] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.526] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.526] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.530] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.530] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.530] GetLastError () returned 0x578 [0204.530] SetLastError (dwErrCode=0x578) [0204.530] CanUserWritePwrScheme () returned 1 [0204.531] GetSystemMetrics (nIndex=46) returned 2 [0204.531] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.531] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.531] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.531] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.538] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.538] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.538] GetLastError () returned 0x578 [0204.538] SetLastError (dwErrCode=0x578) [0204.538] CanUserWritePwrScheme () returned 1 [0204.538] GetSystemMetrics (nIndex=46) returned 2 [0204.538] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.538] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.538] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.538] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.589] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.589] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.589] GetLastError () returned 0x578 [0204.589] SetLastError (dwErrCode=0x578) [0204.589] CanUserWritePwrScheme () returned 1 [0204.589] GetSystemMetrics (nIndex=46) returned 2 [0204.589] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.589] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.589] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.589] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.595] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.595] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.595] GetLastError () returned 0x578 [0204.595] SetLastError (dwErrCode=0x578) [0204.595] CanUserWritePwrScheme () returned 1 [0204.595] GetSystemMetrics (nIndex=46) returned 2 [0204.595] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.595] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.595] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.595] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.600] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.600] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.600] GetLastError () returned 0x578 [0204.600] SetLastError (dwErrCode=0x578) [0204.600] CanUserWritePwrScheme () returned 1 [0204.601] GetSystemMetrics (nIndex=46) returned 2 [0204.601] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.601] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.601] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.601] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.606] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.606] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.606] GetLastError () returned 0x578 [0204.606] SetLastError (dwErrCode=0x578) [0204.606] CanUserWritePwrScheme () returned 1 [0204.606] GetSystemMetrics (nIndex=46) returned 2 [0204.606] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.606] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.606] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.607] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.611] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.611] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.611] GetLastError () returned 0x578 [0204.612] SetLastError (dwErrCode=0x578) [0204.612] CanUserWritePwrScheme () returned 1 [0204.612] GetSystemMetrics (nIndex=46) returned 2 [0204.612] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.612] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.612] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.612] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.617] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.617] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.617] GetLastError () returned 0x578 [0204.617] SetLastError (dwErrCode=0x578) [0204.617] CanUserWritePwrScheme () returned 1 [0204.617] GetSystemMetrics (nIndex=46) returned 2 [0204.617] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.617] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.617] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.617] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.622] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.622] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.622] GetLastError () returned 0x578 [0204.622] SetLastError (dwErrCode=0x578) [0204.622] CanUserWritePwrScheme () returned 1 [0204.623] GetSystemMetrics (nIndex=46) returned 2 [0204.623] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.623] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.623] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.623] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.628] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.628] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.628] GetLastError () returned 0x578 [0204.628] SetLastError (dwErrCode=0x578) [0204.628] CanUserWritePwrScheme () returned 1 [0204.628] GetSystemMetrics (nIndex=46) returned 2 [0204.628] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.628] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.628] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.628] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.633] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.633] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.633] GetLastError () returned 0x578 [0204.633] SetLastError (dwErrCode=0x578) [0204.633] CanUserWritePwrScheme () returned 1 [0204.633] GetSystemMetrics (nIndex=46) returned 2 [0204.633] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.634] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.634] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.634] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.641] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.641] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.641] GetLastError () returned 0x578 [0204.641] SetLastError (dwErrCode=0x578) [0204.641] CanUserWritePwrScheme () returned 1 [0204.641] GetSystemMetrics (nIndex=46) returned 2 [0204.641] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.642] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.642] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.642] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.646] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.646] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.646] GetLastError () returned 0x578 [0204.646] SetLastError (dwErrCode=0x578) [0204.646] CanUserWritePwrScheme () returned 1 [0204.647] GetSystemMetrics (nIndex=46) returned 2 [0204.647] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.647] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.647] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.647] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.652] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.652] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.652] GetLastError () returned 0x578 [0204.652] SetLastError (dwErrCode=0x578) [0204.652] CanUserWritePwrScheme () returned 1 [0204.652] GetSystemMetrics (nIndex=46) returned 2 [0204.652] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.652] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.652] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.652] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.657] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.657] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.657] GetLastError () returned 0x578 [0204.657] SetLastError (dwErrCode=0x578) [0204.657] CanUserWritePwrScheme () returned 1 [0204.658] GetSystemMetrics (nIndex=46) returned 2 [0204.658] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.658] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.658] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.658] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.662] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.662] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.662] GetLastError () returned 0x578 [0204.663] SetLastError (dwErrCode=0x578) [0204.663] CanUserWritePwrScheme () returned 1 [0204.663] GetSystemMetrics (nIndex=46) returned 2 [0204.663] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.663] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.663] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.663] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.734] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.734] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.734] GetLastError () returned 0x578 [0204.734] SetLastError (dwErrCode=0x578) [0204.734] CanUserWritePwrScheme () returned 1 [0204.734] GetSystemMetrics (nIndex=46) returned 2 [0204.734] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.734] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.734] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.734] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.741] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.741] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.741] GetLastError () returned 0x578 [0204.741] SetLastError (dwErrCode=0x578) [0204.741] CanUserWritePwrScheme () returned 1 [0204.742] GetSystemMetrics (nIndex=46) returned 2 [0204.742] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.742] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.742] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.742] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.747] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.747] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.747] GetLastError () returned 0x578 [0204.747] SetLastError (dwErrCode=0x578) [0204.747] CanUserWritePwrScheme () returned 1 [0204.747] GetSystemMetrics (nIndex=46) returned 2 [0204.747] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.747] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.747] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.747] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.752] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.752] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.752] GetLastError () returned 0x578 [0204.752] SetLastError (dwErrCode=0x578) [0204.752] CanUserWritePwrScheme () returned 1 [0204.753] GetSystemMetrics (nIndex=46) returned 2 [0204.753] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.753] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.753] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.753] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.758] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.758] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.758] GetLastError () returned 0x578 [0204.758] SetLastError (dwErrCode=0x578) [0204.758] CanUserWritePwrScheme () returned 1 [0204.759] GetSystemMetrics (nIndex=46) returned 2 [0204.759] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.759] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.759] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.759] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.764] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.764] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.764] GetLastError () returned 0x578 [0204.764] SetLastError (dwErrCode=0x578) [0204.764] CanUserWritePwrScheme () returned 1 [0204.764] GetSystemMetrics (nIndex=46) returned 2 [0204.764] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.764] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.764] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.765] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.769] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.769] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.769] GetLastError () returned 0x578 [0204.769] SetLastError (dwErrCode=0x578) [0204.769] CanUserWritePwrScheme () returned 1 [0204.770] GetSystemMetrics (nIndex=46) returned 2 [0204.770] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.770] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.770] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.770] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.775] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.775] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.775] GetLastError () returned 0x578 [0204.775] SetLastError (dwErrCode=0x578) [0204.775] CanUserWritePwrScheme () returned 1 [0204.775] GetSystemMetrics (nIndex=46) returned 2 [0204.775] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.775] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.775] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.775] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.781] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.781] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.781] GetLastError () returned 0x578 [0204.781] SetLastError (dwErrCode=0x578) [0204.781] CanUserWritePwrScheme () returned 1 [0204.781] GetSystemMetrics (nIndex=46) returned 2 [0204.781] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.781] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.781] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.781] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.786] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.786] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.786] GetLastError () returned 0x578 [0204.786] SetLastError (dwErrCode=0x578) [0204.786] CanUserWritePwrScheme () returned 1 [0204.787] GetSystemMetrics (nIndex=46) returned 2 [0204.787] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.787] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.787] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.787] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.794] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.794] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.794] GetLastError () returned 0x578 [0204.794] SetLastError (dwErrCode=0x578) [0204.794] CanUserWritePwrScheme () returned 1 [0204.795] GetSystemMetrics (nIndex=46) returned 2 [0204.795] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.795] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.795] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.795] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.800] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.800] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.800] GetLastError () returned 0x578 [0204.800] SetLastError (dwErrCode=0x578) [0204.800] CanUserWritePwrScheme () returned 1 [0204.800] GetSystemMetrics (nIndex=46) returned 2 [0204.800] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.800] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.800] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.800] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.805] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.805] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.805] GetLastError () returned 0x578 [0204.805] SetLastError (dwErrCode=0x578) [0204.805] CanUserWritePwrScheme () returned 1 [0204.805] GetSystemMetrics (nIndex=46) returned 2 [0204.805] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.805] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.806] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.806] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.926] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.926] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.926] GetLastError () returned 0x578 [0204.927] SetLastError (dwErrCode=0x578) [0204.927] CanUserWritePwrScheme () returned 1 [0204.927] GetSystemMetrics (nIndex=46) returned 2 [0204.927] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.927] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.927] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.927] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.932] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.932] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.932] GetLastError () returned 0x578 [0204.932] SetLastError (dwErrCode=0x578) [0204.932] CanUserWritePwrScheme () returned 1 [0204.933] GetSystemMetrics (nIndex=46) returned 2 [0204.933] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.933] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.933] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.933] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.940] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.940] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.940] GetLastError () returned 0x578 [0204.940] SetLastError (dwErrCode=0x578) [0204.940] CanUserWritePwrScheme () returned 1 [0204.940] GetSystemMetrics (nIndex=46) returned 2 [0204.940] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.940] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.940] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.940] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.945] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.945] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.945] GetLastError () returned 0x578 [0204.945] SetLastError (dwErrCode=0x578) [0204.945] CanUserWritePwrScheme () returned 1 [0204.946] GetSystemMetrics (nIndex=46) returned 2 [0204.946] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.946] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.946] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.946] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0204.951] GetWindowTextLengthA (hWnd=0x0) returned 0 [0204.951] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0204.951] GetLastError () returned 0x578 [0204.951] SetLastError (dwErrCode=0x578) [0204.951] CanUserWritePwrScheme () returned 1 [0204.951] GetSystemMetrics (nIndex=46) returned 2 [0204.951] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0204.951] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0204.951] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0204.951] waveOutSetVolume (hwo=0x0, dwVolume=0x0) returned 0x0 [0205.048] GetWindowTextLengthA (hWnd=0x0) returned 0 [0205.048] UuidFromStringA (in: StringUuid=0x445df0, Uuid=0x18f438 | out: Uuid=0x18f438) returned 0x6a9 [0205.049] GetLastError () returned 0x578 [0205.049] SetLastError (dwErrCode=0x578) [0205.049] CanUserWritePwrScheme () returned 1 [0205.049] GetSystemMetrics (nIndex=46) returned 2 [0205.049] GetStdHandle (nStdHandle=0xfffffff5) returned 0x0 [0205.049] mmioWrite (hmmio=0x0, pch=0x0, cch=0) returned -1 [0205.049] SetAbortProc (hdc=0x0, proc=0x4097c0) returned -1 [0205.049] waveOutSetVolume (hwo=0x0, dwVolume=0x0) Thread: id = 86 os_tid = 0x59c